path: root/satellit_installer/static_files/lighttpd-auto-ssl.sh

#!/bin/sh

CERT="/etc/lighttpd/server.pem"
CHAIN="/etc/lighttpd/chain.pem"
DHPARAM="/etc/lighttpd/dhparam.pem"
if ! [ -s "$DHPARAM" ]; then
	openssl dhparam -out "$DHPARAM" 2048 >/dev/null 2>&1
fi

[ -s "$CERT" ] || exit 0

cat <<HEREDOC
\$SERVER["socket"] == ":443" {
	protocol	 = "https://"
	ssl.engine   = "enable"
	ssl.disable-client-renegotiation = "enable"

	# pemfile is cert+privkey, ca-file is the intermediate chain in one file
	ssl.pemfile			   = "$CERT"

	# ECDH/ECDHE ciphers curve strength (see "openssl ecparam -list_curves")
	ssl.ec-curve			  = "secp384r1"
	# Compression is by default off at compile-time, but use if needed
	# ssl.use-compression	 = "disable"

	# Environment flag for HTTPS enabled
	setenv.add-environment = (
		"HTTPS" => "on"
	)

	# intermediate configuration, tweak to your needs
	ssl.use-sslv2 = "disable"
	ssl.use-sslv3 = "disable"
	ssl.honor-cipher-order	= "enable"
	ssl.cipher-list		   = "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"

	# HSTS(15768000 seconds = 6 months)
	setenv.add-response-header  = (
		"Strict-Transport-Security" => "max-age=15768000;"
	)
HEREDOC
[ -s "$CHAIN" ] && echo "	ssl.ca-file = \"$CHAIN\""
[ -s "$DHPARAM" ] && echo "	ssl.dh-file          = \"$DHPARAM\""
echo "}"

exit 0