nginx: Disable access log by default
This commit is contained in:
parent
d46eca0ab0
commit
7db9922dc2
|
@ -1,9 +1,15 @@
|
||||||
{ config, lib, ... }:
|
{ config, lib, ... }:
|
||||||
|
let
|
||||||
|
cfg = config.sbruder.nginx;
|
||||||
|
in
|
||||||
{
|
{
|
||||||
options.sbruder.nginx.hardening.enable = lib.mkEnableOption "nginx hardening";
|
options.sbruder.nginx = {
|
||||||
|
hardening.enable = lib.mkEnableOption "nginx hardening";
|
||||||
|
privacy.enable = (lib.mkEnableOption "nginx privacy options") // { default = true; };
|
||||||
|
};
|
||||||
|
|
||||||
config = lib.mkIf config.sbruder.nginx.hardening.enable {
|
config = lib.mkMerge [
|
||||||
|
(lib.mkIf cfg.hardening.enable {
|
||||||
services.nginx.commonHttpConfig = ''
|
services.nginx.commonHttpConfig = ''
|
||||||
map $scheme $hsts_header {
|
map $scheme $hsts_header {
|
||||||
https "max-age=31536000";
|
https "max-age=31536000";
|
||||||
|
@ -14,5 +20,11 @@
|
||||||
add_header X-Content-Type-Options nosniff;
|
add_header X-Content-Type-Options nosniff;
|
||||||
add_header X-Frame-Options SAMEORIGIN;
|
add_header X-Frame-Options SAMEORIGIN;
|
||||||
'';
|
'';
|
||||||
};
|
})
|
||||||
|
(lib.mkIf cfg.privacy.enable {
|
||||||
|
services.nginx.commonHttpConfig = ''
|
||||||
|
access_log off;
|
||||||
|
'';
|
||||||
|
})
|
||||||
|
];
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue