nixos/nginx: fix config validation with hostnames in proxy_pass

[symphorien]

Description of changes

There are actually many directives which trigger domain name resolution, so using regexes to "fix" them all does not seem like a good approach. Instead I run a fake dns server that answers all requests with a dummy IP.
Unfortunately libredirect tricks to point nginx to a fake /etc/resolv.conf don't work, because nginx uses getaddrinfo, so it is glibc which reads /etc/resolv.conf, and one cannot fake glibc calls to glibc it seems.
So I use bubblewrap instead, but that requires user namespaces, which are not always available. If this is not the case, and validation fails on dns failure, then we ignore the failure. The goal is that if it builds somewhere, it builds everywhere (use case: heterogenous remote builders). I have not yet tested building without user namespaces.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.05 Release Notes (or backporting 22.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

cc @delroth

[symphorien]

now works with user namespaces disabled

[SuperSandro2000]

There is not an easier way to run config validation?
We are getting into territoriality where the overhead and workarounds are eventually outweighing the benefits.

[SuperSandro2000]

Suggested change

	];
	meta = {
	];
	pythonImportsCheck = [ "fakedns" ];
	meta = {

[SuperSandro2000]

Suggested change

	pythonImportsCheck = [ "dns_messages" ];

[SuperSandro2000]

Suggested change

	doCheck = false;
	# has no tests
	doCheck = false;

[SuperSandro2000]

Suggested change

	{ buildPythonPackage, fetchPypi, lib }:
	buildPythonPackage rec {
	{ buildPythonPackage, fetchPypi, lib }:
	buildPythonPackage rec {

[SuperSandro2000]

Suggested change

	# has no tests
	doCheck = false;
	pythonImportsCheck = [ "cli_formatter" ];

[SuperSandro2000]

Suggested change

	userns=yes;
	$bwrun ${nginxWithResolver} > out 2>&1;
	else
	userns=no;
	echo "user namespaces are not available, dns resolution will fail if required";
	nginx -t -c $(readlink -f ./conf) > out 2>&1 || true;
	userns=yes
	$bwrun ${nginxWithResolver} > out 2>&1
	else
	userns=no
	echo "user namespaces are not available, dns resolution will fail if required"
	nginx -t -c $(readlink -f ./conf) > out 2>&1 || true

[SuperSandro2000]

Suggested change

	validatedConfigFile = pkgs.runCommand "validated-nginx.conf" { nativeBuildInputs = [ cfg.package pkgs.bubblewrap pkgs.fakedns pkgs.getent ]; } ''
	validatedConfigFile = pkgs.runCommand "validated-nginx.conf" {
	nativeBuildInputs = with pkgs; [ cfg.package bubblewrap fakedns getent ];
	} ''

[SuperSandro2000]

Suggested change

	for i in $(seq 1 1000); do
	for i in $(seq 1 30); do

waiting 1000 seconds for that to come up is to long

[SuperSandro2000]

We should use private addresses or if there are some to be not resolveable them.

[symphorien]

I pushed changes which

• solve @Mic92 issue with dhparams
• address some of the stylistic comments of @SuperSandro2000

We are getting into territoriality where the overhead and workarounds are eventually outweighing the benefits.

Yes. I started #205561 because nixcloud-webservice has been doing such a validation since quite a long time, but it turns out it is pretty limited for more diverse configs. I can make it work with what is arguably an ugly pile of hacks. If you think this is too hacky, we can revert introducing the validation. I am also hesitating, other opinions welcome.

[SuperSandro2000]

I can make it work with what is arguably an ugly pile of hacks. If you think this is too hacky, we can revert introducing the validation. I am also hesitating, other opinions welcome.

To be honest the cleanest solution would probably be to change the nginx code to better fit our usecase and try to upstream that.

[symphorien]

TBH, that's not something I'm willing to attempt.

[symphorien]

superseded by #209075