Updated nginx config; added missing mkIf; added fail2ban to Ophanim's services list.

machines/Ophanim/configuration.nix

@@ -1,4 +1,4 @@
-{ config, lib }:
+{ config, lib, ... }:
 
 with lib;
 
@@ -12,9 +12,8 @@ with lib;
     hostName = "Ophanim";
     allowUnfree = true;
     conffiles = [
-      "etcfiles"
       "etcvars"
-      "fonts"
+      "security"
       "zsh"
     ];
     pkgs = [
@@ -23,6 +22,7 @@ with lib;
       "server"
     ];
     services = [
+      "fail2ban"
       "gitea"
       "hydra"
       "mailserver"

services/mariaDB.nix

@@ -8,14 +8,14 @@ in mkIf (elem "mariaDB" config.machine.services) {
   services.mysql = {
     enable = true;
     package = pkgs.mariadb;
-    initialDatabases = [ mkIf config.services.gitea.enable {
+    initialDatabases = if config.services.gitea.enable then [ {
       name = "gitea";
       schema = pkgs.writeText "gitea.sql"
       ''
         create user if not exists 'git'@'localhost' identified by ${giteapwd};
         grant all privileges on gitea.* to 'git'@'localhost' identified by ${giteapwd};
       '';
-    } ];
+    } ] else [];
   };
 }
 

services/nginx.nix

@@ -16,14 +16,19 @@ mkIf (elem "nginx" config.machine.services) {
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
     recommendedProxySettings = true;
-    sslCiphers = "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256";
+    recommendedTlsSettings = true;
+    sslCiphers = "EECDH+aRSA+AESGCM:EDH+aRSA:EECDH+aRSA:+AES256:+AES128:+SHA1:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL";
+    sslProtocols = "TLSv1.3 TLSv1.2";
+    commonHttpConfig = ''
+      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    '';
     virtualHosts = {
       "ophanim.de" = {
         enableACME = true;
         forceSSL = true;
         root = "/var/www";
       };
-      "builder.ophanim.de" = {
+      "builder.ophanim.de" = mkIf config.services.hydra.enable {
         enableACME = true;
         forceSSL = true;
         extraConfig = ''
@@ -36,7 +41,7 @@ mkIf (elem "nginx" config.machine.services) {
           }
         '';
       };
-      "cache.ophanim.de" = {
+      "cache.ophanim.de" = mkIf config.services.hydra.enable {
         enableACME = true;
         forceSSL = true;
         root = "/var/cache/hydra";
@@ -50,107 +55,107 @@ mkIf (elem "nginx" config.machine.services) {
         root = "/var/www";
       };
 
