Improve SSL settings in Nginx conf.

[shaliko]

Re-created from #236 but now from right fork.

Set up strong SSL security on the Nginx webserver. This way we have a strong and future proof ssl configuration and we get an A+ on the Qually Labs SSL Test.

Example: https://www.ssllabs.com/ssltest/analyze.html?d=nightly.umbrella.apinf.io (A+)

Example of api-umbrella.yml:

nginx:
  server_names_hash_bucket_size: 128
  dhparam: /etc/ssl/private/dhparams.pem
  ssl_session_cache: "shared:SSL:10m"
  ssl_ciphers: "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
  ssl_protocols: "TLSv1 TLSv1.1 TLSv1.2"
hosts:
  - hostname: example.com
    default: true
    ssl_cert: /etc/keys/example.com/fullchain.pem
    ssl_cert_key: /etc/keys/example.com/privkey.pem
    http_strict_transport_security: "max-age=31536000; includeSubDomains; preload"

This request based on instructions and tutorials:

• https://wiki.mozilla.org/Security/Server_Side_TLS
• https://cipherli.st/ (https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html)
• https://github.com/h5bp/server-configs-nginx

That changes related to #24, #234

/cc @brylie @GUI

[GUI]

Thanks you! I'll try to take a look at this later this week.

[GUI]

🌟 Thanks again!

I've just made some small tweaks to how the default values get applied, so we don't need the conditionals in the template: dbefef9 Hope that makes sense.

[shaliko]

@GUI The idea of default values in was keep it optional in "api-umbrella.yml" for few reasons:

1. You always get "A" rating with default values when you upgrade api-umbrella on new version. Rating "A" with current config is not constant, as example tomorrow can be found some vulnerability in cipher "EECDH+AESGCM" and we will start get rating "B" with the same config. When we have defaults you just need get last version of api-umbrella and issue will be fixed. Of course you always have a way for override defaults. But if you have required settings in "api-umbrella.yml", you need care about keep up to date SSL config himself.
2. Existing user no need do anything with "api-umbrella.yml" after upgrade on last version. But with new code dbefef9 they must have add new settings to "api-umbrella.yml".

I am OK with changes, just shared original ideas.

[GUI]

Quick heads up: v0.12.0 packages have been released, which includes this update.