From 2fd6e6e264d033fa32582c32c717590f8f614541 Mon Sep 17 00:00:00 2001
From: Matthias Treydte <mt@waldheinz.de>
Date: Fri, 20 May 2022 09:23:31 +0200
Subject: [PATCH 1/2] nginx: take care not to pull in module sources as runtime
 deps

Nginx likes to print the "configured with ..." stuff on startup,
containing the full configure command line. When built with
modules (which it seems to be by default), this causes the
module sources to appear as runtime dependencies. So just use
the remove-references-to script to patch those out.

For a default installation, the rtmp, dav and moreheaders
module sources are gone, for special cases potentially more.
---
 pkgs/servers/http/nginx/generic.nix | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index e189a7d2fdff..039139e9083c 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -2,7 +2,7 @@ outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt
 , nginx-doc
 
 , nixosTests
-, substituteAll, gd, geoip, perl
+, substituteAll, removeReferencesTo, gd, geoip, perl
 , withDebug ? false
 , withKTLS ? false
 , withStream ? true
@@ -158,9 +158,16 @@ stdenv.mkDerivation {
     cp -r ${nginx-doc}/* $doc
   '';
 
-  postInstall = if postInstall != null then postInstall else ''
-    mv $out/sbin $out/bin
-  '';
+  nativeBuildInputs = [ removeReferencesTo ];
+
+  disallowedReferences = map (m: m.src) modules;
+
+  postInstall =
+    let
+      noSourceRefs = lib.concatMapStrings (m: "remove-references-to -t ${m.src} $out/sbin/nginx\n") modules;
+    in noSourceRefs + (if postInstall != null then postInstall else ''
+      mv $out/sbin $out/bin
+    '');
 
   passthru = {
     modules = modules;

From ecb166b3e3890504af0828bfd2e03edd6f720971 Mon Sep 17 00:00:00 2001
From: Matthias Treydte <mt@waldheinz.de>
Date: Sun, 22 May 2022 10:35:48 +0200
Subject: [PATCH 2/2] nginx: simplify the postInstall phase

Per suggestion from @ajs124, we can rely on the
"move-sbin" setup hook to move the executable
to $out/bin instead of doing it manually and
simplify accoringly.
---
 pkgs/servers/http/nginx/generic.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 039139e9083c..4e0572b10393 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -22,7 +22,7 @@ outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt
 , extraPatches ? []
 , fixPatch ? p: p
 , preConfigure ? ""
-, postInstall ? null
+, postInstall ? ""
 , meta ? null
 , nginx-doc ? outer.nginx-doc
 , passthru ? { tests = {}; }
@@ -165,9 +165,7 @@ stdenv.mkDerivation {
   postInstall =
     let
       noSourceRefs = lib.concatMapStrings (m: "remove-references-to -t ${m.src} $out/sbin/nginx\n") modules;
-    in noSourceRefs + (if postInstall != null then postInstall else ''
-      mv $out/sbin $out/bin
-    '');
+    in noSourceRefs + postInstall;
 
   passthru = {
     modules = modules;