NixOS · Mar 6, 2020 · Mar 7, 2020 · Mar 7, 2020
Showing with 65 additions and 41 deletions.

+14 −6 nixos/modules/services/web-servers/nginx/default.nix

+47 −32 pkgs/servers/grocy/{config-locations.patch → 0001-Define-configs-with-env-vars.patch}

+4 −3 pkgs/servers/grocy/default.nix
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
@@ -87,10 +87,17 @@ let
       ${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"}
 
       ${optionalString (cfg.recommendedTlsSettings) ''
-        ssl_session_cache shared:SSL:42m;
-        ssl_session_timeout 23m;
-        ssl_ecdh_curve secp384r1;
-        ssl_prefer_server_ciphers on;
+        # Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate
+
+        ssl_session_timeout 1d;
+        ssl_session_cache shared:SSL:10m;
+        # Breaks forward secrecy: https://github.com/mozilla/server-side-tls/issues/135
+        ssl_session_tickets off;
+        # We don't enable insecure ciphers by default, so this allows
+        # clients to pick the most performant, per https://github.com/mozilla/server-side-tls/issues/260
+        ssl_prefer_server_ciphers off;
+
+        # OCSP stapling
         ssl_stapling on;
         ssl_stapling_verify on;
       ''}
@@ -487,8 +494,9 @@ in
 
       sslCiphers = mkOption {
         type = types.str;
-        default = "EECDH+aRSA+AESGCM:EDH+aRSA:EECDH+aRSA:+AES256:+AES128:+SHA1:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL";
-        description = "Ciphers to choose from when negotiating tls handshakes.";
+        # Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate
+        default = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+        description = "Ciphers to choose from when negotiating TLS handshakes.";
       };
 
       sslProtocols = mkOption {

diff --git a/pkgs/servers/grocy/config-locations.patch → ...y/0001-Define-configs-with-env-vars.patch b/pkgs/servers/grocy/config-locations.patch → ...y/0001-Define-configs-with-env-vars.patch
@@ -1,8 +1,20 @@
-diff --git a/app.php b/app.php
-index 5f91e4d..09c6010 100644
---- a/app.php
-+++ b/app.php
-@@ -23,7 +23,7 @@ else
+From 931958d8f11cb55f2e88a178a3b828f3c537eba8 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Fri, 6 Mar 2020 23:43:58 +0100
+Subject: [PATCH] Define configs with env vars
+
+---
+ app.php                      | 4 ++--
+ services/DatabaseService.php | 2 +-
+ services/FilesService.php    | 2 +-
+ services/StockService.php    | 2 +-
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/app.php b/app.php
+index af65ad1..4963c28 100644
+--- a/app.php
++++ b/app.php
+@@ -25,7 +25,7 @@ else
  require_once __DIR__ . '/vendor/autoload.php';
 
  // Load config files
@@ -11,46 +23,46 @@ index 5f91e4d..09c6010 100644
  require_once __DIR__ . '/config-dist.php'; // For not in own config defined values we use the default ones
 
  // Definitions for dev/demo/prerelease mode
-@@ -49,7 +49,7 @@ $appContainer = new \Slim\Container([
- 	],
- 	'view' => function($container)
- 	{
--		return new \Slim\Views\Blade(__DIR__ . '/views', GROCY_DATAPATH . '/viewcache');
-+		return new \Slim\Views\Blade(__DIR__ . '/views', getenv('GROCY_CACHE_DIR'));
- 	},
- 	'LoginControllerInstance' => function($container)
- 	{
-diff --git a/services/DatabaseService.php b/services/DatabaseService.php
-index 0bcf9b8..ec45e93 100644
---- a/services/DatabaseService.php
-+++ b/services/DatabaseService.php
-@@ -13,7 +13,7 @@ class DatabaseService
+@@ -50,7 +50,7 @@ $app = AppFactory::create();
+ $container = $app->getContainer();
+ $container->set('view', function(Container $container)
+ {
+-	return new Slim\Views\Blade(__DIR__ . '/views', GROCY_DATAPATH . '/viewcache');
++	return new \Slim\Views\Blade(__DIR__ . '/views', getenv('GROCY_CACHE_DIR'));
+ });
+ $container->set('LoginControllerInstance', function(Container $container)
+ {
+diff --git a/services/DatabaseService.php b/services/DatabaseService.php
+index 23fc7b9..daa1993 100644
+--- a/services/DatabaseService.php
++++ b/services/DatabaseService.php
+@@ -25,7 +25,7 @@ class DatabaseService
  			return GROCY_DATAPATH . '/grocy_' . GROCY_CULTURE . '.db';
  		}
 
 -		return GROCY_DATAPATH . '/grocy.db';
 +		return getenv('GROCY_DB_FILE');
  	}
 
- 	private $DbConnectionRaw;
-diff --git a/services/FilesService.php b/services/FilesService.php
-index 7933b73..f52657e 100644
---- a/services/FilesService.php
-+++ b/services/FilesService.php
-@@ -12,7 +12,7 @@ class FilesService extends BaseService
+     private static $DbConnectionRaw = null;
+diff --git a/services/FilesService.php b/services/FilesService.php
+index cecdae3..357298d 100644
+--- a/services/FilesService.php
++++ b/services/FilesService.php
+@@ -12,7 +12,7 @@ class FilesService extends BaseService
  	{
  		parent::__construct();
- 		
+
 -		$this->StoragePath = GROCY_DATAPATH . '/storage';
 +		$this->StoragePath = getenv('GROCY_STORAGE_DIR');
- 		
+
  		if (!file_exists($this->StoragePath))
  		{
-diff --git a/services/StockService.php b/services/StockService.php
-index d7482ef..d1399a7 100644
---- a/services/StockService.php
-+++ b/services/StockService.php
-@@ -933,7 +933,7 @@ class StockService extends BaseService
+diff --git a/services/StockService.php b/services/StockService.php
+index bfde3fc..53b2245 100644
+--- a/services/StockService.php
++++ b/services/StockService.php
+@@ -934,7 +934,7 @@ class StockService extends BaseService
  			throw new \Exception('No barcode lookup plugin defined');
  		}
 
@@ -59,3 +71,6 @@ index d7482ef..d1399a7 100644
  		if (file_exists($path))
  		{
  			require_once $path;
+-- 
+2.25.0
+
diff --git a/pkgs/servers/grocy/default.nix b/pkgs/servers/grocy/default.nix
@@ -2,19 +2,20 @@
 
 stdenv.mkDerivation rec {
   pname = "grocy";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchurl {
     url = "https://github.com/grocy/grocy/releases/download/v${version}/grocy_${version}.zip";
-    sha256 = "1d4hy495in7p0i4fnhai1yqhjhmblv1g30siggmqpjrzdiiw3bak";
+    sha256 = "1fq1zlxxhpcxj67xxlgf20dia95xcimgnm13cr56sy9f2vjx58m6";
   };
 
   nativeBuildInputs = [ unzip ];
   unpackPhase = ''
     unzip ${src} -d .
   '';
 
-  patches = [ ./config-locations.patch ];
+  patches = [ ./0001-Define-configs-with-env-vars.patch ];
+  patchFlags = [ "--binary" "-p1" ];
 
   dontBuild = true;