nixos/profiles/services/nginx.nix

   1 {
   2   lib,
   3   config,
   4   host,
   5   hostName,
   6   inputs,
   7   ...
   8 }:
   9 let
  10   inherit (lib) types;
  11   inherit (config) networking;
  12   inherit (config.services) nginx;
  13 in
  14 {
  15   options = {
  16     services.nginx = {
  17       configs = lib.mkOption {
  18         type = types.attrsOf types.lines;
  19         default = { };
  20         description = ''
  21           Make some configs available to all virtual hosts.
  22           Useful to workaround the reset of add_header:
  23           https://blog.g3rt.nl/nginx-add_header-pitfall.html
  24         '';
  25         #apply = lib.mapAttrs (name: pkgs.writeText "${name}.conf");
  26       };
  27     };
  28   };
  29   config = {
  30     systemd.tmpfiles.rules = [
  31       "d '/dev/shm/nginx' '750' '${nginx.user}' '${nginx.group}' - -"
  32     ];
  33     systemd.services.nginx = {
  34       requires = [ "systemd-tmpfiles-setup-dev.service" ];
  35       serviceConfig = {
  36         # FIXME: remove all the mkForce in LogsDirectory
  37         # whenever upstream uses a list instead of a string.
  38         LogsDirectory = lib.mkForce [ "nginx" ];
  39         StateDirectory = [ "nginx" ];
  40         StateDirectoryMode = "2771";
  41         #BindPaths = ["/dev/shm/nginx:/var/cache/nginx"];
  42       };
  43     };
  44     services.logrotate = {
  45       enable = true;
  46       settings.nginx = {
  47         files = [
  48           "/var/log/nginx/*.log"
  49           "/var/log/nginx/*/*.log"
  50           "/var/log/nginx/*/*/*.log"
  51           "/var/log/nginx/*/*/*/*.log"
  52           "/var/log/nginx/*/*/*/*/*.log"
  53           "/var/log/nginx/*.json"
  54           "/var/log/nginx/*/*.json"
  55           "/var/log/nginx/*/*/*.json"
  56           "/var/log/nginx/*/*/*/*.json"
  57           "/var/log/nginx/*/*/*/*/*.json"
  58         ];
  59         frequency = "weekly";
  60         rotate = 26;
  61         compress = true;
  62         delaycompress = true;
  63         postrotate = ''
  64           [ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`
  65         '';
  66       };
  67     };
  68     services.nginx = {
  69       eventsConfig = ''
  70         multi_accept on;
  71         use epoll;
  72         worker_connections 1024;
  73       '';
  74       clientMaxBodySize = "20m";
  75       recommendedGzipSettings = true;
  76       recommendedOptimisation = false;
  77       recommendedProxySettings = true;
  78       recommendedTlsSettings = true;
  79       resolver = {
  80         ipv6 = lib.mkDefault (networking.defaultGateway6 != null);
  81       };
  82       serverTokens = false;
  83       # Only allow PFS-enabled ciphers with AES256
  84       #sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
  85       #sslCiphers = "HIGH:!ADH:!MD5:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL";
  86       #sslCiphers = "EECDH+aRSA+AESGCM:EDH+aRSA:EECDH+aRSA:+AES256:+AES128:+SHA1:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL";
  87       sslDhparam = builtins.path { path = inputs.self + "/hosts/${hostName}/nginx/dh4096.pem"; };
  88       sslProtocols = "TLSv1.3 TLSv1.2";
  89       configs = rec {
  90         http_add_headers = ''
  91           # Enable CSP
  92           #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
  93
  94           # Enable XSS protection of the browser.
  95           # May be unnecessary when CSP is configured properly (see above)
  96           # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
  97           #add_header X-XSS-Protection "1; mode=block";
  98
  99           # Minimize information leaked to other domains
 100           add_header 'Referrer-Policy' 'origin-when-cross-origin';
 101
 102           # Restrict embedding as a frame
 103           #add_header X-Frame-Options SAMEORIGIN;
 104
 105           # Prevent injection of code in other mime types (XSS Attacks)
 106           add_header X-Content-Type-Options nosniff;
 107         '';
 108         https_add_headers = ''
 109           ${http_add_headers}
 110           # Add HSTS header with preloading to HTTPS requests.
