Simon Bruder
10b8d432d5
This applies the REUSE specification to the repository, so the licensing information can be tracked for every file individually.
57 lines
1.8 KiB
Nix
57 lines
1.8 KiB
Nix
# SPDX-FileCopyrightText: 2021-2023 Simon Bruder <simon@sbruder.de>
|
||
#
|
||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||
|
||
{ lib, pkgs, ... }:
|
||
let
|
||
# This uses
|
||
# https://github.com/vector-im/element-web#configuration-best-practices
|
||
# but allows to disable the frame-ancestors rule for /usercontent/.
|
||
mkSecurityHeaders = withFrameOptions: ''
|
||
add_header X-Content-Type-Options nosniff;
|
||
add_header X-Frame-Options SAMEORIGIN;
|
||
add_header X-XSS-Protection "1; mode=block";
|
||
'' + lib.optionalString withFrameOptions ''
|
||
add_header Content-Security-Policy "frame-ancestors 'none'";
|
||
'' + lib.optionalString (!withFrameOptions) ''
|
||
add_header Content-Security-Policy "frame-ancestors 'self'";
|
||
'';
|
||
in
|
||
{
|
||
services.nginx.virtualHosts."chat.sbruder.de" = {
|
||
enableACME = true;
|
||
forceSSL = true;
|
||
|
||
root = pkgs.element-web;
|
||
|
||
extraConfig = mkSecurityHeaders true;
|
||
locations."/usercontent/".extraConfig = mkSecurityHeaders false;
|
||
|
||
# nixpkgs’s override mechanism doesn’t allow overriding of all options
|
||
locations."=/config.chat.sbruder.de.json".alias = pkgs.writeText "config.chat.sbruder.de.json" (lib.generators.toJSON { } {
|
||
default_server_config = {
|
||
"m.homeserver" = {
|
||
base_url = "https://matrix.sbruder.de";
|
||
server_name = "matrix.sbruder.de";
|
||
};
|
||
};
|
||
show_labs_settings = true;
|
||
branding = {
|
||
auth_footer_links = [ ];
|
||
};
|
||
piwik = false;
|
||
default_country_code = "DE";
|
||
setting_defaults = {
|
||
"UIFeature.feedback" = false;
|
||
"UIFeature.shareSocial" = false;
|
||
"UIFeature.identityServer" = false;
|
||
"UIFeature.thirdPartyId" = false;
|
||
};
|
||
disable_custom_urls = true;
|
||
disable_guests = true;
|
||
disable_3pid_login = true;
|
||
desktop_builds.available = false;
|
||
});
|
||
};
|
||
}
|