[docs] unify nginx explainers and add apache httpd (#455)

* docs: unify nginx explainers and add apache httpd

there are two places where nginx + certbot is explained, unify that into
one place.
Add apache httpd, following the same steps, but using mod_md for
LetsEncrypt
add a note about #453 in both guides.
Link to both, and call the section reverse proxy, instead of NGINX

* restore full nginx.conf from docker.md

* add installation_guide/apache-httpd.md to mkdocs

1 files changed, 68 insertions, 2 deletions

diff --git a/docs/installation_guide/nginx.md b/docs/installation_guide/nginx.md
index 7d39971a3..7757ec79c 100644
--- a/docs/installation_guide/nginx.md
+++ b/docs/installation_guide/nginx.md
@@ -68,7 +68,9 @@ server {
 }
 ```
 
-Note: You can remove the line `listen [::]:80;` if your server is not ipv6 capable or you'd rather not use ipv6.
+**Note***: You can remove the line `listen [::]:80;` if your server is not ipv6 capable.
+
+**Note***: `proxy_set_header Host $host;` is essential: It guarantees that the proxy and the gotosocial speak of the same Server name. If not, gotosocial will build the wrong authentication headers, and all attempts at federation will be rejected with 401.
 
 Change `proxy_pass` to the ip and port that you're actually serving GoToSocial on and change `server_name` to your own domain name.
 If your domain name is `gotosocial.example.com` then `server_name gotosocial.example.com;` would be the correct value.
@@ -109,8 +111,72 @@ sudo certbot --nginx
 ```
 
 After you do, it should have automatically edited your configuration file to enable https.
-Just reload it one last time and after that you should be good to go!
+Reload it one last time and after that you should be good to go!
 
 ```bash
 sudo systemctl restart nginx
 ```
+
+### Results
+
+The resulting NGINX config should look something like this:
+
+```nginx.conf
+server {
+  listen 80;
+  listen [::]:80;
+  server_name gts.example.com;
+
+  location /.well-known/acme-challenge/ {
+    default_type "text/plain";
+    root /var/www/certbot;
+  }
+  location / { return 301 https://$host$request_uri; }
+}
+
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name gts.example.com;
+
+  #############################################################################
+  # Certificates                                                              #
+  # you need a certificate to run in production. see https://letsencrypt.org/ #
+  #############################################################################
+  ssl_certificate     /etc/letsencrypt/live/gts.example.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/gts.example.com/privkey.pem;
+
+  location ^~ '/.well-known/acme-challenge' {
+    default_type "text/plain";
+    root /var/www/certbot;
+  }
+
+  ###########################################
+  # Security hardening (as of Nov 15, 2020) #
+  # based on Mozilla Guideline v5.6         #
+  ###########################################
+
+  ssl_protocols             TLSv1.2 TLSv1.3;
+  ssl_prefer_server_ciphers on;
+  ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305";
+  ssl_session_timeout       1d; # defaults to 5m
+  ssl_session_cache         shared:SSL:10m; # estimated to 40k sessions
+  ssl_session_tickets       off;
+  ssl_stapling              on;
+  ssl_stapling_verify       on;
+  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+  # HSTS (https://hstspreload.org), requires to be copied in 'location' sections that have add_header directives
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+
+
+  location / {
+    proxy_pass         http://127.0.0.1:8080;
+
+    proxy_set_header   Host             $host;
+    proxy_set_header   Connection       $http_connection;
+    proxy_set_header   X-Real-IP        $remote_addr;
+    proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
+    proxy_set_header   X-Scheme         $scheme;
+  }
+}
+```