mikael/nixfiles-emily
1
0
Fork 0
forked from emily/nixfiles
Code Pull requests Activity

i think the web thingy is kinda done

Browse source
This commit is contained in:
emily 2024-01-11 12:43:58 +01:00
parent fa423ae5aa
commit da816d4d94
Signed by untrusted user: emily
GPG key ID: F6F4C66207FCF995
4 changed files with 31 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
config/common-lxc.nix
View file

@ -8,6 +8,7 @@ with lib; {
manageNetwork = true; manageNetwork = true;
manageHostName = true; manageHostName = true;
}; };
nixpkgs.hostPlatform.system = "x86_64-linux";
networking.useDHCP = false; networking.useDHCP = false;
system.autoUpgrade.enable = true; system.autoUpgrade.enable = true;

8
config/common-nginx.nix
View file

@ -1,4 +1,4 @@
{ config, pkgs, lib, ... }: { { config, pkgs, lib, ... }: with lib; {
security.dhparams.enable = true; security.dhparams.enable = true;
security.dhparams.params.nginx = {}; security.dhparams.params.nginx = {};
security.acme = { security.acme = {
@ -18,20 +18,20 @@
recommendedTlsSettings = true; recommendedTlsSettings = true;
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
sslProtocols = lib.mkDefault "TLSv1.3"; sslProtocols = mkDefault "TLSv1.3";
sslDhparam = config.security.dhparams.params.nginx.path; sslDhparam = config.security.dhparams.params.nginx.path;
clientMaxBodySize = "0"; clientMaxBodySize = mkDefault "128M";
commonHttpConfig = '' commonHttpConfig = ''
map $scheme $hsts_header { map $scheme $hsts_header {
https "max-age=31536000; includeSubdomains; preload"; https "max-age=31536000; includeSubdomains; preload";
} }
add_header Strict-Transport-Security $hsts_header; add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
add_header X-Content-Type-Options "nosniff" always; add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always; add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "same-origin" always; add_header Referrer-Policy "same-origin" always;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
''; '';
}; };
} }

22
flake.lock
View file

@ -3,9 +3,7 @@
"fernglas": { "fernglas": {
"inputs": { "inputs": {
"flake-utils": "flake-utils", "flake-utils": "flake-utils",
"nixpkgs": [ "nixpkgs": "nixpkgs"
"nixpkgs"
]
}, },
"locked": { "locked": {
"lastModified": 1703863936, "lastModified": 1703863936,
@ -55,6 +53,22 @@
} }
}, },
"nixpkgs": { "nixpkgs": {
"locked": {
"lastModified": 1704722960,
"narHash": "sha256-mKGJ3sPsT6//s+Knglai5YflJUF2DGj7Ai6Ynopz0kI=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "317484b1ead87b9c1b8ac5261a8d2dd748a0492d",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": { "locked": {
"lastModified": 1704722960, "lastModified": 1704722960,
"narHash": "sha256-mKGJ3sPsT6//s+Knglai5YflJUF2DGj7Ai6Ynopz0kI=", "narHash": "sha256-mKGJ3sPsT6//s+Knglai5YflJUF2DGj7Ai6Ynopz0kI=",
@ -74,7 +88,7 @@
"inputs": { "inputs": {
"fernglas": "fernglas", "fernglas": "fernglas",
"nixos-hardware": "nixos-hardware", "nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs" "nixpkgs": "nixpkgs_2"
} }
}, },
"systems": { "systems": {

10
flake.nix
View file

@ -3,16 +3,10 @@
inputs = { inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
nixos-hardware.url = "github:nixos/nixos-hardware"; nixos-hardware.url = "github:nixos/nixos-hardware";
# fernglas.url = "github:wobcom/fernglas"; fernglas.url = "github:wobcom/fernglas";
fernglas = {
type = "github";
owner = "wobcom";
repo = "fernglas";
inputs.nixpkgs.follows = "nixpkgs";
};
}; };
outputs = { nixpkgs, nixos-hardware, fernglas, ... }@inputs: { outputs = { self, nixpkgs, nixos-hardware, fernglas, ... }@inputs: {
nixosConfigurations = { nixosConfigurations = {
web02 = nixpkgs.lib.nixosSystem { web02 = nixpkgs.lib.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";