128 lines
3.7 KiB
Nix
128 lines
3.7 KiB
Nix
{ config, inputs, pkgs, lib, ... }:
|
|
let
|
|
bmpPort = 11019;
|
|
extraConfig = ''
|
|
add_header Strict-Transport-Security $hsts_header;
|
|
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header Referrer-Policy "same-origin" always;
|
|
'';
|
|
autoIndex = ''
|
|
autoindex on;
|
|
autoindex_exact_size off;
|
|
autoindex_format html;
|
|
autoindex_localtime on;
|
|
'';
|
|
in {
|
|
networking = {
|
|
hostName = "web02";
|
|
firewall.allowedTCPPorts = [ 80 443 bmpPort ];
|
|
firewall.allowedUDPPorts = [ 443 ];
|
|
};
|
|
systemd.network.networks."98-eth-default" = {
|
|
address = [
|
|
"2a0f:be01:0:100::1312/128"
|
|
];
|
|
};
|
|
users.users."lg" = {
|
|
isSystemUser = true;
|
|
createHome = true;
|
|
home = "/var/www/lg.kyouma.net";
|
|
group = "lg";
|
|
};
|
|
users.groups."lg" = {};
|
|
services.vnstat.enable = true;
|
|
services.fernglas = {
|
|
enable = true;
|
|
settings = {
|
|
api.bind = "[::1]:3000";
|
|
collectors = {
|
|
bmp_collector = {
|
|
collector_type = "Bmp";
|
|
bind = "[::]:${toString bmpPort}";
|
|
peers = {
|
|
"45.150.123.0" = {};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
services.nginx = {
|
|
package = pkgs.nginxQuic;
|
|
enable = true;
|
|
|
|
recommendedOptimisation = true;
|
|
recommendedTlsSettings = true;
|
|
recommendedGzipSettings = true;
|
|
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
|
|
sslProtocols = "TLSv1.3";
|
|
clientMaxBodySize = "0";
|
|
|
|
appendHttpConfig = ''
|
|
map $scheme $hsts_header {
|
|
https "max-age=31536000; includeSubdomains; preload";
|
|
}
|
|
${extraConfig}
|
|
'';
|
|
|
|
createHost = {
|
|
"miau.zip" = { root = "/var/www/kyouma.net"; };
|
|
"www.miau.zip" = { redirectTo = "miau.zip"; };
|
|
"www.kyouma.net" = { redirectTo = "kyouma.net"; };
|
|
"emily.cat" = { root = "/var/www/emily.cat/_site"; };
|
|
"www.emily.cat" = { redirectTo = "kyouma.net"; };
|
|
"www.cocaine.trade" = { redirectTo = "cocaine.trade"; };
|
|
|
|
"redirect" = {
|
|
default = true;
|
|
reuseport = true;
|
|
useACMEHost = "kyouma.net";
|
|
extraConfig = ''
|
|
return 403;
|
|
'';
|
|
};
|
|
"cocaine.trade" = {
|
|
root = "/var/www/cocaine.trade";
|
|
extraConfig = ''error_page 404 /404.html;'';
|
|
locations."/" = {
|
|
index = "index.html";
|
|
tryFiles = "$uri $uri.html =404";
|
|
};
|
|
locations."= /".extraConfig = ''rewrite ^ /index.html last;'';
|
|
};
|
|
"files.cocaine.trade" = {
|
|
useACMEHost = "cocaine.trade";
|
|
root = "/mnt/basti/files.cocaine.trade";
|
|
locations."/".extraConfig = autoIndex;
|
|
};
|
|
"kyouma.net" = {
|
|
root = "/var/www/kyouma.net";
|
|
locations = {
|
|
"/ihk/".extraConfig = autoIndex;
|
|
"/vyos/".extraConfig = autoIndex;
|
|
"/3ds/".extraConfig = autoIndex;
|
|
};
|
|
};
|
|
"lg.kyouma.net" = {
|
|
useACMEHost = "kyouma.net";
|
|
locations."/".root = inputs.fernglas.packages.${config.nixpkgs.hostPlatform.system}.fernglas-frontend;
|
|
locations."/api/".proxyPass = "http://${config.services.fernglas.settings.api.bind}";
|
|
};
|
|
};
|
|
};
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults = {
|
|
keyType = "ec384";
|
|
email = "noc@kyouma.net";
|
|
};
|
|
certs = {
|
|
"miau.zip" = { extraDomainNames = [ "www.miau.zip" "lg.miau.zip" ]; };
|
|
"kyouma.net" = { extraDomainNames = [ "www.kyouma.net" "lg.kyouma.net" ]; };
|
|
"emily.cat" = { extraDomainNames = [ "www.emily.cat" ]; };
|
|
"cocaine.trade" = { extraDomainNames = [ "www.cocaine.trade" "files.cocaine.trade" ]; };
|
|
};
|
|
};
|
|
}
|