nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-08-27 02:34:53 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,058,872 Commits 448 Branches 81 Tags
python-updates
Commit Graph

1246 Commits

Author SHA1 Message Date
K900
3ce38a8ae4 Merge remote-tracking branch 'origin/staging-next' into staging 2026-08-13 15:25:51 +03:00
Peder Bergebakken Sundt
e3d5a82031 nixos/httpd: set Type=notify for systemd unit (#486129) 2026-08-12 21:42:45 +00:00
Maximilian Bosch
1c1d9c499d nixos/unit: rm MemoryDenyWriteExecute 
This package has a direct dependency on pcre2. By removing the sealloc
allocator, which allows MemoryDenyWriteExecute, but is experimental and
not recommended for production, this option needs to be turned off
again.
 2026-08-07 21:01:32 +02:00
Maximilian Bosch
ea6542782d nixos/nginx: generally turn off MemoryDenyWriteExecute 
See #384302 for the issues associated with it.
 2026-08-07 21:01:30 +02:00
Tom Herbers
238c598440 tengine: drop 
Drop due to seriously delayed responses to security vulnerabilities.
 2026-08-03 16:58:38 +02:00
isabel
e2824e9316 (Part 3) various: replace systemd.services.<name>.{script,preStart} with ExecStart{,Pre} (#481639) 2026-08-02 12:04:51 +00:00
h7x4
8f26f8a332 nixos/traefik: replace bash wrapper in ExecStartPre 2026-07-31 03:17:21 +09:00
h7x4
b0cce36acb various: replace systemd.services.<name>.{script,preStart} with ExecStart{,Pre} 
This is a partial revert of 39e9380
 2026-07-31 03:08:12 +09:00
h7x4
29190543f6 nixos/httpd: use Type=notify 2026-07-29 10:50:27 +09:00
Leona Maroni
34ce4d9ac2 nixos/nginx: setup logrotate to send kill USR1 signal only once (#362733) 2026-07-26 15:48:40 +00:00
TheRealGramdalf
6bb5009ce8 nixos/caddy: increase UDP buffer size to match linked recommendation 2026-07-20 18:54:12 -07:00
Sandro
4554587be6 rustfs: init at 1.0.0-beta.9 (#523840) 2026-07-16 01:12:10 +00:00
Marcel
81b44d8527 nixos/rustfs: init 2026-07-15 20:31:43 +02:00
Sandro Jäckel
4080106f0b nixos/nginx: do not match pkgs.openresty as some modules like brotli add buildInputs 
--- /dev/fd/63	2026-07-12 01:29:24.447317728 +0200
+++ /dev/fd/62	2026-07-12 01:29:24.448317734 +0200
@@ -4,7 +4,7 @@
         [ ( "doc"
           , DerivationOutput
               { path =
-                  "/nix/store/r2jdcgwxp2a4pa1cxa6yvf9p0f7wi1ih-openresty-1.31.1.1-doc"
+                  "/nix/store/syrb1ccks4vqgg25ygrylahxglknrc5j-openresty-1.31.1.1-doc"
               , hashAlgo = ""
               , hash = ""
               }
@@ -12,7 +12,7 @@
         , ( "out"
           , DerivationOutput
               { path =
-                  "/nix/store/2saawkswxnxs4ffb98r7bidy4vj6259c-openresty-1.31.1.1"
+                  "/nix/store/n48gwmah2pxfc8vg7dc3ki0c4xmszr1d-openresty-1.31.1.1"
               , hashAlgo = ""
               , hash = ""
               }
@@ -62,12 +62,18 @@
         , ( "/nix/store/v2k6k32vbrfsl2cciclgl1k8v8c3jxv8-nginx-doc-unstable-0-unstable-2026-05-15.drv"
           , fromList [ "out" ]
           )
+        , ( "/nix/store/wkgfkcxnpk1dy9qdd7m22ifkhyxn1hd5-brotli-1.2.0.drv"
