Merge pull request 'treewide: nginx optimizations' (!29) from treewide-nginx-optimizations into main

Reviewed-on: #29

base.nix

@@ -88,17 +88,46 @@
 
   systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
 
-  environment.snakeoil-certs = lib.mkIf (config.services.nginx.enable) {
+  environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
     "/etc/certs/nginx" = {
       owner = "nginx";
       group = "nginx";
     };
   };
 
-  services.nginx.virtualHosts."_" = lib.mkIf (config.services.nginx.enable) {
+  services.nginx = {
+    recommendedTlsSettings = true;
+    recommendedProxySettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+
+    appendConfig = ''
+      pcre_jit on;
+      worker_processes auto;
+      worker_rlimit_nofile 100000;
+    '';
+    eventsConfig = ''
+      worker_connections 2048;
+      use epoll;
+      multi_accept on;
+    '';
+  };
+
+  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
     sslCertificate = "/etc/certs/nginx.crt";
     sslCertificateKey = "/etc/certs/nginx.key";
     addSSL = true;
     extraConfig = "return 444;";
   };
+
+  systemd.services.nginx.serviceConfig = {
+    LimitNOFILE = 65536;
+  };
+
+  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "drift@pvv.ntnu.no";
+  };
 }