derped/nixos
1
0
Fork 0
Code Releases Activity

Changed shell color for Ophanim. Fixed nix-serve. Improved nginx security.

Browse source
This commit is contained in:
Kevin Baensch 2019-04-03 00:06:08 +02:00
parent 782cd1efae
commit 3ea4cf2954
4 changed files with 15 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

14
services/nginx.nix
View file

@ -21,7 +21,14 @@ mkIf (elem "nginx" config.machine.services) {
sslCiphers = "EECDH+aRSA+AESGCM:EDH+aRSA:EECDH+aRSA:+AES256:+AES128:+SHA1:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL";
sslProtocols = "TLSv1.3 TLSv1.2";
commonHttpConfig = ''
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
map $scheme $hsts_header {
https "max-age=31536000; includeSubdomains; preload";
}
add_header Strict-Transport-Security $hsts_header;
add_header 'Referrer-Policy' 'origin-when-cross-origin';
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
'';
virtualHosts = {
"${config.machine.domain}" = {
@ -55,10 +62,10 @@ mkIf (elem "nginx" config.machine.services) {
}
'';
};
"mail.${config.machine.domain}" = mkIf config.mailserver.enable {
"${config.mailserver.fqdn}" = mkIf config.mailserver.enable {
serverName = config.mailserver.fqdn;
enableACME = true;
forceSSL = true;
root = "/var/www";
};
"storage.${config.machine.domain}" = mkIf config.services.nextcloud.enable {
@ -134,6 +141,7 @@ mkIf (elem "nginx" config.machine.services) {
'';
};
extraConfig = ''
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;