https: T6734: Nginx - disable software version reporting

[mwheeler1982]

Change summary

Added new option under "service https" called "no-server-version". This affects the "server_tokens" option in the nginx default site configuration.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T6734

Related PR(s)

How to test / Smoketest result

By default or when this option is not set, the HTTP response headers look like this:

< HTTP/1.1 301 Moved Permanently
< Server: nginx/1.22.1
< Date: Fri, 03 Jan 2025 15:19:18 GMT
< Content-Type: text/html
< Content-Length: 169
< Connection: close
< Location: https://xxx.xxx.xxx.103:80/

When the option is set, the HTTP response headers look like this:

< HTTP/1.1 301 Moved Permanently
< Server: nginx
< Date: Fri, 03 Jan 2025 15:18:48 GMT
< Content-Type: text/html
< Content-Length: 162
< Connection: close
< Location: https://xxx.xxx.xxx.103:80/

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[mwheeler1982]

It doesn't look like the smoke test failure was related to my feature.

[github-actions]

CI integration ❌ failed!

Details

CI logs

• CLI Smoketests (no interfaces) ❌ failed
• CLI Smoketests (interfaces only) ❌ failed
• Config tests 👍 passed
• RAID1 tests 👍 passed
• TPM tests 👍 passed

[c-po]

Wrong indention

[c-po]

@dmbaturin I wonder if we should not always disable this. I see no reason in exposing the webservers version information.

[dmbaturin]

@dmbaturin I wonder if we should not always disable this. I see no reason in exposing the webservers version information.

Interesting question. Maybe it should indeed be the default at least.