Secure Mergin Maps installation

WARNING

This sections aims to provide some guidelines and a minimalistic example on how to secure a Mergin Maps deployment.

Further security enhancements should be implemented by experts in accordance to cybersecurity policies in place.

For security and privacy reasons Mergin Maps deployments should enable HTTPS secured connection via certificate file.

We provide a template configuration file ssl-proxy.confas base for your configuration.

Let's have a quick look at the main sections:

server {  listen 443 ssl;  server_name merginmaps.company.com; # FIXME  client_max_body_size 4G;  ...

Here we enable SSL via the default 443 port and configure name-based HTTPS server via server_name. Here you should change this according to your target server name.

We don't recommend setting a client_max_body_size higher than specified, because that might lead to timeouts while uploading your data to Mergin Maps.

Next, you need to point your certificate files to NGINX configuration. This is done on the next lines on the secured configuration:

... ssl_certificate_key /etc/letsencrypt/live/merginmaps.company.com/privkey.pem; # FIXME ssl_certificate /etc/letsencrypt/live/merginmaps.company.com/fullchain.pem; # FIXME ...

The above example uses automated keys generated by CertBot. For more information, visit CertBot website and check how you can generate your own keys.

Some extra security settings for HTTP headers are provided. Please review them and update in accordance to your requirements.

# Prevent crawlers from indexing and following links for all content served from the mergin app add_header X-Robots-Tag "none";  # Protect against clickjacking iframe add_header Content-Security-Policy "frame-ancestors 'self';" always;  # Add a HSTS policy to prevent plain http from browser add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;  # Set cookies security flags proxy_cookie_flags ~ secure httponly samesite=strict;  location / {  root /var/www/html;   # The lines below were copied from application proxy  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  proxy_set_header X-Forwarded-Proto $scheme;  proxy_set_header Host $http_host;  # we don't want nginx trying to do something clever with  # redirects, we set the Host: header above already.  proxy_redirect off;  proxy_pass http://app_server; }