Improve TLS config

[Darkspirit]

#906 (comment)

Problem:
https://www.hardenize.com/report/build.servo.org#www_tls
https://www.ssllabs.com/ssltest/analyze.html?d=build.servo.org&hideResults=on

• Let's first switch all clients to https before we disable TLS 1.0. Just to be sure.
• server_tokens off; makes nginx return Server: nginx without any version number.
• ssl_session_cache: official recommendation, docs

An nginx restart is needed: service nginx restart
You can test with nginx -t before restarting.

---

This change is 

[Darkspirit]

r? @jdm

[jdm]

One thing to be aware of - I changed a webhook target for servo/servo from http://build.servo.org:9010 to https://build.servo.org:9010 and it broke everything.

[jdm]

That's for

saltfs/buildbot/master/files/buildbot-github-listener.conf

Line 1 in 9003650

exec /usr/local/bin/github_buildbot.py -p 9010 -m localhost:9001 --auth=change:{{ pillar['buildbot']['credentials']['change-pass'] }} --secret={{ pillar['buildbot']['credentials']['gh-hook-secret'] }} -l {{ common.servo_home }}/buildbot/master/github-listener.log

.

[Darkspirit]

One thing to be aware of - I changed a webhook target for servo/servo from http://build.servo.org:9010 to https://build.servo.org:9010 and it broke everything.

Oh dear. Of course, there is no starttls on an http port.
I created another commit to introduce https://build.servo.org/github-buildbot/.
Is this folder name okay or should we change it?

In the future, when all those plaintext services are behind nginx, they can be changed to only listen on 127.0.0.1. For github_buildbot.py it would be

• either blocking port 9010 with iptables for the public
• or changing
  

  saltfs/buildbot/master/files/github_buildbot.py

  Line 306 in 9003650

  reactor.listenTCP(options.port, site)

  
  to reactor.listenTCP(options.port, site, interface='127.0.0.1') (source 1, source 2).

[Darkspirit]

@jdm Should further changes be made, e.g. would you like to have a different name for the github_buildbot.py webhook, or is this ready to be merged? Thanks

[bors-servo]

☔ The latest upstream changes (presumably #935) made this pull request unmergeable. Please resolve the merge conflicts.