The config script of multiple nginx modules must be able to write into
its source tree, so let's accumulate this logic once in nginx instead of
in multiple modules.
I have effectively renounced on maintaining all these packages and I do
not plan to return them except if I'm forced to.
I am also fine with most of these packages being dropped for next
releases if no maintainer shows up.
Change-Id: I8d167c8029b6991181bd7a094af21c3313af2b51
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
> The ngx_http_v3_module module (1.25.0) provides experimental support
> for HTTP/3.
Yes, still experimental, at least in nginx. No mention in angie.
> 0-RTT support requires the OpenSSL library version 3.5.1 or higher.
> Alternatively, BoringSSL, LibreSSL, or QuicTLS libraries can be used to
> build and run this module.
But OpenSSL gets the first mention and our OpenSSL version right now is
3.6.0.
That means we don't need two more packages to ship nginx built with
QuicTLS which does not yet support PQ crypto right.
Fixes corrupted date and a corrupte HTTP header field `/nn1R7cu0=3l`
```
date: 52anAoe1x3Wt3H4l1u0sc3.632 GMT
curl: (92) Invalid HTTP header field was received: frame type: 1, stream: 1, name: [/nn1R7cu0=3l], value: [bytes]
```
The patch is 4+ years old yet no one has had this problem?
Fixes https://www.github.com/NixOS/nixpkgs/issues/437626
Split tests up based on certain use cases:
- http01-builtin: Tests most functionality of the core module, such
as the systemd and hashing components, whilst utilising lego's built
in http01 resolution mechanis.
- dns01: Tests only that DNS01 renewal works as expected.
- nginx: Tests nginx compatability
- httpd: Tests httpd compatability
- caddy: Tests caddy compatability
nginx uses uname to find the target platform by default.
This works fine when building locally or when building on the same OS
for most architectures, but breaks when building e.g. Linux to BSD.
Explicitly tell the target to the configure script instead.
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.
Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.
A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.
This commit was automatically created and can be verified using
nix-build a08b3a4d19.tar.gz \
--argstr baseRev b32a094368
result/bin/apply-formatting $NIXPKGS_PATH
When adding modules to openresty, by either
- using `.override { modules = [ ..]; }` directly
- adding them to `services.nginx.additionalModules` or
- enabling e.g. something like `services.nginx.recommendedZstdSettings`
the build will then fail, as the actual `nginx` binary lands in
`nginx/bin/nginx` for openresty, and is only symlinked to `bin/nginx`
(and `bin/openresty`, for that matter).
This breaks the post-install script for nginx when removing references
to the aforementioned modules, since `remove-references-to` skips
symlinks. Thus, just read the symlink before in this case.
`readlink -fn` will read the symlink if it is one, otherwise just
returns the path itself.
The phase is also moved after the package-specific postInstall phase, at
that might move binaries around or create symlinks - as is the case for
openresty.
Can be easily reproduced using e.g.:
$ nix build --impure -E 'with import ./. {}; openresty.override { modules = [ nginxModules.zstd ]; }' -L
Signed-off-by: Christoph Heiss <christoph@c8h4.io>
In preparation for the deprecation of `stdenv.isX`.
These shorthands are not conducive to cross-compilation because they
hide the platforms.
Darwin might get cross-compilation for which the continued usage of `stdenv.isDarwin` will get in the way
One example of why this is bad and especially affects compiler packages
https://www.github.com/NixOS/nixpkgs/pull/343059
There are too many files to go through manually but a treewide should
get users thinking when they see a `hostPlatform.isX` in a place where it
doesn't make sense.
```
fd --type f "\.nix" | xargs sd --fixed-strings "stdenv.is" "stdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "stdenv'.is" "stdenv'.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "clangStdenv.is" "clangStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "gccStdenv.is" "gccStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "stdenvNoCC.is" "stdenvNoCC.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "inherit (stdenv) is" "inherit (stdenv.hostPlatform) is"
fd --type f "\.nix" | xargs sd --fixed-strings "buildStdenv.is" "buildStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "effectiveStdenv.is" "effectiveStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "originalStdenv.is" "originalStdenv.hostPlatform.is"
```
Reduces nginx package size from 109.88 MiB to 41.99 MiB. Reduction of -67.88 MiB.
GD (libgd.github.io) is a library for the dynamic creation of images.
Co-authored-by: @ulrikstrid
The nixpkgs-unstable channel's programs.sqlite was used to identify
packages producing exactly one binary, and these automatically added
to their package definitions wherever possible.
Per RFC 9110, [section 8.8.1][1], different representations of the same
resource should have different Etags:
> A strong validator is unique across all versions of all
> representations associated with a particular resource over time.
> However, there is no implication of uniqueness across representations
> of different resources (i.e., the same strong validator might be in
> use for representations of multiple resources at the same time and
> does not imply that those representations are equivalent)
When serving statically compressed files (ie, when there is an existing
corresponding .gz/.br/etc. file on disk), Nginx sends the Etag marked
as strong. These tags should be different for each compressed format
(as shown in an explicit example in section [8.8.3.3][2] of the RFC).
Upstream Etags are composed of the file modification timestamp and
content length, and the latter generally changes between these
representations.
Previous implementation of Nix-specific Etags for things served from
store used the store hash. This is fine to share between different
files, but it becomes a problem for statically compressed versions of
the same file, as it means Nginx was serving different representations
of the same resource with the same Etag, marked as strong.
This patch addresses this by imitating the upstream Nginx behavior, and
appending the value of content length to the store hash.
[1]: https://www.rfc-editor.org/rfc/rfc9110.html#name-validator-fields
[2]:
https://www.rfc-editor.org/rfc/rfc9110.html#name-example-entity-tags-varying
nginx lua needs resty
the enableSandbox option of nginx was removed in 535896671b
the test fails with
```
vm-test-run-nginx-sandbox> machine # [ 47.753580] nginx[1142]: nginx: [alert] detected a LuaJIT version which is not OpenResty's; many optimizations will be disabled and performance will be compromised (see https://github.com/openresty/luajit2 for OpenResty's LuaJIT or, even better, consider using the OpenResty releases from https://openresty.org/en/download.html)
vm-test-run-nginx-sandbox> machine # [ 47.756064] nginx[1142]: nginx: [alert] failed to load the 'resty.core' module (https://github.com/openresty/lua-resty-core); ensure you are using an OpenResty release from https://openresty.org/en/download.html (reason: module 'resty.core' not found:
vm-test-run-nginx-sandbox> machine # [ 57.911766] systemd[1]: Failed to start Nginx Web Server.
```
