From c7abbc56562f9745d9d1bb29f3c0d4874425e92c Mon Sep 17 00:00:00 2001
From: adikro <adikro@disroot.org>
Date: Sat, 23 May 2026 21:32:00 +0200
Subject: updates

---
 os/srv/nginx.nix | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

(limited to 'os/srv/nginx.nix')

diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix
index b0c01a7..f0207b3 100644
--- a/os/srv/nginx.nix
+++ b/os/srv/nginx.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.os.srv.nginx;
@@ -17,14 +22,30 @@ in
   config = lib.mkIf cfg.enable {
     services.nginx = {
       enable = true;
+      package = pkgs.nginx.override { openssl = pkgs.libressl; };
 
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
       recommendedOptimisation = true;
       recommendedGzipSettings = true;
+      virtualHosts = {
+        default = {
+          serverName = "_";
+          default = true;
+          rejectSSL = true;
+          locations."/".return = "444";
+        };
+      };
+    };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "adikro@disroot.org";
     };
 
-    networking.firewall.allowedTCPPorts = lib.mkOptional cfg.openFirewall [
+    # users.users.nginx.extraGroups = [ "acme" ];
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
       80
       443
     ];
-- 
cgit v1.3