move TLS configuration into nginx.conf

1 files changed, 20 insertions, 3 deletions

diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index eb3d6fe6..a38bea44 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -22,6 +22,20 @@ http {
     ssl_protocols TLSv1.2 TLSv1.3;
     ssl_prefer_server_ciphers on;
 
+    ssl_certificate /etc/letsencrypt/live/grapheneos.org/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/grapheneos.org/privkey.pem;
+    ssl_dhparam /etc/nginx/ssl-dhparams.pem;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+    ssl_trusted_certificate /etc/letsencrypt/live/grapheneos.org/chain.pem;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    # maintained by certbot-ocsp-fetcher
+    ssl_stapling_file /etc/nginx/ocsp-cache/grapheneos.org.der;
+
     access_log /var/log/nginx/access.log;
     error_log /var/log/nginx/error.log;
 
@@ -39,7 +53,8 @@ http {
     }
 
     server {
-        include /etc/nginx/snippets/https.conf;
+        listen 443 ssl http2;
+        listen [::]:443 ssl http2;
         server_name www.grapheneos.org;
 
         root /var/empty;
@@ -50,7 +65,8 @@ http {
     }
 
     server {
-        include /etc/nginx/snippets/https.conf;
+        listen 443 ssl http2;
+        listen [::]:443 ssl http2;
         server_name grapheneos.org;
 
         root /var/www/html;
@@ -165,7 +181,8 @@ http {
     }
 
     server {
-        include /etc/nginx/snippets/https.conf;
+        listen 443 ssl http2;
+        listen [::]:443 ssl http2;
         server_name mta-sts.grapheneos.org mta-sts.mail.grapheneos.org;
 
         root /var/www/mta-sts;