RGBCube/ncc
1
Fork 0
mirror of https://github.com/RGBCube/ncc synced 2025-07-30 03:27:45 +00:00
Code Issues Activity

fix: fix http configs

Browse source
This commit is contained in:
RGBCube 2025-02-23 20:00:59 +03:00
parent 51c941ed04
commit 63e9359aad
7 changed files with 74 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

21
modules/nginx.nix
View file

@ -7,23 +7,20 @@ in {
options.services.nginx.sslTemplate = mkConst {
forceSSL = true;
quic = true;
useACMEHost = config.networking.domain;
useACMEHost = domain;
};
options.services.nginx.headers = mkConst ''
# TODO: Not working for some reason.
add_header Access-Control-Allow-Origin $allow_origin;
add_header Access-Control-Allow-Methods $allow_methods;
options.services.nginx.headers = mkConst /* nginx */ ''
add_header Access-Control-Allow-Origin $allow_origin always;
add_header Access-Control-Allow-Methods $allow_methods always;
add_header Strict-Transport-Security $hsts_header;
add_header Strict-Transport-Security $hsts_header always;
add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
add_header Content-Security-Policy "script-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'none';" always;
add_header Referrer-Policy no-referrer;
add_header Referrer-Policy no-referrer always;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options DENY always;
'';
config.networking.firewall = {
@ -50,7 +47,7 @@ in {
recommendedProxySettings = true;
recommendedTlsSettings = true;
commonHttpConfig = ''
commonHttpConfig = /* nginx */ ''
map $scheme $hsts_header {
https "max-age=31536000; includeSubdomains; preload";
}

28
modules/site.nix
View file

@ -5,8 +5,13 @@
pathSite = "/var/www/site";
configNotFoundLocation = {
extraConfig = "error_page 404 /404.html;";
locations."/404".extraConfig = "internal;";
extraConfig = /* nginx */ ''
error_page 404 /404.html;
'';
locations."/404".extraConfig = /* nginx */ ''
internal;
'';
};
in {
imports = [(self + /modules/nginx.nix)];
@ -17,11 +22,11 @@ in {
locations."/".tryFiles = "$uri $uri.html $uri/index.html =404";
locations."/assets/".extraConfig = ''
locations."/assets/".extraConfig = /* nginx */ ''
if ($request_method = OPTIONS) {
${config.services.nginx.headers}
add_header Content-Type text/plain;
add_header Content-Length 0;
add_header Content-Type text/plain always;
add_header Content-Length 0 always;
return 204;
}
@ -30,14 +35,21 @@ in {
};
virtualHosts."www.${domain}" = merge config.services.nginx.sslTemplate {
locations."/".extraConfig = "return 301 https://${domain}$request_uri;";
locations."/".extraConfig = /* nginx */ ''
return 301 https://${domain}$request_uri;
'';
};
virtualHosts._ = merge config.services.nginx.sslTemplate configNotFoundLocation {
root = pathSite;
locations."/".extraConfig = "return 404;";
locations."/assets/".extraConfig = "return 301 https://${domain}$request_uri;";
locations."/".extraConfig = /* nginx */ ''
return 404;
'';
locations."/assets/".extraConfig = /* nginx */ ''
return 301 https://${domain}$request_uri;
'';
};
};
}