nixos/nginx: add option rejectSSL exposing ssl_reject_handshake

[ncfavier]

Motivation for this change

Alternative to #119039 as suggested in this comment.

Exposes nginx 1.19.4's ssl_reject_handshake directive. This is useful in default server blocks, to avoid serving the certificate for another vhost. For example, assuming I have a wildcard DNS record for *.example.com:

{ pkgs, ... }: {
  services.nginx = {
    enable = true;
    package = pkgs.nginxMainline;
    recommendedTlsSettings = true;
    virtualHosts = {
      "foo.example.com" = {
	forceSSL = true;
	# ...
      };

      default = {
	default = true;
	rejectSSL = true;
	extraConfig = "return 444;";
      };
    };
  };
}

Now accessing http://unknown.example.com results in a connection reset, and https://unknown.example.com results in a TLS error.

See https://trac.nginx.org/nginx/ticket/195 for additional context.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested this on my own server
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[ncfavier]

@aanderse @lukegb any opinion on this?

[lukegb]

My opinion is:

ship it