From d1a28bbdb48244f7a3edf027e4c90b6de0bb1bf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Sun, 6 Oct 2024 02:05:32 +0200 Subject: [PATCH 1/2] nixos/nginx: add locations."name".uwsgiPass and related options and use it --- nixos/modules/services/mail/mailman.nix | 2 +- .../services/web-servers/nginx/default.nix | 64 ++++++++++++++++++- .../web-servers/nginx/location-options.nix | 19 ++++++ 3 files changed, 83 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix index 95b77da250b2..fe5383b6622d 100644 --- a/nixos/modules/services/mail/mailman.nix +++ b/nixos/modules/services/mail/mailman.nix @@ -441,7 +441,7 @@ in { enable = lib.mkDefault true; virtualHosts = lib.genAttrs cfg.webHosts (webHost: { locations = { - ${cfg.serve.virtualRoot}.extraConfig = "uwsgi_pass unix:/run/mailman-web.socket;"; + ${cfg.serve.virtualRoot}.uwsgiPass = "unix:/run/mailman-web.socket"; "${lib.removeSuffix "/" cfg.serve.virtualRoot}/static/".alias = webSettings.STATIC_ROOT + "/"; }; }); diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index a7efd69adac3..22ee5a7a04db 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -94,7 +94,7 @@ let REDIRECT_STATUS = "200"; }; - recommendedProxyConfig = pkgs.writeText "nginx-recommended-proxy-headers.conf" '' + recommendedProxyConfig = pkgs.writeText "nginx-recommended-proxy_set_header-headers.conf" '' proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -102,6 +102,14 @@ let proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; ''; + recommendedUwsgiConfig = pkgs.writeText "nginx-recommended-uwsgi_param-headers.conf" '' + uwsgi_param HTTP_HOST $host; + uwsgi_param HTTP_X_REAL_IP $remote_addr; + uwsgi_param HTTP_X_FORWARDED_FOR $proxy_add_x_forwarded_for; + uwsgi_param HTTP_X_FORWARDED_PROTO $scheme; + uwsgi_param HTTP_X_FORWARDED_HOST $host; + uwsgi_param HTTP_X_FORWARDED_SERVER $host; + ''; proxyCachePathConfig = concatStringsSep "\n" (mapAttrsToList (name: proxyCachePath: '' proxy_cache_path ${concatStringsSep " " [ @@ -238,6 +246,15 @@ let include ${recommendedProxyConfig}; ''} + ${optionalString cfg.recommendedUwsgiSettings '' + uwsgi_connect_timeout ${cfg.uwsgiTimeout}; + uwsgi_send_timeout ${cfg.uwsgiTimeout}; + uwsgi_read_timeout ${cfg.uwsgiTimeout}; + uwsgi_param HTTP_CONNECTION ""; + include ${cfg.package}/conf/uwsgi_params; + include ${recommendedUwsgiConfig}; + ''} + ${optionalString (cfg.mapHashBucketSize != null) '' map_hash_bucket_size ${toString cfg.mapHashBucketSize}; ''} @@ -442,6 +459,13 @@ let proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; ''} + ${optionalString (config.uwsgiPass != null && !cfg.uwsgiResolveWhileRunning) + "uwsgi_pass ${config.uwsgiPass};" + } + ${optionalString (config.uwsgiPass != null && cfg.uwsgiResolveWhileRunning) '' + set $nix_proxy_target "${config.uwsgiPass}"; + uwsgi_pass $nix_proxy_target; + ''} ${concatStringsSep "\n" (mapAttrsToList (n: v: ''fastcgi_param ${n} "${v}";'') (optionalAttrs (config.fastcgiParams != {}) @@ -453,6 +477,7 @@ let ${optionalString (config.return != null) "return ${toString config.return};"} ${config.extraConfig} ${optionalString (config.proxyPass != null && config.recommendedProxySettings) "include ${recommendedProxyConfig};"} + ${optionalString (config.uwsgiPass != null && config.recommendedUwsgiSettings) "include ${cfg.package}/conf/uwsgi_params; include ${recommendedUwsgiConfig};"} ${mkBasicAuth "sublocation" config} } '') (sortProperties (mapAttrsToList (k: v: v // { location = k; }) locations))); @@ -553,6 +578,23 @@ in ''; }; + recommendedUwsgiSettings = mkOption { + default = false; + type = types.bool; + description = '' + Whether to enable recommended uwsgi settings if a vhost does not specify the option manually. + ''; + }; + + uwsgiTimeout = mkOption { + type = types.str; + default = "60s"; + example = "20s"; + description = '' + Change the uwsgi related timeouts in recommendedUwsgiSettings. + ''; + }; + defaultListen = mkOption { type = with types; listOf (submodule { options = { @@ -859,6 +901,16 @@ in ''; }; + uwsgiResolveWhileRunning = mkOption { + type = types.bool; + default = false; + description = '' + Resolves domains of uwsgi targets at runtime + and not only at start, you have to set + services.nginx.resolver, too. + ''; + }; + mapHashBucketSize = mkOption { type = types.nullOr (types.enum [ 32 64 128 ]); default = null; @@ -1163,6 +1215,16 @@ in ''; } + { + assertion = all (host: + all (location: !