hardened nginx

1 files changed, 13 insertions, 1 deletions

diff --git a/hosts/vps/configuration.nix b/hosts/vps/configuration.nix
index 16c816f..3f0120f 100644
--- a/hosts/vps/configuration.nix
+++ b/hosts/vps/configuration.nix
@@ -43,6 +43,14 @@
 
   services.nginx = {
     enable = true;
+
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
+
     virtualHosts."schererleander.de" = {
       root = "/var/www/site";
       sslCertificate    = "/etc/ssl/certs/schererleander.de.crt";
@@ -60,11 +68,15 @@
     enable = true;
     hostName = "cloud.schererleander.de";
     database.createLocally = true;
-    configureRedis = true;
     maxUploadSize = "16G";
     config.dbtype = "mysql";
     config.adminuser = "schererleander";
     config.adminpassFile = "/etc/nextcloud-admin-pass";
+
+    settings = {
+      maintenance_window_start = 2; # 02:00
+      default_phone_region = "de";
+    };
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 8693 ];