]> Git — Sourcephile - sourcephile-nix.git/blob - install/logical/friot/nginx.nix
shorewall: add packages and services
[sourcephile-nix.git] / install / logical / friot / nginx.nix
1 {pkgs, lib, config, system, ...}:
2 let inherit (lib) types;
3 inherit (config.services) nginx x509;
4 domainDir = dom: lib.concatStringsSep "/" (lib.reverseList (lib.splitString "." dom));
5 in
6 {
7 imports = [
8 nginx/gitweb.nix
9 ];
10 options.services.nginx = {
11 webDir = lib.mkOption {
12 type = types.str;
13 default = "/var/lib/nginx";
14 };
15 logDir = lib.mkOption {
16 type = types.str;
17 default = "/var/log/nginx";
18 };
19 };
20 config = {
21 security.dhparams = {
22 enable = true;
23 params = {
24 nginx = 1024;
25 };
26 };
27 systemd.services.nginx = {
28 preStart = lib.mkBefore ''
29 install -D -d -o ${nginx.user} -g ${nginx.group} -m 0700 \
30 ${nginx.webDir} \
31 ${nginx.logDir}
32 '';
33 };
34 services.nginx = {
35 enable = true;
36 stateDir = "/dev/shm/nginx";
37 eventsConfig = ''
38 multi_accept on;
39 use epoll;
40 worker_connections 1024;
41 '';
42 clientMaxBodySize = "20m";
43 recommendedProxySettings = true;
44 recommendedTlsSettings = true;
45 serverTokens = false;
46 sslCiphers = "HIGH:!ADH:!MD5:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL";
47 #sslCiphers = "EECDH+aRSA+AESGCM:EDH+aRSA:EECDH+aRSA:+AES256:+AES128:+SHA1:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL;";
48 #sslProtocols = "TLSv1.2";
49 commonHttpConfig = ''
50 log_format main '$remote_addr - $remote_user [$time_local] "$request" '
51 '$status $body_bytes_sent "$http_referer" '
52 '"$http_user_agent" "$http_x_forwarded_for"';
53 #charset UTF-8;
54 '' +
55 lib.concatStringsSep "\n" (lib.attrValues {
56 default = ''
57 default_type application/octet-stream;
58 root ${nginx.webDir};
59 '';
60 security = ''
61 error_page 403 = 404;
62 #ssl_certificate ${x509.cert};
63 #ssl_certificate_key ${x509.key};
64 '';
65 log = ''
66 access_log ${nginx.logDir}/access.log main buffer=32k;
67 error_log ${nginx.logDir}/error.log warn;
68 open_log_file_cache max=1000 inactive=20s min_uses=2 valid=1m;
69 '';
70 proxy = ''
71 proxy_cache_use_stale updating;
72 proxy_temp_path ${nginx.stateDir}/proxy_temp 1 2;
73 '';
74 fastcgi = ''
75 # DOC: http://wiki.nginx.org/HttpFastcgiModule
76 fastcgi_buffer_size 128k;
77 fastcgi_buffers 256 4k;
78 fastcgi_busy_buffers_size 256k;
79 fastcgi_cache_key "$request_method $scheme://$http_host$request_uri";
80 fastcgi_cache_path ${nginx.stateDir}/fastcgi_cache
81 inactive=10m
82 keys_zone=microcache:2M
83 levels=1:2
84 loader_files=100000
85 loader_sleep=1
86 loader_threshold=2592000000
87 max_size=64M;
88 fastcgi_connect_timeout 60;
89 fastcgi_ignore_client_abort off;
90 fastcgi_intercept_errors on;
91 fastcgi_max_temp_file_size 2M;
92 #fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
93 fastcgi_param SCRIPT_FILENAME $request_filename;
94 fastcgi_temp_path ${nginx.stateDir}/fastcgi_temp 1 2;
95 '';
96 connexion = ''
97 sendfile on;
98 send_timeout 60;
99 # ^ If the client stops reading data,
100 # free up the stale client connection after this much time.
101 tcp_nopush on;
102 # ^ Causes nginx to attempt to send its HTTP response head
103 # in one packet, instead of using partial frames.
104 # This is useful for prepending headers before calling sendfile,
105 # or for throughput optimization.
106 tcp_nodelay on;
107 # ^ Don't buffer data-sends (disable Nagle algorithm).
108 # Good for sending frequent small bursts of data in real time.
109 keepalive_timeout 20;
110 reset_timedout_connection on;
111 server_names_hash_bucket_size 128;
112 types_hash_max_size 2048;
113 '';
114 map = ''
115 # User agents that are to be blocked.
116 #map $http_user_agent $bad_bot {
117 # default 0;
118 # libwww-perl 1;
119 # ~(?i)(httrack|htmlparser|libwww) 1;
120 #}
121 # Referrers that are to be blocked.
122 #map $http_referer $bad_referer {
123 # default 0;
124 # ~(?i)(babes|casino|click|diamond|forsale|girl|jewelry|love|nudit|organic|poker|porn|poweroversoftware|replica|sex|teen|webcam|zippo) 1;
125 #}
126 #geo $not_local {
127 # default 1;
128 # 127.0.0.1 0;
129 #}
130 '';
131 gzip = ''
132 gzip on;
133 gzip_buffers 16 8k;
134 gzip_comp_level 6;
135 gzip_disable "MSIE [1-6]\.";
136 gzip_http_version 1.1;
137 gzip_min_length 1024;
138 gzip_proxied any;
139 gzip_static on;
140 gzip_vary on;
141 gzip_types application/atom+xml
142 application/javascript
143 application/json
144 application/rss+xml
145 application/vnd.ms-fontobject
146 application/x-font-ttf
147 application/x-javascript
148 application/xml
149 application/xml+rss
150 font/opentype
151 font/truetype
152 image/svg+xml
153 text/css
154 text/javascript
155 text/plain
156 text/x-component
157 text/xml;
158 '';
159 cache = ''
160 client_body_buffer_size 4K;
161 # ^ getconf PAGESIZE
162 # 4096
163 client_body_temp_path ${nginx.stateDir}/client_body_temp 1 2;
164 client_body_timeout 60;
165 client_header_buffer_size 1k;
166 client_header_timeout 60;
167 large_client_header_buffers 4 8k;
168
169 open_file_cache max=200000 inactive=20s;
170 open_file_cache_errors on;
171 open_file_cache_min_uses 2;
172 open_file_cache_valid 30s;
173 '';
174 });
175 appendConfig = ''
176 worker_processes 2;
177 '';
178 };
179 };
180 }