gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

quictls: remove; nginx/angie: remove quic flavors; haproxy: migrate to openssl (#464333)

Browse Source
This commit is contained in:
Martin Weinelt
2025-11-25 18:06:46 +00:00
committed by GitHub
parent a91bd2940a 6df31c1a4c
commit 3abdb62fda
11 changed files with 17 additions and 303 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/doc/manual/release-notes/rl-2511.section.md
+2
View File
@@ -290,6 +290,8 @@
- The `mime_types_file` setting is now set to `"${pkgs.mailcap}/etc/mime.types"` to prevent errors.
For a complete list of changes, please see [their announcement](https://blog.prosody.im/prosody-13.0.0-released/).
- HTTP3 support has been enabled in in `nginx`, `openresty`, `angie` and `tengine`. The `nginxQuic` and `angieQuic` package flavors have been removed.
- The `yeahwm` package and `services.xserver.windowManager.yeahwm` module were removed due to the package being broken and unmaintained upstream.
- `services.nixseparatedebuginfod.enable = true;` has been replaced by `services.nixseparatedebuginfod2.enable = true`. If you only use the official binary cache `https://cache.nixos.org` then no further configuration should be needed. If you have other https substituters, you can add them to `services.nixseparatedebuginfod2.subsituters`. SSH substituters are not supported by nixseparatedebuginfod2. Consider running nixseparatedebuginfod2 on the substituter instead, and pointing to it with the new option `environment.debuginfodServers`.
nixos/modules/services/web-servers/nginx/default.nix
+3 -28
View File
@@ -205,9 +205,9 @@ let
${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"}
${optionalString cfg.recommendedTlsSettings ''
# Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate
# Consider https://ssl-config.mozilla.org/#server=nginx&config=intermediate as the lower bound
ssl_ecdh_curve X25519:prime256v1:secp384r1;
ssl_conf_command Groups "X25519MLKEM768:X25519:P-256:P-384";
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
# Breaks forward secrecy: https://github.com/mozilla/server-side-tls/issues/135
@@ -573,10 +573,7 @@ let
mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib;
oldHTTP2 = (
versionOlder cfg.package.version "1.25.1"
&& !(cfg.package.pname == "angie" || cfg.package.pname == "angieQuic")
);
oldHTTP2 = (versionOlder cfg.package.version "1.25.1" && !(cfg.package.pname == "angie"));
in
{
@@ -778,7 +775,6 @@ in
that the nginx team recommends to use the mainline version which
available in nixpkgs as `nginxMainline`.
Supported Nginx forks include `angie`, `openresty` and `tengine`.
For HTTP/3 support use `nginxQuic` or `angieQuic`.
'';
};
@@ -1374,27 +1370,6 @@ in
'';
}
{
assertion =
cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic" -> !(cfg.enableQuicBPF);
message = ''
services.nginx.enableQuicBPF requires using nginxQuic package,
which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;` or
`services.nginx.package = pkgs.angieQuic;`.
'';
}
{
assertion =
cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic"
-> all (host: !host.quic) (attrValues virtualHosts);
message = ''
services.nginx.service.virtualHosts.<name>.quic requires using nginxQuic or angie packages,
which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;` or
`services.nginx.package = pkgs.angieQuic;`.
'';
}
{
# The idea is to understand whether there is a virtual host with a listen configuration
# that requires ACME configuration but has no HTTP listener which will make deterministically fail
nixos/tests/nginx-http3.nix
+2 -3
View File
@@ -90,7 +90,6 @@ builtins.listToAttrs (
server.wait_for_unit("nginx")
server.wait_for_open_port(443)
client.wait_for_unit("network-online.target")
# Check http connections
client.succeed("curl --verbose --http3-only https://acme.test | grep 'Hello World!'")
