From 4677dbe5914b3435e5d203465f753582bcd17eb0 Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Mon, 17 Aug 2026 15:49:11 -0400
Subject: [PATCH] fix(reverse-proxy): reject unmatched HTTPS hosts

---
 modules/reverse-proxy.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/reverse-proxy.nix b/modules/reverse-proxy.nix
index 799a181..2b36fc5 100644
--- a/modules/reverse-proxy.nix
+++ b/modules/reverse-proxy.nix
@@ -72,6 +72,13 @@ in
 
     services.nginx = {
       enable = true;
+      commonHttpConfig = ''
+        server {
+          listen 0.0.0.0:443 ssl default_server;
+          listen [::0]:443 ssl default_server;
+          ssl_reject_handshake on;
+        }
+      '';
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
       recommendedProxySettings = true;