ssl_certificate /etc/ssl/certs/tile.openstreetmap.org.pem;
ssl_certificate_key /etc/ssl/private/tile.openstreetmap.org.key;
+<% if node[:ssl][:strict_transport_security] -%>
- ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
- ssl_ciphers <%= node[:ssl][:ciphers] -%>;
- ssl_prefer_server_ciphers on;
- ssl_session_cache shared:SSL:50m;
- ssl_session_timeout 30m;
- ssl_stapling on;
- ssl_dhparam /etc/ssl/certs/dhparam.pem;
- resolver <%= @resolvers.join(" ") %>;
- resolver_timeout 5s;
+ add_header Strict-Transport-Security "<%= node[:ssl][:strict_transport_security] %>" always;
+<% end -%>
location / {
proxy_pass http://tile_cache_backend;