@@ -114,7 +113,7 @@ builtins.listToAttrs (
};
})
[
pkgs.angieQuic
pkgs.nginxQuic
pkgs.angie
pkgs.nginx
]
)
nixos/tests/nginx-variants.nix
-2
View File
@@ -25,10 +25,8 @@ builtins.listToAttrs (
})
[
"angie"
"angieQuic"
"nginxStable"
"nginxMainline"
"nginxQuic"
"nginxShibboleth"
"openresty"
"tengine"
pkgs/by-name/ha/haproxy/package.nix
+1 -5
View File
@@ -2,18 +2,16 @@
useLua ? true,
usePcre ? true,
withPrometheusExporter ? true,
sslLibrary ? "quictls",
sslLibrary ? "openssl",
stdenv,
lib,
fetchurl,
fetchpatch,
nixosTests,
zlib,
libxcrypt,
aws-lc,
libressl,
openssl,
quictls,
wolfssl,
lua5_4,
pcre2,
@@ -23,7 +21,6 @@ assert lib.assertOneOf "sslLibrary" sslLibrary [
"aws-lc"
"libressl"
"openssl"
"quictls"
"wolfssl"
];
let
@@ -32,7 +29,6 @@ let
aws-lc
libressl
openssl
quictls
;
wolfssl = wolfssl.override {
variant = "haproxy";
pkgs/development/libraries/quictls/default.nix
-208
View File
@@ -1,208 +0,0 @@
{
buildPackages,
cryptodev,
enableSSL2 ? false,
enableSSL3 ? false,
fetchFromGitHub,
lib,
makeWrapper,
perl,
removeReferencesTo,
static ? stdenv.hostPlatform.isStatic,
stdenv,
withCryptodev ? false,
}:
stdenv.mkDerivation rec {
pname = "quictls";
version = "3.3.0-quic1";
src = fetchFromGitHub {
owner = "quictls";
repo = "openssl";
rev = "openssl-${version}";
hash = "sha256-kBPwldTJbJSuvBVylJNcLSJvF/Hbqh0mfT4Ub5Xc6dk=";
};
patches = [
../openssl/3.0/nix-ssl-cert-file.patch
# openssl will only compile in KTLS if the current kernel supports it.
# This patch disables build-time detection.
../openssl/3.0/openssl-disable-kernel-detection.patch
(
if stdenv.hostPlatform.isDarwin then
../openssl/3.5/use-etc-ssl-certs-darwin.patch
else
../openssl/3.5/use-etc-ssl-certs.patch
)
];
postPatch = ''
patchShebangs Configure
''
# config is a configure script which is not installed.
+ ''
substituteInPlace config --replace '/usr/bin/env' '${buildPackages.coreutils}/bin/env'
''
+ lib.optionalString stdenv.hostPlatform.isMusl ''
substituteInPlace crypto/async/arch/async_posix.h \
--replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \
'!defined(__ANDROID__) && !defined(__OpenBSD__) && 0'
'';
nativeBuildInputs = [
makeWrapper
perl
removeReferencesTo
];
buildInputs = lib.optionals withCryptodev [
cryptodev
];
outputs = [
"bin"
"dev"
"out"
"man"
"doc"
];
setOutputFlags = false;
separateDebugInfo =
!stdenv.hostPlatform.isDarwin && !(stdenv.hostPlatform.useLLVM or false) && stdenv.cc.isGNU;
# TODO(@Ericson2314): Improve with mass rebuild
configurePlatforms = [ ];
configureScript =
{
armv5tel-linux = "./Configure linux-armv4 -march=armv5te";
armv6l-linux = "./Configure linux-armv4 -march=armv6";
armv7l-linux = "./Configure linux-armv4 -march=armv7-a";
x86_64-darwin = "./Configure darwin64-x86_64-cc";
aarch64-darwin = "./Configure darwin64-arm64-cc";
x86_64-linux = "./Configure linux-x86_64";
x86_64-solaris = "./Configure solaris64-x86_64-gcc";
riscv64-linux = "./Configure linux64-riscv64";
mips64el-linux =
if stdenv.hostPlatform.isMips64n64 then
"./Configure linux64-mips64"
else if stdenv.hostPlatform.isMips64n32 then
"./Configure linux-mips64"
else
throw "unsupported ABI for ${stdenv.hostPlatform.system}";
}
.${stdenv.hostPlatform.system} or (
if stdenv.hostPlatform == stdenv.buildPlatform then
"./config"
else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_64 then
"./Configure BSD-x86_64"
else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_32 then
"./Configure BSD-x86" + lib.optionalString stdenv.hostPlatform.isElf "-elf"
else if stdenv.hostPlatform.isBSD then
"./Configure BSD-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
else if stdenv.hostPlatform.isMinGW then
"./Configure mingw${
lib.optionalString (stdenv.hostPlatform.parsed.cpu.bits != 32) (
toString stdenv.hostPlatform.parsed.cpu.bits
)
}"
else if stdenv.hostPlatform.isLinux then
"./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
else if stdenv.hostPlatform.isiOS then
"./Configure ios${toString stdenv.hostPlatform.parsed.cpu.bits}-cross"
else
throw "Not sure what configuration to use for ${stdenv.hostPlatform.config}"
);
