From fca558568875a99bd9aed4db6527e08b2de2e238 Mon Sep 17 00:00:00 2001 From: VC Date: Fri, 16 May 2025 16:54:03 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92:=20upgrade=20TLS=20conf?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- roles/nginx/templates/nginx.ssl.conf.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/nginx/templates/nginx.ssl.conf.j2 b/roles/nginx/templates/nginx.ssl.conf.j2 index acad5b2..5d93ccf 100644 --- a/roles/nginx/templates/nginx.ssl.conf.j2 +++ b/roles/nginx/templates/nginx.ssl.conf.j2 @@ -3,7 +3,7 @@ # ANY MODIFICATION IS LIKELY TO BE ERASED ########## ssl_session_timeout 1d; - ssl_session_cache shared:SSL:50m; + ssl_session_cache shared:SSL:10m; ssl_session_tickets off; # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits @@ -11,7 +11,7 @@ # intermediate configuration. tweak to your needs. ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305; ssl_prefer_server_ciphers off; # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)