This repository has no description
1.7 kB
55 lines
1{
2 networking.firewall.allowedTCPPorts = [
3 80
4 443
5 ];
6 security.acme.acceptTerms = true;
7 security.acme.defaults.email = "acme@lassul.us";
8
9 services.nginx = {
10 enable = true;
11 recommendedGzipSettings = true;
12 recommendedOptimisation = true;
13 recommendedTlsSettings = true;
14
15 enableReload = true;
16
17 # nginx defaults to one worker with 512 connections, and a proxied
18 # websocket costs two of them (client + upstream). maze.lassul.us hit
19 # "512 worker_connections are not enough" at ~250 players, which takes
20 # down every other vhost on the box with it.
21 eventsConfig = ''
22 worker_connections 8192;
23 multi_accept on;
24 '';
25 appendConfig = ''
26 worker_processes auto;
27 worker_rlimit_nofile 65536;
28 '';
29
30 # avoid nixpkgs nginx's /tmp/nginx_* compile-time defaults: under
31 # systemd PrivateTmp they don't survive a host `rm -rf /tmp/*`.
32 appendHttpConfig = ''
33 client_body_temp_path /var/cache/nginx/client_body;
34 proxy_temp_path /var/cache/nginx/proxy;
35 fastcgi_temp_path /var/cache/nginx/fastcgi;
36 uwsgi_temp_path /var/cache/nginx/uwsgi;
37 scgi_temp_path /var/cache/nginx/scgi;
38 '';
39
40 virtualHosts.default = {
41 default = true;
42 locations."/".extraConfig = ''
43 return 404;
44 '';
45 locations."= /etc/os-release".extraConfig = ''
46 default_type text/plain;
47 alias /etc/os-release;
48 '';
49 locations."~ ^/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
50 };
51 };
52
53 # worker_rlimit_nofile above only matters if systemd lets nginx have them.
54 systemd.services.nginx.serviceConfig.LimitNOFILE = 65536;
55}