 111           # Adding this header to HTTP requests is discouraged,
 112           # as doing so makes the connection vulnerable to SSL stripping attacks
 113           # DOC: https://blog.qualys.com/securitylabs/2016/03/28/the-importance-of-a-proper-http-strict-transport-security-implementation-on-your-web-server
 114           add_header Strict-Transport-Security $hsts_header;
 115         '';
 116       };
 117       commonHttpConfig =
 118         ''
 119           log_format main '$remote_addr - $remote_user [$time_local] "$request" '
 120                           '$status $body_bytes_sent "$http_referer" '
 121                           '"$http_user_agent" "$http_x_forwarded_for"';
 122           log_format json escape=json '{'
 123             '"time_local":"$time_local",'
 124             '"host":"$host",'
 125             '"request":"$request",'
 126             '"status":"$status",'
 127             '"http_referrer":"$http_referer",'
 128             '"remote_addr":"$remote_addr",'
 129             '"remote_user":"$remote_user",'
 130             '"msec":"$msec",'
 131             '"body_bytes_sent":"$body_bytes_sent",'
 132             '"bytes_sent":"$bytes_sent",'
 133             '"http_user_agent":"$http_user_agent",'
 134             '"request_length":"$request_length",'
 135             '"request_method":"$request_method",'
 136             '"request_time":"$request_time",'
 137             '"request_uri":"$request_uri",'
 138             '"server_protocol":"$server_protocol",'
 139             '"ssl_protocol":"$ssl_protocol",'
 140             '"upstream_addr":"$upstream_addr",'
 141             '"upstream_connect_time":"$upstream_connect_time",'
 142             '"upstream_response_time":"$upstream_response_time"'
 143           '}';
 144           charset UTF-8;
 145           types {
 146             text/html html5;
 147             text/plain dump;
 148           }
 149         ''
 150         + lib.concatStringsSep "\n" (
 151           lib.attrValues {
 152             default = ''
 153               #default_type application/octet-stream;
 154               root /var/lib/nginx;
 155             '';
 156             security = ''
 157               #error_page 403 = 404;
 158
 159               ${nginx.configs.http_add_headers}
 160
 161               # This might create errors
 162               #proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
 163             '';
 164             log = ''
 165               access_log /var/log/nginx/access.json json;
 166               error_log  /var/log/nginx/error.log warn;
 167               open_log_file_cache max=1000 inactive=20s min_uses=2 valid=1m;
 168             '';
 169             proxy = ''
 170               proxy_cache_use_stale updating;
 171               proxy_temp_path /var/cache/nginx/proxy_temp 1 2;
 172             '';
 173             fastcgi = ''
 174               # DOC: http://wiki.nginx.org/HttpFastcgiModule
 175               fastcgi_buffer_size 128k;
 176               fastcgi_buffers 256 4k;
 177               fastcgi_busy_buffers_size 256k;
 178               fastcgi_cache_key "$request_method $scheme://$http_host$request_uri";
 179               fastcgi_connect_timeout 60;
 180               fastcgi_ignore_client_abort off;
 181               fastcgi_intercept_errors on;
 182               fastcgi_max_temp_file_size 2M;
 183               #fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 184               fastcgi_param SCRIPT_FILENAME $request_filename;
 185               fastcgi_temp_path /var/cache/nginx/fastcgi_temp 1 2;
 186             '';
 187             connection = ''
 188               sendfile on;
 189               # If the client stops reading data,
 190               # free up the stale client connection after this much time.
 191               send_timeout 60;
 192               # Causes nginx to attempt to send its HTTP response head
 193               # in one packet, instead of using partial frames.
 194               # This is useful for prepending headers before calling sendfile,
 195               # or for throughput optimization.
 196               tcp_nopush on;
 197               # Don't buffer data-sends (disable Nagle algorithm).
 198               # Good for sending frequent small bursts of data in real time.
 199               tcp_nodelay on;
 200               keepalive_timeout 20;
 201               reset_timedout_connection on;
 202               server_names_hash_bucket_size 128;
 203             '';
 204             map = ''
 205               map $time_iso8601 $date {
 206                 default 'date-not-found';
 207                 '~^(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})' $year-$month-$day;
 208               }
 209
 210               map $scheme $hsts_header {
 211                 https  "max-age=31536000; includeSubdomains; preload";
 212               }
 213
 214               # User agents that are to be blocked.
 215               #map $http_user_agent $bad_bot {
 216               #  default 0;
 217               #  libwww-perl 1;
 218               #  ~(?i)(httrack|htmlparser|libwww) 1;
 219               #}
 220               # Referrers that are to be blocked.
 221               #map $http_referer $bad_referer {
 222               #  default 0;
 223               #  ~(?i)(babes|casino|click|diamond|forsale|girl|jewelry|love|nudit|organic|poker|porn|poweroversoftware|replica|sex|teen|webcam|zippo) 1;
 224               #}
 225               #geo $not_local {
 226               #  default 1;
 227               #  127.0.0.1 0;
 228               #}
 229             '';
 230             cache = ''
 231               client_body_buffer_size 4K;
 232                 # getconf PAGESIZE
 233                 # 4096
 234               client_body_temp_path /var/cache/nginx/client_body_temp 1 2;
 235               client_body_timeout 60;
 236               client_header_buffer_size 1k;
 237               client_header_timeout 60;
 238               large_client_header_buffers 4 8k;
 239
 240               open_file_cache max=200000 inactive=20s;
 241               open_file_cache_errors on;
 242               open_file_cache_min_uses 2;
 243               open_file_cache_valid 30s;
 244             '';
 245           }
 246         );
 247       appendConfig = ''
 248         worker_processes ${toString host.CPUs};
 249       '';
 250     };
 251   };
 252 }