Posts on My Tech Blog

Nginx SSL Config

Sun, 07 May 2023 20:00:00 +0200

Nginx config for A+ grade SSL labs by Qualys

Here is my to-go config for any internet facing config with grade A+ on Qualys ssllabs.

server {
 listen 443 ssl; # managed by Certbot
 listen [::]:443 ssl; # managed by Certbot
 server_name example.com; # managed by Certbot

 http2 on;

 ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
 ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
 ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

 # HSTS (ngx_http_headers_module is required) (2 years)
 add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains; preload' always;

 #include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
 ssl_session_cache shared:le_nginx_SSL:10m;
 ssl_session_timeout 1440m;
 ssl_session_tickets off;
 
 ssl_protocols TLSv1.2 TLSv1.3;

 ssl_prefer_server_ciphers on;
 ssl_ecdh_curve secp521r1:secp384r1;
 ssl_ciphers EECDH+AESGCM:EECDH+AES256;

 # OCSP stapling
 ssl_stapling on;
 ssl_stapling_verify on;
 resolver 127.0.0.1; # or other DNS server

 root /var/www/html/;
 
 location ~ /\.ht { deny all; }
 
 location / {
 # First attempt to serve request as file, then
 # as directory, then fall back to displaying a 404.
 try_files $uri $uri/ =404;
 }

 index index.html index.htm index.nginx-debian.html;

}
server {
 if ($host = example.com) {
 return 301 https://$host$request_uri;
 } # managed by Certbot

 listen 80;
 listen [::]:80;
 server_name example.com;
 return 404; # managed by Certbot
}

Pass and multiple contexts

Mon, 17 Apr 2023 20:20:20 +0200

Work and Personal password store

pass the standard unix password manager stores passwords in one directory (default one is ~/.password-store). You can create another seprate store by running following command:

$ PASSWORD_STORE_DIR=$HOME/.path/to/another/store pass init pgp@key.id

New password stores can contain new set of gpg keys.

For quicker access to new store without using (reverse-i-search) you can create an alias

$ alias personal_pass='PASSWORD_STORE_DIR=/home/username/.path/to/another/store pass'

Or create a script in folder that is in your $PATH
~/.local/bin/personal_pass:

Pass and multiple computers

Mon, 17 Apr 2023 20:00:00 +0200

Synchronization by git

pass the standard unix password manager can be synchronized by a git. If you don’t have store yet inicialize it. Inicialization of git is simple as well.

$ pass init pgp@key.id
$ pass git init

After this all password changes make a new commit, to update or get latest data from remote you can use following commands.

$ pass git push
$ pass git pull