diff options
author | sefidel <contact@sefidel.net> | 2023-03-29 20:54:19 +0900 |
---|---|---|
committer | sefidel <contact@sefidel.net> | 2023-04-03 18:32:29 +0900 |
commit | ce06f43476863da90dc60dcee606d2b6c5a89a8e (patch) | |
tree | 5d14946330cb09ff0ebd97bee59407fccee4d860 /modules/services/nginx.nix | |
download | infra-ce06f43476863da90dc60dcee606d2b6c5a89a8e.tar.gz infra-ce06f43476863da90dc60dcee606d2b6c5a89a8e.zip |
project: initial commit
Diffstat (limited to 'modules/services/nginx.nix')
-rw-r--r-- | modules/services/nginx.nix | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/modules/services/nginx.nix b/modules/services/nginx.nix new file mode 100644 index 0000000..f9a5a31 --- /dev/null +++ b/modules/services/nginx.nix @@ -0,0 +1,37 @@ +{ config, lib, ... }: + +with lib; +let + cfg = config.modules.services.nginx; +in +{ + options.modules.services.nginx = { + enable = mkEnableOption "nginx proxy"; + }; + config = mkIf cfg.enable { + modules.services.acme.enable = true; + + services.nginx = { + enable = true; + # prevent 3~5s downtime on update + enableReload = true; + + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + + # catch-all for unknown hosts. + virtualHosts."_" = { + default = true; + rejectSSL = true; + + extraConfig = '' + return 444; + ''; + }; + }; + + users.extraUsers.nginx.extraGroups = [ "acme" ]; + }; +} |