non-critical-infra/nginx: init
Martin Weinelt committed
Jan 26, 2024 at 00:04 UTC
b5461cfe2f99a460085749f845eec8522fa53229
1 file changed
+27
non-critical-infra/modules/nginx.nix
new
+27
@@ -0,0 +1,27 @@
1
+{
2
+ networking.firewall = {
3
+ allowedTCPPorts = [ 80 443 ];
4
+ };
5
+
6
+ # Grant nginx access to certificates
7
+ systemd.services.nginx.serviceConfig.SupplementaryGroup = [
8
+ "acme"
9
+ ];
10
+
11
+ # Reload nginx after certificate renewal
12
+ security.acme.defaults.reloadServices = [
13
+ "nginx.service"
14
+ ];
15
+
16
+ services.nginx = {
17
+ enable = true;
18
+ enableReload = true;
19
+
20
+ recommendedBrotliSettings = true;
21
+ recommendedGzipSettings = true;
22
+ recommendedOptimisation = true;
23
+ recommendedProxySettings = true;
24
+ recommendedTlsSettings = true;
25
+ recommendedZstdSettings = true;
26
+ };
27
+}