From 207894dac63155ab8e15a7e4ecd08817fe9d1396 Mon Sep 17 00:00:00 2001 From: bt90 Date: Thu, 22 Dec 2022 19:41:06 +0100 Subject: [PATCH 1/4] docs: improve nginx config --- docs/config.md | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/docs/config.md b/docs/config.md index f91054a0..8092c436 100644 --- a/docs/config.md +++ b/docs/config.md @@ -508,13 +508,17 @@ or the root domain: } server { - listen 443 ssl; + listen 443 ssl http2; + listen [::]:443 ssl http2; server_name ntfy.sh; ssl_session_cache builtin:1000 shared:SSL:10m; + ssl_session_timeout 1d; + ssl_session_tickets off; + ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4; - ssl_prefer_server_ciphers on; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; ssl_certificate /etc/letsencrypt/live/ntfy.sh/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/ntfy.sh/privkey.pem; @@ -572,13 +576,17 @@ or the root domain: } server { - listen 443 ssl; + listen 443 ssl http2; + listen [::]:443 ssl http2; server_name ntfy.sh; ssl_session_cache builtin:1000 shared:SSL:10m; + ssl_session_timeout 1d; + ssl_session_tickets off; + ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4; - ssl_prefer_server_ciphers on; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; ssl_certificate /etc/letsencrypt/live/ntfy.sh/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/ntfy.sh/privkey.pem; From 632d013fb84f7856784aa26823b3884acb2e69c1 Mon Sep 17 00:00:00 2001 From: bt90 Date: Thu, 22 Dec 2022 19:45:44 +0100 Subject: [PATCH 2/4] Fix IPv6 HTTP listen --- docs/config.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/config.md b/docs/config.md index 8092c436..9e8cef47 100644 --- a/docs/config.md +++ b/docs/config.md @@ -471,6 +471,7 @@ or the root domain: server { listen 80; + listen [::]:80; server_name ntfy.sh; location / { @@ -554,6 +555,7 @@ or the root domain: server { listen 80; + listen [::]:80; server_name ntfy.sh; location / { From 5e7657fc40f5680e228ebc9500857083e57b1a95 Mon Sep 17 00:00:00 2001 From: binwiederhier Date: Fri, 23 Dec 2022 20:52:22 -0500 Subject: [PATCH 3/4] SSL config in docs --- docs/config.md | 17 +++++++---------- docs/releases.md | 5 +++++ 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/docs/config.md b/docs/config.md index 9e8cef47..79f67804 100644 --- a/docs/config.md +++ b/docs/config.md @@ -467,11 +467,11 @@ or the root domain: # This config allows insecure HTTP POST/PUT requests against topics to allow a short curl syntax (without -L # and "https://" prefix). It also disables output buffering, which has worked well for the ntfy.sh server. # - # This is how ntfy.sh is configured. + # This is pretty much how ntfy.sh is configured. To see the exact configuration, + # see https://github.com/binwiederhier/ntfy-ansible/ server { listen 80; - listen [::]:80; server_name ntfy.sh; location / { @@ -510,17 +510,16 @@ or the root domain: server { listen 443 ssl http2; - listen [::]:443 ssl http2; server_name ntfy.sh; - ssl_session_cache builtin:1000 shared:SSL:10m; + # See https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6see https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6 ssl_session_timeout 1d; + ssl_session_cache shared:MozSSL:10m; # about 40000 sessions ssl_session_tickets off; - ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; - + ssl_certificate /etc/letsencrypt/live/ntfy.sh/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/ntfy.sh/privkey.pem; @@ -555,7 +554,6 @@ or the root domain: server { listen 80; - listen [::]:80; server_name ntfy.sh; location / { @@ -579,13 +577,12 @@ or the root domain: server { listen 443 ssl http2; - listen [::]:443 ssl http2; server_name ntfy.sh; - ssl_session_cache builtin:1000 shared:SSL:10m; + # See https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6see https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6 ssl_session_timeout 1d; + ssl_session_cache shared:MozSSL:10m; # about 40000 sessions ssl_session_tickets off; - ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; diff --git a/docs/releases.md b/docs/releases.md index 2f65a8bb..813bede4 100644 --- a/docs/releases.md +++ b/docs/releases.md @@ -5,6 +5,10 @@ and the [ntfy Android app](https://github.com/binwiederhier/ntfy-android/release ## ntfy server v1.30.1 Released December 23, 2022 🎅 +This is a special holiday edition version of ntfy, with all sorts of holiday fun and games, and hidden quests. +Nahh, just kidding. This release is an intermediate release mainly to eliminate warnings in the logs, so I can +roll out the TLSv1.3, HTTP/2 and Unix mode changes on ntfy.sh (see [#552](https://github.com/binwiederhier/ntfy/issues/552)). + **Features:** * Web: Generate random topic name button ([#453](https://github.com/binwiederhier/ntfy/issues/453), thanks to [@yardenshoham](https://github.com/yardenshoham)) @@ -15,6 +19,7 @@ Released December 23, 2022 🎅 * Remove `--env-topic` option from `ntfy publish` as per [deprecation](deprecations.md) (no ticket) * Prepared statements for message cache writes ([#542](https://github.com/binwiederhier/ntfy/pull/542), thanks to [@nicois](https://github.com/nicois)) * Do not warn about invalid IP address when behind proxy in unix socket mode (relates to [#552](https://github.com/binwiederhier/ntfy/issues/552)) +* Upgrade nginx/ntfy config on ntfy.sh to work with TLSv1.3, HTTP/2 ([#552](https://github.com/binwiederhier/ntfy/issues/552), thanks to [bt90](https://github.com/bt90)) ## ntfy Android app v1.16.0 Released December 11, 2022 From 73e8f955cac0d2c80cf73e0b6af6fba4e1ffa394 Mon Sep 17 00:00:00 2001 From: binwiederhier Date: Fri, 23 Dec 2022 20:54:58 -0500 Subject: [PATCH 4/4] Changelog --- docs/releases.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/releases.md b/docs/releases.md index 813bede4..5d69ffd8 100644 --- a/docs/releases.md +++ b/docs/releases.md @@ -2,6 +2,12 @@ Binaries for all releases can be found on the GitHub releases pages for the [ntfy server](https://github.com/binwiederhier/ntfy/releases) and the [ntfy Android app](https://github.com/binwiederhier/ntfy-android/releases). +## ntfy server v1.31.0 (UNRELEASED) + +**Documentation:** + +* Add HTTP/2 and TLSv1.3 support to nginx docs ([#553](https://github.com/binwiederhier/ntfy/issues/553), thanks to [bt90](https://github.com/bt90)) + ## ntfy server v1.30.1 Released December 23, 2022 🎅