nginx: add catch-all default_server returning 404 for unmatched hostsHEADmain

Without an explicit default_server, nginx falls back to the first
alphabetically-loaded vhost for any request whose Host or SNI matches no
server_name. Add an explicit catch-all that returns a plain 404 over
HTTP and rejects the TLS handshake (ssl_reject_handshake, nginx >=
1.19.4) so unmatched HTTPS requests are not served a mismatched cert.

1 files changed, 19 insertions, 0 deletions

diff --git a/nginx/files/nginx.conf b/nginx/files/nginx.conf
index 08b1f31..dd7885a 100644
--- a/nginx/files/nginx.conf
+++ b/nginx/files/nginx.conf
@@ -55,6 +55,25 @@ http {
         gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
 
         ##
+        # Default catch-all: any request whose Host/SNI matches no
+        # server_name lands here instead of the first-loaded vhost.
+        ##
+
+        server {
+                listen 80 default_server;
+                listen [::]:80 default_server;
+                listen 443 ssl default_server;
+                listen [::]:443 ssl default_server;
+
+                server_name _;
+
+                # Reject unmatched TLS handshakes without a cert (nginx >= 1.19.4).
+                ssl_reject_handshake on;
+
+                return 404;
+        }
+
+        ##
         # Virtual Host Configs
         ##