diff --git a/doc/09_troyito-com.txt b/doc/09_troyito-com.txt new file mode 100644 index 0000000..d25fd47 --- /dev/null +++ b/doc/09_troyito-com.txt @@ -0,0 +1,21 @@ + +cp troyito.com.conf.bootstrap \ + /etc/nginx/sites-available/troyito.com.conf + +cd /etc/nginx/sites-enabled +ln -s /etc/nginx/sites-available/troyito.com.conf 09troyito.com.conf +cd - + +nginx -t +systemctl restart nginx + +certbot --nginx \ + -d troyito.com,www.troyito.com \ + --agree-tos -m "hostmaster@troyito.com" --no-eff-email \ + --deploy-hook "systemctl reload nginx" + +cp troyito.com.conf /etc/nginx/sites-available/troyito.com.conf + +nginx -t +systemctl restart nginx + diff --git a/etc/nginx/sites-available/troyito.com.conf b/etc/nginx/sites-available/troyito.com.conf new file mode 100644 index 0000000..710600e --- /dev/null +++ b/etc/nginx/sites-available/troyito.com.conf @@ -0,0 +1,87 @@ +# troyito.com +# www.troyito.com + +server { + server_name troyito.com; + root /var/xyzzy/html/troyito; + index index.html; + + location / { + try_files $uri $uri/ =404; + } + + listen [::]:443 ssl; # managed by Certbot + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/troyito.com/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/troyito.com/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + + # https://ssl-config.mozilla.org/ + add_header Strict-Transport-Security "max-age=15724800" always; + + # https://observatory.mozilla.org + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-Content-Type-Options "nosniff"; + add_header X-XSS-Protection "1; mode=block"; + add_header Referrer-Policy "strict-origin-when-cross-origin"; + add_header Content-Security-Policy "default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self';"; +} + +server { + server_name www.troyito.com; + root /var/xyzzy/html/troyito; + index index.html; + + location ~ /\.well-known { + allow all; + } + + location ~ / { + return 301 $scheme://troyito.com$request_uri; + } + + listen [::]:443 ssl; # managed by Certbot + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/troyito.com/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/troyito.com/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + + # https://ssl-config.mozilla.org/ + add_header Strict-Transport-Security "max-age=15724800" always; + + # https://observatory.mozilla.org + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-Content-Type-Options "nosniff"; + add_header X-XSS-Protection "1; mode=block"; + add_header Referrer-Policy "strict-origin-when-cross-origin"; + add_header Content-Security-Policy "default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self';"; +} + +server { + if ($host = troyito.com) { + return 301 https://$host$request_uri; + } # managed by Certbot + + listen 80; + listen [::]:80; + server_name troyito.com; + root /var/xyzzy/html/troyito; + index index.html; + return 404; # managed by Certbot +} + +server { + if ($host = www.troyito.com) { + return 301 https://$host$request_uri; + } # managed by Certbot + + listen 80; + listen [::]:80; + server_name www.troyito.com; + root /var/xyzzy/html/troyito; + index index.html; + return 404; # managed by Certbot +} + diff --git a/etc/nginx/sites-available/troyito.com.conf.bootstrap b/etc/nginx/sites-available/troyito.com.conf.bootstrap new file mode 100644 index 0000000..6d25059 --- /dev/null +++ b/etc/nginx/sites-available/troyito.com.conf.bootstrap @@ -0,0 +1,30 @@ +# troyito.com +# www.troyito.com + +server { + listen 80; + listen [::]:80; + server_name troyito.com; + root /var/xyzzy/html/troyito; + index index.html; + + location / { + try_files $uri $uri/ =404; + } +} + +server { + listen 80; + listen [::]:80; + server_name www.troyito.com; + root /var/xyzzy/html/troyito; + index index.html; + + location ~ /\.well-known { + allow all; + } + + location ~ / { + return 301 $scheme://troyito.com$request_uri; + } +} diff --git a/html/troyito/.well-known/security.txt b/html/troyito/.well-known/security.txt new file mode 100644 index 0000000..358e363 --- /dev/null +++ b/html/troyito/.well-known/security.txt @@ -0,0 +1 @@ +Contact: https://troyito.com diff --git a/html/troyito/divtable.css b/html/troyito/divtable.css new file mode 100644 index 0000000..1e16b77 --- /dev/null +++ b/html/troyito/divtable.css @@ -0,0 +1,35 @@ +/* +