redirect all HTTP to HTTPS and enable HSTS, closes #18

conf/nginx-ssl.conf

@@ -7,7 +7,7 @@
 #ssl_certificate_key /path/to/my-private-decrypted.key;
 
 # optional: tell browsers to require SSL (warning: difficult to change your mind)
-#add_header Strict-Transport-Security max-age=31536000;
+add_header Strict-Transport-Security max-age=31536000;
 
 # optional: prefer certain ciphersuites, to enforce Perfect Forward Secrecy and avoid known vulnerabilities.
 # done in consultation with:
@@ -43,4 +43,4 @@ spdy_headers_comp 6;
 ssl_stapling on;
 ssl_stapling_verify on;
 resolver 8.8.8.8;
-#ssl_trusted_certificate /path/to/all-certs-in-chain.crt;
\ No newline at end of file
+#ssl_trusted_certificate /path/to/all-certs-in-chain.crt;

conf/nginx.conf

-# The HTTP (not SSL) server.
-
+# Redirect all HTTP to HTTPS.
 server {
 	listen 80;
 	listen [::]:80 default_server ipv6only=on;
 
 	server_name $PUBLIC_HOSTNAME;
-
-	# We'll expose this directory publicly over http.
-	root $STORAGE_ROOT/www/static;
-
-	index index.html index.htm;
-	location / {
-		# First attempt to serve request as file, then
-		# as directory, then fall back to displaying a 404.
-		try_files $uri $uri/ /index.html;
-	}
-	
-	# Convenience redirect to https.
-	rewrite ^/mail(/.*)?$ https://$PUBLIC_HOSTNAME/mail$1 permanent;
+	root /tmp/invalid-path-nothing-here;
+	rewrite ^/(.*)$ https://$PUBLIC_HOSTNAME/$1 permanent;
 }
 
 # The secure HTTPS server.
@@ -31,9 +19,8 @@ server {
 	ssl_certificate_key $STORAGE_ROOT/ssl/ssl_private_key.pem;
 	include /etc/nginx/nginx-ssl.conf;
 
-	# We'll expose the same static directory under https.
+	# Expose this directory as static files.
 	root $STORAGE_ROOT/www/static;
-
 	index index.html index.htm;
 
 	# Roundcube Webmail configuration.