about summary refs log tree commit diff
path: root/nixos/modules/services/web-servers
Commit message (Collapse)AuthorAge
* Merge pull request #294542 from Janik-Haag/garageLily Foster2024-03-18
|\ | | | | nixos/garage: add env-var wrapper for admin cli
| * nixos/garage: add env-var wrapper for admin cliJanik H.2024-03-18
| |
* | Merge pull request #282160 from gaykitty/stargazer-debug-modePol Dellaiera2024-03-10
|\ \ | |/ |/| nixos/stargazer: add missing debugMode setting
| * nixos/stargazer: add missing debugMode settinggaykitty2024-03-09
| |
* | nixos/zope2: Remove moduleadisbladis2024-02-18
| | | | | | | | `zope2` is unmaintained and the module is relying on Python2.
* | nixos/garage: allow all available log levels in `cfg.logLevel`emilylange2024-02-13
| | | | | | | | | | | | | | | | | | | | | | `error` and `warn` have always been valid log levels. But because the upstream docs never mentioned those, we simply didn't add them to the enum of our module option. The upstream docs have been updated and now mention `error` and `warn` as well. Upstream PR: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/716
* | Merge pull request #285314 from pbsds/ttyd-1706718068Peder Bergebakken Sundt2024-02-13
|\ \ | | | | | | nixos/ttyd: add `entrypoint` and `writable` option
| * | nixos/ttyd: add entrypoint optionPeder Bergebakken Sundt2024-02-05
| | |
| * | nixos/ttyd: remove `with lib;`Peder Bergebakken Sundt2024-01-31
| | |
| * | nixos/ttyd: add writable optionPeder Bergebakken Sundt2024-01-31
| | | | | | | | | | | | Co-authored-by: Carsten Rodin <19612711+carstoid@users.noreply.github.com>
* | | nixos/nginx: turn auth_request off for ACME challengeRobert Schütz2024-02-05
|/ / | | | | | | This is e.g. necessary when using tailscale-nginx-auth.
* | python311Packages.recursive-pth-loader: rename from recursivePthLoaderFelix Buehler2024-01-25
| |
* | Merge pull request #281904 from Stunkymonkey/ttyd-fix-leakageNick Cao2024-01-21
|\ \ | | | | | | ttyd: add test & use systemd LoadCredential
| * | ttyd: add test & use systemd LoadCredentialFelix Buehler2024-01-20
| |/
* / nixos: fix a bunch of services missing dep on network-online.targetJade Lovelace2024-01-19
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This was done by generating a truly hilarious configuration: rg 'services\.[^.]+\.enable\t' opts-tags | cut -f1 > allonconfig.nix The following were not tested due to other evaluation errors. They should probably be manually audited. services.amule services.castopod services.ceph services.chatgpt-retrieval-plugin services.clamsmtp services.clight services.dante services.dex services.discourse services.dwm-status services.engelsystem services.foundationdb services.frigate services.frp services.grocy services.guacamole-client services.hedgedoc services.home-assistant services.honk services.imaginary services.jitsi-meet services.kerberos_server services.limesurvey services.mastodon services.mediawiki services.mobilizon services.moodle services.mosquitto services.nextcloud services.nullmailer services.patroni services.pfix-srsd services.pgpkeyserver-lite services.postfixadmin services.roundcube services.schleuder services.self-deploy services.slskd services.spacecookie services.statsd services.step-ca services.sympa services.tsmBackup services.vdirsyncer services.vikunja services.yandex-disk services.zabbixWeb
* Merge pull request #270270 from SuperSandro2000/nginx-fastopenRyan Lahfa2024-01-12
|\ | | | | nixos/nginx: filter more options when listening has quic
| * nixos/nginx: filter more options when listening has quicSandro Jäckel2023-12-23
| |
* | Merge pull request #275484 from Izorkin/update-nginx-http3Ryan Lahfa2024-01-12
|\ \ | | | | | | nixos/nginx: disable automatic advertise of HTTP/3 protocol support
| * | nixos/nginx: disable automatic advertise of HTTP/3 protocol supportIzorkin2024-01-01
| | | | | | | | | | | | | | | | | | | | | | | | Automatic advertise in the `http` block about support of HTTP/3 protocol makes it difficult to automatically configure services to work with it. HTTP/3 availability must be manually advertised, preferably in each location block.
