Gixy: Nginx Configuration Static Analyzer

Using the nginx module on NixOS[1] and enabling services.nginx.validateConfigFil, which defaults to true, generated nginx configurations will be checked by Gixy[2]. The build will actually fail if Gixy finds any issues.<p>[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;NixOS&#x2F;nixpkgs&#x2F;blob&#x2F;nixos-24.11&#x2F;nixos&#x2F;modules&#x2F;services&#x2F;web-servers&#x2F;nginx&#x2F;default.nix">https:&#x2F;&#x2F;github.com&#x2F;NixOS&#x2F;nixpkgs&#x2F;blob&#x2F;nixos-24.11&#x2F;nixos&#x2F;modu...</a> [2]: <a href="https:&#x2F;&#x2F;github.com&#x2F;NixOS&#x2F;nixpkgs&#x2F;blob&#x2F;nixos-24.11&#x2F;pkgs&#x2F;build-support&#x2F;writers&#x2F;scripts.nix#L973">https:&#x2F;&#x2F;github.com&#x2F;NixOS&#x2F;nixpkgs&#x2F;blob&#x2F;nixos-24.11&#x2F;pkgs&#x2F;build...</a>

Nice work, tons of extra stuff vs the original.<p>Had a thought: imagine if it were a subcommand of nginx (whichever fork will accept it) - that’d give it a much wider audience.<p>Even more impactful would be if analysis always ran at nginx startup. Wouldn’t have to be blocking but getting warned about risks would help more folks configure things more correctly more often.<p>Either way great to have tools to help with correctly configuring the parts of your infra that are exposed to the wild internet.

I already learned one thing regarding add_header<p>Worth the read already. Initially I even thought the analyzer was &#x27;wrong&#x27; but curl tests indeed shows that add_header replaces all, surprisingly to me.<p>Thanks!<p>But I dont really like the installation of a pip&#x2F;python ecosystem but that is just my issue :) I now simply copy the configurations from a python free servers and analyze them.

I have been building a platform [1] which makes it easy to deploy internal tools. Instead of taking the config file approach, it allows you to install each app at a unique location (domain name + url path). Within its location, the app owns all the URLs and can managing request routing without requiring a global config update.<p>The advantage is that new app installations cannot interfere with an existing app. I wrote more about this approach at <a href="https:&#x2F;&#x2F;clace.io&#x2F;blog&#x2F;webserver&#x2F;" rel="nofollow">https:&#x2F;&#x2F;clace.io&#x2F;blog&#x2F;webserver&#x2F;</a><p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;claceio&#x2F;clace">https:&#x2F;&#x2F;github.com&#x2F;claceio&#x2F;clace</a>

nice idea but i get that error when i try to use the docker image (on a nixos env)<p>NameError: name &#x27;SRE_FLAG_TEMPLATE&#x27; is not defined. Did you mean: &#x27;SRE_FLAG_VERBOSE&#x27;?<p>(using the mentioned docker command on README $ docker run --rm -v `pwd`&#x2F;nginx.conf:&#x2F;etc&#x2F;nginx&#x2F;conf&#x2F;nginx.conf getpagespeed&#x2F;gixy &#x2F;etc&#x2F;nginx&#x2F;conf&#x2F;nginx.conf)

NGINX config language grates on me. Whyyy did they have to come up with their own config format? It is so much nicer to configure Caddy with JSON file for example. Probably would also be much easier to statically check things about the config, than having to create a parser for NGINX config (or somehow integrate NGINX&#x27; own parser maybe). Probably the best one can do is either have NGINX at some point offer alternative config that uses JSON, or have some converter from JSON to NGINX config.

Would it be useful or easier to plug in if these were rules developed for platforms such as Semgrep? It looks like they already have an existing nginx ruleset: <a href="https:&#x2F;&#x2F;semgrep.dev&#x2F;p&#x2F;nginx" rel="nofollow">https:&#x2F;&#x2F;semgrep.dev&#x2F;p&#x2F;nginx</a>.<p>They can always use some extra contributions, and would slot into existing tooling within a pipeline.

Great tool! Also, what about apache2, any similar tool suggestions?

uh, I&#x27;m hitting this one <a href="https:&#x2F;&#x2F;github.com&#x2F;dvershinin&#x2F;gixy&#x2F;blob&#x2F;master&#x2F;docs&#x2F;en&#x2F;plugins&#x2F;httpsplitting.md">https:&#x2F;&#x2F;github.com&#x2F;dvershinin&#x2F;gixy&#x2F;blob&#x2F;master&#x2F;docs&#x2F;en&#x2F;plugi...</a><p>how serious is header injection? it sounds pretty serious, is it?

The need for a configuration file analyzer is a good sign your software is overly complex and poorly architected.<p>Configuration files should be self-documenting.<p>Instead nginx taught us that if != if.