fricloud/server-configs
2
0
Fork 0
Code Issues 4 Pull requests Projects Releases Packages Wiki Activity Actions

nginx: block all /metrics endpoints

Browse source
This commit is contained in:
eyjhb 2025-03-14 16:40:19 +01:00
parent cad1ac566a
commit d6be5fefea
Signed by: eyjhb
GPG key ID: 609F508E3239F920
1 changed files with 50 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

89
shared/applications/server/nginx.nix
View file

@ -10,47 +10,58 @@ let
-out "$out/ca.pem" -keyout "$out/ca.key"
'';
in {
services.nginx = {
enable = true;
recommendedOptimisation = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
# recommendedBrotliSettings = true;
recommendedProxySettings = true;
# only allow PFS-enabled ciphers with AES256
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
# disable access logs
commonHttpConfig= ''
access_log off;
'';
# setup a default site
virtualHosts.default = {
default = lib.mkDefault true;
addSSL = true;
sslCertificateKey = "${snakeOilCa}/ca.key";
sslCertificate = "${snakeOilCa}/ca.pem";
root = pkgs.writeTextDir "index.html" ''
<html>
<head>
<title>Nothing to see</title>
</head>
<body>
<p>Like I said, nothing to see here</p>
</body>
</html>
'';
};
# block all /metrics endpoints
options.services.nginx.virtualHosts = lib.mkOption {
type = lib.types.attrsOf (lib.types.submodule {
config.locations."/metrics" = lib.mkDefault {
extraConfig = "deny all;";
};
});
};
networking.firewall = {
allowedTCPPorts = [80 443];
allowedUDPPorts = [443];
config = {
services.nginx = {
enable = true;
recommendedOptimisation = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
# recommendedBrotliSettings = true;
recommendedProxySettings = true;
# only allow PFS-enabled ciphers with AES256
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
# disable access logs
commonHttpConfig= ''
access_log off;
'';
# setup a default site
virtualHosts.default = {
default = lib.mkDefault true;
addSSL = true;
sslCertificateKey = "${snakeOilCa}/ca.key";
sslCertificate = "${snakeOilCa}/ca.pem";
root = pkgs.writeTextDir "index.html" ''
<html>
<head>
<title>Nothing to see</title>
</head>
<body>
<p>Like I said, nothing to see here</p>
</body>
</html>
'';
};
};
networking.firewall = {
allowedTCPPorts = [80 443];
allowedUDPPorts = [443];
};
};
}