hainich/nginx: disable interest cohort globally

hosts/hainich/services/nginx.nix

@@ -25,27 +25,32 @@
   };
 
   networking.firewall.allowedTCPPorts = [ 1935 ];
-  services.nginx.appendConfig = ''
+  services.nginx = {
-  rtmp {
+    appendHttpConfig = ''
-    server {
+      add_header Permissions-Policy "interest-cohort=()";
-      listen 1935;
+    '';
-      application cutiestream {
+    appendConfig = ''
-        live on;
+      rtmp {
-        allow publish all;
+        server {
-        allow play all;
+          listen 1935;
+          application cutiestream {
+            live on;
+            allow publish all;
+            allow play all;
+          }
+          application ingest {
+            live on;
+    
+            record all;
+            record_path /data/ingest;
+            record_unique on;
+    
+    #        include /var/secrets/ingest.conf;
+          }
+        }
       }
-      application ingest {
+    '';
-        live on;
+  };
-
-        record all;
-        record_path /data/ingest;
-        record_unique on;
-
-#        include /var/secrets/ingest.conf;
-      }
-    }
-  }
-  '';
 
   systemd.services.nginx.serviceConfig.ReadWriteDirectories = "/data/ingest /var/secrets";
 }