pyrox.dev
+2
nixos/doc/manual/release-notes/rl-2311.section.md
+2
nixos/doc/manual/release-notes/rl-2311.section.md
···- A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.+- `services.nginx` gained a `defaultListen` option at server-level with support for PROXY protocol listeners, also `proxyProtocol` is now exposed in `services.nginx.virtualHosts.<name>.listen` option. It is now possible to run PROXY listeners and non-PROXY listeners at a server-level, see [#213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more details.
+94
-6
nixos/modules/services/web-servers/nginx/default.nix
+94
-6
nixos/modules/services/web-servers/nginx/default.nix
···let addrs = if vhost.listenAddresses != [] then vhost.listenAddresses else cfg.defaultListenAddresses;-in optionals (hasSSL || vhost.rejectSSL) (map (addr: { inherit addr; port = cfg.defaultSSLListenPort; ssl = true; }) addrs)-++ optionals (!onlySSL) (map (addr: { inherit addr; port = cfg.defaultHTTPListenPort; ssl = false; }) addrs);·········+# that requires ACME configuration but has no HTTP listener which will make deterministically fail+# listen (vhost) > defaultListen (server) > listenAddresses (vhost) > defaultListenAddresses (server)+hasAtLeastHttpListener = listenOptions: any (listenLine: if listenLine ? proxyProtocol then !listenLine.proxyProtocol else true) listenOptions;+hasAtLeastDefaultHttpListener = if cfg.defaultListen != [] then hasAtLeastHttpListener cfg.defaultListen else (cfg.defaultListenAddresses != []);+hasAtLeastVhostHttpListener = if host.listen != [] then hasAtLeastHttpListener host.listen else (host.listenAddresses != []);+vhostAuthority = host.listen != [] || (cfg.defaultListen == [] && host.listenAddresses != []);+host.enableACME -> ((vhostAuthority && hasAtLeastVhostHttpListener) || (!vhostAuthority && hasAtLeastDefaultHttpListener))
+30
-7
nixos/modules/services/web-servers/nginx/vhost-options.nix
+30
-7
nixos/modules/services/web-servers/nginx/vhost-options.nix
···-extraParameters = mkOption { type = listOf str; description = lib.mdDoc "Extra parameters of this listen directive."; default = []; example = [ "backlog=1024" "deferred" ]; };···
+1
nixos/tests/all-tests.nix
+1
nixos/tests/all-tests.nix
···
+20
nixos/tests/nginx-proxyprotocol/_.test.nix.cert.pem
+20
nixos/tests/nginx-proxyprotocol/_.test.nix.cert.pem
···
+27
nixos/tests/nginx-proxyprotocol/_.test.nix.key.pem
+27
nixos/tests/nginx-proxyprotocol/_.test.nix.key.pem
···
+20
nixos/tests/nginx-proxyprotocol/ca.cert.pem
+20
nixos/tests/nginx-proxyprotocol/ca.cert.pem
···
+27
nixos/tests/nginx-proxyprotocol/ca.key.pem
+27
nixos/tests/nginx-proxyprotocol/ca.key.pem
···
+144
nixos/tests/nginx-proxyprotocol/default.nix
+144
nixos/tests/nginx-proxyprotocol/default.nix
···+log_format pcombined '(proxy_protocol=$proxy_protocol_addr) - (remote_addr=$remote_addr) - (realip=$realip_remote_addr) - (upstream=) - (remote_user=$remote_user) [$time_local] '+def check_origin_ip(src_ip: str, dst_url: str, failure: bool = False, proxy_protocol: bool = False, expected_ip: str | None = None):+return check(f"curl {'--haproxy-protocol' if proxy_protocol else '''} --interface {src_ip} --fail -L {dst_url} | grep '{expected_ip}'")+# Connecting through sniproxy to a non-PROXY protocol enabled listener should not pass the originating IP address.+# FIXME(RaitoBezarius): rewrite it using Python + (Scapy|something else) as this is too much broken unfortunately.+# def spoof(original_ip: str, target_ip: str, dst_url: str, tls: bool = False, expect_failure: bool = True):+# print(webserver.execute(f"cat <<EOF | nc {target_ip} {port}\n{generate_attacker_request(original_ip, target_ip, dst_url)}\nEOF"))+# return method(f"cat <<EOF | nc {target_ip} {port} | grep {original_ip}\n{generate_attacker_request(original_ip, target_ip, dst_url)}\nEOF")
+30
nixos/tests/nginx-proxyprotocol/generate-certs.nix
+30
nixos/tests/nginx-proxyprotocol/generate-certs.nix
···+sed -i 's_NotAfter: time.Now().AddDate(2, 0, 30),_NotAfter: time.Now().AddDate(20, 0, 0),_' main.go
+14
nixos/tests/nginx-proxyprotocol/snakeoil-certs.nix
+14
nixos/tests/nginx-proxyprotocol/snakeoil-certs.nix
···
+1
-1
pkgs/servers/http/nginx/generic.nix
+1
-1
pkgs/servers/http/nginx/generic.nix
···-inherit (nixosTests) nginx nginx-auth nginx-etag nginx-globalredirect nginx-http3 nginx-pubhtml nginx-sandbox nginx-sso;+inherit (nixosTests) nginx nginx-auth nginx-etag nginx-globalredirect nginx-http3 nginx-pubhtml nginx-sandbox nginx-sso nginx-proxyprotocol;