c3d2/nixos-modules
c3d2/nixos-modules
22
0
Fork 0
mirror of https://github.com/SuperSandro2000/nixos-modules.git synced 2024-05-29 04:20:47 +02:00
Code Releases Activity

nginx: assert that HSTS header are set correctly

Browse Source
This commit is contained in:
Sandro - 2024-04-24 21:49:12 +02:00
parent d1bb9acd4a
commit 3aa5a47abe
Signed by: sandro
GPG Key ID: 3AF5A43A3EECC2E5
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
modules/nginx.nix
View File

@ -88,6 +88,13 @@ in
];
config = lib.mkIf cfg.enable {
assertions = lib.mkIf cfg.setHSTSHeader (lib.attrValues (lib.mapAttrs (host: hostConfig: {
assertion = hostConfig.root == null;
message = let
name = ''services.nginx.virtualHosts."${host}"'';
in "Use ${name}.locations./.root instead of ${name}.root to properly apply .locations.*.extraConfig set by services.nginx.setHSTSHeader";
}) cfg.virtualHosts));
boot.kernel.sysctl = lib.mkIf cfg.tcpFastOpen {
# enable tcp fastopen for outgoing and incoming connections
"net.ipv4.tcp_fastopen" = 3;