···

       
130
       
 
       


     

       
131
       
 
       
  vhosts = concatStringsSep "\n" (mapAttrsToList (vhostName: vhost:

     

       
132
       
 
       
    let

     

       
133
       
-
       
        ssl = with vhost; addSSL || onlySSL || enableSSL;

     

       
0
       
 
       

     

       
134
       
 
       


     

       
135
       
-
       
        defaultListen = with vhost;

     

       
136
       
-
       
          if listen != [] then listen

     

       
137
       
-
       
          else if onlySSL || enableSSL then

     

       
138
       
-
       
               singleton                          { addr = "0.0.0.0"; port = 443; ssl = true;  }

     

       
139
       
-
       
               ++ optional enableIPv6             { addr = "[::]";    port = 443; ssl = true;  }

     

       
140
       
-
       
          else singleton                          { addr = "0.0.0.0"; port = 80;  ssl = false; }

     

       
141
       
-
       
               ++ optional enableIPv6             { addr = "[::]";    port = 80;  ssl = false; }

     

       
142
       
-
       
               ++ optional addSSL                 { addr = "0.0.0.0"; port = 443; ssl = true;  }

     

       
143
       
-
       
               ++ optional (enableIPv6 && addSSL) { addr = "[::]";    port = 443; ssl = true;  };

     

       
144
       
 
       


     

       
145
       
 
       
        hostListen =

     

       
146
       
-
       
          if !vhost.forceSSL

     

       
147
       
-
       
            then defaultListen

     

       
148
       
-
       
            else filter (x: x.ssl) defaultListen;

     

       
149
       
 
       


     

       
150
       
 
       
        listenString = { addr, port, ssl, ... }:

     

       
151
       
 
       
          "listen ${addr}:${toString port} "

     
···

       
155
       
 
       


     

       
156
       
 
       
        redirectListen = filter (x: !x.ssl) defaultListen;

     

       
157
       
 
       


     

       
158
       
-
       
        redirectListenString = { addr, ... }:

     

       
159
       
-
       
          "listen ${addr}:80 ${optionalString vhost.default "default_server"};";

     

       
160
       
-
       


     

       
161
       
 
       
        acmeLocation = ''

     

       
162
       
 
       
          location /.well-known/acme-challenge {

     

       
163
       
 
       
            ${optionalString (vhost.acmeFallbackHost != null) "try_files $uri @acme-fallback;"}

     
···

       
175
       
 
       
      in ''

     

       
176
       
 
       
        ${optionalString vhost.forceSSL ''

     

       
177
       
 
       
          server {

     

       
178
       
-
       
            ${concatMapStringsSep "\n" redirectListenString redirectListen}

     

       
179
       
 
       


     

       
180
       
 
       
            server_name ${vhost.serverName} ${concatStringsSep " " vhost.serverAliases};

     

       
181
       
 
       
            ${optionalString vhost.enableACME acmeLocation}

     
···

       
191
       
 
       
          ${optionalString vhost.enableACME acmeLocation}

     

       
192
       
 
       
          ${optionalString (vhost.root != null) "root ${vhost.root};"}

     

       
193
       
 
       
          ${optionalString (vhost.globalRedirect != null) ''

     

       
194
       
-
       
            return 301 http${optionalString ssl "s"}://${vhost.globalRedirect}$request_uri;

     

       
195
       
 
       
          ''}

     

       
196
       
-
       
          ${optionalString ssl ''

     

       
197
       
 
       
            ssl_certificate ${vhost.sslCertificate};

     

       
198
       
 
       
            ssl_certificate_key ${vhost.sslCertificateKey};

     

       
199
       
 
       
          ''}

     
···

       
478
       
 
       
      }

     

       
479
       
 
       


     

       
480
       
 
       
      {

     

       
481
       
-
       
        assertion = all (conf: with conf; !(addSSL && (onlySSL || enableSSL))) (attrValues virtualHosts);

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
482
       
 
       
        message = ''

     

       
483
       
-
       
          Options services.nginx.service.virtualHosts.<name>.addSSL and

     

       
484
       
-
       
          services.nginx.virtualHosts.<name>.onlySSL are mutually esclusive

     

       
485
       
-
       
        '';

     

       
486
       
-
       
      }

     

       
487
       
-
       


     

       
488
       
-
       
      {

     

       
489
       
-
       
        assertion = all (conf: with conf; forceSSL -> addSSL) (attrValues virtualHosts);

     

       
490
       
-
       
        message = ''

     

       
491
       
-
       
          Option services.nginx.virtualHosts.<name>.forceSSL requires

     

       
492
       
-
       
          services.nginx.virtualHosts.<name>.addSSL set to true.

