From 18076e001a54c86c42a3a74a2ef45e1f1dbb4c91 Mon Sep 17 00:00:00 2001 From: aszlig Date: Wed, 17 Oct 2012 15:11:53 +0200 Subject: [PATCH 1/7] apache-httpd: Use authn_core for version >= 2.3. Beginning with version 2.3, the authn were refactored. As a result, authn_alias is now part of the new module authn_core, so let's use authn_core instead of authn_alias. For details please see: http://httpd.apache.org/docs/2.4/upgrading.html#misc Signed-off-by: aszlig --- modules/services/web-servers/apache-httpd/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/services/web-servers/apache-httpd/default.nix b/modules/services/web-servers/apache-httpd/default.nix index 9ceb66a85a0a..4a5362436b0a 100644 --- a/modules/services/web-servers/apache-httpd/default.nix +++ b/modules/services/web-servers/apache-httpd/default.nix @@ -101,7 +101,8 @@ let "auth_basic" "auth_digest" # Authentication: is the user who he claims to be? - "authn_file" "authn_dbm" "authn_anon" "authn_alias" + "authn_file" "authn_dbm" "authn_anon" + (if versionOlder httpd.version "2.3" then "authn_alias" else "authn_core") # Authorization: is the user allowed access? "authz_user" "authz_groupfile" "authz_host" From 3ad8fac5a25b549bd28d5bc5c4f461a52f109c6a Mon Sep 17 00:00:00 2001 From: aszlig Date: Wed, 17 Oct 2012 15:17:48 +0200 Subject: [PATCH 2/7] apache-httpd: Dynamically load MPM module in v2.4. Now, MPMs can be loaded at runtime and it's no longer required to compile in one of the MPM modules statically. So, if version is >= 2.4, load the MPM module corresponding to the multiProcessingModule value of the service module. For details, please see: http://httpd.apache.org/docs/2.4/mpm.html Signed-off-by: aszlig --- modules/services/web-servers/apache-httpd/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/services/web-servers/apache-httpd/default.nix b/modules/services/web-servers/apache-httpd/default.nix index 4a5362436b0a..b70ed3933aaf 100644 --- a/modules/services/web-servers/apache-httpd/default.nix +++ b/modules/services/web-servers/apache-httpd/default.nix @@ -114,6 +114,7 @@ let "vhost_alias" "negotiation" "dir" "imagemap" "actions" "speling" "userdir" "alias" "rewrite" "proxy" "proxy_http" ] + ++ optional (!versionOlder httpd.version "2.4") "mpm_${mainCfg.multiProcessingModule}" ++ (if mainCfg.multiProcessingModule == "prefork" then [ "cgi" ] else [ "cgid" ]) ++ optional enableSSL "ssl" ++ extraApacheModules; From 3acd98b040517cae680c8ca4273c0613f8af82ce Mon Sep 17 00:00:00 2001 From: aszlig Date: Wed, 17 Oct 2012 15:21:32 +0200 Subject: [PATCH 3/7] apache-httpd: Add unixd for 2.4, needed by "User". Beginning with 2.4 mod_unixd is needed to supply Unix usernames and groups for the web server. For details please have a look at: http://httpd.apache.org/docs/2.4/upgrading.html#commonproblems Signed-off-by: aszlig --- modules/services/web-servers/apache-httpd/default.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/services/web-servers/apache-httpd/default.nix b/modules/services/web-servers/apache-httpd/default.nix index b70ed3933aaf..05fada720ba7 100644 --- a/modules/services/web-servers/apache-httpd/default.nix +++ b/modules/services/web-servers/apache-httpd/default.nix @@ -114,7 +114,10 @@ let "vhost_alias" "negotiation" "dir" "imagemap" "actions" "speling" "userdir" "alias" "rewrite" "proxy" "proxy_http" ] - ++ optional (!versionOlder httpd.version "2.4") "mpm_${mainCfg.multiProcessingModule}" + ++ optionals (!versionOlder httpd.version "2.4") [ + "mpm_${mainCfg.multiProcessingModule}" + "unixd" + ] ++ (if mainCfg.multiProcessingModule == "prefork" then [ "cgi" ] else [ "cgid" ]) ++ optional enableSSL "ssl" ++ extraApacheModules; From a88453fbaa8104502975d40c1b53738f71168b70 Mon Sep 17 00:00:00 2001 From: aszlig Date: Wed, 17 Oct 2012 16:57:18 +0200 Subject: [PATCH 4/7] apache-httpd: Properly wrap access directives. The Order/Deny directives are deprecated in version 2.4, so