uboot: (firmwareOdroidC2/C4) don't invoke patch tool, use patches = [] instead

https://github.com/NixOS/nixpkgs/blob/master/pkgs/stdenv/generic/setup.sh#L948 this can do it nicely. Signed-off-by: Anton Arapov <anton@deadbeef.mx>
2021-04-03 12:58:10 +02:00 · 2021-04-03 12:58:10 +02:00 · 56de2bcd43
commit 56de2bcd43
30691 changed files with 3076956 additions and 0 deletions
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@ -0,0 +1,98 @@
+{ lib, stdenv, fetchurl, perl, zlib, apr, aprutil, pcre2, libiconv, lynx, which
+, nixosTests
+, proxySupport ? true
+, sslSupport ? true, openssl
+, http2Support ? true, nghttp2
+, ldapSupport ? true, openldap
+, libxml2Support ? true, libxml2
+, brotliSupport ? true, brotli
+, luaSupport ? false, lua5
+}:
+
+stdenv.mkDerivation rec {
+  pname = "apache-httpd";
+  version = "2.4.53";
+
+  src = fetchurl {
+    url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
+    sha256 = "sha256-0LvREhpXtfKm/5LXuW+AUMWkXT8U2xGPZJedUlhY22M=";
+  };
+
+  # FIXME: -dev depends on -doc
+  outputs = [ "out" "dev" "man" "doc" ];
+  setOutputFlags = false; # it would move $out/modules, etc.
+
+  nativeBuildInputs = [ which ];
+
+  buildInputs = [ perl ] ++
+    lib.optional brotliSupport brotli ++
+    lib.optional sslSupport openssl ++
+    lib.optional ldapSupport openldap ++    # there is no --with-ldap flag
+    lib.optional libxml2Support libxml2 ++
+    lib.optional http2Support nghttp2 ++
+    lib.optional stdenv.isDarwin libiconv;
+
+  postPatch = ''
+    sed -i config.layout -e "s|installbuilddir:.*|installbuilddir: $dev/share/build|"
+    sed -i support/apachectl.in -e 's|@LYNX_PATH@|${lynx}/bin/lynx|'
+  '';
+
+  # Required for ‘pthread_cancel’.
+  NIX_LDFLAGS = lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
+
+  configureFlags = [
+    "--with-apr=${apr.dev}"
+    "--with-apr-util=${aprutil.dev}"
+    "--with-z=${zlib.dev}"
+    "--with-pcre=${pcre2.dev}/bin/pcre2-config"
+    "--disable-maintainer-mode"
+    "--disable-debugger-mode"
+    "--enable-mods-shared=all"
+    "--enable-mpms-shared=all"
+    "--enable-cern-meta"
+    "--enable-imagemap"
+    "--enable-cgi"
+    "--includedir=${placeholder "dev"}/include"
+    (lib.enableFeature proxySupport "proxy")
+    (lib.enableFeature sslSupport "ssl")
+    (lib.withFeatureAs libxml2Support "libxml2" "${libxml2.dev}/include/libxml2")
+    "--docdir=$(doc)/share/doc"
+
+    (lib.enableFeature brotliSupport "brotli")
+    (lib.withFeatureAs brotliSupport "brotli" brotli)
+
+    (lib.enableFeature http2Support "http2")
+    (lib.withFeature http2Support "nghttp2")
+
+    (lib.enableFeature luaSupport "lua")
+    (lib.withFeatureAs luaSupport "lua" lua5)
+  ];
+
+  enableParallelBuilding = true;
+
+  stripDebugList = [ "lib" "modules" "bin" ];
+
+  postInstall = ''
+    mkdir -p $doc/share/doc/httpd
+    mv $out/manual $doc/share/doc/httpd
+    mkdir -p $dev/bin
+    mv $out/bin/apxs $dev/bin/apxs
+  '';
+
+  passthru = {
+    inherit apr aprutil sslSupport proxySupport ldapSupport luaSupport lua5;
+    tests = {
+      acme-integration = nixosTests.acme;
+      proxy = nixosTests.proxy;
+      php = nixosTests.php.httpd;
+    };
+  };
+
+  meta = with lib; {
+    description = "Apache HTTPD, the world's most popular web server";
+    homepage    = "https://httpd.apache.org/";
+    license     = licenses.asl20;
+    platforms   = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ lovek323 ];
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_auth_mellon/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_auth_mellon/default.nix
@ -0,0 +1,35 @@
+{ lib, stdenv, apacheHttpd, autoconf, automake, autoreconfHook, curl, fetchFromGitHub, glib, lasso, libtool, libxml2, libxslt, openssl, pkg-config, xmlsec }:
+
+stdenv.mkDerivation rec {
+
+  pname = "mod_auth_mellon";
+  version = "0.18.0";
+
+  src = fetchFromGitHub {
+    owner = "latchset";
+    repo = "mod_auth_mellon";
+    rev = "v${version}";
+    sha256 = "0alfa8hz09jdg29bi1mvhwyr2nl0nvss2a2kybrcjvdw1fx6vijn";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config autoconf automake ];
+  buildInputs = [ apacheHttpd curl glib lasso libtool libxml2 libxslt openssl xmlsec ];
+
+  configureFlags = ["--with-apxs2=${apacheHttpd.dev}/bin/apxs" "--exec-prefix=$out"];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ./mellon_create_metadata.sh $out/bin
+    mkdir -p $out/modules
+    cp ./.libs/mod_auth_mellon.so $out/modules
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/latchset/mod_auth_mellon";
+    description = "An Apache module with a simple SAML 2.0 service provider";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ womfoo ];
+  };
+
+}
--- a/pkgs/servers/http/apache-modules/mod_ca/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_ca/default.nix
@ -0,0 +1,35 @@
+{ lib, stdenv, fetchurl, pkg-config, apacheHttpd, openssl, openldap, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_ca";
+  version = "0.2.2";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "0gs66br3aig749rzifxn6j1rz2kps4hc4jppscly48lypgyygy8s";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ apacheHttpd openssl openldap apr aprutil ];
+
+  # Note that configureFlags and installFlags are inherited by
+  # the various submodules.
+  #
+  configureFlags = [
+    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
+  ];
+
+  installFlags = [
+    "INCLUDEDIR=${placeholder "out"}/include"
+    "LIBEXECDIR=${placeholder "out"}/modules"
+  ];
+
+  meta = with lib; {
+    description = "RedWax CA service module";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_crl/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_crl/default.nix
@ -0,0 +1,25 @@
+{ lib, stdenv, fetchurl, pkg-config, mod_ca, apr, aprutil }:
+
+
+stdenv.mkDerivation rec {
+  pname = "mod_crl";
+  version = "0.2.3";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "1x186kp6fr8nwg0jlv5phagxndvw4rjqfga9mkibmn6dx252p61d";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with lib; {
+    description = "RedWax module for Certificate Revocation Lists";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_cspnonce/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_cspnonce/default.nix
@ -0,0 +1,34 @@
+{ stdenv, lib, fetchFromGitHub, apacheHttpd }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_cspnonce";
+  version = "1.3";
+
+  src = fetchFromGitHub {
+    owner = "wyattoday";
+    repo = "mod_cspnonce";
+    rev = version;
+    sha256 = "0kqvxf1dn8r0ywrfiwsxryjrxii2sq11wisbjnm7770sjwckwqh5";
+  };
+
+  buildInputs = [ apacheHttpd ];
+
+  buildPhase = ''
+    apxs -ca mod_cspnonce.c
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/modules
+    cp .libs/mod_cspnonce.so $out/modules
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An Apache2 module that makes it dead simple to add nonce values to the CSP";
+    homepage = "https://github.com/wyattoday/mod_cspnonce";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dasj19 ];
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_csr/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_csr/default.nix
@ -0,0 +1,25 @@
+{ lib, stdenv, fetchurl, pkg-config, mod_ca, apr, aprutil }:
+
+
+stdenv.mkDerivation rec {
+  pname = "mod_csr";
+  version = "0.2.3";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "1p4jc0q40453wpvwqgnr1n007b4jxpkizzy3r4jygsxxgg4x9w7x";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with lib; {
+    description = "RedWax CA service module to handle Certificate Signing Requests";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_dnssd/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_dnssd/default.nix
@ -0,0 +1,44 @@
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, apacheHttpd, apr, avahi }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_dnssd";
+  version = "0.6";
+
+  src = fetchurl {
+    url = "http://0pointer.de/lennart/projects/mod_dnssd/${pname}-${version}.tar.gz";
+    sha256 = "2cd171d76eba398f03c1d5bcc468a1756f4801cd8ed5bd065086e4374997c5aa";
+  };
+
+  configureFlags = [ "--disable-lynx" ];
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ apacheHttpd avahi apr ];
+
+  patches = [ (fetchpatch {
+    url = "http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/vivid/mod-dnssd/vivid/download/package-import%40ubuntu.com-20130530193334-kqebiy78q534or5k/portforapache2.4.pat-20130530222510-7tlw5btqchd04edb-3/port-for-apache2.4.patch";
+    sha256 = "1hgcxwy1q8fsxfqyg95w8m45zbvxzskf1jxd87ljj57l7x1wwp4r";
+  }) ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/modules
+    cp src/.libs/mod_dnssd.so $out/modules
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    # TODO: Packages in non-standard directories not stripped.
+    # https://github.com/NixOS/nixpkgs/issues/141554
+    stripDebugList=modules
+  '';
+
+  meta = with lib; {
+    homepage = "http://0pointer.de/lennart/projects/mod_dnssd";
+    description = "Provide Zeroconf support via DNS-SD using Avahi";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ];
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_fastcgi/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_fastcgi/default.nix
@ -0,0 +1,38 @@
+{ lib, stdenv, fetchFromGitHub, fetchurl, apacheHttpd }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_fastcgi";
+  version = "2.4.7.1";
+
+  src = fetchFromGitHub {
+    owner = "FastCGI-Archives";
+    repo = "mod_fastcgi";
+    rev = version;
+    hash = "sha256-ovir59kCjKkgbraX23nsmzlMzGdeNTyj3MQd8cgvLsg=";
+  };
+
+  buildInputs = [ apacheHttpd ];
+
+  preBuild = ''
+    cp Makefile.AP2 Makefile
+    makeFlags="top_dir=${apacheHttpd.dev}/share prefix=$out"
+  '';
+
+  meta = {
+    homepage = "https://github.com/FastCGI-Archives/mod_fastcgi";
+    description = "Provide support for the FastCGI protocol";
+
+    longDescription = ''
+      mod_fastcgi is a module for the Apache web server that enables
+      FastCGI - a standards based protocol for communicating with
+      applications that generate dynamic content for web pages. FastCGI
+      provides a superset of CGI functionality, but a subset of the
+      functionality of programming for a particular web server API.
+      Nonetheless, the feature set is rich enough for programming
+      virtually any type of web application, but the result is generally
+      more scalable.
+    '';
+
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_itk/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_itk/default.nix
@ -0,0 +1,39 @@
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, mod_ca
+, apr
+, aprutil
+, apacheHttpd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mod_itk";
+  version = "2.4.7-04";
+
+  src = fetchurl {
+    url = "http://mpm-itk.sesse.net/mpm-itk-${version}.tar.gz";
+    sha256 = "sha256:1kzgd1332pgpxf489kr0vdwsaik0y8wp3q282d4wa5jlk7l877v0";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ mod_ca apr aprutil apacheHttpd ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/modules
+    ${apacheHttpd.dev}/bin/apxs -S LIBEXECDIR=$out/modules -i mpm_itk.la
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "an MPM (Multi-Processing Module) for the Apache web server.";
+    maintainers = [ maintainers.zupo ];
+    homepage = "http://mpm-itk.sesse.net/";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_ocsp/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_ocsp/default.nix
@ -0,0 +1,24 @@
+{ lib, stdenv, fetchurl, pkg-config, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_ocsp";
+  version = "0.2.2";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "0wy5363m4gq1w08iny2b3sh925bnznlln88pr9lgj9vgbn8pqnrn";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with lib; {
+    description = "RedWax CA service modules of OCSP Online Certificate Validation";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_perl/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_perl/default.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchurl, apacheHttpd, perl, nixosTests }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_perl";
+  version = "2.0.11";
+
+  src = fetchurl {
+    url = "mirror://apache/perl/${pname}-${version}.tar.gz";
+    sha256 = "0x3gq4nz96y202cymgrf56n8spm7bffkd1p74dh9q3zrrlc9wana";
+  };
+
+  patches = [
+    # Fix build on perl-5.34.0, https://github.com/Perl/perl5/issues/18617
+    ../../../../development/perl-modules/mod_perl2-PL_hash_seed.patch
+  ];
+
+  buildInputs = [ apacheHttpd perl ];
+  buildPhase = ''
+    perl Makefile.PL \
+      MP_APXS=${apacheHttpd.dev}/bin/apxs
+    make
+  '';
+  installPhase = ''
+    mkdir -p $out
+    make install DESTDIR=$out
+    mv $out${apacheHttpd}/* $out
+    mv $out${apacheHttpd.dev}/* $out
+    mv $out${perl}/* $out
+    rm $out/nix -rf
+  '';
+
+  passthru.tests = nixosTests.mod_perl;
+}
--- a/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix
@ -0,0 +1,24 @@
+{ lib, stdenv, fetchurl, pkg-config, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_pkcs12";
+  version = "0.2.2";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "1jfyax3qrw9rpf2n0pn6iw4dpn2nl4j0i2a998n5p1mdmjx9ch73";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with lib; {
+    description = "RedWax CA service modules for PKCS#12 format files";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_python/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_python/default.nix
@ -0,0 +1,36 @@
+{ lib, stdenv, fetchurl, apacheHttpd, python2, libintl }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_python";
+  version = "3.5.0";
+
+  src = fetchurl {
+    url = "http://dist.modpython.org/dist/${pname}-${version}.tgz";
+    sha256 = "146apll3yfqk05s8fkf4acmxzqncl08bgn4rv0c1rd4qxmc91w0f";
+  };
+
+  patches = [ ./install.patch ];
+
+  postPatch = ''
+    substituteInPlace dist/version.sh \
+        --replace 'GIT=`git describe --always`' "" \
+        --replace '-$GIT' ""
+  '';
+
+  installFlags = [ "LIBEXECDIR=${placeholder "out"}/modules" ];
+
+  preInstall = ''
+    mkdir -p $out/modules $out/bin
+  '';
+
+  passthru = { inherit apacheHttpd; };
+
+  buildInputs = [ apacheHttpd python2 ]
+    ++ lib.optional stdenv.isDarwin libintl;
+
+  meta = {
+    homepage = "http://modpython.org/";
+    description = "An Apache module that embeds the Python interpreter within the server";
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_python/install.patch
+++ b/pkgs/servers/http/apache-modules/mod_python/install.patch
@ -0,0 +1,12 @@
+diff -ru -x '*~' mod_python-3.5.0-orig/dist/Makefile.in mod_python-3.5.0/dist/Makefile.in
+--- mod_python-3.5.0-orig/dist/Makefile.in	2013-11-12 04:21:34.000000000 +0100
+++ mod_python-3.5.0/dist/Makefile.in	2014-11-07 11:28:24.466377733 +0100
+@@ -34,7 +34,7 @@
+ install_py_lib: mod_python src
+ 	@cd src; $(MAKE) psp_parser.c
+ 	if test -z "$(DESTDIR)" ; then \
+-		$(PYTHON_BIN) setup.py install --optimize 2 --force ; \
+		$(PYTHON_BIN) setup.py install --optimize 2 --force --prefix $(out) ; \
+ 	else \
+ 		$(PYTHON_BIN) setup.py install --optimize 2 --force --root $(DESTDIR) ; \
+ 	fi
--- a/pkgs/servers/http/apache-modules/mod_scep/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_scep/default.nix
@ -0,0 +1,24 @@
+{ lib, stdenv, fetchurl, pkg-config, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_scep";
+  version = "0.2.3";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "1imddqyi81l90valvndx9r0ywn32ggijrdfrjmbx8j1abaccagrc";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with lib; {
+    description = "RedWax CA service modules for SCEP (Automatic ceritifcate issue/renewal)";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_spkac/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_spkac/default.nix
@ -0,0 +1,24 @@
+{ lib, stdenv, fetchurl, pkg-config, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_spkac";
+  version = "0.2.2";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "0hpr58yazbi21m0sjn22a8ns4h81s4jlab9szcdw7j9w9jdc7j0h";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with lib; {
+    description = "RedWax CA service module for handling the Netscape keygen requests. ";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_tile/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_tile/default.nix
@ -0,0 +1,45 @@
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, apacheHttpd, apr, cairo, iniparser, mapnik }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_tile";
+  version = "unstable-2017-01-08";
+
+  src = fetchFromGitHub {
+    owner = "openstreetmap";
+    repo = "mod_tile";
+    rev = "e25bfdba1c1f2103c69529f1a30b22a14ce311f1";
+    sha256 = "12c96avka1dfb9wxqmjd57j30w9h8yx4y4w34kyq6xnf6lwnkcxp";
+  };
+
+  patches = [
+    # Pull upstream fix for -fno-common toolchains:
+    #  https://github.com/openstreetmap/mod_tile/pull/202
+    (fetchpatch {
+      name = "fno-common";
+      url = "https://github.com/openstreetmap/mod_tile/commit/a22065b8ae3c018820a5ca9bf8e2b2bb0a0bfeb4.patch";
+      sha256 = "1ywfa14xn9aa96vx1adn1ndi29qpflca06x986bx9c5pqk761yz3";
+    })
+  ];
+
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ apacheHttpd apr cairo iniparser mapnik ];
+
+  configureFlags = [
