public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security.acme: remove loop when no fallbackHost is given

Browse Source
This commit is contained in:
Alexander Ried 2016-09-06 17:45:57 +02:00
parent 7f98dca782
commit e84b803300
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
nixos/modules/services/web-servers/nginx/default.nix
View File

@ -114,17 +114,18 @@ let
port = if vhost.port != null then vhost.port else (if ssl then 443 else 80); port = if vhost.port != null then vhost.port else (if ssl then 443 else 80);
listenString = toString port + optionalString ssl " ssl http2" listenString = toString port + optionalString ssl " ssl http2"
+ optionalString vhost.default " default"; + optionalString vhost.default " default";
acmeLocation = optionalString vhost.enableACME '' acmeLocation = optionalString vhost.enableACME (''
location /.well-known/acme-challenge { location /.well-known/acme-challenge {
try_files $uri @acme-fallback; ${optionalString (vhost.acmeFallbackHost != null) "try_files $uri @acme-fallback;"}
root ${vhost.acmeRoot}; root ${vhost.acmeRoot};
auth_basic off; auth_basic off;
} }
'' + (optionalString (vhost.acmeFallbackHost != null) ''
location @acme-fallback { location @acme-fallback {
auth_basic off; auth_basic off;
proxy_pass http://${vhost.acmeFallbackHost}; proxy_pass http://${vhost.acmeFallbackHost};
} }
''; ''));
in '' in ''
${optionalString vhost.forceSSL '' ${optionalString vhost.forceSSL ''
server { server {

4
nixos/modules/services/web-servers/nginx/vhost-options.nix
View File

@ -39,8 +39,8 @@ with lib;
}; };
acmeFallbackHost = mkOption { acmeFallbackHost = mkOption {
type = types.str; type = types.nullOr types.str;
default = "0.0.0.0"; default = null;
description = '' description = ''
Host which to proxy requests to if acme challenge is not found. Useful Host which to proxy requests to if acme challenge is not found. Useful
if you want multiple hosts to be able to verify the same domain name. if you want multiple hosts to be able to verify the same domain name.