oier/ulicraft-server-v1
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(nginx): enforce HTTPS-only with HSTS

Browse Source 
Add Strict-Transport-Security (max-age 1y, includeSubDomains) to every TLS
server block in both vhost templates. Combined with the existing port-80
301 redirect, browsers refuse plain HTTP to these names after first visit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Oier Bravo
2026-06-09 01:21:17 +02:00
parent 3185fea4c1
commit a6155819b6
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
nginx/ulicraft-caddy.conf.tmpl
View File

@@ -46,6 +46,7 @@ server {
ssl_certificate ${APP_DIR}/certs/${BASE_DOMAIN}/cert.pem; ssl_certificate ${APP_DIR}/certs/${BASE_DOMAIN}/cert.pem;
ssl_certificate_key ${APP_DIR}/certs/${BASE_DOMAIN}/key.pem; ssl_certificate_key ${APP_DIR}/certs/${BASE_DOMAIN}/key.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
client_max_body_size 4m; # skin uploads (auth) reuse the same proxy block client_max_body_size 4m; # skin uploads (auth) reuse the same proxy block
@@ -66,6 +67,7 @@ server {
ssl_certificate ${APP_DIR}/certs/www.${BASE_DOMAIN}/cert.pem; ssl_certificate ${APP_DIR}/certs/www.${BASE_DOMAIN}/cert.pem;
ssl_certificate_key ${APP_DIR}/certs/www.${BASE_DOMAIN}/key.pem; ssl_certificate_key ${APP_DIR}/certs/www.${BASE_DOMAIN}/key.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
return 301 https://${BASE_DOMAIN}$request_uri; return 301 https://${BASE_DOMAIN}$request_uri;
} }
@@ -77,6 +79,7 @@ server {
ssl_certificate ${APP_DIR}/certs/auth.${BASE_DOMAIN}/cert.pem; ssl_certificate ${APP_DIR}/certs/auth.${BASE_DOMAIN}/cert.pem;
ssl_certificate_key ${APP_DIR}/certs/auth.${BASE_DOMAIN}/key.pem; ssl_certificate_key ${APP_DIR}/certs/auth.${BASE_DOMAIN}/key.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
client_max_body_size 4m; # skin uploads client_max_body_size 4m; # skin uploads
@@ -96,6 +99,7 @@ server {
ssl_certificate ${APP_DIR}/certs/pack.${BASE_DOMAIN}/cert.pem; ssl_certificate ${APP_DIR}/certs/pack.${BASE_DOMAIN}/cert.pem;
ssl_certificate_key ${APP_DIR}/certs/pack.${BASE_DOMAIN}/key.pem; ssl_certificate_key ${APP_DIR}/certs/pack.${BASE_DOMAIN}/key.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
location / { location / {
proxy_pass http://ulicraft_caddy; proxy_pass http://ulicraft_caddy;
@@ -113,6 +117,7 @@ server {
ssl_certificate ${APP_DIR}/certs/distribution.${BASE_DOMAIN}/cert.pem; ssl_certificate ${APP_DIR}/certs/distribution.${BASE_DOMAIN}/cert.pem;
ssl_certificate_key ${APP_DIR}/certs/distribution.${BASE_DOMAIN}/key.pem; ssl_certificate_key ${APP_DIR}/certs/distribution.${BASE_DOMAIN}/key.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
location / { location / {
proxy_pass http://ulicraft_caddy; proxy_pass http://ulicraft_caddy;

3
nginx/ulicraft.conf.tmpl
View File

@@ -34,6 +34,7 @@ server {
ssl_certificate ${APP_DIR}/certs/${BASE_DOMAIN}/cert.pem; ssl_certificate ${APP_DIR}/certs/${BASE_DOMAIN}/cert.pem;
ssl_certificate_key ${APP_DIR}/certs/${BASE_DOMAIN}/key.pem; ssl_certificate_key ${APP_DIR}/certs/${BASE_DOMAIN}/key.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# Launcher downloads (populated by tooling/fetch-launcher.sh -> ./mirror/launcher). # Launcher downloads (populated by tooling/fetch-launcher.sh -> ./mirror/launcher).
location /launcher/ { location /launcher/ {
@@ -56,6 +57,7 @@ server {
ssl_certificate ${APP_DIR}/certs/pack.${BASE_DOMAIN}/cert.pem; ssl_certificate ${APP_DIR}/certs/pack.${BASE_DOMAIN}/cert.pem;
ssl_certificate_key ${APP_DIR}/certs/pack.${BASE_DOMAIN}/key.pem; ssl_certificate_key ${APP_DIR}/certs/pack.${BASE_DOMAIN}/key.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# Locally-hosted custom mod jars live outside ./pack; expose them at /custom/. # Locally-hosted custom mod jars live outside ./pack; expose them at /custom/.
location /custom/ { location /custom/ {
@@ -77,6 +79,7 @@ server {
ssl_certificate ${APP_DIR}/certs/auth.${BASE_DOMAIN}/cert.pem; ssl_certificate ${APP_DIR}/certs/auth.${BASE_DOMAIN}/cert.pem;
ssl_certificate_key ${APP_DIR}/certs/auth.${BASE_DOMAIN}/key.pem; ssl_certificate_key ${APP_DIR}/certs/auth.${BASE_DOMAIN}/key.pem;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
client_max_body_size 4m; # skin uploads client_max_body_size 4m; # skin uploads