From 39d0cfcc10469e7f4f47872e6b391b3a92a06af6 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Wed, 3 Jun 2026 12:15:06 -0300
Subject: [PATCH] Add enableHttp2 flag for sandhole-websites

---
 Dockerfile                        |  2 +-
 nix/modules/sandhole-websites.nix | 25 +++++++++++++++++++++----
 nix/modules/tests/websites.nix    |  2 ++
 npins/sources.json                |  6 +++---
 4 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b1d7ddc..39830dc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Compile application with the official Rust image
-FROM --platform=$BUILDPLATFORM rust:1.95.0-alpine3.23 AS builder
+FROM --platform=$BUILDPLATFORM rust:1.96.0-alpine3.23 AS builder
 ENV PKGCONFIG_SYSROOTDIR=/
 # Add build dependencies and targets
 RUN apk add --no-cache musl-dev libressl-dev perl build-base zig
diff --git a/nix/modules/sandhole-websites.nix b/nix/modules/sandhole-websites.nix
index 89a04c4..92ae7fc 100644
--- a/nix/modules/sandhole-websites.nix
+++ b/nix/modules/sandhole-websites.nix
@@ -88,6 +88,8 @@ in
                 example = "-o ServerAliveInterval=30 -c aes256-gcm@openssh.com";
               };
 
+              enableHttp2 = lib.mkEnableOption "HTTP/2 support";
+
               nginxExtraConfig = lib.mkOption {
                 type = types.str;
                 default = "";
@@ -95,7 +97,7 @@ in
                   These lines go to the end of the NGINX vhost verbatim.
                 '';
                 example = ''
-                  http2 on;
+                  error_page 404 /index.html;
                   rewrite ^/github https://github.com/EpicEric permanent;
                 '';
               };
@@ -132,7 +134,7 @@ in
                 description = ''
                   These lines go to the end of the Autossh arguments verbatim, for use with Sandhole.
                 '';
-                example = "http2";
+                example = "ip-allowlist=10.0.0.0/8,20ff::/16";
               };
             };
           }
@@ -175,7 +177,15 @@ in
                   index = "index.html index.htm";
                   root = "/static";
                 };
-                extraConfig = value.nginxExtraConfig;
+                extraConfig = ''
+                  ${
+                    if value.enableHttp2 && !(lib.hasInfix "http2 on;" value.sandholeExecArguments) then
+                      "http2 on;"
+                    else
+                      ""
+                  }
+                  ${value.nginxExtraConfig}
+                '';
               };
             };
             networking = {
@@ -200,7 +210,14 @@ in
           )
         } \
         -p ${toString value.sandholePort} \
-        ${value.autosshExtraArguments} ${value.sandholeHost} ${value.sandholeExecArguments}
+        ${value.autosshExtraArguments} ${value.sandholeHost} ${
+          if value.enableHttp2 && !(lib.hasInfix "http2" value.sandholeExecArguments) then "http2" else ""
+        } ${
+          if value.enableHttp2 && !(lib.hasInfix "force-https" value.sandholeExecArguments) then
+            "force-https"
+          else
+            ""
+        } ${value.sandholeExecArguments}
       '';
     }) cfg;
   };
diff --git a/nix/modules/tests/websites.nix b/nix/modules/tests/websites.nix
index 70a5d25..e40a5d7 100644
--- a/nix/modules/tests/websites.nix
+++ b/nix/modules/tests/websites.nix
@@ -110,12 +110,14 @@ in
             "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDpmDGLbC68yM87r+fD/aoEimDdnzZtmnZXCnxkIGHMq admin"
           ];
           domains = [ "example.sandhole.nix" ];
+          enableHttp2 = true;
           hostAddress6 = "fc00::2:1";
           localAddress6 = "fc00::2:2";
           autosshExtraArguments = "-o ServerAliveInterval=30 -c aes256-gcm@openssh.com";
           sandholeHost = "192.168.10.10";
           sandholePort = 2222;
           sandholeKeyPath = "/etc/ssh_key";
+          sandholeExecArguments = "http2";
         };
       };
   };
diff --git a/npins/sources.json b/npins/sources.json
index b6002aa..d1c8677 100644
--- a/npins/sources.json
+++ b/npins/sources.json
@@ -28,9 +28,9 @@
       },
       "branch": "master",
       "submodules": false,
-      "revision": "25d75be8139815a53560745fa060909777495105",
-      "url": "https://github.com/oxalica/rust-overlay/archive/25d75be8139815a53560745fa060909777495105.tar.gz",
-      "hash": "sha256-Vqi4AiJVCcBGn/RmBtRCgyH5rCxqm/w0xV9diJWF1Ic="
+      "revision": "40b0a3a193e0840c76174b4a322874c8f6dd0a63",
+      "url": "https://github.com/oxalica/rust-overlay/archive/40b0a3a193e0840c76174b4a322874c8f6dd0a63.tar.gz",
+      "hash": "sha256-aU9nlrS9S+IJ2EiCzsaxzOXUhggogqTrJojBicE6Oeg="
     }
   },
   "version": 7
-- 
2.51.2