c3d2/nixos-modules
c3d2/nixos-modules
22
0
Fork 0
mirror of https://github.com/SuperSandro2000/nixos-modules.git synced 2024-06-14 03:46:57 +02:00
Code Releases Activity

nginx: add less logs option

Browse Source
This commit is contained in:
Sandro - 2023-01-09 20:43:10 +01:00
parent 675d14e765
commit b46a07d24b
Signed by: sandro
GPG Key ID: 3AF5A43A3EECC2E5
1 changed files with 29 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
modules/nginx.nix
View File

@ -7,6 +7,8 @@ in
options.services.nginx = {
allRecommended = libS.mkOpinionatedOption "all recommended options";
keepLessLog = libS.mkOpinionatedOption "keep logs only for 7 days and rotate them daily";
generateDhparams = libS.mkOpinionatedOption "generate more secure, 2048 bits dhparams replacing the default 1024 bits";
openFirewall = libS.mkOpinionatedOption "open the firewall port for the http (80) and https (443) default ports";
@ -17,27 +19,34 @@ in
config = lib.mkIf cfg.enable {
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 80 443 ];
services.nginx = lib.mkMerge [
{
resolver.addresses = let
isIPv6 = addr: builtins.match ".*:.*:.*" addr != null;
escapeIPv6 = addr: if isIPv6 addr then
"[${addr}]"
else
addr;
in
lib.optionals (cfg.setResolverAddresses && config.networking.nameservers != [ ]) (map escapeIPv6 config.networking.nameservers);
sslDhparam = lib.mkIf cfg.generateDhparams config.security.dhparams.params.nginx.path;
}
services = {
logrotate.settings.nginx = lib.mkIf cfg.keepLessLog {
frequency = "daily";
rotate = 7;
};
(lib.mkIf cfg.allRecommended (libS.modules.mkRecursiveDefault {
recommendedBrotliSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
}))
];
nginx = lib.mkMerge [
{
resolver.addresses = let
isIPv6 = addr: builtins.match ".*:.*:.*" addr != null;
escapeIPv6 = addr: if isIPv6 addr then
"[${addr}]"
else
addr;
in
lib.optionals (cfg.setResolverAddresses && config.networking.nameservers != [ ]) (map escapeIPv6 config.networking.nameservers);
sslDhparam = lib.mkIf cfg.generateDhparams config.security.dhparams.params.nginx.path;
}
(lib.mkIf cfg.allRecommended (libS.modules.mkRecursiveDefault {
recommendedBrotliSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
}))
];
};
security.dhparams = lib.mkIf cfg.generateDhparams {
enable = cfg.generateDhparams;