From 3b5a73c436eb22e0cda59469263490705e149cb9 Mon Sep 17 00:00:00 2001
From: schererleander <leander@schererleander.de>
Date: Fri, 9 Jan 2026 16:57:15 +0100
Subject: refactor: use flake-parts, change modules structure

---
 modules/nixos/server/nginx/default.nix | 54 ++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 modules/nixos/server/nginx/default.nix

(limited to 'modules/nixos/server/nginx')

diff --git a/modules/nixos/server/nginx/default.nix b/modules/nixos/server/nginx/default.nix
new file mode 100644
index 0000000..2bdaba1
--- /dev/null
+++ b/modules/nixos/server/nginx/default.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib) mkEnableOption mkOption types mkIf;
+  cfg = config.nx.server.nginx;
+in
+{
+  options.nx.server.nginx = {
+    enable = mkEnableOption "nginx reverse proxy" // {
+      default = true;
+    };
+    hostName = mkOption {
+      description = "url of server";
+      type = types.str;
+      default = "schererleander.de";
+    };
+    sslCertificate = mkOption {
+      description = "ssl certificate to use";
+      type = types.nullOr types.str;
+      default = "/etc/ssl/${cfg.hostName}/fullchain.pem";
+    };
+    sslCertificateKey = mkOption {
+      description = "ssl certificate key to use";
+      type = types.nullOr types.str;
+      default = "/etc/ssl/${cfg.hostName}/privkey.key";
+    };
+  };
+  config = mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      appendHttpConfig = ''
+        map $scheme $hsts_header {
+            https   "max-age=31536000; includeSubdomains; preload";
+        }
+        add_header Strict-Transport-Security $hsts_header;
+        #add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self';" always;
+        add_header 'Referrer-Policy' 'same-origin';
+        add_header X-Frame-Options DENY;
+        add_header X-Content-Type-Options nosniff;
+      '';
+    };
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+  };
+}
-- 
cgit v1.3.1