This repository has no description
8.5 kB
249 lines
1{ lib, pkgs, ... }:
2
3with lib;
4
5rec {
6
7 ssl = domains :
8 let
9 domain = head domains;
10 in {
11 };
12
13 servePage = domains:
14 let
15 domain = head domains;
16 in {
17 services.nginx.virtualHosts.${domain} = {
18 enableACME = true;
19 addSSL = true;
20 serverAliases = domains;
21 locations."/".extraConfig = ''
22 root /srv/http/${domain};
23 '';
24 };
25 };
26
27 servephpBB = domains:
28 let
29 domain = head domains;
30
31 in {
32 services.nginx.virtualHosts."${domain}" = {
33 serverAliases = domains;
34 extraConfig = ''
35 index index.php;
36 root /srv/http/${domain}/;
37 access_log /tmp/nginx_acc.log;
38 error_log /tmp/nginx_err.log;
39 error_page 404 /404.html;
40 error_page 500 502 503 504 /50x.html;
41 client_max_body_size 100m;
42 '';
43 locations."/".extraConfig = ''
44 try_files $uri $uri/ /index.php?$args;
45 '';
46 locations."~ \.php(?:$|/)".extraConfig = ''
47 fastcgi_split_path_info ^(.+\.php)(/.+)$;
48 include ${pkgs.nginx}/conf/fastcgi_params;
49 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
50 fastcgi_param PATH_INFO $fastcgi_path_info;
51 fastcgi_param HTTPS on;
52 fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
53 fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
54 fastcgi_intercept_errors on;
55 '';
56 #Directives to send expires headers and turn off 404 error logging.
57 locations."~* ^.+\.(xml|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$".extraConfig = ''
58 access_log off;
59 log_not_found off;
60 expires max;
61 '';
62 };
63 services.phpfpm.pools."${domain}" = {
64 user = "nginx";
65 group = "nginx";
66 extraConfig = ''
67 listen = /srv/http/${domain}/phpfpm.pool
68 pm = dynamic
69 pm.max_children = 25
70 pm.start_servers = 5
71 pm.min_spare_servers = 3
72 pm.max_spare_servers = 20
73 listen.owner = nginx
74 listen.group = nginx
75 php_admin_value[error_log] = 'stderr'
76 php_admin_flag[log_errors] = on
77 catch_workers_output = yes
78 '';
79 };
80 };
81
82 serveOwncloud = domains:
83 let
84 domain = head domains;
85 in {
86 services.nginx.virtualHosts."${domain}" = {
87 enableACME = true;
88 addSSL = true;
89 serverAliases = domains;
90 extraConfig = ''
91 # Add headers to serve security related headers
92 add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
93 add_header X-Content-Type-Options nosniff;
94 add_header X-Frame-Options "SAMEORIGIN";
95 add_header X-XSS-Protection "1; mode=block";
96 add_header X-Robots-Tag none;
97 add_header X-Download-Options noopen;
98 add_header X-Permitted-Cross-Domain-Policies none;
99
100 # Path to the root of your installation
101 root /srv/http/${domain}/;
102 # set max upload size
103 client_max_body_size 10G;
104 fastcgi_buffers 64 4K;
105 fastcgi_read_timeout 120;
106
107 # Disable gzip to avoid the removal of the ETag header
108 gzip off;
109
110 # Uncomment if your server is build with the ngx_pagespeed module
111 # This module is currently not supported.
112 #pagespeed off;
113
114 index index.php;
115 error_page 403 /core/templates/403.php;
116 error_page 404 /core/templates/404.php;
117
118 rewrite ^/.well-known/carddav /remote.php/carddav/ permanent;
119 rewrite ^/.well-known/caldav /remote.php/caldav/ permanent;
120
121 # The following 2 rules are only needed for the user_webfinger app.
122 # Uncomment it if you're planning to use this app.
