gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/nginx: make cipher configuration structured (#513393)

Browse Source
This commit is contained in:
Martin Weinelt
2026-05-04 23:16:12 +00:00
committed by GitHub
parent 3dd1f0b9fd dd3f260355
commit fbebf19913
1 changed files with 26 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/web-servers/nginx/default.nix
+26 -5
View File
@@ -201,7 +201,11 @@ let
''}
ssl_protocols ${cfg.sslProtocols};
${optionalString (cfg.sslCiphers != null) "ssl_ciphers ${cfg.sslCiphers};"}
${optionalString (cfg.sslCiphers != null)
"ssl_ciphers ${
if lib.isList cfg.sslCiphers then (lib.concatStringsSep ":" cfg.sslCiphers) else cfg.sslCiphers
};"
}
${optionalString (cfg.sslDhparam != false)
"ssl_dhparam ${
if cfg.sslDhparam == true then config.security.dhparams.params.nginx.path else cfg.sslDhparam
@@ -968,16 +972,33 @@ in
};
sslCiphers = mkOption {
type = types.nullOr types.str;
type = types.nullOr (types.either types.str (types.listOf types.str));
# Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate
default = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305";
description = "Ciphers to choose from when negotiating TLS handshakes.";
default = [
"ECDHE-ECDSA-AES128-GCM-SHA256"
"ECDHE-RSA-AES128-GCM-SHA256"
"ECDHE-ECDSA-AES256-GCM-SHA384"
"ECDHE-RSA-AES256-GCM-SHA384"
"ECDHE-ECDSA-CHACHA20-POLY1305"
"ECDHE-RSA-CHACHA20-POLY1305"
"DHE-RSA-AES128-GCM-SHA256"
"DHE-RSA-AES256-GCM-SHA384"
"DHE-RSA-CHACHA20-POLY1305"
];
description = ''
List of available cipher suites to choose from when negotiating TLS sessions.
:::{.warn}
This option only handles cipher suites up to TLSv1.2. Use
`ssl_conf_command CipherSuites` to configure TLSv1.3 cipher suites.
:::
'';
};
sslProtocols = mkOption {
type = types.str;
default = "TLSv1.2 TLSv1.3";
example = "TLSv1 TLSv1.1 TLSv1.2 TLSv1.3";
example = "TLSv1.3";
description = "Allowed TLS protocol versions.";
};