nix-config/config/default.nix

{ config, lib, ... }:

# this file contains default configuration that may be turned on depending on other config settings.
# options should go to modules.

lib.mkMerge [
  {
    assertions = [{
      assertion = config.users.users.root.password == null;
      message = "Root passwords not allowed in HQ";
    }];
  }

  (lib.mkIf config.services.nginx.enable {
    services.nginx = {
      openFirewall = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;
    };
  })
]