rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nginx: add security headers (HSTS, CSP, X-Frame-Options, etc.) to all vhosts

Browse source
This commit is contained in:
rope 2026-07-21 12:45:33 +01:00
parent 5b0b5b246b
commit bad68a51f8
1 changed files with 15 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

18
services/nginx.nix
View file

@ -32,6 +32,18 @@ let
forceSSL = true; forceSSL = true;
}; };
# Security headers, shared across every location. add_header does NOT
# merge with an ancestor context if a location defines its own add_header,
# so any location below that sets add_header must re-include this string.
securityHeaders = ''
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "default-src 'self' https: wss: data: blob: 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self';" always;
'';
# Simple reverse proxy vhost # Simple reverse proxy vhost
proxy = port: ssl // { proxy = port: ssl // {
locations."/" = { locations."/" = {
@ -86,7 +98,7 @@ in
appendHttpConfig = '' appendHttpConfig = ''
proxy_headers_hash_max_size 1024; proxy_headers_hash_max_size 1024;
access_log /var/log/nginx/access.log; access_log /var/log/nginx/access.log;
''; '' + securityHeaders;
virtualHosts = { virtualHosts = {
# --- Unprotected (own auth, or by design) --- # --- Unprotected (own auth, or by design) ---
@ -104,7 +116,7 @@ in
# auth.nordhammer.it, which trips the check. Strip it so qBit skips. # auth.nordhammer.it, which trips the check. Strip it so qBit skips.
# Cookie stripped too so cached SID cookies don't fight localhost-bypass. # Cookie stripped too so cached SID cookies don't fight localhost-bypass.
"torrent.nordhammer.it" = lib.recursiveUpdate (protectedProxy 8080) { "torrent.nordhammer.it" = lib.recursiveUpdate (protectedProxy 8080) {
locations."/".extraConfig = autheliaAuthConfig + '' locations."/".extraConfig = autheliaAuthConfig + securityHeaders + ''
proxy_set_header Referer ""; proxy_set_header Referer "";
proxy_set_header Cookie ""; proxy_set_header Cookie "";
proxy_hide_header Set-Cookie; proxy_hide_header Set-Cookie;
@ -118,7 +130,7 @@ in
"shelfarr.nordhammer.it" = protectedProxy 5056; "shelfarr.nordhammer.it" = protectedProxy 5056;
"sabnzbd.nordhammer.it" = protectedProxy 8085; "sabnzbd.nordhammer.it" = protectedProxy 8085;
"code.nordhammer.it" = lib.recursiveUpdate (protectedProxy 4444) { "code.nordhammer.it" = lib.recursiveUpdate (protectedProxy 4444) {
locations."/".extraConfig = autheliaAuthConfig + '' locations."/".extraConfig = autheliaAuthConfig + securityHeaders + ''
# Prevent browser from restoring a cached page on tab reopen — # Prevent browser from restoring a cached page on tab reopen —
# forces a fresh request so Authelia can redirect before JS # forces a fresh request so Authelia can redirect before JS
# tries to open a WebSocket with an expired session. # tries to open a WebSocket with an expired session.