71 lines
3 KiB
Nix
71 lines
3 KiB
Nix
{ ... }:
|
|
{
|
|
services.nginx = {
|
|
enable = true;
|
|
virtualHosts."jellyfin.grzb.de" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
listen = [
|
|
{
|
|
addr = "0.0.0.0";
|
|
port = 80;
|
|
}
|
|
{
|
|
addr = "0.0.0.0";
|
|
port = 443;
|
|
ssl = true;
|
|
}
|
|
{
|
|
addr = "0.0.0.0";
|
|
port = 8443;
|
|
ssl = true;
|
|
proxyProtocol = true;
|
|
}
|
|
];
|
|
locations."= /" = {
|
|
return = "302 https://$host/web/";
|
|
};
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:8096/";
|
|
extraConfig = ''
|
|
# Disable buffering when the nginx proxy gets very resource heavy upon streaming
|
|
proxy_buffering off;
|
|
'';
|
|
};
|
|
locations."= /web/" = {
|
|
proxyPass = "http://localhost:8096/web/index.html";
|
|
};
|
|
locations."/socket" = {
|
|
proxyPass = "http://localhost:8096/socket";
|
|
proxyWebsockets = true;
|
|
};
|
|
extraConfig = ''
|
|
client_max_body_size 20M;
|
|
|
|
# Security / XSS Mitigation Headers
|
|
# NOTE: X-Frame-Options may cause issues with the webOS app
|
|
add_header X-Frame-Options "SAMEORIGIN";
|
|
add_header X-XSS-Protection "1; mode=block";
|
|
add_header X-Content-Type-Options "nosniff";
|
|
|
|
# COOP/COEP. Disable if you use external plugins/images/assets
|
|
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
|
add_header Cross-Origin-Embedder-Policy "require-corp" always;
|
|
add_header Cross-Origin-Resource-Policy "same-origin" always;
|
|
|
|
# Permissions policy. May cause issues on some clients
|
|
add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;
|
|
|
|
# Tell browsers to use per-origin process isolation
|
|
add_header Origin-Agent-Cluster "?1" always;
|
|
|
|
# Content Security Policy
|
|
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
|
|
# Enforces https content and restricts JS/CSS to origin
|
|
# External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
|
|
# NOTE: The default CSP headers may cause issues with the webOS app
|
|
#add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js https://www.gstatic.com/eureka/clank/95/cast_sender.js https://www.gstatic.com/eureka/clank/96/cast_sender.js https://www.gstatic.com/eureka/clank/97/cast_sender.js https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";
|
|
'';
|
|
};
|
|
};
|
|
}
|