+          , fromList [ "dev" ]
+          )
         , ( "/nix/store/wx2j9jzk90dlsz9wvbrjdxlm4q1vf8aq-openresty-nix-etag-1.15.4.patch.drv"
           , fromList [ "out" ]
           )
         , ( "/nix/store/xk8m6ai5q00gr0h3vm8afc5dk1plpw9i-install-shell-files.drv"
           , fromList [ "out" ]
           )
+        , ( "/nix/store/xy1vwc4173xz5hz2yjv7z83gz3ss6h72-brotli.drv"
+          , fromList [ "out" ]
+          )
         , ( "/nix/store/zhhm8h70q64qgwg3bccc7ygwy48jn5c3-libxml2-2.15.3.drv"
           , fromList [ "dev" ]
           )
@@ -95,14 +101,14 @@
           )
         , ( "__structuredAttrs" , "" )
         , ( "buildInputs"
-          , "/nix/store/i0jqva96qfgc76g8w7jbyiv6h3si07b9-openssl-3.6.2-dev /nix/store/a9psmsc93llkravrd50rrv8k3dwdw60x-zlib-1.3.2-dev /nix/store/y5yv1kzvmppzdp0jkq3yf3apx563canv-pcre2-10.46-dev /nix/store/35wfzwiy77ab9dhzjblb4kmdnckss40i-libxml2-2.15.3-dev /nix/store/9vgz8w91lcw9f43glyqmfj50v1hvgkmp-libxslt-1.1.45-dev /nix/store/k7kxg101ikkm0cyf8jcqhg948vy542af-perl-5.42.0 /nix/store/hzdwjd2s60585lygfj81qdhm2825frsm-libpq-18.4-dev"
+          , "/nix/store/i0jqva96qfgc76g8w7jbyiv6h3si07b9-openssl-3.6.2-dev /nix/store/a9psmsc93llkravrd50rrv8k3dwdw60x-zlib-1.3.2-dev /nix/store/y5yv1kzvmppzdp0jkq3yf3apx563canv-pcre2-10.46-dev /nix/store/35wfzwiy77ab9dhzjblb4kmdnckss40i-libxml2-2.15.3-dev /nix/store/9vgz8w91lcw9f43glyqmfj50v1hvgkmp-libxslt-1.1.45-dev /nix/store/k7kxg101ikkm0cyf8jcqhg948vy542af-perl-5.42.0 /nix/store/hzdwjd2s60585lygfj81qdhm2825frsm-libpq-18.4-dev /nix/store/pcq77h5mhc5nfvf1rs92a5l5g0kaapdg-brotli-1.2.0-dev"
           )
         , ( "builder"
           , "/nix/store/zh1ijdhb6gng1509b1zrilb6xlzx60j6-bash-5.3p9/bin/bash"
           )
         , ( "cmakeFlags" , "" )
         , ( "configureFlags"
-          , "--sbin-path=bin/nginx --with-http_ssl_module --with-http_v2_module --with-http_v3_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_auth_request_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_stub_status_module --with-threads --with-pcre-jit --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --pid-path=/var/log/nginx/nginx.pid --http-client-body-temp-path=/tmp/nginx_client_body --http-proxy-temp-path=/tmp/nginx_proxy --http-fastcgi-temp-path=/tmp/nginx_fastcgi --http-uwsgi-temp-path=/tmp/nginx_uwsgi --http-scgi-temp-path=/tmp/nginx_scgi --with-openssl-opt=enable-ktls --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-file-aio --with-http_postgres_module"
+          , "--sbin-path=bin/nginx --with-http_ssl_module --with-http_v2_module --with-http_v3_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_auth_request_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_stub_status_module --with-threads --with-pcre-jit --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --pid-path=/var/log/nginx/nginx.pid --http-client-body-temp-path=/tmp/nginx_client_body --http-proxy-temp-path=/tmp/nginx_proxy --http-fastcgi-temp-path=/tmp/nginx_fastcgi --http-uwsgi-temp-path=/tmp/nginx_uwsgi --http-scgi-temp-path=/tmp/nginx_scgi --with-openssl-opt=enable-ktls --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-file-aio --with-http_postgres_module --add-module=/nix/store/sw63grm2cbi76pcq44izm8f8fdvzjafn-brotli"
