Differences

This shows you the differences between two versions of the page.

--- servers:linux:nginx_php_php-fpm [2026/01/07 02:58] – old revision restored (2026/01/04 14:27) Sean Rhone
+++ servers:linux:nginx_php_php-fpm [2026/06/03 00:27] (current) – [Let's Encrypt] more PQC Sean Rhone
@@ Line 14: / Line 14: @@
 ****
-  sudo zypper install git-core nginx php8-cli php8-fpm php8-opcache
+  sudo zypper install git-core nginx php8-cli php8-fpm
 ====== Information ======
@@ Line 34: / Line 34: @@
   sudo systemctl stop 'nginx' 'php-fpm'
-===== Start =====
-  sudo systemctl start 'nginx'
-  sudo systemctl start 'php-fpm'
 ====== Disable Defaults ======
@@ Line 47: / Line 41: @@
 ****
-  sudo mv '/etc/nginx/nginx.conf' '/etc/nginx/nginx.conf~'
+  sudo mv -fv '/etc/nginx/nginx.conf' '/etc/nginx/nginx.conf~'
 ===== PHP-FPM =====
@@ Line 53: / Line 47: @@
 ****
-  sudo mv '/etc/php8/fpm/php-fpm.d/www.conf' '/etc/php8/fpm/php-fpm.d/www.conf~'
+  sudo mv -fv '/etc/php8/fpm/php-fpm.d/www.conf' '/etc/php8/fpm/php-fpm.d/www.conf~'
 ===== Check Defaults =====
@@ Line 95: / Line 89: @@
 <code>
 server {
  listen '80' 'default_server';
  listen '[::]:80' 'default_server';
  return '301' 'https://$host$request_uri';
 }
@@ Line 113: / Line 105: @@
 <code>
 server {
  listen '443' 'ssl' 'default_server';
  http2 'on';
@@ Line 119: / Line 110: @@
  return '404';
 }
@@ Line 131: / Line 121: @@
 <code>
-add_header 'Strict-Transport-Security' 'max-age=63072000; includeSubdomains; preload' 'always';
+ add_header 'Strict-Transport-Security' 'max-age=63072000; includeSubdomains; preload' 'always';
-add_header 'X-Content-Type-Options' 'nosniff' 'always';
+ add_header 'X-Content-Type-Options' 'nosniff' 'always';
-add_header 'X-Frame-Options' 'sameorigin' 'always';
+ add_header 'X-Frame-Options' 'sameorigin' 'always';
-add_header 'X-XSS-Protection' '1; mode=block' 'always';
+ add_header 'X-XSS-Protection' '1; mode=block' 'always';
-add_header 'Cache-Control' 'no-store, no-transform, public' 'always';
+ add_header 'Cache-Control' 'max-age=604800, no-transform, public' 'always';
-add_header 'Referrer-Policy' 'same-origin' 'always';
+ add_header 'Referrer-Policy' 'same-origin' 'always';
-add_header 'Expect-CT' 'max-age=0' 'always';
+ add_header 'Expect-CT' 'max-age=0' 'always';
-add_header 'Permissions-Policy' 'geolocation=(), microphone=(), payment=(), usb=(), vr=(), magnetometer=(), midi=(), camera=(), ambient-light-sensor=(), accelerometer=()' 'always';
+ add_header 'Permissions-Policy' 'geolocation=(), microphone=(), payment=(), usb=(), vr=(), magnetometer=(), midi=(), camera=(), ambient-light-sensor=(), accelerometer=()' 'always';
 # End</code>
@@ Line 153: / Line 143: @@
 #error_log '/var/log/nginx/error.log';
+error_log '/dev/null';
 http {
- # Logging
  #log_format main '$time_local - $http_host - $remote_addr - $status "$request" $body_bytes_sent - $http_referer - "$http_user_agent"';
  #access_log '/var/log/nginx/access.log main';
@@ Line 162: / Line 152: @@
  access_log '/dev/null';
- # Includes
  include '/etc/nginx/conf.d/*.conf';
  include '/etc/nginx/vhosts.d/*.conf';
@@ Line 168: / Line 157: @@
  default_type 'application/octet-stream';
- # Config
  sendfile 'on';
  tcp_nopush 'on';
@@ Line 175: / Line 163: @@
  types_hash_max_size '4096';
- # gzip
  gzip 'on';
  gzip_vary 'on';
@@ Line 189: / Line 176: @@
   * The empty CSP allows all and can be useful for new site bring-ups, and should be placed in site-specific configs underneath the ''include'' line(s)
-<code>    add_header Content-Security-Policy "default-src 'self'" always;</code>
+<code>add_header Content-Security-Policy "default-src 'self'" always;</code>
-<code>    add_header Content-Security-Policy "" always;</code>
+<code>add_header Content-Security-Policy "" always;</code>
 ====== SSL Certs ======
@@ Line 202: / Line 189: @@
 <code>
-ssl_certificate '/etc/letsencrypt/live/realmofespionage.xyz/fullchain.pem';
+ ssl_certificate '/etc/letsencrypt/live/realmofespionage.xyz/fullchain.pem';
-ssl_trusted_certificate '/etc/letsencrypt/live/realmofespionage.xyz/fullchain.pem';
+ ssl_trusted_certificate '/etc/letsencrypt/live/realmofespionage.xyz/fullchain.pem';
-ssl_certificate_key '/etc/letsencrypt/live/realmofespionage.xyz/privkey.pem';
+ ssl_certificate_key '/etc/letsencrypt/live/realmofespionage.xyz/privkey.pem';
-ssl_session_timeout '10m';
+ ssl_session_timeout '10m';
-ssl_session_cache 'shared:SSL:10m';
+ ssl_session_cache 'shared:SSL:10m';
-ssl_session_tickets 'off';
+ ssl_session_tickets 'off';
-ssl_buffer_size '4k';
+ ssl_buffer_size '4k';
-ssl_protocols 'TLSv1.2' 'TLSv1.3';
+ ssl_protocols 'TLSv1.2' 'TLSv1.3';
-ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM';
+ ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM';
-ssl_prefer_server_ciphers 'on';
+ ssl_prefer_server_ciphers 'on';
-ssl_ecdh_curve 'secp384r1';
+ ssl_ecdh_curve 'secp384r1:SecP384r1MLKEM1024:SecP256r1MLKEM768:X25519MLKEM768';
 # End</code>
@@ Line 239: / Line 226: @@
   * https://scotthelme.co.uk
   * https://mozilla.github.io/server-side-tls/ssl-config-generator
-  * [[https://www.ssllabs.com/ssltest/analyze.html?d=wiki.realmofespionage.xyz|Qualys SSL Test]]
   * https://fedoraproject.org/wiki/Nginx