we're going to define two wrappers for allDenied and allGranted in order to properly generate configurations for both version 2.2 and 2.4. For more information an access control changes, see: http://httpd.apache.org/docs/2.4/upgrading.html#access Signed-off-by: aszlig --- .../web-servers/apache-httpd/default.nix | 37 ++++++++++++------- 1 file changed, 23 insertions(+), 14 deletions(-) diff --git a/modules/services/web-servers/apache-httpd/default.nix b/modules/services/web-servers/apache-httpd/default.nix index 05fada720ba7..29a20cae162b 100644 --- a/modules/services/web-servers/apache-httpd/default.nix +++ b/modules/services/web-servers/apache-httpd/default.nix @@ -116,6 +116,7 @@ let ] ++ optionals (!versionOlder httpd.version "2.4") [ "mpm_${mainCfg.multiProcessingModule}" + "authz_core" "unixd" ] ++ (if mainCfg.multiProcessingModule == "prefork" then [ "cgi" ] else [ "cgid" ]) @@ -123,6 +124,21 @@ let ++ extraApacheModules; + allDenied = if versionOlder httpd.version "2.4" then '' + Order deny,allow + Deny from all + '' else '' + Require all denied + ''; + + allGranted = if versionOlder httpd.version "2.4" then '' + Order allow,deny + Allow from all + '' else '' + Require all granted + ''; + + loggingConf = '' ErrorLog ${mainCfg.logDir}/error_log @@ -191,8 +207,7 @@ let Options Indexes FollowSymLinks AllowOverride None - Order allow,deny - Allow from all + ${allGranted} ''; @@ -246,12 +261,10 @@ let AllowOverride FileInfo AuthConfig Limit Indexes Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec - Order allow,deny - Allow from all + ${allGranted} - Order deny,allow - Deny from all + ${allDenied} @@ -273,8 +286,7 @@ let Alias ${elem.urlPath} ${elem.dir}/ Options +Indexes - Order allow,deny - Allow from all + ${allGranted} AllowOverride All ''; @@ -326,8 +338,7 @@ let AddHandler type-map var - Order allow,deny - Deny from all + ${allDenied} ${mimeConf} @@ -345,16 +356,14 @@ let Options FollowSymLinks AllowOverride None - Order deny,allow - Deny from all + ${allDenied} # But do allow access to files in the store so that we don't have # to generate clauses for every generated file that we # want to serve. - Order allow,deny - Allow from all + ${allGranted} # Generate directives for the main server. From 5655ec0efa3839217dae12742d585c11d25dd693 Mon Sep 17 00:00:00 2001 From: aszlig Date: Wed, 17 Oct 2012 17:03:50 +0200 Subject: [PATCH 5/7] apache-httpd: Avoid NameVirtualHost in >= v2.4. NameVirtualHost no longer has any effect on version 2.4 and just emits ugly warnings, so let's not use it if we use 2.4. More information: http://httpd.apache.org/docs/2.4/upgrading.html#misc Signed-off-by: aszlig --- modules/services/web-servers/apache-httpd/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/services/web-servers/apache-httpd/default.nix b/modules/services/web-servers/apache-httpd/default.nix index 29a20cae162b..9a3a3a105411 100644 --- a/modules/services/web-servers/apache-httpd/default.nix +++ b/modules/services/web-servers/apache-httpd/default.nix @@ -373,7 +373,9 @@ let ${let ports = map getPort allHosts; uniquePorts = uniqList {inputList = ports;}; - in concatMapStrings (port: "NameVirtualHost *:${toString port}\n") uniquePorts + isNeeded = versionOlder httpd.version "2.4"; + directives = concatMapStrings (port: "NameVirtualHost *:${toString port}\n") uniquePorts; + in optionalString isNeeded directives } ${let From 919e6e55a9c6c98fe408831905a8b91587af0503 Mon Sep 17 00:00:00 2001 From: aszlig Date: Wed, 17 Oct 2012 17:38:43 +0200 Subject: [PATCH 6/7] apache-httpd: Create runtime dir for version 2.4. By default the path is determined related to ServerRoot. Unfortunately ServerRoot is pointing to the Nix store and the web server can't write to it. We now create a directory called "runtime" withen the stateDir and point DefaultRuntimeDir to it. For more information on the DefaultRuntimeDir directive, please see: http://httpd.apache.org/docs/2.4/mod/core.html#defaultruntimedir Signed-off-by: aszlig --- modules/services/web-servers/apache-httpd/default.