diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index 91cb788a4c53..4b0b58028e7b 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -290,6 +290,8 @@ - The `mime_types_file` setting is now set to `"${pkgs.mailcap}/etc/mime.types"` to prevent errors. For a complete list of changes, please see [their announcement](https://blog.prosody.im/prosody-13.0.0-released/). +- HTTP3 support has been enabled in in `nginx`, `openresty`, `angie` and `tengine`. The `nginxQuic` and `angieQuic` package flavors have been removed. + - The `yeahwm` package and `services.xserver.windowManager.yeahwm` module were removed due to the package being broken and unmaintained upstream. - `services.nixseparatedebuginfod.enable = true;` has been replaced by `services.nixseparatedebuginfod2.enable = true`. If you only use the official binary cache `https://cache.nixos.org` then no further configuration should be needed. If you have other https substituters, you can add them to `services.nixseparatedebuginfod2.subsituters`. SSH substituters are not supported by nixseparatedebuginfod2. Consider running nixseparatedebuginfod2 on the substituter instead, and pointing to it with the new option `environment.debuginfodServers`. diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 54cf523f4df0..e557ee92f7a7 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -205,9 +205,9 @@ let ${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"} ${optionalString cfg.recommendedTlsSettings '' - # Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate + # Consider https://ssl-config.mozilla.org/#server=nginx&config=intermediate as the lower bound - ssl_ecdh_curve X25519:prime256v1:secp384r1; + ssl_conf_command Groups "X25519MLKEM768:X25519:P-256:P-384"; ssl_session_timeout 1d; ssl_session_cache shared:SSL:10m; # Breaks forward secrecy: https://github.com/mozilla/server-side-tls/issues/135 @@ -573,10 +573,7 @@ let mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib; - oldHTTP2 = ( - versionOlder cfg.package.version "1.25.1" - && !(cfg.package.pname == "angie" || cfg.package.pname == "angieQuic") - ); + oldHTTP2 = (versionOlder cfg.package.version "1.25.1" && !(cfg.package.pname == "angie")); in { @@ -778,7 +775,6 @@ in that the nginx team recommends to use the mainline version which available in nixpkgs as `nginxMainline`. Supported Nginx forks include `angie`, `openresty` and `tengine`. - For HTTP/3 support use `nginxQuic` or `angieQuic`. ''; }; @@ -1374,27 +1370,6 @@ in ''; } - { - assertion = - cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic" -> !(cfg.enableQuicBPF); - message = '' - services.nginx.enableQuicBPF requires using nginxQuic package, - which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;` or - `services.nginx.package = pkgs.angieQuic;`. - ''; - } - - { - assertion = - cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic" - -> all (host: !host.quic) (attrValues virtualHosts); - message = '' - services.nginx.service.virtualHosts..quic requires using nginxQuic or angie packages, - which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;` or - `services.nginx.package = pkgs.angieQuic;`. - ''; - } - { # The idea is to understand whether there is a virtual host with a listen configuration # that requires ACME configuration but has no HTTP listener which will make deterministically fail diff --git a/nixos/tests/nginx-http3.nix b/nixos/tests/nginx-http3.nix index cd321d43d2e1..17c3d215f029 100644 --- a/nixos/tests/nginx-http3.nix +++ b/nixos/tests/nginx-http3.nix @@ -90,7 +90,6 @@ builtins.listToAttrs ( server.wait_for_unit("nginx") server.wait_for_open_port(443) - client.wait_for_unit("network-online.target") # Check http connections client.succeed("curl --verbose --http3-only https://acme.test | grep 'Hello World!'") @@ -114,7 +113,7 @@ builtins.listToAttrs ( }; }) [ - pkgs.angieQuic - pkgs.nginxQuic + pkgs.angie + pkgs.nginx ] ) diff --git a/nixos/tests/nginx-variants.nix b/nixos/tests/nginx-variants.nix index 0e845b3414d4..6e43abae920b 100644 --- a/nixos/tests/nginx-variants.nix +++ b/nixos/tests/nginx-variants.nix @@ -25,10 +25,8 @@ builtins.listToAttrs ( }) [ "angie" - "angieQuic" "nginxStable" "nginxMainline" - "nginxQuic" "nginxShibboleth" "openresty" "tengine" diff --git a/pkgs/by-name/ha/haproxy/package.nix b/pkgs/by-name/ha/haproxy/package.nix index 0998f1f775c6..67a6bbe0ffc9 100644 --- a/pkgs/by-name/ha/haproxy/package.nix +++ b/pkgs/by-name/ha/haproxy/package.nix @@ -2,18 +2,16 @@ useLua ? true, usePcre ? true, withPrometheusExporter ? true, - sslLibrary ? "quictls", + sslLibrary ? "openssl", stdenv, lib, fetchurl, - fetchpatch, nixosTests, zlib, libxcrypt, aws-lc, libressl, openssl, - quictls, wolfssl, lua5_4, pcre2, @@ -23,7 +21,6 @@ assert lib.assertOneOf "sslLibrary" sslLibrary [ "aws-lc" "libressl" "openssl" - "quictls" "wolfssl" ]; let @@ -32,7 +29,6 @@ let aws-lc libressl openssl - quictls ; wolfssl = wolfssl.override { variant = "haproxy"; diff --git a/pkgs/development/libraries/quictls/default.nix b/pkgs/development/libraries/quictls/default.nix deleted file mode 100644 index 7ee882f89445..000000000000 --- a/pkgs/development/libraries/quictls/default.nix +++ /dev/null @@ -1,208 +0,0 @@ -{ - buildPackages, - cryptodev, - enableSSL2 ? false, - enableSSL3 ? false, - fetchFromGitHub, - lib, - makeWrapper, - perl, - removeReferencesTo, - static ? stdenv.hostPlatform.isStatic, - stdenv, - withCryptodev ? false, -}: - -stdenv.mkDerivation rec { - pname = "quictls"; - version = "3.3.0-quic1"; - - src = fetchFromGitHub { - owner = "quictls"; - repo = "openssl"; - rev = "openssl-${version}"; - hash = "sha256-kBPwldTJbJSuvBVylJNcLSJvF/Hbqh0mfT4Ub5Xc6dk="; - }; - - patches = [ - ../openssl/3.0/nix-ssl-cert-file.patch - - # openssl will only compile in KTLS if the current kernel supports it. - # This patch disables build-time detection. - ../openssl/3.0/openssl-disable-kernel-detection.patch - - ( - if stdenv.hostPlatform.isDarwin then - ../openssl/3.5/use-etc-ssl-certs-darwin.patch - else - ../openssl/3.5/use-etc-ssl-certs.patch - ) - ]; - - postPatch = '' - patchShebangs Configure - '' - # config is a configure script which is not installed. - + '' - substituteInPlace config --replace '/usr/bin/env' '${buildPackages.coreutils}/bin/env' - '' - + lib.optionalString stdenv.hostPlatform.isMusl '' - substituteInPlace crypto/async/arch/async_posix.h \ - --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \ - '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0' - ''; - - nativeBuildInputs = [ - makeWrapper - perl - removeReferencesTo - ]; - - buildInputs = lib.optionals withCryptodev [ - cryptodev - ]; - - outputs = [ - "bin" - "dev" - "out" - "man" - "doc" - ]; - - setOutputFlags = false; - - separateDebugInfo = - !stdenv.hostPlatform.isDarwin && !(stdenv.hostPlatform.useLLVM or false) && stdenv.cc.isGNU; - - # TODO(@Ericson2314): Improve with mass rebuild - configurePlatforms = [ ]; - configureScript = - { - armv5tel-linux = "./Configure linux-armv4 -march=armv5te"; - armv6l-linux = "./Configure linux-armv4 -march=armv6"; - armv7l-linux = "./Configure linux-armv4 -march=armv7-a"; - x86_64-darwin = "./Configure darwin64-x86_64-cc"; - aarch64-darwin = "./Configure darwin64-arm64-cc"; - x86_64-linux = "./Configure linux-x86_64"; - x86_64-solaris = "./Configure solaris64-x86_64-gcc"; - riscv64-linux = "./Configure linux64-riscv64"; - mips64el-linux = - if stdenv.hostPlatform.isMips64n64 then - "./Configure linux64-mips64" - else if stdenv.hostPlatform.isMips64n32 then - "./Configure linux-mips64" - else - throw "unsupported ABI for ${stdenv.hostPlatform.system}"; - } - .${stdenv.hostPlatform.system} or ( - if stdenv.hostPlatform == stdenv.buildPlatform then - "./config" - else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_64 then - "./Configure BSD-x86_64" - else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_32 then - "./Configure BSD-x86" + lib.optionalString stdenv.hostPlatform.isElf "-elf" - else if stdenv.hostPlatform.isBSD then - "./Configure BSD-generic${toString stdenv.hostPlatform.parsed.cpu.bits}" - else if stdenv.hostPlatform.isMinGW then - "./Configure mingw${ - lib.optionalString (stdenv.hostPlatform.parsed.cpu.bits != 32) ( - toString stdenv.hostPlatform.parsed.cpu.bits - ) - }" - else if stdenv.hostPlatform.isLinux then - "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}" - else