Build documentation of nginx (which is maintained separately from webserver
itself) and make it available both as "nginx-doc" attribute and as "doc" output
of "nginx" derivation.
I'm not sure this is the best way to get these patches, but it's better than `master` (at commit `e9617f553284b170a8b520d051ac1fc1b83cff30` on `nginx` these patches moved into a `nginx` subdirectory, breaking the build unless the patches are cached).
Previously, http_perl_module was disabled by overriding perl=null -- this means
it is impossible to disable http_perl_module in openresty, since openresty
requires perl for its configure scripts.
The primary motivation of this change was to allow third-party modules
to be used with OpenResty, but it also results in a significant
reduction of code duplication.
So far, the Nix store directory was hardcoded and if someone uses a
different Nix store directory the patch won't work. Of course, this is
pretty uncommon, but by not only substituting the store directory but
also the length of it we also save a few calls to ngx_strlen(), which
should save us a few cycles.
Signed-off-by: aszlig <aszlig@nix.build>
This adds the nginx module `ngx_http_proxy_connect_module` which allows
to tunnel HTTPS through an nginx proxy[1].
As this module contained patches for several nginx version, some minor
adjustments were needed:
* Allowed each entry in `nginxModules` to provide patches.
* Added an optional `supports` attribute to ensure that each module can
determine if it supports the currently built nginx version (e.g. stable
1.14 ATM or mainline 1.15 ATM).
[1] https://github.com/chobits/ngx_http_proxy_connect_module
Currently, it seems there is no easy way to override package to add
modules. For example, if we want to add the `ipscrub` module, we can
do:
pkgs.nginxStable.override {
modules = [ pkgs.nginxModules.ipscrub ];
};
But, then, we loose `rtmp`, `dav` and `moreheaders` which are defined
in `all-packages.nix`. With this modification, we can now do:
pkgs.nginxStable.override {
modules = pkg.nginxStable.passthru.modules ++ [ pkgs.nginxModules.ipscrub ];
};
* treewide: http -> https sources
This updates the source urls of all top-level packages from http to
https where possible.
* buildtorrent: fix url and tab -> spaces
This commit permits incantations like `pkgs.nginx.override { gd = null; }` to
produce a slimmed-down nginx.
When used, this functionality removes a pile of stuff from nginx's closure.
The resulting nginx's closure:
$ nix-store -q -R /nix/store/wk3h0a4dmdmjmxkbd0q09iw0wfq0yzpz-nginx-1.10.2 | wc -l
12
$ nix-store -q -R /nix/store/gpcx77anqrj05qz0mrwm7hf4wgxry5py-nginx-1.10.2 | wc -l
24
The following parameters are now available:
* hardeningDisable
To disable specific hardening flags
* hardeningEnable
To enable specific hardening flags
Only the cc-wrapper supports this right now, but these may be reused by
other wrappers, builders or setup hooks.
cc-wrapper supports the following flags:
* fortify
* stackprotector
* pie (disabled by default)
* pic
* strictoverflow
* format
* relro
* bindnow
Dmitry Bogatov