The current default and catchall config in nginx causes domain leak. maybe create a 000-catchall like
server {
listen 80 default_server;
listen [::]:80 default_server;
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
server_name _;
server_tokens off;
ssl_reject_handshake on;
return 444;
}
and also remove the default since no longer needed!?
I need a bit more context on this. A domain leak? How does it leak your domains?
Imagine you have 10 sites on the server. When you visit the public IP of the server, nginx server the first site and not throwing 444.
Also kinda similar situation with site with ssl and no ssl
@Dennis I am not sure if it is what he refers to, but at least myself I've faced a similar situation.
Lets say you configure a domain for a site with multiple tenantes, but the tenant isn’t added yet to Ploi (so there’s no nginx config for it, so anyone accessing that domain will get the default server configuration until you add the tenant - leaking the default/catchall nginx server conf.
Let me know it makes sense.
