[{"data":1,"prerenderedAt":471},["ShallowReactive",2],{"project-24842306":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":36,"aspects":37,"strip":47,"post_text":50,"what":51,"said":87,"maker_in_thread":210,"shape":212,"grid":216,"attempts":435,"same_week":436,"maker_shows":48,"maker_hidden":464,"reader_version":465,"card":466},"24842306","Bunkerized-Nginx","Nginx Docker image secure by default","title","Show HN: Bunkerized-Nginx – Nginx Docker image secure by default","https:\u002F\u002Fgithub.com\u002Fbunkerity\u002Fbunkerized-nginx","github.com","bunkerity",1603227551,2020,221,88,233,3028,8,"notable","infrastructure","nginx docker image","other",[24,25,26,27,28],"nginx","docker","reverse proxy","web security","waf","roasted",-0.48,{"positive":32,"neutral":33,"mixed":34,"critical":35},4,14,0,24,42,{"design":38,"docs":40,"execution":41,"idea":42,"performance":44,"privacy":46},{"positive":34,"critical":39},5,{"positive":34,"critical":34},{"positive":34,"critical":18},{"positive":32,"critical":43},7,{"positive":34,"critical":45},2,{"positive":34,"critical":45},[48,34,49,48,49,39,34,34,34,45,48,39,34,49,34,34,48,49,34,34,34,48,48,34,34,48,48,48,48,49,49,48,48,48,48,48,34,48,49,48],1,3,null,{"problem":52,"audience":50,"pricing":50,"motivation":50,"time_to_build":50,"stack":62,"openness":85,"stage":86,"team_size":86},{"value":53,"source":54,"evidence":55},"Hardening an nginx web server with best-practice security settings","inferred",[56,58],{"id":57},"post",{"id":59,"by":60,"text":61},"24842616","pkage","While it's true that nginx is secure by default, this image adds extra best-practice security addons on top of the out-of-the-box security. Rate limiting, fail2ban, DNSBL is all…",[63,66,70,78],{"value":24,"source":54,"evidence":64},[65],{"id":57},{"value":67,"source":54,"evidence":68},"Docker",[69],{"id":57},{"value":71,"source":72,"evidence":73},"Lua (resty.session)","commenter",[74],{"id":75,"by":76,"text":77},"24843142","progval","From what I understand, when a user completes a captcha, you set a session cookie, using resty.session, which I assume is this library:…",{"value":79,"source":72,"evidence":80},"Alpine base image",[81],{"id":82,"by":83,"text":84},"24843223","surfer7837","Why use Alpine? A better base image would be Red Hat UBI","open_source","unknown",{"praise":88,"objections":106,"requests":155,"questions":177,"alternatives":193},[89,99],{"value":90,"source":72,"evidence":91},"Useful for hardening a self-hosted or production reverse proxy",[92,96],{"id":93,"by":94,"text":95},"24842491","joshstrange","Hmm, looks like it would serve a very similar role as Caddy does for me right now (though my Caddy SSO w\u002F JWT is something I'd have to recreate). I wish this had existed a few…",{"id":97,"by":94,"text":98},"24842658","Agreed, I’ll probably keep using Caddy for my self-hosted apps but this looks like a nice alternative for more production-facing things.",{"value":100,"source":72,"evidence":101},"Configurable via environment variables and open source",[102],{"id":103,"by":104,"text":105},"24843427","iRomain","If you only read the HN comments, you will probably not check this repo out. Well you should: - everything is easily configurable by env vars so the features that some are hating…",[107,122,137,151],{"value":108,"source":72,"evidence":109},"Blocking Tor, proxies and countries is not effective and hurts legitimate users",[110,114,118],{"id":111,"by":112,"text":113},"24842863","SahAssar","> Block TOR, proxies, bad user-agents, countries Does this really help? Especially blocking TOR and whole countries seems bad. As for blocking user-agents: why? Sorta seems like…",{"id":115,"by":116,"text":117},"24843711","phil21","> You block TOR. More complaints that some users cannot access, but other than that no more complaints about spam. Sure, if this worked. But it's not 2010 any more. Simple stuff…",{"id":119,"by":120,"text":121},"24842910","dmix","> Block TOR sadface At least have a good reason for doing this instead of outright doing it for 'Security'. As far as I'm concerned you've made the site less privacy friendly. At…",{"value":123,"source":72,"evidence":124},"Too much complexity and configuration makes it less secure",[125,129,133],{"id":126,"by":127,"text":128},"24845883","throwaway4good","Hundreds of configurable parameters, thousands of lines of code ... Are