Commit graph

694 commits

Author SHA1 Message Date
Robert Hensing d48591123f nixos/apache-httpd: Use pkgs.emptyDirectory 2021-06-12 17:28:42 +02:00
Naïm Favier 821ca7d4cc
nixos/nginx: add option rejectSSL exposing ssl_reject_handshake 2021-05-24 15:10:09 +02:00
Jörg Thalheim b900661f6e
Merge pull request #122825 from Izorkin/update-duplicates-systemcallfilters
treewide: remove duplicates SystemCallFilters
2021-05-17 12:06:06 +01:00
Richard Marko 16b0f07890 nixos/nginx: fix comment about acme postRun not running as root
As of 67a5d66 this is no longer true, since acme postRun runs as root.
The idea of the service is good so reword a comment a bit.
2021-05-17 18:03:04 +09:00
Richard Marko 7423afb5e4 nixos/molly-brown: fix description of certPath
`allowKeysForGroup` is no longer available so this drops

```
security.acme.certs."example.com".allowKeysForGroup = true;
```

line. `SupplementaryGroups` should be enough for
allowing access to certificates.
2021-05-17 18:03:04 +09:00
Sandro ec1dd62608
Merge pull request #118521 from SuperSandro2000/nginx-proxy-timeout
nixos/nginx: add option to change proxy timeouts
2021-05-17 03:15:54 +02:00
Sandro 700942d2a5
Merge pull request #121119 from SuperSandro2000/remove-gnidorah
treewide: remove gnidorah
2021-05-17 02:42:24 +02:00
Sandro Jäckel 51166f90c6
nixos/nginx: add option to change proxy timeouts 2021-05-17 02:37:44 +02:00
Aaron Andersen 21f5dd5c6e
Merge pull request #122647 from onny/caddy
nixos/caddy: support user and group options
2021-05-16 17:23:57 -04:00
Jonas Heinrich fff9cf00fd caddy: support user and group options 2021-05-15 10:32:49 +02:00
Aaron Andersen fc63be7ac8
Merge pull request #122658 from aanderse/httpd-reload
nixos/httpd: provide a stable path stable path to the configuration f…
2021-05-14 23:50:43 -04:00
Izorkin feebe402f5
treewide: remove duplicates SystemCallFilters 2021-05-13 15:44:56 +03:00
Aaron Andersen f20aa073e1 nixos/httpd: provide a stable path stable path to the configuration file for reloads 2021-05-11 22:36:55 -04:00
Luke Granger-Brown d922cad4d6
Merge pull request #119172 from midchildan/package/trafficserver
nixos/trafficserver: init
2021-05-03 09:48:07 +01:00
Martin Weinelt 506bc7ba02
nixos/nginx: update hardening settings
- Set an explicit umask that allows u+rwx and g+r.
- Adds `ProtectControlGroups` and `ProtectKernelLogs`, there should be
  no need to access either.
- Adds `ProtectClock` to prevent write-access to the system clock.
- `ProtectProc` hides processes from other users within the /proc
  filesystem and `ProcSubSet` hides all files/directories unrelated to
  the process management of the units process.
- Sets `RemoveIPC`, as there is no SysV or POSIX IPC within nginx that I
  know of.
- Restricts the creation of arbitrary namespaces
- Adds a reasonable `SystemCallFilter` preventing calls to @privileged,
  @obsolete and others.

And finally applies some sorting based on the order these options appear
in systemd.exec(5).
2021-04-30 18:49:43 +02:00
Sandro Jäckel ae02415ee8
treewide: remove gnidorah
due to github account removal/deletion and not other mean of contact.
2021-04-30 01:48:19 +02:00
midchildan 28e608f84b
nixos/trafficserver: init 2021-04-27 00:02:16 +09:00
Lassulus ea5759474a
Merge pull request #119803 from SuperSandro2000/SuperSandro2000-patch-1
nixos/nginx: set isSystemUser
2021-04-24 22:37:46 +02:00
Maciej Krüger 9530794548
nginx: add vhost.http3
Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
2021-04-18 20:20:24 +02:00
Sandro 15cd5fc57e
nixos/nginx: set isSystemUser 2021-04-18 16:15:48 +02:00
Sandro 0139874db9
nixos/nginx: add upstreams examples (#118447)
* nixos/nginx: add upstreams examples

I am not fully sure if they are fully correct but they deployed the right syntax.

* nixos/nginx: use literal example

* Update nixos/modules/services/web-servers/nginx/default.nix

* Update nixos/modules/services/web-servers/nginx/default.nix
2021-04-17 00:25:03 +02:00
talyz 06dee38345
Revert "nixos/nginx: fix eval for tengine"
This reverts commit 2d3200e010.
2021-04-14 16:34:10 +02:00
taku0 4c87cb87a2
Merge pull request #67684 from indiscipline/minio
nixos/minio: allow multiple data directories for erasure coding
2021-04-13 18:29:28 +09:00
Sandro 39060b241c
Merge pull request #118445 from SuperSandro2000/SuperSandro2000-patch-3 2021-04-12 17:18:50 +02:00
Indiscipline 9ffc4ad790 nixos/minio: allow multiple data directories for erasure coding 2021-04-10 14:44:45 +03:00
Kim Lindberger 5a1bd5ff66
Merge pull request #116074 from talyz/discourse
discourse: Add package and NixOS module
2021-04-08 14:19:49 +02:00
Luke Granger-Brown ddf4795824 nixos/pomerium: fix useACMEHost
useACMEHost doesn't work properly, because I forgot to actually define
the variable that is being relied upon here. Oops.
2021-04-07 01:26:44 +00:00
Sandro fb9a2414dc nixos/nginx: use http 1.1 in "recommended" proxySettings
This allows http keep-alive by default which requires http 1.1.
2021-04-05 05:30:18 +02:00
talyz 46d935a4ce
nixos/nginx: Add an option to specify additional third-party modules 2021-04-04 13:44:36 +02:00
Sandro db5a15676c
nixos/nginx: set "recommended" proxy timeouts to 60s
According to the nginx documentation [1] those values  cannot usually exceed 75 seconds.
The defaults are 60s and should probably be lowered to something reasonable like 20 or 30 seconds.

