From 1dd59831f80ff4d49f3b60c8c3b2aabfb1512eeb Mon Sep 17 00:00:00 2001 From: Rigel Kent Date: Sat, 2 Jun 2018 13:41:38 +0200 Subject: [PATCH] (docker) making security settings of traefik on par with nginx --- support/docker/production/config/traefik.toml | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/support/docker/production/config/traefik.toml b/support/docker/production/config/traefik.toml index 775a26515..882c95548 100644 --- a/support/docker/production/config/traefik.toml +++ b/support/docker/production/config/traefik.toml @@ -7,6 +7,29 @@ defaultEntryPoints = ["http", "https"] [entryPoints.https] address = ":443" [entryPoints.https.tls] + MinVersion = "VersionTLS12" + CurvePreferences = [ + "CurveP521", + "CurveP384", + "CurveP256" + ] + PreferServerCipherSuites = true + CipherSuites = [ + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", + "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", + "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", + "TLS_RSA_WITH_AES_256_GCM_SHA384", + "TLS_RSA_WITH_AES_256_CBC_SHA" + ] + FrameDeny = false # here we don't want to deny frames since we have an embed + STSIncludeSubdomains = true + STSSeconds = 315360000 + STSPreload = true + ContentTypeNosniff = true + BrowserXssFilter = true + # Enable ACME (Let's Encrypt): automatic SSL. [acme] -- 2.25.1