+    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/modules
+    make install-mod_tile DESTDIR=$out
+    mv $out${apacheHttpd}/* $out
+    rm -rf $out/nix
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/openstreetmap/mod_tile";
+    description = "Efficiently render and serve OpenStreetMap tiles using Apache and Mapnik";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ jglukasik ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_timestamp/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_timestamp/default.nix
@ -0,0 +1,24 @@
+{ lib, stdenv, fetchurl, pkg-config, mod_ca, apr, aprutil }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_timestamp";
+  version = "0.2.2";
+
+  src = fetchurl {
+    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    sha256 = "1p18mgxx2ainfrc2wm27rl3lh6yl0ihx6snib60jnp694587bfwg";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ mod_ca apr aprutil ];
+  inherit (mod_ca) configureFlags installFlags;
+
+  meta = with lib; {
+    description = "RedWax CA service module for issuing signed timestamps";
+
+    homepage = "https://redwax.eu";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ dirkx ];
+  };
+}
--- a/pkgs/servers/http/apache-modules/mod_wsgi/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_wsgi/default.nix
@ -0,0 +1,28 @@
+{ lib, stdenv, fetchFromGitHub, apacheHttpd, python, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "mod_wsgi";
+  version = "4.9.0";
+
+  src = fetchFromGitHub {
+    owner = "GrahamDumpleton";
+    repo = "mod_wsgi";
+    rev = version;
+    hash = "sha256-gaWA6m4ENYtm88hCaoqrcIooA0TBI7Kj6fU6pPShoo4=";
+  };
+
+  buildInputs = [ apacheHttpd python ncurses ];
+
+  patchPhase = ''
+    sed -r -i -e "s|^LIBEXECDIR=.*$|LIBEXECDIR=$out/modules|" \
+      ${if stdenv.isDarwin then "-e 's|/usr/bin/lipo|lipo|'" else ""} \
+      configure
+  '';
+
+  meta = {
+    homepage = "https://github.com/GrahamDumpleton/mod_wsgi";
+    description = "Host Python applications in Apache through the WSGI interface";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix
+++ b/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix
@ -0,0 +1,34 @@
+{ lib, stdenv, fetchurl, apacheHttpd, jdk }:
+
+stdenv.mkDerivation rec {
+  pname = "tomcat-connectors";
+  version = "1.2.48";
+
+  src = fetchurl {
+    url = "mirror://apache/tomcat/tomcat-connectors/jk/${pname}-${version}-src.tar.gz";
+    sha256 = "15wfj1mvad15j1fqw67qbpbpwrcz3rb0zdhrq6z2sax1l05kc6yb";
+  };
+
+  configureFlags = [
+    "--with-apxs=${apacheHttpd.dev}/bin/apxs"
+    "--with-java-home=${jdk}"
+  ];
+
+  setSourceRoot = ''
+    sourceRoot=$(echo */native)
+  '';
+
+  installPhase = ''
+    mkdir -p $out/modules
+    cp apache-2.0/mod_jk.so $out/modules
+  '';
+
+  buildInputs = [ apacheHttpd jdk ];
+
+  meta = with lib; {
+    description = "Provides web server plugins to connect web servers with Tomcat";
+    homepage = "https://tomcat.apache.org/download-connectors.cgi";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/servers/http/apt-cacher-ng/default.nix
+++ b/pkgs/servers/http/apt-cacher-ng/default.nix
@ -0,0 +1,36 @@
+{ lib, stdenv
+, bzip2
+, cmake
+, doxygen
+, fetchurl
+, fuse
+, libevent
+, xz
+, openssl
+, pkg-config
+, systemd
+, tcp_wrappers
+, zlib
+, c-ares
+}:
+
+stdenv.mkDerivation rec {
+  pname = "apt-cacher-ng";
+  version = "3.7.4";
+
+  src = fetchurl {
+    url = "https://ftp.debian.org/debian/pool/main/a/apt-cacher-ng/apt-cacher-ng_${version}.orig.tar.xz";
+    sha256 = "0pwsj9rf6a6q7cnfbpcrfq2gjcy7sylqzqqr49g2zi39lrrh8533";
+  };
+
+  nativeBuildInputs = [ cmake doxygen pkg-config ];
+  buildInputs = [ bzip2 fuse libevent xz openssl systemd tcp_wrappers zlib c-ares ];
+
+  meta = with lib; {
+    description = "A caching proxy specialized for Linux distribution files";
+    homepage = "https://www.unix-ag.uni-kl.de/~bloch/acng/";
+    license = licenses.bsdOriginal;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.makefu ];
+  };
+}
--- a/pkgs/servers/http/bozohttpd/0001-include-stdint.h.patch
+++ b/pkgs/servers/http/bozohttpd/0001-include-stdint.h.patch
@ -0,0 +1,12 @@
+diff --git a/libexec/httpd/bozohttpd.c b/libexec/httpd/bozohttpd.c
+index 67083b2c6782..273cb5f5a42b 100644
+--- a/libexec/httpd/bozohttpd.c
+++ b/libexec/httpd/bozohttpd.c
+@@ -138,6 +138,7 @@
+ #include <grp.h>
+ #include <stdarg.h>
+ #include <stdlib.h>
+#include <stdint.h>
+ #include <strings.h>
+ #include <string.h>
+ #include <syslog.h>
--- a/pkgs/servers/http/bozohttpd/0002-dont-use-host-BUFSIZ.patch
+++ b/pkgs/servers/http/bozohttpd/0002-dont-use-host-BUFSIZ.patch
@ -0,0 +1,88 @@
+diff --git a/libexec/httpd/auth-bozo.c b/libexec/httpd/auth-bozo.c
+index a2f2ee4304c1..c9eefe3313dd 100644
+--- a/libexec/httpd/auth-bozo.c
+++ b/libexec/httpd/auth-bozo.c
+@@ -54,7 +54,7 @@ bozo_auth_check(bozo_httpreq_t *request, const char *file)
+ 	bozohttpd_t *httpd = request->hr_httpd;
+ 	struct stat sb;
+ 	char dir[MAXPATHLEN], authfile[MAXPATHLEN], *basename;
+-	char user[BUFSIZ], *pass;
+	char user[BOZO_MINBUFSIZE], *pass;
+ 	FILE *fp;
+ 	int len;
+ 
+@@ -144,7 +144,7 @@ bozo_auth_check_headers(bozo_httpreq_t *request, char *val, char *str,
+ 
+ 	if (strcasecmp(val, "authorization") == 0 &&
+ 	    strncasecmp(str, "Basic ", 6) == 0) {
+-		char	authbuf[BUFSIZ];
+		char	authbuf[BOZO_MINBUFSIZE];
+ 		char	*pass = NULL;
+ 		ssize_t	alen;
+ 
+diff --git a/libexec/httpd/bozohttpd.c b/libexec/httpd/bozohttpd.c
+index 273cb5f5a42b..f619567ba822 100644
+--- a/libexec/httpd/bozohttpd.c
+++ b/libexec/httpd/bozohttpd.c
+@@ -2275,7 +2275,7 @@ bozo_http_error(bozohttpd_t *httpd, int code, bozo_httpreq_t *request,
+ 		}
+ #endif /* !NO_USER_SUPPORT */
+ 
+-		size = snprintf(httpd->errorbuf, BUFSIZ,
+		size = snprintf(httpd->errorbuf, BOZO_MINBUFSIZE,
+ 		    "<html><head><title>%s</title></head>\n"
+ 		    "<body><h1>%s</h1>\n"
+ 		    "%s%s: <pre>%s</pre>\n"
+@@ -2285,10 +2285,10 @@ bozo_http_error(bozohttpd_t *httpd, int code, bozo_httpreq_t *request,
+ 		    user ? user : "", file,
+ 		    reason, hostname, portbuf, hostname, portbuf);
+ 		free(user);
+-		if (size >= (int)BUFSIZ) {
+		if (size >= (int)BOZO_MINBUFSIZE) {
+ 			bozowarn(httpd,
+ 				"bozo_http_error buffer too small, truncated");
+-			size = (int)BUFSIZ;
+			size = (int)BOZO_MINBUFSIZE;
+ 		}
+ 
+ 		if (file_alloc)
+@@ -2515,7 +2515,7 @@ bozo_init_httpd(bozohttpd_t *httpd)
+ 	httpd->mmapsz = BOZO_MMAPSZ;
+ 
+ 	/* error buffer for bozo_http_error() */
+-	if ((httpd->errorbuf = malloc(BUFSIZ)) == NULL) {
+	if ((httpd->errorbuf = malloc(BOZO_MINBUFSIZE)) == NULL) {
+ 		fprintf(stderr,
+ 			"bozohttpd: memory_allocation failure\n");
+ 		return 0;
+diff --git a/libexec/httpd/bozohttpd.h b/libexec/httpd/bozohttpd.h
+index c83bd112d9d7..7b19494cf5ad 100644
+--- a/libexec/httpd/bozohttpd.h
+++ b/libexec/httpd/bozohttpd.h
+@@ -227,6 +227,8 @@ typedef struct bozoprefs_t {
+ /* only allow this many total headers bytes */
+ #define BOZO_HEADERS_MAX_SIZE (16 * 1024)
+ 
+#define BOZO_MINBUFSIZE (4 * 1024)
+
+ /* debug flags */
+ #define DEBUG_NORMAL	1
+ #define DEBUG_FAT	2
+diff --git a/libexec/httpd/testsuite/t10.out b/libexec/httpd/testsuite/t10.out
+index cf410110627c..b3ab88f94fb9 100644
+--- a/libexec/httpd/testsuite/t10.out
+++ b/libexec/httpd/testsuite/t10.out
+@@ -1,8 +1,8 @@
+ HTTP/1.0 404 Not Found
+ Content-Type: text/html
+-Content-Length: 1024
+-Server: bozohttpd/20140708
+Content-Length: 4096
+Server: bozohttpd/20210403
+ 
+ <html><head><title>404 Not Found</title></head>
+ <body><h1>404 Not Found</h1>
+-/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+\ No newline at end of file
+/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+\ No newline at end of file
--- a/pkgs/servers/http/bozohttpd/default.nix
+++ b/pkgs/servers/http/bozohttpd/default.nix
@ -0,0 +1,95 @@
+{ lib
+, stdenv
+, fetchurl
+, bmake
+, groff
+, inetutils
+, wget
+, openssl
+, minimal ? false
+, userSupport ? !minimal
+, cgiSupport ? !minimal
+, dirIndexSupport ? !minimal
+, dynamicContentSupport ? !minimal
+, sslSupport ? !minimal
+, luaSupport ? !minimal
+, lua
+, htpasswdSupport ? !minimal
+}:
+
+let inherit (lib) optional optionals;
+in
+stdenv.mkDerivation rec {
+  pname = "bozohttpd";
+  version = "20210227";
+
+  # bozohttpd is developed in-tree in pkgsrc, canonical hashes can be found at:
+  # http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/www/bozohttpd/distinfo
+  src = fetchurl {
+    url = "http://www.eterna.com.au/${pname}/${pname}-${version}.tar.bz2";
+    sha512 = "b838498626ffb7f7e84f31611e0e99aaa3af64bd9376e1a13ec16313c182eebfd9ea2c2d03904497239af723bf34a3d2202dac1f2d3e55f9fd076f6d45ccfa33";
+  };
+
+  # backport two unreleased commits to fix builds on non-netbsd platforms.
+  patches = [
+    # add missing `#include <stdint.h>`
+    # https://freshbsd.org/netbsd/src/commit/qMGNoXfgeieZBVRC
+    ./0001-include-stdint.h.patch
+
+    # BUFSIZ is not guaranteed to be large enough
+    # https://freshbsd.org/netbsd/src/commit/A4ueIHIp3JgjNVRC
+    ./0002-dont-use-host-BUFSIZ.patch
+  ];
+  patchFlags = [ "-p3" ];
+
+  buildInputs = [ openssl ] ++ optional (luaSupport) lua;
+  nativeBuildInputs = [ bmake groff ];
+
+  COPTS = [
+    "-D_DEFAULT_SOURCE"
+    "-D_GNU_SOURCE"
+
+    # ensure that we can serve >2GB files even on 32-bit systems.
+    "-D_LARGEFILE_SOURCE"
+    "-D_FILE_OFFSET_BITS=64"
+
+    # unpackaged dependency: https://man.netbsd.org/blocklist.3
+    "-DNO_BLOCKLIST_SUPPORT"
+  ]
+  ++ optional (!userSupport) "-DNO_USER_SUPPORT"
+  ++ optional (!dirIndexSupport) "-DNO_DIRINDEX_SUPPORT"
+  ++ optional (!dynamicContentSupport) "-DNO_DYNAMIC_CONTENT"
+  ++ optional (!luaSupport) "-DNO_LUA_SUPPORT"
+  ++ optional (!sslSupport) "-DNO_SSL_SUPPORT"
+  ++ optional (!cgiSupport) "-DNO_CGIBIN_SUPPORT"
+  ++ optional (htpasswdSupport) "-DDO_HTPASSWD";
+
+  _LDADD = [ "-lm" ]
+    ++ optional (stdenv.hostPlatform.libc != "libSystem") "-lcrypt"
+    ++ optional (luaSupport) "-llua"
+    ++ optionals (sslSupport) [ "-lssl" "-lcrypto" ];
+  makeFlags = [ "LDADD=$(_LDADD)" ];
+
+  doCheck = true;
+  checkInputs = [ inetutils wget ];
+  checkFlags = optional (!cgiSupport) "CGITESTS=";
+
+  meta = with lib; {
+    description = "Bozotic HTTP server; small and secure";
+    longDescription = ''
+      bozohttpd is a small and secure HTTP version 1.1 server. Its main
+      feature is the lack of features, reducing the code size and improving
+      verifiability.
+
+      It supports CGI/1.1, HTTP/1.1, HTTP/1.0, HTTP/0.9, ~user translations,
+      virtual hosting support, as well as multiple IP-based servers on a
+      single machine. It is capable of servicing pages via the IPv6 protocol.
+      It has SSL support. It has no configuration file by design.
+    '';
+    homepage = "http://www.eterna.com.au/bozohttpd/";
+    changelog = "http://www.eterna.com.au/bozohttpd/CHANGES";
+    license = licenses.bsd2;
+    maintainers = [ maintainers.embr ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/servers/http/cgiserver/default.nix
+++ b/pkgs/servers/http/cgiserver/default.nix
@ -0,0 +1,21 @@
+{ lib, buildGoModule, fetchzip, zstd }:
+
+buildGoModule rec {
+  pname = "cgiserver";
+  version = "1.0.0";
+
+  src = fetchzip {
+    url = "https://src.anomalous.eu/cgiserver/snapshot/cgiserver-${version}.tar.zst";
+    nativeBuildInputs = [ zstd ];
+    sha256 = "14bp92sw0w6n5dzs4f7g4fcklh25nc9k0xjx4ia0gi7kn5jwx2mq";
+  };
+
+  vendorSha256 = "00jslxzf6p8zs1wxdx3qdb919i80xv4w9ihljd40nnydasshqa4v";
+
+  meta = with lib; {
+    homepage = "https://src.anomalous.eu/cgiserver/about/";
+    description = "Lightweight web server for sandboxing CGI applications";
+    maintainers = with maintainers; [ qyliss ];
+    license = licenses.osl3;
+  };
+}
--- a/pkgs/servers/http/couchdb/3.nix
+++ b/pkgs/servers/http/couchdb/3.nix
@ -0,0 +1,42 @@
+{ lib, stdenv, fetchurl, erlang, icu, openssl, spidermonkey_91
+, coreutils, bash, makeWrapper, python3, nixosTests }:
+
+stdenv.mkDerivation rec {
+  pname = "couchdb";
+  version = "3.2.2";
+
+
+  # when updating this, please consider bumping the erlang/OTP version
+  # in all-packages.nix
+  src = fetchurl {
+    url = "mirror://apache/couchdb/source/${version}/apache-${pname}-${version}.tar.gz";
+    sha256 = "sha256-acn9b4ATNVf2igLpLdpypP1kbWRvQp9Fu4Mpow+C8g4=";
+  };
+
+  buildInputs = [ erlang icu openssl spidermonkey_91 (python3.withPackages(ps: with ps; [ requests ]))];
+  postPatch = ''
+    substituteInPlace src/couch/rebar.config.script --replace '/usr/include/mozjs-91' "${spidermonkey_91.dev}/include/mozjs-91"
+    patchShebangs bin/rebar
+  '';
+
+  dontAddPrefix= "True";
+  configureFlags = ["--spidermonkey-version=91"];
+  buildFlags = ["release"];
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r rel/couchdb/* $out
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) couchdb;
+  };
+
+  meta = with lib; {
+    description = "A database that uses JSON for documents, JavaScript for MapReduce queries, and regular HTTP for an API";
+    homepage = "https://couchdb.apache.org";
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ lostnet ];
+  };
+}
--- a/pkgs/servers/http/darkhttpd/default.nix
+++ b/pkgs/servers/http/darkhttpd/default.nix
@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "darkhttpd";
+  version = "1.13";
+
+  src = fetchFromGitHub {
+    owner = "emikulic";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0w11xq160q9yyffv4mw9ncp1n0dl50d9plmwxb0yijaaxls9i4sk";
+  };
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 -t $out/bin darkhttpd
+    install -Dm444 -t $out/share/doc/${pname} README.md
+    head -n 18 darkhttpd.c > $out/share/doc/${pname}/LICENSE
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Small and secure static webserver";
+    homepage = "https://unix4lyfe.org/darkhttpd/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ bobvanderlinden ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/servers/http/dave/default.nix
+++ b/pkgs/servers/http/dave/default.nix
@ -0,0 +1,28 @@
+{ lib, buildGoPackage, fetchFromGitHub, mage }:
+
+buildGoPackage rec {
+  pname = "dave";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "micromata";
+    repo = "dave";
+    rev = "v${version}";
+    sha256 = "sha256-wvsW4EwMWAgEV+LPeMhHL4AsuyS5TDMmpD9D4F1nVM4=";
+  };
+
+  goPackagePath = "github.com/micromata/dave";
+
+  subPackages = [ "cmd/dave" "cmd/davecli" ];
+
+  ldflags =
+    [ "-s" "-w" "-X main.version=${version}" "-X main.builtBy=nixpkgs" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/micromata/dave";
+    description =
+      "A totally simple and very easy to configure stand alone webdav server";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ lunik1 ];
+  };
+}
--- a/pkgs/servers/http/envoy/bump-brotli.patch
+++ b/pkgs/servers/http/envoy/bump-brotli.patch
@ -0,0 +1,15 @@
+diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
+index 454c54b0ef..2ac0623cf0 100644
+--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
+@@ -510,8 +510,8 @@ REPOSITORY_LOCATIONS_SPEC = dict(
+         project_url = "https://brotli.org",
+         # Use the dev branch of brotli to resolve compilation issues.
+         # TODO(rojkov): Remove when brotli > 1.0.9 is released.
+-        version = "0cd2e3926e95e7e2930f57ae3f4885508d462a25",
+-        sha256 = "93810780e60304b51f2c9645fe313a6e4640711063ed0b860cfa60999dd256c5",
+        version = "27dd7265403d8e8fed99a854b9c3e1db7d79525f",
+        sha256 = "e71238b12e30233bdf25997132b29ae49639a69f33fdef3ae18a47abfc0d5e4c",
+         strip_prefix = "brotli-{version}",
+         urls = ["https://github.com/google/brotli/archive/{version}.tar.gz"],
+         use_category = ["dataplane_ext"],
--- a/pkgs/servers/http/envoy/default.nix
+++ b/pkgs/servers/http/envoy/default.nix
@ -0,0 +1,161 @@
+{ lib
+, bazel_4
+, buildBazelPackage
+, fetchFromGitHub
+, fetchpatch
+, stdenv
+, cmake
+, gn
+, go
+, jdk
+, ninja
+, python3
+, linuxHeaders
+, nixosTests
+
+# v8 (upstream default), wavm, wamr, wasmtime, disabled
+, wasmRuntime ? "wamr"
+}:
+
+let
+  srcVer = {
+    # We need the commit hash, since Bazel stamps the build with it.
+    # However, the version string is more useful for end-users.
+    # These are contained in a attrset of their own to make it obvious that
+    # people should update both.
+    version = "1.21.1";
+    rev = "af50070ee60866874b0a9383daf9364e884ded22";
+  };
+in
+buildBazelPackage rec {
+  pname = "envoy";
+  inherit (srcVer) version;
+  bazel = bazel_4;
+  src = fetchFromGitHub {
+    owner = "envoyproxy";
+    repo = "envoy";
+    inherit (srcVer) rev;
+    hash = "sha256:11mm72zmb479ss585jzqzhklyyqmdadnvr91ghzvjxc0j2a1hrr4";
+
+    postFetch = ''
+      chmod -R +w $out
+      rm $out/.bazelversion
+      echo ${srcVer.rev} > $out/SOURCE_VERSION
+      sed -i 's/GO_VERSION = ".*"/GO_VERSION = "host"/g' $out/bazel/dependency_imports.bzl
+    '';
+  };
+
+  postPatch = ''
+    sed -i 's,#!/usr/bin/env python3,#!${python3}/bin/python,' bazel/foreign_cc/luajit.patch
+    sed -i '/javabase=/d' .bazelrc
+    # Patch paths to build tools, and disable gold because it just segfaults.
