summaryrefslogtreecommitdiff
path: root/nginx
AgeCommit message (Collapse)Author
2023-02-09reduce sendfile max chunk to 256kDaniel Micay
2023-02-09avoid unnecessary ACME challenge redirectsDaniel Micay
2023-02-09unify HTTP redirect server blocksDaniel Micay
2023-02-09use default HTTP/2 input buffer sizeDaniel Micay
2023-01-31simplify nginx status pathDaniel Micay
2023-01-17rebase onto current nginx mime.typesDaniel Micay
2023-01-05SSH commit signing will be used going forwardDaniel Micay
2022-12-15add empty traffic-advice configurationDaniel Micay
2022-11-01update Permissions-Policy for web installerDaniel Micay
2022-10-18Update device imagesmdyv
This is a vectorized image of the Pixel 7 Pro, and saves 98 % of the byte length of the previously used image.
2022-10-12increase resolver timeoutDaniel Micay
2022-10-11disable bluetooth in Permissions PolicyDaniel Micay
2022-10-11disable keyboard-map in Permissions PolicyDaniel Micay
2022-10-11disable local-fonts in Permissions PolicyDaniel Micay
2022-10-01rename conn limit memory zoneDaniel Micay
2022-09-27use custom format for access log againDaniel Micay
2022-09-26enable caching for Matrix discovery APIDaniel Micay
2022-09-26reduce HTTP/2 chunk size to match TLS record sizeDaniel Micay
2022-09-25use syslog (journald) for nginx access logDaniel Micay
2022-09-24reduce keepalive requestsDaniel Micay
2022-09-24reduce connection limit to 128Daniel Micay
2022-09-24reduce HTTP/2 concurrent streams to 16Daniel Micay
2022-09-24reduce max client header buffer sizeDaniel Micay
2022-08-25remove legacy Expect-CT headerDaniel Micay
2022-08-25no longer need location block for PDFsDaniel Micay
2022-08-25redirect legacy counterclaim document to historyDaniel Micay
The purpose of this document was to respond to false claims from James Donaldson about myself and GrapheneOS. He changed his story about what happened many times since this was posted. He didn't move forward with his attempt at taking us to court and this was never used beyond being posted on our site as a public response. Nearly all of his supporters realized he was misleading them and left for greener pastures. Most of them are now using GrapheneOS. We don't need to refute outdated attacks on GrapheneOS from a person that's now almost completely irrelevant, especially since he's now trying not to draw attention to this since he came out looking so terrible. He quietly misleads people about what happened with his latest historical revisions and those are countered better by our newer pages summarizing it.
2022-08-25Add "Origin-Agent-Cluster" headerRohan Kumar
Hint to browsers that we prefer per-origin process isolation. This disables certain unsafe features regarding cross-origin same-site resource sharing. https://web.dev/origin-agent-cluster/#limitations Specification link: https://html.spec.whatwg.org/multipage/origin.html#origin-keyed-agent-clusters This is just a hint to browsers. Depending on resource availability, they may or may not actually allocate a process. For this reason, it's not a robust security feature although it is preferable. This header needs to be active on all pages from an origin for it to work.
2022-08-25move nginx status API to socketDaniel Micay
2022-06-27configuration style fixesDaniel Micay
2022-06-26use standard GrapheneOS mime.typesDaniel Micay
2022-06-10raise expected nginx versionDaniel Micay
2022-05-12RFC 9239 obsoletes application/javascriptDaniel Micay
2022-05-03enable thread pool AIO supportDaniel Micay
2022-05-03drop configuration for clearing legacy push cookieDaniel Micay
2022-05-02add resolver setup to baseline configurationDaniel Micay
2022-04-30disable traditional stateful TLS session cacheDaniel Micay
This is useless for TLSv1.3 since there's no longer any distinction in the protocol based on whether the server is using stateless or stateful session resumption. OpenSSL has a non-standard anti-replay mechanism for 0-RTT based on stateful session resumption but 0-RTT still ends up being a downgrade for the TLS security properties. nginx disables that feature since otherwise 0-RTT wouldn't work with the default stateless approach. Since this cache is only used for TLSv1.2 when stateless resumption isn't disabled and nearly all TLSv1.2 clients support tickets, it isn't getting any significant use. It provides worse forward secrecy than tickets because we implement ticket key rotation based on the expiry time and sessions aren't actively purged from the stateful cache when they expire. Cached session state varies in size and nginx ends up writing errors to the log when clearing out a session fails to make room for a new one due to it being larger. It's best to finally get rid of this flawed approach to session resumption. TLSv1.3 provides the option of forward secrecy for resumed sessions and it's the only approach that's normally enabled so we don't need to worry about this anymore once TLSv1.2 is disabled as long as we never enable 0-RTT which weakens forward secrecy and other security properties.
2022-04-18add gamepad and speaker-selection to permissions policyJune
Signed-off-by: June <zanthed@riseup.net>
2022-04-17use IPv6 only for internal nginx status serviceDaniel Micay
2022-03-06add transparent Zcash donation addressDaniel Micay
2022-02-19extend redirect.js preload / push to /install/Daniel Micay
2022-02-19set up preload and push for redirect.jsDaniel Micay
2022-02-19simplify configurationDaniel Micay
2022-02-01avoid redirect for double slash in parametersDaniel Micay
2022-01-27add grapheneos.dev domainDaniel Micay
2022-01-13workaround for odd CSP semantics in Chromium 97Daniel Micay
2022-01-03improve approach to redundant slash redirectionDaniel Micay
Since merge_slashes gets rid of the redundant slashes, a no-op rewrite will get rid of all of them at once instead of requiring one redirect to get rid of each redundant slash.
2021-12-11rename push cookie for clarityDaniel Micay
2021-12-11add preload/push for main page phone imageDaniel Micay
2021-12-10set charset in Content-Type header for CSS tooDaniel Micay
2021-12-10disable legacy X-XSS-Protection featureDaniel Micay
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-18 20:06:58 +0000