From 096591d322689b15572a53c8adfea01e69cd94b3 Mon Sep 17 00:00:00 2001
From: Leander Scherer <leander@schererleander.de>
Date: Sun, 5 Apr 2026 13:52:24 +0200
Subject: feat(nginx): change conflicting http headers and disable gzip to
 align with nextcloud hardening doc

---
 modules/services/nginx.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

(limited to 'modules/services')

diff --git a/modules/services/nginx.nix b/modules/services/nginx.nix
index 73ed594..ebece15 100644
--- a/modules/services/nginx.nix
+++ b/modules/services/nginx.nix
@@ -2,7 +2,7 @@
   flake.modules.nixos.nginx = {
     services.nginx = {
       enable = true;
-      recommendedGzipSettings = true;
+      recommendedGzipSettings = false;
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
@@ -12,9 +12,6 @@
         }
         add_header Strict-Transport-Security $hsts_header;
         #add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self';" always;
-        add_header 'Referrer-Policy' 'same-origin';
-        add_header X-Frame-Options DENY;
-        add_header X-Content-Type-Options nosniff;
       '';
     };
     networking.firewall.allowedTCPPorts = [
-- 
cgit v1.3.1