diff --git a/element/README.md b/element/README.md index e69de29..fe4848f 100644 --- a/element/README.md +++ b/element/README.md @@ -0,0 +1,17 @@ +# Scoring + +## SSL Labs +![alt text](./scoring/SSL_Labs.png?raw=true) + +## Mozilla Observatory +![alt text](./scoring/Mozilla_Observatory.png?raw=true) + +# Additional Score Commentary: + +## Mozilla Observatory +Current CSP requires the use of unsafe-eval due to WASM. + + +The relevant issue can be found at: https://github.com/vector-im/element-web/issues/12262, and has a relevant issue in the dotnet development found at: https://github.com/dotnet/aspnetcore/issues/37787 + +This scores a -10 in Mozilla Observatory. diff --git a/element/element.theschricks.com.conf b/element/element.theschricks.com.conf new file mode 100644 index 0000000..d6c9d07 --- /dev/null +++ b/element/element.theschricks.com.conf @@ -0,0 +1,53 @@ +#HTTPS +server { + + root /var/www/element.theschricks.com/element-latest; + + index index.html; + + server_name element.theschricks.com; + + location / { + try_files $uri $uri/ =404; + } + + client_max_body_size 512m; + + listen [::]:443 ssl; # managed by Certbot + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/element.theschricks.com/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/element.theschricks.com/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + + + add_header X-XSS-Protection "1; mode=block"; + add_header X-Content-Type-Options nosniff; + add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload'; + add_header X-Robots-Tag none; + add_header X-Frame-Options "SAMEORIGIN"; + add_header Referrer-Policy "strict-origin"; + add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()"; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + + #return 301 https://$host$request_uri; +} + +#HTTP +server { + listen 80; + listen [::]:80; + server_name element.theschricks.com www.element.theschricks.com; + return 301 https://$host$request_uri; +} + +#Redirect www +server { + listen 443 ssl; + listen [::]:443 ssl; + server_name www.element.theschricks.com; + return 301 https://$host$request_uri; +} diff --git a/element/scoring/Mozilla_Observatory.png b/element/scoring/Mozilla_Observatory.png new file mode 100644 index 0000000..e43caf9 Binary files /dev/null and b/element/scoring/Mozilla_Observatory.png differ diff --git a/element/scoring/SSL_Labs.png b/element/scoring/SSL_Labs.png new file mode 100644 index 0000000..866f9d5 Binary files /dev/null and b/element/scoring/SSL_Labs.png differ