From c61157b7e6512036a7abc04a45df334162b3b111 Mon Sep 17 00:00:00 2001
From: Tristan Helmich <tristan.helmich@gmail.com>
Date: Mon, 1 Feb 2016 17:30:43 +0100
Subject: [PATCH] nginx module: Add dhParams option

---
 nixos/modules/services/web-servers/nginx/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index b74a35f1e9f..e369505fbc3 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -37,6 +37,7 @@ let
       ssl_ciphers ${cfg.sslCiphers};
       ssl_ecdh_curve secp521r1;
       ssl_prefer_server_ciphers on;
+      ${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"}
 
       ssl_stapling on;
       ssl_stapling_verify on;
@@ -204,6 +205,13 @@ in
         description = "Allowed TLS protocol versions.";
       };
 
+      sslDhparam = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = literalExample "/path/to/dhparams.pem";
+        description = "Path to DH parameters file.";
+      };
+
       virtualHosts = mkOption {
         type = types.attrsOf (types.submodule (import ./vhost-options.nix {
           inherit lib;