nixos-vps/modules/nginx.nix

# Nginx Reverse Proxy Module
# Provides: Nginx with automatic Let's Encrypt certificates and security headers
#
# Usage:
#   myModules.nginx = {
#     enable = true;
#     email = "your@email.com";
#     domains = {
#       "search.example.com" = {
#         port = 8888;
#       };
#     };
#   };

{
  config,
  lib,
  pkgs,
  ...
}:

let
  cfg = config.myModules.nginx;
in
{
  options.myModules.nginx = {
    enable = lib.mkEnableOption "Nginx reverse proxy with Let's Encrypt";

    email = lib.mkOption {
      type = lib.types.str;
      example = "admin@example.com";
      description = "Email address for Let's Encrypt registration";
    };

    domains = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule {
        options = {
          port = lib.mkOption {
            type = lib.types.port;
            description = "Local port to proxy to";
          };

          extraConfig = lib.mkOption {
            type = lib.types.lines;
            default = "";
            description = "Extra Nginx config for this location";
          };

          contentSecurityPolicy = lib.mkOption {
            type = lib.types.nullOr lib.types.str;
            default = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'";
            description = "Content-Security-Policy header value. Set to null to omit.";
          };

          extraLocations = lib.mkOption {
            type = lib.types.attrsOf (lib.types.submodule {
              options = {
                proxyPass = lib.mkOption {
                  type = lib.types.str;
                  description = "Proxy target URL";
                };
                extraConfig = lib.mkOption {
                  type = lib.types.lines;
                  default = "";
                  description = "Extra Nginx config for this location";
                };
              };
            });
            default = { };
            description = "Additional location blocks to add to this virtual host";
          };
        };
      });
      default = { };
      description = "Domains to configure with their proxy targets";
    };
  };

  config = lib.mkIf cfg.enable {
    # Open HTTP/HTTPS ports
    networking.firewall.allowedTCPPorts = [ 80 443 ];

    # ACME (Let's Encrypt) configuration
    security.acme = {
      acceptTerms = true;
      defaults.email = cfg.email;
      certs = lib.mapAttrs' (domain: opts: {
        name = domain;
        value = { };
      }) cfg.domains;
    };

    # Nginx configuration
    services.nginx = {
      enable = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;

      virtualHosts = lib.mapAttrs' (domain: opts: {
        name = domain;
        value = {
          enableACME = true;
          forceSSL = true;

          # Security headers applied per-vhost
          extraConfig = ''
            # Strict Transport Security — 6 months, include subdomains, preload-ready
            add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;

            # Prevent MIME type sniffing
            add_header X-Content-Type-Options "nosniff" always;

            # Restrict browser features
            add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

            # Cross-origin isolation
            add_header Cross-Origin-Resource-Policy "same-origin" always;
            add_header Cross-Origin-Opener-Policy "same-origin" always;

            # Content Security Policy (configurable per-domain)
          '' + lib.optionalString (opts.contentSecurityPolicy != null) ''
            add_header Content-Security-Policy "${opts.contentSecurityPolicy}" always;
          '';

          locations = {
            "/" = {
              proxyPass = "http://127.0.0.1:${toString opts.port}";
              extraConfig = opts.extraConfig;
            };
          } // lib.mapAttrs' (locPath: locOpts: {
            name = locPath;
            value = {
              proxyPass = locOpts.proxyPass;
              extraConfig = locOpts.extraConfig;
            };
          }) opts.extraLocations;
        };
      }) cfg.domains;
    };

    # Ensure nginx user can access ACME certs
    users.users.nginx.extraGroups = [ "acme" ];
  };
}