c79c11c2b7
So that we can run jitsi-meet with local modifications, build our own container images. This builds the base, prosody, and web images from the docker-jitsi-meet project. That project has distinct Dockerfiles for each image, but for simplicity, this change combines them into a single multi-stage Dockerfile. The minor stylistic differences between the different sections are a result of that, and are intentional in order to minimise the delta from the source material. Again, for simplicity, this change does not publish the base image since it is not anticipated that we will run this build often. If we do, we could split this back out. The upstream images are based on pre-built debian packages hosted by the jitsi project. Since our goal is to modify the software, we will need to rebuild the debian packages as well. This adds a new builder image that is used to build the debian packages initially. The docker-jitsi-meet project also has Dockerfiles for several more images, but since the immediate need is only for the "web" image (built from the "jitsi-meet" project), we only build that image and the "prosody" image (not strictly necessary, but it is also a product of the "jisti-meet" repository, so it seems a good practice to build it as well). Change-Id: Ib3177ebfe2b8732a3522a1fa101fe95586dd1e1b
28 lines
1.3 KiB
Plaintext
28 lines
1.3 KiB
Plaintext
# session settings
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:SSL:50m;
|
|
ssl_session_tickets off;
|
|
|
|
# Diffie-Hellman parameter for DHE cipher suites
|
|
ssl_dhparam /config/nginx/dhparams.pem;
|
|
|
|
# ssl certs
|
|
{{ if .Env.ENABLE_LETSENCRYPT | default "0" | toBool }}
|
|
ssl_certificate /etc/letsencrypt/live/{{ .Env.LETSENCRYPT_DOMAIN }}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/{{ .Env.LETSENCRYPT_DOMAIN }}/privkey.pem;
|
|
{{ else }}
|
|
ssl_certificate /config/keys/cert.crt;
|
|
ssl_certificate_key /config/keys/cert.key;
|
|
{{ end }}
|
|
|
|
# protocols
|
|
ssl_protocols TLSv1.2;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_ecdh_curve secp384r1;
|
|
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDH+CHACHA20:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK;
|
|
|
|
# headers
|
|
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
|
|
add_header X-Content-Type-Options nosniff;
|
|
add_header X-XSS-Protection "1; mode=block";
|