Unverified Commit 6d95c0c8 authored by Martin Weinelt's avatar Martin Weinelt
Browse files

nginxQuic, angieQuic: retire 

> The ngx_http_v3_module module (1.25.0) provides experimental support
> for HTTP/3.

Yes, still experimental, at least in nginx. No mention in angie.

> 0-RTT support requires the OpenSSL library version 3.5.1 or higher.
> Alternatively, BoringSSL, LibreSSL, or QuicTLS libraries can be used to
>  build and run this module.

But OpenSSL gets the first mention and our OpenSSL version right now is
3.6.0.

That means we don't need two more packages to ship nginx built with
QuicTLS which does not yet support PQ crypto right.
parent 146bbcdf

nixos/doc/manual/release-notes/rl-2511.section.md

+2 −0
Original line number Diff line number Diff line
@@ -290,6 +290,8 @@ 
  - The `mime_types_file` setting is now set to `"${pkgs.mailcap}/etc/mime.types"` to prevent errors.

  For a complete list of changes, please see [their announcement](https://blog.prosody.im/prosody-13.0.0-released/).



- HTTP3 support has been enabled in in `nginx`, `openresty`, `angie` and `tengine`. The `nginxQuic` and `angieQuic` package flavors have been removed.



- The `yeahwm` package and `services.xserver.windowManager.yeahwm` module were removed due to the package being broken and unmaintained upstream.



- `services.nixseparatedebuginfod.enable = true;` has been replaced by `services.nixseparatedebuginfod2.enable = true`. If you only use the official binary cache `https://cache.nixos.org` then no further configuration should be needed. If you have other https substituters, you can add them to `services.nixseparatedebuginfod2.subsituters`. SSH substituters are not supported by nixseparatedebuginfod2. Consider running nixseparatedebuginfod2 on the substituter instead, and pointing to it with the new option `environment.debuginfodServers`.

nixos/modules/services/web-servers/nginx/default.nix

+1 −26
Original line number Diff line number Diff line
@@ -573,10 +573,7 @@ let 


  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib;



  oldHTTP2 = (

    versionOlder cfg.package.version "1.25.1"

    && !(cfg.package.pname == "angie" || cfg.package.pname == "angieQuic")

  );

  oldHTTP2 = (versionOlder cfg.package.version "1.25.1" && !(cfg.package.pname == "angie"));

in



{
@@ -778,7 +775,6 @@ in 
          that the nginx team recommends to use the mainline version which

          available in nixpkgs as `nginxMainline`.

          Supported Nginx forks include `angie`, `openresty` and `tengine`.

          For HTTP/3 support use `nginxQuic` or `angieQuic`.

        '';

      };
@@ -1374,27 +1370,6 @@ in 
          '';

        }



        {

          assertion =

            cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic" -> !(cfg.enableQuicBPF);

          message = ''

            services.nginx.enableQuicBPF requires using nginxQuic package,

            which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;` or

            `services.nginx.package = pkgs.angieQuic;`.

          '';

        }



        {

          assertion =

            cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic"

            -> all (host: !host.quic) (attrValues virtualHosts);

          message = ''

            services.nginx.service.virtualHosts.<name>.quic requires using nginxQuic or angie packages,

            which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;` or

            `services.nginx.package = pkgs.angieQuic;`.

          '';

        }



        {

          # The idea is to understand whether there is a virtual host with a listen configuration

          # that requires ACME configuration but has no HTTP listener which will make deterministically fail

nixos/tests/nginx-http3.nix

+2 −2
Original line number Diff line number Diff line
@@ -114,7 +114,7 @@ builtins.listToAttrs ( 
      };

    })

    [

      pkgs.angieQuic

      pkgs.nginxQuic

      pkgs.angie

      pkgs.nginx

    ]

)

nixos/tests/nginx-variants.nix

+0 −2
Original line number Diff line number Diff line
@@ -25,10 +25,8 @@ builtins.listToAttrs ( 
    })

    [

      "angie"

      "angieQuic"

      "nginxStable"

      "nginxMainline"

      "nginxQuic"

      "nginxShibboleth"

      "openresty"

      "tengine"

pkgs/servers/http/angie/default.nix

+6 −11
Original line number Diff line number Diff line
@@ -4,26 +4,21 @@ 
  fetchurl,

  nixosTests,

  withAcme ? false,

  withQuic ? false,

  ...

}@args:



callPackage ../nginx/generic.nix args rec {

  version = "1.10.2";

  pname = if withQuic then "angieQuic" else "angie";

  pname = "angie";



  src = fetchurl {

    url = "https://download.angie.software/files/angie-${version}.tar.gz";

    hash = "sha256-pcKrk33ySoDnhq9WOJIvRuqKc9FhQYPIyQKYrocwlLg=";

  };



  configureFlags =

    lib.optionals withAcme [

  configureFlags = lib.optionals withAcme [

    "--with-http_acme_module"

    "--http-acme-client-path=/var/lib/nginx/acme"

    ]

    ++ lib.optionals withQuic [

      "--with-http_v3_module"

  ];



  preInstall = ''
@@ -39,7 +34,7 @@ callPackage ../nginx/generic.nix args rec { 
  passthru.tests = {

    angie = nixosTests.nginx-variants.angie;

    angie-api = nixosTests.angie-api;

    angie-http3 = nixosTests.nginx-http3.angieQuic;

    angie-http3 = nixosTests.nginx-http3.angie;

  };



  meta = {