nixos/nginx: add build time syntax validation

[gepbird]

Motivation and summary

Simple mistakes like forgetting a ; when writing nginx configs can take down all your sites.

This is because the nginx -t test command is being executed in the preStart of the systemd service. Moving this check to build time avoids these accidental small down times.

Fixes #35395.

Prior work

This has been attempted previously in #205561, but it caused some issues and was reverted in #209075.
The main issues were nginx -t being impure: it tried to access the internet to resolve hosts, and tried to read SSL certificates on the disk, which are not available in the nix sandbox.

(A gixy check was added in #57979, it makes the config fail to build if it finds security issues, but it doesn't detect syntax errors.)

Implementation

To combat the previous issues, I created an nginx patch that adds a new -S flag, which behaves like -T, but is skips the impure checks.

Testing

Manually tested this with our config which has proxyPass option with a remote domain that requires internet access to resolve, and of course we have SSL certificates. Syntax validation passes with the current config, and fails with eg. removing a ;.

I'd be happy to add automatic tests, but not sure what's the best approach. The problem is NixOS tests are for runtime asserts, some lib tests that I've met are eval time, what about build time assertions? Is a bash script (with eg. expect) next to the nginx NixOS test preferred, or converting the build time failure to eval time with IFD (I know it's disallowed for regular uses, not sure about tests)?

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

---

Add a 👍 reaction to pull requests you find important.