movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 13:40:28 +03:00
Code Activity

Merge pull request #101192 from grahamc/nixpkgs-location-basic-auth

Browse source 
nginx: support basic auth in location blocks
This commit is contained in:
Graham Christensen 2020-11-02 09:44:54 -05:00 • committed by GitHub
commit 75a2bc94fa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 93 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nixos/modules/services/web-servers/nginx/default.nix
View file

@ -261,10 +261,7 @@ let
ssl_trusted_certificate ${vhost.sslTrustedCertificate};
''}
${optionalString (vhost.basicAuthFile != null || vhost.basicAuth != {}) ''
auth_basic secured;
auth_basic_user_file ${if vhost.basicAuthFile != null then vhost.basicAuthFile else mkHtpasswd vhostName vhost.basicAuth};
''}
${mkBasicAuth vhostName vhost}
${mkLocations vhost.locations}
@ -293,9 +290,19 @@ let
${optionalString (config.return != null) "return ${config.return};"}
${config.extraConfig}
${optionalString (config.proxyPass != null && cfg.recommendedProxySettings) "include ${recommendedProxyConfig};"}
${mkBasicAuth "sublocation" config}
}
'') (sortProperties (mapAttrsToList (k: v: v // { location = k; }) locations)));
mkHtpasswd = vhostName: authDef: pkgs.writeText "${vhostName}.htpasswd" (
mkBasicAuth = name: zone: optionalString (zone.basicAuthFile != null || zone.basicAuth != {}) (let
auth_file = if zone.basicAuthFile != null
then zone.basicAuthFile
else mkHtpasswd name zone.basicAuth;
in ''
auth_basic secured;
auth_basic_user_file ${auth_file};
'');
mkHtpasswd = name: authDef: pkgs.writeText "${name}.htpasswd" (
concatStringsSep "\n" (mapAttrsToList (user: password: ''
${user}:{PLAIN}${password}
'') authDef)

28
nixos/modules/services/web-servers/nginx/location-options.nix
View file

@ -9,6 +9,34 @@ with lib;
{
options = {
basicAuth = mkOption {
type = types.attrsOf types.str;
default = {};
example = literalExample ''
{
user = "password";
};
'';
description = ''
Basic Auth protection for a vhost.
WARNING: This is implemented to store the password in plain text in the
Nix store.
'';
};
basicAuthFile = mkOption {
type = types.nullOr types.path;
default = null;
description = ''
Basic Auth password file for a vhost.
Can be created via: <command>htpasswd -c &lt;filename&gt; &lt;username&gt;</command>.
WARNING: The generate file contains the users' passwords in a
non-cryptographically-securely hashed way.
'';
};
proxyPass = mkOption {
type = types.nullOr types.str;
default = null;

7
nixos/modules/services/web-servers/nginx/vhost-options.nix
View file

@ -198,7 +198,7 @@ with lib;
Basic Auth protection for a vhost.
WARNING: This is implemented to store the password in plain text in the
nix store.
Nix store.
'';
};
@ -207,7 +207,10 @@ with lib;
default = null;
description = ''
Basic Auth password file for a vhost.
Can be created via: <command>htpasswd -c &lt;filename&gt; &lt;username&gt;</command>
Can be created via: <command>htpasswd -c &lt;filename&gt; &lt;username&gt;</command>.
WARNING: The generate file contains the users' passwords in a
non-cryptographically-securely hashed way.
'';
};