Turn off server_tokens for nginx http->https redirect vhost

[sizowie]

This change turns off server_tokens (NGINX version in the HTTP response header) for the http->https redirect vhost in the NGINX configuration template.

Why?

NGINX "security" options like server_tokens should be the same in the http redirect vhost as for the https vhost, otherwise hiding the NGINX release in https vhost wouldn't make sense.

http

# curl -v http://localhost        
....     
< Server: nginx/1.22.0      

https

# curl -v https://localhost
...      
< Server: nginx          

Please indicate you've done the following:

• Well Written Title and Summary of the PR
• Label the PR as needed. "release-note/ignore-for-release, release-note/new-feature, release-note/update, release-note/enhancement, release-note/community, release-note/breaking-change, release-note/docs, release-note/infra, release-note/deprecation"
• Accepted the DCO. Commits without the DCO will delay acceptance.
• Made sure tests are passing and test coverage is added if needed.
• Considered the docs impact and opened a new docs issue or PR with docs changes if needed in website repository.

[Vad1mo]

@sizowie can you indicate, in your PR the benefits for Harbor and their users?

[codecov]

Codecov Report

Merging #18314 (aca5b91) into main (c8120d5) will increase coverage by 0.16%.
Report is 103 commits behind head on main.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main   #18314      +/-   ##
==========================================
+ Coverage   67.38%   67.54%   +0.16%     
==========================================
  Files         981      999      +18     
  Lines      107194   111450    +4256     
  Branches     2698     2973     +275     
==========================================
+ Hits        72228    75282    +3054     
- Misses      31085    31941     +856     
- Partials     3881     4227     +346     

Flag	Coverage Δ
unittests	67.52% <ø> (+0.14%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 92 files with indirect coverage changes

[sizowie]

@sizowie can you indicate, in your PR the benefits for Harbor and their users?

sure, description updated.

[Vad1mo]

Makes sense, it is common practice and security advice to not print tokens

[wy65701436]

hi @sizowie would you mind to provide some references for this change?

And the similar comments with this change,

Harbor provides a default configuration for Nginx, but users can enable or disable any configurations based on their specific requirements. However, this default configuration is only applicable for online/offline installations. What if a user installs Harbor on Kubernetes and prefers to use Contour as the proxy?

[sizowie]

hi @sizowie would you mind to provide some references for this change?

And the similar comments with this change,

Harbor provides a default configuration for Nginx, but users can enable or disable any configurations based on their specific requirements. However, this default configuration is only applicable for online/offline installations. What if a user installs Harbor on Kubernetes and prefers to use Contour as the proxy?

http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens
Enables or disables emitting nginx version on error pages and in the “Server” response header field.

This change only applies to users that are using the nginx container from the harbor online/offline-installer to ensure a minimum default hardened reverse proxy.

[github-actions]

This PR is being marked stale due to a period of inactivty. If this PR is still relevant, please comment or remove the stale label. Otherwise, this PR will close in 30 days.

[github-actions]

This PR was closed because it has been stalled for 30 days with no activity. If this PR is still relevant, please re-open a new PR against main.

[Vad1mo]

Hey @goharbor/maintainers can we get this merged? this is a sensible basic configuration setting for Harbor.

[github-actions]

This PR is being marked stale due to a period of inactivty. If this PR is still relevant, please comment or remove the stale label. Otherwise, this PR will close in 30 days.

[github-actions]

This PR was closed because it has been stalled for 30 days with no activity. If this PR is still relevant, please re-open a new PR against main.