This repository has no description
6.2 kB
189 lines
1{ lib, pkgs, ... }:
2
3with lib;
4
5rec {
6
7 ssl =
8 _domains:
9 {
10 };
11
12 servePage =
13 domains:
14 let
15 domain = head domains;
16 in
17 {
18 services.nginx.virtualHosts.${domain} = {
19 enableACME = true;
20 addSSL = true;
21 serverAliases = domains;
22 locations."/".extraConfig = ''
23 root /srv/http/${domain};
24 '';
25 };
26 };
27
28 serveOwncloud =
29 domains:
30 let
31 domain = head domains;
32 in
33 {
34 services.nginx.virtualHosts."${domain}" = {
35 enableACME = true;
36 addSSL = true;
37 serverAliases = domains;
38 extraConfig = ''
39 # Add headers to serve security related headers
40 add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
41 add_header X-Content-Type-Options nosniff;
42 add_header X-Frame-Options "SAMEORIGIN";
43 add_header X-XSS-Protection "1; mode=block";
44 add_header X-Robots-Tag none;
45 add_header X-Download-Options noopen;
46 add_header X-Permitted-Cross-Domain-Policies none;
47
48 # Path to the root of your installation
49 root /srv/http/${domain}/;
50 # set max upload size
51 client_max_body_size 10G;
52 fastcgi_buffers 64 4K;
53 fastcgi_read_timeout 120;
54
55 # Disable gzip to avoid the removal of the ETag header
56 gzip off;
57
58 # Uncomment if your server is build with the ngx_pagespeed module
59 # This module is currently not supported.
60 #pagespeed off;
61
62 index index.php;
63 error_page 403 /core/templates/403.php;
64 error_page 404 /core/templates/404.php;
65
66 rewrite ^/.well-known/carddav /remote.php/carddav/ permanent;
67 rewrite ^/.well-known/caldav /remote.php/caldav/ permanent;
68
69 # The following 2 rules are only needed for the user_webfinger app.
70 # Uncomment it if you're planning to use this app.
71 rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
72 rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
73 '';
74 locations."/robots.txt".extraConfig = ''
75 allow all;
76 log_not_found off;
77 access_log off;
78 '';
79 locations."~ ^/(build|tests|config|lib|3rdparty|templates|data)/".extraConfig = ''
80 deny all;
81 '';
82
83 locations."~ ^/(?:autotest|occ|issue|indie|db_|console)".extraConfig = ''
84 deny all;
85 '';
86
87 locations."/".extraConfig = ''
88 rewrite ^/remote/(.*) /remote.php last;
89 rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;
90 try_files $uri $uri/ =404;
91 '';
92
93 locations."~ \.php(?:$|/)".extraConfig = ''
94 fastcgi_split_path_info ^(.+\.php)(/.+)$;
95 include ${pkgs.nginx}/conf/fastcgi_params;
96 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
97 fastcgi_param PATH_INFO $fastcgi_path_info;
98 fastcgi_param HTTPS on;
99 fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
100 fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
101 fastcgi_intercept_errors on;
102 '';
103
104 # Adding the cache control header for js and css files
105 # Make sure it is BELOW the location ~ \.php(?:$|/) { block
106 locations."~* \.(?:css|js)$".extraConfig = ''
107 add_header Cache-Control "public, max-age=7200";
108 # Add headers to serve security related headers
109 add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
110 add_header X-Content-Type-Options nosniff;
111 add_header X-Frame-Options "SAMEORIGIN";
112 add_header X-XSS-Protection "1; mode=block";
113 add_header X-Robots-Tag none;
114 # Optional: Don't log access to assets
115 access_log off;
116 '';
117 # Optional: Don't log access to other assets
118 locations."~* \.(?:jpg|jpeg|gif|bmp|ico|png|swf)$".extraConfig = ''
119 access_log off;
120 '';
121 };
122 services.phpfpm.pools."${domain}" = {
123 user = "nginx";
124 group = "nginx";
125 settings = {
126 listen = "/srv/http/${domain}/phpfpm.pool";
127 pm = "dynamic";
128 "pm.max_children" = 32;
129 "pm.max_requests" = 500;
130 "pm.start_servers" = 2;
131 "pm.min_spare_servers" = 2;
132 "pm.max_spare_servers" = 5;
133 };
134 };
135 };
136
137 serveWordpress =
138 domains:
139 let
140 domain = head domains;
141
142 in
143 {
144 services.nginx.virtualHosts."${domain}" = {
145 enableACME = true;
146 forceSSL = true;
147 serverAliases = domains;
148 extraConfig = ''
149 root /srv/http/${domain}/;
150 index index.php;
151 access_log /tmp/nginx_acc.log;
152 error_log /tmp/nginx_err.log;
153 error_page 404 /404.html;
154 error_page 500 502 503 504 /50x.html;
155 client_max_body_size 100m;
156 '';
157 locations."/".extraConfig = ''
158 try_files $uri $uri/ /index.php?$args;
159 '';
160 locations."~ \.php$".extraConfig = ''
161 fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
162 fastcgi_read_timeout 120;
163 include ${pkgs.nginx}/conf/fastcgi.conf;
164 '';
165 #Directives to send expires headers and turn off 404 error logging.
166 locations."~* ^.+\.(xml|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$".extraConfig = ''
167 access_log off;
168 log_not_found off;
169 expires max;
170 '';
171 locations."/nb".extraConfig = ''
172 index index.html;
173 '';
174 };
175 services.phpfpm.pools."${domain}" = {
176 user = "nginx";
177 group = "nginx";
178 settings = {
179 listen = "/srv/http/${domain}/phpfpm.pool";
180 pm = "dynamic";
181 "pm.max_children" = 32;
182 "pm.max_requests" = 500;
183 "pm.start_servers" = 2;
184 "pm.min_spare_servers" = 2;
185 "pm.max_spare_servers" = 5;
186 };
187 };
188 };
189}