]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/nginx.nix
nsd: lower sourcephile.fr TTL
[sourcephile-nix.git] / servers / mermet / nginx.nix
1 {pkgs, lib, config, system, ...}:
2 let inherit (builtins) readFile;
3 inherit (builtins.extraBuiltins) pass;
4 inherit (lib) types;
5 inherit (pkgs.lib) loadFile;
6 inherit (config) networking;
7 inherit (config.services) nginx;
8 domainDir = dom: lib.concatStringsSep "/" (lib.reverseList (lib.splitString "." dom));
9 in
10 {
11 imports = [
12 nginx/gitweb.nix
13 nginx/www.nix
14 ];
15 options = {
16 services.nginx = {
17 x509Dir = lib.mkOption {
18 type = types.str;
19 default = "/var/lib/nginx/x509";
20 };
21 webDir = lib.mkOption {
22 type = types.str;
23 default = "/var/www";
24 };
25 logDir = lib.mkOption {
26 type = types.str;
27 default = "/var/log/nginx";
28 };
29 };
30 };
31 config = {
32 systemd.services.nginx.after = [
33 "${networking.domainBase}.key.pem-key.service"
34 #"keys.target"
35 ];
36 deployment.keys = {
37 "nginx.${networking.domainBase}.key.pem" = {
38 text = pass "x509/${networking.domainBase}/key.pem";
39 user = nginx.user;
40 group = "root";
41 destDir = "/run/keys/";
42 permissions = "0400"; # WARNING: not enforced when deployment.storeKeysOnMachine = true
43 };
44 };
45 systemd.services.nginx = {
46 preStart = lib.mkBefore ''
47 install -D -d -o ${nginx.user} -g ${nginx.group} -m 0700 \
48 ${nginx.x509Dir} \
49 ${nginx.webDir} \
50 ${nginx.logDir}
51 '';
52 };
53 services.nginx = {
54 enable = true;
55 stateDir = "/dev/shm/nginx";
56 eventsConfig = ''
57 multi_accept on;
58 use epoll;
59 worker_connections 1024;
60 '';
61 clientMaxBodySize = "20m";
62 recommendedProxySettings = true;
63 recommendedTlsSettings = true;
64 serverTokens = false;
65 sslCiphers = "HIGH:!ADH:!MD5:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL";
66 sslDhparam = ../../../sec/openssl/dh.pem;
67 #sslCiphers = "EECDH+aRSA+AESGCM:EDH+aRSA:EECDH+aRSA:+AES256:+AES128:+SHA1:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL;";
68 #sslProtocols = "TLSv1.2";
69 commonHttpConfig = ''
70 log_format main '$remote_addr - $remote_user [$time_local] "$request" '
71 '$status $body_bytes_sent "$http_referer" '
72 '"$http_user_agent" "$http_x_forwarded_for"';
73 #charset UTF-8;
74 '' +
75 lib.concatStringsSep "\n" (lib.attrValues {
76 default = ''
77 default_type application/octet-stream;
78 root ${nginx.webDir};
79 '';
80 security = ''
81 #error_page 403 = 404;
82 '';
83 log = ''
84 access_log ${nginx.logDir}/access.log main buffer=32k;
85 error_log ${nginx.logDir}/error.log warn;
86 open_log_file_cache max=1000 inactive=20s min_uses=2 valid=1m;
87 '';
88 proxy = ''
89 proxy_cache_use_stale updating;
90 proxy_temp_path ${nginx.stateDir}/proxy_temp 1 2;
91 '';
92 fastcgi = ''
93 # DOC: http://wiki.nginx.org/HttpFastcgiModule
94 fastcgi_buffer_size 128k;
95 fastcgi_buffers 256 4k;
96 fastcgi_busy_buffers_size 256k;
97 fastcgi_cache_key "$request_method $scheme://$http_host$request_uri";
98 fastcgi_cache_path ${nginx.stateDir}/fastcgi_cache
99 inactive=10m
100 keys_zone=microcache:2M
101 levels=1:2
102 loader_files=100000
103 loader_sleep=1
104 loader_threshold=2592000000
105 max_size=64M;
106 fastcgi_connect_timeout 60;
107 fastcgi_ignore_client_abort off;
108 fastcgi_intercept_errors on;
109 fastcgi_max_temp_file_size 2M;
110 #fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
111 fastcgi_param SCRIPT_FILENAME $request_filename;
112 fastcgi_temp_path ${nginx.stateDir}/fastcgi_temp 1 2;
113 '';
114 connexion = ''
115 sendfile on;
116 # If the client stops reading data,
117 # free up the stale client connection after this much time.
118 send_timeout 60;
119 # Causes nginx to attempt to send its HTTP response head
120 # in one packet, instead of using partial frames.
121 # This is useful for prepending headers before calling sendfile,
122 # or for throughput optimization.
123 tcp_nopush on;
124 # Don't buffer data-sends (disable Nagle algorithm).
125 # Good for sending frequent small bursts of data in real time.
126 tcp_nodelay on;
127 keepalive_timeout 20;
128 reset_timedout_connection on;
129 server_names_hash_bucket_size 128;
130 types_hash_max_size 2048;
131 '';
132 map = ''
133 # User agents that are to be blocked.
134 #map $http_user_agent $bad_bot {
135 # default 0;
136 # libwww-perl 1;
137 # ~(?i)(httrack|htmlparser|libwww) 1;
138 #}
139 # Referrers that are to be blocked.
140 #map $http_referer $bad_referer {
141 # default 0;
142 # ~(?i)(babes|casino|click|diamond|forsale|girl|jewelry|love|nudit|organic|poker|porn|poweroversoftware|replica|sex|teen|webcam|zippo) 1;
143 #}
144 #geo $not_local {
145 # default 1;
146 # 127.0.0.1 0;
147 #}
148 '';
149 gzip = ''
150 gzip on;
151 gzip_buffers 16 8k;
152 gzip_comp_level 6;
153 gzip_disable "MSIE [1-6]\.";
154 gzip_http_version 1.1;
155 gzip_min_length 1024;
156 gzip_proxied any;
157 gzip_static on;
158 gzip_vary on;
159 gzip_types application/atom+xml
160 application/javascript
161 application/json
162 application/rss+xml
163 application/vnd.ms-fontobject
164 application/x-font-ttf
165 application/x-javascript
166 application/xml
167 application/xml+rss
168 font/opentype
169 font/truetype
170 image/svg+xml
171 text/css
172 text/javascript
173 text/plain
174 text/x-component
175 text/xml;
176 '';
177 cache = ''
178 client_body_buffer_size 4K;
179 # getconf PAGESIZE
180 # 4096
181 client_body_temp_path ${nginx.stateDir}/client_body_temp 1 2;
182 client_body_timeout 60;
183 client_header_buffer_size 1k;
184 client_header_timeout 60;
185 large_client_header_buffers 4 8k;
186
187 open_file_cache max=200000 inactive=20s;
188 open_file_cache_errors on;
189 open_file_cache_min_uses 2;
190 open_file_cache_valid 30s;
191 '';
192 });
193 appendConfig = ''
194 worker_processes 4;
195 '';
196 virtualHosts."_" = {
197 forceSSL = false;
198 # Convoluted way to load the certificate in the store and using ${networking.domainBase} to find it.
199 # NOTE: no ssl_stapling while the certificate remains self-signed.
200 sslCertificate = loadFile (../../../sec + "/openssl/${networking.domainBase}/cert.self-signed.pem");
201 sslCertificateKey = "/run/keys/nginx.${networking.domainBase}.key.pem";
202 };
203 };
204 };
205 }