From 8bd1f401bbacf7e6537528d3f2dfd9e610e346c8 Mon Sep 17 00:00:00 2001 From: Tristan Helmich Date: Mon, 1 Feb 2016 14:08:45 +0100 Subject: [PATCH] nginx module: Add sslProtocols option --- nixos/modules/services/web-servers/nginx/default.nix | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index fb3f554bbf2..75ce9e26a30 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -30,7 +30,7 @@ let types_hash_max_size 2048; # use secure TLS defaults - ssl_protocols TLSv1.2; + ssl_protocols ${cfg.sslProtocols}; ssl_session_cache shared:SSL:42m; ssl_session_timeout 23m; @@ -191,6 +191,13 @@ in description = "Show nginx version in headers and error pages"; }; + sslProtocols = mkOption { + type = types.str; + default = "TLSv1.2"; + example = "TLSv1 TLSv1.1 TLSv1.2"; + description = "Allowed TLS protocol versions."; + }; + virtualHosts = mkOption { type = types.attrsOf (types.submodule (import ./vhost-options.nix { inherit lib;