[1] https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout
2021-04-04 07:47:45 +02:00
Luke Granger-Brown 309e836c33 nixos/tests/pomerium: init 2021-03-29 10:41:41 +00:00
Luke Granger-Brown cb2f1df034 nixos/pomerium: init 2021-03-29 10:41:41 +00:00
ajs124 2d3200e010 nixos/nginx: fix eval for tengine 2021-03-10 01:23:11 +01:00
Aaron Andersen 9798ed1a3d
Merge pull request #111011 from waldheinz/nginx-mem-write-exec
nixos/nginx: fix MemoryDenyWriteExecute not being disabled when needed
2021-03-03 07:19:35 -05:00
Elis Hirwing 1216baaee1
nixos/httpd: Fix httpd module for php8 2021-03-02 09:22:32 +01:00
Daniel Nagy 7c121e60c5
nixos/httpd: fix lua paths
Account for the fact that, when creating a lua package without the
"withPackages" helper, we dont get an extra "lua" attribute in the
package.

Therefore we need to distinguish between the "withPackages" case and the
direct ( or "empty" ) lua package.

For example with this nixos config:

```nix
{
  services.httpd = {
      enable = true;
      package = pkgs.apacheHttpd.override {
        luaSupport = true;
        lua5 = pkgs.lua5_3.withPackages (ps: with ps; [ luafilesystem ] );
      };
    };
}
```

Here we say that we want to have apache to use a lua, packaged with the
`luafilesystem` module so that we can `require` that in scripts to
render http responses. There, the set that gets assigned to `lua5 ` does
not have a `luaversion` attribute, rather it has a `lua` attribute
wherein lies a `luaversion` attribute. If we dont package additional
modules, then we dont have that `lua` attribute in between and rather
directly have to use `luaversion` directly.
2021-02-11 11:56:06 +01:00
Martin Weinelt 47901b544c
Merge pull request #111302 from fooker/pr/nginx-default-type
nixos/nginx: serve unknown MIME-Types as binary
2021-02-09 01:44:47 +01:00
Luflosi e31dc1c5f6
nginx module: fix typo in proxyWebsockets description 2021-01-31 18:09:41 +01:00
Sandro 2c748ee8a4
Merge pull request #111439 from helsinki-systems/unit
nixos/unit: add stateDir and logDir types
2021-01-31 15:18:08 +01:00
Fritz Otlinghaus 4e353723d6
nixos/unit: add stateDir and logDir types 2021-01-31 13:41:53 +01:00
Fritz Otlinghaus a55d0b80ff
nixos/nginx: add logError type 2021-01-31 11:37:38 +01:00
Sandro fccda5aae6
Merge pull request #108819 from SuperSandro2000/nginx-module 2021-01-30 21:46:35 +01:00
Dustin Frisch 891d1aa885
nixos/nginx: serve unknown MIME-Types as binary
The built-in default for unknown MIME-Types is `text/plain` whereas the
upstream default config changes it to `application/octet-stream`. By
changing the default tpye, unknown files will be downloaded by browsers
instead of being displayed.
2021-01-30 12:52:02 +01:00
WORLDofPEACE 3eae73d862
Merge pull request #97618 from lf-/fix-bad-caddy-configs
nixos/caddy: fix overwriting of tls settings in config
2021-01-29 10:08:46 -05:00
Matthias Treydte 7d2829c0a0 nixos/nginx: fix MemoryDenyWriteExecute not being disabled when needed
The expression should check if the actually used nginx package
needes write+execute rights, not the default pkgs.nginx (which
has no modules unless overridden in an overlay).

Having MemoryDenyWriteExecute always true causes e.g. the Lua
module to fail (because JIT compilation).
2021-01-28 13:13:31 +01:00
rnhmjoj f62d2652e2
nixos/uwsgi: set up the default runtime directory
Fix issue #110691
2021-01-25 14:05:39 +01:00
volth bc0d605cf1 treewide: fix double quoted strings in meta.description
Signed-off-by: Ben Siraphob <bensiraphob@gmail.com>
2021-01-24 19:56:59 +07:00
Fritz Otlinghaus 0a38f6da4f
nixos/tomcat: add extraGroups type (#110486) 2021-01-22 16:22:06 +01:00
Fritz Otlinghaus c1efc32740
nixos/module/jboss: Add types to options (#110451) 2021-01-22 11:11:40 +01:00
Sandro Jäckel 7856011a30
nixos/apache-httpd: Suggest directory used security.acme.certs.<name>.webroot 2021-01-09 02:24:24 +01:00