Merge pull request 'treewide: nginx optimizations' (!29) from treewide-nginx-optimizations into main
Reviewed-on: https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/29
This commit is contained in:
commit
03c9638098
33
base.nix
33
base.nix
|
@ -88,17 +88,46 @@
|
||||||
|
|
||||||
systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
|
systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
|
||||||
|
|
||||||
environment.snakeoil-certs = lib.mkIf (config.services.nginx.enable) {
|
environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
|
||||||
"/etc/certs/nginx" = {
|
"/etc/certs/nginx" = {
|
||||||
owner = "nginx";
|
owner = "nginx";
|
||||||
group = "nginx";
|
group = "nginx";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx.virtualHosts."_" = lib.mkIf (config.services.nginx.enable) {
|
services.nginx = {
|
||||||
|
recommendedTlsSettings = true;
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
recommendedOptimisation = true;
|
||||||
|
recommendedGzipSettings = true;
|
||||||
|
|
||||||
|
appendConfig = ''
|
||||||
|
pcre_jit on;
|
||||||
|
worker_processes auto;
|
||||||
|
worker_rlimit_nofile 100000;
|
||||||
|
'';
|
||||||
|
eventsConfig = ''
|
||||||
|
worker_connections 2048;
|
||||||
|
use epoll;
|
||||||
|
multi_accept on;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
|
||||||
sslCertificate = "/etc/certs/nginx.crt";
|
sslCertificate = "/etc/certs/nginx.crt";
|
||||||
sslCertificateKey = "/etc/certs/nginx.key";
|
sslCertificateKey = "/etc/certs/nginx.key";
|
||||||
addSSL = true;
|
addSSL = true;
|
||||||
extraConfig = "return 444;";
|
extraConfig = "return 444;";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
systemd.services.nginx.serviceConfig = {
|
||||||
|
LimitNOFILE = 65536;
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
|
||||||
|
|
||||||
|
security.acme = {
|
||||||
|
acceptTerms = true;
|
||||||
|
defaults.email = "drift@pvv.ntnu.no";
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -59,9 +59,9 @@ in {
|
||||||
services.nginx.virtualHosts."${domain}" = {
|
services.nginx.virtualHosts."${domain}" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
kTLS = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
|
proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
|
||||||
recommendedProxySettings = true;
|
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
client_max_body_size 512M;
|
client_max_body_size 512M;
|
||||||
'';
|
'';
|
||||||
|
|
|
@ -180,6 +180,7 @@ in
|
||||||
services.nginx.virtualHosts."idp2.pvv.ntnu.no" = {
|
services.nginx.virtualHosts."idp2.pvv.ntnu.no" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
kTLS = true;
|
||||||
root = "${package}/share/php/simplesamlphp/public";
|
root = "${package}/share/php/simplesamlphp/public";
|
||||||
locations = {
|
locations = {
|
||||||
# based on https://simplesamlphp.org/docs/stable/simplesamlphp-install.html#configuring-nginx
|
# based on https://simplesamlphp.org/docs/stable/simplesamlphp-install.html#configuring-nginx
|
||||||
|
|
|
@ -152,6 +152,7 @@ in {
|
||||||
users.groups.mediawiki.members = [ "nginx" ];
|
users.groups.mediawiki.members = [ "nginx" ];
|
||||||
|
|
||||||
services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
|
services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
|
||||||
|
kTLS = true;
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations = {
|
locations = {
|
||||||
|
|
|
@ -4,19 +4,5 @@
|
||||||
./ingress.nix
|
./ingress.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
security.acme = {
|
services.nginx.enable = true;
|
||||||
acceptTerms = true;
|
|
||||||
defaults.email = "drift@pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
recommendedTlsSettings = true;
|
|
||||||
recommendedProxySettings = true;
|
|
||||||
recommendedOptimisation = true;
|
|
||||||
recommendedGzipSettings = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -5,6 +5,7 @@
|
||||||
serverAliases = [ "www2.pvv.org" "pvv.ntnu.no" "pvv.org" ];
|
serverAliases = [ "www2.pvv.org" "pvv.ntnu.no" "pvv.org" ];
|
||||||
addSSL = true;
|
addSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
kTLS = true;
|
||||||
|
|
||||||
locations = {
|
locations = {
|
||||||
# Proxy home directories
|
# Proxy home directories
|
||||||
|
|
|
@ -7,7 +7,7 @@
|
||||||
services.nginx.virtualHosts."webmail2.pvv.ntnu.no" = {
|
services.nginx.virtualHosts."webmail2.pvv.ntnu.no" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
#locations."/" = lib.mkForce { };
|
kTLS = true;
|
||||||
locations."= /" = {
|
locations."= /" = {
|
||||||
return = "301 https://www.pvv.ntnu.no/mail/";
|
return = "301 https://www.pvv.ntnu.no/mail/";
|
||||||
};
|
};
|
||||||
|
|
