nix-config/nixos/services/nginx.nix

{ config, lib, pkgs, ... }:
with lib;
let
  cfg = config.roles.server.nginx;
in {
  options.roles.server.nginx.enable = mkOption {
    default = false;
    type = types.bool;
  };

  config = mkIf cfg.enable {
    users.users.nginx.extraGroups = [ "acme" ];

    networking.firewall.allowedTCPPorts = [ 80 443 ];

    services.nginx = {
      enable = true;
      additionalModules = with pkgs.nginxModules; [ dav fancyindex ];
      appendConfig = mkDefault ''
        worker_processes 2;
        worker_cpu_affinity auto;
      '';
      eventsConfig = mkDefault ''
        worker_connections 1024;
      '';
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;
    };
  };
}