nixos/services/nginx.nix

##############################################################################################
# Includes:                                                                                  #
#   - Nginx + SSL config                                                                     #
#   - Gitea                                                                                  #
#   - Hydra                                                                                  #
#   - Nextcloud                                                                              #
#   - Mail ssl root                                                                          #
##############################################################################################
{
  options,
  config,
  lib,
  pkgs,
  ...
}:
with lib;
with builtins;
  mkIf (elem "nginx" config.machine.services) {
    services.nginx = let
      vHostConfigs = listToAttrs (map
        (name: {
          name = replaceStrings [".nix"] [""] name;
          value = import (./. + (toPath "/nginx_vHosts/${name}")) {inherit options config lib pkgs;};
        })
        (attrNames (readDir ./nginx_vHosts)));

      mkVHost = vHost: {
        name = vHost.domain;
        value =
          {
            enableACME = true;
            forceSSL = true;
            acmeRoot = "/var/lib/acme/acme-challenge";
          }
          // vHostConfigs."${vHost.service}";
      };

      vHosts = listToAttrs (map mkVHost config.machine.vHosts);
    in {
      enable = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;
      sslCiphers = "EECDH+aRSA+AESGCM:EDH+aRSA:EECDH+aRSA:+AES256:+AES128:+SHA1:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL";
      sslProtocols = "TLSv1.3 TLSv1.2";
      commonHttpConfig = ''
        map $scheme $hsts_header {
            https   "max-age=31536000; includeSubdomains; preload";
        }
        add_header Strict-Transport-Security $hsts_header;
        add_header 'Referrer-Policy' 'origin-when-cross-origin';
        # add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
      '';
      virtualHosts = vHosts;
    };
  }