add default server block to drop unknown host headers

docker/nginx/conf.d/00-default.conf

@@ -0,0 +1,19 @@
+# Drop connections with unknown Host headers
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+    return 444;
+}
+
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    http2 on;
+    server_name _;
+
+    ssl_certificate     /etc/letsencrypt/live/hantim.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/hantim.net/privkey.pem;
+
+    return 444;
+}

tests/test_default_server.py

@@ -0,0 +1,29 @@
+"""Test that unknown Host headers are dropped by the default server block."""
+
+import socket
+import ssl
+
+import pytest
+
+
+HOST = "www.hantim.net"
+
+
+def test_unknown_host_https_dropped():
+    """HTTPS request with a fake Host header should be dropped (connection reset)."""
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    ctx.check_hostname = False
+    ctx.verify_mode = ssl.CERT_NONE
+    sock = socket.create_connection((HOST, 443))
+    ssock = ctx.wrap_socket(sock, server_hostname=HOST)
+    ssock.sendall(b"GET / HTTP/1.1\r\nHost: evil.example.com\r\n\r\n")
+    resp = ssock.recv(4096)
+    assert resp == b"", f"Expected empty response, got {resp[:100]}"
+
+
+def test_unknown_host_http_dropped():
+    """HTTP request with a fake Host header should be dropped (connection reset)."""
+    sock = socket.create_connection((HOST, 80))
+    sock.sendall(b"GET / HTTP/1.1\r\nHost: evil.example.com\r\n\r\n")
+    resp = sock.recv(4096)
+    assert resp == b"", f"Expected empty response, got {resp[:100]}"