# OpenSSL doesn't like the `--enable-static` / `--disable-shared` flags.
dontAddStaticConfigureFlags = true;
configureFlags = [
"shared" # "shared" builds both shared and static libraries
"--libdir=lib"
"--openssldir=etc/ssl"
]
++ lib.optionals withCryptodev [
"-DHAVE_CRYPTODEV"
"-DUSE_CRYPTODEV_DIGESTS"
]
++ lib.optional enableSSL2 "enable-ssl2"
++ lib.optional enableSSL3 "enable-ssl3"
# We select KTLS here instead of the configure-time detection (which we patch out).
# KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it.
++ lib.optional (stdenv.hostPlatform.isLinux && lib.versionAtLeast version "3.0.0") "enable-ktls"
++ lib.optional stdenv.hostPlatform.isAarch64 "no-afalgeng"
# OpenSSL needs a specific `no-shared` configure flag.
# See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options
# for a comprehensive list of configuration options.
++ lib.optional static "no-shared"
# This introduces a reference to the CTLOG_FILE which is undesired when
# trying to build binaries statically.
++ lib.optional static "no-ct";
makeFlags = [
"MANDIR=$(man)/share/man"
# This avoids conflicts between man pages of openssl subcommands (for
# example 'ts' and 'err') man pages and their equivalent top-level
# command in other packages (respectively man-pages and moreutils).
# This is done in ubuntu and archlinux, and possibly many other distros.
"MANSUFFIX=ssl"
];
enableParallelBuilding = true;
postInstall =
(
if static then
''
# OPENSSLDIR has a reference to self
${removeReferencesTo}/bin/remove-references-to -t $out $out/lib/*.a
''
else
''
# If we're building dynamic libraries, then don't install static
# libraries.
if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then
rm "$out/lib/"*.a
fi
''
)
+ ''
mkdir -p $bin
mv $out/bin $bin/bin
# c_rehash is a legacy perl script with the same functionality
# as `openssl rehash`
# this wrapper script is created to maintain backwards compatibility without
# depending on perl
makeWrapper $bin/bin/openssl $bin/bin/c_rehash \
--add-flags "rehash"
mkdir $dev
mv $out/include $dev/
# remove dependency on Perl at runtime
rm -r $out/etc/ssl/misc
rmdir $out/etc/ssl/{certs,private}
'';
postFixup = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
# Check to make sure the main output doesn't depend on perl
if grep -r '${buildPackages.perl}' $out; then
echo "Found an erroneous dependency on perl ^^^" >&2
exit 1
fi
'';
meta = {
changelog = "https://github.com/quictls/openssl/blob/openssl-${version}/CHANGES.md";
description = "TLS/SSL and crypto library with QUIC APIs";
homepage = "https://quictls.github.io";
license = lib.licenses.openssl;
maintainers = with lib.maintainers; [ izorkin ];
platforms = lib.platforms.all;
};
}
pkgs/servers/http/angie/default.nix
+6 -11
View File
@@ -4,27 +4,22 @@
fetchurl,
nixosTests,
withAcme ? false,
withQuic ? false,
...
}@args:
callPackage ../nginx/generic.nix args rec {
version = "1.10.2";
pname = if withQuic then "angieQuic" else "angie";
pname = "angie";
src = fetchurl {
url = "https://download.angie.software/files/angie-${version}.tar.gz";
hash = "sha256-pcKrk33ySoDnhq9WOJIvRuqKc9FhQYPIyQKYrocwlLg=";
};
configureFlags =
lib.optionals withAcme [
"--with-http_acme_module"
"--http-acme-client-path=/var/lib/nginx/acme"
]
++ lib.optionals withQuic [
"--with-http_v3_module"
];
configureFlags = lib.optionals withAcme [
"--with-http_acme_module"
"--http-acme-client-path=/var/lib/nginx/acme"
];
preInstall = ''
if [[ -e man/angie.8 ]]; then
@@ -39,7 +34,7 @@ callPackage ../nginx/generic.nix args rec {
passthru.tests = {
angie = nixosTests.nginx-variants.angie;
angie-api = nixosTests.angie-api;
angie-http3 = nixosTests.nginx-http3.angieQuic;
angie-http3 = nixosTests.nginx-http3.angie;
};
meta = {
pkgs/servers/http/nginx/generic.nix
+1
View File
@@ -117,6 +117,7 @@ stdenv.mkDerivation {
"--sbin-path=bin/nginx"
"--with-http_ssl_module"
"--with-http_v2_module"
"--with-http_v3_module"
"--with-http_realip_module"
"--with-http_addition_module"
"--with-http_xslt_module"
pkgs/servers/http/nginx/quic.nix
-15
View File
@@ -1,15 +0,0 @@
{
callPackage,
nginxMainline,
...