           )
         , ( "configurePlatforms" , "" )
         , ( "depsBuildBuild" , "" )
@@ -113,11 +119,13 @@
         , ( "depsHostHostPropagated" , "" )
         , ( "depsTargetTarget" , "" )
         , ( "depsTargetTargetPropagated" , "" )
-        , ( "disallowedReferences" , "" )
+        , ( "disallowedReferences"
+          , "/nix/store/sw63grm2cbi76pcq44izm8f8fdvzjafn-brotli"
+          )
         , ( "doCheck" , "" )
         , ( "doInstallCheck" , "" )
         , ( "doc"
-          , "/nix/store/r2jdcgwxp2a4pa1cxa6yvf9p0f7wi1ih-openresty-1.31.1.1-doc"
+          , "/nix/store/syrb1ccks4vqgg25ygrylahxglknrc5j-openresty-1.31.1.1-doc"
           )
         , ( "enableParallelBuilding" , "1" )
         , ( "enableParallelChecking" , "1" )
@@ -129,7 +137,7 @@
           )
         , ( "nginxVersion" , "1.31.1" )
         , ( "out"
-          , "/nix/store/2saawkswxnxs4ffb98r7bidy4vj6259c-openresty-1.31.1.1"
+          , "/nix/store/n48gwmah2pxfc8vg7dc3ki0c4xmszr1d-openresty-1.31.1.1"
           )
         , ( "outputs" , "out doc" )
         , ( "patches"
@@ -137,7 +145,7 @@
           )
         , ( "pname" , "openresty" )
         , ( "postInstall"
-          , "ln -s $out/luajit/bin/luajit-2.1.ROLLING $out/bin/luajit-openresty\nln -sf $out/nginx/bin/nginx $out/bin/openresty\nln -s $out/nginx/bin/nginx $out/bin/nginx\nln -s $out/nginx/conf $out/conf\nln -s $out/nginx/html $out/html\n\nwrapProgram $out/bin/restydoc \\\n  --prefix PATH : /nix/store/i6jrv1f3mygdh2gv5r2yn1lm77d3qals-groff-1.24.1/bin\n\nsubstituteInPlace $out/bin/resty \\\n  --replace-fail \"'bin/nginx'\" \"'$out/bin/nginx'\"\n"
+          , "ln -s $out/luajit/bin/luajit-2.1.ROLLING $out/bin/luajit-openresty\nln -sf $out/nginx/bin/nginx $out/bin/openresty\nln -s $out/nginx/bin/nginx $out/bin/nginx\nln -s $out/nginx/conf $out/conf\nln -s $out/nginx/html $out/html\n\nwrapProgram $out/bin/restydoc \\\n  --prefix PATH : /nix/store/i6jrv1f3mygdh2gv5r2yn1lm77d3qals-groff-1.24.1/bin\n\nsubstituteInPlace $out/bin/resty \\\n  --replace-fail \"'bin/nginx'\" \"'$out/bin/nginx'\"\nremove-references-to -t /nix/store/sw63grm2cbi76pcq44izm8f8fdvzjafn-brotli $(readlink -fn $out/bin/nginx)\n"
           )
         , ( "postPatch"
           , "substituteInPlace bundle/nginx-1.31.1/src/http/ngx_http_core_module.c \\\n  --replace-fail '@nixStoreDir@' \"$NIX_STORE\" \\\n  --replace-fail '@nixStoreDirLen@' \"${#NIX_STORE}\"\n\npatchShebangs configure bundle/\n"
 2026-07-14 13:15:19 +02:00
Sandro Jäckel
323b76b823 Revert "nixos/nginx: disable MemoryDenyWriteExecute when lua with luajit is enabled" 
This reverts commit 04b527753e.
 2026-07-12 01:33:42 +02:00
Maximilian Bosch
cb03a8497a nixos/phpfpm: escape ini values (#516530) 2026-07-11 18:13:55 +00:00
Sandro Jäckel
04b527753e nixos/nginx: disable MemoryDenyWriteExecute when lua with luajit is enabled 
Otherwise nginx prints warnings such as the following when using lua code:

