nixos/services/nginx.nix

##############################################################################################
# Includes:                                                                                  #
#   - Nginx + SSL config                                                                     #
#   - Gitea                                                                                  #
#   - Hydra                                                                                  #
#   - Nextcloud                                                                              #
#   - Mail ssl root                                                                          #
##############################################################################################
{
  options,
  config,
  lib,
  pkgs,
  ...
}:
with lib;
with builtins;
mkIf (elem "nginx" config.machine.services) {
  services.nginx =
    let
      vHostConfigs = listToAttrs (
        map (name: {
          name = replaceStrings [ ".nix" ] [ "" ] name;
          value = import (./. + (toPath "/nginx_vHosts/${name}")) {
            inherit
              options
              config
              lib
              pkgs
              ;
          };
        }) (attrNames (readDir ./nginx_vHosts))
      );

      mkVHost = vHost: {
        name = vHost.domain;
        value = {
          enableACME = true;
          forceSSL = true;
          acmeRoot = "/var/lib/acme/acme-challenge";
        } // vHostConfigs."${vHost.service}";
      };

      vHosts = listToAttrs (map mkVHost config.machine.vHosts);
    in
    {
      enable = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;
      sslCiphers = "EECDH+aRSA+AESGCM:EDH+aRSA:EECDH+aRSA:+AES256:+AES128:+SHA1:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL";
      sslProtocols = "TLSv1.3 TLSv1.2";
      commonHttpConfig = ''
        map $scheme $hsts_header {
            https   "max-age=31536000; includeSubdomains; preload";
        }
        add_header Strict-Transport-Security $hsts_header;
        add_header 'Referrer-Policy' 'origin-when-cross-origin';
        # add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
      '';
      virtualHosts = vHosts;
    };
}