[Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set#7343
Open
smpaz7467 wants to merge 1 commit into
Open
[Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set#7343smpaz7467 wants to merge 1 commit into
smpaz7467 wants to merge 1 commit into
Conversation
The HTTP-to-HTTPS redirect server block bound `listen [::]:{{ HTTP_PORT }}
default_server` unconditionally, while every other IPv6 listen directive in
this template is guarded by `{% if ENABLE_IPV6 %}`. On hosts where IPv6 is
disabled at the kernel level, nginx cannot bind `::` and fails to start.
This only triggers when HTTP_REDIRECT is enabled and ENABLE_IPV6 is false,
which is why it survives testing with ENABLE_IPV6=false alone.
Guard the directive like the other six IPv6 listeners in the template.
Refs mailcow#7296
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The HTTP→HTTPS redirect server block in
nginx.conf.j2bindslisten [::]:{{ HTTP_PORT }} default_serverunconditionally, while all sixother IPv6 listen directives in the same template are guarded by
{% if ENABLE_IPV6 %}. On hosts with IPv6 disabled at the kernel level,nginx cannot bind
::and fails to start.It only triggers when
HTTP_REDIRECT=yandENABLE_IPV6=false— which islikely why it went unnoticed: testing
ENABLE_IPV6=falsewith the redirectoff shows nothing wrong.
Verification
Rendered the template with Jinja2 across all four combinations and validated
each output with
nginx -t(nginx:alpine, includes and cert stubbed):listen [::]beforenginx -tBehaviour with
ENABLE_IPV6=trueis unchanged.Scope
Refs #7296
Deliberately limited to the nginx template — the bug in the issue title. The
reporter's follow-up notes that dovecot, php-fpm, postfix and unbound also
hardcode IPv6. Those are not addressed here: nginx is currently the only
service that consumes
ENABLE_IPV6at all, so making the others respect itmeans introducing config templating where none exists today — a design
decision that seems better left to maintainers. (The workarounds in that
comment also hardcode IPv4, e.g.
inet_protocols = ipv4, which would breakIPv6 for everyone else.)
Using
Refsrather thanFixesso the issue stays open for that remaining work.