1
0
Fork 0
selfhostblocks/nginx/unit.nix

76 lines
1.6 KiB
Nix
Raw Normal View History

2022-09-29 08:37:24 +02:00
{ stdenv
, pkgs
, utils
}:
{ serviceSuffix
, user ? "http"
, group ? "http"
, configDir ? "/etc/nginx"
, configFile ? "nginx.conf"
, pidFile ? "/run/nginx/nginx.pid"
}:
{...}:
utils.systemd.mkService rec {
name = "nginx-${serviceSuffix}";
content = ''
[Unit]
Description=Nginx webserver
After=network.target network-online.target
Wants=network-online.target systemd-networkd-wait-online.target
StartLimitInterval=14400
StartLimitBurst=10
[Service]
Type=forking
User=${user}
Group=${group}
PIDFile=${pidFile}
ExecStart=${pkgs.nginx}/bin/nginx -c ${configDir}/${configFile} -g 'pid ${pidFile};'
ExecReload=${pkgs.nginx}/bin/nginx -s reload
KillMode=mixed
# Nginx verifies it can open a file under here even when configured
# to write elsewhere.
LogsDirectory=nginx
CacheDirectory=nginx
RuntimeDirectory=nginx
# Restart=on-abnormal
# KillSignal=SIGQUIT
TimeoutStopSec=5s
LimitNOFILE=1048576
LimitNPROC=512
LockPersonality=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=full
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
# CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
# ProtectSystem=strict
# ReadWritePaths=/var/lib/nginx /var/log/nginx
[Install]
WantedBy=multi-user.target
'';
}