From e62971b005f2b85bdc72a5e810120ac7b135e87f Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Sat, 26 Jul 2025 14:26:28 +0200
Subject: [PATCH] nixos/nginx: sync with Mozilla Intermediate TLS configuration

- adds ssl_ecdh_curve, per https://github.com/mozilla/ssl-config-generator/issues/76
- removes ssl_stapling, after Let's Encrypt ended support for OCSP
  stapling https://letsencrypt.org/2024/12/05/ending-ocsp/, enabling ssl_stapling
  leads to warning log spam:
```
  ssl_stapling" ignored, no OCSP responder URL in the certificate "<cert-directory>
```
---
 nixos/modules/services/web-servers/nginx/default.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 8515df0274d8..553f1f1148a5 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -207,6 +207,7 @@ let
             ${optionalString cfg.recommendedTlsSettings ''
               # Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate
 
+              ssl_ecdh_curve X25519:prime256v1:secp384r1;
               ssl_session_timeout 1d;
               ssl_session_cache shared:SSL:10m;
               # Breaks forward secrecy: https://github.com/mozilla/server-side-tls/issues/135
@@ -214,10 +215,6 @@ let
               # We don't enable insecure ciphers by default, so this allows
               # clients to pick the most performant, per https://github.com/mozilla/server-side-tls/issues/260
               ssl_prefer_server_ciphers off;
-
-              # OCSP stapling
-              ssl_stapling on;
-              ssl_stapling_verify on;
             ''}
 
             ${optionalString cfg.recommendedBrotliSettings ''