From 0ae2c5c96e269483d06c23d4d59b84f25d4424a0 Mon Sep 17 00:00:00 2001 From: Anders Kaseorg Date: Tue, 29 Oct 2019 18:11:26 -0700 Subject: [PATCH] nginx: Enable TLS 1.3 if supported. Signed-off-by: Anders Kaseorg --- puppet/zulip/manifests/nginx.pp | 2 +- .../nginx/nginx.conf => templates/nginx.conf.template.erb} | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) rename puppet/zulip/{files/nginx/nginx.conf => templates/nginx.conf.template.erb} (90%) diff --git a/puppet/zulip/manifests/nginx.pp b/puppet/zulip/manifests/nginx.pp index 9d60811474..6e8fb4b088 100644 --- a/puppet/zulip/manifests/nginx.pp +++ b/puppet/zulip/manifests/nginx.pp @@ -65,7 +65,7 @@ class zulip::nginx { group => 'root', mode => '0644', notify => Service['nginx'], - source => 'puppet:///modules/zulip/nginx/nginx.conf', + content => template('zulip/nginx.conf.template.erb'), } file { '/etc/nginx/uwsgi_params': diff --git a/puppet/zulip/files/nginx/nginx.conf b/puppet/zulip/templates/nginx.conf.template.erb similarity index 90% rename from puppet/zulip/files/nginx/nginx.conf rename to puppet/zulip/templates/nginx.conf.template.erb index 27707461ca..cf2229f111 100644 --- a/puppet/zulip/files/nginx/nginx.conf +++ b/puppet/zulip/templates/nginx.conf.template.erb @@ -53,7 +53,11 @@ http { ssl_session_cache shared:SSL:50m; ssl_session_tickets off; ssl_dhparam /etc/nginx/dhparam.pem; +<% if scope["zulip::base::release_name"] == "stretch" or scope["zulip::base::release_name"] == "xenial" -%> ssl_protocols TLSv1.2; +<% else -%> + ssl_protocols TLSv1.2 TLSv1.3; +<% end -%> ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; ssl_stapling on;