1 files changed, 43 insertions, 1 deletions

diff --git a/custom/ymir-nginx.nix b/custom/ymir-nginx.nix
index 861b0720..fd7d7e94 100644
--- a/custom/ymir-nginx.nix
+++ b/custom/ymir-nginx.nix
@@ -16,6 +16,18 @@ let
     uwsgi_param SERVER_PORT $server_port;
     uwsgi_param SERVER_NAME $server_name;
   '';
+
+  favicon = builtins.toFile "favicon" ''
+    location = /favicon.ico {
+      root /srv/www/praseodym.org;
+    }
+  '';
+
+  acme = builtins.toFile "acme" ''
+    location /.well-known/acme-challenge {
+      root /srv/www/acme/$host/;
+    }
+  '';
 in {
   services.nginx = {
     enable = true;
@@ -56,11 +68,28 @@ in {
       access_log stderr;
       error_log stderr;
 
+      ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+      ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
+      ssl_prefer_server_ciphers on;
+      ssl_session_cache shared:SSL:10m;
+      ssl_dhparam /etc/ssl/dhparam.pem;
+
+      server {
+        listen *:80;
+        listen [::]:80;
+        server_name _;
+
+        root /srv/www/praseodym.org;
+      }
+
       server {
         listen *:80;
         listen [::]:80;
         server_name dirty-haskell.org www.dirty-haskell.org;
 
+        include ${favicon};
+        include ${acme};
+
         root /srv/www/dirty-haskell.org;
       }
 
@@ -69,6 +98,9 @@ in {
         listen [::]:443 ssl;
         server_name dirty-haskell.org;
 
+        include ${favicon};
+        include ${acme};
+
         ssl_certificate /etc/nginx/ssl/dirty-haskell.org/fullchain.pem;
         ssl_certificate_key /etc/nginx/ssl/dirty-haskell.org/privkey.pem;
 
@@ -80,6 +112,9 @@ in {
         listen [::]:443 ssl;
         server_name www.dirty-haskell.org;
 
+        include ${favicon};
+        include ${acme};
+
         ssl_certificate /etc/nginx/ssl/www.dirty-haskell.org/fullchain.pem;
         ssl_certificate_key /etc/nginx/ssl/www.dirty-haskell.org/privkey.pem;
 
@@ -88,13 +123,20 @@ in {
 
       server {
         listen *:80;
+        listen *:443 ssl;
         listen [::]:80;
-        server_name git.yggdrasil.li www.git.yggdrasil.li;
+        listen [::]:443 ssl;
+        ssl_certificate /etc/nginx/ssl/git.yggdrasil.li/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/git.yggdrasil.li/key.pem;
+        server_name git.yggdrasil.li;
 
         root ${pkgs.cgit}/cgit;
 
         try_files $uri @cgit;
 
+        include ${favicon};
+        include ${acme};
+
         location @cgit {
           include ${uwsgi_params};
           uwsgi_pass unix:/tmp/cgit.sock;