* | | Merge pull request #277925 from Izorkin/update-nginx-http2Peder Bergebakken Sundt2024-01-12
|\ \ \ | | | | | | | | nixos/nginx: use new variant of http2 option for angie package
| * | | nixos/nginx: use new variant of http2 option for angie packageIzorkin2023-12-31
| | | |
* | | | nginx: enable ktls support by defaultIzorkin2024-01-01
| |/ / |/| |
* | | nixos/nginx: skip adding a comment to acmeLocation in nginx configurationIzorkin2023-12-30
| | |
* | | nixos/nginx: change position acmeLocation in nginx configurationIzorkin2023-12-30
|/ /
* | angie: init at 1.4.0Izorkin2023-12-17
| |
* | nixos/caddy: also increase socket send buffer size as recommended by upstreamnetworkException2023-12-15
|/ | | | | | | | this patch adjusts the `boot.kernel.sysctl."net.core.wmem_max"` to match the value suggested in the quic-go wiki, just as `"net.core.wmem_max"`. see fdfdc5df21d3df985b751bc61929e2305882dd48 see https://github.com/quic-go/quic-go/issues/3923
* Merge pull request #271506 from Misterio77/nginx-redirect-status-codeRyan Lahfa2023-12-12
|\
| * nixos/nginx: make redirect status code configurableGabriel Fontes2023-12-11
| | | | | | | | | | Add an option to configure which code globalRedirect and forceSSL use. It previously was always 301 with no easy way to override.
* | nixos/nginx: allow return to be an intSandro Jäckel2023-12-08
| |
* | Merge pull request #272542 from Sohalt/caddy-config-fileFlorian Klink2023-12-07
|\ \ | | | | | | nixos/caddy: use caddyfile adapter by default with explicit configFile
| * | nixos/caddy: Use caddyfile adapter by default when explicitly specifying ↵sohalt2023-12-06
| |/ | | | | | | configFile
* / nixos/nginx/tailscale-auth: init modulephaer2023-12-06
|/
* Merge pull request #270847 from anthonyroussel/updates/tomcat_10_1_16Mario Rodas2023-11-30
|\ | | | | tomcat10: 10.1.15 -> 10.1.16
| * nixos/tomcat: add anthonyroussel to maintainersAnthony Roussel2023-11-29
| |
* | treewide: use `mkPackageOption`h7x42023-11-27
|/ | | | | This commit replaces a lot of usages of `mkOption` with the package type, to be `mkPackageOption`, in order to reduce the amount of code.
* nixos/caddy: Fixed RestartSec typo.Jonathan Davies2023-11-24
|
* Merge pull request #265465 from jpds/caddy-restart-on-failureEmily2023-11-19
|\ | | | | nixos/caddy: Set systemd unit to restart on-failure
| * nixos/caddy: Set systemd unit to restart on-failure whilst ignoringJonathan Davies2023-11-06
| | | | | | | | | | | | | | error code 1. This is what's recommended by systemd for long-running services and helps with recovering from crashes.
