JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #45810 from vincentbernat/fix/nginx-stapling

Browse Source 
nixos/nginx: ensure TLS OCSP stapling works out of the box with LE
This commit is contained in:
Franz Pletz 2018-08-31 07:18:40 +00:00 committed by GitHub
commit 1cc916b5b2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
nixos/modules/services/web-servers/nginx/default.nix
View File

@ -16,9 +16,11 @@ let
} // (optionalAttrs vhostConfig.enableACME { } // (optionalAttrs vhostConfig.enableACME {
sslCertificate = "${acmeDirectory}/${serverName}/fullchain.pem"; sslCertificate = "${acmeDirectory}/${serverName}/fullchain.pem";
sslCertificateKey = "${acmeDirectory}/${serverName}/key.pem"; sslCertificateKey = "${acmeDirectory}/${serverName}/key.pem";
sslTrustedCertificate = "${acmeDirectory}/${serverName}/full.pem";
}) // (optionalAttrs (vhostConfig.useACMEHost != null) { }) // (optionalAttrs (vhostConfig.useACMEHost != null) {
sslCertificate = "${acmeDirectory}/${vhostConfig.useACMEHost}/fullchain.pem"; sslCertificate = "${acmeDirectory}/${vhostConfig.useACMEHost}/fullchain.pem";
sslCertificateKey = "${acmeDirectory}/${vhostConfig.useACMEHost}/key.pem"; sslCertificateKey = "${acmeDirectory}/${vhostConfig.useACMEHost}/key.pem";
sslTrustedCertificate = "${acmeDirectory}/${vhostConfig.useACMEHost}/full.pem";
}) })
) cfg.virtualHosts; ) cfg.virtualHosts;
enableIPv6 = config.networking.enableIPv6; enableIPv6 = config.networking.enableIPv6;
@ -228,6 +230,9 @@ let
ssl_certificate ${vhost.sslCertificate}; ssl_certificate ${vhost.sslCertificate};
ssl_certificate_key ${vhost.sslCertificateKey}; ssl_certificate_key ${vhost.sslCertificateKey};
''} ''}
${optionalString (hasSSL && vhost.sslTrustedCertificate != null) ''
ssl_trusted_certificate ${vhost.sslTrustedCertificate};
''}
${optionalString (vhost.basicAuthFile != null || vhost.basicAuth != {}) '' ${optionalString (vhost.basicAuthFile != null || vhost.basicAuth != {}) ''
auth_basic secured; auth_basic secured;

7
nixos/modules/services/web-servers/nginx/vhost-options.nix
View File

@ -129,6 +129,13 @@ with lib;
description = "Path to server SSL certificate key."; description = "Path to server SSL certificate key.";
}; };
sslTrustedCertificate = mkOption {
type = types.path;
default = null;
example = "/var/root.cert";
description = "Path to root SSL certificate for stapling and client certificates.";
};
http2 = mkOption { http2 = mkOption {
type = types.bool; type = types.bool;
default = true; default = true;