78 lines
3.1 KiB
Text
78 lines
3.1 KiB
Text
# =============================================================================
|
|
# Alliance Boréale — vhost nginx (site statique)
|
|
# À déposer sur web-frontal-01 dans /etc/nginx/sites-available/, puis lier
|
|
# dans sites-enabled/. Sert le contenu statique de /var/www/alliance-boreale.
|
|
#
|
|
# sudo ln -s /etc/nginx/sites-available/alliance-boreale.conf \
|
|
# /etc/nginx/sites-enabled/alliance-boreale.conf
|
|
# sudo nginx -t && sudo systemctl reload nginx
|
|
#
|
|
# Adapter : server_name, chemins des certificats TLS, racine si besoin.
|
|
# =============================================================================
|
|
|
|
# --- Redirection HTTP -> HTTPS ---------------------------------------------
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name alliance-boreale.ca www.alliance-boreale.ca;
|
|
|
|
# Laisser passer les défis ACME si vous en utilisez un :
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/alliance-boreale;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
|
|
# --- Site HTTPS -------------------------------------------------------------
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name alliance-boreale.ca www.alliance-boreale.ca;
|
|
|
|
root /var/www/alliance-boreale;
|
|
index index.html;
|
|
|
|
# --- TLS (adapter les chemins : step-ca interne, Let's Encrypt, etc.) ---
|
|
ssl_certificate /etc/ssl/alliance-boreale/fullchain.pem;
|
|
ssl_certificate_key /etc/ssl/alliance-boreale/privkey.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:AB_TLS:10m;
|
|
|
|
# --- En-têtes de sécurité (site statique, sans pistage) ----------------
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
|
|
# Tout le contenu est local : pas de CDN, pas de tiers.
|
|
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
|
|
# Décommenter une fois le HTTPS stabilisé sur le domaine :
|
|
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
# --- Compression --------------------------------------------------------
|
|
gzip on;
|
|
gzip_types text/css application/javascript text/html image/svg+xml;
|
|
gzip_min_length 1024;
|
|
|
|
# --- Cache des actifs statiques ----------------------------------------
|
|
location /assets/ {
|
|
expires 7d;
|
|
add_header Cache-Control "public";
|
|
}
|
|
|
|
# --- Routage ------------------------------------------------------------
|
|
location / {
|
|
try_files $uri $uri/ $uri.html =404;
|
|
}
|
|
|
|
error_page 404 /404.html;
|
|
|
|
# Pas de logs d'accès nominatifs au-delà du nécessaire (sobriété/vie privée).
|
|
access_log /var/log/nginx/alliance-boreale.access.log;
|
|
error_log /var/log/nginx/alliance-boreale.error.log;
|
|
}
|