commit 0371f2b5cc0a8d7b146af4e88f4c583e4ced73eb · pyrox.dev/nixpkgs

+25 -30

nixos/modules/services/web-servers/nginx/default.nix

···

       130
       130
        
       

     

       131
       131
        
         vhosts = concatStringsSep "\n" (mapAttrsToList (vhostName: vhost:

     

       132
       132
        
           let

     

       133
       133
       -
               ssl = with vhost; addSSL || onlySSL || enableSSL;

     

       133
       133
       +
               onlySSL = vhost.onlySSL || vhost.enableSSL;

     

       134
       134
       +
               hasSSL = onlySSL || vhost.addSSL || vhost.forceSSL;

     

       134
       135
        
       

     

       135
       135
       -
               defaultListen = with vhost;

     

       136
       136
       -
                 if listen != [] then listen

     

       137
       137
       -
                 else if onlySSL || enableSSL then

     

       138
       138
       -
                      singleton                          { addr = "0.0.0.0"; port = 443; ssl = true;  }

     

       139
       139
       -
                      ++ optional enableIPv6             { addr = "[::]";    port = 443; ssl = true;  }

     

       140
       140
       -
                 else singleton                          { addr = "0.0.0.0"; port = 80;  ssl = false; }

     

       141
       141
       -
                      ++ optional enableIPv6             { addr = "[::]";    port = 80;  ssl = false; }

     

       142
       142
       -
                      ++ optional addSSL                 { addr = "0.0.0.0"; port = 443; ssl = true;  }

     

       143
       143
       -
                      ++ optional (enableIPv6 && addSSL) { addr = "[::]";    port = 443; ssl = true;  };

     

       136
       136
       +
               defaultListen =

     

       137
       137
       +
                 if vhost.listen != [] then vhost.listen

     

       138
       138
       +
                 else ((optionals hasSSL (

     

       139
       139
       +
                   singleton                    { addr = "0.0.0.0"; port = 443; ssl = true; }

     

       140
       140
       +
                   ++ optional enableIPv6 { addr = "[::]";    port = 443; ssl = true; }

     

       141
       141
       +
                 )) ++ optionals (!onlySSL) (

     

       142
       142
       +
                   singleton                    { addr = "0.0.0.0"; port = 80;  ssl = false; }

     

       143
       143
       +
                   ++ optional enableIPv6 { addr = "[::]";    port = 80;  ssl = false; }

     

       144
       144
       +
                 ));

     

       144
       145
        
       

     

       145
       146
        
               hostListen =

     

       146
       146
       -
                 if !vhost.forceSSL

     

       147
       147
       -
                   then defaultListen

     

       148
       148
       -
                   else filter (x: x.ssl) defaultListen;

     

       147
       147
       +
                 if vhost.forceSSL

     

       148
       148
       +
                   then filter (x: x.ssl) defaultListen

     

       149
       149
       +
                   else defaultListen;

     

       149
       150
        
       

     

       150
       151
        
               listenString = { addr, port, ssl, ... }:

     

       151
       152
        
                 "listen ${addr}:${toString port} "

     
···

       155
       156
        
       

     

       156
       157
        
               redirectListen = filter (x: !x.ssl) defaultListen;

     

       157
       158
        
       

     

       158
       158
       -
               redirectListenString = { addr, ... }:

     

       159
       159
       -
                 "listen ${addr}:80 ${optionalString vhost.default "default_server"};";

     

       160
       160
       -
       

     

       161
       159
        
               acmeLocation = ''

     

       162
       160
        
                 location /.well-known/acme-challenge {

     

       163
       161
        
                   ${optionalString (vhost.acmeFallbackHost != null) "try_files $uri @acme-fallback;"}

     
···

       175
       173
        
             in ''

     

       176
       174
        
               ${optionalString vhost.forceSSL ''

     

       177
       175
        
                 server {

     

       178
       178
       -
                   ${concatMapStringsSep "\n" redirectListenString redirectListen}

     

       176
       176
       +
                   ${concatMapStringsSep "\n" listenString redirectListen}

     

       179
       177
        
       

     

       180
       178
        
                   server_name ${vhost.serverName} ${concatStringsSep " " vhost.serverAliases};

     

       181
       179
        
                   ${optionalString vhost.enableACME acmeLocation}

     
···

       191
       189
        
                 ${optionalString vhost.enableACME acmeLocation}

     

       192
       190
        
                 ${optionalString (vhost.root != null) "root ${vhost.root};"}

     

       193
       191
        
                 ${optionalString (vhost.globalRedirect != null) ''

     

       194
       194
       -
                   return 301 http${optionalString ssl "s"}://${vhost.globalRedirect}$request_uri;

     

       192
       192
       +
                   return 301 http${optionalString hasSSL "s"}://${vhost.globalRedirect}$request_uri;

     

       195
       193
        
                 ''}

     

       196
       196
       -
                 ${optionalString ssl ''

     

       194
       194
       +
                 ${optionalString hasSSL ''

     

       197
       195
        
                   ssl_certificate ${vhost.sslCertificate};

     

       198
       196
        
                   ssl_certificate_key ${vhost.sslCertificateKey};

     

       199
       197
        
                 ''}

     
···

       478
       476
        
             }

     

       479
       477
        
       

     

       480
       478
        
             {

     

       481
       481
       -
               assertion = all (conf: with conf; !(addSSL && (onlySSL || enableSSL))) (attrValues virtualHosts);

     

       479
       479
       +
               assertion = all (conf: with conf;

     

       480
       480
       +
                 !(addSSL && (onlySSL || enableSSL)) &&

     

       481
       481
       +
                 !(forceSSL && (onlySSL || enableSSL)) &&

     

       482
       482
       +
                 !(addSSL && forceSSL)

     

       483
       483
       +
               ) (attrValues virtualHosts);

     

       482
       484
        
               message = ''

     

       483
       483
       -
                 Options services.nginx.service.virtualHosts.<name>.addSSL and

     

       484
       484
       -
                 services.nginx.virtualHosts.<name>.onlySSL are mutually esclusive

     

       485
       485
       -
               '';

     

       486
       486
       -
             }

     

       487
       487
       -
       

     

       488
       488
       -
             {

     

       489
       489
       -
               assertion = all (conf: with conf; forceSSL -> addSSL) (attrValues virtualHosts);

     

       490
       490
       -
               message = ''

     

       491
       491
       -
                 Option services.nginx.virtualHosts.<name>.forceSSL requires

     

       492
       492
       -
                 services.nginx.virtualHosts.<name>.addSSL set to true.

     

       485
       485
       +
                 Options services.nginx.service.virtualHosts.<name>.addSSL,

     

       486
       486
       +
                 services.nginx.virtualHosts.<name>.onlySSL and services.nginx.virtualHosts.<name>.forceSSL

     

       487
       487
       +
                 are mutually exclusive.

     

       493
       488
        
               '';

     

       494
       489
        
             }

     

       495
       490
        
           ];

+3 -2

nixos/modules/services/web-servers/nginx/vhost-options.nix

···

       96
       96
        
             default = false;

     

       97
       97
        
             description = ''

     

       98
       98
        
               Whether to add a separate nginx server block that permanently redirects (301)

     

       99
       99
       -
               all plain HTTP traffic to HTTPS. This option needs <literal>addSSL</literal>

     

       100
       100
       -
               to be set to true.

     

       99
       99
       +
               all plain HTTP traffic to HTTPS. This will set defaults for

     

       100
       100
       +
               <literal>listen</literal> to listen on all interfaces on the respective default

     

       101
       101
       +
               ports (80, 443), where the non-SSL listens are used for the redirect vhosts.

     

       101
       102
        
             '';

     

       102
       103
        
           };

     

       103
       104