...

1 files changed, 67 insertions, 0 deletions

diff --git a/hosts/surtr/http/default.nix b/hosts/surtr/http/default.nix
new file mode 100644
index 00000000..a77252ff
--- /dev/null
+++ b/hosts/surtr/http/default.nix
@@ -0,0 +1,67 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    ./webdav
+  ];
+  
+  config = {
+    services.nginx = {
+      enable = true;
+      # package = pkgs.nginxQuic;
+      recommendedGzipSettings = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      sslDhparam = config.security.dhparams.params.nginx.path;
+      commonHttpConfig = ''
+        ssl_ecdh_curve X25519:prime256v1:secp521r1:secp384r1;
+
+        log_format main
+                '$remote_addr "$remote_user" '
+                '"$host" "$request" $status $bytes_sent '
+                '"$http_referer" "$http_user_agent" '
+                '$gzip_ratio';
+
+        access_log syslog:server=unix:/dev/log main;
+        error_log syslog:server=unix:/dev/log info;
+
+        client_body_temp_path /run/nginx-client-bodies;
+      '';
+      additionalModules = with pkgs.nginxModules; [ dav pam ];
+    };
+    systemd.services.nginx = {
+      preStart = lib.mkForce config.services.nginx.preStart;
+      serviceConfig = {
+        SupplementaryGroups = [ "shadow" ];
+        ExecReload = lib.mkForce "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        RuntimeDirectory = lib.mkForce [ "nginx" "nginx-client-bodies" ];
+        RuntimeDirectoryMode = "0750";
+
+        NoNewPrivileges = lib.mkForce false;
+        PrivateDevices = lib.mkForce false;
+        ProtectHostname = lib.mkForce false;
+        ProtectKernelTunables = lib.mkForce false;
+        ProtectKernelModules = lib.mkForce false;
+        RestrictAddressFamilies = lib.mkForce [ ];
+        LockPersonality = lib.mkForce false;
+        MemoryDenyWriteExecute = lib.mkForce false;
+        RestrictRealtime = lib.mkForce false;
+        RestrictSUIDSGID = lib.mkForce false;
+        SystemCallArchitectures = lib.mkForce "";
+        ProtectClock = lib.mkForce false;
+        ProtectKernelLogs = lib.mkForce false;
+        RestrictNamespaces = lib.mkForce false;
+        SystemCallFilter = lib.mkForce "";
+        ReadWritePaths = [ "/srv/files" ];
+      };
+    };
+
+    services.uwsgi = {
+      enable = true;
+      plugins = ["python3"];
+      instance = {
+        type = "emperor";
+        vassals = {};
+      };
+    };
+  };
+}