movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-14 06:00:33 +03:00
Code Activity

Merge pull request #147027 from Izorkin/update-nginx-ktls

Browse source 
nginxMainline: enable ktls support
This commit is contained in:
7c6f434c 2021-12-24 10:23:17 +00:00 • committed by GitHub
commit b0f154fd44
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nixos/modules/services/web-servers/nginx/default.nix
View file

@ -317,9 +317,12 @@ let
${optionalString (hasSSL && vhost.sslTrustedCertificate != null) ''
ssl_trusted_certificate ${vhost.sslTrustedCertificate};
''}
${optionalString vhost.rejectSSL ''
${optionalString (hasSSL && vhost.rejectSSL) ''
ssl_reject_handshake on;
''}
${optionalString (hasSSL && vhost.kTLS) ''
ssl_conf_command Options KTLS;
''}
${mkBasicAuth vhostName vhost}
@ -824,6 +827,14 @@ in
'';
}
{
assertion = any (host: host.kTLS) (attrValues virtualHosts) -> versionAtLeast cfg.package.version "1.21.4";
message = ''
services.nginx.virtualHosts.<name>.kTLS requires nginx version
1.21.4 or above; see the documentation for services.nginx.package.
'';
}
{
assertion = all (host: !(host.enableACME && host.useACMEHost != null)) (attrValues virtualHosts);
message = ''
@ -900,7 +911,7 @@ in
PrivateMounts = true;
# System Call Filtering
SystemCallArchitectures = "native";
SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid @mincore";
SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid @mincore" ] ++ optionals (cfg.package != pkgs.tengine) [ "~@ipc" ];
};
};

11
nixos/modules/services/web-servers/nginx/vhost-options.nix
View file

@ -147,6 +147,17 @@ with lib;
'';
};
kTLS = mkOption {
type = types.bool;
default = false;
description = ''
Whether to enable kTLS support.
Implementing TLS in the kernel (kTLS) improves performance by significantly
reducing the need for copying operations between user space and the kernel.
Required Nginx version 1.21.4 or later.
'';
};
sslCertificate = mkOption {
type = types.path;
example = "/var/host.cert";