rrvsh/pantheon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(networking): disable ipv6 and add ssl check to proxy passes

Browse source
This commit is contained in:
Mohammad Rafiq 2025-06-13 01:26:52 +08:00
parent d6da064163
commit 17dc383a97
No known key found for this signature in database
2 changed files with 9 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
modules/nixos/hardware/networking.nix
View file

@ -2,9 +2,12 @@
{ {
config = lib.mkMerge [ config = lib.mkMerge [
{ {
networking.useDHCP = lib.mkDefault true; networking = {
networking.hostName = config.system.hostname; enableIPv6 = false;
networking.networkmanager.enable = true; useDHCP = lib.mkDefault true;
hostName = config.system.hostname;
networkmanager.enable = true;
};
services.openssh = { services.openssh = {
enable = true; enable = true;

5
modules/nixos/server/web-servers/nginx/default.nix
View file

@ -9,20 +9,21 @@ let
inherit (lib.pantheon) mkStrOption; inherit (lib.pantheon) mkStrOption;
inherit (builtins) listToAttrs map; inherit (builtins) listToAttrs map;
cfg = config.server.web-servers.nginx; cfg = config.server.web-servers.nginx;
sslCheck = if config.server.web-servers.enableSSL then true else false;
defaultSink = mkIf cfg.enableDefaultSink { defaultSink = mkIf cfg.enableDefaultSink {
"_" = { "_" = {
default = true; default = true;
rejectSSL = true; rejectSSL = sslCheck;
locations."/" = { locations."/" = {
return = "444"; return = "444";
}; };
}; };
}; };
sslCheck = if config.server.web-servers.enableSSL then true else false;
proxyPasses = listToAttrs ( proxyPasses = listToAttrs (
map (proxy: { map (proxy: {
name = proxy.source; name = proxy.source;
value = { value = {
addSSL = sslCheck;
enableACME = sslCheck; enableACME = sslCheck;
acmeRoot = null; acmeRoot = null;
locations."/" = { locations."/" = {