Commit Graph

997 Commits

Author SHA1 Message Date
Jörg Thalheim
ba37bf5f3d
Merge pull request #307076 from flokli/caddy-reload
nixos/caddy: don't set ExecReload if enableReload is disabled
2024-05-13 10:45:28 +02:00
Pol Dellaiera
378c5c67ed
Merge pull request #310348 from ehmry/nginx-validateConfigFile
nixos/nginx: add validateConfigFile option
2024-05-12 21:58:59 +02:00
Florian Klink
0244a8d5d7 nixos/caddy: don't set ExecReload if enableReload is disabled
Otherwise, setting services.caddy.enableReload to false fails in a very bad fashion:

The reload command still gets executed, but fails:

```
Apr 26 21:23:01 n1-rk1 systemd[1]: Reloading Caddy...
Apr 26 21:23:01 n1-rk1 caddy[70793]: {"level":"info","ts":1714166581.733018,"msg":"using provided configuration","config_file":"/etc/caddy/caddy_config","config_adapter":"caddyfile"}
Apr 26 21:23:01 n1-rk1 caddy[70793]: {"level":"warn","ts":1714166581.7353032,"msg":"Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies","adapter":"caddyfile","file":"/etc/caddy/caddy_config","line":3}
Apr 26 21:23:01 n1-rk1 caddy[70793]: Error: sending configuration to instance: performing request: Post "http://localhost:2019/load": dial tcp [::1]:2019: connect: connection refused
Apr 26 21:23:01 n1-rk1 systemd[1]: caddy.service: Control process exited, code=exited, status=1/FAILURE
Apr 26 21:23:01 n1-rk1 systemd[1]: Reload failed for Caddy.
```

… and the server is not restarted either, as a ExecReload= command is
specified.

Fix this, by only setting ExecReload if the reload exists.

The first empty string is still necessary to reset the old option.
2024-05-12 18:27:02 +03:00
Franz Pletz
b7d060d10d
nixos/nginx: fix reference to acme cert hostname
The change introduced in #308303 refers to the virtualHosts attrset
key which can be any string. The servername is the actual primary
hostname used for the certificate.

This fixes use cases like:

    services.nginx.virualHosts.foobar.serverName = "my.fqdn.org";
2024-05-10 01:36:34 +02:00
Emery Hemingway
60c75135f8 nixos/nginx: add validateConfigFile option
Add an option to disable configuration file processing and
validation.
2024-05-09 16:48:26 +02:00
Niklas Hambüchen
9d7a729277 treewide: ReadWriteDirectories -> ReadWritePaths.
These were renamed in systemd v231:
2a624c36e6
2024-05-07 01:06:02 +02:00
Niklas Hambüchen
7b6b627a66 nixos/caddy: Comment why ExecStart is reset 2024-05-06 03:18:29 +02:00
Lynn
a586e82ef6 nixos/nginx: don't add .well-known locations for acme when using DNS-01 challenge 2024-05-01 16:48:07 +02:00
Sandro Jäckel
8db512dae8 nixos/nginx: update ciphers list 2024-04-22 23:08:14 +10:00
Sandro
f417891699
Merge pull request #293954 from Dan-Theriault/refactor-tailscale-auth 2024-04-18 15:14:01 +02:00
Dan Theriault
3cf6c4ddb3 nixos/tailscale-auth: init module
This additional module allows the tailscale auth proxy to be configured
independently of nginx. The tailscale auth proxy works with both caddy
and traefik. All prior nginx/tailscale-auth options are retained as
aliases.
2024-04-16 19:06:08 -04:00
Kerstin Humm
d6e8934f38
nixos/nginx: allow for resolving IPv6 addresses only 2024-04-16 23:44:11 +02:00
stuebinm
6afb255d97 nixos: remove all uses of lib.mdDoc
these changes were generated with nixq 0.0.2, by running

  nixq ">> lib.mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> Inherit >> mdDoc[remove]" --batchmode nixos/**.nix

two mentions of the mdDoc function remain in nixos/, both of which
are inside of comments.

