nixaalborg/nixos
2
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Add CSP header, restructure deployment user

Browse source
This commit is contained in:
Emelie Graven 2021-11-23 11:40:34 +01:00
parent ef89a0a949
commit 87b41e0627
Signed by: emelie
GPG key ID: C11123726DBB55A1
3 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
config/common/services/nginx.nix
View file

@ -21,7 +21,7 @@
add_header Strict-Transport-Security $hsts_header; add_header Strict-Transport-Security $hsts_header;
# Enable CSP for your services. # Enable CSP for your services.
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
# Minimize information leaked to other domains # Minimize information leaked to other domains
add_header 'Referrer-Policy' 'same-origin'; add_header 'Referrer-Policy' 'same-origin';

11
config/hosts/capetillo/configuration.nix
View file

@ -34,7 +34,7 @@
]; ];
}; };
users.users.deploy = { users.users.deploy-nix = {
isNormalUser = true; isNormalUser = true;
extraGroups = [ "wheel" ]; extraGroups = [ "wheel" ];
openssh.authorizedKeys.keys = [ openssh.authorizedKeys.keys = [
@ -42,7 +42,15 @@
]; ];
}; };
users.users.deploy-web = {
isNormalUser = true;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILk4m1uJzxd7pDmMZgnZxqD6lEIfVPf+I4tKPo0jJJrK deploy@drone.data.coop"
];
};
users.groups.backup.members = [ "virtualMail" ]; users.groups.backup.members = [ "virtualMail" ];
users.groups.nginx.members = [ "deploy-web" ];
security.sudo.wheelNeedsPassword = false; security.sudo.wheelNeedsPassword = false;
@ -55,7 +63,6 @@
nix.trustedUsers = [ nix.trustedUsers = [
"root" "root"
"deploy"
"@wheel" "@wheel"
]; ];

2
deploy/default.nix
View file

@ -13,7 +13,7 @@ in import "${sources.nixus}" {} ({ config, ... }: {
nodes = { nodes = {
mail = { lib, config, ... }: { mail = { lib, config, ... }: {
host = "deploy@nixaalb.org"; host = "deploy-nix@nixaalb.org";
configuration = ../config/hosts/capetillo/configuration.nix; configuration = ../config/hosts/capetillo/configuration.nix;
switchTimeout = 300; switchTimeout = 300;
successTimeout = 300; successTimeout = 300;