if stdenv.hostPlatform.isiOS then - "./Configure ios${toString stdenv.hostPlatform.parsed.cpu.bits}-cross" - else - throw "Not sure what configuration to use for ${stdenv.hostPlatform.config}" - ); - - # OpenSSL doesn't like the `--enable-static` / `--disable-shared` flags. - dontAddStaticConfigureFlags = true; - - configureFlags = [ - "shared" # "shared" builds both shared and static libraries - "--libdir=lib" - "--openssldir=etc/ssl" - ] - ++ lib.optionals withCryptodev [ - "-DHAVE_CRYPTODEV" - "-DUSE_CRYPTODEV_DIGESTS" - ] - ++ lib.optional enableSSL2 "enable-ssl2" - ++ lib.optional enableSSL3 "enable-ssl3" - # We select KTLS here instead of the configure-time detection (which we patch out). - # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it. - ++ lib.optional (stdenv.hostPlatform.isLinux && lib.versionAtLeast version "3.0.0") "enable-ktls" - ++ lib.optional stdenv.hostPlatform.isAarch64 "no-afalgeng" - # OpenSSL needs a specific `no-shared` configure flag. - # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options - # for a comprehensive list of configuration options. - ++ lib.optional static "no-shared" - # This introduces a reference to the CTLOG_FILE which is undesired when - # trying to build binaries statically. - ++ lib.optional static "no-ct"; - - makeFlags = [ - "MANDIR=$(man)/share/man" - # This avoids conflicts between man pages of openssl subcommands (for - # example 'ts' and 'err') man pages and their equivalent top-level - # command in other packages (respectively man-pages and moreutils). - # This is done in ubuntu and archlinux, and possibly many other distros. - "MANSUFFIX=ssl" - ]; - - enableParallelBuilding = true; - - postInstall = - ( - if static then - '' - # OPENSSLDIR has a reference to self - ${removeReferencesTo}/bin/remove-references-to -t $out $out/lib/*.a - '' - else - '' - # If we're building dynamic libraries, then don't install static - # libraries. - if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then - rm "$out/lib/"*.a - fi - '' - ) - + '' - mkdir -p $bin - mv $out/bin $bin/bin - - # c_rehash is a legacy perl script with the same functionality - # as `openssl rehash` - # this wrapper script is created to maintain backwards compatibility without - # depending on perl - makeWrapper $bin/bin/openssl $bin/bin/c_rehash \ - --add-flags "rehash" - - mkdir $dev - mv $out/include $dev/ - # remove dependency on Perl at runtime - rm -r $out/etc/ssl/misc - rmdir $out/etc/ssl/{certs,private} - ''; - - postFixup = lib.optionalString (!stdenv.hostPlatform.isWindows) '' - # Check to make sure the main output doesn't depend on perl - if grep -r '${buildPackages.perl}' $out; then - echo "Found an erroneous dependency on perl ^^^" >&2 - exit 1 - fi - ''; - - meta = { - changelog = "https://github.com/quictls/openssl/blob/openssl-${version}/CHANGES.md"; - description = "TLS/SSL and crypto library with QUIC APIs"; - homepage = "https://quictls.github.io"; - license = lib.licenses.openssl; - maintainers = with lib.maintainers; [ izorkin ]; - platforms = lib.platforms.all; - }; -} diff --git a/pkgs/servers/http/angie/default.nix b/pkgs/servers/http/angie/default.nix index 6c0fb856ecb8..4fab1346b188 100644 --- a/pkgs/servers/http/angie/default.nix +++ b/pkgs/servers/http/angie/default.nix @@ -4,27 +4,22 @@ fetchurl, nixosTests, withAcme ? false, - withQuic ? false, ... }@args: callPackage ../nginx/generic.nix args rec { version = "1.10.2"; - pname = if withQuic then "angieQuic" else "angie"; + pname = "angie"; src = fetchurl { url = "https://download.angie.software/files/angie-${version}.tar.gz"; hash = "sha256-pcKrk33ySoDnhq9WOJIvRuqKc9FhQYPIyQKYrocwlLg="; }; - configureFlags = - lib.optionals withAcme [ - "--with-http_acme_module" - "--http-acme-client-path=/var/lib/nginx/acme" - ] - ++ lib.optionals withQuic [ - "--with-http_v3_module" - ]; + configureFlags = lib.optionals withAcme [ + "--with-http_acme_module" + "--http-acme-client-path=/var/lib/nginx/acme" + ]; preInstall = '' if [[ -e man/angie.8 ]]; then @@ -39,7 +34,7 @@ callPackage ../nginx/generic.nix args rec { passthru.tests = { angie = nixosTests.nginx-variants.angie; angie-api = nixosTests.angie-api; - angie-http3 = nixosTests.nginx-http3.angieQuic; + angie-http3 = nixosTests.nginx-http3.angie; }; meta = { diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix index e3964c40f03d..ca8d9fb15ada 100644 --- a/pkgs/servers/http/nginx/generic.nix +++ b/pkgs/servers/http/nginx/generic.nix @@ -117,6 +117,7 @@ stdenv.mkDerivation { "--sbin-path=bin/nginx" "--with-http_ssl_module" "--with-http_v2_module" + "--with-http_v3_module" "--with-http_realip_module" "--with-http_addition_module" "--with-http_xslt_module" diff --git a/pkgs/servers/http/nginx/quic.nix b/pkgs/servers/http/nginx/quic.nix deleted file mode 100644 index a3db09f16bb8..000000000000 --- a/pkgs/servers/http/nginx/quic.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ - callPackage, - nginxMainline, - ... -}@args: - -callPackage ./generic.nix args { - pname = "nginxQuic"; - - inherit (nginxMainline) src version; - - configureFlags = [ - "--with-http_v3_module" - ]; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index bb570b85bf2e..f0ff0bc091a9 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1130,6 +1130,7 @@ mapAliases { "; # Added 2025-09-25 nextcloud30Packages = throw "Nextcloud 30 is EOL!"; # Added 2025-09-25 nfstrace = throw "nfstrace has been removed, as it was broken"; # Added 2025-08-25 + nginxQuic = throw "'nginxQuic' has been removed. QUIC support is now available in the default nginx builds."; ngrid = throw "'ngrid' has been removed as it has been unmaintained upstream and broken"; # Added 2025-11-15 nix-direnv-flakes = throw "'nix-direnv-flakes' has been renamed to/replaced by 'nix-direnv'"; # Converted to throw 2025-10-27 nix-ld-rs = throw "'nix-ld-rs' has been renamed to/replaced by 'nix-ld'"; # Converted to throw 2025-10-27 @@ -1349,6 +1350,7 @@ mapAliases { quaternion-qt5 = throw "'quaternion-qt5' has been removed as quaternion dropped Qt5 support with v0.0.97.1"; # Added 2025-05-24 qubes-core-vchan-xen = throw "'qubes-core-vchan-xen' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-11 quicksynergy = throw "'quicksynergy' has been removed due to lack of maintenance upstream. Consider using 'deskflow' instead."; # Added 2025-06-18 + quictls = throw "'quictls' has been removed. QUIC support is now available in `openssl`."; quorum = throw "'quorum' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-07 qv2ray = throw "'qv2ray' has been removed as it was unmaintained"; # Added 2025-06-03 ra-multiplex = lib.warnOnInstantiate "'ra-multiplex' has been renamed to/replaced by 'lspmux'" lspmux; # Added 2025-10-27 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 69fa8240b3ce..bbbb70b760a7 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -1477,21 +1477,6 @@ with pkgs; ]; }; - angieQuic = callPackage ../servers/http/angie { - zlib-ng = zlib-ng.override { withZlibCompat = true; }; - withPerl = false; - withQuic = true; - # We don't use `with` statement here on purpose! - # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334 - modules = [ - nginxModules.rtmp - nginxModules.dav - nginxModules.moreheaders - ]; - # Use latest quictls to allow http3 support - openssl = quictls; - }; - angie-console-light = callPackage ../servers/http/angie/console-light.nix { }; apk-tools = callPackage ../tools/package-management/apk-tools { @@ -3790,8 +3775,6 @@ with pkgs; qtspim = libsForQt5.callPackage ../development/tools/misc/qtspim { }; - quictls = callPackage ../development/libraries/quictls { }; - quota = if stdenv.hostPlatform.isLinux then linuxquota else unixtools.quota; radeon-profile = libsForQt5.callPackage ../tools/misc/radeon-profile { }; @@ -9326,20 +9309,6 @@ with pkgs; nginx = nginxStable; - nginxQuic = callPackage ../servers/http/nginx/quic.nix { - zlib-ng = zlib-ng.override { withZlibCompat = true; }; - withPerl = false; - # We don't use `with` statement here on purpose! - # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334 - modules = [ - nginxModules.rtmp - nginxModules.dav - nginxModules.moreheaders - ]; - # Use latest boringssl to allow http3 support - openssl = quictls; - }; - nginxStable = callPackage ../servers/http/nginx/stable.nix { zlib-ng = zlib-ng.override { withZlibCompat = true; }; withPerl = false;