base.nix

@@ -88,44 +88,17 @@
 
   systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
 
-  environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
+  environment.snakeoil-certs = lib.mkIf (config.services.nginx.enable) {
     "/etc/certs/nginx" = {
       owner = "nginx";
       group = "nginx";
     };
   };
 
-  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
+  services.nginx.virtualHosts."_" = lib.mkIf (config.services.nginx.enable) {
     sslCertificate = "/etc/certs/nginx.crt";
     sslCertificateKey = "/etc/certs/nginx.key";
     addSSL = true;
     extraConfig = "return 444;";
-
-    recommendedTlsSettings = true;
-    recommendedProxySettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-
-    config = ''
-      pcre_jit on;
-      worker_processes auto;
-      worker_rlimit_nofile 100000;
-    '';
-    eventsConfig = ''
-      worker_connections 2048;
-      use epoll;
-      multi_accept on;
-    '';
-  };
-
-  systemd.services.nginx.serviceConfig = {
-    LimitNOFILE = 65536;
-  };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "drift@pvv.ntnu.no";
   };
 }

hosts/bekkalokk/services/gitea/default.nix

@@ -59,9 +59,9 @@ in {
   services.nginx.virtualHosts."${domain}" = {
     forceSSL = true;
     enableACME = true;
-    kTLS = true;
     locations."/" = {
       proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
+      recommendedProxySettings = true;
       extraConfig = ''
         client_max_body_size 512M;
       '';

hosts/bekkalokk/services/idp-simplesamlphp/default.nix

@@ -180,7 +180,6 @@ in
     services.nginx.virtualHosts."idp2.pvv.ntnu.no" = {
       forceSSL = true;
       enableACME = true;
-      kTLS = true;
       root = "${package}/share/php/simplesamlphp/public";
       locations =  {
         # based on https://simplesamlphp.org/docs/stable/simplesamlphp-install.html#configuring-nginx

hosts/bekkalokk/services/mediawiki/default.nix

@@ -152,7 +152,6 @@ in {
   users.groups.mediawiki.members = [ "nginx" ];
 
   services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
-    kTLS = true;
     forceSSL = true;
     enableACME = true;
     locations =  {

hosts/bekkalokk/services/nginx/default.nix

@@ -4,5 +4,19 @@
     ./ingress.nix
   ];
 
-  services.nginx.enable = true;
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "drift@pvv.ntnu.no";
+  };
+
+  services.nginx = {
+    enable = true;
+
+    recommendedTlsSettings = true;
+    recommendedProxySettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
 }

hosts/bekkalokk/services/nginx/ingress.nix

@@ -5,7 +5,6 @@
       serverAliases = [ "www2.pvv.org" "pvv.ntnu.no" "pvv.org" ];
       addSSL = true;
       enableACME = true;
-      kTLS = true;
 
       locations = {
         # Proxy home directories

hosts/bekkalokk/services/webmail/default.nix

@@ -7,7 +7,7 @@
   services.nginx.virtualHosts."webmail2.pvv.ntnu.no" = {
     forceSSL = true;
     enableACME = true;
-    kTLS = true;
+    #locations."/" = lib.mkForce { };
     locations."= /" = {
       return = "301 https://www.pvv.ntnu.no/mail/";
     };

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -35,7 +35,6 @@ in
   services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
 
   services.nginx.virtualHosts.${domain} = {
-    kTLS = true;
     locations."/roundcube" = {
       tryFiles = "$uri $uri/ =404";
       index = "index.php";

hosts/bicep/services/matrix/element.nix

@@ -5,7 +5,6 @@ in {
   services.nginx.virtualHosts."chat.pvv.ntnu.no" = {
     enableACME = true;
     forceSSL = true;
-    kTLS = true;
 
     root = pkgs.element-web.override {
       conf = {

hosts/bicep/services/matrix/synapse.nix

@@ -217,9 +217,6 @@ in {
   services.redis.servers."".enable = true;
   
   services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
-  ({
-    kTLS = true;
-  })
   ({
     locations."/.well-known/matrix/server" = {
       return = ''

hosts/bicep/services/nginx/default.nix

@@ -1,8 +1,15 @@
 { config, values, ... }:
 {
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "danio@pvv.ntnu.no";
+  };
+
   services.nginx = {
     enable = true;
+
     enableReload = true;
+
     defaultListenAddresses = [
       values.hosts.bicep.ipv4
       "[${values.hosts.bicep.ipv6}]"
@@ -13,6 +20,7 @@
     ];
 
     appendConfig = ''
+      pcre_jit on;
       worker_processes 8;
       worker_rlimit_nofile 8192;
     '';
@@ -21,5 +29,17 @@
       multi_accept on;
       worker_connections 4096;
     '';
+
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedBrotliSettings = true;
+    recommendedOptimisation = true;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  systemd.services.nginx.serviceConfig = {
+    LimitNOFILE = 65536;
   };
 }

hosts/ildkule/services/metrics/grafana.nix

@@ -91,7 +91,6 @@ in {
   services.nginx.virtualHosts.${cfg.settings.server.domain} = {
     enableACME = true;
     forceSSL = true;
-    kTLS = true;
     locations = {
       "/" = {
         proxyPass = "http://127.0.0.1:${toString cfg.settings.server.http_port}";

hosts/ildkule/services/nginx/default.nix

@@ -1,8 +1,15 @@
 { config, values, ... }:
 {
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "drift@pvv.ntnu.no";
+  };
+
   services.nginx = {
     enable = true;
+
     enableReload = true;
+
     defaultListenAddresses = [
       values.hosts.ildkule.ipv4
       "[${values.hosts.ildkule.ipv6}]"
@@ -11,5 +18,12 @@
       "127.0.0.2"
       "[::1]"
     ];
+
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
   };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
 }

modules/grzegorz.nix

@@ -24,12 +24,15 @@ in {
   services.grzegorz-webui.hostName = "${config.networking.fqdn}";
   services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
 
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "pederbs@pvv.ntnu.no";
+
   services.nginx.enable = true;
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
 
   services.nginx.virtualHosts."${config.networking.fqdn}" = {
     forceSSL = true;
     enableACME = true;
-    kTLS = true;
     serverAliases = [
       "${config.networking.hostName}.pvv.org"
     ];