{ pkgs, ... }: let element-web = pkgs.fetchzip { url = "https://github.com/vector-im/element-web/releases/download/v1.11.45/element-v1.11.45.tar.gz"; sha256 = "sha256-nwRsBIF9vcHZkyVsLA2sU2cmuzALEIIOcWQRGfd+5xs="; }; elementSecurityHeaders = '' # Configuration best practices # See: https://github.com/vector-im/element-web/tree/develop#configuration-best-practices add_header X-Frame-Options SAMEORIGIN; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header Content-Security-Policy "frame-ancestors 'self'"; add_header Strict-Transport-Security "max-age=63072000" always; ''; in { services.nginx.virtualHosts = { "acme-element.hamburg.ccc.de" = { enableACME = true; serverName = "element.hamburg.ccc.de"; listen = [ { addr = "0.0.0.0"; port = 31820; } ]; }; "element.hamburg.ccc.de" = { forceSSL = true; useACMEHost = "element.hamburg.ccc.de"; listen = [ { addr = "0.0.0.0"; port = 8443; ssl = true; extraParameters = [ "proxy_protocol" ]; } ]; root = pkgs.buildEnv { name = "element-web"; paths = [ element-web ./element-web-config ]; }; # Set no-cache for the version, config and index.html # so that browsers always check for a new copy of Element Web. # NB http://your-domain/ and http://your-domain/? are also covered by this locations."= /index.html" = { extraConfig = elementSecurityHeaders + '' add_header Cache-Control "no-cache"; ''; }; locations."= /version" = { extraConfig = elementSecurityHeaders + '' add_header Cache-Control "no-cache"; ''; }; # covers config.json and config.hostname.json requests as it is prefix. locations."/config" = { extraConfig = elementSecurityHeaders + '' add_header Cache-Control "no-cache"; ''; }; extraConfig = elementSecurityHeaders + '' index index.html; # redirect server error pages to the static page /50x.html error_page 500 502 503 504 /50x.html; # Make use of the ngx_http_realip_module to set the $remote_addr and # $remote_port to the client address and client port, when using proxy # protocol. # First set our proxy protocol proxy as trusted. set_real_ip_from 172.31.17.140; # Then tell the realip_module to get the addreses from the proxy protocol # header. real_ip_header proxy_protocol; ''; }; }; }