Cleanup nginx configuration

[bwbroersma]

See the issues:

• Serve 404's on / requests for http://ns.test-ns-signed.internet.nl #1175
• www.-instance not 100% - missing HSTS #1210:

  Long term: cleanup the nginx file and make use of files to include default headers, so the same defaults are not repeated all over the file.

and PR's:

• WIP Nginx more specific server_name #1179
• Fix nginx config warnings #1187

So:

• de-duplicate all 'default' headers in separate files:

  • http.headers:
    

    Internet.nl/docker/webserver/nginx_templates/app.conf.template

    Lines 16 to 21 in f15c239

    	# default headers added to all responses
    	add_header 'X-Frame-Options' 'SAMEORIGIN' always;
    	add_header 'X-Content-Type-Options' 'nosniff' always;
    	add_header 'X-Clacks-Overhead' 'GNU Terry Pratchett' always;
    	add_header 'Referrer-Policy' 'same-origin' always;
    	add_header 'X-XSS-Protection' '1; mode=block' always;

  • hsts.header (maybe also use the recommended two year instead of the current one?):
    

    Internet.nl/docker/webserver/nginx_templates/app.conf.template

    Lines 169 to 171 in f15c239

    	# Do *not* add includeSubdomains before https://github.com/internetstandards/Internet.nl/issues/324 is resolved,
    	# adding includeSubdomains without adding the wildcard SSL certificates will otherwise break the connection test.
    	add_header 'Strict-Transport-Security' 'max-age=31536000;' always;

  • csp.header
    currently not in the nginx.conf, the csp.header.template should probably be:

    add_header Content-Security-Policy "base-uri 'self' https://*.${INTERNETNL_DOMAINNAME}; form-action 'self' https://*.${INTERNETNL_DOMAINNAME}; frame-ancestors 'none'; default-src 'self' https://*.${INTERNETNL_DOMAINNAME}";

  • could also have something like all.headers with:

    include http.headers;
    include hsts.header;
    include csp.header;

• don't quote nginx header names (but it might be a style choice to discuss?), this is valid:

  add_header X-Frame-Options SAMEORIGIN always;
  add_header X-Content-Type-Options nosniff always;
  add_header X-Clacks-Overhead 'GNU Terry Pratchett' always; 
  add_header Referrer-Policy same-origin always;
  add_header X-XSS-Protection '1; mode=block' always;
  
  add_header Strict-Transport-Security max-age=63072000 always;

• add regex save domain names (for nginx)

• fix all regex domains (WIP Nginx more specific server_name #1179)

• remove location regex where possible, e.g.:
  

  Internet.nl/docker/webserver/nginx_templates/app.conf.template

  Line 145 in f15c239

  location ~ /(.*) {

  
  can be simplified to location /

• set HSTS only in nginx (since it needs to be done in nginx, also doing it in django is an extra config)

  • remove django CSPMiddleware

    • Internet.nl/internetnl/settings.py

      Lines 53 to 54 in f15c239

      	CSP_DEFAULT_SRC = split_csv_trim(getenv("CSP_DEFAULT_SRC", "'self',*.internet.nl"))
      	CSP_BASE_URI = CSP_FORM_ACTION = CSP_DEFAULT_SRC

    • Internet.nl/internetnl/settings.py

      Line 189 in f15c239

      "csp.middleware.CSPMiddleware",

    • Internet.nl/internetnl/settings.py

      Line 193 in f15c239

      CSP_FRAME_ANCESTORS = "'none'"

  • remove CSP filtering in nginx

    • Internet.nl/docker/webserver/nginx_templates/app.conf.template

      Lines 68 to 69 in f15c239

      	# disable CSP on connection test
      	proxy_hide_header Content-Security-Policy;

    • Internet.nl/docker/webserver/nginx_templates/app.conf.template

      Lines 108 to 109 in f15c239

      	# disable CSP on connection test
      	proxy_hide_header Content-Security-Policy;