Download as
Browse Code »

Commit ce1e7c03994295c72307f8bbd4d799fde9e9701b

Authored by Jacob Vosmaer
1 parent abad0f11
Exists in master and in 3 other branches 7-2-stable, 7-2-stable-ee, nginx_ssl_tweaks

Set Nginx ssl_protocols and ssl_session_cache

Showing 2 changed files with 4 additions and 0 deletions   Show diff stats
files/gitlab-cookbooks/gitlab/attributes/default.rb
  Diff comments   View file @ce1e7c0
@@ -248,6 +248,8 @@ default['gitlab']['nginx']['ssl_certificate'] = "/etc/gitlab/ssl/#{node['fqdn']} @@ -248,6 +248,8 @@ default['gitlab']['nginx']['ssl_certificate'] = "/etc/gitlab/ssl/#{node['fqdn']}
248 default['gitlab']['nginx']['ssl_certificate_key'] = "/etc/gitlab/ssl/#{node['fqdn']}.key" 248 default['gitlab']['nginx']['ssl_certificate_key'] = "/etc/gitlab/ssl/#{node['fqdn']}.key"
249 default['gitlab']['nginx']['ssl_ciphers'] = "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4" 249 default['gitlab']['nginx']['ssl_ciphers'] = "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4"
250 default['gitlab']['nginx']['ssl_prefer_server_ciphers'] = "on" 250 default['gitlab']['nginx']['ssl_prefer_server_ciphers'] = "on"
  251 +default['gitlab']['nginx']['ssl_protocols'] = "TLSv1 TLSv1.1 TLSv1.2" # recommended by https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
  252 +default['gitlab']['nginx']['ssl_session_cache'] = "shared:SSL:10m" # recommended in http://nginx.org/en/docs/http/ngx_http_ssl_module.html
251 default['gitlab']['nginx']['listen_address'] = '*' 253 default['gitlab']['nginx']['listen_address'] = '*'
252 254
253 ### 255 ###
files/gitlab-cookbooks/gitlab/templates/default/nginx-gitlab-http.conf.erb
  Diff comments   View file @ce1e7c0
@@ -46,6 +46,8 @@ server { @@ -46,6 +46,8 @@ server {
46 ssl_certificate_key <%= @ssl_certificate_key %>; 46 ssl_certificate_key <%= @ssl_certificate_key %>;
47 ssl_ciphers '<%= @ssl_ciphers %>'; 47 ssl_ciphers '<%= @ssl_ciphers %>';
48 ssl_prefer_server_ciphers <%= @ssl_prefer_server_ciphers %>; 48 ssl_prefer_server_ciphers <%= @ssl_prefer_server_ciphers %>;
  49 + ssl_protocols <%= @ssl_protocols %>;
  50 + ssl_session_cache <%= @ssl_session_cache %>;
49 <% end %> 51 <% end %>
50 52
51 # Increase this if you want to upload large attachments 53 # Increase this if you want to upload large attachments