54 lines
1.5 KiB
Nix
54 lines
1.5 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
snakeoilCert = pkgs.runCommand "nginx-snakeoil-cert" {buildInputs = [pkgs.openssl];} ''
|
|
mkdir "$out"
|
|
openssl req -newkey rsa:4096 -x509 -sha256 -days 36500 -subj '/CN=Snakeoil CA' -nodes -out "$out/cert.pem" -keyout "$out/cert.key"
|
|
'';
|
|
in {
|
|
services.nginx = {
|
|
enable = true;
|
|
package = pkgs.nginxMainline;
|
|
|
|
recommendedBrotliSettings = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
recommendedZstdSettings = true;
|
|
|
|
# https://github.com/NixOS/nixpkgs/issues/180980#issuecomment-1179723811
|
|
virtualHosts = {
|
|
"defaultDummy404" = {
|
|
default = true;
|
|
serverName = "_";
|
|
locations."/".extraConfig = "return 444;";
|
|
locations."/.well-known/acme-challenge".root = "/var/lib/acme/acme-challenge";
|
|
};
|
|
"defaultDummy404ssl" = {
|
|
default = true;
|
|
serverName = "_";
|
|
locations."/".extraConfig = "return 444;";
|
|
locations."/.well-known/acme-challenge".root = "/var/lib/acme/acme-challenge";
|
|
# Dummy SSL config
|
|
onlySSL = true;
|
|
sslCertificate = "${snakeoilCert}/cert.pem";
|
|
sslCertificateKey = "${snakeoilCert}/cert.key";
|
|
};
|
|
};
|
|
|
|
sslDhparam = config.security.dhparams.params.nginx.path;
|
|
};
|
|
|
|
security.dhparams = {
|
|
enable = true;
|
|
params.nginx = {};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [80 443];
|
|
|
|
# allow nginx to access Acme secrets
|
|
users.users.nginx.extraGroups = ["acme"];
|
|
}
|