liv/nixos-config
1
0
Fork 0
mirror of https://github.com/Ahwxorg/nixos-config.git synced 2025-12-04 15:00:13 +01:00
Code Issues 1 Projects Releases Packages Wiki Activity Actions

feat: enable csp for liv.town

Browse source
This commit is contained in:
Ahwx 2024-07-17 13:07:01 +02:00
parent 720e3ae4bf
commit f3a84a5ce4
1 changed files with 24 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

18
modules/services/matrix/default.nix
View file

@ -34,7 +34,7 @@ in {
enable = true;
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedGzipSettings = false;
recommendedProxySettings = true;
# Hardened TLS and HSTS preloading
@ -47,7 +47,7 @@ in {
add_header Strict-Transport-Security $hsts_header;
# Enable CSP for your services.
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
# Minimize information leaked to other domains
add_header 'Referrer-Policy' 'origin-when-cross-origin';
@ -73,26 +73,28 @@ in {
"${fqdn}" = {
enableACME = true;
forceSSL = true;
locations = {
# This section is not needed if the server_name of matrix-synapse is equal to
# the domain (i.e. example.org from @foo:example.org) and the federation port
# is 8448.
# Further reference can be found in the docs about delegation under
# https://element-hq.github.io/synapse/latest/delegate.html
locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
"= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
# This is usually needed for homeserver discovery (from e.g. other Matrix clients).
# Further reference can be found in the upstream docs at
# https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixclient
locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
"= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
# It's also possible to do a redirect here or something else, this vhost is not
# needed for Matrix. It's recommended though to *not put* element
# here, see also the section about Element.
locations."/".proxyPass = "http://127.0.0.1:4321";
"/".proxyPass = "http://127.0.0.1:4321";
# Forward all Matrix API calls to the synapse Matrix homeserver. A trailing slash
# *must not* be used here.
locations."/_matrix".proxyPass = "http://[::1]:8008";
"/_matrix".proxyPass = "http://[::1]:8008";
# Forward requests for e.g. SSO and password-resets.
locations."/_synapse/client".proxyPass = "http://[::1]:8008";
locations."wp-login.php".return = "301 https://hil-speed.hetzner.com/10GB.bin";
"/_synapse/client".proxyPass = "http://[::1]:8008";
"wp-login.php".return = "301 https://hil-speed.hetzner.com/10GB.bin";
};
};
};
};