nginx: lua atpanic: Lua VM crashed, reason: runtime code generation failed, restricted kernel?
 2026-07-11 02:44:04 +02:00
Jean-Baptiste Giraudeau
e32b3af849 nixos/nginx: setup logrotate to send kill USR1 signal only once 
by setting `sharedscripts = true` so that nginx receive
the kill USR1 signal only once at the end, instead of once per log file.
 2026-07-05 15:46:07 +02:00
Maximilian Bosch
309b10bfca nixos/nginx: Always symlink nginx configuration to /etc/nginx/nginx.conf (#164100) 2026-07-04 10:25:07 +00:00
Diogo Correia
f309829221 nixos/phpfpm: escape ini values 
Passing a value that contains special characters (e.g., `=`) causes
phpfpm to be unable to parse the configuration file.
As per PHP's parse_ini_file function documentation [1], all values
containing non-alphanumeric characters must be enclosed in double
quotes:
> If a value in the ini file contains any non-alphanumeric characters it
> needs to be enclosed in double-quotes (").

This commit ensures string values are enclosed in double-quotes, and
appropriately escapes double-quotes, backslashes, and line breaks.

[1]: https://www.php.net/parse_ini_file
 2026-07-03 20:18:50 +01:00
Maximilian Bosch
8ef5dd7568 nixos/nginx/gitweb: move into gitweb module (#538174) 2026-07-03 17:58:54 +00:00
Maximilian Bosch
d8f802c855 nixos/nginx/gitweb: move into gitweb module 
I don't see how this was ever considered a good idea, but that's part of
a service-module and is not the responsibility of the nginx maintainers.
 2026-07-03 19:39:04 +02:00
Maximilian Bosch
27fbd73b93 nixos/nginx: not using reuseport for unix domain listens (#473182) 2026-07-03 15:07:37 +00:00
Victor Nawothnig
dc68e7fd15 nixos/nginx: Always symlink nginx configuration to /etc/nginx/nginx.conf 2026-07-03 16:51:56 +02:00
Maximilian Bosch
5fd9527f61 nginx: add ma27 and leona to maintainers, remove inactive maintainers (#536585) 2026-06-29 10:33:26 +00:00
Leona Maroni
54bf69f9d7 nixos/nginx: add leona and ma27 as maintainers 2026-06-29 10:52:49 +02:00
Ilan Joselevich
eaffe290dd nixos/nginx: add lua option for Lua scripting support 
Add `services.nginx.lua.{enable,extraPackages}` to enable OpenResty's
lua-nginx-module on a stock nginx. When enabled it adds the module,
includes lua-resty-core, and wires up lua_package_path /
lua_package_cpath (and lua_ssl_trusted_certificate) from a
luajit_openresty package set built from extraPackages.

When the configured package already bundles Lua (openresty), the module
and bundled libraries are not re-added; only the search path is set up so
its own lualib stays in use.

Migrate the openresty-lua test to the new option and add an nginx-lua
test covering the stock-nginx path.

Assisted-by: Claude:claude-opus-4-8
 2026-06-25 00:56:45 +03:00
Leona Maroni
d95db34ef9 varnish60: drop 
uses EOL pcre, complicates our handling inside Nixpkgs.
There are much newer versions available.
 2026-05-29 11:29:40 +02:00
Michael Hoang
6d1bbc317c nixos/nginx: drop option for configuring DHE 
This option is no longer necessary as DHE is deprecated in NixOS as of #513396
and ECDHE does not require any configuration changes.
 2026-05-25 09:18:10 +02:00
Michael Hoang
6db66126ec nixos/nginx: sync Mozilla recommended cipher list 
https://ssl-config.mozilla.org/#server=nginx&config=intermediate&guideline=6.0
https://wiki.mozilla.org/Security/Server_Side_TLS#Version_History
 2026-05-25 09:15:25 +02:00
Sandro
54cca98030 nixos/h2o: upgrade Mozilla’s TLS recommendations (drops “old”) (#516056) 2026-05-22 23:50:47 +00:00
Leona Maroni
c5f9753e38 vinyl-cache: 9.0.0 -> 9.0.1 (#522042) 2026-05-21 09:47:20 +00:00
Sandro
1f1b4a2ffe nixos/nginx/tailscale-auth: drop Content-Length header (#516441) 2026-05-20 15:52:03 +00:00
Oliver Schmidt
6dfb871fdc varnish,nixos/varnish: expose stateDir from package to module 
Unfortunately, Vinyl Cache has decided to change the default state dir
in a patch release. As this is a compile-time constant, we
- now explicitly provide a well-chosen stateDir in the package
- basically keep the stateDir as is, beacuse /var/run/ is a symlink to
  /run
- expose it via passthru to the module that picks up the particular
  stateDir of the package used

