7 ms·

FWIW gixy (nginx configuration checker) catches this: https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md https://github.com/yandex/gix

FWIW gixy (nginx configuration checker) catches this: https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md https://github.com/yandex/gixy/blob/master/docs/en/plugins/a... (and nixos automatically runs gixy on a configuration generated through it, so the system refuses to build <3)

wredue 3y ago
I just gave nix a go and so far it seems great. But do you know, if they’re a nicer options finder? The one I found where you just search all several thousand options kinda sucks. I want to just see my package (say, ssh) and just the ssh options, but the results get littered with irrelevancy.
- evgpbfhnr 3y ago
  When I roughly know what I'm doing I use search.nixos.org; if you give it the full services.foo prefix it's usually relevant enough, e.g. for ssh you'd want "services.openssh", which you can find skimming through the results of just searching 'ssh' first: https://search.nixos.org/options?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=services.openssh https://search.nixos.org/options?channel=unstable&from=0&siz... For anything I'm not 100% sure will be obvious I search through a local clone of the nixpkgs repo directly, but I'll be honest and say I just never took time to search for a better tool
- JasonSage 3y ago
  My main usage of Nix is on non-NixOS machines, and I use Home Manager, and while it has a similar problem, just searching the options in the packages it provides configuration for is a smaller issue. Not sure if this helps you at all or not, it really depends on your usage of Nix, but for managing user configuration I do recommend Home Manager.
- smoldesu 3y ago
  > if they’re a nicer options finder? https://mynixos.com/ https://mynixos.com/ > I want to just see my package (say, ssh) and just the ssh options https://mynixos.com/nixpkgs/options/programs.ssh https://mynixos.com/nixpkgs/options/programs.ssh
- licebmi__at__ 3y ago
  I would suggest using man and searching like any piece of documentation. Specifically you are looking for `man configuration.nix`
  - SuperSandro2000 3y ago
    That's actually worse search experience and slower because less is struggling with the amount of lines.
- lillecarl 3y ago
  https://mynixos.com/ https://mynixos.com/
- bembo 3y ago
  I found this a few weeks ago: https://github.com/mlvzk/manix https://github.com/mlvzk/manix
GlitchMr 3y ago
NixOS doesn't run Gixy anymore, see https://github.com/NixOS/nixpkgs/pull/209075 https://github.com/NixOS/nixpkgs/pull/209075.
- SuperSandro2000 3y ago
  NixOS core maintainer here. That's about nginx' own test. Gixy is still run when writing any nginx config file with the writer helper function https://github.com/NixOS/nixpkgs/blob/b6cc06826812247fe54655e0d5e49dcde253a72f/pkgs/build-support/writers/default.nix#L230 https://github.com/NixOS/nixpkgs/blob/b6cc06826812247fe54655...
tsak 3y ago
Thank you. I didn't know about gixy and ran it on my home server which found a vulnerability ($uri in a 301 redirect)
BitPirate 3y ago
If a webserver requires additional tools for the user to avoid all these pitfalls, maybe just maybe it should re-evaluate its defaults.
- jgalt212 3y ago
  Yeah, the config checker should be built-in, and if it does not pass, then one must use --force or similar to start the server.
- ndocjdn 3y ago
  But then how will nginx continue to pretend that it is still 1995? nginx was once amazing, but it’s decidedly bad now when compared to modern webservers.
  - nubinetwork 3y ago
    What is a modern webserver? I only use Apache or nginx... anything cobbled together with nodejs or go doesn't count.
    - TheFlyingFish 3y ago
      Caddy has been my default choice recently: https://caddyserver.com https://caddyserver.com Among other things, it features automatic TLS via ACME and dead-simple configuration for my most common use cases: namely, serving a directory of static files and reverse-proxying to an app server. It is written in Go, but I certainly wouldn't describe it as "cobbled together." I'm also a fan of Traefik but it's strictly a reverse proxy, there's not even built-in support for serving static files. But it's great if you have e.g. a bunch of containers on a single host and you want to front them all with a single load balancer.

wredue 3y ago

I just gave nix a go and so far it seems great. But do you know, if they’re a nicer options finder? The one I found where you just search all several thousand options kinda sucks. I want to just see my package (say, ssh) and just the ssh options, but the results get littered with irrelevancy.

evgpbfhnr 3y ago
When I roughly know what I'm doing I use search.nixos.org; if you give it the full services.foo prefix it's usually relevant enough, e.g. for ssh you'd want "services.openssh", which you can find skimming through the results of just searching 'ssh' first: https://search.nixos.org/options?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=services.openssh https://search.nixos.org/options?channel=unstable&from=0&siz... For anything I'm not 100% sure will be obvious I search through a local clone of the nixpkgs repo directly, but I'll be honest and say I just never took time to search for a better tool
JasonSage 3y ago
My main usage of Nix is on non-NixOS machines, and I use Home Manager, and while it has a similar problem, just searching the options in the packages it provides configuration for is a smaller issue. Not sure if this helps you at all or not, it really depends on your usage of Nix, but for managing user configuration I do recommend Home Manager.
smoldesu 3y ago
> if they’re a nicer options finder? https://mynixos.com/ https://mynixos.com/ > I want to just see my package (say, ssh) and just the ssh options https://mynixos.com/nixpkgs/options/programs.ssh https://mynixos.com/nixpkgs/options/programs.ssh
licebmi__at__ 3y ago
I would suggest using man and searching like any piece of documentation. Specifically you are looking for `man configuration.nix`
- SuperSandro2000 3y ago
  That's actually worse search experience and slower because less is struggling with the amount of lines.
lillecarl 3y ago
https://mynixos.com/ https://mynixos.com/
bembo 3y ago
I found this a few weeks ago: https://github.com/mlvzk/manix https://github.com/mlvzk/manix

GlitchMr 3y ago

NixOS doesn't run Gixy anymore, see https://github.com/NixOS/nixpkgs/pull/209075 https://github.com/NixOS/nixpkgs/pull/209075.

SuperSandro2000 3y ago
NixOS core maintainer here. That's about nginx' own test. Gixy is still run when writing any nginx config file with the writer helper function https://github.com/NixOS/nixpkgs/blob/b6cc06826812247fe54655e0d5e49dcde253a72f/pkgs/build-support/writers/default.nix#L230 https://github.com/NixOS/nixpkgs/blob/b6cc06826812247fe54655...

tsak 3y ago

Thank you. I didn't know about gixy and ran it on my home server which found a vulnerability ($uri in a 301 redirect)

BitPirate 3y ago

If a webserver requires additional tools for the user to avoid all these pitfalls, maybe just maybe it should re-evaluate its defaults.

jgalt212 3y ago
Yeah, the config checker should be built-in, and if it does not pass, then one must use --force or similar to start the server.
ndocjdn 3y ago
But then how will nginx continue to pretend that it is still 1995? nginx was once amazing, but it’s decidedly bad now when compared to modern webservers.
- nubinetwork 3y ago
  What is a modern webserver? I only use Apache or nginx... anything cobbled together with nodejs or go doesn't count.
  - TheFlyingFish 3y ago
    Caddy has been my default choice recently: https://caddyserver.com https://caddyserver.com Among other things, it features automatic TLS via ACME and dead-simple configuration for my most common use cases: namely, serving a directory of static files and reverse-proxying to an app server. It is written in Go, but I certainly wouldn't describe it as "cobbled together." I'm also a fan of Traefik but it's strictly a reverse proxy, there's not even built-in support for serving static files. But it's great if you have e.g. a bunch of containers on a single host and you want to front them all with a single load balancer.