+    substituteInPlace bazel/external/wee8.genrule_cmd \
+      --replace '"''$$gn"' '"''$$(command -v gn)"' \
+      --replace '"''$$ninja"' '"''$$(command -v ninja)"' \
+      --replace '"''$$WEE8_BUILD_ARGS"' '"''$$WEE8_BUILD_ARGS use_gold=false"'
+  '';
+
+  patches = [
+    # make linux/tcp.h relative. drop when upgrading to >1.21
+    (fetchpatch {
+      url = "https://github.com/envoyproxy/envoy/commit/68448aae7a78a3123097b6ea96016b270457e7b8.patch";
+      sha256 = "123kv3x37p8fgfp29jhw5xg5js5q5ipibs8hsm7gzfd5bcllnpfh";
+    })
+
+    # fix issues with brotli and GCC 11.2.0+ (-Werror=vla-parameter)
+    ./bump-brotli.patch
+
+    # fix linux-aarch64 WAMR builds
+    # (upstream WAMR only detects aarch64 on Darwin, not Linux)
+    ./fix-aarch64-wamr.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    python3
+    gn
+    go
+    jdk
+    ninja
+  ];
+
+  buildInputs = [
+    linuxHeaders
+  ];
+
+  fetchAttrs = {
+    sha256 = {
+      x86_64-linux = "sha256-23Z6SbKnbah/NCrdMrXhrNFFASd/8xRH3fSyIE++heA=";
+      aarch64-linux = "sha256-dMOu0HYUIUJ+XEtctjaZZ1jGGQq+cHbay8+KwR5XqP0=";
+    }.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
+    dontUseCmakeConfigure = true;
+    dontUseGnConfigure = true;
+    preInstall = ''
+      # Strip out the path to the build location (by deleting the comment line).
+      find $bazelOut/external -name requirements.bzl | while read requirements; do
+        sed -i '/# Generated from /d' "$requirements"
+      done
+
+      # Remove references to paths in the Nix store.
+      sed -i \
+        -e 's,${python3},__NIXPYTHON__,' \
+        -e 's,${stdenv.shellPackage},__NIXSHELL__,' \
+        $bazelOut/external/com_github_luajit_luajit/build.py \
+        $bazelOut/external/local_config_sh/BUILD
+      rm -r $bazelOut/external/go_sdk
+
+      # Remove Unix timestamps from go cache.
+      rm -rf $bazelOut/external/bazel_gazelle_go_repository_cache/{gocache,pkg/mod/cache,pkg/sumdb}
+    '';
+  };
+  buildAttrs = {
+    dontUseCmakeConfigure = true;
+    dontUseGnConfigure = true;
+    dontUseNinjaInstall = true;
+    preConfigure = ''
+      sed -i 's,#!/usr/bin/env bash,#!${stdenv.shell},' $bazelOut/external/rules_foreign_cc/foreign_cc/private/framework/toolchains/linux_commands.bzl
+
+      # Add paths to Nix store back.
+      sed -i \
+        -e 's,__NIXPYTHON__,${python3},' \
+        -e 's,__NIXSHELL__,${stdenv.shellPackage},' \
+        $bazelOut/external/com_github_luajit_luajit/build.py \
+        $bazelOut/external/local_config_sh/BUILD
+    '';
+    installPhase = ''
+      install -Dm0755 bazel-bin/source/exe/envoy-static $out/bin/envoy
+    '';
+  };
+
+  removeRulesCC = false;
+  removeLocalConfigCc = true;
+  removeLocal = false;
+  bazelTarget = "//source/exe:envoy-static";
+  bazelBuildFlags = [
+    "-c opt"
+    "--spawn_strategy=standalone"
+    "--noexperimental_strict_action_env"
+    "--cxxopt=-Wno-maybe-uninitialized"
+    "--cxxopt=-Wno-uninitialized"
+    "--cxxopt=-Wno-error=type-limits"
+
+    "--define=wasm=${wasmRuntime}"
+  ];
+  bazelFetchFlags = [
+    "--define=wasm=${wasmRuntime}"
+  ];
+
+  passthru.tests = {
+    envoy = nixosTests.envoy;
+    # tested as a core component of Pomerium
+    pomerium = nixosTests.pomerium;
+  };
+
+  meta = with lib; {
+    homepage = "https://envoyproxy.io";
+    description = "Cloud-native edge and service proxy";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ lukegb ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+  };
+}
--- a/pkgs/servers/http/envoy/fix-aarch64-wamr.patch
+++ b/pkgs/servers/http/envoy/fix-aarch64-wamr.patch
@ -0,0 +1,38 @@
+diff --git a/bazel/envoy_build_system.bzl b/bazel/envoy_build_system.bzl
+index f48ebe7056..1e5cc5d663 100644
+--- a/bazel/envoy_build_system.bzl
+++ b/bazel/envoy_build_system.bzl
+@@ -102,6 +102,7 @@ def envoy_cmake(
+         pdb_name = "",
+         cmake_files_dir = "$BUILD_TMPDIR/CMakeFiles",
+         generate_crosstool_file = False,
+        generate_args = [],
+         **kwargs):
+     cache_entries.update({"CMAKE_BUILD_TYPE": "Bazel"})
+     cache_entries_debug = dict(cache_entries)
+@@ -131,7 +132,7 @@ def envoy_cmake(
+             "@envoy//bazel:dbg_build": cache_entries_debug,
+             "//conditions:default": cache_entries,
+         }),
+-        generate_args = ["-GNinja"],
+        generate_args = ["-GNinja"] + generate_args,
+         targets = ["", "install"],
+         # TODO: Remove install target and make this work
+         install = False,
+diff --git a/bazel/foreign_cc/BUILD b/bazel/foreign_cc/BUILD
+index 4d3a281669..b4716dfe2e 100644
+--- a/bazel/foreign_cc/BUILD
+++ b/bazel/foreign_cc/BUILD
+@@ -394,6 +394,12 @@ envoy_cmake(
+         "WAMR_BUILD_LIBC_WASI": "0",
+         "WAMR_BUILD_TAIL_CALL": "1",
+     },
+    generate_args = select({
+        "//conditions:default": [],
+        "@platforms//cpu:aarch64": [
+            "-DWAMR_BUILD_TARGET=AARCH64",
+        ],
+    }),
+     lib_source = "@com_github_wamr//:all",
+     out_static_libs = ["libvmlib.a"],
+     tags = ["skip_on_windows"],
--- a/pkgs/servers/http/gatling/default.nix
+++ b/pkgs/servers/http/gatling/default.nix
@ -0,0 +1,32 @@
+{ lib, stdenv, fetchurl, libowfat, libcap, zlib, openssl }:
+
+let
+  version = "0.16";
+in
+stdenv.mkDerivation rec {
+  pname = "gatling";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://www.fefe.de/gatling/${pname}-${version}.tar.xz";
+    sha256 = "0nrnws5qrl4frqcsfa9z973vv5mifgr9z170qbvg3mq1wa7475jz";
+  };
+
+  buildInputs = [ libowfat libcap zlib openssl.dev ];
+
+  configurePhase = ''
+    substituteInPlace Makefile --replace "/usr/local" "$out"
+    substituteInPlace GNUmakefile --replace "/opt/diet" "$out"
+  '';
+
+  buildPhase = ''
+    make gatling
+  '';
+
+  meta = with lib; {
+    description = "A high performance web server";
+    homepage = "http://www.fefe.de/gatling/";
+    license = lib.licenses.gpl2;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/servers/http/gitlab-pages/default.nix
+++ b/pkgs/servers/http/gitlab-pages/default.nix
@ -0,0 +1,24 @@
+{ buildGoModule, lib, fetchFromGitLab }:
+
+buildGoModule rec {
+  pname = "gitlab-pages";
+  version = "1.54.0";
+
+  src = fetchFromGitLab {
+    owner = "gitlab-org";
+    repo = "gitlab-pages";
+    rev = "v${version}";
+    sha256 = "sha256-XPIUDHDoxuRiWar2P6dzPWY7YRn1jDU69TL3ZmGx1AM=";
+  };
+
+  vendorSha256 = "sha256-knW8IiuNGyirHCs8LR3VwWG4hxhWr9SmFzxjdbQ9l+k=";
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Daemon used to serve static websites for GitLab users";
+    homepage = "https://gitlab.com/gitlab-org/gitlab-pages";
+    changelog = "https://gitlab.com/gitlab-org/gitlab-pages/-/blob/v${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ajs124 das_j ];
+  };
+}
--- a/pkgs/servers/http/go-camo/default.nix
+++ b/pkgs/servers/http/go-camo/default.nix
@ -0,0 +1,30 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "go-camo";
+  version = "2.4.0";
+
+  src = fetchFromGitHub {
+    owner = "cactus";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1Wzy5EHFJAPnxusUBvNoJnXyVAx/LiiTgIQZE9r01Lw=";
+  };
+
+  vendorSha256 = "31B6LXCutIdPwxqMFTMUfxAaCuYW14py8Vu1EycBydE=";
+
+  ldflags = [ "-s" "-w" "-X=main.ServerVersion=${version}" ];
+
+  preCheck = ''
+    # requires network access
+    rm pkg/camo/proxy_{,filter_}test.go
+  '';
+
+  meta = with lib; {
+    description = "A camo server is a special type of image proxy that proxies non-secure images over SSL/TLS";
+    homepage = "https://github.com/cactus/go-camo";
+    changelog = "https://github.com/cactus/go-camo/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ viraptor ];
+  };
+}
--- a/pkgs/servers/http/h2o/default.nix
+++ b/pkgs/servers/http/h2o/default.nix
@ -0,0 +1,29 @@
+{ lib, stdenv, fetchFromGitHub
+, pkg-config, cmake, ninja
+, openssl, libuv, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname   = "h2o";
+  version = "2.3.0-beta2";
+
+  src = fetchFromGitHub {
+    owner  = "h2o";
+    repo   = "h2o";
+    rev    = "refs/tags/v${version}";
+    sha256 = "0lwg5sfsr7fw7cfy0hrhadgixm35b5cgcvlhwhbk89j72y1bqi6n";
+  };
+
+  outputs = [ "out" "man" "dev" "lib" ];
+
+  nativeBuildInputs = [ pkg-config cmake ninja ];
+  buildInputs = [ openssl libuv zlib ];
+
+  meta = with lib; {
+    description = "Optimized HTTP/1 and HTTP/2 server";
+    homepage    = "https://h2o.examp1e.net";
+    license     = licenses.mit;
+    maintainers = with maintainers; [ thoughtpolice ];
+    platforms   = platforms.linux;
+  };
+}
--- a/pkgs/servers/http/hiawatha/default.nix
+++ b/pkgs/servers/http/hiawatha/default.nix
@ -0,0 +1,56 @@
+{ lib, stdenv
+, fetchFromGitLab
+
+, cmake
+, ninja
+, mbedtls
+
+, enableCache     ? true     # Internal cache support.
+, enableIpV6      ? true
+, enableTls       ? true
+, enableMonitor   ? false    # Support for the Hiawatha Monitor.
+, enableRproxy    ? true     # Reverse proxy support.
+, enableTomahawk  ? false    # Tomahawk, the Hiawatha command shell.
+, enableXslt      ? true, libxml2 ? null, libxslt ? null
+, enableToolkit   ? true     # The URL Toolkit.
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hiawatha";
+  version = "10.11";
+
+  src = fetchFromGitLab {
+    owner = "hsleisink";
+    repo = "hiawatha";
+    rev = "v${version}";
+    sha256 = "10a7dqj37zrbmgnhwsw0mqm5x25kasl8p95g01rzakviwxkdrkid";
+  };
+
+  nativeBuildInputs = [ cmake ninja ];
+  buildInputs = [ mbedtls ] ++ lib.optionals enableXslt [ libxslt libxml2 ];
+
+  prePatch = ''
+    substituteInPlace CMakeLists.txt --replace SETUID ""
+  '';
+
+  cmakeFlags = [
+    "-DUSE_SYSTEM_MBEDTLS=on" # Policy to use Nix deps, and Nix uses up to date deps
+    ( if enableCache     then "-DENABLE_CACHE=on"       else "-DENABLE_CACHE=off"       )
+    ( if enableIpV6      then "-DENABLE_IPV6=on"        else "-DENABLE_IPV6=off"        )
+    ( if enableTls       then "-DENABLE_TLS=on"         else "-DENABLE_TLS=off"         )
+    ( if enableMonitor   then "-DENABLE_MONITOR=on"     else "-DENABLE_MONITOR=off"     )
+    ( if enableRproxy    then "-DENABLE_RPROXY=on"      else "-DENABLE_RPROXY=off"      )
+    ( if enableTomahawk  then "-DENABLE_TOMAHAWK=on"    else "-DENABLE_TOMAHAWK=off"    )
+    ( if enableXslt      then "-DENABLE_XSLT=on"        else "-DENABLE_XSLT=off"        )
+    ( if enableToolkit   then "-DENABLE_TOOLKIT=on"     else "-DENABLE_TOOLKIT=off"     )
+  ];
+
+  meta = with lib; {
+    homepage = "https://www.hiawatha-webserver.org";
+    description = "An advanced and secure webserver";
+    license = licenses.gpl2;
+    platforms = platforms.unix;    # "Hiawatha runs perfectly on Linux, BSD and MacOS X"
+    maintainers = [];
+  };
+
+}
--- a/pkgs/servers/http/hyp/default.nix
+++ b/pkgs/servers/http/hyp/default.nix
@ -0,0 +1,19 @@
+{ lib, fetchurl, python3Packages }:
+
+python3Packages.buildPythonPackage rec {
+  pname = "hyp-server";
+  version = "1.2.0";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "1lafjdcn9nnq6xc3hhyizfwh6l69lc7rixn6dx65aq71c913jc15";
+  };
+
+  meta = with lib; {
+    description = "Hyperminimal https server";
+    homepage    = "https://github.com/rnhmjoj/hyp";
+    license     = with licenses; [gpl3Plus mit];
+    maintainers = with maintainers; [ rnhmjoj ];
+    platforms   = platforms.unix;
+  };
+}
--- a/pkgs/servers/http/jboss/default.nix
+++ b/pkgs/servers/http/jboss/default.nix
@ -0,0 +1,27 @@
+{ lib, stdenv, fetchurl, jdk }:
+
+stdenv.mkDerivation rec {
+  pname = "jboss-as";
+  version = "7.1.1.Final";
+  src = fetchurl {
+    url = "https://download.jboss.org/jbossas/${lib.versions.majorMinor version}/jboss-as-${version}/jboss-as-${version}.tar.gz";
+    sha256 = "1bdjw0ib9qr498vpfbg8klqw6rl11vbz7vwn6gp1r5gpqkd3zzc8";
+  };
+
+  installPhase = ''
+    mv $PWD $out
+    find $out/bin -name \*.sh -print0 | xargs -0 sed -i -e '/#!\/bin\/sh/aJAVA_HOME=${jdk}'
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.jboss.org/";
+    description = "Open Source J2EE application server";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    license = licenses.lgpl21;
+    maintainers = [ maintainers.sander ];
+    platforms = platforms.unix;
+    knownVulnerabilities = [
+      "CVE-2015-7501: remote code execution in apache-commons-collections: InvokerTransformer during deserialisation"
+    ];
+  };
+}
--- a/pkgs/servers/http/jboss/jdbc/mysql/default.nix
+++ b/pkgs/servers/http/jboss/jdbc/mysql/default.nix
@ -0,0 +1,22 @@
+{ lib, stdenv, mysql_jdbc }:
+
+stdenv.mkDerivation {
+  pname = "jboss-mysql-jdbc";
+  inherit (mysql_jdbc) version;
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/server/default/lib
+    ln -s $mysql_jdbc/share/java/mysql-connector-java.jar $out/server/default/lib/mysql-connector-java.jar
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    inherit (mysql_jdbc.meta) description license platforms homepage;
+    maintainers = with maintainers; [ ];
+  };
+}
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/servers/http/jetty/default.nix
@ -0,0 +1,26 @@
+{ lib, stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "jetty";
+  version = "11.0.8";
+  src = fetchurl {
+    url = "mirror://maven/org/eclipse/jetty/jetty-home/${version}/jetty-home-${version}.tar.gz";
+    sha256 = "sha256-fHd0o5f+WLdbDK1nmSnHNKjDO0mV7+vkPs4zVEaqeyw=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out
+    mv etc lib modules start.jar $out
+  '';
+
+  meta = with lib; {
+    description = "A Web server and javax.servlet container";
+    homepage = "https://www.eclipse.org/jetty/";
+    platforms = platforms.all;
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    license = with licenses; [ asl20 epl10 ];
+    maintainers = with maintainers; [ emmanuelrosa ];
+  };
+}
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@ -0,0 +1,90 @@
+{ lib, stdenv, buildPackages, fetchurl, pkg-config, pcre2, libxml2, zlib, bzip2, which, file
+, fetchpatch
+, openssl
+, enableDbi ? false, libdbi
+, enableMagnet ? false, lua5_1
+, enableMysql ? false, libmysqlclient
+, enableLdap ? false, openldap
+, enablePam ? false, linux-pam
+, enableSasl ? false, cyrus_sasl
+, enableWebDAV ? false, sqlite, libuuid
+, enableExtendedAttrs ? false, attr
+, perl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lighttpd";
+  version = "1.4.64";
+
+  src = fetchurl {
+    url = "https://download.lighttpd.net/lighttpd/releases-${lib.versions.majorMinor version}.x/${pname}-${version}.tar.xz";
+    sha256 = "sha256-4Uidn6dJb78uBxwzi1k7IwDTjCPx5ZZ+UsnvSC4bDiY=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "macos-10.12-avoid-ccrandomgeneratebytes.patch";
+      url = "https://redmine.lighttpd.net/projects/lighttpd/repository/14/revisions/6791f71b20a127b5b0091020dd065f4f9c7cafb6/diff?format=diff";
+      sha256 = "1x5ybkvxwinl7s1nv3rrc57m4mj38q0gbyjp1ijr4w5lhabw4vzs";
+    })
+  ];
+
+  postPatch = ''
+    patchShebangs tests
+    # Linux sandbox has an empty hostname and not /etc/hosts, which fails some tests
+    sed -ire '/[$]self->{HOSTNAME} *=/i     if(length($name)==0) { $name = "127.0.0.1" }' tests/LightyTest.pm
+    # it's difficult to prevent this test from trying to use /var/tmp (which
+    # the sandbox doesn't have) so until libredirect has support for mkstemp
+    # calls it's easiest to disable it
+    sed -i '/test_mod_ssi/d' src/t/test_mod.c
+  '';
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ pcre2 pcre2.dev libxml2 zlib bzip2 which file openssl ]
+             ++ lib.optional enableDbi libdbi
+             ++ lib.optional enableMagnet lua5_1
+             ++ lib.optional enableMysql libmysqlclient
+             ++ lib.optional enableLdap openldap
+             ++ lib.optional enablePam linux-pam
+             ++ lib.optional enableSasl cyrus_sasl
+             ++ lib.optional enableWebDAV sqlite
+             ++ lib.optional enableWebDAV libuuid;
+
+  configureFlags = [ "--with-openssl" ]
+                ++ lib.optional enableDbi "--with-dbi"
+                ++ lib.optional enableMagnet "--with-lua"
+                ++ lib.optional enableMysql "--with-mysql"
+                ++ lib.optional enableLdap "--with-ldap"
+                ++ lib.optional enablePam "--with-pam"
+                ++ lib.optional enableSasl "--with-sasl"
+                ++ lib.optional enableWebDAV "--with-webdav-props"
+                ++ lib.optional enableWebDAV "--with-webdav-locks"
+                ++ lib.optional enableExtendedAttrs "--with-attr";
+
+  preConfigure = ''
+    export PATH=$PATH:${pcre2.dev}/bin
+    sed -i "s:/usr/bin/file:${file}/bin/file:g" configure
+  '';
+
+  checkInputs = [ perl ];
+  doCheck = true;
+
+  postInstall = ''
+    mkdir -p "$out/share/lighttpd/doc/config"
+    cp -vr doc/config "$out/share/lighttpd/doc/"
+    # Remove files that references needless store paths (dependency bloat)
+    rm "$out/share/lighttpd/doc/config/Makefile"*
+    rm "$out/share/lighttpd/doc/config/conf.d/Makefile"*
+    rm "$out/share/lighttpd/doc/config/vhosts.d/Makefile"*
+  '';
+
+  meta = with lib; {
+    description = "Lightweight high-performance web server";
+    homepage = "http://www.lighttpd.net/";
+    license = lib.licenses.bsd3;
+    platforms = platforms.linux ++ platforms.darwin;
+    maintainers = with maintainers; [ bjornfor brecht ];
+  };
+}
--- a/pkgs/servers/http/lwan/default.nix
+++ b/pkgs/servers/http/lwan/default.nix
@ -0,0 +1,39 @@
+{ lib, stdenv, fetchFromGitHub, pkg-config, zlib, cmake, enableJemalloc ? !stdenv.hostPlatform.isMusl, jemalloc }:
+
+stdenv.mkDerivation rec {
+  pname = "lwan";
+  version = "0.4";
+
+  src = fetchFromGitHub {
+    owner = "lpereira";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-Z8kiuZHLEupCKFrj8guiu9fTG7s+5KiQ6x0pg9iMy0c=";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  buildInputs = [ zlib ] ++ lib.optional enableJemalloc jemalloc;
+
+  # Note: tcmalloc and mimalloc are also supported (and normal malloc)
+  cmakeFlags = lib.optional enableJemalloc "-DUSE_ALTERNATIVE_MALLOC=jemalloc";
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "pie";
+
+  meta = with lib; {
+    description = "Lightweight high-performance multi-threaded web server";
+    longDescription = "A lightweight and speedy web server with a low memory
+      footprint (~500KiB for 10k idle connections), with minimal system calls and
+      memory allocation.  Lwan contains a hand-crafted HTTP request parser. Files are
+      served using the most efficient way according to their size: no copies between
+      kernel and userland for files larger than 16KiB.  Smaller files are sent using
+      vectored I/O of memory-mapped buffers. Header overhead is considered before
+      compressing small files.  Features include: mustache templating engine and IPv6
+      support.