Since lib.mdDoc is already defined as just id, this commit is a no-op as
far as Nix (and the built manual) is concerned.
2024-04-13 10:07:35 -07:00
Janne Heß
bc77c7a973 treewide: Mark Nix blocks in markdown as Nix
This should help us with highlighting and future formatting.
2024-03-28 09:28:12 +01:00
Lily Foster
e3c0bb4255
Merge pull request #294542 from Janik-Haag/garage
nixos/garage: add env-var wrapper for admin cli
2024-03-18 16:10:15 -07:00
Janik H.
9ec0e31f79
nixos/garage: add env-var wrapper for admin cli 2024-03-18 22:53:21 +01:00
Pol Dellaiera
2bd0c18d98
Merge pull request #282160 from gaykitty/stargazer-debug-mode
nixos/stargazer: add missing debugMode setting
2024-03-10 14:31:06 +01:00
gaykitty
366147b86d nixos/stargazer: add missing debugMode setting 2024-03-09 11:04:27 -05:00
adisbladis
3209343527 nixos/zope2: Remove module
`zope2` is unmaintained and the module is relying on Python2.
2024-02-18 17:48:24 +13:00
emilylange
993083f0ab
nixos/garage: allow all available log levels in cfg.logLevel
`error` and `warn` have always been valid log levels.
But because the upstream docs never mentioned those, we simply didn't
add them to the enum of our module option.

The upstream docs have been updated and now mention `error` and `warn`
as well.

Upstream PR: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/716
2024-02-13 20:26:29 +01:00
Peder Bergebakken Sundt
bf7c95ce73
Merge pull request #285314 from pbsds/ttyd-1706718068
nixos/ttyd: add `entrypoint` and `writable` option
2024-02-13 19:41:11 +01:00
Peder Bergebakken Sundt
a8880f1647 nixos/ttyd: add entrypoint option 2024-02-05 17:38:00 +01:00
Robert Schütz
1dd5f2b1f9 nixos/nginx: turn auth_request off for ACME challenge
This is e.g. necessary when using tailscale-nginx-auth.
2024-02-05 00:33:33 -08:00
Peder Bergebakken Sundt
0d13d2a90f nixos/ttyd: remove with lib; 2024-01-31 17:58:59 +01:00
Peder Bergebakken Sundt
4c70703931 nixos/ttyd: add writable option
Co-authored-by: Carsten Rodin <19612711+carstoid@users.noreply.github.com>
2024-01-31 17:57:42 +01:00
Felix Buehler
d35003e302 python311Packages.recursive-pth-loader: rename from recursivePthLoader 2024-01-25 22:13:17 +01:00
Nick Cao
9969fb7ff4
Merge pull request #281904 from Stunkymonkey/ttyd-fix-leakage
ttyd: add test & use systemd LoadCredential
2024-01-21 14:48:40 -05:00
Felix Buehler
c34493d7c0 ttyd: add test & use systemd LoadCredential 2024-01-20 21:01:51 +01:00
Jade Lovelace
6c5ab28fce nixos: fix a bunch of services missing dep on network-online.target
This was done by generating a truly hilarious configuration:

