From 35d76a72aba69108a369478be6cb21914d5075a5 Mon Sep 17 00:00:00 2001
From: Tristan Helmich <tristan.helmich@gmail.com>
Date: Mon, 1 Feb 2016 14:09:13 +0100
Subject: [PATCH] nginx module: Add sslCiphers option

---
 nixos/modules/services/web-servers/nginx/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 75ce9e26a30..b74a35f1e9f 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -34,7 +34,7 @@ let
       ssl_session_cache shared:SSL:42m;
       ssl_session_timeout 23m;
 
-      ssl_ciphers EDH+aRSA+AES256:+AESGCM:ECDHE+aRSA+AES256;
+      ssl_ciphers ${cfg.sslCiphers};
       ssl_ecdh_curve secp521r1;
       ssl_prefer_server_ciphers on;
 
@@ -191,6 +191,12 @@ in
         description = "Show nginx version in headers and error pages";
       };
 
+      sslCiphers = mkOption {
+        type = types.str;
+        default = "EDH+CHACHA20:EDH+AES:EECDHE+CHACHA20:ECDHE+AES:+AES128:-DSS";
+        description = "Ciphers to choose from when negotiating tls handshakes.";
+      };
+
       sslProtocols = mkOption {
         type = types.str;
         default = "TLSv1.2";