@nh2, thanks for your PR! By analyzing the history of the files in this pull request, we identified @globin, @domenkozar and @fadenb to be potential reviewers.

In ferm, I check that the configuration is valid, even before the update is applied to the system.
However I fear this will not work here, because nginx would try to resolve ips during configuration check:
https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/ferm.nix#L14

There have been many attempts at getting this right (see closed PRs), you can find the latest at #24476

There have been many attempts at getting this right (see closed PRs), you can find the latest at #24476

@domenkozar I am confused, this issue is not about reloading without restarting. This issue is about making sure that starting with invalid config file fails before systemd counts the service as running.

@domenkozar Ping, as I cannot reopen this myself apparently.

@GrahamcOfBorg test nginx

Success on x86_64-linux (full log)

webserver: exit status 1
syncing
webserver: running command: sync
webserver: exit status 0
test script finished in 9.83s
cleaning up
killing webserver (pid 593)
vde_switch: EOF on stdin, cleaning up and exiting
vde_switch: Could not remove ctl dir '/tmp/nix-build-vm-test-run-nginx.drv-0/vde1.ctl': Directory not empty
/nix/store/n06m7s6lgdx0hq23nc20mm49fp6hw9y9-vm-test-run-nginx

Success on aarch64-linux (full log)

webserver: exit status 1
syncing
webserver: running command: sync
webserver: exit status 0
test script finished in 17.88s
cleaning up
killing webserver (pid 627)
vde_switch: EOF on stdin, cleaning up and exiting
vde_switch: Could not remove ctl dir '/build/vde1.ctl': Directory not empty
/nix/store/fr2l4vynh8gm24a850l3iwfnf5hcfnbk-vm-test-run-nginx

@volth Agreed -- I think both are useful. The preStart check so that you see if something is wrong if you systemctl start something manually, or somehow configured nginx to load a config file not controlled by nix, and also so that commands like nixops deploy fail loudly (because it doesn't return before preStart is over).

I think we should open another issue to add nix-evaluation-time config checking for nginx, like you did for Varnish.

I think we should open another issue to add nix-evaluation-time config checking for nginx

Done in #35395