From b11dbbc961abc6fa0046e6a69f9e20cd60860887 Mon Sep 17 00:00:00 2001 From: silverwind Date: Wed, 5 Aug 2026 22:50:38 +0000 Subject: [PATCH] Update TLS settings docs (#489) Update for https://github.com/go-gitea/gitea/pull/38687. Reviewed-on: https://gitea.com/gitea/docs/pulls/489 Reviewed-by: techknowlogick <9+techknowlogick@noreply.gitea.com> Co-authored-by: silverwind --- docs/administration/config-cheat-sheet.md | 40 ++----------------- .../administration/config-cheat-sheet.md | 40 ++----------------- .../administration/config-cheat-sheet.md | 40 ++----------------- 3 files changed, 12 insertions(+), 108 deletions(-) diff --git a/docs/administration/config-cheat-sheet.md b/docs/administration/config-cheat-sheet.md index 112d8cb2..ec2d6732 100644 --- a/docs/administration/config-cheat-sheet.md +++ b/docs/administration/config-cheat-sheet.md @@ -451,42 +451,10 @@ The following configuration set `Content-Type: application/vnd.android.package-a - `REDIRECT_OTHER_PORT`: **false**: If true and `PROTOCOL` is https, allows redirecting http requests on `PORT_TO_REDIRECT` to the https port Gitea listens on. - `REDIRECTOR_USE_PROXY_PROTOCOL`: **`{USE_PROXY_PROTOCOL}`**: expect PROXY protocol header on connections to https redirector. - `PORT_TO_REDIRECT`: **80**: Port for the http redirection service to listen on. Used when `REDIRECT_OTHER_PORT` is true. -- `SSL_MIN_VERSION`: **TLSv1.2**: Set the minimum version of ssl support. -- `SSL_MAX_VERSION`: **_empty_**: Set the maximum version of ssl support. -- `SSL_CURVE_PREFERENCES`: **X25519,P256**: Set the preferred curves, -- `SSL_CIPHER_SUITES`: **ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305**: Set the preferred cipher suites. - - If there is no hardware support for AES suites, by default the ChaCha suites will be preferred over the AES suites. - - supported suites as of Go 1.18 are: - - TLS 1.0 - 1.2 cipher suites - - "rsa_with_rc4_128_sha" - - "rsa_with_3des_ede_cbc_sha" - - "rsa_with_aes_128_cbc_sha" - - "rsa_with_aes_256_cbc_sha" - - "rsa_with_aes_128_cbc_sha256" - - "rsa_with_aes_128_gcm_sha256" - - "rsa_with_aes_256_gcm_sha384" - - "ecdhe_ecdsa_with_rc4_128_sha" - - "ecdhe_ecdsa_with_aes_128_cbc_sha" - - "ecdhe_ecdsa_with_aes_256_cbc_sha" - - "ecdhe_rsa_with_rc4_128_sha" - - "ecdhe_rsa_with_3des_ede_cbc_sha" - - "ecdhe_rsa_with_aes_128_cbc_sha" - - "ecdhe_rsa_with_aes_256_cbc_sha" - - "ecdhe_ecdsa_with_aes_128_cbc_sha256" - - "ecdhe_rsa_with_aes_128_cbc_sha256" - - "ecdhe_rsa_with_aes_128_gcm_sha256" - - "ecdhe_ecdsa_with_aes_128_gcm_sha256" - - "ecdhe_rsa_with_aes_256_gcm_sha384" - - "ecdhe_ecdsa_with_aes_256_gcm_sha384" - - "ecdhe_rsa_with_chacha20_poly1305_sha256" - - "ecdhe_ecdsa_with_chacha20_poly1305_sha256" - - TLS 