From f1c4d339a5bc99f1b1be68ab42e479e2dd0b3885 Mon Sep 17 00:00:00 2001 From: Daniel Xu Date: Mon, 20 Jan 2025 11:48:04 -0800 Subject: [PATCH] nixos/wordpress: Use https by default for caddy Previously, `http://` scheme was hard coded into the caddy config if `webserver = "caddy"` was chosen. This is fine for local testing, but is problematic if you want your nixos host to be public facing. In the public facing case, you generally want to be using TLS. But since the wordpress module generates the caddyfile rule, the user's nixos config cannot easily change it to also allow https. An alternative would be to reverse proxy an https rule to the generated http rule, but that's somewhat questionable as there's not an internal http endpoint to proxy to. It might be possible but I couldn't figure it out. So simplify by omitting the scheme. This causes caddy to use https by default and 301 redirect any http requests to the https endpoint. Caddy will just do the right thing if it's being hosted on a local/internal hostname (self sign certificates). This should be backwards compatible with previous default if users are using reasonable browsers/tools. Signed-off-by: Daniel Xu --- nixos/doc/manual/release-notes/rl-2505.section.md | 4 ++++ nixos/modules/services/web-apps/wordpress.nix | 2 +- nixos/tests/wordpress.nix | 4 ++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index 8c0b3bfc63e1..013a1a8ba1da 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -445,6 +445,10 @@ For those unable to upgrade yet, there is a [v0 compatibility mode](https://www.openpolicyagent.org/docs/v1.0.1/v0-compatibility/) available too. +- Wordpress with the Caddy webserver (`services.wordpress.webserver = "caddy"`) now sets up sites with Caddy's automatic HTTPS instead of HTTP-only. + Given a site example.com, http://example.com now 301 redirects to https://example.com. + To keep the old behavior for a site `example.com`, set `services.caddy.virtualHosts."example.com".hostName = "http://example.com"`. + - `vscode-utils.buildVscodeExtension` now requires pname as an argument - The behavior of `services.hostapd.radios..networks..authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore. diff --git a/nixos/modules/services/web-apps/wordpress.nix b/nixos/modules/services/web-apps/wordpress.nix index 827db987890e..0635b5505701 100644 --- a/nixos/modules/services/web-apps/wordpress.nix +++ b/nixos/modules/services/web-apps/wordpress.nix @@ -545,7 +545,7 @@ in services.caddy = { enable = true; virtualHosts = mapAttrs' (hostName: cfg: ( - nameValuePair "http://${hostName}" { + nameValuePair hostName { extraConfig = '' root * /${pkg hostName cfg}/share/wordpress file_server diff --git a/nixos/tests/wordpress.nix b/nixos/tests/wordpress.nix index c7988c111ac4..0983974908ed 100644 --- a/nixos/tests/wordpress.nix +++ b/nixos/tests/wordpress.nix @@ -75,7 +75,7 @@ rec { }; }; - networking.firewall.allowedTCPPorts = [ 80 ]; + networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.hosts."127.0.0.1" = [ "site1.local" "site2.local" @@ -106,7 +106,7 @@ rec { machine.wait_for_unit(f"phpfpm-wordpress-{site_name}") with subtest("website returns welcome screen"): - assert "Welcome to the famous" in machine.succeed(f"curl -L {site_name}") + assert "Welcome to the famous" in machine.succeed(f"curl -k -L {site_name}") with subtest("wordpress-init went through"): info = machine.get_unit_info(f"wordpress-init-{site_name}")