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/modules/services/web-servers/apache-httpd/default.nix b/modules/services/web-servers/apache-httpd/default.nix index 9a3a3a105411..89fd491fd220 100644 --- a/modules/services/web-servers/apache-httpd/default.nix +++ b/modules/services/web-servers/apache-httpd/default.nix @@ -303,6 +303,10 @@ let ServerRoot ${httpd} + ${optionalString (!versionOlder httpd.version "2.4") '' + DefaultRuntimeDir ${mainCfg.stateDir}/runtime + ''} + PidFile ${mainCfg.stateDir}/httpd.pid ${optionalString (mainCfg.multiProcessingModule != "prefork") '' @@ -636,6 +640,10 @@ in '' mkdir -m 0750 -p ${mainCfg.stateDir} chown root.${mainCfg.group} ${mainCfg.stateDir} + ${optionalString (!versionOlder httpd.version "2.4") '' + mkdir -m 0750 -p "${mainCfg.stateDir}/runtime" + chown root.${mainCfg.group} "${mainCfg.stateDir}/runtime" + ''} mkdir -m 0700 -p ${mainCfg.logDir} ${optionalString (mainCfg.documentRoot != null) From f9831a94c984b1bfdff598299a1b66341a1f9cd2 Mon Sep 17 00:00:00 2001 From: aszlig Date: Wed, 17 Oct 2012 17:47:30 +0200 Subject: [PATCH 7/7] apache-httpd: Simplify all versionOlder calls. We now just have a simple attribute called "version24" which replaces all those pesky versionOlder that were spreading throughout the file and makes things way more readable. Signed-off-by: aszlig --- .../web-servers/apache-httpd/default.nix | 25 ++++++++++--------- 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/modules/services/web-servers/apache-httpd/default.nix b/modules/services/web-servers/apache-httpd/default.nix index 89fd491fd220..1729850421a3 100644 --- a/modules/services/web-servers/apache-httpd/default.nix +++ b/modules/services/web-servers/apache-httpd/default.nix @@ -8,6 +8,8 @@ let httpd = mainCfg.package; + version24 = !versionOlder httpd.version "2.4"; + httpdConf = mainCfg.configFile; php = pkgs.php.override { apacheHttpd = httpd; }; @@ -102,7 +104,7 @@ let # Authentication: is the user who he claims to be? "authn_file" "authn_dbm" "authn_anon" - (if versionOlder httpd.version "2.3" then "authn_alias" else "authn_core") + (if version24 then "authn_core" else "authn_alias") # Authorization: is the user allowed access? "authz_user" "authz_groupfile" "authz_host" @@ -114,7 +116,7 @@ let "vhost_alias" "negotiation" "dir" "imagemap" "actions" "speling" "userdir" "alias" "rewrite" "proxy" "proxy_http" ] - ++ optionals (!versionOlder httpd.version "2.4") [ + ++ optionals version24 [ "mpm_${mainCfg.multiProcessingModule}" "authz_core" "unixd" @@ -124,18 +126,18 @@ let ++ extraApacheModules; - allDenied = if versionOlder httpd.version "2.4" then '' + allDenied = if version24 then '' + Require all denied + '' else '' Order deny,allow Deny from all - '' else '' - Require all denied ''; - allGranted = if versionOlder httpd.version "2.4" then '' + allGranted = if version24 then '' + Require all granted + '' else '' Order allow,deny Allow from all - '' else '' - Require all granted ''; @@ -303,7 +305,7 @@ let ServerRoot ${httpd} - ${optionalString (!versionOlder httpd.version "2.4") '' + ${optionalString version24 '' DefaultRuntimeDir ${mainCfg.stateDir}/runtime ''} @@ -377,9 +379,8 @@ let ${let ports = map getPort allHosts; uniquePorts = uniqList {inputList = ports;}; - isNeeded = versionOlder httpd.version "2.4"; directives = concatMapStrings (port: "NameVirtualHost *:${toString port}\n") uniquePorts; - in optionalString isNeeded directives + in optionalString (!version24) directives } ${let @@ -640,7 +641,7 @@ in '' mkdir -m 0750 -p ${mainCfg.stateDir} chown root.${mainCfg.group} ${mainCfg.stateDir} - ${optionalString (!versionOlder httpd.version "2.4") '' + ${optionalString version24 '' mkdir -m 0750 -p "${mainCfg.stateDir}/runtime" chown root.${mainCfg.group} "${mainCfg.stateDir}/runtime" ''}