From 22f3caf7471fcb3cb7615f8a28c14ac465d7ca42 Mon Sep 17 00:00:00 2001
From: n0099 <n@n0099.net>
Date: Fri, 17 Oct 2025 16:24:07 +0000
Subject: [PATCH] nixos/nginx: allow using `security.dhparams` via `sslDhparam
 = true` Currently `security.dhparams` is only used by `services.dovecot2` :
 https://github.com/NixOS/nixpkgs/blob/98ff3f9af2684f6136c24beef08f5e2033fc5389/nixos/modules/services/mail/dovecot.nix#L627-L630
 Co-authored-by: Sandro <sandro.jaeckel@gmail.com>

---
 .../modules/services/web-servers/nginx/default.nix | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index a29ad656cad9..e07c0a8e9bdf 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -202,7 +202,11 @@ let
 
             ssl_protocols ${cfg.sslProtocols};
             ${optionalString (cfg.sslCiphers != null) "ssl_ciphers ${cfg.sslCiphers};"}
-            ${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"}
+            ${optionalString (cfg.sslDhparam != false)
+              "ssl_dhparam ${
+                if cfg.sslDhparam == true then config.security.dhparams.params.nginx.path else cfg.sslDhparam
+              };"
+            }
 
             ${optionalString cfg.recommendedTlsSettings ''
               # Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate
@@ -982,10 +986,10 @@ in
       };
 
       sslDhparam = mkOption {
-        type = types.nullOr types.path;
-        default = null;
+        type = types.either types.path types.bool;
+        default = false;
         example = "/path/to/dhparams.pem";
-        description = "Path to DH parameters file.";
+        description = "Path to DH parameters file, or `true` to generate with `security.dhparms.params.nginx`.";
       };
 
       proxyResolveWhileRunning = mkOption {
@@ -1652,6 +1656,8 @@ in
       in
       listToAttrs acmePairs;
 
+    security.dhparams.params.nginx = lib.mkIf (cfg.sslDhparam == true) { };
+
     users.users = optionalAttrs (cfg.user == "nginx") {
       nginx = {
         group = cfg.group;