     

       
493
       
 
       
        '';

     

       
494
       
 
       
      }

     

       
495
       
 
       
    ];

     

···

       
130
       
 
       


     

       
131
       
 
       
  vhosts = concatStringsSep "\n" (mapAttrsToList (vhostName: vhost:

     

       
132
       
 
       
    let

     

       
133
       
+
       
        onlySSL = vhost.onlySSL || vhost.enableSSL;

     

       
134
       
+
       
        hasSSL = onlySSL || vhost.addSSL || vhost.forceSSL;

     

       
135
       
 
       


     

       
136
       
+
       
        defaultListen =

     

       
137
       
+
       
          if vhost.listen != [] then vhost.listen

     

       
138
       
+
       
          else ((optionals hasSSL (

     

       
139
       
+
       
            singleton                    { addr = "0.0.0.0"; port = 443; ssl = true; }

     

       
140
       
+
       
            ++ optional enableIPv6 { addr = "[::]";    port = 443; ssl = true; }

     

       
141
       
+
       
          )) ++ optionals (!onlySSL) (

     

       
142
       
+
       
            singleton                    { addr = "0.0.0.0"; port = 80;  ssl = false; }

     

       
143
       
+
       
            ++ optional enableIPv6 { addr = "[::]";    port = 80;  ssl = false; }

     

       
144
       
+
       
          ));

     

       
145
       
 
       


     

       
146
       
 
       
        hostListen =

     

       
147
       
+
       
          if vhost.forceSSL

     

       
148
       
+
       
            then filter (x: x.ssl) defaultListen

     

       
149
       
+
       
            else defaultListen;

     

       
150
       
 
       


     

       
151
       
 
       
        listenString = { addr, port, ssl, ... }:

     

       
152
       
 
       
          "listen ${addr}:${toString port} "

     
···

       
156
       
 
       


     

       
157
       
 
       
        redirectListen = filter (x: !x.ssl) defaultListen;

     

       
158
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
159
       
 
       
        acmeLocation = ''

     

       
160
       
 
       
          location /.well-known/acme-challenge {

     

       
161
       
 
       
            ${optionalString (vhost.acmeFallbackHost != null) "try_files $uri @acme-fallback;"}

     
···

       
173
       
 
       
      in ''

     

       
174
       
 
       
        ${optionalString vhost.forceSSL ''

     

       
175
       
 
       
          server {

     

       
176
       
+
       
            ${concatMapStringsSep "\n" listenString redirectListen}

     

       
177
       
 
       


     

       
178
       
 
       
            server_name ${vhost.serverName} ${concatStringsSep " " vhost.serverAliases};

     

       
179
       
 
       
            ${optionalString vhost.enableACME acmeLocation}

     
···

       
189
       
 
       
          ${optionalString vhost.enableACME acmeLocation}

     

       
190
       
 
       
          ${optionalString (vhost.root != null) "root ${vhost.root};"}

     

       
191
       
 
       
          ${optionalString (vhost.globalRedirect != null) ''

     

       
192
       
+
       
            return 301 http${optionalString hasSSL "s"}://${vhost.globalRedirect}$request_uri;

     

       
193
       
 
       
          ''}

     

       
194
       
+
       
          ${optionalString hasSSL ''

     

       
195
       
 
       
            ssl_certificate ${vhost.sslCertificate};

     

       
196
       
 
       
            ssl_certificate_key ${vhost.sslCertificateKey};

     

       
197
       
 
       
          ''}

     
···

       
476
       
 
       
      }

     

       
477
       
 
       


     

       
478
       
 
       
      {

     

       
479
       
+
       
        assertion = all (conf: with conf;

     

       
480
       
+
       
          !(addSSL && (onlySSL || enableSSL)) &&

     

       
481
       
+
       
          !(forceSSL && (onlySSL || enableSSL)) &&

     

       
482
       
+
       
          !(addSSL && forceSSL)

     

       
483
       
+
       
        ) (attrValues virtualHosts);

     

       
484
       
 
       
        message = ''

     

       
485
       
+
       
          Options services.nginx.service.virtualHosts.<name>.addSSL,

     

       
486
       
+
       
          services.nginx.virtualHosts.<name>.onlySSL and services.nginx.virtualHosts.<name>.forceSSL

     

       
487
       
+
       
          are mutually exclusive.

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
488
       
 
       
        '';

     

       
489
       
 
       
      }

     

       
490
       
 
       
    ];

     

···

       
96
       
 
       
      default = false;

     

       
97
       
 
       
      description = ''

     

       
98
       
 
       
        Whether to add a separate nginx server block that permanently redirects (301)

     

       
99
       
-
       
        all plain HTTP traffic to HTTPS. This option needs <literal>addSSL</literal>

     

       
100
       
-
       
        to be set to true.

     

       
0
       
 
       

     

       
101
       
 
       
      '';

     

       
102
       
 
       
    };

     

       
103
       
 
       


     

···

       
96
       
 
       
      default = false;

     

       
97
       
 
       
      description = ''

     

       
98
       
 
       
        Whether to add a separate nginx server block that permanently redirects (301)

     

       
99
       
+
       
        all plain HTTP traffic to HTTPS. This will set defaults for

     

       
100
       
+
       
        <literal>listen</literal> to listen on all interfaces on the respective default

     

       
101
       
+
       
        ports (80, 443), where the non-SSL listens are used for the redirect vhosts.

     

       
102
       
 
       
      '';

     

       
103
       
 
       
    };

     

       
104