* | Merge pull request #263550 from anthonyroussel/updates/axis2Mario Rodas2023-11-19
|\ \ | | | | | | axis2: 1.7.9 -> 1.8.2, tomcat10: 10.0.27 -> 10.1.15, tomcat9: 9.0.75 -> 9.0.82
| * | nixos/tomcat: remove `with lib;` and use mkEnableOptionAnthony Roussel2023-11-07
| |/
* | Merge pull request #266270 from Ma27/postgresql-ownership-15Ryan Lahfa2023-11-17
|\ \
| * | nixos/postgresql: drop ensurePermissions, fix ensureUsers for postgresql15Maximilian Bosch2023-11-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes #216989 First of all, a bit of context: in PostgreSQL, newly created users don't have the CREATE privilege on the public schema of a database even with `ALL PRIVILEGES` granted via `ensurePermissions` which is how most of the DB users are currently set up "declaratively"[1]. This means e.g. a freshly deployed Nextcloud service will break early because Nextcloud itself cannot CREATE any tables in the public schema anymore. The other issue here is that `ensurePermissions` is a mere hack. It's effectively a mixture of SQL code (e.g. `DATABASE foo` is relying on how a value is substituted in a query. You'd have to parse a subset of SQL to actually know which object are permissions granted to for a user). After analyzing the existing modules I realized that in every case with a single exception[2] the UNIX system user is equal to the db user is equal to the db name and I don't see a compelling reason why people would change that in 99% of the cases. In fact, some modules would even break if you'd change that because the declarations of the system user & the db user are mixed up[3]. So I decided to go with something new which restricts the ways to use `ensure*` options rather than expanding those[4]. Effectively this means that * The DB user _must_ be equal to the DB name. * Permissions are granted via `ensureDBOwnerhip` for an attribute-set in `ensureUsers`. That way, the user is actually the owner and can perform `CREATE`. * For such a postgres user, a database must be declared in `ensureDatabases`. For anything else, a custom state management should be implemented. This can either be `initialScript`, doing it manual, outside of the module or by implementing proper state management for postgresql[5], but the current state of `ensure*` isn't even declarative, but a convergent tool which is what Nix actually claims to _not_ do. Regarding existing setups: there are effectively two options: * Leave everything as-is (assuming that system user == db user == db name): then the DB user will automatically become the DB owner and everything else stays the same. * Drop the `createDatabase = true;` declarations: nothing will change because a removal of `ensure*` statements is ignored, so it doesn't matter at all whether this option is kept after the first deploy (and later on you'd usually restore from backups anyways). The DB user isn't the owner of the DB then, but for an existing setup this is irrelevant because CREATE on the public schema isn't revoked from existing users (only not granted for new users). [1] not really declarative though because removals of these statements are simply ignored for instance: https://github.com/NixOS/nixpkgs/issues/206467 [2] `services.invidious`: I removed the `ensure*` part temporarily because it IMHO falls into the category "manage the state on your own" (see the commit message). See also https://github.com/NixOS/nixpkgs/pull/265857 [3] e.g. roundcube had `"DATABASE ${cfg.database.username}" = "ALL PRIVILEGES";` [4] As opposed to other changes that are considered a potential fix, but also add more things like collation for DBs or passwords that are _never_ touched again when changing those. [5] As suggested in e.g. https://github.com/NixOS/nixpkgs/issues/206467
* | | Merge master into staging-nextgithub-actions[bot]2023-11-11
|\| |
| * | treewide: fix redirected and broken URLsAnthony Roussel2023-11-11
| |/ | | | | | | Using the script in maintainers/scripts/update-redirected-urls.sh
* | Merge master into staging-nextgithub-actions[bot]2023-10-28
|\|
| * Merge pull request #263203 from nikstur/replace-activationLinus Heckemann2023-10-28
| |\ | | | | | | Replace simple activationScripts
| | * nixos/stargazer: replace activationScript via tmpfilesnikstur2023-10-26
| | |
* | | Merge master into staging-nextgithub-actions[bot]2023-10-28
|\| |
| * | Merge pull request #254386 from erikarvstedt/nginx-js-mime-typeArtturi2023-10-27
| |\ \
| | * | nixos/nginx: add `application/javascript` to `compressMimeTypes`Erik Arvstedt2023-09-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Although deprecated, this MIME type is still used by various applications and web frameworks which are potentially proxied by nginx. Examples: - Apps based on ASP.NET Core - Apps based on http.server (Python)
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-08-07 02:24:37 +0000