bunkerized-nginx

nginx based Docker image secure by default.

Main features

HTTPS support with transparent Let's Encrypt automation
State-of-the-art web security : HTTP headers, php.ini hardening, version leak, ...
Integrated ModSecurity WAF with the OWASP Core Rule Set
Based on alpine and compiled from source (< 100 MB image)
Easy to configure with environment variables

Quickstart guide

Run HTTP server with default settings

docker run -p 80:80 -v /path/to/web/files:/www bunkerity/bunkerized-nginx

Web files are stored in the /www directory, so you need to mount the volume on it.

Run HTTPS server with automated Let's Encrypt

docker run -p 80:80 -p 443:443 -v /path/to/web/files:/www -e SERVER_NAME=www.yourdomain.com -e AUTO_LETS_ENCRYPT=yes bunkerity/bunkerized-nginx

Let's Encrypt needs port 80 to be open to request and sign certificates but nginx will only listen on port 443.

List of variables

nginx security

SERVER_TOKENS
Values : on | off
Default value : off
If set to on, nginx will display server version in Server header and default error pages.

HEADER_SERVER Values : yes | no Default value : no If set to no, nginx will remove the Server header in HTTP responses.

ALLOWED_METHODS Values : allowed HTTP methods separated with | char Default value : GET|POST|HEAD Only the HTTP methods listed here will be accepted by nginx. If not listed, nginx will close the connection.

DISABLE_DEFAULT_SERVER Values : yes | no Default value : no If set to yes, nginx will only respond to HTTP request when the Host header match the SERVER_NAME. For example, it will close the connection if a bot access the site with direct ip.

Security headers

X_FRAME_OPTIONS Values : DENY | SAMEORIGIN | ALLOW-FROM https://www.website.net | ALLOWALL Default value : DENY Policy to be used when the site is displayed through iframe. Can be used to mitigate clickjacking attacks. More info here.

X_XSS_PROTECTION Values : 0 | 1 | 1; mode=block Default value : 1; mode=block Policy to be used when XSS is detected by the browser. Only works with Internet Explorer. More info here.

X_CONTENT_TYPE_OPTIONS Values : nosniff Default value : nosniff Tells the browser to be strict about MIME type. More info here.

TODO : list variables, default value, explanation, ...

TODO

File permissions hardening
Custom nginx configuration
Custom TLS certificates
Documentation
Reverse proxy mode

2.9 KiB Raw Blame History