Docker SSL NGINX: ปรับแต่ง NGINX SSL configuration ให้ได้ A+ [ล่าสุด 2023]

.nginx-docker/
|____docker-compose.yaml
|____nginx/
| |____nginx.conf
| |____ssl/
| | |____coppers_io.key
| | |____coppers_io.pem
| |____conf.d/
|   |____vhost-coppers_io.conf
|____public/
  |____index.php

$ docker pull nginx
$ docker pull php:7.2-fpm-alpine

version: "2"
services:
  # Nginx webserver
  nginx:
    image: nginx:latest
    restart: always
    volumes:
      - ./nginx/nginx.conf:/etc/nginx.conf:ro
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
    ports:
      - "80:80"
      - "443:443"
    volumes_from:
      - php

  # PHP-FPM for compile .php file
  php:
    image: php:7.2-fpm-alpine
    restart: always
    volumes:
      - ./public:/var/www/html

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
  worker_connections  1024;
}

http {
  include       /etc/nginx/mime.types;
  default_type  application/octet-stream;
  log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
  access_log  /var/log/nginx/access.log  main;
  sendfile        on;
  #tcp_nopush     on;
  keepalive_timeout  65;
  client_max_body_size 10M;

  # SSL Settings
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_ecdh_curve secp384r1;
  ssl_buffer_size 4k;

  # Optimize session cache
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 4h;

  # Enable session tickets
  ssl_session_tickets off;

  # OCSP Stapling
  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /etc/nginx/ssl/trustchain.pem;
  resolver 8.8.8.8 8.8.4.4 valid=300s;
  resolver_timeout 5s;

  # Security headers
  add_header X-Frame-Options "SAMEORIGIN" always;
  add_header X-XSS-Protection "1; mode=block" always;
  add_header X-Content-Type-Options "nosniff" always;
  add_header Referrer-Policy "no-referrer-when-downgrade" always;
  add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
  # Enable HSTS
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

  include /etc/nginx/conf.d/*.conf;
}

server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    server_name coppers.io www.coppers.io;

    ssl_certificate /etc/nginx/ssl/coppers_io.pem;
    ssl_certificate_key /etc/nginx/ssl/coppers_io.key;

    root /var/www/html;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php {
        fastcgi_index index.php;
        fastcgi_pass php:9000;

        include fastcgi_params;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name coppers.io www.coppers.io;
    return 301 https://www.coppers.io$request_uri;
}

$ docker-compose up -d

$ docker-compose ps