From 3c4b8aadd56cfd27142a0cf0a70cd843a7b66af4 Mon Sep 17 00:00:00 2001
From: Ivan Dimitrov <ivan@idimitrov.dev>
Date: Mon, 27 Nov 2023 15:02:30 +0200
Subject: [PATCH] harden and enable base site

---
 mailserver/nginx/default.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/mailserver/nginx/default.nix b/mailserver/nginx/default.nix
index bb061a6..40a517d 100644
--- a/mailserver/nginx/default.nix
+++ b/mailserver/nginx/default.nix
@@ -3,9 +3,22 @@
   services = {
     nginx = {
       enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
-      virtualHosts."webshite.idimitrov.dev" = {
+      sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
+      appendHttpConfig = ''
+        map $scheme $hsts_header {
+            https   "max-age=31536000; includeSubdomains; preload";
+        }
+        add_header Strict-Transport-Security $hsts_header;
+        add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
+        add_header 'Referrer-Policy' 'origin-when-cross-origin';
+        add_header X-Frame-Options DENY;
+        add_header X-Content-Type-Options nosniff;
+      '';
+      virtualHosts."idimitrov.dev" = {
         enableACME = true;
         forceSSL = true;
         locations."/" = {