+    ";
+    homepage = "https://lwan.ws/";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ leenaars ];
+  };
+}
--- a/pkgs/servers/http/micro-httpd/default.nix
+++ b/pkgs/servers/http/micro-httpd/default.nix
@ -0,0 +1,27 @@
+{ lib, stdenv, fetchurl }:
+
+stdenv.mkDerivation {
+  pname = "micro-httpd";
+  version = "20140814";
+
+  src = fetchurl {
+    url   = "https://acme.com/software/micro_httpd/micro_httpd_14Aug2014.tar.gz";
+    sha256 = "0mlm24bi31s0s8w55i0sysv2nc1n2x4cfp6dm47slz49h2fz24rk";
+  };
+
+  preBuild = ''
+    makeFlagsArray=(BINDIR="$out/bin" MANDIR="$out/share/man/man8")
+    mkdir -p $out/bin
+    mkdir -p $out/share/man/man8
+  '';
+
+  meta = with lib; {
+    homepage    = "http://acme.com/software/micro_httpd/";
+    description = "A really small HTTP server";
+    license     = licenses.bsd2;
+    platforms   = platforms.unix;
+    maintainers = with maintainers; [ copumpkin ];
+    mainProgram = "micro_httpd";
+  };
+}
+
--- a/pkgs/servers/http/mini-httpd/default.nix
+++ b/pkgs/servers/http/mini-httpd/default.nix
@ -0,0 +1,25 @@
+{ lib, stdenv, fetchurl, boost }:
+
+stdenv.mkDerivation rec {
+  pname = "mini-httpd";
+  version = "1.7";
+
+  src = fetchurl {
+    url = "https://download-mirror.savannah.gnu.org/releases/mini-httpd/${pname}-${version}.tar.gz";
+    sha256 = "0jggmlaywjfbdljzv5hyiz49plnxh0har2bnc9dq4xmj1pmjgs49";
+  };
+
+  buildInputs = [ boost ];
+
+  enableParallelBuilding = true;
+
+  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+
+  meta = {
+    homepage = "http://mini-httpd.nongnu.org/";
+    description = "minimalistic high-performance web server";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.peti ];
+  };
+}
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@ -0,0 +1,186 @@
+outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt
+, nginx-doc
+
+, nixosTests
+, substituteAll, removeReferencesTo, gd, geoip, perl
+, withDebug ? false
+, withKTLS ? false
+, withStream ? true
+, withMail ? false
+, withPerl ? true
+, modules ? []
+, ...
+}:
+
+{ pname ? "nginx"
+, version
+, nginxVersion ? version
+, src ? null # defaults to upstream nginx ${version}
+, sha256 ? null # when not specifying src
+, configureFlags ? []
+, buildInputs ? []
+, extraPatches ? []
+, fixPatch ? p: p
+, preConfigure ? ""
+, postInstall ? ""
+, meta ? null
+, nginx-doc ? outer.nginx-doc
+, passthru ? { tests = {}; }
+}:
+
+with lib;
+
+let
+
+  mapModules = attrPath: flip concatMap modules
+    (mod:
+      let supports = mod.supports or (_: true);
+      in
+        if supports nginxVersion then mod.${attrPath} or []
+        else throw "Module at ${toString mod.src} does not support nginx version ${nginxVersion}!");
+
+in
+
+stdenv.mkDerivation {
+  inherit pname;
+  inherit version;
+  inherit nginxVersion;
+
+  outputs = ["out" "doc"];
+
+  src = if src != null then src else fetchurl {
+    url = "https://nginx.org/download/nginx-${version}.tar.gz";
+    inherit sha256;
+  };
+
+  buildInputs = [ openssl zlib pcre libxml2 libxslt gd geoip perl ]
+    ++ buildInputs
+    ++ mapModules "inputs";
+
+  configureFlags = [
+    "--with-http_ssl_module"
+    "--with-http_v2_module"
+    "--with-http_realip_module"
+    "--with-http_addition_module"
+    "--with-http_xslt_module"
+    "--with-http_sub_module"
+    "--with-http_dav_module"
+    "--with-http_flv_module"
+    "--with-http_mp4_module"
+    "--with-http_gunzip_module"
+    "--with-http_gzip_static_module"
+    "--with-http_auth_request_module"
+    "--with-http_random_index_module"
+    "--with-http_secure_link_module"
+    "--with-http_degradation_module"
+    "--with-http_stub_status_module"
+    "--with-threads"
+    "--with-pcre-jit"
+    "--http-log-path=/var/log/nginx/access.log"
+    "--error-log-path=/var/log/nginx/error.log"
+    "--pid-path=/var/log/nginx/nginx.pid"
+    "--http-client-body-temp-path=/var/cache/nginx/client_body"
+    "--http-proxy-temp-path=/var/cache/nginx/proxy"
+    "--http-fastcgi-temp-path=/var/cache/nginx/fastcgi"
+    "--http-uwsgi-temp-path=/var/cache/nginx/uwsgi"
+    "--http-scgi-temp-path=/var/cache/nginx/scgi"
+  ] ++ optionals withDebug [
+    "--with-debug"
+  ] ++ optionals withKTLS [
+    "--with-openssl-opt=enable-ktls"
+  ] ++ optionals withStream [
+    "--with-stream"
+    "--with-stream_realip_module"
+    "--with-stream_ssl_module"
+    "--with-stream_ssl_preread_module"
+  ] ++ optionals withMail [
+    "--with-mail"
+    "--with-mail_ssl_module"
+  ] ++ optionals withPerl [
+    "--with-http_perl_module"
+    "--with-perl=${perl}/bin/perl"
+    "--with-perl_modules_path=lib/perl5"
+  ]
+    ++ optional (gd != null) "--with-http_image_filter_module"
+    ++ optional (geoip != null) "--with-http_geoip_module"
+    ++ optional (withStream && geoip != null) "--with-stream_geoip_module"
+    ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
+    ++ configureFlags
+    ++ map (mod: "--add-module=${mod.src}") modules;
+
+  NIX_CFLAGS_COMPILE = toString ([
+    "-I${libxml2.dev}/include/libxml2"
+    "-Wno-error=implicit-fallthrough"
+  ] ++ optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") [
+    # fix build vts module on gcc11
+    "-Wno-error=stringop-overread"
+  ] ++ optional stdenv.isDarwin "-Wno-error=deprecated-declarations");
+
+  configurePlatforms = [];
+
+  # Disable _multioutConfig hook which adds --bindir=$out/bin into configureFlags,
+  # which breaks build, since nginx does not actually use autoconf.
+  preConfigure = ''
+    setOutputFlags=
+  '' + preConfigure
+     + concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules;
+
+  patches = map fixPatch ([
+    (substituteAll {
+      src = ./nix-etag-1.15.4.patch;
+      preInstall = ''
+        export nixStoreDir="$NIX_STORE" nixStoreDirLen="''${#NIX_STORE}"
+      '';
+    })
+    ./nix-skip-check-logs-path.patch
+  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/openwrt/packages/c057dfb09c7027287c7862afab965a4cd95293a3/net/nginx/patches/102-sizeof_test_fix.patch";
+      sha256 = "0i2k30ac8d7inj9l6bl0684kjglam2f68z8lf3xggcc2i5wzhh8a";
+    })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/openwrt/packages/c057dfb09c7027287c7862afab965a4cd95293a3/net/nginx/patches/101-feature_test_fix.patch";
+      sha256 = "0v6890a85aqmw60pgj3mm7g8nkaphgq65dj4v9c6h58wdsrc6f0y";
+    })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/openwrt/packages/c057dfb09c7027287c7862afab965a4cd95293a3/net/nginx/patches/103-sys_nerr.patch";
+      sha256 = "0s497x6mkz947aw29wdy073k8dyjq8j99lax1a1mzpikzr4rxlmd";
+    })
+  ] ++ mapModules "patches")
+    ++ extraPatches;
+
+  hardeningEnable = optional (!stdenv.isDarwin) "pie";
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    mkdir -p $doc
+    cp -r ${nginx-doc}/* $doc
+  '';
+
+  nativeBuildInputs = [ removeReferencesTo ];
+
+  disallowedReferences = map (m: m.src) modules;
+
+  postInstall =
+    let
+      noSourceRefs = lib.concatMapStrings (m: "remove-references-to -t ${m.src} $out/sbin/nginx\n") modules;
+    in noSourceRefs + postInstall;
+
+  passthru = {
+    modules = modules;
+    tests = {
+      inherit (nixosTests) nginx nginx-auth nginx-etag nginx-http3 nginx-pubhtml nginx-sandbox nginx-sso;
+      variants = lib.recurseIntoAttrs nixosTests.nginx-variants;
+      acme-integration = nixosTests.acme;
+    } // passthru.tests;
+  };
+
+  meta = if meta != null then meta else {
+    description = "A reverse proxy and lightweight webserver";
+    homepage    = "http://nginx.org";
+    license     = licenses.bsd2;
+    platforms   = platforms.all;
+    maintainers = with maintainers; [ thoughtpolice raskin fpletz globin ajs124 ];
+  };
+}
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@ -0,0 +1,6 @@
+{ callPackage, ... }@args:
+
+callPackage ./generic.nix args {
+  version = "1.22.0";
+  sha256 = "0lzb4sn8hv491zad9kbpvka3m5ayjf1pxqbwllri980idyd5cgdk";
+}
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@ -0,0 +1,573 @@
+{ fetchFromGitHub, fetchFromGitLab, lib, pkgs }:
+
+let
+
+  http_proxy_connect_module_generic = patchName: rec {
+    src = fetchFromGitHub {
+      name = "http_proxy_connect_module_generic";
+      owner = "chobits";
+      repo = "ngx_http_proxy_connect_module";
+      rev = "96ae4e06381f821218f368ad0ba964f87cbe0266";
+      sha256 = "1nc7z31i7x9dzp67kzgvs34hs6ps749y26wcpi3wf5mm63i803rh";
+    };
+
+    patches = [
+      "${src}/patch/${patchName}.patch"
+    ];
+  };
+
+in
+
+{
+  fastcgi-cache-purge = throw "fastcgi-cache-purge was renamed to cache-purge";
+  ngx_aws_auth = throw "ngx_aws_auth was renamed to aws-auth";
+
+  akamai-token-validate = {
+    src = fetchFromGitHub {
+      name = "akamai-token-validate";
+      owner = "kaltura";
+      repo = "nginx-akamai-token-validate-module";
+      rev = "34fd0c94d2c43c642f323491c4f4a226cd83b962";
+      sha256 = "0yf34s11vgkcl03wbl6gjngm3p9hs8vvm7hkjkwhjh39vkk2a7cy";
+    };
+    inputs = [ pkgs.openssl ];
+  };
+
+  auth-a2aclr = {
+    src = fetchFromGitLab {
+      name = "auth-a2aclr";
+      owner = "arpa2";
+      repo = "nginx-auth-a2aclr";
+      rev = "bbabf9480bb2b40ac581551883a18dfa6522dd63";
+      sha256 = "sha256-h2LgMhreCgod+H/bNQzY9BvqG9ezkwikwWB3T6gHH04=";
+    };
+    inputs = [
+      (pkgs.arpa2common.overrideAttrs
+        (old: rec {
+          version = "0.7.1";
+
+          src = fetchFromGitLab {
+            owner = "arpa2";
+            repo = "arpa2common";
+            rev = "v${version}";
+            sha256 = "sha256-8zVsAlGtmya9EK4OkGUMu2FKJRn2Q3bg2QWGjqcii64=";
+          };
+        }))
+    ];
+  };
+
+  aws-auth = {
+    src = fetchFromGitHub {
+      name = "aws-auth";
+      owner = "anomalizer";
+      repo = "ngx_aws_auth";
+      rev = "2.1.1";
+      sha256 = "10z67g40w7wpd13fwxyknkbg3p6hn61i4v8xw6lh27br29v1y6h9";
+    };
+  };
+
+  brotli = {
+    src = let gitsrc = pkgs.fetchFromGitHub {
+      name = "brotli";
+      owner = "google";
+      repo = "ngx_brotli";
+      rev = "25f86f0bac1101b6512135eac5f93c49c63609e3";
+      sha256 = "02hfvfa6milj40qc2ikpb9f95sxqvxk4hly3x74kqhysbdi06hhv";
+    }; in
+      pkgs.runCommand "ngx_brotli-src" { } ''
+        cp -a ${gitsrc} $out
+        substituteInPlace $out/filter/config \
+          --replace '$ngx_addon_dir/deps/brotli/c' ${lib.getDev pkgs.brotli}
+      '';
+    inputs = [ pkgs.brotli ];
+  };
+
+  cache-purge = {
+    src = fetchFromGitHub {
+      name = "cache-purge";
+      owner = "nginx-modules";
+      repo = "ngx_cache_purge";
+      rev = "2.5.1";
+      sha256 = "0va4jz36mxj76nmq05n3fgnpdad30cslg7c10vnlhdmmic9vqncd";
+    };
+  };
+
+  coolkit = {
+    src = fetchFromGitHub {
+      name = "coolkit";
+      owner = "FRiCKLE";
+      repo = "ngx_coolkit";
+      rev = "0.2";
+      sha256 = "1idj0cqmfsdqawjcqpr1fsq670fdki51ksqk2lslfpcs3yrfjpqh";
+    };
+  };
+
+  dav = {
+    src = fetchFromGitHub {
+      name = "dav";
+      owner = "arut";
+      repo = "nginx-dav-ext-module";
+      rev = "v3.0.0";
+      sha256 = "000dm5zk0m1hm1iq60aff5r6y8xmqd7djrwhgnz9ig01xyhnjv9w";
+    };
+    inputs = [ pkgs.expat ];
+  };
+
+  develkit = {
+    src = fetchFromGitHub {
+      name = "develkit";
+      owner = "vision5";
+      repo = "ngx_devel_kit";
+      rev = "v0.3.1";
+      sha256 = "1c5zfpvm0hrd9lp8rasmw79dnr2aabh0i6y11wzb783bp8m3p2sq";
+    };
+  };
+
+  echo = {
+    src = fetchFromGitHub {
+      name = "echo";
+      owner = "openresty";
+      repo = "echo-nginx-module";
+      rev = "v0.62";
+      sha256 = "0kr1y094yw1a9fyrf4w73ikq18w5ys463wza9n7yfl77xdwirnvl";
+    };
+  };
+
+  fancyindex = {
+    src = fetchFromGitHub {
+      name = "fancyindex";
+      owner = "aperezdc";
+      repo = "ngx-fancyindex";
+      rev = "v0.5.2";
+      sha256 = "0nar45lp3jays3p6b01a78a6gwh6v0snpzcncgiphcqmj5kw8ipg";
+    };
+    meta = {
+      maintainers = with lib.maintainers; [ aneeshusa ];
+    };
+  };
+
+  fluentd = {
+    src = fetchFromGitHub {
+      name = "fluentd";
+      owner = "fluent";
+      repo = "nginx-fluentd-module";
+      rev = "8af234043059c857be27879bc547c141eafd5c13";
+      sha256 = "1ycb5zd9sw60ra53jpak1m73zwrjikwhrrh9q6266h1mlyns7zxm";
+    };
+  };
+
+  geoip2 = {
+    src = fetchFromGitHub {
+      name = "geoip2";
+      owner = "leev";
+      repo = "ngx_http_geoip2_module";
+      rev = "3.3";
+      sha256 = "EEn/qxPsBFgVBqOgPYTrRhaLPwSBlSPWYYSr3SL8wZA=";
+    };
+    inputs = [ pkgs.libmaxminddb ];
+
+    meta = {
+      maintainers = with lib.maintainers; [ pinpox ];
+    };
+  };
+
+  http_proxy_connect_module_v18 = http_proxy_connect_module_generic "proxy_connect_rewrite_1018" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "18";
+  };
+
+  http_proxy_connect_module_v19 = http_proxy_connect_module_generic "proxy_connect_rewrite_1018" // {
+    supports = with lib.versions; version: major version == "1" && minor version == "19";
+  };
+
+  ipscrub = {
+    src = fetchFromGitHub
+      {
+        name = "ipscrub";
+        owner = "masonicboom";
+        repo = "ipscrub";
+        rev = "v1.0.1";
+        sha256 = "0qcx15c8wbsmyz2hkmyy5yd7qn1n84kx9amaxnfxkpqi05vzm1zz";
+      } + "/ipscrub";
+    inputs = [ pkgs.libbsd ];
+  };
+
+  limit-speed = {
+    src = fetchFromGitHub {
+      name = "limit-speed";
+      owner = "yaoweibin";
+      repo = "nginx_limit_speed_module";
+      rev = "f77ad4a56fbb134878e75827b40cf801990ed936";
+      sha256 = "0kkrd08zpcwx938i2is07vq6pgjkvn97xzjab0g4zaz8bivgmjp8";
+    };
+  };
+
+  live = {
+    src = fetchFromGitHub {
+      name = "live";
+      owner = "arut";
+      repo = "nginx-live-module";
+      rev = "5e4a1e3a718e65e5206c24eba00d42b0d1c4b7dd";
+      sha256 = "1kpnhl4b50zim84z22ahqxyxfq4jv8ab85kzsy2n5ciqbyg491lz";
+    };
+  };
+
+  lua = {
+    src = fetchFromGitHub {
+      name = "lua";
+      owner = "openresty";
+      repo = "lua-nginx-module";
+      rev = "v0.10.15";
