7 files changed, 131 insertions, 28 deletions
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 4822b5109e81..d7f7660bf61f 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -47,26 +47,32 @@ stdenv.mkDerivation rec {
     configureFlags="$configureFlags --includedir=$dev/include"
   '';
 
-  configureFlags = ''
-    --with-apr=${apr.dev}
-    --with-apr-util=${aprutil.dev}
-    --with-z=${zlib.dev}
-    --with-pcre=${pcre.dev}
-    --disable-maintainer-mode
-    --disable-debugger-mode
-    --enable-mods-shared=all
-    --enable-mpms-shared=all
-    --enable-cern-meta
-    --enable-imagemap
-    --enable-cgi
-    ${optionalString brotliSupport "--enable-brotli --with-brotli=${brotli}"}
-    ${optionalString proxySupport "--enable-proxy"}
-    ${optionalString sslSupport "--enable-ssl"}
-    ${optionalString http2Support "--enable-http2 --with-nghttp2"}
-    ${optionalString luaSupport "--enable-lua --with-lua=${lua5}"}
-    ${optionalString libxml2Support "--with-libxml2=${libxml2.dev}/include/libxml2"}
-    --docdir=$(doc)/share/doc
-  '';
+  configureFlags = [
+    "--with-apr=${apr.dev}"
+    "--with-apr-util=${aprutil.dev}"
+    "--with-z=${zlib.dev}"
+    "--with-pcre=${pcre.dev}"
+    "--disable-maintainer-mode"
+    "--disable-debugger-mode"
+    "--enable-mods-shared=all"
+    "--enable-mpms-shared=all"
+    "--enable-cern-meta"
+    "--enable-imagemap"
+    "--enable-cgi"
+    (stdenv.lib.enableFeature proxySupport "proxy")
+    (stdenv.lib.enableFeature sslSupport "ssl")
+    (stdenv.lib.withFeatureAs libxml2Support "libxml2" "${libxml2.dev}/include/libxml2")
+    "--docdir=$(doc)/share/doc"
+
+    (stdenv.lib.enableFeature brotliSupport "brotli")
+    (stdenv.lib.withFeatureAs brotliSupport "brotli" brotli)
+
+    (stdenv.lib.enableFeature http2Support "http2")
+    (stdenv.lib.withFeature http2Support "nghttp2")
+
+    (stdenv.lib.enableFeature luaSupport "lua")
+    (stdenv.lib.withFeatureAs luaSupport "lua" lua5)
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix b/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix
index 58ae8f85b81f..e569ae8f8706 100644
--- a/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix
+++ b/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix
@@ -8,7 +8,10 @@ stdenv.mkDerivation rec {
     sha256 = "11khipjpy3y84j1pp7yyx76y64jccvyhh3klwzqxylff49vjc2fc";
   };
 
-  configureFlags = "--with-apxs=${apacheHttpd.dev}/bin/apxs --with-java-home=${jdk}";
+  configureFlags = [
+    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
+    "--with-java-home=${jdk}"
+  ];
 
   setSourceRoot = ''
     sourceRoot=$(echo */native)
diff --git a/pkgs/servers/http/couchdb/default.nix b/pkgs/servers/http/couchdb/default.nix
index 5a873c7e84b1..5239c027b8fa 100644
--- a/pkgs/servers/http/couchdb/default.nix
+++ b/pkgs/servers/http/couchdb/default.nix
@@ -25,9 +25,9 @@ stdenv.mkDerivation rec {
 
   If you wish to ignore this error pass --enable-js-trunk to ./configure.
   */
-  configureFlags = ''
-    --enable-js-trunk
-  '';
+  configureFlags = [
+    "--enable-js-trunk"
+  ];
 
   meta = with stdenv.lib; {
     description = "A database that uses JSON for documents, JavaScript for MapReduce queries, and regular HTTP for an API";
diff --git a/pkgs/servers/http/h2o/default.nix b/pkgs/servers/http/h2o/default.nix
index e05624fa46c8..ceffd3e0260d 100644
--- a/pkgs/servers/http/h2o/default.nix
+++ b/pkgs/servers/http/h2o/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub
 , pkgconfig, cmake
-, libressl_2_6, libuv, zlib
+, libressl, libuv, zlib
 }:
 
 with builtins;
@@ -16,8 +16,17 @@ stdenv.mkDerivation rec {
     sha256 = "0jyvbp6cjiirj44nxqa2fi5y473gnc8awfn8zv82hb1y9rlxqfyv";
   };
 