you sure that this is actually more secure?",{"id":130,"by":131,"text":132},"24842505","superkuh","A more secure (and much simpler to maintain) version would be just running nginx from your repos without all these extra things. nginx is secure by default. The insecurity comes…",{"id":134,"by":135,"text":136},"24847307","burrnii","Keeping systems lean, with little possibilities for configuration errors, can help keep them secure. This Bloatware certainly not.",{"value":138,"source":72,"evidence":139},"Docker container design violates best practices and runs as root",[140,144,148],{"id":141,"by":142,"text":143},"24844386","gui77aume","Shouldn't the Dockerfile have a USER directive, so it doesn't use root by default?",{"id":145,"by":146,"text":147},"24842885","uponcoffee","It violates a lot of principles of using containers. There's no separation of concerns here, builds aren't reproducible, it hijacks logging for its own setup, appears to allow…",{"id":149,"by":146,"text":150},"24843186","The linked repo. I mostly agree with you that most of this should be in containers; I should have been more clear to what part of your comment I was addressing. In regards to…",{"value":152,"source":72,"evidence":153},"Session cookies may be reusable without IP binding in the captcha flow",[154],{"id":75,"by":76,"text":77},[156,163,170],{"value":157,"source":72,"evidence":158},"Provide a config file or config generator instead of only a Docker image",[159],{"id":160,"by":161,"text":162},"24842679","TheDong","I'd prefer if this were not offered as a docker image, but rather as a configuration file or config file generator, akin to what mozilla does for recommended SSL settings [0]. A…",{"value":164,"source":72,"evidence":165},"Use CAP_NET_BIND_SERVICE instead of running as root",[166],{"id":167,"by":168,"text":169},"24844531","otterley","It's better to run as a non-root user, and use the CAP_NET_BIND_SERVICE capability (see capabilities(7)) to allow only the minimal privileges necessary to bind to a low-numbered…",{"value":171,"source":72,"evidence":172},"Add a CSP walkthrough or generator",[173],{"id":174,"by":175,"text":176},"24843500","jchook","For folks interested in further reading, I like this guide for hardening nginx: https:\u002F\u002Fgithub.com\u002Ftrimstray\u002Fnginx-admins-handbook Seems some very critical security mechanisms…",[178,186],{"value":179,"source":72,"evidence":180},"Why block Tor and user agents?",[181,182],{"id":111,"by":112,"text":113},{"id":183,"by":184,"text":185},"24846713","ktpsns","From the list of features: > Block TOR Why the hell should I block TOR? I better block users from mass testing passwords on my login masks, but do not distinguish them of their…",{"value":187,"source":72,"evidence":188},"Is the Caddy v2 migration path possible?",[189],{"id":190,"by":191,"text":192},"24845135","efrecon","Have you looked into how to migrate this to caddy v2?",[194,202,206],{"value":195,"source":72,"evidence":196},"Caddy",[197,198],{"id":93,"by":94,"text":95},{"id":199,"by":200,"text":201},"24842638","bransonf","Also using Caddy as a reverse proxy for a number of containers. This is definitely an attractive alternative. Really isn’t of concern at my current scale, but Nginx offers some…",{"value":203,"source":72,"evidence":204},"nginx installed from distro repos",[205],{"id":130,"by":131,"text":132},{"value":207,"source":72,"evidence":208},"Mozilla SSL config generator",[209],{"id":160,"by":161,"text":162},{"comments":34,"answered":34,"key":211},[],{"commenters":213,"max_depth":214,"maker_replies":34,"first_comment_mins":215,"lifespan_hours":15},60,10,27,[217,221,225,229,232,234,236,239,241,242,244,246,247,250,252,255,256,259,263,265,267,271,274,276,279,281,284,286,288,291,292,295,298,300,302,304,306,308,310,313,316,319,322,324,327,329,332,333,335,336,339,342,345,347,350,353,355,357,358,359,362,363,367,368,372,374,376,379,382,384,387,390,392,395,398,401,403,406,408,411,414,416,418,421,424,426,430,433],[218,34,49,219,220,34],"24843459","project\u002Fneutral\u002Fnone","lights0123",[222,34,48,223,224,34],"24845651","project\u002Fcritical\u002Fdesign","andix",[226,34,34,227,228,34],"24846891","commenter\u002Fneutral\u002Fnone","sascha_sl",[230,34,34,227,231,34],"24847789","samoa42",[233,34,34,227,228,34],"24855915",[174,48,49,235,175,34],"project\u002Fneutral\u002Fdocs",[237,48