+      sha256 = "1j216isp0546hycklbr5wi8mlga5hq170hk7f2sm16sfavlkh5gz";
+    };
+    inputs = [ pkgs.luajit ];
+    preConfigure = ''
+      export LUAJIT_LIB="${pkgs.luajit}/lib"
+      export LUAJIT_INC="${pkgs.luajit}/include/luajit-2.0"
+    '';
+    allowMemoryWriteExecute = true;
+  };
+
+  lua-upstream = {
+    src = fetchFromGitHub {
+      name = "lua-upstream";
+      owner = "openresty";
+      repo = "lua-upstream-nginx-module";
+      rev = "v0.07";
+      sha256 = "1gqccg8airli3i9103zv1zfwbjm27h235qjabfbfqk503rjamkpk";
+    };
+    inputs = [ pkgs.luajit ];
+    allowMemoryWriteExecute = true;
+  };
+
+  modsecurity = {
+    src = "${pkgs.modsecurity_standalone.nginx}/nginx/modsecurity";
+    inputs = [ pkgs.curl pkgs.apr pkgs.aprutil pkgs.apacheHttpd pkgs.yajl ];
+    preConfigure = ''
+      export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${pkgs.aprutil.dev}/include/apr-1 -I${pkgs.apacheHttpd.dev}/include -I${pkgs.apr.dev}/include/apr-1 -I${pkgs.yajl}/include"
+    '';
+  };
+
+  modsecurity-nginx = {
+    src = fetchFromGitHub {
+      name = "modsecurity-nginx";
+      owner = "SpiderLabs";
+      repo = "ModSecurity-nginx";
+      rev = "v1.0.2";
+      sha256 = "sha256-UXiitc3jZlgXlCsDPS+xEFLNRVgRbn8BCCXUEqAWlII=";
+    };
+    inputs = [ pkgs.curl pkgs.geoip pkgs.libmodsecurity pkgs.libxml2 pkgs.lmdb pkgs.yajl ];
+    disableIPC = true;
+  };
+
+  moreheaders = {
+    src = fetchFromGitHub {
+      name = "moreheaders";
+      owner = "openresty";
+      repo = "headers-more-nginx-module";
+      rev = "v0.33";
+      sha256 = "1cgdjylrdd69vlkwwmn018hrglzjwd83nqva1hrapgcfw12f7j53";
+    };
+  };
+
+  mpeg-ts = {
+    src = fetchFromGitHub {
+      name = "mpeg-ts";
+      owner = "arut";
+      repo = "nginx-ts-module";
+      rev = "v0.1.1";
+      sha256 = "12dxcyy6wna1fccl3a9lnsbymd6p4apnwz6c24w74v97qvpfdxqd";
+    };
+  };
+
+  naxsi = {
+    src = fetchFromGitHub
+      {
+        name = "naxsi";
+        owner = "nbs-system";
+        repo = "naxsi";
+        rev = "95ac520eed2ea04098a76305fd0ad7e9158840b7";
+        sha256 = "0b5pnqkgg18kbw5rf2ifiq7lsx5rqmpqsql6hx5ycxjzxj6acfb3";
+      } + "/naxsi_src";
+  };
+
+  opentracing = {
+    src =
+      let src' = fetchFromGitHub {
+        name = "opentracing";
+        owner = "opentracing-contrib";
+        repo = "nginx-opentracing";
+        rev = "v0.10.0";
+        sha256 = "1q234s3p55xv820207dnh4fcxkqikjcq5rs02ai31ylpmfsf0kkb";
+      };
+      in "${src'}/opentracing";
+    inputs = [ pkgs.opentracing-cpp ];
+  };
+
+  pagespeed =
+    let
+      version = pkgs.psol.version;
+
+      moduleSrc = fetchFromGitHub {
+        name = "pagespeed";
+        owner = "pagespeed";
+        repo = "ngx_pagespeed";
+        rev = "v${version}-stable";
+        sha256 = "0ry7vmkb2bx0sspl1kgjlrzzz6lbz07313ks2lr80rrdm2zb16wp";
+      };
+
+      ngx_pagespeed = pkgs.runCommand
+        "ngx_pagespeed"
+        {
+          meta = {
+            description = "PageSpeed module for Nginx";
+            homepage = "https://developers.google.com/speed/pagespeed/module/";
+            license = pkgs.lib.licenses.asl20;
+          };
+        }
+        ''
+          cp -r "${moduleSrc}" "$out"
+          chmod -R +w "$out"
+          ln -s "${pkgs.psol}" "$out/psol"
+        '';
+    in
+    {
+      src = ngx_pagespeed;
+      inputs = [ pkgs.zlib pkgs.libuuid ]; # psol deps
+      allowMemoryWriteExecute = true;
+    };
+
+  pam = {
+    src = fetchFromGitHub {
+      name = "pam";
+      owner = "sto";
+      repo = "ngx_http_auth_pam_module";
+      rev = "v1.5.3";
+      sha256 = "sha256:09lnljdhjg65643bc4535z378lsn4llbq67zcxlln0pizk9y921a";
+    };
+    inputs = [ pkgs.pam ];
+  };
+
+  pinba = {
+    src = fetchFromGitHub {
+      name = "pinba";
+      owner = "tony2001";
+      repo = "ngx_http_pinba_module";
+      rev = "28131255d4797a7e2f82a6a35cf9fc03c4678fe6";
+      sha256 = "00fii8bjvyipq6q47xhjhm3ylj4rhzmlk3qwxmfpdn37j7bc8p8c";
+    };
+  };
+
+  push-stream = {
+    src = fetchFromGitHub {
+      name = "push-stream";
+      owner = "wandenberg";
+      repo = "nginx-push-stream-module";
+      rev = "1cdc01521ed44dc614ebb5c0d19141cf047e1f90";
+      sha256 = "0ijka32b37dl07k2jl48db5a32ix43jaczrpjih84cvq8yph0jjr";
+    };
+  };
+
+  rtmp = {
+    src = fetchFromGitHub {
+      name = "rtmp";
+      owner = "arut";
+      repo = "nginx-rtmp-module";
+      rev = "v1.2.2";
+      sha256 = "0y45bswk213yhkc2v1xca2rnsxrhx8v6azxz9pvi71vvxcggqv6h";
+    };
+  };
+
+  secure-token = {
+    src = fetchFromGitHub {
+      name = "secure-token";
+      owner = "kaltura";
+      repo = "nginx-secure-token-module";
+      rev = "95bdc0d1aca06ea7fe42555f71e65910bd74914d";
+      sha256 = "19wzck1xzq4kz7nyabcwzlank1k7wi7w2wn2c1mwz374c79g8ggp";
+    };
+    inputs = [ pkgs.openssl ];
+  };
+
+  set-misc = {
+    src = fetchFromGitHub {
+      name = "set-misc";
+      owner = "openresty";
+      repo = "set-misc-nginx-module";
+      rev = "v0.32";
+      sha256 = "048a6jwinbjgxiprjj9ml3fdp0mhkx89g6ggams57fsx9m5vaxax";
+    };
+  };
+
+  shibboleth = {
+    src = fetchFromGitHub {
+      name = "shibboleth";
+      owner = "nginx-shib";
+      repo = "nginx-http-shibboleth";
+      rev = "3f5ff4212fa12de23cb1acae8bf3a5a432b3f43b";
+      sha256 = "136zjipaz7iikgcgqwdv1mrh3ya996zyzbkdy6d4k07s2h9g7hy6";
+    };
+  };
+
+  sla = {
+    src = fetchFromGitHub {
+      name = "sla";
+      owner = "goldenclone";
+      repo = "nginx-sla";
+      rev = "7778f0125974befbc83751d0e1cadb2dcea57601";
+      sha256 = "1x5hm6r0dkm02ffny8kjd7mmq8przyd9amg2qvy5700x6lb63pbs";
+    };
+  };
+
+  slowfs-cache = {
+    src = fetchFromGitHub {
+      name = "slowfs-cache";
+      owner = "FRiCKLE";
+      repo = "ngx_slowfs_cache";
+      rev = "1.10";
+      sha256 = "1gyza02pcws3zqm1phv3ag50db5gnapxyjwy8skjmvawz7p5bmxr";
+    };
+  };
+
+  sorted-querystring = {
+    src = fetchFromGitHub {
+      name = "sorted-querystring";
+      owner = "wandenberg";
+      repo = "nginx-sorted-querystring-module";
+      rev = "0.3";
+      sha256 = "0p6b0hcws39n27fx4xp9k4hb3pcv7b6kah4qqaj0pzjy3nbp4gj7";
+    };
+  };
+
+  spnego-http-auth = {
+    src = fetchFromGitHub {
+      name = "spnego-http-auth";
+      owner = "stnoonan";
+      repo = "spnego-http-auth-nginx-module";
+      rev = "72c8ee04c81f929ec84d5a6d126f789b77781a8c";
+      sha256 = "05rw3a7cv651951li995r5l1yzz6kwkm2xpbd59jsfzd74bw941i";
+    };
+  };
+
+  statsd = {
+    src = fetchFromGitHub {
+      name = "statsd";
+      owner = "harvesthq";
+      repo = "nginx-statsd";
+      rev = "b970e40467a624ba710c9a5106879a0554413d15";
+      sha256 = "1x8j4i1i2ahrr7qvz03vkldgdjdxi6mx75mzkfizfcc8smr4salr";
+    };
+  };
+
+  stream-sts = {
+    src = fetchFromGitHub {
+      name = "stream-sts";
+      owner = "vozlt";
+      repo = "nginx-module-stream-sts";
+      rev = "v0.1.1";
+      sha256 = "1jdj1kik6l3rl9nyx61xkqk7hmqbncy0rrqjz3dmjqsz92y8zaya";
+    };
+  };
+
+  sts = {
+    src = fetchFromGitHub {
+      name = "sts";
+      owner = "vozlt";
+      repo = "nginx-module-sts";
+      rev = "v0.1.1";
+      sha256 = "0nvb29641x1i7mdbydcny4qwlvdpws38xscxirajd2x7nnfdflrk";
+    };
+  };
+
+  subsFilter = {
+    src = fetchFromGitHub {
+      name = "subsFilter";
+      owner = "yaoweibin";
+      repo = "ngx_http_substitutions_filter_module";
+      rev = "b8a71eacc7f986ba091282ab8b1bbbc6ae1807e0";
+      sha256 = "027jxzx66q9a6ycn47imjh40xmnqr0z423lz0ds3w4rf1c2x130f";
+    };
+  };
+
+  sysguard = {
+    src = fetchFromGitHub {
+      name = "sysguard";
+      owner = "vozlt";
+      repo = "nginx-module-sysguard";
+      rev = "e512897f5aba4f79ccaeeebb51138f1704a58608";
+      sha256 = "19c6w6wscbq9phnx7vzbdf4ay6p2ys0g7kp2rmc9d4fb53phrhfx";
+    };
+  };
+
+  upload = {
+    src = fetchFromGitHub {
+      name = "upload";
+      owner = "fdintino";
+      repo = "nginx-upload-module";
+      rev = "2.3.0";
+      sha256 = "8veZP516oC7TESO368ZsZreetbDt+1eTcamk7P1kWjU=";
+    };
+  };
+
+  upstream-check = {
+    src = fetchFromGitHub {
+      name = "upstream-check";
+      owner = "yaoweibin";
+      repo = "nginx_upstream_check_module";
+      rev = "e538034b6ad7992080d2403d6d3da56e4f7ac01e";
+      sha256 = "06y7k04072xzqyqyb08m0vaaizkp4rfwm0q7i735imbzw2rxb74l";
+    };
+  };
+
+  upstream-tarantool = {
+    src = fetchFromGitHub {
+      name = "upstream-tarantool";
+      owner = "tarantool";
+      repo = "nginx_upstream_module";
+      rev = "v2.7.1";
+      sha256 = "0ya4330in7zjzqw57djv4icpk0n1j98nvf0f8v296yi9rjy054br";
+    };
+    inputs = [ pkgs.msgpuck.dev pkgs.yajl ];
+  };
+
+  url = {
+    src = fetchFromGitHub {
+      name = "url";
+      owner = "vozlt";
+      repo = "nginx-module-url";
+      rev = "9299816ca6bc395625c3683fbd2aa7b916bfe91e";
+      sha256 = "0mk1gjmfnry6hgdsnlavww9bn7223idw50jlkhh5k00q5509w4ip";
+    };
+  };
+
+  video-thumbextractor = {
+    src = fetchFromGitHub {
+      name = "video-thumbextractor";
+      owner = "wandenberg";
+      repo = "nginx-video-thumbextractor-module";
+      rev = "92b80642538eec4cfc98114dec5917b8d820e912";
+      sha256 = "0a8d9ifryhhnll7k7jcsf9frshk5yhpsgz7zgxdmw81wbz5hxklc";
+    };
+    inputs = [ pkgs.ffmpeg ];
+  };
+
+  vod = {
+    src = fetchFromGitHub {
+      name = "vod";
+      owner = "kaltura";
+      repo = "nginx-vod-module";
+      rev = "1.29";
+      sha256 = "1z0ka0cwqbgh3fv2d5yva395sf90626rdzx7lyfrgs89gy4h9nrr";
+    };
+    inputs = with pkgs; [ ffmpeg fdk_aac openssl libxml2 libiconv ];
+  };
+
+  vts = {
+    src = fetchFromGitHub {
+      name = "vts";
+      owner = "vozlt";
+      repo = "nginx-module-vts";
+      rev = "v0.1.18";
+      sha256 = "1jq2s9k7hah3b317hfn9y3g1q4g4x58k209psrfsqs718a9sw8c7";
+    };
+  };
+}
--- a/pkgs/servers/http/nginx/nix-etag-1.15.4.patch
+++ b/pkgs/servers/http/nginx/nix-etag-1.15.4.patch
@ -0,0 +1,85 @@
+This patch makes it possible to serve static content from Nix store paths, by
+using the hash of the store path for the ETag header.
+
+diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
+index cb49ef74..7b456993 100644
+--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
+@@ -1583,6 +1583,8 @@ ngx_http_set_etag(ngx_http_request_t *r)
+ {
+     ngx_table_elt_t           *etag;
+     ngx_http_core_loc_conf_t  *clcf;
+    u_char                    *real, *ptr1, *ptr2;
+    ngx_err_t                 err;
+ 
+     clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
+ 
+@@ -1598,16 +1600,60 @@ ngx_http_set_etag(ngx_http_request_t *r)
+     etag->hash = 1;
+     ngx_str_set(&etag->key, "ETag");
+ 
+-    etag->value.data = ngx_pnalloc(r->pool, NGX_OFF_T_LEN + NGX_TIME_T_LEN + 3);
+-    if (etag->value.data == NULL) {
+-        etag->hash = 0;
+-        return NGX_ERROR;
+    err = ngx_errno;
+    real = ngx_realpath(clcf->root.data, NULL);
+    ngx_set_errno(err);
+
+    #define NIX_STORE_DIR "@nixStoreDir@"
+    #define NIX_STORE_LEN @nixStoreDirLen@
+
+    if (r->headers_out.last_modified_time == 1
+        && real != NULL
+        && !ngx_strncmp(real, NIX_STORE_DIR, NIX_STORE_LEN)
+        && real[NIX_STORE_LEN] == '/'
+        && real[NIX_STORE_LEN + 1] != '\0')
+    {
+        ptr1 = real + NIX_STORE_LEN;
+        *ptr1 = '"';
+
+        ptr2 = (u_char *) ngx_strchr(ptr1, '-');
+
+        if (ptr2 == NULL) {
+            ngx_free(real);
+            etag->hash = 0;
+            return NGX_ERROR;
+        }
+
+        *ptr2++ = '"';
+        *ptr2 = '\0';
+
+        etag->value.len = ngx_strlen(ptr1);
+        etag->value.data = ngx_pnalloc(r->pool, etag->value.len);
+
+        if (etag->value.data == NULL) {
+            ngx_free(real);
+            etag->hash = 0;
+            return NGX_ERROR;
+        }
+
+        ngx_memcpy(etag->value.data, ptr1, etag->value.len);
+        ngx_http_clear_last_modified(r);
+    } else {
+        etag->value.data = ngx_pnalloc(r->pool, NGX_OFF_T_LEN + NGX_TIME_T_LEN + 3);
+
+        if (etag->value.data == NULL) {
+            ngx_free(real);
+            etag->hash = 0;
+            return NGX_ERROR;
+        }
+
+        etag->value.len = ngx_sprintf(etag->value.data, "\"%xT-%xO\"",
+                                      r->headers_out.last_modified_time,
+                                      r->headers_out.content_length_n)
+                          - etag->value.data;
+     }
+ 
+-    etag->value.len = ngx_sprintf(etag->value.data, "\"%xT-%xO\"",
+-                                  r->headers_out.last_modified_time,
+-                                  r->headers_out.content_length_n)
+-                      - etag->value.data;
+    ngx_free(real);
+ 
+     r->headers_out.etag = etag;
+ 
--- a/pkgs/servers/http/nginx/nix-skip-check-logs-path.patch
+++ b/pkgs/servers/http/nginx/nix-skip-check-logs-path.patch
@ -0,0 +1,27 @@
+diff --git a/auto/install b/auto/install
+index d884487..dccc411 100644
+--- a/auto/install
+++ b/auto/install
+@@ -148,12 +148,6 @@ install:	build $NGX_INSTALL_PERL_MODULES
+ 		|| cp conf/nginx.conf '\$(DESTDIR)$NGX_CONF_PATH'
+ 	cp conf/nginx.conf '\$(DESTDIR)$NGX_CONF_PREFIX/nginx.conf.default'
+ 
+-	test -d '\$(DESTDIR)`dirname "$NGX_PID_PATH"`' \\
+-		|| mkdir -p '\$(DESTDIR)`dirname "$NGX_PID_PATH"`'
+-
+-	test -d '\$(DESTDIR)`dirname "$NGX_HTTP_LOG_PATH"`' \\
+-		|| mkdir -p '\$(DESTDIR)`dirname "$NGX_HTTP_LOG_PATH"`'
+-
+ 	test -d '\$(DESTDIR)$NGX_PREFIX/html' \\
+ 		|| cp -R $NGX_HTML '\$(DESTDIR)$NGX_PREFIX'
+ END
+@@ -161,9 +155,6 @@ END
+ 
+ if test -n "$NGX_ERROR_LOG_PATH"; then
+     cat << END                                                >> $NGX_MAKEFILE
+-
+-	test -d '\$(DESTDIR)`dirname "$NGX_ERROR_LOG_PATH"`' \\
+-		|| mkdir -p '\$(DESTDIR)`dirname "$NGX_ERROR_LOG_PATH"`'
+ END
+ 
+ fi
--- a/pkgs/servers/http/nginx/quic.nix
+++ b/pkgs/servers/http/nginx/quic.nix
@ -0,0 +1,23 @@
+{ callPackage
+, fetchhg
+, ...
