diff options
author | sefidel <contact@sefidel.net> | 2024-01-24 13:29:27 +0900 |
---|---|---|
committer | sefidel <contact@sefidel.net> | 2024-01-24 18:59:54 +0900 |
commit | 8e9b074467006c76768efe04cf1fb1ef9d652c67 (patch) | |
tree | fad73c7f94a74c77714c260d1fc0a63e2d205b49 /modules/services/nginx.nix | |
download | infra-modules-8e9b074467006c76768efe04cf1fb1ef9d652c67.tar.gz infra-modules-8e9b074467006c76768efe04cf1fb1ef9d652c67.zip |
Diffstat (limited to 'modules/services/nginx.nix')
-rw-r--r-- | modules/services/nginx.nix | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/modules/services/nginx.nix b/modules/services/nginx.nix new file mode 100644 index 0000000..f9a5a31 --- /dev/null +++ b/modules/services/nginx.nix @@ -0,0 +1,37 @@ +{ config, lib, ... }: + +with lib; +let + cfg = config.modules.services.nginx; +in +{ + options.modules.services.nginx = { + enable = mkEnableOption "nginx proxy"; + }; + config = mkIf cfg.enable { + modules.services.acme.enable = true; + + services.nginx = { + enable = true; + # prevent 3~5s downtime on update + enableReload = true; + + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + + # catch-all for unknown hosts. + virtualHosts."_" = { + default = true; + rejectSSL = true; + + extraConfig = '' + return 444; + ''; + }; + }; + + users.extraUsers.nginx.extraGroups = [ "acme" ]; + }; +} |