From 1cdef430f7653946ddb48eb75b2017b1fc8b9571 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sun, 19 Apr 2026 23:16:58 +0200
Subject: [PATCH] nginx: 1.28.3 -> 1.30.0

https://nginx.org/en/CHANGES-1.30

The build now uses OpenSSL 4.0 to allow usage of ECH
https://blog.nginx.org/blog/encrypted-client-hello-comes-to-nginx
---
 pkgs/servers/http/nginx/stable.nix | 4 ++--
 pkgs/top-level/all-packages.nix    | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/http/nginx/stable.nix b/pkgs/servers/http/nginx/stable.nix
index 7191c6d93fd3..8e9facc7fc1f 100644
--- a/pkgs/servers/http/nginx/stable.nix
+++ b/pkgs/servers/http/nginx/stable.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.28.3";
-  hash = "sha256-LJapRr+wiCohdE7UKXcKISOuGCjHxIZlCSmT3e6RqRg=";
+  version = "1.30.0";
+  hash = "sha256-BYGIxkvyK67KpyuAmmMYpPm6YjiJxVT+qwP3y4U6sxs=";
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4e6cc40f54d9..5f3cd5690d99 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8150,6 +8150,7 @@ with pkgs;
   nginx = nginxStable;
 
   nginxStable = callPackage ../servers/http/nginx/stable.nix {
+    openssl = openssl_4_0;
     zlib-ng = zlib-ng.override { withZlibCompat = true; };
     withPerl = false;
     # We don't use `with` statement here on purpose!