c3d2/nixos-modules
c3d2/nixos-modules
22
0
Fork 0
mirror of https://github.com/SuperSandro2000/nixos-modules.git synced 2024-06-09 17:54:06 +02:00
Code Releases Activity

nginx: add dhparams, enable recommended defaults

Browse Source
This commit is contained in:
Sandro - 2023-01-01 20:37:47 +01:00
parent 78ec98a750
commit c637341236
Signed by: sandro
GPG Key ID: 3AF5A43A3EECC2E5
1 changed files with 33 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
modules/nginx.nix
View File

@ -1,16 +1,44 @@
{ config, lib, ... }:
{ config, lib, libS, ... }:
let
cfg = config.services.nginx;
in
{
options.services.nginx.openFirewall = lib.mkOption {
type = lib.types.bool;
default = config.opinionatedDefaults;
description = lib.mdDoc "Wether to open the firewall port for the http (80) and https (443) default ports.";
options.services.nginx = {
generateDhparams = lib.mkOption {
type = lib.types.bool;
default = config.opinionatedDefaults;
description = lib.mdDoc "Wether to generate more secure, 2048 bits dhparams replacing the default 1024 bits.";
};
openFirewall = lib.mkOption {
type = lib.types.bool;
default = config.opinionatedDefaults;
description = lib.mdDoc "Wether to open the firewall port for the http (80) and https (443) default ports.";
};
};
config = lib.mkIf cfg.enable {
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 80 443 ];
services.nginx = lib.mkMerge [
{
sslDhparam = config.security.dhparams.params.nginx.path;
}
(lib.mkIf config.opinionatedDefaults (libS.modules.mkRecursiveDefault {
recommendedBrotliSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
resolver.addresses = lib.optionals (config.networking.nameservers != [ ]) config.networking.nameservers;
}))
];
security.dhparams = {
enable = cfg.generateDhparams;
params.nginx = { };
};
};
}