mikael/nixfiles-emily
1
0
Fork 0
forked from emily/nixfiles
Code Pull requests Activity

i think the web thingy is kinda done

Browse source
This commit is contained in:
emily 2024-01-11 12:43:58 +01:00
parent fa423ae5aa
commit da816d4d94
Signed by untrusted user: emily
GPG key ID: F6F4C66207FCF995
4 changed files with 31 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
config/common-lxc.nix
View file

@ -8,6 +8,7 @@ with lib; {
manageNetwork = true;
manageHostName = true;
};
nixpkgs.hostPlatform.system = "x86_64-linux";
networking.useDHCP = false;
system.autoUpgrade.enable = true;

20
config/common-nginx.nix
View file

@ -1,4 +1,4 @@
{ config, pkgs, lib, ... }: {
{ config, pkgs, lib, ... }: with lib; {
security.dhparams.enable = true;
security.dhparams.params.nginx = {};
security.acme = {
@ -18,20 +18,20 @@
recommendedTlsSettings = true;
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
sslProtocols = lib.mkDefault "TLSv1.3";
sslProtocols = mkDefault "TLSv1.3";
sslDhparam = config.security.dhparams.params.nginx.path;
clientMaxBodySize = "0";
clientMaxBodySize = mkDefault "128M";
commonHttpConfig = ''
map $scheme $hsts_header {
https "max-age=31536000; includeSubdomains; preload";
https "max-age=31536000; includeSubdomains; preload";
}
add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "same-origin" always;
add_header Strict-Transport-Security $hsts_header;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "same-origin" always;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
'';
};
}

22
flake.lock
View file

@ -3,9 +3,7 @@
"fernglas": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": [
"nixpkgs"
]
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1703863936,
@ -55,6 +53,22 @@
}
},
"nixpkgs": {
"locked": {
"lastModified": 1704722960,
"narHash": "sha256-mKGJ3sPsT6//s+Knglai5YflJUF2DGj7Ai6Ynopz0kI=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "317484b1ead87b9c1b8ac5261a8d2dd748a0492d",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1704722960,
"narHash": "sha256-mKGJ3sPsT6//s+Knglai5YflJUF2DGj7Ai6Ynopz0kI=",
@ -74,7 +88,7 @@
"inputs": {
"fernglas": "fernglas",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs"
"nixpkgs": "nixpkgs_2"
}
},
"systems": {

10
flake.nix
View file

@ -3,16 +3,10 @@
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
nixos-hardware.url = "github:nixos/nixos-hardware";
# fernglas.url = "github:wobcom/fernglas";
fernglas = {
type = "github";
owner = "wobcom";
repo = "fernglas";
inputs.nixpkgs.follows = "nixpkgs";
};
fernglas.url = "github:wobcom/fernglas";
};
outputs = { nixpkgs, nixos-hardware, fernglas, ... }@inputs: {
outputs = { self, nixpkgs, nixos-hardware, fernglas, ... }@inputs: {
nixosConfigurations = {
web02 = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";