-        "${config.services.nextcloud.hostName}" = {
+      "${config.services.nextcloud.hostName}" = mkIf config.services.nextcloud.enable {
-            root = pkgs.nextcloud;
+        root = pkgs.nextcloud;
-            enableACME = config.services.nextcloud.https;
+        enableACME = config.services.nextcloud.https;
-            forceSSL = config.services.nextcloud.https;
+        forceSSL = config.services.nextcloud.https;
-            locations = {
+        locations = {
-              "= /robots.txt" = {
+          "= /robots.txt" = {
-                priority = 100;
+            priority = 100;
-                extraConfig = ''
-                  allow all;
-                  log_not_found off;
-                  access_log off;
-                '';
-              };
-              "/" = {
-                priority = 200;
-                extraConfig = "rewrite ^ /index.php$request_uri;";
-              };
-              "~ ^/store-apps" = {
-                priority = 201;
-                extraConfig = "root ${config.services.nextcloud.home};";
-              };
-              "= /.well-known/carddav" = {
-                priority = 210;
-                extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-              };
-              "= /.well-known/caldav" = {
-                priority = 210;
-                extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-              };
-              "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/" = {
-                priority = 300;
-                extraConfig = "deny all;";
-              };
-              "~ ^/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
-                priority = 300;
-                extraConfig = "deny all;";
-              };
-              "~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\\.php(?:$|/)" = {
-                priority = 500;
-                extraConfig = ''
-                  include ${config.services.nginx.package}/conf/fastcgi.conf;
-                  fastcgi_split_path_info ^(.+\.php)(/.*)$;
-                  fastcgi_param PATH_INFO $fastcgi_path_info;
-                  fastcgi_param HTTPS ${if config.services.nextcloud.https then "on" else "off"};
-                  fastcgi_param modHeadersAvailable true;
-                  fastcgi_param front_controller_active true;
-                  fastcgi_pass unix:/run/phpfpm/nextcloud;
-                  fastcgi_intercept_errors on;
-                  fastcgi_request_buffering off;
-                  fastcgi_read_timeout 120s;
-                '';
-              };
-              "~ ^/(?:updater|ocs-provider|ocm-provider)(?:$|\/)".extraConfig = ''
-                try_files $uri/ =404;
-                index index.php;
-              '';
-              "~ \\.(?:css|js|woff2?|svg|gif)$".extraConfig = ''
-                try_files $uri /index.php$request_uri;
-                add_header Cache-Control "public, max-age=15778463";
-                add_header X-Content-Type-Options nosniff;
-                add_header X-XSS-Protection "1; mode=block";
-                add_header X-Robots-Tag none;
-                add_header X-Download-Options noopen;
-                add_header X-Permitted-Cross-Domain-Policies none;
-                add_header Referrer-Policy no-referrer;
-                access_log off;
-              '';
-              "~ \\.(?:png|html|ttf|ico|jpg|jpeg)$".extraConfig = ''
-                try_files $uri /index.php$request_uri;
-                access_log off;
-              '';
-            };
             extraConfig = ''
-              add_header X-Content-Type-Options nosniff;
+              allow all;
-              add_header X-XSS-Protection "1; mode=block";
+              log_not_found off;
-              add_header X-Robots-Tag none;
+              access_log off;
-              add_header X-Download-Options noopen;
-              add_header X-Permitted-Cross-Domain-Policies none;
-              add_header Referrer-Policy no-referrer;
-              error_page 403 /core/templates/403.php;
-              error_page 404 /core/templates/404.php;
-              client_max_body_size ${config.services.nextcloud.maxUploadSize};
-              fastcgi_buffers 64 4K;
-              fastcgi_hide_header X-Powered-By;
-              gzip on;
-              gzip_vary on;
-              gzip_comp_level 4;
-              gzip_min_length 256;
-              gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-              gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
-              ${lib.optionalString config.services.nextcloud.webfinger ''
-                rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-                rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
-              ''}
             '';
           };
+          "/" = {
+            priority = 200;
+            extraConfig = "rewrite ^ /index.php$request_uri;";
+          };
+          "~ ^/store-apps" = {
+            priority = 201;
+            extraConfig = "root ${config.services.nextcloud.home};";
+          };
+          "= /.well-known/carddav" = {
+            priority = 210;
+            extraConfig = "return 301 $scheme://$host/remote.php/dav;";
+          };
+          "= /.well-known/caldav" = {
+            priority = 210;
+            extraConfig = "return 301 $scheme://$host/remote.php/dav;";
+          };
+          "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/" = {
+            priority = 300;
+            extraConfig = "deny all;";
+          };
+          "~ ^/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
+            priority = 300;
+            extraConfig = "deny all;";
+          };
+          "~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+)\\.php(?:$|/)" = {
+            priority = 500;
+            extraConfig = ''
+              include ${config.services.nginx.package}/conf/fastcgi.conf;
+              fastcgi_split_path_info ^(.+\.php)(/.*)$;
+              fastcgi_param PATH_INFO $fastcgi_path_info;
+              fastcgi_param HTTPS ${if config.services.nextcloud.https then "on" else "off"};
+              fastcgi_param modHeadersAvailable true;
+              fastcgi_param front_controller_active true;
+              fastcgi_pass unix:/run/phpfpm/nextcloud;
+              fastcgi_intercept_errors on;
+              fastcgi_request_buffering off;
+              fastcgi_read_timeout 120s;
+            '';
+          };
+          "~ ^/(?:updater|ocs-provider|ocm-provider)(?:$|\/)".extraConfig = ''
+            try_files $uri/ =404;
+            index index.php;
+          '';
+          "~ \\.(?:css|js|woff2?|svg|gif)$".extraConfig = ''
+            try_files $uri /index.php$request_uri;
+            add_header Cache-Control "public, max-age=15778463";
+            add_header X-Content-Type-Options nosniff;
+            add_header X-XSS-Protection "1; mode=block";
+            add_header X-Robots-Tag none;
+            add_header X-Download-Options noopen;
+            add_header X-Permitted-Cross-Domain-Policies none;
+            add_header Referrer-Policy no-referrer;
+            access_log off;
+          '';
+          "~ \\.(?:png|html|ttf|ico|jpg|jpeg)$".extraConfig = ''
+            try_files $uri /index.php$request_uri;
+            access_log off;
+          '';
+        };
+        extraConfig = ''
+          add_header X-Content-Type-Options nosniff;
+          add_header X-XSS-Protection "1; mode=block";
+          add_header X-Robots-Tag none;
+          add_header X-Download-Options noopen;
+          add_header X-Permitted-Cross-Domain-Policies none;
+          add_header Referrer-Policy no-referrer;
+          error_page 403 /core/templates/403.php;
+          error_page 404 /core/templates/404.php;
+          client_max_body_size ${config.services.nextcloud.maxUploadSize};
+          fastcgi_buffers 64 4K;
+          fastcgi_hide_header X-Powered-By;
+          gzip on;
+          gzip_vary on;
+          gzip_comp_level 4;
+          gzip_min_length 256;
+          gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+          gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+          ${optionalString config.services.nextcloud.webfinger ''
+            rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
+            rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
+          ''}
+        '';
+      };
 
-      "git.ophanim.de" = {
+      "${config.services.gitea.domain}" = mkIf config.services.gitea.enable {
         enableACME = true;
         forceSSL = true;
-        root = "/var/lib/gitea/public";
+        root = "${config.services.gitea.stateDir}/public";
         extraConfig = ''
           location / {
             try_files maintain.html $uri $uri/index.html @node;

services/xserver.nix

@@ -1,6 +1,8 @@
 { config, lib, pkgs, ... }:
 
-{
+with lib;
+
+mkIf (elem "xserver" config.machine.services) {
   services.gnome3.gvfs.enable = true;
   environment.variables.GIO_EXTRA_MODULES = [ "${pkgs.gnome3.gvfs}/lib/gio/modules" ];
   services.xserver = {