# NGINX General NGINX configuration # Realip ==================================================================================== 1. Ensure that the nginx 'ngx\_http\_realip\_module' is installed: ``` nginx -V 2>&1 | grep --color -o 'http_realip_module' ``` 2\. Create a new file, for example `/etc/nginx/cloudflare.conf`, and add the list of Cloudflare IPs to it: ``` set_real_ip_from 103.21.244.0/22; set_real_ip_from 103.22.200.0/22; set_real_ip_from 103.31.4.0/22; set_real_ip_from 104.16.0.0/13; set_real_ip_from 104.24.0.0/14; set_real_ip_from 108.162.192.0/18; set_real_ip_from 131.0.72.0/22; set_real_ip_from 141.101.64.0/18; set_real_ip_from 162.158.0.0/15; set_real_ip_from 172.64.0.0/13; set_real_ip_from 173.245.48.0/20; set_real_ip_from 188.114.96.0/20; set_real_ip_from 190.93.240.0/20; set_real_ip_from 197.234.240.0/22; set_real_ip_from 198.41.128.0/17; set_real_ip_from 199.27.128.0/21; set_real_ip_from 2400:cb00::/32; set_real_ip_from 2606:4700::/32; set_real_ip_from 2803:f800::/32; set_real_ip_from 2405:b500::/32; set_real_ip_from 2405:8100::/32; set_real_ip_from 2a06:98c0::/29; set_real_ip_from 2c0f:f248::/32; real_ip_header CF-Connecting-IP; ``` 3\. Add an 'include' statement to the nginx.conf file: Add the following line inside the `http` block, alongside your existing `include` directives: ``` include       /etc/nginx/cloudflare.conf; ``` 4\. Test and reload nginx ==================================================================================== # Security options, headers, ciphers, and TLS settings. ==================================================================================== ### Security Options and Headers ------------------------------------------------------------------------------------------------------------------------------------------------ ### SSL/TLS Settings Define SSL certificate in vhost: ``` ssl_certificate /etc/nginx/ssl/your-domain.com.crt; ssl_certificate_key /etc/nginx/ssl/your-domain.com.key; ``` Enable TLS 1.2 and 1.3: ``` ssl_protocols TLSv1.2 TLSv1.3; ``` Force usage of ciphers in order of most secure to least: ``` ssl_prefer_server_ciphers on;  ``` Define SSL ciphers for nginx to use: ``` ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256'; ``` ==================================================================================== ### Headers ------------------------------------------------------------------------------------------------------------------------------------------------ ##### HSTS HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking.. It allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections, and never via the insecure HTTP protocol. HSTS can be enabled globally in the nginx.conf file, or on a per site bases. ``` add_header Strict-Transport-Security "max-age=63072000; includeSubdomains;" ``` ------------------------------------------------------------------------------------------------------------------------------------------------ ##### X-Content-Type-Options Prevents MIME-sniffing attacks where browsers may override the declared content type of a resource. `nosniff`: Instructs the browser not to sniff the MIME type and to use the content type as declared in the `Content-Type` header. ``` add_header X-Content-Type-Options "nosniff" always; ``` ------------------------------------------------------------------------------------------------------------------------------------------------ ##### X-Frame-Options Prevents clickjacking attacks by controlling whether your site can be embedded in a frame or iframe. `DENY`: Prevents any site from framing your content. `SAMEORIGIN`: Allows framing only from the same origin. ``` add_header X-Frame-Options "DENY" always; ``` ------------------------------------------------------------------------------------------------------------------------------------------------ ##### X-XSS-Protection
Enables the Cross-Site Scripting (XSS) filter built into modern web browsers.
`1; mode=block`: Activates the XSS filter and instructs the browser to block the response if an XSS attack is detected.
``` add_header X-XSS-Protection "1; mode=block" always; ```
------------------------------------------------------------------------------------------------------------------------------------------------
Referrer-Policy
Controls how much referrer information is included with requests.
`no-referrer-when-downgrade`: Sends the full URL as a referrer to requests going to the same origin or a less secure destination (HTTP to HTTPS).
``` add_header Referrer-Policy "no-referrer-when-downgrade" always; ```
====================================================================================