Minor fixes

- Keep self signed certificates to own directory
- Add comments on OCSP stapling

Author: axilleas

web-server/nginx/gitlab-ssl

@@ -18,9 +18,10 @@
 ## Make sure to read it and understand what each option does.
 ##
 ## [Optional] Generate a self-signed ssl certificate:
-##   cd /etc/nginx/
-##   sudo openssl req -new -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
-##   sudo chmod o-r gitlab.key
+##    mkdir /etc/nginx/ssl/
+##    cd /etc/nginx/ssl/
+##    sudo openssl req -new -x509 -nodes -days 3560 -out gitlab.crt -keyout gitlab.key
+##    sudo chmod o-r gitlab.key
 ##
 ## Edit `gitlab-shell/config.yml`:
 ##  1) Set "gitlab_url" param in `gitlab-shell/config.yml` to `https://git.example.com`
@@ -66,14 +67,16 @@ server {
   ## Replace git.example.com with your FQDN.
   server_name git.example.com;
   server_tokens off;
-  ## this doesn't have to be a valid path since we are redirecting, you don't have to change it.
+  ## This doesn't have to be a valid path since we are redirecting,
+  ## you don't have to change it.
   root /nowhere;
   rewrite ^ https://$server_name$request_uri permanent;
 }
 
 server {
   listen 443 ssl;
-  server_name git.example.com; # Replace git.example.com with your FQDN.
+  ## Replace git.example.com with your FQDN.
+  server_name git.example.com;
   server_tokens off;
   root /home/git/gitlab/public;
 
@@ -84,17 +87,22 @@ server {
   ## Strong SSL Security
   ## https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
   ssl on;
-  ssl_certificate /etc/nginx/gitlab.crt;
-  ssl_certificate_key /etc/nginx/gitlab.key;
+  ssl_certificate /etc/nginx/ssl/gitlab.crt;
+  ssl_certificate_key /etc/nginx/ssl/gitlab.key;
 
   ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4';
 
   ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
   ssl_session_cache  builtin:1000  shared:SSL:10m;
 
+  ## Enable OCSP stapling to reduce the overhead and latency of running SSL.
+  ## Replace with your ssl_trusted_certificate. For more info see:
+  ## - https://medium.com/devops-programming/4445f4862461
+  ## - https://www.ruby-forum.com/topic/4419319
   ssl_stapling on;
   ssl_stapling_verify on;
-  resolver 8.8.4.4 8.8.8.8 valid=300s;
+  ssl_trusted_certificate /etc/nginx/ssl/stapling.trusted.crt;
+  resolver 208.67.222.222 208.67.222.220 valid=300s;
   resolver_timeout 10s;
 
   ssl_prefer_server_ciphers   on;