35 lines
797 B
Nix
35 lines
797 B
Nix
|
{
|
||
|
|
lib,
|
||
|
|
pkgs,
|
||
|
|
config,
|
||
|
|
...
|
||
|
|
}:
|
||
|
|
{
|
||
|
|
services.nginx = {
|
||
|
|
enable = true;
|
||
|
|
|
||
|
|
recommendedTlsSettings = true;
|
||
|
|
recommendedProxySettings = true;
|
||
|
|
recommendedOptimisation = true;
|
||
|
|
recommendedGzipSettings = true;
|
||
|
|
|
||
|
|
appendHttpConfig = ''
|
||
|
|
# Add HSTS header with preloading to HTTPS requests.
|
||
|
|
# Adding this header to HTTP requests is discouraged
|
||
|
|
map $scheme $hsts_header {
|
||
|
|
https "max-age=63072000; includeSubDomains; preload";
|
||
|
|
}
|
||
|
|
add_header Strict-Transport-Security $hsts_header;
|
||
|
|
|
||
|
|
add_header 'Referrer-Policy' 'same-origin';
|
||
|
|
add_header X-Frame-Options DENY;
|
||
|
|
add_header X-Content-Type-Options nosniff;
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
|
||
|
|
security.acme = {
|
||
|
|
acceptTerms = true;
|
||
|
|
defaults.email = "hackerncoder+acme@encryptionin.space";
|
||
|
|
};
|
||
|
|
}
|