3 ms·
Just skimmed through it, and most of this seems to revolve around hardening, not performance, and most of the hardening seems questionable at best. Some of the
by vegardx 8y ago
Just skimmed through it, and most of this seems to revolve around hardening, not performance, and most of the hardening seems questionable at best. Some of the headers that is suggested have some implications that aren't really explained at all. Like HSTS including sub-domains.
And you don't set the `default_server` as this document suggest. `default_server` is a parameter to the `listen`-directive. The only reason the docs might work is because the first server-block defined, when no-one is defined as `default_server`, becomes the default server.
server {
listen 80 default_server;
return 444;
}
This will close the connection and log it internally, for any domain that isn't defined in Nginx.
Edit: Shout-out to #nginx on FreeNode, where you'll always find someone to point you i the right directing or help you out.
- deleted 8y ago[deleted]
- trimstray 8y ago"and most of the hardening seems questionable at best." - Don't do this, please add rationale, not bullshit. "Some of the headers that is suggested have some implications that aren't really explained at all. Like HSTS including sub-domains." - This repo also contain "Force all connections over TLS". However, I understand your attention. "And you don't set the `default_server` as this document suggest. `default_server` is a parameter to the `listen`-directive. The only reason the docs might work is because the first server-block defined, when no-one is defined as `default_server`, becomes the default server." - You're right, your suggestion is very well (it's also from Nginx official handbook) and rationale, thanks for this! I receive this criticism, My mistake.