infrastructure

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README

nginx.nix (1732B)

      1 {
      2   config,
      3   lib,
      4   ...
      5 }:
      6 
      7 let
      8   cfg = config.services.local.nginx-hardened;
      9 in
     10 {
     11   options.services.local.nginx-hardened = {
     12     enable = lib.mkEnableOption "Hardened nginx configuration";
     13 
     14     rateLimit = lib.mkOption {
     15       type = lib.types.str;
     16       default = "10r/s";
     17       description = "Rate limit (requests per second)";
     18     };
     19 
     20     rateLimitZoneSize = lib.mkOption {
     21       type = lib.types.str;
     22       default = "10m";
     23       description = "Size of the rate limit zone";
     24     };
     25 
     26     rateLimitBurst = lib.mkOption {
     27       type = lib.types.int;
     28       default = 20;
     29       description = "Burst size for rate limiting";
     30     };
     31 
     32     enableCatchAll = lib.mkOption {
     33       type = lib.types.bool;
     34       default = true;
     35       description = "Enable catch-all vhost that rejects unknown hostnames";
     36     };
     37 
     38     acmeEmail = lib.mkOption {
     39       type = lib.types.str;
     40       description = "Email for ACME/Let's Encrypt";
     41     };
     42   };
     43 
     44   config = lib.mkIf cfg.enable {
     45     security.acme = {
     46       acceptTerms = true;
     47       defaults.email = cfg.acmeEmail;
     48     };
     49 
     50     services.nginx = {
     51       enable = true;
     52       recommendedGzipSettings = true;
     53       recommendedBrotliSettings = true;
     54       recommendedOptimisation = true;
     55       recommendedTlsSettings = true;
     56       recommendedProxySettings = true;
     57 
     58       commonHttpConfig = ''
     59         limit_req_zone $binary_remote_addr zone=ratelimit:${cfg.rateLimitZoneSize} rate=${cfg.rateLimit};
     60       '';
     61 
     62       appendHttpConfig = ''
     63         limit_req_status 429;
     64       '';
     65 
     66       virtualHosts = lib.mkIf cfg.enableCatchAll {
     67         "_" = {
     68           default = true;
     69           rejectSSL = true;
     70           locations."/" = {
     71             return = "444";
     72           };
     73         };
     74       };
     75     };
     76   };
     77 }