From 0c67557015535754c8b545dfe0262b077624421e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E0=B9=82=E0=B8=97=E0=B8=AA=E0=B8=BA=E0=B8=95=E0=B8=B1?=
 =?UTF-8?q?=E0=B8=A5?= <toastal@posteo.net>
Date: Thu, 27 Mar 2025 22:54:59 +0700
Subject: [PATCH] =?UTF-8?q?nixos/h2o:=20disable=20OCSP=20stapling=20w/=20L?=
 =?UTF-8?q?et=E2=80=99s=20Encrypt=20(support=20sunset)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It was noted in the TLS recommendations comment, but it actually should
be disabled everywhere if ACME is used as H2O has in enabled by default.

More info: <https://letsencrypt.org/2024/12/05/ending-ocsp/>
---
 .../services/web-servers/h2o/default.nix      | 45 +++++++++++--------
 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/nixos/modules/services/web-servers/h2o/default.nix b/nixos/modules/services/web-servers/h2o/default.nix
index e8441a3a6347..2037ccd4d158 100644
--- a/nixos/modules/services/web-servers/h2o/default.nix
+++ b/nixos/modules/services/web-servers/h2o/default.nix
@@ -165,25 +165,34 @@ let
 
                 hasTLSRecommendations = tlsRecommendations != null && mozTLSRecs != null;
 
-                # NOTE: Let’s Encrypt has sunset OCSP stapling. Mozilla’s
-                # ssl-config-generator is at present still recommending this setting, but
-                # this module will skip setting a stapling value as Let’s Encrypt +
-                # ACME is the most likely use case.
-                #
-                # See: https://github.com/mozilla/ssl-config-generator/issues/323
-                tlsRecAttrs = lib.optionalAttrs hasTLSRecommendations (
-                  let
-                    recs = mozTLSRecs.${tlsRecommendations};
-                  in
-                  {
-                    min-version = builtins.head recs.tls_versions;
-                    cipher-preference = "server";
-                    "cipher-suite-tls1.3" = recs.ciphersuites;
+                # ATTENTION: Let’s Encrypt has sunset OCSP stapling.
+                tlsRecAttrs =
+                  # If using ACME, this module will disable H2O’s default OCSP
+                  # stapling.
+                  #
+                  # See: https://letsencrypt.org/2024/12/05/ending-ocsp/
+                  lib.optionalAttrs (builtins.elem names.cert certNames.all) {
+                    ocsp-update-interval = 0;
                   }
-                  // lib.optionalAttrs (recs.ciphers.openssl != [ ]) {
-                    cipher-suite = lib.concatStringsSep ":" recs.ciphers.openssl;
-                  }
-                );
+                  # Mozilla’s ssl-config-generator is at present still
+                  # recommending this setting as well, but this module will
+                  # skip setting a stapling value as Let’s Encrypt + ACME is
+                  # the most likely use case.
+                  #
+                  # See: https://github.com/mozilla/ssl-config-generator/issues/323
+                  // lib.optionalAttrs hasTLSRecommendations (
+                    let
+                      recs = mozTLSRecs.${tlsRecommendations};
+                    in
+                    {
+                      min-version = builtins.head recs.tls_versions;
+                      cipher-preference = "server";
+                      "cipher-suite-tls1.3" = recs.ciphersuites;
+                    }
+                    // lib.optionalAttrs (recs.ciphers.openssl != [ ]) {
+                      cipher-suite = lib.concatStringsSep ":" recs.ciphers.openssl;
+                    }
+                  );
 
                 headerRecAttrs =
                   lib.optionalAttrs