From fe4a34a9e35babd578eeefced73a2bc7fc8e11ba Mon Sep 17 00:00:00 2001
From: Henrik Lissner <henrik@lissner.net>
Date: Sat, 30 Jan 2021 17:07:52 -0500
Subject: [PATCH] Harden nginx defaults

---
 hosts/ao/modules/bitwarden.nix | 1 +
 hosts/ao/modules/gitea.nix     | 1 +
 modules/services/nginx.nix     | 9 +++++++++
 3 files changed, 11 insertions(+)

diff --git a/hosts/ao/modules/bitwarden.nix b/hosts/ao/modules/bitwarden.nix
index 31ad8fa7..dce5823b 100644
--- a/hosts/ao/modules/bitwarden.nix
+++ b/hosts/ao/modules/bitwarden.nix
@@ -20,6 +20,7 @@
   services.nginx.virtualHosts."p.v0.io" = {
     forceSSL = true;
     enableACME = true;
+    root = "/srv/www/p.v0.io";
     extraConfig = ''
       client_max_body_size 128M;
     '';
diff --git a/hosts/ao/modules/gitea.nix b/hosts/ao/modules/gitea.nix
index 65164414..ab4929a9 100644
--- a/hosts/ao/modules/gitea.nix
+++ b/hosts/ao/modules/gitea.nix
@@ -26,6 +26,7 @@
   services.nginx.virtualHosts."git.v0.io" = {
     forceSSL = true;
     enableACME = true;
+    root = "/srv/www/git.v0.io";
     locations."/".proxyPass = "http://127.0.0.1:3000";
   };
 }
diff --git a/modules/services/nginx.nix b/modules/services/nginx.nix
index 47484a26..82b3d63a 100644
--- a/modules/services/nginx.nix
+++ b/modules/services/nginx.nix
@@ -21,6 +21,15 @@ in {
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
+
+      # Reduce the permitted size of client requests, to reduce the likelihood
+      # of buffer overflow attacks. This can be tweaked on a per-vhost basis, as
+      # needed.
+      commonHttpConfig = ''
+        client_body_buffer_size  4k;       # default: 8k
+        client_max_body_size 1k;           # default: 1m
+        large_client_header_buffers 2 4k;  # default: 4 8k
+      '';
     };
   };
 }