summaryrefslogtreecommitdiffstats
path: root/krebs/3modules/nginx.nix
diff options
context:
space:
mode:
authormakefu <github@syntax-fehler.de>2016-03-16 08:25:50 +0100
committermakefu <github@syntax-fehler.de>2016-03-16 08:25:50 +0100
commit57476fb24a71dd709105ab61f380e12bca592279 (patch)
treea5f96fa27e38d312c8f1ec18b036d6477c1b42d9 /krebs/3modules/nginx.nix
parentbe5a136464ea2de6449fc9abe7ec9b0acc9708ff (diff)
parent03a72ef958055c958992c4fbde618c1e68bfff6e (diff)
Merge branch 'master' of gum:stockholm
Diffstat (limited to 'krebs/3modules/nginx.nix')
-rw-r--r--krebs/3modules/nginx.nix29
1 files changed, 23 insertions, 6 deletions
diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix
index 2aa023443..8d0704e8c 100644
--- a/krebs/3modules/nginx.nix
+++ b/krebs/3modules/nginx.nix
@@ -12,6 +12,20 @@ let
api = {
enable = mkEnableOption "krebs.nginx";
+ default404 = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ By default all requests not directed to an explicit hostname are
+ replied with a 404 error to avoid accidental exposition of nginx
+ services.
+
+ Set this value to `false` to disable this behavior - you will then be
+ able to configure a new `default_server` in the listen address entries
+ again.
+ '';
+ };
+
servers = mkOption {
type = types.attrsOf (types.submodule {
options = {
@@ -20,6 +34,7 @@ let
# TODO use identity
default = [
"${config.networking.hostName}"
+ "${config.networking.hostName}.r"
"${config.networking.hostName}.retiolum"
];
};
@@ -53,17 +68,19 @@ let
sendfile on;
keepalive_timeout 65;
gzip on;
- server {
- listen 80 default_server;
- server_name _;
- return 404;
- }
+
+ ${optionalString cfg.default404 ''
+ server {
+ listen 80 default_server;
+ server_name _;
+ return 404;
+ }''}
+
${concatStrings (mapAttrsToList (_: to-server) cfg.servers)}
'';
};
};
-
indent = replaceChars ["\n"] ["\n "];
to-location = { name, value }: ''