(location.proxyPass != null && location.uwsgiPass != null)) (attrValues host.locations)) + (attrValues virtualHosts); + message = '' + Options services.nginx.service.virtualHosts..proxyPass and + services.nginx.virtualHosts..uwsgiPass are mutually exclusive. + ''; + } + { assertion = cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic" -> !(cfg.enableQuicBPF); message = '' diff --git a/nixos/modules/services/web-servers/nginx/location-options.nix b/nixos/modules/services/web-servers/nginx/location-options.nix index 8cefd481d3f9..5c399e8d5958 100644 --- a/nixos/modules/services/web-servers/nginx/location-options.nix +++ b/nixos/modules/services/web-servers/nginx/location-options.nix @@ -56,6 +56,16 @@ with lib; ''; }; + uwsgiPass = mkOption { + type = types.nullOr types.str; + default = null; + example = "unix:/run/example/example.sock"; + description = '' + Adds uwsgi_pass directive and sets recommended proxy headers if + recommendedUwsgiSettings is enabled. + ''; + }; + index = mkOption { type = types.nullOr types.str; default = null; @@ -137,5 +147,14 @@ with lib; Enable recommended proxy settings. ''; }; + + recommendedUwsgiSettings = mkOption { + type = types.bool; + default = config.services.nginx.recommendedUwsgiSettings; + defaultText = literalExpression "config.services.nginx.recommendedUwsgiSettings"; + description = '' + Enable recommended uwsgi settings. + ''; + }; }; } From 2ad694fff9ed8ccaaca963dad229bda4f517f579 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 21 Feb 2025 13:48:07 +0100 Subject: [PATCH 2/2] nixos/nginx: remove custom HTTP_ header from recommendedUwsgiSettings `uwsgi_pass` uses the uwsgi protocol instead of the HTTP protocol (that's what `proxy_pass` is for). Also, the source IP is already derived from the REMOTE_ADDR param that's specified by the uwsgi defaults from nginx, similarily to how it's done for fcgi. Hence, removing that since it seems not necessary (and perhaps even wrong). --- nixos/modules/services/web-servers/nginx/default.nix | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 22ee5a7a04db..f42bac4d9487 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -102,14 +102,6 @@ let proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; ''; - recommendedUwsgiConfig = pkgs.writeText "nginx-recommended-uwsgi_param-headers.conf" '' - uwsgi_param HTTP_HOST $host; - uwsgi_param HTTP_X_REAL_IP $remote_addr; - uwsgi_param HTTP_X_FORWARDED_FOR $proxy_add_x_forwarded_for; - uwsgi_param HTTP_X_FORWARDED_PROTO $scheme; - uwsgi_param HTTP_X_FORWARDED_HOST $host; - uwsgi_param HTTP_X_FORWARDED_SERVER $host; - ''; proxyCachePathConfig = concatStringsSep "\n" (mapAttrsToList (name: proxyCachePath: '' proxy_cache_path ${concatStringsSep " " [ @@ -252,7 +244,6 @@ let uwsgi_read_timeout ${cfg.uwsgiTimeout}; uwsgi_param HTTP_CONNECTION ""; include ${cfg.package}/conf/uwsgi_params; - include ${recommendedUwsgiConfig}; ''} ${optionalString (cfg.mapHashBucketSize != null) '' @@ -477,7 +468,7 @@ let ${optionalString (config.return != null) "return ${toString config.return};"} ${config.extraConfig} ${optionalString (config.proxyPass != null && config.recommendedProxySettings) "include ${recommendedProxyConfig};"} - ${optionalString (config.uwsgiPass != null && config.recommendedUwsgiSettings) "include ${cfg.package}/conf/uwsgi_params; include ${recommendedUwsgiConfig};"} + ${optionalString (config.uwsgiPass != null && config.recommendedUwsgiSettings) "include ${cfg.package}/conf/uwsgi_params;"} ${mkBasicAuth "sublocation" config} } '') (sortProperties (mapAttrsToList (k: v: v // { location = k; }) locations)));