nginx: add support for modescurity

pkgs/servers/http/nginx/default.nix

@@ -1,11 +1,13 @@
 { stdenv, fetchurl, fetchFromGitHub, openssl, zlib, pcre, libxml2, libxslt, expat
 , gd, geoip, luajit
+, curl, apr, aprutil, apacheHttpd, yajl, libcap, modsecurity_standalone
 , rtmp ? false
 , fullWebDAV ? false
 , syslog ? false
 , moreheaders ? false
 , echo ? false
-, ngx_lua ? false
+, modsecurity ? false
+, ngx_lua ? modsecurity || false
 , set_misc ? false
 , fluent ? false
 , extraModules ? []
@@ -48,6 +50,8 @@ let
     sha256 = "01wkqhk8mk8jgmzi7jbzmg5kamffx3lmhj5yfwryvnvs6xqs74wn";
   };
 
+  modsecurity-ext = modsecurity_standalone.nginx;
+
   echo-ext = fetchFromGitHub {
     owner = "openresty";
     repo = "echo-nginx-module";
@@ -93,7 +97,8 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ openssl zlib pcre libxml2 libxslt gd geoip
     ] ++ optional fullWebDAV expat
-      ++ optional ngx_lua luajit;
+      ++ optional ngx_lua luajit
+      ++ optionals modsecurity [ curl apr aprutil apacheHttpd yajl ];
 
   LUAJIT_LIB = if ngx_lua then "${luajit}/lib" else "";
   LUAJIT_INC = if ngx_lua then "${luajit}/include/luajit-2.0" else "";
@@ -132,14 +137,17 @@ stdenv.mkDerivation rec {
     ++ optional echo "--add-module=${echo-ext}"
     ++ optional ngx_lua "--add-module=${develkit-ext} --add-module=${lua-ext}"
     ++ optional set_misc "--add-module=${set-misc-ext}"
-    ++ optionals (elem stdenv.system (with platforms; linux ++ freebsd)) 
+    ++ optionals (elem stdenv.system (with platforms; linux ++ freebsd))
         [ "--with-file-aio" "--with-aio_module" ]
     ++ optional fluent "--add-module=${fluentd}"
+    ++ optional modsecurity "--add-module=${modsecurity-ext}/nginx/modsecurity"
     ++ (map (m: "--add-module=${m}") extraModules);
 
 
   additionalFlags = optionalString stdenv.isDarwin "-Wno-error=deprecated-declarations -Wno-error=conditional-uninitialized";
 
+  NIX_CFLAGS_COMPILE = optionalString modsecurity "-I${aprutil}/include/apr-1 -I${apacheHttpd}/include -I${apr}/include/apr-1 -I${yajl}/include";
+
   preConfigure = ''
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${libxml2}/include/libxml2 $additionalFlags"
   '';