Note: The patch file has been created from git, but then manually
altered Makefile.am -> Makefile.in to account for the preprocessing of
the release tarball.
 2026-05-20 15:22:43 +02:00
Martin Weinelt
fbebf19913 nixos/nginx: make cipher configuration structured (#513393) 2026-05-04 23:16:12 +00:00
Martin Weinelt
dd3f260355 nixos/nginx: make cipher configuration structured 
Give hints about how to configure TLSv1.3 ciphersuites, because they get
configured somewhere else and the "incomplete" list might throw people
off.

Remove TLSv1 and TLSv1.1 from examples, they should not be used any more.
 2026-05-05 01:11:07 +02:00
Robert Hensing
04b6aa5544 nixos/*: remove unused let bindings (#515686) 2026-05-04 13:12:07 +00:00
Bouke van der Bijl
71e18ef931 nixos/nginx/tailscale-auth: drop Content-Length header 
When a request has no body but Content-Length does have a value, the
request can hang waiting for the body.

We should clear out the Content-Length header when forwarding the
request without the body.
 2026-05-04 12:31:45 +02:00
·𐑑𐑴𐑕𐑑𐑩𐑤
032457146e nixos/h2o: upgrade Mozilla’s TLS recommendations (drops “old“) 2026-05-03 19:19:14 +07:00
K900
963acab9a1 nixos/send: Add environmentFile option for securely passing secrets (#462978) 2026-05-02 15:26:55 +00:00
Michael Daniels
2e87c2f8f4 nixos/*: remove unused let bindings 
Generated using deadnix (with some manual work); split from #514611.
 2026-05-01 20:39:14 -04:00
Leona Maroni
1997c5f274 vinyl-cache_9: init at 9.0.0 (#510889) 2026-04-28 12:29:35 +00:00
Ameer Taweel
b4389214c2 nixos/stargazer: remove absolute path literals 2026-04-25 01:45:10 +03:00
Leona Maroni
21318349b9 nixos/{varnish,vinyl-cache}: add assertions to prevent users using wrong module 
Varnish Cache and Vinyl Cache are similar, so it could happen that users
use the wrong module. This change adds assertions to both modules that
only the supported packages can be used with it.
 2026-04-24 11:36:05 +02:00
Leona Maroni
d7de32990c nixos/vinyl-cache: init module 
This module is essentialy the same as services.varnish, but adapts to the
changed project name. For the lifetime of NixOS 26.05, we still support
Varnish to simplify the migration.
 2026-04-24 11:36:05 +02:00
Ilan Joselevich
6a73e02580 nixos/tusd: init module (#505412) 2026-04-18 18:46:27 +00:00
StepBroBD
fa57458391 nixos/caddy: Fix string conversion for http and https ports (#507283) 2026-04-17 13:05:50 +00:00
Michael Schneider
52b16dc40d nixos/tusd: init module 2026-04-15 15:15:48 +01:00
Philip Taron
d22bc0f6f5 treewide: remove nobody/nogroup [part 1] (#509391) 2026-04-13 14:51:20 +00:00
rnhmjoj
577b32b084 treewide: remove nobody/nogroup from examples 
The nobody/nogroup pair of should only ever be used by NFS to map remote
uid/guids that are missing locally. Every other use is an abuse and
generally a security concern.

Specifically, they're NOT some special user/group that can be used to
run programs without giving them any privileges. In fact, the opposite
is true: the more programs you run as nobody/nogroup the more valuable
files and resources become accessible to "nobody" and consequently
exposed to a potentially compromised program.

This removes mentions of nobody/nogroup from documentation and examples.
 2026-04-13 10:23:25 +02:00