From 6db66126ec426fe3cbf54df8aa46e6c7e60ead26 Mon Sep 17 00:00:00 2001
From: Michael Hoang <enzime@users.noreply.github.com>
Date: Thu, 30 Apr 2026 14:15:56 +0200
Subject: [PATCH 1/2] nixos/nginx: sync Mozilla recommended cipher list

https://ssl-config.mozilla.org/#server=nginx&config=intermediate&guideline=6.0
https://wiki.mozilla.org/Security/Server_Side_TLS#Version_History
---
 nixos/modules/services/web-servers/nginx/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index fe4b5e101151..22260a3fc2ae 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -981,9 +981,6 @@ in
           "ECDHE-RSA-AES256-GCM-SHA384"
           "ECDHE-ECDSA-CHACHA20-POLY1305"
           "ECDHE-RSA-CHACHA20-POLY1305"
-          "DHE-RSA-AES128-GCM-SHA256"
-          "DHE-RSA-AES256-GCM-SHA384"
-          "DHE-RSA-CHACHA20-POLY1305"
         ];
         description = ''
           List of available cipher suites to choose from when negotiating TLS sessions.

From 6d1bbc317c77e16a0baee4d6fbfcc2f41a311255 Mon Sep 17 00:00:00 2001
From: Michael Hoang <enzime@users.noreply.github.com>
Date: Thu, 30 Apr 2026 14:19:24 +0200
Subject: [PATCH 2/2] nixos/nginx: drop option for configuring DHE

This option is no longer necessary as DHE is deprecated in NixOS as of #513396
and ECDHE does not require any configuration changes.
---
 .../services/web-servers/nginx/default.nix    | 21 +++++++------------
 1 file changed, 7 insertions(+), 14 deletions(-)

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 22260a3fc2ae..73efd441d23d 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -206,11 +206,6 @@ let
                 if lib.isList cfg.sslCiphers then (lib.concatStringsSep ":" cfg.sslCiphers) else cfg.sslCiphers
               };"
             }
-            ${optionalString (cfg.sslDhparam != false)
-              "ssl_dhparam ${
-                if cfg.sslDhparam == true then config.security.dhparams.params.nginx.path else cfg.sslDhparam
-              };"
-            }
 
             ${optionalString cfg.recommendedTlsSettings ''
               # Consider https://ssl-config.mozilla.org/#server=nginx&config=intermediate as the lower bound
@@ -999,13 +994,6 @@ in
         description = "Allowed TLS protocol versions.";
       };
 
-      sslDhparam = mkOption {
-        type = types.either types.path types.bool;
-        default = false;
-        example = "/path/to/dhparams.pem";
-        description = "Path to DH parameters file, or `true` to generate with `security.dhparms.params.nginx`.";
-      };
-
       proxyResolveWhileRunning = mkOption {
         type = types.bool;
         default = false;
@@ -1305,6 +1293,13 @@ in
   };
 
   imports = [
+    (mkRemovedOptionModule [ "services" "nginx" "sslDhparam" ] ''
+      DHE cipher suites have been removed from the default nginx cipher list.
+
+      No additional configuration is required as ECDHE is used by default already.
+
+      If you wish to use Hybrid PQ key exchange, you can set services.nginx.recommendedTlsSettings = true.
+    '')
     (mkRemovedOptionModule [ "services" "nginx" "stateDir" ] ''
       The Nginx log directory has been moved to /var/log/nginx, the cache directory
       to /var/cache/nginx. The option services.nginx.stateDir has been removed.
@@ -1675,8 +1670,6 @@ in
       in
       listToAttrs acmePairs;
 
-    security.dhparams.params.nginx = lib.mkIf (cfg.sslDhparam == true) { };
-
     users.users = optionalAttrs (cfg.user == "nginx") {
       nginx = {
         group = cfg.group;