gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/nextcloud: recommended nginx headers should

Browse Source 
not be optional, because upstream recommends them
https://docs.nextcloud.com/server/stable/admin_manual/installation/harden_server.html#serve-security-related-headers-by-the-web-server
This commit is contained in:
teutat3s
2025-10-09 10:09:42 +02:00
parent c794451fee
commit ed6fed3410
1 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/web-apps/nextcloud.nix
+12 -12
View File
@@ -320,6 +320,9 @@ in
(lib.mkRemovedOptionModule [ "services" "nextcloud" "config" "dbport" ] ''
Add port to services.nextcloud.config.dbhost instead.
'')
(lib.mkRemovedOptionModule [ "services" "nextcloud" "nginx" "recommendedHttpHeaders" ] ''
This option has been removed to always follow upstream's security recommendation.
'')
(lib.mkRenamedOptionModule
[ "services" "nextcloud" "logLevel" ]
[ "services" "nextcloud" "settings" "loglevel" ]
@@ -979,11 +982,6 @@ in
};
nginx = {
recommendedHttpHeaders = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Enable additional recommended HTTP response headers";
};
hstsMaxAge = lib.mkOption {
type = lib.types.ints.positive;
default = 15552000;
@@ -1534,13 +1532,11 @@ in
};
extraConfig = ''
index index.php index.html /index.php$request_uri;
${lib.optionalString (cfg.nginx.recommendedHttpHeaders) ''
add_header X-Content-Type-Options nosniff;
add_header X-Robots-Tag "noindex, nofollow";
add_header X-Permitted-Cross-Domain-Policies none;
add_header X-Frame-Options sameorigin;
add_header Referrer-Policy no-referrer;
''}
add_header X-Content-Type-Options nosniff;
add_header X-Robots-Tag "noindex, nofollow";
add_header X-Permitted-Cross-Domain-Policies none;
add_header X-Frame-Options sameorigin;
add_header Referrer-Policy no-referrer;
${lib.optionalString (cfg.https) ''
add_header Strict-Transport-Security "max-age=${toString cfg.nginx.hstsMaxAge}; includeSubDomains" always;
''}
@@ -1548,6 +1544,10 @@ in
fastcgi_buffers 64 4K;
fastcgi_hide_header X-Powered-By;
# mirror upstream htaccess file https://github.com/nextcloud/server/blob/v32.0.0/.htaccess#L40-L41
fastcgi_hide_header Referrer-Policy;
fastcgi_hide_header X-Content-Type-Options;
fastcgi_hide_header X-Frame-Options;
fastcgi_hide_header X-Permitted-Cross-Domain-Policies;
fastcgi_hide_header X-Robots-Tag;
gzip on;
gzip_vary on;