1
0
Fork 0
forked from emily/nixfiles
nixfiles-emily/modules/nginx/default.nix
2024-05-03 16:12:39 +02:00

35 lines
1.3 KiB
Nix

{ config, lib, ... }: let
extraConfig = ''
add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "same-origin" always;
'';
createHost = vhostName: vhostCfg: {
extraConfig = (lib.optionalString (builtins.hasAttr "extraConfig" vhostCfg) vhostCfg.extraConfig) + "\n" + extraConfig;
forceSSL = true;
#kTLS = true;
#http3 = true;
#quic = true;
} // lib.optionalAttrs (!(builtins.hasAttr "useACMEHost" vhostCfg)) {
enableACME = true;
} // lib.optionalAttrs (builtins.hasAttr "redirectTo" vhostCfg) {
enableACME = false;
useACMEHost = vhostCfg.redirectTo;
globalRedirect = vhostCfg.redirectTo;
} // (builtins.removeAttrs vhostCfg [ "redirectTo" "extraConfig" ]);
in {
options = {
kyouma.nginx.virtualHosts = lib.mkOption {
type = with lib.types; nullOr anything;
default = null;
};
};
config = {
services.nginx.virtualHosts = lib.mkIf (config.kyouma.nginx.virtualHosts != null) (
builtins.mapAttrs (createHost) config.kyouma.nginx.virtualHosts);
};
}