better tls config

1 files changed, 6 insertions, 0 deletions

diff --git a/custom/ymir-nginx.nix b/custom/ymir-nginx.nix
index 9c98d2ab..fd7d7e94 100644
--- a/custom/ymir-nginx.nix
+++ b/custom/ymir-nginx.nix
@@ -68,6 +68,12 @@ in {
       access_log stderr;
       error_log stderr;
 
+      ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+      ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
+      ssl_prefer_server_ciphers on;
+      ssl_session_cache shared:SSL:10m;
+      ssl_dhparam /etc/ssl/dhparam.pem;
+
       server {
         listen *:80;
         listen [::]:80;