From 6b7e5a5acac9d6a63dbc97e2fbadcea6545383cf Mon Sep 17 00:00:00 2001
From: Leona Maroni <lm@flyingcircus.io>
Date: Thu, 25 Sep 2025 16:28:46 +0200
Subject: [PATCH] nixos/nginx: remove deprecated vhost option enableSSL

The option services.nginx.virtualHost.<...>.enableSSL is deprecated for
8 years [^1]. It causes confusion for people who guess the option and
think it's the right one.
I think it's time to remove it for good.

^1: https://github.com/NixOS/nixpkgs/commit/a912a6a291eaa5f6a2ad9143c9e276779c357a41
---
 .../services/web-servers/nginx/default.nix       | 16 ++--------------
 .../services/web-servers/nginx/vhost-options.nix |  6 ------
 nixos/tests/matrix/conduit.nix                   |  2 +-
 3 files changed, 3 insertions(+), 21 deletions(-)

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 04495f81c165..3704634512eb 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -324,7 +324,7 @@ let
     mapAttrsToList (
       vhostName: vhost:
       let
-        onlySSL = vhost.onlySSL || vhost.enableSSL;
+        onlySSL = vhost.onlySSL;
         hasSSL = onlySSL || vhost.addSSL || vhost.forceSSL;
 
         # First evaluation of defaultListen based on a set of listen lines.
@@ -1324,18 +1324,6 @@ in
   ];
 
   config = mkIf cfg.enable {
-    warnings =
-      let
-        deprecatedSSL =
-          name: config:
-          optional config.enableSSL ''
-            config.services.nginx.virtualHosts.<name>.enableSSL is deprecated,
-            use config.services.nginx.virtualHosts.<name>.onlySSL instead.
-          '';
-
-      in
-      flatten (mapAttrsToList deprecatedSSL virtualHosts);
-
     assertions =
       let
         hostOrAliasIsNull = l: l.root == null || l.alias == null;
@@ -1352,7 +1340,7 @@ in
             with host;
             count id [
               addSSL
-              (onlySSL || enableSSL)
+              onlySSL
               forceSSL
               rejectSSL
             ] <= 1
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
index 169c443d759a..547a85f5f700 100644
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -170,12 +170,6 @@ with lib;
       '';
     };
 
-    enableSSL = mkOption {
-      type = types.bool;
-      visible = false;
-      default = false;
-    };
-
     forceSSL = mkOption {
       type = types.bool;
       default = false;
diff --git a/nixos/tests/matrix/conduit.nix b/nixos/tests/matrix/conduit.nix
index 874e7672812b..02bf00886ba4 100644
--- a/nixos/tests/matrix/conduit.nix
+++ b/nixos/tests/matrix/conduit.nix
@@ -18,7 +18,7 @@ in
         virtualHosts.${name} = {
           enableACME = false;
           forceSSL = false;
-          enableSSL = false;
+          onlySSL = false;
 
           locations."/_matrix" = {
             proxyPass = "http://[::1]:6167";