This repository has no description
6.2 kB
188 lines
1{ lib, pkgs, ... }:
2
3with lib;
4
5rec {
6
7 ssl = _domains: {
8 };
9
10 servePage =
11 domains:
12 let
13 domain = head domains;
14 in
15 {
16 services.nginx.virtualHosts.${domain} = {
17 enableACME = true;
18 addSSL = true;
19 serverAliases = domains;
20 locations."/".extraConfig = ''
21 root /srv/http/${domain};
22 '';
23 };
24 };
25
26 serveOwncloud =
27 domains:
28 let
29 domain = head domains;
30 in
31 {
32 services.nginx.virtualHosts."${domain}" = {
33 enableACME = true;
34 addSSL = true;
35 serverAliases = domains;
36 extraConfig = ''
37 # Add headers to serve security related headers
38 add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
39 add_header X-Content-Type-Options nosniff;
40 add_header X-Frame-Options "SAMEORIGIN";
41 add_header X-XSS-Protection "1; mode=block";
42 add_header X-Robots-Tag none;
43 add_header X-Download-Options noopen;
44 add_header X-Permitted-Cross-Domain-Policies none;
45
46 # Path to the root of your installation
47 root /srv/http/${domain}/;
48 # set max upload size
49 client_max_body_size 10G;
50 fastcgi_buffers 64 4K;
51 fastcgi_read_timeout 120;
52
53 # Disable gzip to avoid the removal of the ETag header
54 gzip off;
55
56 # Uncomment if your server is build with the ngx_pagespeed module
57 # This module is currently not supported.
58 #pagespeed off;
59
60 index index.php;
61 error_page 403 /core/templates/403.php;
62 error_page 404 /core/templates/404.php;
63
64 rewrite ^/.well-known/carddav /remote.php/carddav/ permanent;
65 rewrite ^/.well-known/caldav /remote.php/caldav/ permanent;
66
67 # The following 2 rules are only needed for the user_webfinger app.
68 # Uncomment it if you're planning to use this app.
69 rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
70 rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
71 '';
72 locations."/robots.txt".extraConfig = ''
73 allow all;
74 log_not_found off;
75 access_log off;
76 '';
77 locations."~ ^/(build|tests|config|lib|3rdparty|templates|data)/".extraConfig = ''
78 deny all;
79 '';
80
81 locations."~ ^/(?:autotest|occ|issue|indie|db_|console)".extraConfig = ''
82 deny all;
83 '';
84
85 locations."/".extraConfig = ''
86 rewrite ^/remote/(.*) /remote.php last;
87 rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;
88 try_files $uri $uri/ =404;
89 '';
90
91 locations."~ \.php(?:$|/)".extraConfig = ''
92 fastcgi_split_path_info ^(.+\.php)(/.+)$;
93 include ${pkgs.nginx}/conf/fastcgi_params;
94 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
95 fastcgi_param PATH_INFO $fastcgi_path_info;
96 fastcgi_param HTTPS on;
97 fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
98 fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
99 fastcgi_intercept_errors on;
100 '';
101
102 # Adding the cache control header for js and css files
103 # Make sure it is BELOW the location ~ \.php(?:$|/) { block
104 locations."~* \.(?:css|js)$".extraConfig = ''
105 add_header Cache-Control "public, max-age=7200";
106 # Add headers to serve security related headers
107 add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
108 add_header X-Content-Type-Options nosniff;
109 add_header X-Frame-Options "SAMEORIGIN";
110 add_header X-XSS-Protection "1; mode=block";
111 add_header X-Robots-Tag none;
112 # Optional: Don't log access to assets
113 access_log off;
114 '';
115 # Optional: Don't log access to other assets
116 locations."~* \.(?:jpg|jpeg|gif|bmp|ico|png|swf)$".extraConfig = ''
117 access_log off;
118 '';
119 };
120 services.phpfpm.pools."${domain}" = {
121 user = "nginx";
122 group = "nginx";
123 settings = {
124 listen = "/srv/http/${domain}/phpfpm.pool";
125 pm = "dynamic";
126 "pm.max_children" = 32;
127 "pm.max_requests" = 500;
128 "pm.start_servers" = 2;
129 "pm.min_spare_servers" = 2;
130 "pm.max_spare_servers" = 5;
131 };
132 };
133 };
134
135 serveWordpress =
136 domains:
137 let
138 domain = head domains;
139
140 in
141 {
142 services.nginx.virtualHosts."${domain}" = {
143 enableACME = true;
144 forceSSL = true;
145 serverAliases = domains;
146 extraConfig = ''
147 root /srv/http/${domain}/;
148 index index.php;
149 access_log /tmp/nginx_acc.log;
150 error_log /tmp/nginx_err.log;
151 error_page 404 /404.html;
152 error_page 500 502 503 504 /50x.html;
153 client_max_body_size 100m;
154 '';
155 locations."/".extraConfig = ''
156 try_files $uri $uri/ /index.php?$args;
157 '';
158 locations."~ \.php$".extraConfig = ''
159 fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
160 fastcgi_read_timeout 120;
161 include ${pkgs.nginx}/conf/fastcgi.conf;
162 '';
163 #Directives to send expires headers and turn off 404 error logging.
164 locations."~* ^.+\.(xml|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$".extraConfig =
165 ''
166 access_log off;
167 log_not_found off;
168 expires max;
169 '';
170 locations."/nb".extraConfig = ''
171 index index.html;
172 '';
173 };
174 services.phpfpm.pools."${domain}" = {
175 user = "nginx";
176 group = "nginx";
177 settings = {
178 listen = "/srv/http/${domain}/phpfpm.pool";
179 pm = "dynamic";
180 "pm.max_children" = 32;
181 "pm.max_requests" = 500;
182 "pm.start_servers" = 2;
183 "pm.min_spare_servers" = 2;
184 "pm.max_spare_servers" = 5;
185 };
186 };
187 };
188}