nixfiles/config/services/nginx.nix

39 lines
1.2 KiB
Nix
Raw Normal View History

2024-01-11 12:43:58 +01:00
{ config, pkgs, lib, ... }: with lib; {
kyouma.deployment.tags = [ "web" ];
2024-01-10 13:32:18 +01:00
security.dhparams.enable = true;
security.dhparams.params.nginx = {};
security.acme = {
acceptTerms = true;
defaults = {
keyType = "ec256";
email = "noc@kyouma.net";
};
};
services.nginx = {
enable = true;
2024-04-04 14:42:48 +02:00
#package = pkgs.nginxQuic;
2024-01-10 13:32:18 +01:00
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
2024-01-11 12:43:58 +01:00
sslProtocols = mkDefault "TLSv1.3";
2024-01-10 13:32:18 +01:00
sslDhparam = config.security.dhparams.params.nginx.path;
2024-01-11 12:43:58 +01:00
clientMaxBodySize = mkDefault "128M";
2024-01-10 13:32:18 +01:00
commonHttpConfig = ''
map $scheme $hsts_header {
2024-01-11 12:43:58 +01:00
https "max-age=31536000; includeSubdomains; preload";
2024-01-10 13:32:18 +01:00
}
2024-01-11 12:43:58 +01:00
add_header Strict-Transport-Security $hsts_header;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "same-origin" always;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
2024-01-10 13:32:18 +01:00
'';
};
}