diff --git a/docs/config.md b/docs/config.md index 9e8cef47..79f67804 100644 --- a/docs/config.md +++ b/docs/config.md @@ -467,11 +467,11 @@ or the root domain: # This config allows insecure HTTP POST/PUT requests against topics to allow a short curl syntax (without -L # and "https://" prefix). It also disables output buffering, which has worked well for the ntfy.sh server. # - # This is how ntfy.sh is configured. + # This is pretty much how ntfy.sh is configured. To see the exact configuration, + # see https://github.com/binwiederhier/ntfy-ansible/ server { listen 80; - listen [::]:80; server_name ntfy.sh; location / { @@ -510,17 +510,16 @@ or the root domain: server { listen 443 ssl http2; - listen [::]:443 ssl http2; server_name ntfy.sh; - ssl_session_cache builtin:1000 shared:SSL:10m; + # See https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6see https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6 ssl_session_timeout 1d; + ssl_session_cache shared:MozSSL:10m; # about 40000 sessions ssl_session_tickets off; - ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; - + ssl_certificate /etc/letsencrypt/live/ntfy.sh/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/ntfy.sh/privkey.pem; @@ -555,7 +554,6 @@ or the root domain: server { listen 80; - listen [::]:80; server_name ntfy.sh; location / { @@ -579,13 +577,12 @@ or the root domain: server { listen 443 ssl http2; - listen [::]:443 ssl http2; server_name ntfy.sh; - ssl_session_cache builtin:1000 shared:SSL:10m; + # See https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6see https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6 ssl_session_timeout 1d; + ssl_session_cache shared:MozSSL:10m; # about 40000 sessions ssl_session_tickets off; - ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; diff --git a/docs/releases.md b/docs/releases.md index 2f65a8bb..813bede4 100644 --- a/docs/releases.md +++ b/docs/releases.md @@ -5,6 +5,10 @@ and the [ntfy Android app](https://github.com/binwiederhier/ntfy-android/release ## ntfy server v1.30.1 Released December 23, 2022 🎅 +This is a special holiday edition version of ntfy, with all sorts of holiday fun and games, and hidden quests. +Nahh, just kidding. This release is an intermediate release mainly to eliminate warnings in the logs, so I can +roll out the TLSv1.3, HTTP/2 and Unix mode changes on ntfy.sh (see [#552](https://github.com/binwiederhier/ntfy/issues/552)). + **Features:** * Web: Generate random topic name button ([#453](https://github.com/binwiederhier/ntfy/issues/453), thanks to [@yardenshoham](https://github.com/yardenshoham)) @@ -15,6 +19,7 @@ Released December 23, 2022 🎅 * Remove `--env-topic` option from `ntfy publish` as per [deprecation](deprecations.md) (no ticket) * Prepared statements for message cache writes ([#542](https://github.com/binwiederhier/ntfy/pull/542), thanks to [@nicois](https://github.com/nicois)) * Do not warn about invalid IP address when behind proxy in unix socket mode (relates to [#552](https://github.com/binwiederhier/ntfy/issues/552)) +* Upgrade nginx/ntfy config on ntfy.sh to work with TLSv1.3, HTTP/2 ([#552](https://github.com/binwiederhier/ntfy/issues/552), thanks to [bt90](https://github.com/bt90)) ## ntfy Android app v1.16.0 Released December 11, 2022