From f3e20dbfb08a29a55960f13c9d6f17e5492fda39 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Tue, 23 Aug 2022 13:57:42 +0300 Subject: [PATCH 1/3] nginxModules.brotli: unstable-2020-04-23 -> unstable-2022-04-29 --- pkgs/servers/http/nginx/modules.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix index 64be47874a4..7c3e6255c40 100644 --- a/pkgs/servers/http/nginx/modules.nix +++ b/pkgs/servers/http/nginx/modules.nix @@ -102,15 +102,15 @@ let self = { brotli = { name = "brotli"; - src = let gitsrc = fetchFromGitHub { + src = let src' = fetchFromGitHub { name = "brotli"; owner = "google"; repo = "ngx_brotli"; - rev = "25f86f0bac1101b6512135eac5f93c49c63609e3"; - sha256 = "02hfvfa6milj40qc2ikpb9f95sxqvxk4hly3x74kqhysbdi06hhv"; + rev = "6e975bcb015f62e1f303054897783355e2a877dc"; + sha256 = "sha256-G0IDYlvaQzzJ6cNTSGbfuOuSXFp3RsEwIJLGapTbDgo="; }; in - runCommand "ngx_brotli-src" { } '' - cp -a ${gitsrc} $out + runCommand "brotli" { } '' + cp -a ${src'} $out substituteInPlace $out/filter/config \ --replace '$ngx_addon_dir/deps/brotli/c' ${lib.getDev brotli} ''; From 4a7d0140a081effbf6274fee957049871dcfc8c6 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Tue, 23 Aug 2022 14:07:41 +0300 Subject: [PATCH 2/3] nixos/nginx: add recommended brotli settings --- nixos/modules/services/web-apps/discourse.nix | 2 +- .../services/web-servers/nginx/default.nix | 64 ++++++++++++++++++- 2 files changed, 62 insertions(+), 4 deletions(-) diff --git a/nixos/modules/services/web-apps/discourse.nix b/nixos/modules/services/web-apps/discourse.nix index 1ab0e679a54..b8104ade467 100644 --- a/nixos/modules/services/web-apps/discourse.nix +++ b/nixos/modules/services/web-apps/discourse.nix @@ -820,10 +820,10 @@ in services.nginx = lib.mkIf cfg.nginx.enable { enable = true; - additionalModules = [ pkgs.nginxModules.brotli ]; recommendedTlsSettings = true; recommendedOptimisation = true; + recommendedBrotliSettings = true; recommendedGzipSettings = true; recommendedProxySettings = true; diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 8377e8a76d5..95e600ea79a 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -29,6 +29,43 @@ let ) cfg.virtualHosts; enableIPv6 = config.networking.enableIPv6; + # Mime.types values are taken from brotli sample configuration - https://github.com/google/ngx_brotli + # and Nginx Server Configs - https://github.com/h5bp/server-configs-nginx + compressMimeTypes = [ + "application/atom+xml" + "application/geo+json" + "application/json" + "application/ld+json" + "application/manifest+json" + "application/rdf+xml" + "application/vnd.ms-fontobject" + "application/wasm" + "application/x-rss+xml" + "application/x-web-app-manifest+json" + "application/xhtml+xml" + "application/xliff+xml" + "application/xml" + "font/collection" + "font/otf" + "font/ttf" + "image/bmp" + "image/svg+xml" + "image/vnd.microsoft.icon" + "text/cache-manifest" + "text/calendar" + "text/css" + "text/csv" + "text/html" + "text/javascript" + "text/markdown" + "text/plain" + "text/vcard" + "text/vnd.rim.location.xloc" + "text/vtt" + "text/x-component" + "text/xml" + ]; + defaultFastcgiParams = { SCRIPT_FILENAME = "$document_root$fastcgi_script_name"; QUERY_STRING = "$query_string"; @@ -140,6 +177,16 @@ let ssl_stapling_verify on; ''} + ${optionalString (cfg.recommendedBrotliSettings) '' + brotli on; + brotli_static on; + brotli_comp_level 5; + brotli_window 512k; + brotli_min_length 256; + brotli_types ${lib.concatStringsSep " " compressMimeTypes}; + brotli_buffers 32 8k; + ''} + ${optionalString (cfg.recommendedGzipSettings) '' gzip on; gzip_proxied any; @@ -456,6 +503,16 @@ in ''; }; + recommendedBrotliSettings = mkOption { + default = false; + type = types.bool; + description = lib.mdDoc '' + Enable recommended brotli settings. Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/blob/master/README.md). + + This adds `pkgs.nginxModules.brotli` to `services.nginx.additionalModules`. + ''; + }; + recommendedGzipSettings = mkOption { default = false; type = types.bool; @@ -537,11 +594,10 @@ in additionalModules = mkOption { default = []; type = types.listOf (types.attrsOf types.anything); - example = literalExpression "[ pkgs.nginxModules.brotli ]"; + example = literalExpression "[ pkgs.nginxModules.echo ]"; description = lib.mdDoc '' Additional [third-party nginx modules](https://www.nginx.com/resources/wiki/modules/) - to install. Packaged modules are available in - `pkgs.nginxModules`. + to install. Packaged modules are available in `pkgs.nginxModules`. ''; }; @@ -999,6 +1055,8 @@ in groups = config.users.groups; }) dependentCertNames; + services.nginx.additionalModules = optional cfg.recommendedBrotliSettings pkgs.nginxModules.brotli; + systemd.services.nginx = { description = "Nginx Web Server"; wantedBy = [ "multi-user.target" ]; From a9ad69dee95a684ec6ff26268f2b35d5ddf6f21c Mon Sep 17 00:00:00 2001 From: Izorkin Date: Sat, 3 Dec 2022 09:32:07 +0300 Subject: [PATCH 3/3] nixos/nginx: add release notes for `recommendedBrotliSettings` --- .../doc/manual/from_md/release-notes/rl-2305.section.xml | 8 ++++++++ nixos/doc/manual/release-notes/rl-2305.section.md | 2 ++ 2 files changed, 10 insertions(+) diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml index 23a39a52ab2..2b4fb6fc92f 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml @@ -391,6 +391,14 @@ option. + + + A new option recommendedBrotliSettings has + been added to services.nginx. Learn more + about compression in Brotli format + here. + + Resilio sync secret keys can now be provided using a secrets diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index 3e4f0fd490f..1328f317dbf 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -107,6 +107,8 @@ In addition to numerous new and upgraded packages, this release has the followin - Enabling global redirect in `services.nginx.virtualHosts` now allows one to add exceptions with the `locations` option. +- A new option `recommendedBrotliSettings` has been added to `services.nginx`. Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/blob/master/README.md). + - Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store. - The `firewall` and `nat` module now has a nftables based implementation. Enable `networking.nftables` to use it.