From 88dc742f423968ebb6ca93ccfb3abc20b85feafd Mon Sep 17 00:00:00 2001
From: Wayne Witzel III <wayne@riotousliving.com>
Date: Fri, 9 Dec 2016 10:29:03 -0500
Subject: [PATCH] update uwsgi/nginx production configuration

---
 config/awx-nginx.conf | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/config/awx-nginx.conf b/config/awx-nginx.conf
index 3df3155ec8..a14dd036cf 100644
--- a/config/awx-nginx.conf
+++ b/config/awx-nginx.conf
@@ -24,12 +24,6 @@ http {
 
     sendfile        on;
     #tcp_nopush     on;
-
-    ssl_session_cache shared:SSL:10m;
-    ssl_session_timeout 10m;
-
-    keepalive_timeout  65;
-
     #gzip  on;
  
     upstream uwsgi {
@@ -42,16 +36,30 @@ http {
 
     server {
         listen 80 default_server;
+        listen [::]:80 default_server;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
         listen 443 default_server ssl;
 
         # If you have a domain name, this is where to add it
         server_name _;
-        keepalive_timeout 70;
+        keepalive_timeout 60;
 
         ssl_certificate /etc/tower/tower.cert;
         ssl_certificate_key /etc/tower/tower.key;
+        ssl_session_cache shared:SSL:50m;
+        ssl_session_timeout 1d;
+        ssl_session_tickets off;
+
+        # intermediate configuration
         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-        ssl_ciphers HIGH:!aNULL:!MD5;
+        ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
+        ssl_prefer_server_ciphers on;
+
+        # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
+        add_header Strict-Transport-Security max-age=15768000;
 
         location /favicon.ico { alias /var/lib/awx/public/static/favicon.ico; }
         location /static { alias /var/lib/awx/public/static; }
@@ -79,8 +87,10 @@ http {
         }      
 
         location / {
-            include /etc/nginx/uwsgi_params;
+            uwsgi_read_timeout 30s;
+            uwsgi_send_timeout 30s;
             uwsgi_pass uwsgi;
+            include /etc/nginx/uwsgi_params;
         }
     }
 }