Add post-quantum hybrid ECDHE-MLKEM for TLSv1.3

Author: bwbroersma

docker/compose.development.yaml

@@ -1,7 +1,7 @@
 services:
   # terminate tls so we don't need to have exceptions in the nginx config file for development
   port-expose:
-    image: nginx:1.27.3-alpine
+    image: nginx:1.29.1-alpine3.22
     networks:
       - public-internet
       - internal

docker/compose.integration-tests.yaml

@@ -4,7 +4,7 @@ services:
   # from the internal network to the outside
   # also terminate tls so we don't need to have exceptions in the nginx config file for development
   port-expose:
-    image: nginx:1.27.3-alpine
+    image: nginx:1.29.1-alpine3.22
     networks:
       - public-internet
       - port-expose
@@ -96,7 +96,7 @@ services:
       - $RABBITMQ_GUI
 
   test-target:
-    image: nginx:1.27.3-alpine
+    image: nginx:1.29.1-alpine3.22
 
     networks:
       public-internet:
@@ -137,7 +137,7 @@ services:
       MH_SMTP_BIND_ADDR: 0.0.0.0:25
 
   static:
-    image: nginx:1.27.3-alpine
+    image: nginx:1.29.1-alpine3.22
 
     restart: unless-stopped
 

docker/compose.yaml

@@ -59,7 +59,7 @@ services:
       - nginx-logs-exporter:/var/log/nginx/prometheus-nginxlog-exporter/
 
     healthcheck:
-      test: ["CMD", "service", "nginx", "status"]
+      test: ["CMD", "curl", "-kfsSo/dev/null", "https://$INTERNETNL_DOMAINNAME", "--resolve", "$INTERNETNL_DOMAINNAME:443:127.0.0.1"]
       interval: $HEALTHCHECK_INTERVAL
       start_interval: $HEALTHCHECK_START_INTERVAL
       start_period: 1m

docker/webserver.Dockerfile

@@ -1,11 +1,12 @@
-FROM nginx:1.27.3
+FROM nginx:1.29.1-alpine3.22
 
-RUN apt-get update && apt-get install -y \
+RUN apk add \
+  # for random quic host key
+  openssl \
   # for htpasswd
   apache2-utils \
-  # for gixy install
-  python3-venv \
-  && rm -rf /var/lib/apt/lists/*
+  # for gixy and certbot install
+  python3
 
 # install nginx config static analysis tool
 RUN python3 -m venv /opt/gixy

docker/webserver/nginx_templates/app.conf.template

@@ -37,6 +37,7 @@ ssl_stapling on;
 ssl_stapling_verify on;
 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
+ssl_ecdh_curve SecP384r1MLKEM1024:X25519MLKEM768:SecP256r1MLKEM768:secp521r1:brainpoolP512r1:x448:brainpoolP384r1:secp384r1:x25519:secp256r1:brainpoolP256r1;
 
 http2 on;
 http3 on;