reidlab/nix-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

change nginx headers

Browse source
This commit is contained in:
Reid 2024-05-08 22:58:04 -07:00
parent 1f38029c28
commit 0729d089f8
1 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
modules/services/nginx-conf.nix
View file

@ -77,6 +77,8 @@ in {
in '' in ''
lua_package_path "${toString cfg.defaultLuaPackagePath}/?.lua;;${lua-resty-template}/lib/?.lua;;${lua-resty-redis}/lib/?.lua;;${lua-resty-websocket}/lib/?.lua;;"; lua_package_path "${toString cfg.defaultLuaPackagePath}/?.lua;;${lua-resty-template}/lib/?.lua;;${lua-resty-redis}/lib/?.lua;;${lua-resty-websocket}/lib/?.lua;;";
# add hsts header with preloading to https reqeusts
# adding this header to http requests is
map $scheme $hsts_header { map $scheme $hsts_header {
https "max-age=31536000; includeSubdomains; preload"; https "max-age=31536000; includeSubdomains; preload";
} }
@ -84,14 +86,22 @@ in {
# Enable CSP for your services. # Enable CSP for your services.
# add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; # add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
# ^ this above breaks forgejo/gitea so
# Minimize information leaked to other domains
add_header 'Referrer-Policy' 'origin-when-cross-origin'; add_header 'Referrer-Policy' 'origin-when-cross-origin';
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block"; # Disable embedding as a frame
#add_header X-Frame-Options DENY;
# Prevent injection of code in other mime types (XSS Attacks)
#add_header X-Content-Type-Options nosniff;
# Enable XSS protection of the browser.
# May be unnecessary when CSP is configured properly (see above)
#add_header X-XSS-Protection "1; mode=block";
# This might create errors # This might create errors
proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict"; #proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
${realIpsFromList cfipv4} ${realIpsFromList cfipv4}
${realIpsFromList cfipv6} ${realIpsFromList cfipv6}