From fa7b74cf51e2b5c7c60aaf3ec529ba2292450d7b Mon Sep 17 00:00:00 2001
From: Jason Snell <jason@newrelic.com>
Date: Tue, 4 Apr 2017 18:43:21 -0700
Subject: [PATCH] SSL best practices for nginx

---
 docs/Running-Mastodon/Production-guide.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/docs/Running-Mastodon/Production-guide.md b/docs/Running-Mastodon/Production-guide.md
index b1f7bd35b..d539ddf64 100644
--- a/docs/Running-Mastodon/Production-guide.md
+++ b/docs/Running-Mastodon/Production-guide.md
@@ -11,10 +11,22 @@ map $http_upgrade $connection_upgrade {
   ''      close;
 }
 
+server {
+  listen 80;
+  listen [::]:80;
+  server_name example.com;
+  return 301 https://$host$request_uri;
+}
+
 server {
   listen 443 ssl;
   server_name example.com;
 
+  ssl_protocols TLSv1.2;
+  ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
+  ssl_prefer_server_ciphers on;
+  ssl_session_cache shared:SSL:10m;
+
   ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;