1 files changed, 43 insertions, 28 deletions
diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix
index f0207b3..6159e25 100644
--- a/os/srv/nginx.nix
+++ b/os/srv/nginx.nix
@@ -19,39 +19,54 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable {
-    services.nginx = {
-      enable = true;
-      package = pkgs.nginx.override { openssl = pkgs.libressl; };
+  config = lib.mkMerge [
+    {
+      _module.args.securityTemplates.restrictToInternal = ''
+        allow 127.0.0.1;
+        allow ::1;
 
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      recommendedOptimisation = true;
-      recommendedGzipSettings = true;
-      virtualHosts = {
-        default = {
-          serverName = "_";
-          default = true;
-          rejectSSL = true;
-          locations."/".return = "444";
+        allow ${config.os.core.network.lan.range};
+        allow ${config.os.core.network.wg.range};
+        allow ${config.os.core.network.hs.range};
+
+        deny all;
+      '';
+    }
+
+    (lib.mkIf cfg.enable {
+      services.nginx = {
+        enable = true;
+        package = pkgs.nginx.override { openssl = pkgs.libressl; };
+
+        recommendedProxySettings = true;
+        recommendedTlsSettings = true;
+        recommendedOptimisation = true;
+        recommendedGzipSettings = true;
+        virtualHosts = {
+          default = {
+            serverName = "_";
+            default = true;
+            rejectSSL = true;
+            locations."/".return = "444";
+          };
         };
       };
-    };
 
-    security.acme = {
-      acceptTerms = true;
-      defaults.email = "adikro@disroot.org";
-    };
+      security.acme = {
+        acceptTerms = true;
+        defaults.email = "adikro@disroot.org";
+      };
 
-    # users.users.nginx.extraGroups = [ "acme" ];
+      users.users.nginx.extraGroups = [ "acme" ];
 
-    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
-      80
-      443
-    ];
+      networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
+        80
+        443
+      ];
 
-    systemd.tmpfiles.rules = [
-      "d /var/log/nginx 0750 nginx adm -"
-    ];
-  };
+      systemd.tmpfiles.rules = [
+        "d /var/log/nginx 0750 nginx adm -"
+      ];
+    })
+  ];
 }