+  # We have to fix up some function prototypes, because despite upstream h2o
+  # issue #1705 (https://github.com/h2o/h2o/issues/1706), libressl 2.7+ doesn't
+  # seem to work
+  patchPhase = ''
+    substituteInPlace ./deps/neverbleed/neverbleed.c \
+      --replace 'static void RSA_' 'void RSA_' \
+      --replace 'static int RSA_'  'int RSA_'
+  '';
+
   nativeBuildInputs = [ pkgconfig cmake ];
-  buildInputs = [ libressl_2_6 libuv zlib ];
+  buildInputs = [ libressl libuv zlib ];
   enableParallelBuilding = true;
 
   meta = {
diff --git a/pkgs/servers/http/pshs/default.nix b/pkgs/servers/http/pshs/default.nix
index 2205c91789f5..c38ca046a35b 100644
--- a/pkgs/servers/http/pshs/default.nix
+++ b/pkgs/servers/http/pshs/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libevent file qrencode miniupnpc ];
 
   # SSL requires libevent at 2.1 with ssl support
-  configureFlags = "--disable-ssl";
+  configureFlags = [ "--disable-ssl" ];
 
   meta = {
     description = "Pretty small HTTP server - a command-line tool to share files";
diff --git a/pkgs/servers/http/tengine/default.nix b/pkgs/servers/http/tengine/default.nix
new file mode 100644
index 000000000000..36f326d5590b
--- /dev/null
+++ b/pkgs/servers/http/tengine/default.nix
@@ -0,0 +1,85 @@
+{ stdenv, fetchurl, openssl, zlib, pcre, libxml2, libxslt
+, gd, geoip
+, withDebug ? false
+, withMail ? false
+, withIPv6 ? true
+, modules ? []
+, ...
+}:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  version = "2.2.2";
+  name = "tengine-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/alibaba/tengine/archive/${name}.tar.gz";
+    sha256 = "1vq73wsldvj7rc61ag85pvnaacrrq9rs0pfqv71z5iyvb5r3bxc2";
+  };
+
+  buildInputs =
+    [ openssl zlib pcre libxml2 libxslt gd geoip ]
+    ++ concatMap (mod: mod.inputs or []) modules;
+
+  configureFlags = [
+    "--with-http_ssl_module"
+    "--with-http_v2_module"
+    "--with-http_realip_module"
+    "--with-http_addition_module"
+    "--with-http_xslt_module"
+    "--with-http_geoip_module"
+    "--with-http_sub_module"
+    "--with-http_dav_module"
+    "--with-http_flv_module"
+    "--with-http_mp4_module"
+    "--with-http_gunzip_module"
+    "--with-http_gzip_static_module"
+    "--with-http_auth_request_module"
+    "--with-http_concat_module"
+    "--with-http_random_index_module"
+    "--with-http_secure_link_module"
+    "--with-http_degradation_module"
+    "--with-http_stub_status_module"
+    "--with-http_sysguard_module"
+    "--with-threads"
+    "--with-pcre-jit"
+    "--with-http_slice_module"
+  ] ++ optional withDebug [
+    "--with-debug"
+  ] ++ optional withMail [
+    "--with-mail"
+    "--with-mail_ssl_module"
+  ] ++ optional (withMail != true) [
+    "--without-mail_pop3_module"
+    "--without-mail_imap_module"
+    "--without-mail_smtp_module"
+  ] ++ optional withIPv6 [
+    "--with-ipv6"
+  ] ++ optional (gd != null) "--with-http_image_filter_module"
+    ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
+    ++ map (mod: "--add-module=${mod.src}") modules;
+
+  NIX_CFLAGS_COMPILE = [
+    "-I${libxml2.dev}/include/libxml2"
+    "-Wno-error=implicit-fallthrough"
+  ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations";
+
+  preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
+
+  hardeningEnable = optional (!stdenv.isDarwin) "pie";
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    mv $out/sbin $out/bin
+  '';
+
+  meta = {
+    description = "A web server based on Nginx and has many advanced features, originated by Taobao.";
+    homepage    = https://tengine.taobao.org;
+    license     = licenses.bsd2;
+    platforms   = platforms.all;
+    maintainers = with maintainers; [ izorkin ];
+  };
+}
diff --git a/pkgs/servers/http/yaws/default.nix b/pkgs/servers/http/yaws/default.nix
index 5f92fbf2c03f..827f6122b573 100644
--- a/pkgs/servers/http/yaws/default.nix
+++ b/pkgs/servers/http/yaws/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cd $name
   '';
 
-  configureFlags = "--with-extrainclude=${pam}/include/security";
+  configureFlags = [ "--with-extrainclude=${pam}/include/security" ];
 
   buildInputs = [ erlang pam perl ];