diff options
| author | Alexander Ried <ried@mytum.de> | 2016-09-06 17:45:57 +0200 |
|---|---|---|
| committer | Alexander Ried <ried@mytum.de> | 2016-09-06 17:47:00 +0200 |
| commit | e84b803300033a030907f351b5a5c6fa671b7bf6 (patch) | |
| tree | 87417f379ac59f2ce3c28357d797ebaa0938bbd7 /nixos | |
| parent | 7f98dca782b50e685ee49415a126a32b1e0cb4d8 (diff) | |
| download | nixlib-e84b803300033a030907f351b5a5c6fa671b7bf6.tar nixlib-e84b803300033a030907f351b5a5c6fa671b7bf6.tar.gz nixlib-e84b803300033a030907f351b5a5c6fa671b7bf6.tar.bz2 nixlib-e84b803300033a030907f351b5a5c6fa671b7bf6.tar.lz nixlib-e84b803300033a030907f351b5a5c6fa671b7bf6.tar.xz nixlib-e84b803300033a030907f351b5a5c6fa671b7bf6.tar.zst nixlib-e84b803300033a030907f351b5a5c6fa671b7bf6.zip | |
security.acme: remove loop when no fallbackHost is given
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/services/web-servers/nginx/default.nix | 7 | ||||
| -rw-r--r-- | nixos/modules/services/web-servers/nginx/vhost-options.nix | 4 |
2 files changed, 6 insertions, 5 deletions
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 6e62606f323e..94c442e165b7 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -114,17 +114,18 @@ let port = if vhost.port != null then vhost.port else (if ssl then 443 else 80); listenString = toString port + optionalString ssl " ssl http2" + optionalString vhost.default " default"; - acmeLocation = optionalString vhost.enableACME '' + acmeLocation = optionalString vhost.enableACME ('' location /.well-known/acme-challenge { - try_files $uri @acme-fallback; + ${optionalString (vhost.acmeFallbackHost != null) "try_files $uri @acme-fallback;"} root ${vhost.acmeRoot}; auth_basic off; } + '' + (optionalString (vhost.acmeFallbackHost != null) '' location @acme-fallback { auth_basic off; proxy_pass http://${vhost.acmeFallbackHost}; } - ''; + '')); in '' ${optionalString vhost.forceSSL '' server { diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix index ee3f68bf8059..dcebbc9229fc 100644 --- a/nixos/modules/services/web-servers/nginx/vhost-options.nix +++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix @@ -39,8 +39,8 @@ with lib; }; acmeFallbackHost = mkOption { - type = types.str; - default = "0.0.0.0"; + type = types.nullOr types.str; + default = null; description = '' Host which to proxy requests to if acme challenge is not found. Useful if you want multiple hosts to be able to verify the same domain name. |