From 6bb20e9b279567d35e2b7af86178eae6b6eeb9cb Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Fri, 21 Nov 2025 22:01:49 -0500 Subject: [PATCH 1/2] chore: remove nginx checks for functionality that always exists TLS 1.3, HTTP2 and GRPC are now standard in all operating systems where Dokku is supported. --- plugins/nginx-vhosts/functions | 70 ++----------------- .../nginx-vhosts/templates/nginx.conf.sigil | 12 ++-- 2 files changed, 8 insertions(+), 74 deletions(-) diff --git a/plugins/nginx-vhosts/functions b/plugins/nginx-vhosts/functions index 1cccc2542..2d190e613 100755 --- a/plugins/nginx-vhosts/functions +++ b/plugins/nginx-vhosts/functions @@ -146,24 +146,6 @@ get_custom_nginx_template() { fi } -is_tls13_available() { - declare desc="detects whether the installed nginx version has TLSv1.3 support" - local NGINX_VERSION="$1" - local MAJOR_VERSION MINOR_VERSION PATCH_VERSION - local HAS_SUPPORT=false - - MAJOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[1]}') - MINOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[2]}') - PATCH_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[3]}') - if [[ "$MAJOR_VERSION" -ge "2" ]]; then - HAS_SUPPORT=true - elif [[ "$MAJOR_VERSION" -eq "1" ]] && [[ "$MINOR_VERSION" -ge "13" ]]; then - HAS_SUPPORT=true - fi - - echo $HAS_SUPPORT -} - is_http2_push_enabled() { declare desc="detects whether the installed nginx version has http2 push support" local NGINX_VERSION="$1" @@ -181,7 +163,7 @@ is_http2_push_enabled() { elif [[ "$MINOR_VERSION" -ge "14" ]]; then HAS_SUPPORT=true fi - if [[ "$MINOR_VERSION" -eq "25" ]]; then + if [[ "$MINOR_VERSION" -ge "25" ]]; then HAS_SUPPORT=false fi fi @@ -189,28 +171,6 @@ is_http2_push_enabled() { echo $HAS_SUPPORT } -is_http2_enabled() { - declare desc="detects whether the installed nginx version has http2 support" - local NGINX_VERSION="$1" - local MAJOR_VERSION MINOR_VERSION PATCH_VERSION - local HAS_SUPPORT=false - - MAJOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[1]}') - MINOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[2]}') - PATCH_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[3]}') - if [[ "$MAJOR_VERSION" -ge "2" ]]; then - HAS_SUPPORT=true - elif [[ "$MAJOR_VERSION" -eq "1" ]]; then - if [[ "$MINOR_VERSION" -eq "11" ]] && [[ "$PATCH_VERSION" -ge "5" ]]; then - HAS_SUPPORT=true - elif [[ "$MINOR_VERSION" -ge "12" ]]; then - HAS_SUPPORT=true - fi - fi - - echo $HAS_SUPPORT -} - is_http2_directive_supported() { declare desc="detects whether the installed nginx version has http2 directive support" local NGINX_VERSION="$1" @@ -233,28 +193,6 @@ is_http2_directive_supported() { echo $HAS_SUPPORT } -is_grpc_enabled() { - declare desc="detects whether the installed nginx version has grpc support" - local NGINX_VERSION="$1" - local MAJOR_VERSION MINOR_VERSION PATCH_VERSION - local HAS_SUPPORT=false - - MAJOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[1]}') - MINOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[2]}') - PATCH_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[3]}') - if [[ "$MAJOR_VERSION" -ge "2" ]]; then - HAS_SUPPORT=true - elif [[ "$MAJOR_VERSION" -eq "1" ]]; then - if [[ "$MINOR_VERSION" -eq "13" ]] && [[ "$PATCH_VERSION" -ge "10" ]]; then - HAS_SUPPORT=true - elif [[ "$MINOR_VERSION" -ge "14" ]]; then - HAS_SUPPORT=true - fi - fi - - echo $HAS_SUPPORT -} - nginx_build_config() { declare desc="build nginx config to proxy app containers using sigil" declare APP="$1" DOKKU_APP_LISTEN_PORT="$2" DOKKU_APP_LISTEN_IP="$3" @@ -343,11 +281,11 @@ nginx_build_config() { NGINX_VERSION="$("$NGINX_LOCATION" -v 2>&1 | cut -d'/' -f 2 | awk '{print $1}')" # DEPRECATED: Remove me at 1.0.0 SPDY_SUPPORTED="false" - TLS13_SUPPORTED="$(is_tls13_available "$NGINX_VERSION")" - HTTP2_SUPPORTED="$(is_http2_enabled "$NGINX_VERSION")" + TLS13_SUPPORTED="true" + HTTP2_SUPPORTED="true" HTTP2_DIRECTIVE_SUPPORTED="$(is_http2_directive_supported "$NGINX_VERSION")" HTTP2_PUSH_SUPPORTED="$(is_http2_push_enabled "$NGINX_VERSION")" - GRPC_SUPPORTED="$(is_grpc_enabled "$NGINX_VERSION")" + GRPC_SUPPORTED="true" local NGINX_LOG_ROOT="$(fn-nginx-log-root)" local NGINX_ACCESS_LOG_FORMAT="$(fn-nginx-computed-access-log-format "$APP")" diff --git a/plugins/nginx-vhosts/templates/nginx.conf.sigil b/plugins/nginx-vhosts/templates/nginx.conf.sigil index 5b5e6c052..8e2ce48f6 100644 --- a/plugins/nginx-vhosts/templates/nginx.conf.sigil +++ b/plugins/nginx-vhosts/templates/nginx.conf.sigil @@ -82,8 +82,8 @@ server { listen {{ if $.NGINX_BIND_ADDRESS_IP4 }}{{ $.NGINX_BIND_ADDRESS_IP4 }}:{{end}}{{ $listen_port }} ssl; http2 on; {{ else }} - listen [{{ $.NGINX_BIND_ADDRESS_IP6 }}]:{{ $listen_port }} ssl {{ if eq $.HTTP2_SUPPORTED "true" }}http2{{ end }}; - listen {{ if $.NGINX_BIND_ADDRESS_IP4 }}{{ $.NGINX_BIND_ADDRESS_IP4 }}:{{end}}{{ $listen_port }} ssl {{ if eq $.HTTP2_SUPPORTED "true" }}http2{{ end }}; + listen [{{ $.NGINX_BIND_ADDRESS_IP6 }}]:{{ $listen_port }} ssl http2; + listen {{ if $.NGINX_BIND_ADDRESS_IP4 }}{{ $.NGINX_BIND_ADDRESS_IP4 }}:{{end}}{{ $listen_port }} ssl http2; {{ end }} {{ if $.SSL_SERVER_NAME }}server_name {{ $.SSL_SERVER_NAME }}; {{ end }} {{ if $.NOSSL_SERVER_NAME }}server_name {{ $.NOSSL_SERVER_NAME }}; {{ end }} @@ -93,7 +93,7 @@ server { ssl_certificate {{ $.APP_SSL_PATH }}/server.crt; ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key; - ssl_protocols TLSv1.2 {{ if eq $.TLS13_SUPPORTED "true" }}TLSv1.3{{ end }}; + ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers off; {{ if $.CLIENT_BODY_TIMEOUT }}client_body_timeout {{ $.CLIENT_BODY_TIMEOUT }};{{end}} @@ -159,7 +159,6 @@ server { include {{ $.DOKKU_ROOT }}/{{ $.APP }}/nginx.conf.d/*.conf; } {{ else if eq $scheme "grpc"}} -{{ if eq $.GRPC_SUPPORTED "true"}}{{ if eq $.HTTP2_SUPPORTED "true"}} server { {{ if eq $.HTTP2_DIRECTIVE_SUPPORTED "true" }} listen [{{ $.NGINX_BIND_ADDRESS_IP6 }}]:{{ $listen_port }}; @@ -180,9 +179,7 @@ server { {{ if $.CLIENT_MAX_BODY_SIZE }}client_max_body_size {{ $.CLIENT_MAX_BODY_SIZE }};{{ end }} include {{ $.DOKKU_ROOT }}/{{ $.APP }}/nginx.conf.d/*.conf; } -{{ end }}{{ end }} {{ else if eq $scheme "grpcs"}} -{{ if eq $.GRPC_SUPPORTED "true"}}{{ if eq $.HTTP2_SUPPORTED "true"}} server { {{ if eq $.HTTP2_DIRECTIVE_SUPPORTED "true" }} listen [{{ $.NGINX_BIND_ADDRESS_IP6 }}]:{{ $listen_port }} ssl; @@ -199,7 +196,7 @@ server { ssl_certificate {{ $.APP_SSL_PATH }}/server.crt; ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key; - ssl_protocols TLSv1.2 {{ if eq $.TLS13_SUPPORTED "true" }}TLSv1.3{{ end }}; + ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers off; location / { @@ -209,7 +206,6 @@ server { {{ if $.CLIENT_MAX_BODY_SIZE }}client_max_body_size {{ $.CLIENT_MAX_BODY_SIZE }};{{ end }} include {{ $.DOKKU_ROOT }}/{{ $.APP }}/nginx.conf.d/*.conf; } -{{ end }}{{ end }} {{ end }} {{ end }} From 05bd2913dd350ff95232dd77215fdc380aab7a90 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Fri, 21 Nov 2025 22:15:48 -0500 Subject: [PATCH 2/2] chore: remove conditionals for variables that always have values --- .../nginx-vhosts/templates/nginx.conf.sigil | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/plugins/nginx-vhosts/templates/nginx.conf.sigil b/plugins/nginx-vhosts/templates/nginx.conf.sigil index 8e2ce48f6..9c200882e 100644 --- a/plugins/nginx-vhosts/templates/nginx.conf.sigil +++ b/plugins/nginx-vhosts/templates/nginx.conf.sigil @@ -13,11 +13,11 @@ server { error_log {{ $.NGINX_ERROR_LOG_PATH }}; underscores_in_headers {{ $.NGINX_UNDERSCORE_IN_HEADERS }}; - {{ if $.CLIENT_BODY_TIMEOUT }}client_body_timeout {{ $.CLIENT_BODY_TIMEOUT }};{{end}} - {{ if $.CLIENT_HEADER_TIMEOUT }}client_header_timeout {{ $.CLIENT_HEADER_TIMEOUT }};{{end}} - {{ if $.KEEPALIVE_TIMEOUT }}keepalive_timeout {{ $.KEEPALIVE_TIMEOUT }};{{end}} - {{ if $.LINGERING_TIMEOUT }}lingering_timeout {{ $.LINGERING_TIMEOUT }};{{end}} - {{ if $.SEND_TIMEOUT }}send_timeout {{ $.SEND_TIMEOUT }};{{end}} + client_body_timeout {{ $.CLIENT_BODY_TIMEOUT }}; + client_header_timeout {{ $.CLIENT_HEADER_TIMEOUT }}; + keepalive_timeout {{ $.KEEPALIVE_TIMEOUT }}; + lingering_timeout {{ $.LINGERING_TIMEOUT }}; + send_timeout {{ $.SEND_TIMEOUT }}; {{ if (and (eq $listen_port "80") ($.SSL_INUSE)) }} include {{ $.DOKKU_ROOT }}/{{ $.APP }}/nginx.conf.d/*.conf; @@ -36,9 +36,9 @@ server { proxy_pass http://{{ $.APP }}-{{ $upstream_port }}; proxy_http_version 1.1; - {{ if $.PROXY_CONNECT_TIMEOUT }}proxy_connect_timeout {{ $.PROXY_CONNECT_TIMEOUT }};{{end}} - {{ if $.PROXY_READ_TIMEOUT }}proxy_read_timeout {{ $.PROXY_READ_TIMEOUT }};{{end}} - {{ if $.PROXY_SEND_TIMEOUT }}proxy_send_timeout {{ $.PROXY_SEND_TIMEOUT }};{{end}} + proxy_connect_timeout {{ $.PROXY_CONNECT_TIMEOUT }}; + proxy_read_timeout {{ $.PROXY_READ_TIMEOUT }}; + proxy_send_timeout {{ $.PROXY_SEND_TIMEOUT }}; proxy_buffer_size {{ $.PROXY_BUFFER_SIZE }}; proxy_buffering {{ $.PROXY_BUFFERING }}; proxy_buffers {{ $.PROXY_BUFFERS }}; @@ -53,7 +53,7 @@ server { {{ if $.PROXY_X_FORWARDED_SSL }}proxy_set_header X-Forwarded-Ssl {{ $.PROXY_X_FORWARDED_SSL }};{{ end }} } - {{ if $.CLIENT_MAX_BODY_SIZE }}client_max_body_size {{ $.CLIENT_MAX_BODY_SIZE }};{{ end }} + client_max_body_size {{ $.CLIENT_MAX_BODY_SIZE }}; error_page 400 401 402 403 405 406 407 408 409 410 411 412 413 414 415 416 417 418 420 422 423 424 426 428 429 431 444 449 450 451 /400-error.html; location /400-error.html { @@ -96,11 +96,11 @@ server { ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers off; - {{ if $.CLIENT_BODY_TIMEOUT }}client_body_timeout {{ $.CLIENT_BODY_TIMEOUT }};{{end}} - {{ if $.CLIENT_HEADER_TIMEOUT }}client_header_timeout {{ $.CLIENT_HEADER_TIMEOUT }};{{end}} - {{ if $.KEEPALIVE_TIMEOUT }}keepalive_timeout {{ $.KEEPALIVE_TIMEOUT }};{{end}} - {{ if $.LINGERING_TIMEOUT }}lingering_timeout {{ $.LINGERING_TIMEOUT }};{{end}} - {{ if $.SEND_TIMEOUT }}send_timeout {{ $.SEND_TIMEOUT }};{{end}} + client_body_timeout {{ $.CLIENT_BODY_TIMEOUT }}; + client_header_timeout {{ $.CLIENT_HEADER_TIMEOUT }}; + keepalive_timeout {{ $.KEEPALIVE_TIMEOUT }}; + lingering_timeout {{ $.LINGERING_TIMEOUT }}; + send_timeout {{ $.SEND_TIMEOUT }}; location / { @@ -114,9 +114,9 @@ server { proxy_pass http://{{ $.APP }}-{{ $upstream_port }}; {{ if eq $.HTTP2_PUSH_SUPPORTED "true" }}http2_push_preload on; {{ end }} proxy_http_version 1.1; - {{ if $.PROXY_CONNECT_TIMEOUT }}proxy_connect_timeout {{ $.PROXY_CONNECT_TIMEOUT }};{{end}} - {{ if $.PROXY_READ_TIMEOUT }}proxy_read_timeout {{ $.PROXY_READ_TIMEOUT }};{{end}} - {{ if $.PROXY_SEND_TIMEOUT }}proxy_send_timeout {{ $.PROXY_SEND_TIMEOUT }};{{end}} + proxy_connect_timeout {{ $.PROXY_CONNECT_TIMEOUT }}; + proxy_read_timeout {{ $.PROXY_READ_TIMEOUT }}; + proxy_send_timeout {{ $.PROXY_SEND_TIMEOUT }}; proxy_buffer_size {{ $.PROXY_BUFFER_SIZE }}; proxy_buffering {{ $.PROXY_BUFFERING }}; proxy_buffers {{ $.PROXY_BUFFERS }}; @@ -131,7 +131,7 @@ server { {{ if $.PROXY_X_FORWARDED_SSL }}proxy_set_header X-Forwarded-Ssl {{ $.PROXY_X_FORWARDED_SSL }};{{ end }} } - {{ if $.CLIENT_MAX_BODY_SIZE }}client_max_body_size {{ $.CLIENT_MAX_BODY_SIZE }};{{ end }} + client_max_body_size {{ $.CLIENT_MAX_BODY_SIZE }}; error_page 400 401 402 403 405 406 407 408 409 410 411 412 413 414 415 416 417 418 420 422 423 424 426 428 429 431 444 449 450 451 /400-error.html; location /400-error.html { @@ -176,7 +176,7 @@ server { grpc_pass grpc://{{ $.APP }}-{{ $upstream_port }}; } - {{ if $.CLIENT_MAX_BODY_SIZE }}client_max_body_size {{ $.CLIENT_MAX_BODY_SIZE }};{{ end }} + client_max_body_size {{ $.CLIENT_MAX_BODY_SIZE }}; include {{ $.DOKKU_ROOT }}/{{ $.APP }}/nginx.conf.d/*.conf; } {{ else if eq $scheme "grpcs"}} @@ -203,7 +203,7 @@ server { grpc_pass grpc://{{ $.APP }}-{{ $upstream_port }}; } - {{ if $.CLIENT_MAX_BODY_SIZE }}client_max_body_size {{ $.CLIENT_MAX_BODY_SIZE }};{{ end }} + client_max_body_size {{ $.CLIENT_MAX_BODY_SIZE }}; include {{ $.DOKKU_ROOT }}/{{ $.APP }}/nginx.conf.d/*.conf; } {{ end }}