add static landing page

nix/module.nix

@@ -6,6 +6,17 @@
 }:
 let
   cfg = config.services.tide;
+  landingPage = import ./site.nix { inherit pkgs; };
+  contentSecurityPolicy = lib.concatStringsSep " " [
+    "default-src 'self';"
+    "base-uri 'self';"
+    "font-src 'self';"
+    "form-action 'self';"
+    "frame-ancestors 'none';"
+    "img-src 'self' data:;"
+    "object-src 'none';"
+    "style-src 'self';"
+  ];
   dumpCommand = lib.concatStringsSep " " [
     "${config.services.postgresql.package}/bin/pg_dump"
     "--format=custom"
@@ -32,6 +43,25 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      virtualHosts."torahimderecheretz.com" = {
+        enableACME = true;
+        forceSSL = true;
+        root = landingPage;
+
+        locations."/" = {
+          tryFiles = "$uri $uri/ =404";
+          extraConfig = ''
+            add_header Content-Security-Policy "${contentSecurityPolicy}" always;
+            add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            add_header X-Content-Type-Options "nosniff" always;
+          '';
+        };
+      };
+    };
+
     services.discourse = {
       enable = true;
       admin = {