Mirrors/dokku
1
0
Fork 0
mirror of https://github.com/dokku/dokku.git synced 2026-05-18 05:05:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: gate ssl_reject_handshake behind nginx 1.19.4

Browse Source 
The shipped catch-all default site uses `ssl_reject_handshake`, which is unsupported on nginx older than 1.19.4 and causes nginx to fail to start on Debian Bullseye. The postinst now detects the installed nginx version and installs an HTTP-only variant of the catch-all on older systems.
This commit is contained in:
Jose Diaz-Gonzalez
2026-05-09 16:32:30 -04:00
parent d00aaf3ff3
commit 392ac73d33
5 changed files with 115 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
debian/postinst vendored
View File

@@ -171,8 +171,28 @@ setup-default-site() {
return
fi
local nginx_bin nginx_version major minor patch
nginx_bin="$(command -v nginx || true)"
if [ -z "$nginx_bin" ]; then
return
fi
nginx_version="$("$nginx_bin" -v 2>&1 | cut -d'/' -f 2 | awk '{print $1}')"
major="$(echo "$nginx_version" | awk -F. '{print $1}')"
minor="$(echo "$nginx_version" | awk -F. '{print $2}')"
patch="$(echo "$nginx_version" | awk -F. '{print $3}')"
# ssl_reject_handshake requires nginx >= 1.19.4; older nginx gets the
# HTTP-only catch-all so the SSL listen lines do not require a cert.
local default_vhost_basename="default-site.conf"
if [ "${major:-0}" -lt 2 ]; then
if [ "${major:-0}" -lt 1 ] || [ "${minor:-0}" -lt 19 ] || { [ "${minor:-0}" -eq 19 ] && [ "${patch:-0}" -lt 4 ]; }; then
default_vhost_basename="default-site-legacy.conf"
fi
fi
local default_vhost_target="/etc/nginx/conf.d/00-default-vhost.conf"
local default_vhost_source="${DOKKU_LIB_ROOT}/core-plugins/available/nginx-vhosts/templates/default-site.conf"
local default_vhost_source="${DOKKU_LIB_ROOT}/core-plugins/available/nginx-vhosts/templates/${default_vhost_basename}"
if [ -e "$default_vhost_target" ]; then
return