[Backport release-25.11] quictls: remove; nginx/angie: remove quic flavors;...

  - The `mime_types_file` setting is now set to `"${pkgs.mailcap}/etc/mime.types"` to prevent errors.

  For a complete list of changes, please see [their announcement](https://blog.prosody.im/prosody-13.0.0-released/).

- HTTP3 support has been enabled in in `nginx`, `openresty`, `angie` and `tengine`. The `nginxQuic` and `angieQuic` package flavors have been removed.

- The `yeahwm` package and `services.xserver.windowManager.yeahwm` module were removed due to the package being broken and unmaintained upstream.

- `services.nixseparatedebuginfod.enable = true;` has been replaced by `services.nixseparatedebuginfod2.enable = true`. If you only use the official binary cache `https://cache.nixos.org` then no further configuration should be needed. If you have other https substituters, you can add them to `services.nixseparatedebuginfod2.subsituters`. SSH substituters are not supported by nixseparatedebuginfod2. Consider running nixseparatedebuginfod2 on the substituter instead, and pointing to it with the new option `environment.debuginfodServers`.

            ${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"}

            ${optionalString cfg.recommendedTlsSettings ''

              # Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate

              # Consider https://ssl-config.mozilla.org/#server=nginx&config=intermediate as the lower bound

              ssl_ecdh_curve X25519:prime256v1:secp384r1;

              ssl_conf_command Groups "X25519MLKEM768:X25519:P-256:P-384";

              ssl_session_timeout 1d;

              ssl_session_cache shared:SSL:10m;

              # Breaks forward secrecy: https://github.com/mozilla/server-side-tls/issues/135

  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib;

  oldHTTP2 = (

    versionOlder cfg.package.version "1.25.1"

    && !(cfg.package.pname == "angie" || cfg.package.pname == "angieQuic")

  );

  oldHTTP2 = (versionOlder cfg.package.version "1.25.1" && !(cfg.package.pname == "angie"));

in

{

          that the nginx team recommends to use the mainline version which

          available in nixpkgs as `nginxMainline`.

          Supported Nginx forks include `angie`, `openresty` and `tengine`.

          For HTTP/3 support use `nginxQuic` or `angieQuic`.

        '';

      };

          '';

        }

        {

          assertion =

            cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic" -> !(cfg.enableQuicBPF);

          message = ''

            services.nginx.enableQuicBPF requires using nginxQuic package,

            which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;` or

            `services.nginx.package = pkgs.angieQuic;`.

          '';

        }

        {

          assertion =

            cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic"

            -> all (host: !host.quic) (attrValues virtualHosts);

          message = ''

            services.nginx.service.virtualHosts.<name>.quic requires using nginxQuic or angie packages,

            which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;` or

            `services.nginx.package = pkgs.angieQuic;`.

          '';

        }

        {

          # The idea is to understand whether there is a virtual host with a listen configuration

          # that requires ACME configuration but has no HTTP listener which will make deterministically fail

          server.wait_for_unit("nginx")

          server.wait_for_open_port(443)

          client.wait_for_unit("network-online.target")

          # Check http connections

          client.succeed("curl --verbose --http3-only https://acme.test | grep 'Hello World!'")

      };

    })

    [

      pkgs.angieQuic

      pkgs.nginxQuic

      pkgs.angie

      pkgs.nginx

    ]

)

    })

    [

      "angie"

      "angieQuic"

      "nginxStable"

      "nginxMainline"

      "nginxQuic"

      "nginxShibboleth"

      "openresty"

      "tengine"

  useLua ? true,

  usePcre ? true,

  withPrometheusExporter ? true,

  sslLibrary ? "quictls",

  sslLibrary ? "openssl",

  stdenv,

  lib,

  fetchurl,

  fetchpatch,

  nixosTests,

  zlib,

  libxcrypt,

  aws-lc,

  libressl,

  openssl,

  quictls,

  wolfssl,

  lua5_4,

  pcre2,

  "aws-lc"

  "libressl"

  "openssl"

  "quictls"

  "wolfssl"

];

let

      aws-lc

      libressl

      openssl

      quictls

      ;

    wolfssl = wolfssl.override {

      variant = "haproxy";