toufy/adonis
toufy/adonis
1
Fork 0
Code Activity Actions

a little nginx hardening
Some checks failed
/ deploy (push) Failing after 14s
Details

Browse source
This commit is contained in:
toufic ar 2026-01-15 00:48:13 +02:00
parent 08f6ed421f
commit caf60d32fb
Signed by: toufic ar
SSH key fingerprint: SHA256:/NaO5I1nG3gYKzrzSiTYIdRyaIYxDWfr1U+d+yfJ/4k
2 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
config/http/captiveportal.nix
View file

@ -2,6 +2,13 @@
domain = config.customOps.domain; domain = config.customOps.domain;
in { in {
services.nginx.virtualHosts."cpcheck.${domain}" = { services.nginx.virtualHosts."cpcheck.${domain}" = {
extraConfig = ''
access_log off;
error_log off;
add_header Content-Security-Policy "default-src 'none'";
add_header 'Referrer-Policy' 'same-origin';
'';
locations."/".return = 204; locations."/".return = 204;
forceSSL = false; forceSSL = false;
addSSL = true; addSSL = true;

8
config/http/default.nix
View file

@ -15,9 +15,17 @@ in {
recommendedProxySettings = true; recommendedProxySettings = true;
recommendedBrotliSettings = true; recommendedBrotliSettings = true;
appendHttpConfig = ''
add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
add_header 'Referrer-Policy' 'origin-when-cross-origin';
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
'';
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
virtualHosts.${customDomain} = { virtualHosts.${customDomain} = {
default = true;
root = "/var/www/${customDomain}"; root = "/var/www/${customDomain}";
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;