+} @ args:
+
+callPackage ./generic.nix args {
+  src = fetchhg {
+    url = "https://hg.nginx.org/nginx-quic";
+    rev = "5b1011b5702b"; # branch=quic
+    sha256 = "sha256-q1gsJ6CJ7SD1XLitygnRusJ+exFPFg+B3wdsN+NvuL8=";
+  };
+
+  preConfigure = ''
+    ln -s auto/configure configure
+  '';
+
+  configureFlags = [
+    "--with-http_v3_module"
+    "--with-stream_quic_module"
+  ];
+
+  version = "1.21.7-quic";
+}
--- a/pkgs/servers/http/nginx/stable.nix
+++ b/pkgs/servers/http/nginx/stable.nix
@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix args {
+  version = "1.22.0";
+  sha256 = "0lzb4sn8hv491zad9kbpvka3m5ayjf1pxqbwllri980idyd5cgdk";
+}
--- a/pkgs/servers/http/nix-binary-cache/default.nix
+++ b/pkgs/servers/http/nix-binary-cache/default.nix
@ -0,0 +1,60 @@
+{lib, stdenv
+, coreutils, findutils, nix, xz, bzip2, gnused, gnugrep, openssl
+, lighttpd, iproute2 }:
+stdenv.mkDerivation rec {
+  version = "2014-06-29-1";
+  pname = "nix-binary-cache";
+
+  dontUnpack = true;
+
+  installPhase = ''
+    mkdir -p "$out/bin"
+    substitute "${./nix-binary-cache.cgi.in}" "$out"/bin/nix-binary-cache.cgi \
+      --replace @out@ "$out/bin" \
+      --replace @shell@ "${stdenv.shell}" \
+      --replace @coreutils@ "${coreutils}/bin" \
+      --replace @findutils@ "${findutils}/bin" \
+      --replace @nix@ "${nix.out}/bin" \
+      --replace @xz@ "${xz.bin}/bin" \
+      --replace @bzip2@ "${bzip2.bin}/bin" \
+      --replace @gnused@ "${gnused}/bin" \
+      --replace @gnugrep@ "${gnugrep}/bin" \
+      --replace @openssl@ "${openssl.bin}/bin" \
+      --replace @lighttpd@ "${lighttpd}/sbin" \
+      --replace @iproute@ "${iproute2}/sbin" \
+      --replace "xXxXx" "xXxXx"
+
+    chmod a+x "$out/bin/nix-binary-cache.cgi"
+
+    substitute "${./nix-binary-cache-start.in}" "$out"/bin/nix-binary-cache-start \
+      --replace @out@ "$out/bin" \
+      --replace @shell@ "${stdenv.shell}" \
+      --replace @coreutils@ "${coreutils}/bin" \
+      --replace @findutils@ "${findutils}/bin" \
+      --replace @nix@ "${nix.out}/bin" \
+      --replace @xz@ "${xz.bin}/bin" \
+      --replace @bzip2@ "${bzip2.bin}/bin" \
+      --replace @gnused@ "${gnused}/bin" \
+      --replace @gnugrep@ "${gnugrep}/bin" \
+      --replace @openssl@ "${openssl.bin}/bin" \
+      --replace @lighttpd@ "${lighttpd}/sbin" \
+      --replace @iproute@ "${iproute2}/sbin" \
+      --replace "xXxXx" "xXxXx"
+
+    chmod a+x "$out/bin/nix-binary-cache-start"
+  '';
+
+  meta = {
+    description = "A set of scripts to serve the Nix store as a binary cache";
+    longDescription = ''
+      This package installs a CGI script that serves Nix store path in the
+      binary cache format. It also installs a launcher called
+      nix-binary-cache-start that can be run without any setup to launch
+      a binary cache and get the example arguments for its usage.
+    '';
+    maintainers = [lib.maintainers.raskin];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.all;
+    hydraPlatforms = [];
+  };
+}
--- a/pkgs/servers/http/nix-binary-cache/nix-binary-cache-start.in
+++ b/pkgs/servers/http/nix-binary-cache/nix-binary-cache-start.in
@ -0,0 +1,117 @@
+#! @shell@
+
+parse_opts () {
+  while @coreutils@/test -n "$1" && @coreutils@/test "x$1" != x-- ; do 
+    case "$1" in
+      --store-dir)
+        shift;
+        echo "STORE_DIR='$1'"
+        shift;
+        ;;
+      --priority)
+        shift;
+        echo "PRIORITY=$1";
+        shift;
+        ;;
+      --compression)
+        shift;
+        echo "COMPRESSION=$1";
+        shift;
+        ;;
+      --key)
+        shift;
+        echo "KEY=${1#*:}"
+        echo "KEYNAME=${1%%:*}"
+        shift;
+        ;;
+      --nix-remote)
+        shift;
+        echo "NIX_REMOTE=$1"
+        shift;
+        ;;
+      --mass-query)
+        shift;
+        echo "MASS_QUERY=$1"
+        shift;
+        ;;
+      --port)
+        shift;
+        echo "PORT=$1"
+        shift;
+        ;;
+      --ipv6)
+        shift;
+	echo "USE_IPV6=enable"
+	;;
+      --help)
+        cat <<EOF >&2
+"$0": start the Nix binary cache serving the Nix store dynamically.
+
+Recognized options:
+
+--port           server port
+--store-dir      served Nix store
+
+--priority       binary cache priority
+--mass-query     0 or 1 - whether binary cache expects queries for nix-env -qas
+
+--compression    compression to use: bzip2 or xz
+--key            name:/path/to/key - key to use for narinfo signing
+
+--nix-remote     'daemon' or empty string '' - whether to use daemon for store
+                   operations
+
+--ipv6           enable ipv6
+
+--help           show help and exit
+EOF
+	exit 1;
+        ;;
+      *) shift ;;
+    esac;
+  done
+}
+
+workingdir="$(@coreutils@/mktemp -d)"
+cd "$workingdir"
+
+PORT=8080
+(echo "STORE_DIR=${NIX_STORE_DIR:-/nix/store}"; parse_opts "$@" 
+  ) > nix-binary-cache.conf || exit
+. "$workingdir/nix-binary-cache.conf"
+
+echo "
+server.port = $PORT
+server.modules = ( \"mod_cgi\", \"mod_setenv\", )
+server.document-root = \"$workingdir\"
+cgi.assign = ( \".cgi\" => \"@shell@\" )
+setenv.add-request-header = ( \"NIX_BINARY_CACHE_CONFIG\" => \"$workingdir/nix-binary-cache.conf\" )
+" > lighttpd.conf
+
+test -n "$USE_IPV6" && echo "
+\$SERVER[\"socket\"] == \"[::]:$PORT\" {
+server.use-ipv6 = \"enable\"
+}
+" >> lighttpd.conf
+
+cp @out@/nix-binary-cache.cgi . 
+cp @out@/nix-binary-cache.cgi ./nix-bc.cgi 
+
+ip="$(@iproute@/ip a | @gnugrep@/grep 'inet .* scope global' | @coreutils@/head -n 1)"
+ip="${ip%%/*}"
+ip="${ip##* }"
+
+url="http://$ip:$PORT/nix-bc.cgi?"
+
+echo "Working directory: $workingdir"
+echo
+echo "Address of the binary cache: $url"
+echo
+echo "Usage example: NIX_REMOTE= nix-store --option binary-caches '$url'"
+echo
+echo
+
+@lighttpd@/lighttpd -D -f "$workingdir/lighttpd.conf"
+
+cd /
+@coreutils@/rm -rf "$workingdir"
--- a/pkgs/servers/http/nix-binary-cache/nix-binary-cache.cgi.in
+++ b/pkgs/servers/http/nix-binary-cache/nix-binary-cache.cgi.in
@ -0,0 +1,105 @@
+#! @shell@
+
+STORE_DIR="${NIX_STORE_DIR:-/nix/store}"
+MASS_QUERY=0
+PRIORITY=75
+COMPRESSION=bzip2
+KEY=
+KEYNAME=na
+
+export NIX_REMOTE=daemon
+
+config="${NIX_BINARY_CACHE_CONFIG:-${HTTP_NIX_BINARY_CACHE_CONFIG:-/etc/nix/nix-binary-cache.cgi.conf}}"
+config="$(cd "$(@coreutils@/dirname "$config")";
+  @coreutils@/pwd)/$(@coreutils@/basename "$config")"
+@coreutils@/test -e "$config" && . "$config"
+
+header(){
+	echo "Content-Type: text/plain; charset=utf-8"
+	echo
+}
+
+header404(){
+	echo "Status: 404 Not Found"
+	echo
+}
+
+clean_path() {
+	@gnused@/sed -re "s@^$STORE_DIR/?@@" | @findutils@/xargs
+}
+
+storeq(){
+	@nix@/nix-store -q "$@"
+}
+
+sign(){
+	test -n "$1" &&
+	  @coreutils@/sha256sum | @gnused@/sed -e 's/ .*//' |
+	  @openssl@/openssl rsautl -sign -inkey "$@" | @coreutils@/base64 -w 0
+}
+
+case "$QUERY_STRING" in
+	"")
+		header
+		echo "Hello, this is a dynamically-generated Nix binary cache"
+		;;
+	/debug)
+		header
+		set
+		;;
+	/nix-cache-info)
+		header
+		echo "StoreDir: $STORE_DIR"
+		echo "WantMassQuery: $MASS_QUERY"
+		echo "Priority: $PRIORITY"
+		;;
+	*.narinfo)
+		hash=${QUERY_STRING%.narinfo}
+		hash=${hash#/}
+		path="$(echo "$STORE_DIR/$hash-"* | @coreutils@/sort | @coreutils@/head -n 1)"
+		if [ -n "$path" ] && [ -e "$path" ]; then
+			header
+			info="$(
+			echo "StorePath: $path"
+			echo "URL: $(@coreutils@/basename "$path"
+			  ).nar.$COMPRESSION"
+			echo "Compression: $COMPRESSION"
+			echo "NarHash: $(storeq --hash "$path")"
+			echo "NarSize: $(storeq --size "$path")"
+			echo "References: $(storeq --references "$path" |
+			  @coreutils@/tac | clean_path )"
+			echo "Deriver: $(storeq --deriver "$path" |
+			  clean_path )"
+			)"
+			signature="$(echo "$info" | sign "$KEY")"
+
+			echo "$info"
+			echo "Signature: 1;$KEYNAME;$signature"
+
+		else
+			header404
+			exit 1
+		fi
+		;;
+	*.nar.xz)
+		path="$STORE_DIR${QUERY_STRING%.nar.xz}"
+		if [ -n "$path" ] && [ -e "$path" ]; then
+			header
+			@nix@/nix-store --dump "$path" | @xz@/xz
+		else
+			header404
+			exit 1
+		fi
+		;;
+	*.nar.bzip2)
+		path="$STORE_DIR${QUERY_STRING%.nar.bzip2}"
+		echo "$path" >&2;
+		if [ -n "$path" ] && [ -e "$path" ]; then
+			header
+			@nix@/nix-store --dump "$path" | @bzip2@/bzip2
+		else
+			header404
+			exit 1
+		fi
+		;;
+esac
--- a/pkgs/servers/http/openresty/default.nix
+++ b/pkgs/servers/http/openresty/default.nix
@ -0,0 +1,57 @@
+{ callPackage
+, runCommand
+, lib
+, fetchurl
+, postgresql
+, nixosTests
+, ...
+}@args:
+
+callPackage ../nginx/generic.nix args rec {
+  pname = "openresty";
+  nginxVersion = "1.19.9";
+  version = "${nginxVersion}.1";
+
+  src = fetchurl {
+    url = "https://openresty.org/download/openresty-${version}.tar.gz";
+    sha256 = "1xn1d0x2y63z0mi0qq3js6lz6ziba92r7vyyfkj1qc738vjz8vsp";
+  };
+
+  # generic.nix applies fixPatch on top of every patch defined there.  This
+  # allows updating the patch destination, as openresty has nginx source code
+  # in a different folder.
+  fixPatch = patch:
+    let name = patch.name or (builtins.baseNameOf patch); in
+    runCommand "openresty-${name}" { src = patch; } ''
+      substitute $src $out \
+        --replace "a/" "a/bundle/nginx-${nginxVersion}/" \
+        --replace "b/" "b/bundle/nginx-${nginxVersion}/"
+    '';
+
+  buildInputs = [ postgresql ];
+
+  configureFlags = [ "--with-http_postgres_module" ];
+
+  preConfigure = ''
+    patchShebangs .
+  '';
+
+  postInstall = ''
+    ln -s $out/luajit/bin/luajit-2.1.0-beta3 $out/bin/luajit-openresty
+    ln -s $out/nginx/sbin/nginx $out/bin/nginx
+    ln -s $out/nginx/conf $out/conf
+    ln -s $out/nginx/html $out/html
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) openresty-lua;
+  };
+
+  meta = {
+    description = "A fast web application server built on Nginx";
+    homepage = "https://openresty.org";
+    license = lib.licenses.bsd2;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ thoughtpolice lblasc emily ];
+  };
+}
--- a/pkgs/servers/http/pomerium/default.nix
+++ b/pkgs/servers/http/pomerium/default.nix
@ -0,0 +1,91 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, envoy
+, zip
+, nixosTests
+, pomerium-cli
+}:
+
+let
+  inherit (lib) concatStringsSep concatMap id mapAttrsToList;
+in
+buildGoModule rec {
+  pname = "pomerium";
+  version = "0.17.1";
+  src = fetchFromGitHub {
+    owner = "pomerium";
+    repo = "pomerium";
+    rev = "v${version}";
+    hash = "sha256:0b9mdzyfn7c6gwgslqk787yyrrcmdjf3282vx2zvhcr3psz0xqwx";
+  };
+
+  vendorSha256 = "sha256:1cq4m5a7z64yg3v1c68d15ilw78il6p53vaqzxgn338zjggr3kig";
+  subPackages = [
+    "cmd/pomerium"
+  ];
+
+  ldflags = let
+    # Set a variety of useful meta variables for stamping the build with.
+    setVars = {
+      "github.com/pomerium/pomerium/internal/version" = {
+        Version = "v${version}";
+        BuildMeta = "nixpkgs";
+        ProjectName = "pomerium";
+        ProjectURL = "github.com/pomerium/pomerium";
+      };
+      "github.com/pomerium/pomerium/internal/envoy" = {
+        OverrideEnvoyPath = "${envoy}/bin/envoy";
+      };
+    };
+    concatStringsSpace = list: concatStringsSep " " list;
+    mapAttrsToFlatList = fn: list: concatMap id (mapAttrsToList fn list);
+    varFlags = concatStringsSpace (
+      mapAttrsToFlatList (package: packageVars:
+        mapAttrsToList (variable: value:
+          "-X ${package}.${variable}=${value}"
+        ) packageVars
+      ) setVars);
+  in [
+    "${varFlags}"
+  ];
+
+  preBuild = ''
+    # Replace embedded envoy with nothing.
+    # We set OverrideEnvoyPath above, so rawBinary should never get looked at
+    # but we still need to set a checksum/version.
+    rm internal/envoy/files/files_{darwin,linux}*.go
+    cat <<EOF >internal/envoy/files/files_generic.go
+    package files
+
+    import _ "embed" // embed
+
+    var rawBinary []byte
+
+    //go:embed envoy.sha256
+    var rawChecksum string
+
+    //go:embed envoy.version
+    var rawVersion string
+    EOF
+    sha256sum '${envoy}/bin/envoy' > internal/envoy/files/envoy.sha256
+    echo '${envoy.version}' > internal/envoy/files/envoy.version
+  '';
+
+  installPhase = ''
+    install -Dm0755 $GOPATH/bin/pomerium $out/bin/pomerium
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) pomerium;
+    inherit pomerium-cli;
+  };
+
+  meta = with lib; {
+    homepage = "https://pomerium.io";
+    description = "Authenticating reverse proxy";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ lukegb ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+  };
+}
--- a/pkgs/servers/http/pshs/default.nix
+++ b/pkgs/servers/http/pshs/default.nix
@ -0,0 +1,26 @@
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libevent, file, qrencode, miniupnpc }:
+
+stdenv.mkDerivation rec {
+  pname = "pshs";
+  version = "0.3.4";
+
+  src = fetchFromGitHub {
+    owner = "mgorny";
+    repo = "pshs";
+    rev = "v${version}";
+    sha256 = "1j8j4r0vsmp6226q6jdgf9bzhx3qk7vdliwaw7f8kcsrkndkg6p4";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ libevent file qrencode miniupnpc ];
+
+  # SSL requires libevent at 2.1 with ssl support
+  configureFlags = [ "--disable-ssl" ];
+
+  meta = {
+    description = "Pretty small HTTP server - a command-line tool to share files";
+    homepage = "https://github.com/mgorny/pshs";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/servers/http/quark/default.nix
+++ b/pkgs/servers/http/quark/default.nix
@ -0,0 +1,26 @@
+{ lib, stdenv, fetchgit, patches ? null }:
+
+stdenv.mkDerivation {
+  pname = "quark";
+  version = "unstable-2021-02-22";
+
+  src = fetchgit {
+    url = "git://git.suckless.org/quark";
+    rev = "68b4f733b2755762e43df90f73db5a6ec8d14104";
+    sha256 = "sha256-Jtu5zJfHd+6Oq572nVem5msMDCOjdqDNH4SQck8/O5A=";
+  };
+
+  inherit patches;
+
+  makeFlags = [ "CC:=$(CC)" ];
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    description = "Extremely small and simple HTTP GET/HEAD-only web server for static content";
+    homepage = "http://tools.suckless.org/quark";
+    license = licenses.isc;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/servers/http/ran/default.nix
+++ b/pkgs/servers/http/ran/default.nix
@ -0,0 +1,46 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, runCommand
+, ran
+, curl
+}:
+
+buildGoModule rec {
+  pname = "ran";
+  version = "0.1.6";
+  src = fetchFromGitHub {
+    owner = "m3ng9i";
+    repo = "ran";
+    rev = "v${version}";
+    hash = "sha256-iMvUvzr/jaTNdgHQFuoJNJnnkx2XHIUUlrPWyTlreEw=";
+  };
+
+  vendorSha256 = "sha256-ObroruWWNilHIclqNvbEaa7vwk+1zMzDKbjlVs7Fito=";
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-X" "main._version_=v${version}"
+    "-X" "main._branch_=master"
+  ];
+
+  passthru.tests = {
+    simple = runCommand "ran-test" { } ''
+      echo hello world > index.html
+      ${ran}/bin/ran &
+      # Allow ran to fully initialize
+      sleep 1
+      [ "$(${curl}/bin/curl 127.0.0.1:8080)" == "hello world" ]
+      kill %1
+      ${ran}/bin/ran --version > $out
+    '';
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/m3ng9i/ran";
+    description = "Ran is a simple web server for serving static files";
+    license = licenses.mit;
+    maintainers = with maintainers; [ tomberek ];
+  };
+}
--- a/pkgs/servers/http/redstore/default.nix
+++ b/pkgs/servers/http/redstore/default.nix
@ -0,0 +1,31 @@
+{ lib, stdenv, fetchurl, redland, pkg-config, gmp, zlib, librdf_raptor2
+  , librdf_rasqal }:
+
+stdenv.mkDerivation rec {
+  pname = "redstore";
+  version = "0.5.4";
+
+  src = fetchurl {
+    url = "https://www.aelius.com/njh/redstore/redstore-${version}.tar.gz";
+    sha256 = "0hc1fjfbfvggl72zqx27v4wy84f5m7bp4dnwd8g41aw8lgynbgaq";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ gmp redland zlib librdf_raptor2 librdf_rasqal ];
+
+  preConfigure = ''
+    # Define _XOPEN_SOURCE to enable, e.g., getaddrinfo.
