fixL certificates with acme for *.liv.town

modules/services/nginx.nix

@@ -0,0 +1,47 @@
+{ pkgs, config, lib, ... }: {
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = lib.mkDefault "ahwx@ahwx.org";
+    certs = {
+      "liv.town" = {
+        domain = "*.liv.town";
+        extraDomainNames = [ "liv.town" ];
+        group = config.services.nginx.group;
+        dnsProvider = "desec";
+        environmentFile = "/home/liv/desec.env"; # location of your DESEC_TOKEN=[value]
+        webroot = null;
+       };
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = false;
+    recommendedProxySettings = true;
+    clientMaxBodySize = lib.mkDefault "10G";
+
+    # Hardened TLS and HSTS preloading
+    appendHttpConfig = ''
+      # Add HSTS header with preloading to HTTPS requests.
+      # Do not add HSTS header to HTTP requests.
+      map $scheme $hsts_header {
+          https   "max-age=31536000; includeSubdomains; preload";
+      }
+      add_header Strict-Transport-Security $hsts_header;
+
+      # # Enable CSP for your services. (THIS BREAKS SHARKEY!!!!!!!)
+      # add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self';" always;
+
+      # Disable embedding as a frame
+      add_header X-Frame-Options DENY;
+
+      # Prevent injection of code in other mime types (XSS Attacks)
+      add_header X-Content-Type-Options nosniff;
+
+      #   # This might create errors
+      #   # proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
+    '';
+  };
+}