Add an SSL listener to insecure vhosts
It is impossible to specify both a secure and an insecure variety of the same
vhost, as they would need to be on the same hostname. As the only types of
insecure hosts we want are forwards to ACME challenges anyway it makes sense to
allow them over SSL too. Along with a helper nixfiles commit this will fix
access to email over https
Change-Id: I1e3dc3db735c0ccea5a6b7407cda8338ff7cf1e8
diff --git a/nginx.nix b/nginx.nix
index 08dea07..376ed02 100644
--- a/nginx.nix
+++ b/nginx.nix
@@ -91,15 +91,10 @@
value = {
serverAliases = service.extraHosts;
- enableACME = service.secure;
+ enableACME = true;
forceSSL = service.secure;
- listen = [
- {
- addr = "0.0.0.0";
- port = if service.secure then 443 else 80;
- ssl = service.secure;
- }
- ];
+ addSSL = !service.secure;
+ listenAddresses = [ "0.0.0.0" ];
};
}) currentPath service.secure priority
else if service.type == "reverseproxy"