toufy/adonis
toufy/adonis
1
Fork 0
Code Activity Actions

harden nginx tryx2
Some checks failed
/ deploy (push) Failing after 21s
Details

Browse source
This commit is contained in:
toufic ar 2026-03-04 03:24:06 +02:00
parent 72340afbfa
commit 8bfe367ff4
Signed by: toufic ar
SSH key fingerprint: SHA256:/NaO5I1nG3gYKzrzSiTYIdRyaIYxDWfr1U+d+yfJ/4k
2 changed files with 11 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

5
config/http/captiveportal.nix
View file

@ -5,11 +5,6 @@ in {
extraConfig = '' extraConfig = ''
access_log off; access_log off;
error_log /dev/null; error_log /dev/null;
add_header Content-Security-Policy "default-src 'none'";
add_header 'Referrer-Policy' 'same-origin';
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
''; '';
locations."/".return = 204; locations."/".return = 204;
forceSSL = false; forceSSL = false;

11
config/http/default.nix
View file

@ -21,6 +21,17 @@ in {
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
appendHttpConfig = ''
map $scheme $hsts_header {
https "max-age=31536000; includeSubdomains; preload";
}
add_header Strict-Transport-Security $hsts_header;
add_header Content-Security-Policy "default-src 'none'";
add_header 'Referrer-Policy' 'origin-when-cross-origin';
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
'';
virtualHosts.${customDomain} = { virtualHosts.${customDomain} = {
default = true; default = true;
root = "/var/www/${customDomain}"; root = "/var/www/${customDomain}";