diff options
Diffstat (limited to 'lass')
| -rw-r--r-- | lass/3modules/owncloud_nginx.nix | 29 | ||||
| -rw-r--r-- | lass/3modules/static_nginx.nix | 44 | ||||
| -rw-r--r-- | lass/3modules/wordpress_nginx.nix | 29 |
3 files changed, 97 insertions, 5 deletions
diff --git a/lass/3modules/owncloud_nginx.nix b/lass/3modules/owncloud_nginx.nix index 0cb11846c..79c9de1d4 100644 --- a/lass/3modules/owncloud_nginx.nix +++ b/lass/3modules/owncloud_nginx.nix @@ -46,8 +46,22 @@ let type = str; }; ssl = mkOption { - type = bool; - default = false; + type = with types; submodule ({ + options = { + enable = mkEnableOption "ssl"; + certificate = mkOption { + type = str; + }; + certificate_key = mkOption { + type = str; + }; + ciphers = mkOption { + type = str; + default = "AES128+EECDH:AES128+EDH"; + }; + }; + }); + default = {}; }; }; })); @@ -58,7 +72,7 @@ let group = config.services.nginx.group; imp = { - krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ... }: { + krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ssl, ... }: { server-names = [ "${domain}" "www.${domain}" @@ -102,7 +116,16 @@ let error_page 403 /core/templates/403.php; error_page 404 /core/templates/404.php; + ${if ssl.enable then '' + ssl_certificate ${ssl.certificate}; + ssl_certificate_key ${ssl.certificate_key}; + '' else ""} ''; + listen = (if ssl.enable then + [ "80" "443 ssl" ] + else + "80" + ); }); services.phpfpm.poolConfigs = flip mapAttrs cfg (name: { domain, folder, ... }: '' listen = ${folder}/phpfpm.pool diff --git a/lass/3modules/static_nginx.nix b/lass/3modules/static_nginx.nix index cc2641af2..fd5cfdfd7 100644 --- a/lass/3modules/static_nginx.nix +++ b/lass/3modules/static_nginx.nix @@ -21,6 +21,35 @@ let type = str; default = "/srv/http/${config.domain}"; }; + #sslEnable = mkEnableOption "ssl"; + #certificate = mkOption { + # type = str; + #}; + #certificate_key = mkOption { + # type = str; + #}; + #ciphers = mkOption { + # type = str; + # default = "AES128+EECDH:AES128+EDH"; + #}; + ssl = mkOption { + type = with types; submodule ({ + options = { + enable = mkEnableOption "ssl"; + certificate = mkOption { + type = str; + }; + certificate_key = mkOption { + type = str; + }; + ciphers = mkOption { + type = str; + default = "AES128+EECDH:AES128+EDH"; + }; + }; + }); + default = {}; + }; }; })); default = {}; @@ -29,8 +58,10 @@ let user = config.services.nginx.user; group = config.services.nginx.group; + external-ip = head config.krebs.build.host.nets.internet.addrs4; + imp = { - krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ... }: { + krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ssl, ... }: { server-names = [ "${domain}" "www.${domain}" @@ -43,6 +74,17 @@ let deny all; '') ]; + + listen = (if ssl.enable then + [ "80" "443 ssl" ] + else + "80" + ); + extraConfig = (if ssl.enable then '' + ssl_certificate ${ssl.certificate}; + ssl_certificate_key ${ssl.certificate_key}; + '' else ""); + }); }; diff --git a/lass/3modules/wordpress_nginx.nix b/lass/3modules/wordpress_nginx.nix index 974aacd83..bfed9e7c6 100644 --- a/lass/3modules/wordpress_nginx.nix +++ b/lass/3modules/wordpress_nginx.nix @@ -53,6 +53,23 @@ let "1" = "test.testsite.de"; }; }; + ssl = mkOption { + type = with types; submodule ({ + options = { + enable = mkEnableOption "ssl"; + certificate = mkOption { + type = str; + }; + certificate_key = mkOption { + type = str; + }; + ciphers = mkOption { + type = str; + default = "AES128+EECDH:AES128+EDH"; + }; + }; + }); + }; }; })); default = {}; @@ -68,7 +85,7 @@ let # } #''; - krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, multiSite, ... }: { + krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, multiSite, ssl, ... }: { server-names = [ "${domain}" "www.${domain}" @@ -114,7 +131,17 @@ let error_log /tmp/nginx_err.log; error_page 404 /404.html; error_page 500 502 503 504 /50x.html; + ${if ssl.enable then '' + ssl_certificate ${ssl.certificate}; + ssl_certificate_key ${ssl.certificate_key}; + '' else ""} + ''; + listen = (if ssl.enable then + [ "80" "443 ssl" ] + else + "80" + ); }); services.phpfpm.poolConfigs = flip mapAttrs cfg (name: { domain, folder, ... }: '' listen = ${folder}/phpfpm.pool |