123 rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
124 rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
125 '';
126 locations."/robots.txt".extraConfig = ''
127 allow all;
128 log_not_found off;
129 access_log off;
130 '';
131 locations."~ ^/(build|tests|config|lib|3rdparty|templates|data)/".extraConfig = ''
132 deny all;
133 '';
134
135 locations."~ ^/(?:autotest|occ|issue|indie|db_|console)".extraConfig = ''
136 deny all;
137 '';
138
139 locations."/".extraConfig = ''
140 rewrite ^/remote/(.*) /remote.php last;
141 rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;
142 try_files $uri $uri/ =404;
143 '';
144
145 locations."~ \.php(?:$|/)".extraConfig = ''
146 fastcgi_split_path_info ^(.+\.php)(/.+)$;
147 include ${pkgs.nginx}/conf/fastcgi_params;
148 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
149 fastcgi_param PATH_INFO $fastcgi_path_info;
150 fastcgi_param HTTPS on;
151 fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
152 fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
153 fastcgi_intercept_errors on;
154 '';
155
156 # Adding the cache control header for js and css files
157 # Make sure it is BELOW the location ~ \.php(?:$|/) { block
158 locations."~* \.(?:css|js)$".extraConfig = ''
159 add_header Cache-Control "public, max-age=7200";
160 # Add headers to serve security related headers
161 add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
162 add_header X-Content-Type-Options nosniff;
163 add_header X-Frame-Options "SAMEORIGIN";
164 add_header X-XSS-Protection "1; mode=block";
165 add_header X-Robots-Tag none;
166 # Optional: Don't log access to assets
167 access_log off;
168 '';
169 # Optional: Don't log access to other assets
170 locations."~* \.(?:jpg|jpeg|gif|bmp|ico|png|swf)$".extraConfig = ''
171 access_log off;
172 '';
173 };
174 services.phpfpm.pools."${domain}" = {
175 user = "nginx";
176 group = "nginx";
177 extraConfig = ''
178 listen = /srv/http/${domain}/phpfpm.pool
179 pm = dynamic
180 pm.max_children = 32
181 pm.max_requests = 500
182 pm.start_servers = 2
183 pm.min_spare_servers = 2
184 pm.max_spare_servers = 5
185 listen.owner = nginx
186 listen.group = nginx
187 php_admin_value[error_log] = 'stderr'
188 php_admin_flag[log_errors] = on
189 catch_workers_output = yes
190 '';
191 };
192 };
193
194 serveWordpress = domains:
195 let
196 domain = head domains;
197
198 in {
199 services.nginx.virtualHosts."${domain}" = {
200 enableACME = true;
201 forceSSL = true;
202 serverAliases = domains;
203 extraConfig = ''
204 root /srv/http/${domain}/;
205 index index.php;
206 access_log /tmp/nginx_acc.log;
207 error_log /tmp/nginx_err.log;
208 error_page 404 /404.html;
209 error_page 500 502 503 504 /50x.html;
210 client_max_body_size 100m;
211 '';
212 locations."/".extraConfig = ''
213 try_files $uri $uri/ /index.php?$args;
214 '';
215 locations."~ \.php$".extraConfig = ''
216 fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
217 fastcgi_read_timeout 120;
218 include ${pkgs.nginx}/conf/fastcgi.conf;
219 '';
220 #Directives to send expires headers and turn off 404 error logging.
221 locations."~* ^.+\.(xml|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$".extraConfig = ''
222 access_log off;
223 log_not_found off;
224 expires max;
225 '';
226 locations."/nb".extraConfig = ''
227 index index.html;
228 '';
229 };
230 services.phpfpm.pools."${domain}" = {
231 user = "nginx";
232 group = "nginx";
233 extraConfig = ''
234 listen = /srv/http/${domain}/phpfpm.pool
235 pm = dynamic
236 pm.max_children = 25
237 pm.start_servers = 5
238 pm.min_spare_servers = 3
239 pm.max_spare_servers = 20
240 listen.owner = nginx
241 listen.group = nginx
242 php_admin_value[error_log] = 'stderr'
243 php_admin_flag[log_errors] = on
244 catch_workers_output = yes
245 '';
246 };
247 };
248
249}