This repository has no description
6.2 kB
184 lines
1{ lib, pkgs, ... }:
2
3with lib;
4
5rec {
6
7 ssl = domains :
8 let
9 domain = head domains;
10 in {
11 };
12
13 servePage = domains:
14 let
15 domain = head domains;
16 in {
17 services.nginx.virtualHosts.${domain} = {
18 enableACME = true;
19 addSSL = true;
20 serverAliases = domains;
21 locations."/".extraConfig = ''
22 root /srv/http/${domain};
23 '';
24 };
25 };
26
27 serveOwncloud = domains:
28 let
29 domain = head domains;
30 in {
31 services.nginx.virtualHosts."${domain}" = {
32 enableACME = true;
33 addSSL = true;
34 serverAliases = domains;
35 extraConfig = ''
36 # Add headers to serve security related headers
37 add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
38 add_header X-Content-Type-Options nosniff;
39 add_header X-Frame-Options "SAMEORIGIN";
40 add_header X-XSS-Protection "1; mode=block";
41 add_header X-Robots-Tag none;
42 add_header X-Download-Options noopen;
43 add_header X-Permitted-Cross-Domain-Policies none;
44
45 # Path to the root of your installation
46 root /srv/http/${domain}/;
47 # set max upload size
48 client_max_body_size 10G;
49 fastcgi_buffers 64 4K;
50 fastcgi_read_timeout 120;
51
52 # Disable gzip to avoid the removal of the ETag header
53 gzip off;
54
55 # Uncomment if your server is build with the ngx_pagespeed module
56 # This module is currently not supported.
57 #pagespeed off;
58
59 index index.php;
60 error_page 403 /core/templates/403.php;
61 error_page 404 /core/templates/404.php;
62
63 rewrite ^/.well-known/carddav /remote.php/carddav/ permanent;
64 rewrite ^/.well-known/caldav /remote.php/caldav/ permanent;
65
66 # The following 2 rules are only needed for the user_webfinger app.
67 # Uncomment it if you're planning to use this app.
68 rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
69 rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
70 '';
71 locations."/robots.txt".extraConfig = ''
72 allow all;
73 log_not_found off;
74 access_log off;
75 '';
76 locations."~ ^/(build|tests|config|lib|3rdparty|templates|data)/".extraConfig = ''
77 deny all;
78 '';
79
80 locations."~ ^/(?:autotest|occ|issue|indie|db_|console)".extraConfig = ''
81 deny all;
82 '';
83
84 locations."/".extraConfig = ''
85 rewrite ^/remote/(.*) /remote.php last;
86 rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;
87 try_files $uri $uri/ =404;
88 '';
89
90 locations."~ \.php(?:$|/)".extraConfig = ''
91 fastcgi_split_path_info ^(.+\.php)(/.+)$;
92 include ${pkgs.nginx}/conf/fastcgi_params;
93 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
94 fastcgi_param PATH_INFO $fastcgi_path_info;
95 fastcgi_param HTTPS on;
96 fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
97 fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
98 fastcgi_intercept_errors on;
99 '';
100
101 # Adding the cache control header for js and css files
102 # Make sure it is BELOW the location ~ \.php(?:$|/) { block
103 locations."~* \.(?:css|js)$".extraConfig = ''
104 add_header Cache-Control "public, max-age=7200";
105 # Add headers to serve security related headers
106 add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
107 add_header X-Content-Type-Options nosniff;
108 add_header X-Frame-Options "SAMEORIGIN";
109 add_header X-XSS-Protection "1; mode=block";
110 add_header X-Robots-Tag none;
111 # Optional: Don't log access to assets
112 access_log off;
113 '';
114 # Optional: Don't log access to other assets
115 locations."~* \.(?:jpg|jpeg|gif|bmp|ico|png|swf)$".extraConfig = ''
116 access_log off;
117 '';
118 };
119 services.phpfpm.pools."${domain}" = {
120 user = "nginx";
121 group = "nginx";
122 settings = {
123 listen = "/srv/http/${domain}/phpfpm.pool";
124 pm = "dynamic";
125 "pm.max_children" = 32;
126 "pm.max_requests" = 500;
127 "pm.start_servers" = 2;
128 "pm.min_spare_servers" = 2;
129 "pm.max_spare_servers" = 5;
130 };
131 };
132 };
133
134 serveWordpress = domains:
135 let
136 domain = head domains;
137
138 in {
139 services.nginx.virtualHosts."${domain}" = {
140 enableACME = true;
141 forceSSL = true;
142 serverAliases = domains;
143 extraConfig = ''
144 root /srv/http/${domain}/;
145 index index.php;
146 access_log /tmp/nginx_acc.log;
147 error_log /tmp/nginx_err.log;
148 error_page 404 /404.html;
149 error_page 500 502 503 504 /50x.html;
150 client_max_body_size 100m;
151 '';
152 locations."/".extraConfig = ''
153 try_files $uri $uri/ /index.php?$args;
154 '';
155 locations."~ \.php$".extraConfig = ''
156 fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
157 fastcgi_read_timeout 120;
158 include ${pkgs.nginx}/conf/fastcgi.conf;
159 '';
160 #Directives to send expires headers and turn off 404 error logging.
161 locations."~* ^.+\.(xml|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$".extraConfig = ''
162 access_log off;
163 log_not_found off;
164 expires max;
165 '';
166 locations."/nb".extraConfig = ''
167 index index.html;
168 '';
169 };
170 services.phpfpm.pools."${domain}" = {
171 user = "nginx";
172 group = "nginx";
173 settings = {
174 listen = "/srv/http/${domain}/phpfpm.pool";
175 pm = "dynamic";
176 "pm.max_children" = 32;
177 "pm.max_requests" = 500;
178 "pm.start_servers" = 2;
179 "pm.min_spare_servers" = 2;
180 "pm.max_spare_servers" = 5;
181 };
182 };
183 };
184}