|
@ -35,6 +35,7 @@ in
|
||||||
services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
|
services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
|
||||||
|
|
||||||
services.nginx.virtualHosts.${domain} = {
|
services.nginx.virtualHosts.${domain} = {
|
||||||
|
kTLS = true;
|
||||||
locations."/roundcube" = {
|
locations."/roundcube" = {
|
||||||
tryFiles = "$uri $uri/ =404";
|
tryFiles = "$uri $uri/ =404";
|
||||||
index = "index.php";
|
index = "index.php";
|
||||||
|
|
|
@ -5,6 +5,7 @@ in {
|
||||||
services.nginx.virtualHosts."chat.pvv.ntnu.no" = {
|
services.nginx.virtualHosts."chat.pvv.ntnu.no" = {
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
|
kTLS = true;
|
||||||
|
|
||||||
root = pkgs.element-web.override {
|
root = pkgs.element-web.override {
|
||||||
conf = {
|
conf = {
|
||||||
|
|
|
@ -217,6 +217,9 @@ in {
|
||||||
services.redis.servers."".enable = true;
|
services.redis.servers."".enable = true;
|
||||||
|
|
||||||
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
|
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
|
||||||
|
({
|
||||||
|
kTLS = true;
|
||||||
|
})
|
||||||
({
|
({
|
||||||
locations."/.well-known/matrix/server" = {
|
locations."/.well-known/matrix/server" = {
|
||||||
return = ''
|
return = ''
|
||||||
|
|
|
@ -1,15 +1,8 @@
|
||||||
{ config, values, ... }:
|
{ config, values, ... }:
|
||||||
{
|
{
|
||||||
security.acme = {
|
|
||||||
acceptTerms = true;
|
|
||||||
defaults.email = "danio@pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
enableReload = true;
|
enableReload = true;
|
||||||
|
|
||||||
defaultListenAddresses = [
|
defaultListenAddresses = [
|
||||||
values.hosts.bicep.ipv4
|
values.hosts.bicep.ipv4
|
||||||
"[${values.hosts.bicep.ipv6}]"
|
"[${values.hosts.bicep.ipv6}]"
|
||||||
|
@ -20,7 +13,6 @@
|
||||||
];
|
];
|
||||||
|
|
||||||
appendConfig = ''
|
appendConfig = ''
|
||||||
pcre_jit on;
|
|
||||||
worker_processes 8;
|
worker_processes 8;
|
||||||
worker_rlimit_nofile 8192;
|
worker_rlimit_nofile 8192;
|
||||||
'';
|
'';
|
||||||
|
@ -29,17 +21,5 @@
|
||||||
multi_accept on;
|
multi_accept on;
|
||||||
worker_connections 4096;
|
worker_connections 4096;
|
||||||
'';
|
'';
|
||||||
|
|
||||||
recommendedProxySettings = true;
|
|
||||||
recommendedTlsSettings = true;
|
|
||||||
recommendedGzipSettings = true;
|
|
||||||
recommendedBrotliSettings = true;
|
|
||||||
recommendedOptimisation = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
||||||
|
|
||||||
systemd.services.nginx.serviceConfig = {
|
|
||||||
LimitNOFILE = 65536;
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -91,6 +91,7 @@ in {
|
||||||
services.nginx.virtualHosts.${cfg.settings.server.domain} = {
|
services.nginx.virtualHosts.${cfg.settings.server.domain} = {
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
|
kTLS = true;
|
||||||
locations = {
|
locations = {
|
||||||
"/" = {
|
"/" = {
|
||||||
proxyPass = "http://127.0.0.1:${toString cfg.settings.server.http_port}";
|
proxyPass = "http://127.0.0.1:${toString cfg.settings.server.http_port}";
|
||||||
|
|
|
@ -1,15 +1,8 @@
|
||||||
{ config, values, ... }:
|
{ config, values, ... }:
|
||||||
{
|
{
|
||||||
security.acme = {
|
|
||||||
acceptTerms = true;
|
|
||||||
defaults.email = "drift@pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
enableReload = true;
|
enableReload = true;
|
||||||
|
|
||||||
defaultListenAddresses = [
|
defaultListenAddresses = [
|
||||||
values.hosts.ildkule.ipv4
|
values.hosts.ildkule.ipv4
|
||||||
"[${values.hosts.ildkule.ipv6}]"
|
"[${values.hosts.ildkule.ipv6}]"
|
||||||
|
@ -18,12 +11,5 @@
|
||||||
"127.0.0.2"
|
"127.0.0.2"
|
||||||
"[::1]"
|
"[::1]"
|
||||||
];
|
];
|
||||||
|
|
||||||
recommendedProxySettings = true;
|
|
||||||
recommendedTlsSettings = true;
|
|
||||||
recommendedGzipSettings = true;
|
|
||||||
recommendedOptimisation = true;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -24,15 +24,12 @@ in {
|
||||||
services.grzegorz-webui.hostName = "${config.networking.fqdn}";
|
services.grzegorz-webui.hostName = "${config.networking.fqdn}";
|
||||||
services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
|
services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
|
||||||
|
|
||||||
security.acme.acceptTerms = true;
|
|
||||||
security.acme.defaults.email = "pederbs@pvv.ntnu.no";
|
|
||||||
|
|
||||||
services.nginx.enable = true;
|
services.nginx.enable = true;
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
kTLS = true;
|
||||||
serverAliases = [
|
serverAliases = [
|
||||||
"${config.networking.hostName}.pvv.org"
|
"${config.networking.hostName}.pvv.org"
|
||||||
];
|
];
|
||||||
|
|
Loading…
Reference in New Issue