deploy: enable trusted HTTPS IP endpoint

2026-08-26 10:04:01 +08:00
parent c3975babf1
commit ea90cac50c
6 changed files with 43 additions and 5 deletions
@@ -1,9 +1,23 @@
 server {
    listen 80;
    server_name _;
+    return 301 https://121.41.46.238$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name 121.41.46.238;
    server_tokens off;
    client_max_body_size 256m;

+    ssl_certificate /etc/letsencrypt/live/121.41.46.238/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/121.41.46.238/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+
+    add_header Strict-Transport-Security "max-age=31536000" always;
+
    proxy_http_version 1.1;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Host $http_host;
@@ -46,4 +60,3 @@ server {
        proxy_pass http://web:8080;
    }
 }
-