,49,235,238,34],"24844510","PaywallBuster",[75,45,48,240,76,34],"project\u002Fcritical\u002Fexecution",[126,49,48,223,127,34],[93,32,39,243,94,34],"project\u002Fpositive\u002Fidea",[199,32,49,245,200,34],"project\u002Fneutral\u002Fperformance",[97,32,39,243,94,34],[248,32,34,227,249,34],"24842919","edoceo",[251,32,34,227,94,34],"24843095",[253,32,34,227,254,34],"24844141","Grimm665",[190,32,34,227,191,34],[257,32,34,227,258,34],"24845530","francislavoie",[260,32,34,261,262,34],"24845302","other\u002Fneutral\u002Fnone","pvg",[264,32,34,227,94,34],"24853006",[111,39,48,266,112,34],"project\u002Fcritical\u002Fidea",[268,39,49,269,270,34],"24842930","project\u002Fneutral\u002Fidea","djeiasbsbo",[272,39,49,219,273,34],"24842948","kenniskrag",[275,39,48,266,112,34],"24845160",[277,39,34,227,278,34],"24845595","jve",[280,39,34,227,112,34],"24849785",[282,39,39,243,283,34],"24846687","sbarre",[285,39,34,227,112,34],"24849758",[287,39,34,227,283,34],"24857924",[289,39,39,243,290,34],"24842949","varispeed",[115,39,48,266,116,34],[293,39,34,227,294,34],"24844255","peteretep",[296,39,34,227,297,34],"24844362","girvo",[299,39,34,227,290,34],"24870832",[301,39,34,227,112,34],"24845189",[303,39,34,227,283,34],"24846715",[305,39,34,227,290,34],"24870863",[130,307,48,266,131,34],6,[59,307,49,309,60,34],"project\u002Fneutral\u002Fdesign",[311,307,49,309,312,34],"24842694","GordonS",[314,307,34,227,315,34],"24842771","andybak",[317,307,34,227,318,34],"24842798","hermitmaster",[320,307,34,227,321,34],"24842908","zepearl",[323,307,34,227,273,34],"24842994",[325,307,34,227,326,34],"24843183","rudasn",[328,307,34,227,318,34],"24843311",[330,307,34,227,331,34],"24845924","unionpivo",[145,307,48,223,146,34],[334,307,34,227,315,34],"24842997",[149,307,48,223,146,34],[337,307,34,227,338,34],"24844701","rhizome",[340,307,34,227,341,34],"24845321","diarrhea",[343,307,34,227,344,34],"24849717","GoblinSlayer",[346,307,34,227,161,34],"24850657",[348,307,34,227,349,34],"24845846","sgk284",[351,307,34,227,352,34],"24843348","lmeyerov",[354,307,34,227,349,34],"24845810",[356,307,48,266,131,34],"24843932",[160,307,48,223,161,34],[183,43,48,266,184,34],[360,43,34,227,361,34],"24846877","mhuffman",[141,18,48,240,142,34],[364,18,34,365,366,34],"24844492","commenter\u002Fneutral\u002Fexecution","cpach",[167,18,48,240,168,34],[369,18,49,370,371,34],"24844706","project\u002Fneutral\u002Fexecution","sjy",[373,18,34,227,366,34],"24844828",[375,18,34,227,142,34],"24845013",[377,18,34,227,378,34],"24845301","cmckn",[380,18,49,370,381,34],"24845281","brigandish",[383,18,34,227,168,34],"24847999",[385,18,48,240,386,34],"24845250","e-Minguez",[119,388,48,389,120,34],9,"project\u002Fcritical\u002Fprivacy",[391,388,49,269,290,34],"24843141",[393,388,48,389,394,34],"24849884","cnst",[396,214,48,240,397,34],"24842834","Denvercoder9",[399,214,48,240,400,34],"24843581","eeZah7Ux",[134,402,48,266,135,34],11,[103,404,34,405,104,34],12,"commenter\u002Fpositive\u002Fidea",[82,407,48,240,83,34],13,[409,407,49,370,410,34],"24843477","spurgu",[412,407,34,413,168,34],"24844559","commenter\u002Fneutral\u002Fperformance",[415,407,34,227,191,34],"24845158",[417,407,34,413,168,34],"24850433",[419,407,48,240,420,34],"24845215","Rebelgecko",[422,407,49,370,423,34],"24845283","tpetry",[425,407,49,370,83,34],"24848825",[427,33,48,428,429,34],"24844676","project\u002Fcritical\u002Fperformance","johndoe42377",[431,33,34,413,432,34],"24844721","RussianCow",[434,33,48,428,429,34],"24878832",[],[437,442,447,451,456,460],{"id":438,"name":439,"points":440,"category":441},"24834636","Arturo",324,"languages",{"id":443,"name":444,"points":445,"category":446},"24835219","Formito Favicon Generator",199,"dev_tools",{"id":448,"name":449,"points":450,"category":446},"24833801","ConsoleChat",148,{"id":452,"name":453,"points":454,"category":455},"24846335","TidalWaves API",124,"data",{"id":457,"name":458,"points":459,"category":20},"24829768","Turing Pi 2",109,{"id":461,"name":462,"points":463,"category":446},"24790500","WebCatalog",64,false,"v2",{"id":467,"name":5,"line":6,"ai":464,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":30,"top":18,"kw":468,"maker":11,"domain":10,"tier":19,"attempts":34,"strip":469,"url":9,"mix":470,"praise":90,"objection":108,"sub":21},24842306,[24,25,26,27,28],"1031350002150300130001100111133111110131",[32,33,34,35],1794036597454]