4 # Generate strong Diffie-Hellman parameters
5 - "mkdir -p /shared/ssl/"
7 filename: "/etc/nginx/conf.d/discourse.conf"
12 return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
17 filename: "/etc/nginx/conf.d/discourse.conf"
18 from: /listen 80;\s+gzip on;/m
21 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
22 ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA;
23 ssl_prefer_server_ciphers on;
24 ssl_ecdh_curve secp384r1;
26 ssl_certificate /shared/ssl/ssl.crt;
27 ssl_certificate_key /shared/ssl/ssl.key;
29 ssl_session_tickets off;
30 ssl_session_timeout 1d;
31 ssl_session_cache shared:SSL:1m;
35 add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
36 add_header Referrer-Policy 'no-referrer-when-downgrade';
38 if ($http_host != $$ENV_DISCOURSE_HOSTNAME) {
39 rewrite (.*) https://$$ENV_DISCOURSE_HOSTNAME$1 permanent;