rg 'services\.[^.]+\.enable\t' opts-tags | cut -f1 > allonconfig.nix

The following were not tested due to other evaluation errors. They
should probably be manually audited.
services.amule
services.castopod
services.ceph
services.chatgpt-retrieval-plugin
services.clamsmtp
services.clight
services.dante
services.dex
services.discourse
services.dwm-status
services.engelsystem
services.foundationdb
services.frigate
services.frp
services.grocy
services.guacamole-client
services.hedgedoc
services.home-assistant
services.honk
services.imaginary
services.jitsi-meet
services.kerberos_server
services.limesurvey
services.mastodon
services.mediawiki
services.mobilizon
services.moodle
services.mosquitto
services.nextcloud
services.nullmailer
services.patroni
services.pfix-srsd
services.pgpkeyserver-lite
services.postfixadmin
services.roundcube
services.schleuder
services.self-deploy
services.slskd
services.spacecookie
services.statsd
services.step-ca
services.sympa
services.tsmBackup
services.vdirsyncer
services.vikunja
services.yandex-disk
services.zabbixWeb
2024-01-19 00:11:34 -08:00
Ryan Lahfa
6d8630efda
Merge pull request #270270 from SuperSandro2000/nginx-fastopen
nixos/nginx: filter more options when listening has quic
2024-01-12 20:01:29 +01:00
Ryan Lahfa
3287441158
Merge pull request #275484 from Izorkin/update-nginx-http3
nixos/nginx: disable automatic advertise of HTTP/3 protocol support
2024-01-12 19:49:18 +01:00
Peder Bergebakken Sundt
f489e99576
Merge pull request #277925 from Izorkin/update-nginx-http2
nixos/nginx: use new variant of http2 option for angie package
2024-01-12 01:40:18 +01:00
Izorkin
10c06cb060
nginx: enable ktls support by default 2024-01-01 12:02:57 +03:00
Izorkin
2fb0b52c50
nixos/nginx: disable automatic advertise of HTTP/3 protocol support
Automatic advertise in the `http` block about support of HTTP/3
protocol makes it difficult to automatically configure services
to work with it.
HTTP/3 availability must be manually advertised, preferably in
each location block.
2024-01-01 02:29:01 +03:00
Izorkin
d11fe979a2
nixos/nginx: use new variant of http2 option for angie package 2023-12-31 16:52:08 +03:00
Izorkin
ae5c0c1521
nixos/nginx: skip adding a comment to acmeLocation in nginx configuration 2023-12-30 23:50:02 +03:00
Izorkin
7f1b6d45af
nixos/nginx: change position acmeLocation in nginx configuration 2023-12-30 23:49:58 +03:00
Sandro Jäckel
157256f9dd
nixos/nginx: filter more options when listening has quic 2023-12-23 02:20:48 +01:00
Izorkin
86efccfa45
angie: init at 1.4.0 2023-12-17 22:43:13 +03:00
networkException
968905ab76
nixos/caddy: also increase socket send buffer size as recommended by upstream
this patch adjusts the `boot.kernel.sysctl."net.core.wmem_max"` to match the
value suggested in the quic-go wiki, just as `"net.core.wmem_max"`.

see fdfdc5df21
see https://github.com/quic-go/quic-go/issues/3923
2023-12-15 04:43:57 +01:00
Ryan Lahfa
3bb93fb2cd
Merge pull request #271506 from Misterio77/nginx-redirect-status-code 2023-12-12 14:05:33 +01:00
Gabriel Fontes
a3c60d2ddc
nixos/nginx: make redirect status code configurable
Add an option to configure which code globalRedirect and forceSSL use.
It previously was always 301 with no easy way to override.
2023-12-11 11:09:02 -03:00
Sandro Jäckel
78541e68eb
nixos/nginx: allow return to be an int 2023-12-08 15:04:27 +01:00
Florian Klink
4db2e0cc80
Merge pull request #272542 from Sohalt/caddy-config-file
nixos/caddy: use caddyfile adapter by default with explicit configFile
2023-12-07 09:07:35 +02:00
sohalt
3c6b3d71fa nixos/caddy: Use caddyfile adapter by default when explicitly specifying configFile 2023-12-06 21:57:21 +01:00
phaer
c40f706dc4 nixos/nginx/tailscale-auth: init module 2023-12-06 20:57:38 +01:00
Mario Rodas
15b5295311
Merge pull request #270847 from anthonyroussel/updates/tomcat_10_1_16
tomcat10: 10.1.15 -> 10.1.16
2023-11-30 22:38:23 -05:00
Anthony Roussel
9a5f5ee7d3
nixos/tomcat: add anthonyroussel to maintainers 2023-11-29 07:56:09 +01:00
h7x4
0a37316d6c
treewide: use mkPackageOption
This commit replaces a lot of usages of `mkOption` with the package
type, to be `mkPackageOption`, in order to reduce the amount of code.
2023-11-27 01:28:36 +01:00
Jonathan Davies
a1163912c2 nixos/caddy: Fixed RestartSec typo. 2023-11-24 11:03:32 +00:00