flakes/modules/nixos/services/nginx/default.nix

{
  config,
  lib,
  ...
}: {
  options.snowflake.services.nginx = {
    enable = lib.mkEnableOption "Enable nginx service";
    acmeEmail = lib.mkOption {
      type = lib.types.str;
      description = "Email to use for ACME SSL certificates";
    };
    enableCloudflareRealIP = lib.mkEnableOption "Enable setting real_ip_header from Cloudflare IPs";
  };

  config = let
    cfg = config.snowflake.services.nginx;
  in
    lib.mkIf cfg.enable {
      security.acme.defaults.email = cfg.acmeEmail;
      security.dhparams = {
        enable = true;
        params.nginx = {};
      };
      services.nginx = {
        enable = true;
        recommendedProxySettings = true;
        recommendedOptimisation = true;
        recommendedGzipSettings = true;
        recommendedTlsSettings = true;
        sslDhparam = config.security.dhparams.params.nginx.path;

        # Disable default_server access and return HTTP 444.
        appendHttpConfig =
          ''
            # Strict Transport Security (HSTS): Yes
            add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

            # Enable CSP
            add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;

            # Minimize information leaked to other domains
            add_header 'Referrer-Policy' 'origin-when-cross-origin';

            # Disable embedding as a frame
            add_header X-Frame-Options DENY;

            # Prevent injection of code in other mime types (XSS Attacks)
            add_header X-Content-Type-Options nosniff;

            server {
              listen 80 http2 default_server;
              listen 443 ssl http2 default_server;

              ssl_reject_handshake on;
              return 444;
            }
          ''
          ++ lib.optionalString cfg.enableCloudflareRealIP ''
            ${lib.concatMapStrings (ip: "set_real_ip_from ${ip};\n")
              (lib.filter (line: line != "")
                (lib.splitString "\n" ''
                  ${lib.readFile (lib.fetchurl "https://www.cloudflare.com/ips-v4/")}
                  ${lib.readFile (lib.fetchurl "https://www.cloudflare.com/ips-v6/")}
                ''))}
            real_ip_header CF-Connecting-IP;
          '';
      };
    };
}