Skip to content

Commit

Permalink
Better consistency
Browse files Browse the repository at this point in the history
Signed-off-by: Tommy <[email protected]>
  • Loading branch information
TommyTran732 committed Jun 25, 2024
1 parent 0b31a1d commit a09a2ab
Showing 1 changed file with 2 additions and 3 deletions.
5 changes: 2 additions & 3 deletions setup.sh
Original file line number Diff line number Diff line change
Expand Up @@ -40,10 +40,9 @@ sudo firewall-cmd --reload
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/sysctl.d/99-nonlocal-bind.conf | sudo tee /etc/sysctl.d/99-nonlocal-bind.conf

# Setup webroot for NGINX
sudo mkdir /srv/nginx
## Explicitly using /var/srv here because SELinux does not follow symlinks
sudo semanage fcontext -a -t httpd_sys_content_t "/var/srv/nginx(/.*)?"
sudo restorecon -Rv /var/srv/nginx
sudo mkdir -p /srv/nginx
sudo mkdir -p /srv/nginx/.well-known/acme-challenge

# NGINX hardening
Expand All @@ -56,8 +55,8 @@ unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/cer
## Explicitly using /var/usrlocal/bin here because SELinux does not follow symlinks
sudo semanage fcontext -a -t bin_t /var/usrlocal/bin/certbot-ocsp-fetcher
sudo restorecon -Rv /var/usrlocal/bin/certbot-ocsp-fetcher
sudo mkdir /var/cache/certbot-ocsp-fetcher/
sudo semanage fcontext -a -t httpd_config_t "/var/cache/certbot-ocsp-fetcher(/.*)?"
sudo mkdir -p /var/cache/certbot-ocsp-fetcher/

# Setup nginx-create-session-ticket-keys
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/nginx-create-session-ticket-keys | sudo tee /usr/local/bin/nginx-create-session-ticket-keys
Expand Down

0 comments on commit a09a2ab

Please sign in to comment.