+    configureFlagsArray+=(
+      "CFLAGS=-D_XOPEN_SOURCE=600 -I${librdf_raptor2}/include/raptor2 -I${librdf_rasqal}/include/rasqal"
+    )
+  '';
+
+  meta = {
+    description = "An HTTP interface to Redland RDF store";
+    homepage = "https://www.aelius.com/njh/redstore/";
+    maintainers = [ lib.maintainers.raskin ];
+    platforms = with lib.platforms;
+      linux ++ freebsd ++ gnu;
+    license = lib.licenses.gpl3Plus;
+  };
+}
--- a/pkgs/servers/http/showoff/Gemfile
+++ b/pkgs/servers/http/showoff/Gemfile
@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'showoff'
--- a/pkgs/servers/http/showoff/Gemfile.lock
+++ b/pkgs/servers/http/showoff/Gemfile.lock
@ -0,0 +1,73 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.6.0)
+      public_suffix (>= 2.0.2, < 4.0)
+    commonmarker (0.18.2)
+      ruby-enum (~> 0.5)
+    concurrent-ruby (1.1.5)
+    daemons (1.3.1)
+    em-websocket (0.3.8)
+      addressable (>= 2.1.1)
+      eventmachine (>= 0.12.9)
+    eventmachine (1.2.7)
+    fidget (0.0.6)
+      ruby-dbus (< 0.15.0)
+    gli (2.18.0)
+    htmlentities (4.3.4)
+    i18n (1.6.0)
+      concurrent-ruby (~> 1.0)
+    iso-639 (0.2.8)
+    json (2.2.0)
+    mini_portile2 (2.4.0)
+    nokogiri (1.10.1)
+      mini_portile2 (~> 2.4.0)
+    parslet (1.8.2)
+    public_suffix (3.0.3)
+    rack (1.6.11)
+    rack-contrib (1.8.0)
+      rack (~> 1.4)
+    rack-protection (1.5.5)
+      rack
+    redcarpet (3.4.0)
+    ruby-dbus (0.14.1)
+    ruby-enum (0.7.2)
+      i18n
+    showoff (0.20.1)
+      commonmarker
+      fidget (>= 0.0.3)
+      gli (>= 2.0)
+      htmlentities
+      i18n
+      iso-639
+      json
+      nokogiri
+      parslet
+      rack-contrib
+      redcarpet
+      sinatra (~> 1.3)
+      sinatra-websocket
+      thin (~> 1.3)
+      tilt (>= 2.0.3)
+    sinatra (1.4.8)
+      rack (~> 1.5)
+      rack-protection (~> 1.4)
+      tilt (>= 1.3, < 3)
+    sinatra-websocket (0.3.1)
+      em-websocket (~> 0.3.6)
+      eventmachine
+      thin (>= 1.3.1, < 2.0.0)
+    thin (1.7.2)
+      daemons (~> 1.0, >= 1.0.9)
+      eventmachine (~> 1.0, >= 1.0.4)
+      rack (>= 1, < 3)
+    tilt (2.0.9)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  showoff
+
+BUNDLED WITH
+   2.1.4
--- a/pkgs/servers/http/showoff/default.nix
+++ b/pkgs/servers/http/showoff/default.nix
@ -0,0 +1,18 @@
+{ lib, bundlerApp, bundlerUpdateScript }:
+
+bundlerApp {
+  pname = "showoff";
+  gemdir = ./.;
+  exes = [ "showoff" ];
+
+  passthru.updateScript = bundlerUpdateScript "showoff";
+
+  meta = with lib; {
+    description = "A slideshow presentation tool with a twist";
+    longDescription = "It runs as a web application, with audience interactivity features. This means that your audience can follow along in their own browsers, can download supplemental materials, can participate in quizzes or polls, post questions for the presenter, etc. By default, their slideshows will synchronize with the presenter, but they can switch to self-navigation mode";
+    homepage = "https://puppetlabs.github.io/showoff/";
+    license = with licenses; mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ maxwilson nicknovitski ];
+  };
+}
--- a/pkgs/servers/http/showoff/gemset.nix
+++ b/pkgs/servers/http/showoff/gemset.nix
@ -0,0 +1,231 @@
+{
+  addressable = {
+    dependencies = ["public_suffix"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bcm2hchn897xjhqj9zzsxf3n9xhddymj4lsclz508f4vw3av46l";
+      type = "gem";
+    };
+    version = "2.6.0";
+  };
+  commonmarker = {
+    dependencies = ["ruby-enum"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "122dy5mzx4p86flpzyg3raf742zp5ab9bjr7zk29p3ixpncf0rdk";
+      type = "gem";
+    };
+    version = "0.18.2";
+  };
+  concurrent-ruby = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1x07r23s7836cpp5z9yrlbpljcxpax14yw4fy4bnp6crhr6x24an";
+      type = "gem";
+    };
+    version = "1.1.5";
+  };
+  daemons = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0l5gai3vd4g7aqff0k1mp41j9zcsvm2rbwmqn115a325k9r7pf4w";
+      type = "gem";
+    };
+    version = "1.3.1";
+  };
+  em-websocket = {
+    dependencies = ["addressable" "eventmachine"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xkb1rc6dd3y5s7qsp4wqrri3n9gwsbvnwwv6xwgp241jxdpp4iq";
+      type = "gem";
+    };
+    version = "0.3.8";
+  };
+  eventmachine = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0wh9aqb0skz80fhfn66lbpr4f86ya2z5rx6gm5xlfhd05bj1ch4r";
+      type = "gem";
+    };
+    version = "1.2.7";
+  };
+  fidget = {
+    dependencies = ["ruby-dbus"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "04g2846wjlb8ms5041lv37aqs4jzsziwv58bxg7yzc61pdvi4ksb";
+      type = "gem";
+    };
+    version = "0.0.6";
+  };
+  gli = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "133glfzsq67ykmdsgp251s9kddg9x4qki2jpbjv25h3hawlql4hs";
+      type = "gem";
+    };
+    version = "2.18.0";
+  };
+  htmlentities = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nkklqsn8ir8wizzlakncfv42i32wc0w9hxp00hvdlgjr7376nhj";
+      type = "gem";
+    };
+    version = "4.3.4";
+  };
+  i18n = {
+    dependencies = ["concurrent-ruby"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1hfxnlyr618s25xpafw9mypa82qppjccbh292c4l3bj36az7f6wl";
+      type = "gem";
+    };
+    version = "1.6.0";
+  };
+  iso-639 = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "10k1gpkkbxbasgjzh4hd32ygxzjb5312rphipm46ryxkpx556zzz";
+      type = "gem";
+    };
+    version = "0.2.8";
+  };
+  json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0sx97bm9by389rbzv8r1f43h06xcz8vwi3h5jv074gvparql7lcx";
+      type = "gem";
+    };
+    version = "2.2.0";
+  };
+  mini_portile2 = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15zplpfw3knqifj9bpf604rb3wc1vhq6363pd6lvhayng8wql5vy";
+      type = "gem";
+    };
+    version = "2.4.0";
+  };
+  nokogiri = {
+    dependencies = ["mini_portile2"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09zll7c6j7xr6wyvh5mm5ncj6pkryp70ybcsxdbw1nyphx5dh184";
+      type = "gem";
+    };
+    version = "1.10.1";
+  };
+  parslet = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "12nrzfwjphjlakb9pmpj70hgjwgzvnr8i1zfzddifgyd44vspl88";
+      type = "gem";
+    };
+    version = "1.8.2";
+  };
+  public_suffix = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "08q64b5br692dd3v0a9wq9q5dvycc6kmiqmjbdxkxbfizggsvx6l";
+      type = "gem";
+    };
+    version = "3.0.3";
+  };
+  rack = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1g9926ln2lw12lfxm4ylq1h6nl0rafl10za3xvjzc87qvnqic87f";
+      type = "gem";
+    };
+    version = "1.6.11";
+  };
+  rack-contrib = {
+    dependencies = ["rack"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1l7m0av4pjl5p64l8j7pkip1jwhkp80a8kc2j7b9lrwh04fgx5wx";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
+  rack-protection = {
+    dependencies = ["rack"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0my0wlw4a5l3hs79jkx2xzv7djhajgf8d28k8ai1ddlnxxb0v7ss";
+      type = "gem";
+    };
+    version = "1.5.5";
+  };
+  redcarpet = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0h9qz2hik4s9knpmbwrzb3jcp3vc5vygp9ya8lcpl7f1l9khmcd7";
+      type = "gem";
+    };
+    version = "3.4.0";
+  };
+  ruby-dbus = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "16lsqdwas6ngyyvq51l7lynj5ayis17zm5hpsg5x3m3n6r5k2gv4";
+      type = "gem";
+    };
+    version = "0.14.1";
+  };
+  ruby-enum = {
+    dependencies = ["i18n"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0h62avini866kxpjzqxlqnajma3yvj0y25l6hn9h2mv5pp6fcrhx";
+      type = "gem";
+    };
+    version = "0.7.2";
+  };
+  showoff = {
+    dependencies = ["commonmarker" "fidget" "gli" "htmlentities" "i18n" "iso-639" "json" "nokogiri" "parslet" "rack-contrib" "redcarpet" "sinatra" "sinatra-websocket" "thin" "tilt"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "14884kh7vrp5b72dpn7q26h49y7igxqza72girkv1h28qx4kqw4r";
+      type = "gem";
+    };
+    version = "0.20.1";
+  };
+  sinatra = {
+    dependencies = ["rack" "rack-protection" "tilt"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0byxzl7rx3ki0xd7aiv1x8mbah7hzd8f81l65nq8857kmgzj1jqq";
+      type = "gem";
+    };
+    version = "1.4.8";
+  };
+  sinatra-websocket = {
+    dependencies = ["em-websocket" "eventmachine" "thin"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0as52mfw34z3ba6qjab009h2rdn0za0iwrc42kw948hbb8qzcm5m";
+      type = "gem";
+    };
+    version = "0.3.1";
+  };
+  thin = {
+    dependencies = ["daemons" "eventmachine" "rack"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nagbf9pwy1vg09k6j4xqhbjjzrg5dwzvkn4ffvlj76fsn6vv61f";
+      type = "gem";
+    };
+    version = "1.7.2";
+  };
+  tilt = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ca4k0clwf0rkvy7726x4nxpjxkpv67w043i39saxgldxd97zmwz";
+      type = "gem";
+    };
+    version = "2.0.9";
+  };
+}
--- a/pkgs/servers/http/spawn-fcgi/default.nix
+++ b/pkgs/servers/http/spawn-fcgi/default.nix
@ -0,0 +1,25 @@
+{ lib, stdenv, fetchsvn, autoconf, automake }:
+
+stdenv.mkDerivation rec {
+  pname = "spawn-fcgi";
+  version = "1.6.4";
+
+  src = fetchsvn {
+    url = "svn://svn.lighttpd.net/spawn-fcgi/tags/spawn-fcgi-${version}";
+    sha256 = "07r6nwbg4881mdgp0hqh80c4x9wb7jg6cgc84ghwhfbd2abc2iq5";
+  };
+
+  nativeBuildInputs = [ automake autoconf ];
+
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
+  meta = with lib; {
+    homepage    = "https://redmine.lighttpd.net/projects/spawn-fcgi";
+    description = "Provides an interface to external programs that support the FastCGI interface";
+    license     = licenses.bsd3;
+    maintainers = with maintainers; [ cstrahan ];
+    platforms = with platforms; unix;
+  };
+}
--- a/pkgs/servers/http/tengine/check-resolv-conf.patch
+++ b/pkgs/servers/http/tengine/check-resolv-conf.patch
@ -0,0 +1,14 @@
+diff --git a/auto/unix b/auto/unix
+index a38c12dc..025a4899 100644
+--- a/auto/unix
+++ b/auto/unix
+@@ -1072,9 +1072,7 @@ ngx_feature_test='int fd;
+ 
+ 
+ # Auto read nameserver from /etc/resolv.conf.
+- if [ -f "/etc/resolv.conf" ]; then
+     have=NGX_RESOLVER_FILE
+     value=\"/etc/resolv.conf\"
+     . auto/define
+-fi
+ 
--- a/pkgs/servers/http/tengine/default.nix
+++ b/pkgs/servers/http/tengine/default.nix
@ -0,0 +1,126 @@
+{ lib, stdenv, fetchFromGitHub, openssl, zlib, pcre, libxml2, libxslt
+, substituteAll, gd, geoip, gperftools, jemalloc, nixosTests
+, withDebug ? false
+, withMail ? false
+, withStream ? false
+, modules ? []
+, ...
+}:
+
+with lib;
+
+stdenv.mkDerivation rec {
+  version = "2.3.3";
+  pname = "tengine";
+
+  src = fetchFromGitHub {
+    owner = "alibaba";
+    repo = pname;
+    rev = version;
+    sha256 = "0p43qsldwhx4zfwp585x8kps0akrf7b0gxdgf0sh0yqcp7l28gmx";
+  };
+
+  buildInputs =
+    [ openssl zlib pcre libxml2 libxslt gd geoip gperftools jemalloc ]
+    ++ concatMap (mod: mod.inputs or []) modules;
+
+  patches = singleton (substituteAll {
+    src = ../nginx/nix-etag-1.15.4.patch;
+    preInstall = ''
+      export nixStoreDir="$NIX_STORE" nixStoreDirLen="''${#NIX_STORE}"
+    '';
+  }) ++ [
+    ./check-resolv-conf.patch
+    ../nginx/nix-skip-check-logs-path.patch
+  ];
+
+  configureFlags = [
+    "--with-http_ssl_module"
+    "--with-http_v2_module"
+    "--with-http_realip_module"
+    "--with-http_addition_module"
+    "--with-http_xslt_module"
+    "--with-http_geoip_module"
+    "--with-http_sub_module"
+    "--with-http_dav_module"
+    "--with-http_flv_module"
+    "--with-http_mp4_module"
+    "--with-http_gunzip_module"
+    "--with-http_gzip_static_module"
+    "--with-http_auth_request_module"
+    "--with-http_random_index_module"
+    "--with-http_secure_link_module"
+    "--with-http_degradation_module"
+    "--with-http_stub_status_module"
+    "--with-threads"
+    "--with-pcre-jit"
+    "--with-http_slice_module"
+    "--with-select_module"
+    "--with-poll_module"
+    "--with-google_perftools_module"
+    "--with-jemalloc"
+    "--http-log-path=/var/log/nginx/access.log"
+    "--error-log-path=/var/log/nginx/error.log"
+    "--pid-path=/var/log/nginx/nginx.pid"
+    "--http-client-body-temp-path=/var/cache/nginx/client_body"
+    "--http-proxy-temp-path=/var/cache/nginx/proxy"
+    "--http-fastcgi-temp-path=/var/cache/nginx/fastcgi"
+    "--http-uwsgi-temp-path=/var/cache/nginx/uwsgi"
+    "--http-scgi-temp-path=/var/cache/nginx/scgi"
+  ] ++ optionals withDebug [
+    "--with-debug"
+  ] ++ optionals withMail [
+    "--with-mail"
+    "--with-mail_ssl_module"
+  ] ++ optionals (!withMail) [
+    "--without-mail_pop3_module"
+    "--without-mail_imap_module"
+    "--without-mail_smtp_module"
+  ] ++ optionals withStream [
+    "--with-stream"
+    "--with-stream_ssl_module"
+    "--with-stream_realip_module"
+    "--with-stream_geoip_module"
+    "--with-stream_ssl_preread_module"
+    "--with-stream_sni"
+  ] ++ optionals (!withStream) [
+    "--without-stream_limit_conn_module"
+    "--without-stream_access_module"
+    "--without-stream_geo_module"
+    "--without-stream_map_module"
+    "--without-stream_split_clients_module"
+    "--without-stream_return_module"
+    "--without-stream_upstream_hash_module"
+    "--without-stream_upstream_least_conn_module"
+    "--without-stream_upstream_random_module"
+    "--without-stream_upstream_zone_module"
+  ] ++ optional (gd != null) "--with-http_image_filter_module"
+    ++ optional (with stdenv.hostPlatform; isLinux || isFreeBSD) "--with-file-aio"
+    ++ map (mod: "--add-module=${mod.src}") modules;
+
+  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2 -Wno-error=implicit-fallthrough"
+    + optionalString stdenv.isDarwin " -Wno-error=deprecated-declarations";
+
+  preConfigure = (concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules);
+
+  hardeningEnable = optional (!stdenv.isDarwin) "pie";
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    mv $out/sbin $out/bin
+  '';
+
+  passthru = {
+    inherit modules;
+    tests = nixosTests.nginx-variants.tengine;
+  };
+
+  meta = {
+    description = "A web server based on Nginx and has many advanced features, originated by Taobao";
+    homepage    = "https://tengine.taobao.org";
+    license     = licenses.bsd2;
+    platforms   = platforms.all;
+    maintainers = with maintainers; [ izorkin ];
+  };
+}
--- a/pkgs/servers/http/thttpd/default.nix
+++ b/pkgs/servers/http/thttpd/default.nix
@ -0,0 +1,29 @@
+{ lib, stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "thttpd";
+  version = "2.29";
+
+  src = fetchurl {
+    url = "https://acme.com/software/thttpd/${pname}-${version}.tar.gz";
+    sha256 = "15x3h4b49wgfywn82i3wwbf38mdns94mbi4ma9xiwsrjv93rzh4r";
+  };
+
+  prePatch = ''
+    sed -i -e 's/getline/getlineX/' extras/htpasswd.c
+    sed -i -e 's/chmod 2755/chmod 755/' extras/Makefile.in
+  '';
+
+  preInstall = ''
+    mkdir -p "$out/man/man1"
+    sed -i -e 's/-o bin -g bin *//' Makefile
+    sed -i -e '/chgrp/d' extras/Makefile
+  '';
+
+  meta = {
+    description = "Tiny/turbo/throttling HTTP server";
+    homepage = "http://www.acme.com/software/thttpd/";
+    license = lib.licenses.bsd2;
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/servers/http/tomcat/axis2/builder.sh
+++ b/pkgs/servers/http/tomcat/axis2/builder.sh
@ -0,0 +1,15 @@
+source $stdenv/setup
+
+unzip $src
+cd axis2-*
+mkdir -p $out
+cp -av * $out
+cd webapp
+ant
+cd ..
