liv/nixos-config
1
0
Fork 0
mirror of https://github.com/Ahwxorg/nixos-config.git synced 2025-12-04 23:00:14 +01:00
Code Issues 1 Projects Releases Packages Wiki Activity Actions

feat: enable csp for liv.town

Browse source
This commit is contained in:
Ahwx 2024-07-17 13:07:01 +02:00
parent 720e3ae4bf
commit f3a84a5ce4
1 changed files with 24 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

18
modules/services/matrix/default.nix
View file

@ -34,7 +34,7 @@ in {
enable = true; enable = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
recommendedOptimisation = true; recommendedOptimisation = true;
recommendedGzipSettings = true; recommendedGzipSettings = false;
recommendedProxySettings = true; recommendedProxySettings = true;
# Hardened TLS and HSTS preloading # Hardened TLS and HSTS preloading
@ -47,7 +47,7 @@ in {
add_header Strict-Transport-Security $hsts_header; add_header Strict-Transport-Security $hsts_header;
# Enable CSP for your services. # Enable CSP for your services.
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
# Minimize information leaked to other domains # Minimize information leaked to other domains
add_header 'Referrer-Policy' 'origin-when-cross-origin'; add_header 'Referrer-Policy' 'origin-when-cross-origin';
@ -73,26 +73,28 @@ in {
"${fqdn}" = { "${fqdn}" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
locations = {
# This section is not needed if the server_name of matrix-synapse is equal to # This section is not needed if the server_name of matrix-synapse is equal to
# the domain (i.e. example.org from @foo:example.org) and the federation port # the domain (i.e. example.org from @foo:example.org) and the federation port
# is 8448. # is 8448.
# Further reference can be found in the docs about delegation under # Further reference can be found in the docs about delegation under
# https://element-hq.github.io/synapse/latest/delegate.html # https://element-hq.github.io/synapse/latest/delegate.html
locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig; "= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
# This is usually needed for homeserver discovery (from e.g. other Matrix clients). # This is usually needed for homeserver discovery (from e.g. other Matrix clients).
# Further reference can be found in the upstream docs at # Further reference can be found in the upstream docs at
# https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixclient # https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixclient
locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig; "= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
# It's also possible to do a redirect here or something else, this vhost is not # It's also possible to do a redirect here or something else, this vhost is not
# needed for Matrix. It's recommended though to *not put* element # needed for Matrix. It's recommended though to *not put* element
# here, see also the section about Element. # here, see also the section about Element.
locations."/".proxyPass = "http://127.0.0.1:4321"; "/".proxyPass = "http://127.0.0.1:4321";
# Forward all Matrix API calls to the synapse Matrix homeserver. A trailing slash # Forward all Matrix API calls to the synapse Matrix homeserver. A trailing slash
# *must not* be used here. # *must not* be used here.
locations."/_matrix".proxyPass = "http://[::1]:8008"; "/_matrix".proxyPass = "http://[::1]:8008";
# Forward requests for e.g. SSO and password-resets. # Forward requests for e.g. SSO and password-resets.
locations."/_synapse/client".proxyPass = "http://[::1]:8008"; "/_synapse/client".proxyPass = "http://[::1]:8008";
locations."wp-login.php".return = "301 https://hil-speed.hetzner.com/10GB.bin"; "wp-login.php".return = "301 https://hil-speed.hetzner.com/10GB.bin";
};
}; };
}; };
}; };