Article URL: https://gagliardoni.net/#20260724_codeberg_drama Comments URL: https://news.ycombinator.com/item?id=49034928 Points: 28 # Comments: 18

SSLCipherSuite TLS_AES_256_GCM_SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256 SSLCompression off SSLHonorCipherOrder on SSLProtocol -all +TLSv1.2 +TLSv1.3 SSLUseStapling on SSLStaplingCache "shmcb:logs/stapling-cache(150000)" SSLSessionTickets off <VirtualHost 1.2.3.4:80> ServerAdmin admin@mysite.net ServerName www.mysite.net ServerAlias mysite.net *.mysite.net # Redirect permanent / https://mysite.net/ DocumentRoot /var/www/mysite.net <Directory /> Order Deny,Allow Options -Indexes AllowOverride None </Directory> ErrorLog ${APACHE_LOG_DIR}/error.log LogLevel warn CustomLog ${APACHE_LOG_DIR}/access.log combined Header set X-XSS-Protection "1; mode=block" Header always append X-Frame-Options DENY Header set X-Content-Type-Options nosniff </VirtualHost> <VirtualHost 1.2.3.4:443> ServerAdmin admin@mysite.net ServerName www.mysite.net ServerAlias mysite.net *.mysite.net DocumentRoot /var/www/mysite.net # SSLEngine on # SSLCertificateKeyFile /etc/ssl/letsencrypt/mysite.net/key.pem # SSLCertificateFile /etc/ssl/letsencrypt/mysite.net/fullchain.pem # <If "%{HTTP_HOST} == 'www.mysite.net'"> # Redirect permanent / https://mysite.net/ # </If> <Directory /> Order Deny,Allow Options -Indexes AllowOverride None </Directory> ErrorLog ${APACHE_LOG_DIR}/error.log LogLevel warn CustomLog ${APACHE_LOG_DIR}/access.log combined Header set X-XSS-Protection "1; mode=block" Header always append X-Frame-Options DENY Header set X-Content-Type-Options nosniff </VirtualHost> acme.sh --issue -d mysite.net -d www.mysite.net -w /var/www/mysite.net --keylength 4096 acme.sh --install-cert -d mysite.net --cert-file /etc/ssl/letsencrypt/mysite.net/cert.pem --key-file /etc/ssl/letsencrypt/mysite.net/key.pem --ca-file /etc/ssl/letsencrypt/mysite.net/ca.cer --fullchain-file /etc/ssl/letsencrypt/mysite.net/fullchain.pem --reloadcmd "systemctl restart apache2"