}@args:
callPackage ./generic.nix args {
pname = "nginxQuic";
inherit (nginxMainline) src version;
configureFlags = [
"--with-http_v3_module"
];
}
pkgs/top-level/aliases.nix
+2
View File
@@ -1130,6 +1130,7 @@ mapAliases {
"; # Added 2025-09-25
nextcloud30Packages = throw "Nextcloud 30 is EOL!"; # Added 2025-09-25
nfstrace = throw "nfstrace has been removed, as it was broken"; # Added 2025-08-25
nginxQuic = throw "'nginxQuic' has been removed. QUIC support is now available in the default nginx builds.";
ngrid = throw "'ngrid' has been removed as it has been unmaintained upstream and broken"; # Added 2025-11-15
nix-direnv-flakes = throw "'nix-direnv-flakes' has been renamed to/replaced by 'nix-direnv'"; # Converted to throw 2025-10-27
nix-ld-rs = throw "'nix-ld-rs' has been renamed to/replaced by 'nix-ld'"; # Converted to throw 2025-10-27
@@ -1349,6 +1350,7 @@ mapAliases {
quaternion-qt5 = throw "'quaternion-qt5' has been removed as quaternion dropped Qt5 support with v0.0.97.1"; # Added 2025-05-24
qubes-core-vchan-xen = throw "'qubes-core-vchan-xen' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-11
quicksynergy = throw "'quicksynergy' has been removed due to lack of maintenance upstream. Consider using 'deskflow' instead."; # Added 2025-06-18
quictls = throw "'quictls' has been removed. QUIC support is now available in `openssl`.";
quorum = throw "'quorum' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-07
qv2ray = throw "'qv2ray' has been removed as it was unmaintained"; # Added 2025-06-03
ra-multiplex = lib.warnOnInstantiate "'ra-multiplex' has been renamed to/replaced by 'lspmux'" lspmux; # Added 2025-10-27
pkgs/top-level/all-packages.nix
-31
View File
@@ -1477,21 +1477,6 @@ with pkgs;
];
};
angieQuic = callPackage ../servers/http/angie {
zlib-ng = zlib-ng.override { withZlibCompat = true; };
withPerl = false;
withQuic = true;
# We don't use `with` statement here on purpose!
# See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334
modules = [
nginxModules.rtmp
nginxModules.dav
nginxModules.moreheaders
];
# Use latest quictls to allow http3 support
openssl = quictls;
};
angie-console-light = callPackage ../servers/http/angie/console-light.nix { };
apk-tools = callPackage ../tools/package-management/apk-tools {
@@ -3790,8 +3775,6 @@ with pkgs;
qtspim = libsForQt5.callPackage ../development/tools/misc/qtspim { };
quictls = callPackage ../development/libraries/quictls { };
quota = if stdenv.hostPlatform.isLinux then linuxquota else unixtools.quota;
radeon-profile = libsForQt5.callPackage ../tools/misc/radeon-profile { };
@@ -9326,20 +9309,6 @@ with pkgs;
nginx = nginxStable;
nginxQuic = callPackage ../servers/http/nginx/quic.nix {
zlib-ng = zlib-ng.override { withZlibCompat = true; };
withPerl = false;
# We don't use `with` statement here on purpose!
# See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334
modules = [
nginxModules.rtmp
nginxModules.dav
nginxModules.moreheaders
];
# Use latest boringssl to allow http3 support
openssl = quictls;
};
nginxStable = callPackage ../servers/http/nginx/stable.nix {
zlib-ng = zlib-ng.override { withZlibCompat = true; };
withPerl = false;