Improve TLS config

.travis.yml

@@ -58,6 +58,5 @@ matrix:
 script: .travis/dispatch.sh
 
 notifications:
-  webhooks: http://build.servo.org:54856/travis
   irc: "irc.mozilla.org#servo-bots"
 

buildbot/master/files/config/master.cfg

@@ -139,7 +139,7 @@ c['builders'] = [
 
 c['status'] = [
     status_push.HttpStatusPush(
-        serverUrl='http://build.servo.org:54856/buildbot',
+        serverUrl='https://build.servo.org/homu/buildbot',
         extra_post_params={'secret': HOMU_BUILDBOT_SECRET},
     ),
     html.WebStatus(
@@ -184,8 +184,8 @@ c['status'] = [
 
 
 c['title'] = "Servo"
-c['titleURL'] = "http://github.com/servo/servo"
-c['buildbotURL'] = "http://build.servo.org/"
+c['titleURL'] = "https://github.com/servo/servo"
+c['buildbotURL'] = "https://build.servo.org/"
 
 
 ##################

homu/files/cfg.toml

@@ -223,7 +223,7 @@ secret = "{{ secrets['web-secret'] }}"
 ] %}
 
 [repo.servo.buildbot]
-url = "http://build.servo.org"
+url = "https://build.servo.org"
 secret = "{{ secrets["buildbot-secret"] }}"
 builders = [
     "linux-rel-css",

nginx/default

@@ -1,15 +1,23 @@
 server {
   listen 80 default_server;
+  listen 443 ssl;
   server_name build.servo.org;
+  ssl_protocols TLSv1.2;
+  ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256;
   ssl_certificate /etc/letsencrypt/live/build.servo.org/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/build.servo.org/privkey.pem;
+  ssl_session_timeout 1d;
+  ssl_session_cache shared:SSL:10m;
+  ssl_session_tickets off;
 
-  listen 443 ssl;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
 
   location / {
     proxy_pass http://localhost:8010/;
   }
-
+  location /github-buildbot-webhook/ {
+    proxy_pass http://localhost:9010/;
+  }
   location /homu/ {
     proxy_pass http://localhost:54856/;
   }

servo-build-dependencies/linux-gstreamer.sls

@@ -6,7 +6,7 @@ include:
 libs-gstreamer:
   archive.extracted:
     - name: {{ common.servo_home }}
-    - source: http://servo-deps.s3.amazonaws.com/gstreamer/gstreamer-1.16-x86_64-linux-gnu.20190515.tar.gz
+    - source: https://servo-deps.s3.amazonaws.com/gstreamer/gstreamer-1.16-x86_64-linux-gnu.20190515.tar.gz
     - source_hash: sha512=1a003f8fdf8fcb3a80b871600da2b7db34267b7e587820ce6442e85eb6aab3b956de7e5aaf08221e65bcb301df48c9d5ce75bb11b7f20ef77b5be5901f2a6e27
     - archive_format: tar
     - user: servo