Better configure the site for improved security

[hnarayanan]

Particularly to improve the site's rating at: https://securityheaders.io

[hnarayanan]

https://diogomonica.com/2015/12/29/from-double-f-to-double-a/ https://sethvargo.com/getting-an-a-plus-on-qualys-ssl-labs-tester/

[hnarayanan]

server {
    ssl_session_tickets off;
}

[hnarayanan]

https://scotthelme.co.uk/hpkp-http-public-key-pinning/

[hnarayanan]

Improve the security of the certificates generated by Let's Encrypt:

security:
  Security parameters & server settings

  --rsa-key-size N      Size of the RSA key. (default: 2048)
  --must-staple         Adds the OCSP Must Staple extension to the
                        certificate. Autoconfigures OCSP Stapling for
                        supported setups (Apache version >= 2.3.3 ). (default:
                        False)
  --redirect            Automatically redirect all HTTP traffic to HTTPS for
                        the newly authenticated vhost. (default: Ask)
  --no-redirect         Do not automatically redirect all HTTP traffic to
                        HTTPS for the newly authenticated vhost. (default:
                        Ask)
  --hsts                Add the Strict-Transport-Security header to every HTTP
                        response. Forcing browser to always use SSL for the
                        domain. Defends against SSL Stripping. (default:
                        False)
  --uir                 Add the "Content-Security-Policy: upgrade-insecure-
                        requests" header to every HTTP response. Forcing the
                        browser to use https:// for every http:// resource.
                        (default: None)
  --staple-ocsp         Enables OCSP Stapling. A valid OCSP response is
                        stapled to the certificate that the server offers
                        during TLS. (default: None)
  --strict-permissions  Require that all configuration files are owned by the
                        current user; only needed if your config is somewhere
                        unsafe like /tmp/ (default: False)

[hnarayanan]

• [ ] Consider making the nginx configuration more DRY by re-using a generated snippet from Let's Encrypt: options-ssl-nginx.conf