1.3 cipher suites - - "aes_128_gcm_sha256" - - "aes_256_gcm_sha384" - - "chacha20_poly1305_sha256" - - Aliased names - - "ecdhe_rsa_with_chacha20_poly1305" is an alias for "ecdhe_rsa_with_chacha20_poly1305_sha256" - - "ecdhe_ecdsa_with_chacha20_poly1305" is alias for "ecdhe_ecdsa_with_chacha20_poly1305_sha256" +- `SSL_MIN_VERSION`: **_empty_**: Minimum supported TLS version, one of TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3. Unset uses Go's default. +- `SSL_MAX_VERSION`: **_empty_**: Maximum supported TLS version, one of TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3. Unset uses Go's default. +- `SSL_CURVE_PREFERENCES`: **_empty_**: Comma-separated list of SSL curve preferences. Unset uses Go's default. +- `SSL_CIPHER_SUITES`: **_empty_**: Comma-separated list of SSL cipher suites. Unset uses Go's default. - `ENABLE_ACME`: **false**: Flag to enable automatic certificate management via an ACME capable Certificate Authority (CA) server (default: Lets Encrypt). If enabled, `CERT_FILE` and `KEY_FILE` are ignored, and the CA must resolve `DOMAIN` to this gitea server. Ensure that DNS records are set and either port `80` or port `443` are accessible by the CA server (the public internet by default), and redirected to the appropriate ports `PORT_TO_REDIRECT` or `HTTP_PORT` respectively. - `ACME_URL`: **_empty_**: The CA's ACME directory URL, e.g. for a self-hosted [smallstep CA server](https://github.com/smallstep/certificates), it can look like `https://ca.example.com/acme/acme/directory`. If left empty, it defaults to using Let's Encerypt's production CA (check `LETSENCRYPT_ACCEPTTOS` as well). - `ACME_ACCEPTTOS`: **false**: This is an explicit check that you accept the terms of service of the ACME provider. The default is Lets Encrypt [terms of service](https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf). diff --git a/i18n/zh-cn/docusaurus-plugin-content-docs/current/administration/config-cheat-sheet.md b/i18n/zh-cn/docusaurus-plugin-content-docs/current/administration/config-cheat-sheet.md index 65441063..99a710af 100644 --- a/i18n/zh-cn/docusaurus-plugin-content-docs/current/administration/config-cheat-sheet.md +++ b/i18n/zh-cn/docusaurus-plugin-content-docs/current/administration/config-cheat-sheet.md @@ -396,42 +396,10 @@ aliases: - `REDIRECT_OTHER_PORT`: **false**: 如果为 true 并且 `PROTOCOL` 为 https，则允许将 http 请求重定向到 Gitea 监听的 https 端口的 `PORT_TO_REDIRECT`。 - `REDIRECTOR_USE_PROXY_PROTOCOL`: **`{USE_PROXY_PROTOCOL}`**: 在连接到 https 重定向器时，需要 PROXY 协议头。 - `PORT_TO_REDIRECT`: **80**: http 重定向服务监听的端口。当 `REDIRECT_OTHER_PORT` 为 true 时使用。 -- `SSL_MIN_VERSION`: **TLSv1.2**: 设置最低支持的 SSL 版本。 -- `SSL_MAX_VERSION`: **_empty_**: 设置最大支持的 SSL 版本。 -- `SSL_CURVE_PREFERENCES`: **X25519,P256**: 设置首选的曲线。 -- `SSL_CIPHER_SUITES`: **ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305**: 设置首选的密码套件。 - - 如果没有对 AES 套件的硬件支持，默认情况下，ChaCha 套件将优先于 AES 套件。 - - 根据 Go 1.18 的支持的套件有： - - TLS 1.0 - 1.2 套件 - - "rsa_with_rc4_128_sha" - - "rsa_with_3des_ede_cbc_sha" - - "rsa_with_aes_128_cbc_sha" - - "rsa_with_aes_256_cbc_sha" - - "rsa_with_aes_128_cbc_sha256" - - "rsa_with_aes_128_gcm_sha256" - - "rsa_with_aes_256_gcm_sha384" - - "ecdhe_ecdsa_with_rc4_128_sha" - - "ecdhe_ecdsa_with_aes_128_cbc_sha" - - "ecdhe_ecdsa_with_aes_256_cbc_sha" - - "ecdhe_rsa_with_rc4_128_sha" - - "ecdhe_rsa_with_3des_ede_cbc_sha" - - "ecdhe_rsa_with_aes_128_cbc_sha" - - "ecdhe_rsa_with_aes_256_cbc_sha" - - "ecdhe_ecdsa_with_aes_128_cbc_sha256" - - "ecdhe_rsa_with_aes_128_cbc_sha256" - - "ecdhe_rsa_with_aes_128_gcm_sha256" - - "ecdhe_ecdsa_with_aes_128_gcm_sha256" - - "ecdhe_rsa_with_aes_256_gcm_sha384" - - "ecdhe_ecdsa_with_aes_256_gcm_sha384" - - "ecdhe_rsa_with_chacha20_poly1305_sha256" - - "ecdhe_ecdsa_with_chacha20_poly1305_sha256" - - TLS 1.3 套件 - - "aes_128_gcm_sha256" - - "aes_256_gcm_sha384" - - "chacha20_poly1305_sha256" - - 别名 - - "ecdhe_rsa_with_chacha20_poly1305" 是 "ecdhe_rsa_with_chacha20_poly1305_sha256" 的别名 - - "ecdhe_ecdsa_with_chacha20_poly1305" 是 "ecdhe_ecdsa_with_chacha20_poly1305_sha256" 的别名 +- `SSL_MIN_VERSION`: **_empty_**: 最低支持的 TLS 版本，可选 TLSv1.0、TLSv1.1、TLSv1.2、TLSv1.3。留空则使用 Go 的默认值。 +- `SSL_MAX_VERSION`: **_empty_**: 最高支持的 TLS 版本，可选 TLSv1.0、TLSv1.1、TLSv1.2、TLSv1.3。留空则使用 Go 的默认值。 +- `SSL_CURVE_PREFERENCES`: **_empty_**: 以逗号分隔的 SSL 曲线偏好列表。留空则使用 Go 的默认值。 +- `SSL_CIPHER_SUITES`: **_empty_**: 以逗号分隔的 SSL 密码套件列表。留空则使用 Go 的默认值。 - `ENABLE_ACME`: **false**: 通过 ACME 能力的证书颁发机构（CA）服务器（默认为 Let's Encrypt）启用自动证书管理的标志。如果启用，将忽略 `CERT_FILE` 和 `KEY_FILE`，并且 CA 必须将 `DOMAIN` 解析为此 Gitea 服务器。确保设置了 DNS 记录，并且端口 `80` 或端口 `443` 可以被 CA 服务器访问（默认情况下是公共互联网），并重定向到相应的端口 `PORT_TO_REDIRECT` 或 `HTTP_PORT`。 - `ACME_URL`: **_empty_**: CA 的 ACME 目录 URL，例如自托管的 [smallstep CA 服务器](https://github.com/smallstep/certificates)，它可以是 `https://ca.example.com/acme/acme/directory`。如果留空，默认使用 Let's Encrypt 的生产 CA（还要检查 `LETSENCRYPT_ACCEPTTOS`）。 - `ACME_ACCEPTTOS`: **false**: 这是一个明确的检查，您是否接受 ACME 提供者的服务条款。默认为 Let's Encrypt 的 [服务条款](https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf)。 diff --git a/i18n/zh-tw/docusaurus-plugin-content-docs/current/administration/config-cheat-sheet.md b/i18n/zh-tw/docusaurus-plugin-content-docs/current/administration/config-cheat-sheet.md index c98f5570..261370b5 100644 --- a/i18n/zh-tw/docusaurus-plugin-content-docs/current/administration/config-cheat-sheet.md +++ b/i18n/zh-tw/docusaurus-plugin-content-docs/current/administration/config-cheat-sheet.md @@ -399,42 +399,10 @@ aliases: - `REDIRECT_OTHER_PORT`: **false**: 如果為 true 並且 `PROTOCOL` 為 https，則允許將 http 請求重定向到 Gitea 監聽的 https 端口的 `PORT_TO_REDIRECT`。 - `REDIRECTOR_USE_PROXY_PROTOCOL`: **`{USE_PROXY_PROTOCOL}`**: 在連接到 https 重定向器時，需要 PROXY 協議頭。 - `PORT_TO_REDIRECT`: **80**: http 重定向服務監聽的端口。當 `REDIRECT_OTHER_PORT` 為 true 時使用。 -- `SSL_MIN_VERSION`: **TLSv1.2**: 設定最低支援的 SSL 版本。 -- `SSL_MAX_VERSION`: **_empty_**: 設定最大支援的 SSL 版本。 -- `SSL_CURVE_PREFERENCES`: **X25519,P256**: 設定首選的曲線。 -- `SSL_CIPHER_SUITES`: **ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305**: 設定首選的密碼套件。 - - 如果沒有對 AES 套件的硬件支援，預設情況下，ChaCha 套件將優先於 AES 套件。 - - 根據 Go 1.18 的支援的套件有： - - TLS 1.0 - 1.2 套件 - - "rsa_with_rc4_128_sha" - - "rsa_with_3des_ede_cbc_sha" - - "rsa_with_aes_128_cbc_sha" - - "rsa_with_aes_256_cbc_sha" - - "rsa_with_aes_128_cbc_sha256" - - "rsa_with_aes_128_gcm_sha256" - - "rsa_with_aes_256_gcm_sha384" - - "ecdhe_ecdsa_with_rc4_128_sha" - - "ecdhe_ecdsa_with_aes_128_cbc_sha" - - "ecdhe_ecdsa_with_aes_256_cbc_sha" - - "ecdhe_rsa_with_rc4_128_sha" - - "ecdhe_rsa_with_3des_ede_cbc_sha" - - "ecdhe_rsa_with_aes_128_cbc_sha" - - "ecdhe_rsa_with_aes_256_cbc_sha" - - "ecdhe_ecdsa_with_aes_128_cbc_sha256" - - "ecdhe_rsa_with_aes_128_cbc_sha256" - - "ecdhe_rsa_with_aes_128_gcm_sha256" - - "ecdhe_ecdsa_with_aes_128_gcm_sha256" - - "ecdhe_rsa_with_aes_256_gcm_sha384" - - "ecdhe_ecdsa_with_aes_256_gcm_sha384" - - "ecdhe_rsa_with_chacha20_poly1305_sha256" - - "ecdhe_ecdsa_with_chacha20_poly1305_sha256" - - TLS 1.3 套件 - - "aes_128_gcm_sha256" - - "aes_256_gcm_sha384" - - "chacha20_poly1305_sha256" - - 別名 - - "ecdhe_rsa_with_chacha20_poly1305" 是 "ecdhe_rsa_with_chacha20_poly1305_sha256" 的別名 - - "ecdhe_ecdsa_with_chacha20_poly1305" 是 "ecdhe_ecdsa_with_chacha20_poly1305_sha256" 的別名 +- `SSL_MIN_VERSION`: **_empty_**: 最低支援的 TLS 版本，可選 TLSv1.0、TLSv1.1、TLSv1.2、TLSv1.3。留空則使用 Go 的預設值。 +- `SSL_MAX_VERSION`: **_empty_**: 最高支援的 TLS 版本，可選 TLSv1.0、TLSv1.1、TLSv1.2、TLSv1.3。留空則使用 Go 的預設值。 +- `SSL_CURVE_PREFERENCES`: **_empty_**: 以逗號分隔的 SSL 曲線偏好列表。留空則使用 Go 的預設值。 +- `SSL_CIPHER_SUITES`: **_empty_**: 以逗號分隔的 SSL 密碼套件列表。留空則使用 Go 的預設值。 - `ENABLE_ACME`: **false**: 通過 ACME 能力的證書頒發機構（CA）伺服器（預設為 Let's Encrypt）啟用自動證書管理的標誌。如果啟用，將忽略 `CERT_FILE` 和 `KEY_FILE`，並且 CA 必須將 `DOMAIN` 解析為此 Gitea 伺服器。確保設定了 DNS 記錄，並且端口 `80` 或端口 `443` 可以被 CA 伺服器訪問（預設情況下是公共互聯網），並重定向到相應的端口 `PORT_TO_REDIRECT` 或 `HTTP_PORT`。 - `ACME_URL`: **_empty_**: CA 的 ACME 目錄 URL，例如自託管的 [smallstep CA 伺服器](https://github.com/smallstep/certificates)，它可以是 `https://ca.example.com/acme/acme/directory`。如果留空，預設使用 Let's Encrypt 的生產 CA（還要檢查 `LETSENCRYPT_ACCEPTTOS`）。 - `ACME_ACCEPTTOS`: **false**: 這是一個明確的檢查，您是否接受 ACME 提供者的服務條款。預設為 Let's Encrypt 的 [服務條款](https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf)。