+mkdir -p $out/webapps
+cp dist/axis2.war $out/webapps
+cd $out/webapps
+mkdir axis2
+cd axis2
+unzip ../axis2.war
--- a/pkgs/servers/http/tomcat/axis2/default.nix
+++ b/pkgs/servers/http/tomcat/axis2/default.nix
@ -0,0 +1,22 @@
+{ lib, stdenv, fetchurl, apacheAnt, jdk, unzip }:
+
+stdenv.mkDerivation rec {
+  pname = "axis2";
+  version = "1.7.9";
+
+  src = fetchurl {
+    url = "http://apache.proserve.nl/axis/axis2/java/core/${version}/${pname}-${version}-bin.zip";
+    sha256 = "0dh0s9bfh95wmmw8nyf2yw95biq7d9zmrbg8k4vzcyz1if228lac";
+  };
+
+  nativeBuildInputs = [ unzip ];
+  buildInputs = [ apacheAnt jdk ];
+  builder = ./builder.sh;
+
+  meta = {
+    description = "Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack";
+    platforms = lib.platforms.unix;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    license = lib.licenses.asl20;
+  };
+}
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@ -0,0 +1,44 @@
+{ stdenv, lib, fetchurl }:
+
+let
+
+  common = { versionMajor, versionMinor, sha256 }: stdenv.mkDerivation (rec {
+    pname = "apache-tomcat";
+    version = "${versionMajor}.${versionMinor}";
+
+    src = fetchurl {
+      url = "mirror://apache/tomcat/tomcat-${versionMajor}/v${version}/bin/${pname}-${version}.tar.gz";
+      inherit sha256;
+    };
+
+    outputs = [ "out" "webapps" ];
+    installPhase =
+      ''
+        mkdir $out
+        mv * $out
+        mkdir -p $webapps/webapps
+        mv $out/webapps $webapps/
+      '';
+
+    meta = with lib; {
+      homepage = "https://tomcat.apache.org/";
+      description = "An implementation of the Java Servlet and JavaServer Pages technologies";
+      platforms = platforms.all;
+      maintainers = [ ];
+      license = [ licenses.asl20 ];
+    };
+  });
+
+in {
+  tomcat9 = common {
+    versionMajor = "9";
+    versionMinor = "0.53";
+    sha256 = "1zdnbb0bfbi7762lz69li0wf48jbfz1mv637jzcl42vbsxp4agkv";
+  };
+
+  tomcat10 = common {
+    versionMajor = "10";
+    versionMinor = "0.11";
+    sha256 = "1hjvsxxxavni7bis1hm56281ffmf4x0zdh65zqkrnhqa1rbs0lg2";
+  };
+}
--- a/pkgs/servers/http/tomcat/jdbc/mysql/default.nix
+++ b/pkgs/servers/http/tomcat/jdbc/mysql/default.nix
@ -0,0 +1,21 @@
+{ lib, stdenv, mysql_jdbc }:
+
+stdenv.mkDerivation {
+  pname = "tomcat-mysql-jdbc";
+  version = mysql_jdbc.version;
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    ln -s $mysql_jdbc/share/java/mysql-connector-java.jar $out/lib/mysql-connector-java.jar
+
+    runHook postInstall
+  '';
+
+  meta = {
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/servers/http/tomcat/tomcat-native.nix
+++ b/pkgs/servers/http/tomcat/tomcat-native.nix
@ -0,0 +1,29 @@
+{ lib, stdenv, fetchurl, apr, jdk, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "tomcat-native";
+  version = "1.2.31";
+
+  src = fetchurl {
+    url = "mirror://apache/tomcat/tomcat-connectors/native/${version}/source/${pname}-${version}-src.tar.gz";
+    sha512 = "2aaa93f0acf3eb780d39faeda3ece3cf053d3b6e2918462f7183070e8ab32232e035e9062f7c07ceb621006d727d3596d9b4b948f4432b4f625327b72fdb0e49";
+  };
+
+  sourceRoot = "${pname}-${version}-src/native";
+
+  buildInputs = [ apr jdk openssl ];
+
+  configureFlags = [
+    "--with-apr=${apr.dev}"
+    "--with-java-home=${jdk}"
+    "--with-ssl=${openssl.dev}"
+  ];
+
+  meta = with lib; {
+    description = "An optional component for use with Apache Tomcat that allows Tomcat to use certain native resources for performance, compatibility, etc";
+    homepage = "https://tomcat.apache.org/native-doc/";
+    license = licenses.asl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ aanderse ];
+  };
+}
--- a/pkgs/servers/http/trafficserver/default.nix
+++ b/pkgs/servers/http/trafficserver/default.nix
@ -0,0 +1,207 @@
+{ lib
+, stdenv
+, fetchzip
+, fetchpatch
+, makeWrapper
+, nixosTests
+, pkg-config
+, file
+, linuxHeaders
+, openssl
+, pcre
+, perlPackages
+, python3
+, xz
+, zlib
+, catch2
+# recommended dependencies
+, withHwloc ? true
+, hwloc
+, withCurl ? true
+, curl
+, withCurses ? true
+, ncurses
+, withCap ? stdenv.isLinux
+, libcap
+, withUnwind ? stdenv.isLinux
+, libunwind
+# optional dependencies
+, withBrotli ? false
+, brotli
+, withCjose ? false
+, cjose
+, withGeoIP ? false
+, geoip
+, withHiredis ? false
+, hiredis
+, withImageMagick ? false
+, imagemagick
+, withJansson ? false
+, jansson
+, withKyotoCabinet ? false
+, kyotocabinet
+, withLuaJIT ? false
+, luajit
+, withMaxmindDB ? false
+, libmaxminddb
+# optional features
+, enableWCCP ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "trafficserver";
+  version = "9.1.2";
+
+  src = fetchzip {
+    url = "mirror://apache/trafficserver/trafficserver-${version}.tar.bz2";
+    sha256 = "sha256-eRpyTdwwO5EzrVpt9fF6VEYGZjHb905nQJd065wY5RU=";
+  };
+
+  patches = [
+    # Adds support for NixOS
+    # https://github.com/apache/trafficserver/pull/7697
+    (fetchpatch {
+      url = "https://github.com/apache/trafficserver/commit/19d3af481cf74c91fbf713fc9d2f8b138ed5fbaf.diff";
+      sha256 = "0z1ikgpp00rzrrcqh97931586yn9wbksgai9xlkcjd5cg8gq0150";
+    })
+
+    ./fix-catch2-version-incompatibility.patch
+  ];
+
+  # NOTE: The upstream README indicates that flex is needed for some features,
+  # but it actually seems to be unnecessary as of this commit[1]. The detection
+  # logic for bison and flex is still present in the build script[2], but no
+  # other code seems to depend on it. This situation is susceptible to change
+  # though, so it's a good idea to inspect the build scripts periodically.
+  #
+  # [1]: https://github.com/apache/trafficserver/pull/5617
+  # [2]: https://github.com/apache/trafficserver/blob/3fd2c60/configure.ac#L742-L788
+  nativeBuildInputs = [ makeWrapper pkg-config file python3 ]
+    ++ (with perlPackages; [ perl ExtUtilsMakeMaker ])
+    ++ lib.optionals stdenv.isLinux [ linuxHeaders ];
+
+  buildInputs = [
+    openssl
+    pcre
+    perlPackages.perl
+  ] ++ lib.optional withBrotli brotli
+  ++ lib.optional withCap libcap
+  ++ lib.optional withCjose cjose
+  ++ lib.optional withCurl curl
+  ++ lib.optional withGeoIP geoip
+  ++ lib.optional withHiredis hiredis
+  ++ lib.optional withHwloc hwloc
+  ++ lib.optional withImageMagick imagemagick
+  ++ lib.optional withJansson jansson
+  ++ lib.optional withKyotoCabinet kyotocabinet
+  ++ lib.optional withCurses ncurses
+  ++ lib.optional withLuaJIT luajit
+  ++ lib.optional withUnwind libunwind
+  ++ lib.optional withMaxmindDB libmaxminddb;
+
+  outputs = [ "out" "man" ];
+
+  postPatch = ''
+    patchShebangs \
+      iocore/aio/test_AIO.sample \
+      src/traffic_via/test_traffic_via \
+      src/traffic_logstats/tests \
+      tools/check-unused-dependencies
+
+    substituteInPlace configure --replace '/usr/bin/file' '${file}/bin/file'
+
+    # TODO: remove after the following change has been released
+    # https://github.com/apache/trafficserver/pull/8683
+    cp ${catch2}/include/catch2/catch.hpp tests/include/catch.hpp
+  '' + lib.optionalString stdenv.isLinux ''
+    substituteInPlace configure \
+      --replace '/usr/include/linux' '${linuxHeaders}/include/linux'
+  '' + lib.optionalString stdenv.isDarwin ''
+    # 'xcrun leaks' probably requires non-free XCode
+    substituteInPlace iocore/net/test_certlookup.cc \
+      --replace 'xcrun leaks' 'true'
+  '';
+
+  configureFlags = [
+    "--enable-layout=NixOS"
+    "--enable-experimental-plugins"
+    (lib.enableFeature enableWCCP "wccp")
+
+    # the configure script can't auto-locate the following from buildInputs
+    "--with-lzma=${xz.dev}"
+    "--with-zlib=${zlib.dev}"
+    (lib.withFeatureAs withHiredis "hiredis" hiredis)
+  ];
+
+  installFlags = [
+    "pkgsysconfdir=${placeholder "out"}/etc/trafficserver"
+
+    # replace runtime directories with an install-time placeholder directory
+    "pkgcachedir=${placeholder "out"}/.install-trafficserver"
+    "pkglocalstatedir=${placeholder "out"}/.install-trafficserver"
+    "pkglogdir=${placeholder "out"}/.install-trafficserver"
+    "pkgruntimedir=${placeholder "out"}/.install-trafficserver"
+  ];
+
+  postInstall = ''
+    substituteInPlace rc/trafficserver.service --replace "syslog.target" ""
+    install -Dm644 rc/trafficserver.service $out/lib/systemd/system/trafficserver.service
+
+    wrapProgram $out/bin/tspush \
+      --set PERL5LIB '${with perlPackages; makePerlPath [ URI ]}' \
+      --prefix PATH : "${lib.makeBinPath [ file ]}"
+
+    find "$out" -name '*.la' -delete
+
+    # ensure no files actually exist in this directory
+    rmdir $out/.install-trafficserver
+  '';
+
+  installCheckPhase = let
+    expected = ''
+      Via header is [uScMsEf p eC:t cCMp sF], Length is 22
+      Via Header Details:
+      Request headers received from client                   :simple request (not conditional)
+      Result of Traffic Server cache lookup for URL          :miss (a cache "MISS")
+      Response information received from origin server       :error in response
+      Result of document write-to-cache:                     :no cache write performed
+      Proxy operation result                                 :unknown
+      Error codes (if any)                                   :connection to server failed
+      Tunnel info                                            :no tunneling
+      Cache Type                                             :cache
+      Cache Lookup Result                                    :cache miss (url not in cache)
+      Parent proxy connection status                         :no parent proxy or unknown
+      Origin server connection status                        :connection open failed
+    '';
+  in ''
+    runHook preInstallCheck
+    diff -Naur <($out/bin/traffic_via '[uScMsEf p eC:t cCMp sF]') - <<EOF
+    ${lib.removeSuffix "\n" expected}
+    EOF
+    runHook postInstallCheck
+  '';
+
+  doCheck = true;
+  doInstallCheck = true;
+  enableParallelBuilding = true;
+
+  passthru.tests = { inherit (nixosTests) trafficserver; };
+
+  meta = with lib; {
+    homepage = "https://trafficserver.apache.org";
+    changelog = "https://raw.githubusercontent.com/apache/trafficserver/${version}/CHANGELOG-${version}";
+    description = "Fast, scalable, and extensible HTTP caching proxy server";
+    longDescription = ''
+      Apache Traffic Server is a high-performance web proxy cache that improves
+      network efficiency and performance by caching frequently-accessed
+      information at the edge of the network. This brings content physically
+      closer to end users, while enabling faster delivery and reduced bandwidth
+      use. Traffic Server is designed to improve content delivery for
+      enterprises, Internet service providers (ISPs), backbone providers, and
+      large intranets by maximizing existing and available bandwidth.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ midchildan ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/servers/http/trafficserver/fix-catch2-version-incompatibility.patch
+++ b/pkgs/servers/http/trafficserver/fix-catch2-version-incompatibility.patch
@ -0,0 +1,43 @@
+diff --git a/src/tscore/unit_tests/test_History.cc b/src/tscore/unit_tests/test_History.cc
+index 3e699139da0..7505f10aa4c 100644
+--- a/src/tscore/unit_tests/test_History.cc
+++ b/src/tscore/unit_tests/test_History.cc
+@@ -59,10 +59,10 @@ TEST_CASE("History", "[libts][History]")
+   REQUIRE(history[2].reentrancy == static_cast<short>(NO_REENTRANT));
+ 
+   history[0].location.str(buf, sizeof(buf));
+-  REQUIRE(string_view{buf} == "test_History.cc:48 (____C_A_T_C_H____T_E_S_T____0)");
+  REQUIRE(string_view{buf} == "test_History.cc:48 (C_A_T_C_H_T_E_S_T_0)");
+ 
+   history[1].location.str(buf, sizeof(buf));
+-  REQUIRE(string_view{buf} == "test_History.cc:49 (____C_A_T_C_H____T_E_S_T____0)");
+  REQUIRE(string_view{buf} == "test_History.cc:49 (C_A_T_C_H_T_E_S_T_0)");
+ 
+   ts::LocalBufferWriter<128> w;
+   SM<HISTORY_DEFAULT_SIZE> *sm = new SM<HISTORY_DEFAULT_SIZE>;
+@@ -71,10 +71,10 @@ TEST_CASE("History", "[libts][History]")
+   SM_REMEMBER(sm, 3, NO_REENTRANT);
+ 
+   w.print("{}", sm->history[0].location);
+-  REQUIRE(w.view() == "test_History.cc:69 (____C_A_T_C_H____T_E_S_T____0)");
+  REQUIRE(w.view() == "test_History.cc:69 (C_A_T_C_H_T_E_S_T_0)");
+ 
+   w.reset().print("{}", sm->history[1].location);
+-  REQUIRE(w.view() == "test_History.cc:70 (____C_A_T_C_H____T_E_S_T____0)");
+  REQUIRE(w.view() == "test_History.cc:70 (C_A_T_C_H_T_E_S_T_0)");
+ 
+   REQUIRE(sm->history[0].event == 1);
+   REQUIRE(sm->history[0].reentrancy == 1);
+@@ -106,10 +106,10 @@ TEST_CASE("History", "[libts][History]")
+   REQUIRE(sm2->history.overflowed() == true);
+ 
+   w.reset().print("{}", sm2->history[0].location);
+-  REQUIRE(w.view() == "test_History.cc:103 (____C_A_T_C_H____T_E_S_T____0)");
+  REQUIRE(w.view() == "test_History.cc:103 (C_A_T_C_H_T_E_S_T_0)");
+ 
+   w.reset().print("{}", sm2->history[1].location);
+-  REQUIRE(w.view() == "test_History.cc:98 (____C_A_T_C_H____T_E_S_T____0)");
+  REQUIRE(w.view() == "test_History.cc:98 (C_A_T_C_H_T_E_S_T_0)");
+ 
+   sm2->history.clear();
+   REQUIRE(sm2->history.size() == 0);
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@ -0,0 +1,85 @@
+{ lib, stdenv, fetchFromGitHub, nixosTests, which
+, pcre2
+, withPython3 ? true, python3, ncurses
+, withPHP74 ? false, php74
+, withPHP80 ? true, php80
+, withPerl532 ? false, perl532
+, withPerl534 ? true, perl534
+, withPerldevel ? false, perldevel
+, withRuby_2_7 ? false, ruby_2_7
+, withSSL ? true, openssl ? null
+, withIPv6 ? true
+, withDebug ? false
+}:
+
+with lib;
+
+let
+  phpConfig = {
+    embedSupport = true;
+    apxs2Support = false;
+    systemdSupport = false;
+    phpdbgSupport = false;
+    cgiSupport = false;
+    fpmSupport = false;
+  };
+
+  php74-unit = php74.override phpConfig;
+  php80-unit = php80.override phpConfig;
+
+in stdenv.mkDerivation rec {
+  version = "1.26.1";
+  pname = "unit";
+
+  src = fetchFromGitHub {
+    owner = "nginx";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-rTT7EJSHepGOwNXVqlOBOhZayZQXyNo3B2Oa1oLf2FI=";
+  };
+
+  nativeBuildInputs = [ which ];
+
+  buildInputs = [ pcre2.dev ]
+    ++ optionals withPython3 [ python3 ncurses ]
+    ++ optional withPHP74 php74-unit
+    ++ optional withPHP80 php80-unit
+    ++ optional withPerl532 perl532
+    ++ optional withPerl534 perl534
+    ++ optional withPerldevel perldevel
+    ++ optional withRuby_2_7 ruby_2_7
+    ++ optional withSSL openssl;
+
+  configureFlags = [
+    "--control=unix:/run/unit/control.unit.sock"
+    "--pid=/run/unit/unit.pid"
+    "--user=unit"
+    "--group=unit"
+  ] ++ optional withSSL     "--openssl"
+    ++ optional (!withIPv6) "--no-ipv6"
+    ++ optional withDebug   "--debug";
+
+  # Optionally add the PHP derivations used so they can be addressed in the configs
+  usedPhp74 = optionals withPHP74 php74-unit;
+  usedPhp80 = optionals withPHP80 php80-unit;
+
+  postConfigure = ''
+    ${optionalString withPython3    "./configure python --module=python3  --config=python3-config  --lib-path=${python3}/lib"}
+    ${optionalString withPHP74      "./configure php    --module=php74    --config=${php74-unit.unwrapped.dev}/bin/php-config --lib-path=${php74-unit}/lib"}
+    ${optionalString withPHP80      "./configure php    --module=php80    --config=${php80-unit.unwrapped.dev}/bin/php-config --lib-path=${php80-unit}/lib"}
+    ${optionalString withPerl532    "./configure perl   --module=perl532  --perl=${perl532}/bin/perl"}
+    ${optionalString withPerl534    "./configure perl   --module=perl534  --perl=${perl534}/bin/perl"}
+    ${optionalString withPerldevel  "./configure perl   --module=perldev  --perl=${perldevel}/bin/perl"}
+    ${optionalString withRuby_2_7   "./configure ruby   --module=ruby27   --ruby=${ruby_2_7}/bin/ruby"}
+  '';
+
+  passthru.tests.unit-php = nixosTests.unit-php;
+
+  meta = {
+    description = "Dynamic web and application server, designed to run applications in multiple languages";
+    homepage    = "https://unit.nginx.org/";
+    license     = licenses.asl20;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ izorkin ];
+  };
+}
--- a/pkgs/servers/http/webfs/default.nix
+++ b/pkgs/servers/http/webfs/default.nix
@ -0,0 +1,35 @@
+{ lib, stdenv, fetchurl, openssl }:
+let
+  # Let's not pull the whole apache httpd package
+  mime_file = fetchurl {
+    url = "https://raw.githubusercontent.com/apache/httpd/906e419c1f703360e2e8ec077b393347f993884f/docs/conf/mime.types";
+    sha256 = "ef972fc545cbff4c0daa2b2e6b440859693b3c10435ee90f10fa6fffad800c16";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "webfs";
+  version = "1.21";
+
+  src = fetchurl {
+    url = "https://www.kraxel.org/releases/webfs/${pname}-${version}.tar.gz";
+    sha256 = "98c1cb93473df08e166e848e549f86402e94a2f727366925b1c54ab31064a62a";
+  };
+
+  patches = [ ./ls.c.patch ];
+
+  buildInputs = [ openssl ];
+
+  makeFlags = [
+    "mimefile=${mime_file}"
+    "prefix=$(out)"
+  ];
+
+  meta = with lib; {
+    description = "HTTP server for purely static content";
+    homepage    = "http://linux.bytesex.org/misc/webfs.html";
+    license     = licenses.gpl2;
+    platforms   = platforms.all;
+    maintainers = with maintainers; [ zimbatm ];
+    mainProgram = "webfsd";
+  };
+}
--- a/pkgs/servers/http/webfs/ls.c.patch
+++ b/pkgs/servers/http/webfs/ls.c.patch
@ -0,0 +1,13 @@
+# Source: homebrew
+# https://raw.githubusercontent.com/Homebrew/patches/0518a6d1/webfs/patch-ls.c
+--- ./ls.c.orig	Fri Oct 15 14:20:50 2004
+++ ./ls.c	Fri Oct 15 14:21:13 2004
+@@ -160,7 +160,7 @@
+     return buf;
+ }
+ 
+-#if !defined(__FreeBSD__) && !defined(__OpenBSD__)
+#if !defined(__FreeBSD__) && !defined(__OpenBSD__) && !defined(__APPLE__)
+ static void strmode(mode_t mode, char *dest)
+ {
+     static const char *rwx[] = {
--- a/pkgs/servers/http/webhook/default.nix
+++ b/pkgs/servers/http/webhook/default.nix
@ -0,0 +1,29 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "webhook";
+  version = "2.8.0";
+
+  src = fetchFromGitHub {
+    owner = "adnanh";
+    repo = "webhook";
+    rev = version;
+    sha256 = "0n03xkgwpzans0cymmzb0iiks8mi2c76xxdak780dk0jbv6qgp5i";
+  };
+
+  vendorSha256 = null;
+
+  subPackages = [ "." ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Incoming webhook server that executes shell commands";
+    homepage = "https://github.com/adnanh/webhook";
+    license = licenses.mit;
+    maintainers = with maintainers; [ azahi ];
+  };
+}
--- a/pkgs/servers/http/yaws/default.nix
+++ b/pkgs/servers/http/yaws/default.nix
@ -0,0 +1,35 @@
+{lib, stdenv, fetchurl, erlang, pam, perl }:
+
+stdenv.mkDerivation rec {
+  pname = "yaws";
+  version = "2.0.6";
+
+  src = fetchurl {
+    url = "http://yaws.hyber.org/download/${pname}-${version}.tar.gz";
+    sha256 = "03nh97g7smsgm6sw5asssmlq7zgx6y2gnn7jn0lv2x5mkf5nzyb9";
+  };
+
+  # The tarball includes a symlink yaws -> yaws-1.95, which seems to be
+  # necessary for importing erlang files
+  unpackPhase = ''
+    tar xzf $src
+    cd $name
+  '';
+
+  configureFlags = [ "--with-extrainclude=${pam}/include/security" ];
+
+  buildInputs = [ erlang pam perl ];
+
+  postInstall = ''
+    sed -i "s#which #type -P #" $out/bin/yaws
+  '';
+
+  meta = with lib; {
+    description = "A high performance HTTP 1.1 server in Erlang";
+    homepage = "http://yaws.hyber.org";
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ goibhniu ];
+  };
+
+}