Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

Improve HSTS header

Browse source 
- always set the header to make it hopefully appear on redirect as well
  (https://fedorahosted.org/fedora-infrastructure/ticket/2888#comment:11)
- set preload, to make it more likely that subdomains can be
  added to preload list
This commit is contained in:
Till Maas 2015-02-04 11:44:35 +01:00
parent 49e1e87d10
commit e67081afe1
3 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
roles/anitya/frontend/files/0_releasemonitoring.conf
View file

@ -9,7 +9,7 @@
SSLEngine on SSLEngine on
SSLProtocol all -SSLv2 -SSLv3 SSLProtocol all -SSLv2 -SSLv3
# Use secure TLSv1.1 and TLSv1.2 ciphers # Use secure TLSv1.1 and TLSv1.2 ciphers
Header add Strict-Transport-Security "max-age=15768000" Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
SSLCertificateFile /etc/pki/tls/certs/release-monitoring.org.cert SSLCertificateFile /etc/pki/tls/certs/release-monitoring.org.cert
SSLCertificateChainFile /etc/pki/tls/certs/release-monitoring.org.intermediate.cert SSLCertificateChainFile /etc/pki/tls/certs/release-monitoring.org.intermediate.cert

2
roles/copr/frontend/files/httpd/coprs_ssl.conf
View file

@ -4,7 +4,7 @@
# Use secure TLSv1.1 and TLSv1.2 ciphers # Use secure TLSv1.1 and TLSv1.2 ciphers
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5 SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5
SSLHonorCipherOrder on SSLHonorCipherOrder on
Header add Strict-Transport-Security "max-age=15768000" Header always add Strict-Transport-Security "max-age=15768000; preload"
SSLCertificateFile /etc/pki/tls/ca.crt SSLCertificateFile /etc/pki/tls/ca.crt
SSLCertificateKeyFile /etc/pki/tls/private/ca.key SSLCertificateKeyFile /etc/pki/tls/private/ca.key

2
roles/httpd/reverseproxy/templates/reversepassproxy.id.conf
View file

@ -26,7 +26,7 @@ RewriteRule ^([a-z0-9-]+)\.id\.fedoraproject\.org/.* {{proxyurl}}/openid/id/$1/
RewriteCond %{HTTPS} off RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L] RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L]
Header add Strict-Transport-Security "max-age=15768000" Header always add Strict-Transport-Security "max-age=15768000; preload"
RewriteRule ^(.+) - [PT] RewriteRule ^(.+) - [PT]