Add nginx config snippets.

extra/hsts.conf

@@ -0,0 +1,13 @@
+# Enables HTTP Strict Transport Security (HSTS) which instructs browsers to
+# always request the resource over HTTPS, preventing a stripping/downgrade
+# attack.
+
+http {
+
+    map $scheme $hsts_header {
+        https   max-age=31536000;
+    }
+
+    add_header Strict-Transport-Security $hsts_header;
+
+}

extra/redirect-http.conf

@@ -0,0 +1,13 @@
+# Redirects all default HTTP traffic to HTTPS.
+
+server {
+
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    server_name _;
+
+    return 301 https://$host$request_uri;
+
+}
+

extra/security.conf

@@ -0,0 +1,20 @@
+# General security-related directives.
+
+http {
+
+    # Don't offer up information about the version of Nginx we use
+    server_tokens      off;
+
+    # Don't allow other websites to present our content in a frame/iframe.
+    # This mitigates clickjacking attacks.
+    add_header         X-Frame-Options "SAMEORIGIN";
+
+    # Don't allow browsers to try and sniff content types. This prevents
+    # malicious user-generated content being misinterpreted.
+    add_header         X-Content-Type-Options "nosniff";
+
+    # Enable XSS protection, if browsers don't already have it enabled
+    # by default.
+    add_header         X-XSS-Protection "1; mode=block";
+
+}

extra/ssl.conf

@@ -0,0 +1,30 @@
+# Values here are based on Mozilla's "Modern compatibility" configuration.
+# https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
+#
+# NB: This configuration severely limits older browsers and configurations.
+# Specifically, the following are the oldest supported versions:
+#
+#  * Firefox 27
+#  * Chrome 30
+#  * IE 11 on Windows 7
+#  * Edge
+#  * Opera 17
+#  * Safari 9
+#  * Android 5.0
+#  * Java 8 
+#
+# Older browsers or platforms won't be able to negotiate a connection.
+
+http {
+
+    ssl_protocols               TLSv1.2;
+    ssl_ciphers                 "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256";
+    ssl_prefer_server_ciphers   on;
+    ssl_session_timeout         1d;
+    ssl_session_cache           shared:SSL:50m;
+    ssl_session_tickets         off;
+    ssl_stapling                on;
+    ssl_stapling_verify         on;
+    resolver                    8.8.8.8;
+
+}