fix(reverse-proxy): reject unmatched HTTPS hosts

2026-08-17 15:49:11 -04:00
parent c50e996851
commit 4677dbe591
1 changed files with 7 additions and 0 deletions
--- a/modules/reverse-proxy.nix
+++ b/modules/reverse-proxy.nix
@@ -72,6 +72,13 @@ in

    services.nginx = {
      enable = true;
+      commonHttpConfig = ''
+        server {
+          listen 0.0.0.0:443 ssl default_server;
+          listen [::0]:443 ssl default_server;
+          ssl_reject_handshake on;
+        }
+      '';
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;