2016-04-21 22:39:41 +02:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
|
2023-09-23 16:02:44 +02:00
|
|
|
{
|
2018-03-11 18:28:25 +01:00
|
|
|
config = lib.mkIf config.services.nginx.enable {
|
2021-05-29 18:05:31 +02:00
|
|
|
services.nginx = {
|
|
|
|
recommendedTlsSettings = true;
|
|
|
|
recommendedGzipSettings = true;
|
|
|
|
recommendedProxySettings = true;
|
|
|
|
recommendedOptimisation = true;
|
|
|
|
serverTokens = false;
|
|
|
|
sslDhparam = "/etc/nginx/dhparam.pem";
|
2021-01-03 16:40:38 +01:00
|
|
|
virtualHosts."${config.networking.hostName}.yori.cc" = {
|
2018-03-11 18:28:25 +01:00
|
|
|
enableACME = true;
|
|
|
|
forceSSL = true;
|
|
|
|
default = true;
|
|
|
|
};
|
|
|
|
};
|
2021-05-29 18:05:31 +02:00
|
|
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
|
|
system.activationScripts.nginxdhparams = ''
|
|
|
|
if ! [[ -e /etc/nginx/dhparam.pem ]]; then
|
|
|
|
mkdir -p /etc/nginx/
|
|
|
|
${pkgs.openssl}/bin/openssl dhparam -out /etc/nginx/dhparam.pem 2048
|
2022-09-14 14:35:06 +02:00
|
|
|
chown nginx:nginx /etc/nginx/dhparam.pem
|
2021-05-29 18:05:31 +02:00
|
|
|
fi
|
2018-03-11 18:28:25 +01:00
|
|
|
'';
|
2021-05-29 18:05:31 +02:00
|
|
|
};
|
2016-04-21 22:39:41 +02:00
|
|
|
|
|
|
|
}
|