nginx configuration w/ Mozilla modern compatibility

gistfile1.txt

headers:

        # http headers hardening
        # cf. https://securityheaders.io/
        add_header X-Xss-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Content-Security-Policy "frame-ancestors none; default-src 'self' *.keltia.net; frame-src *; object-src 'none'; style-src 'self' *.keltia.net";

        # No framing
        add_header X-Frame-Options DENY;

        # HSTS - 180 days
        add_header Strict-Transport-Security "max-age=15553000; includeSubDomains; preload" ;

        # No referrer when crossing domains & http
        add_header Referrer-Policy strict-origin-when-cross-origin;
        
nginx.conf

        include headers;
        
        ssl on;
        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 127.0.1.1;     # jail

        ssl_certificate      /etc/ssl/certs/assets.keltia.net_ecc/fullchain.cer;
        ssl_certificate_key  /etc/ssl/certs/assets.keltia.net_ecc/assets.keltia.net.key;
        ssl_protocols TLSv1.2;
        ssl_dhparam /etc/ssl/certs/dhparams.pem;
        ssl_prefer_server_ciphers on;

        # Mozilla Security Guide
        # https://wiki.mozilla.org/Security/Server_Side_TLS

        # Modern compatibility
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';