aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

Harden nginx defaults

Browse source
This commit is contained in:
Henrik Lissner 2021-01-30 17:07:52 -05:00
parent 2da00f3ad5
commit fe4a34a9e3
3 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
hosts/ao/modules/bitwarden.nix
View file

@ -20,6 +20,7 @@
services.nginx.virtualHosts."p.v0.io" = { services.nginx.virtualHosts."p.v0.io" = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
root = "/srv/www/p.v0.io";
extraConfig = '' extraConfig = ''
client_max_body_size 128M; client_max_body_size 128M;
''; '';

1
hosts/ao/modules/gitea.nix
View file

@ -26,6 +26,7 @@
services.nginx.virtualHosts."git.v0.io" = { services.nginx.virtualHosts."git.v0.io" = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
root = "/srv/www/git.v0.io";
locations."/".proxyPass = "http://127.0.0.1:3000"; locations."/".proxyPass = "http://127.0.0.1:3000";
}; };
} }

9
modules/services/nginx.nix
View file

@ -21,6 +21,15 @@ in {
recommendedOptimisation = true; recommendedOptimisation = true;
recommendedProxySettings = true; recommendedProxySettings = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
# Reduce the permitted size of client requests, to reduce the likelihood
# of buffer overflow attacks. This can be tweaked on a per-vhost basis, as
# needed.
commonHttpConfig = ''
client_body_buffer_size 4k; # default: 8k
client_max_body_size 1k; # default: 1m
large_client_header_buffers 2 4k; # default: 4 8k
'';
}; };
}; };
} }