From 85a2aafcdfd6acf336d9188420519056040dd382 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Wed, 14 Sep 2022 11:03:44 +0200 Subject: [PATCH] ghostwheel42's suggestions --- core/nginx/conf/nginx.conf | 2 +- core/nginx/config.py | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/core/nginx/conf/nginx.conf b/core/nginx/conf/nginx.conf index e772bf41..8fcaef26 100644 --- a/core/nginx/conf/nginx.conf +++ b/core/nginx/conf/nginx.conf @@ -317,7 +317,7 @@ mail { ssl_certificate /certs/letsencrypt/live/mailu/fullchain.pem; ssl_certificate /certs/letsencrypt/live/mailu-ecdsa/fullchain.pem; {% endif %} - {% if TLS_PERMISSIVE == 'true' %} + {% if TLS_PERMISSIVE %} ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA; ssl_prefer_server_ciphers on; diff --git a/core/nginx/config.py b/core/nginx/config.py index 6afde510..e9c4b50e 100755 --- a/core/nginx/config.py +++ b/core/nginx/config.py @@ -9,6 +9,8 @@ args = os.environ.copy() log.basicConfig(stream=sys.stderr, level=args.get("LOG_LEVEL", "WARNING")) +args['TLS_PERMISSIVE'] = str(args.get('TLS_PERMISSIVE')).lower() not in ('false', 'no') + # Get the first DNS server with open("/etc/resolv.conf") as handle: content = handle.read().split()