Code change:
<ins> From f6a978f024d01202f954483423af1b2d5d5159a6 Mon Sep 17 00:00:00 2001 From: Yegor Timoshenko <yegortimoshenko@riseup.net> Date: Fri, 28 Sep 2018 03:27:04 +0000 Subject: [PATCH] If root is in Nix store, set ETag to its path hash --- src/http/ngx_http_core_module.c | 56 +++++++++++++++++++++++++++++---- 1 file changed, 50 insertions(+), 6 deletions(-) diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c index c57ec00c..b7992de2 100644 --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -1583,6 +1583,7 @@ ngx_http_set_etag(ngx_http_request_t *r) { ngx_table_elt_t           *etag; ngx_http_core_loc_conf_t  *clcf; +    u_char                    *real, *ptr1, *ptr2; clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module); @@ -1598,16 +1599,61 @@ ngx_http_set_etag(ngx_http_request_t *r) etag->hash = 1; ngx_str_set(&etag->key, "ETag"); -    etag->value.data = ngx_pnalloc(r->pool, NGX_OFF_T_LEN + NGX_TIME_T_LEN + 3); -    if (etag->value.data == NULL) { +    real = ngx_realpath(clcf->root.data, NULL); + +    if (real == NULL) { etag->hash = 0; return NGX_ERROR; } -    etag->value.len = ngx_sprintf(etag->value.data, ""%xT-%xO"", -                                  r->headers_out.last_modified_time, -                                  r->headers_out.content_length_n) -                      - etag->value.data; +    #define NIX_STORE_DIR "@nixStoreDir@" +    #define NIX_STORE_LEN @nixStoreDirLen@ + +    if (r->headers_out.last_modified_time == 1 +        && !ngx_strncmp(real, NIX_STORE_DIR, NIX_STORE_LEN) +        && real[NIX_STORE_LEN] == '/' +        && real[NIX_STORE_LEN + 1] != '0') +    { +        ptr1 = real + NIX_STORE_LEN; +        *ptr1 = '"'; + +        ptr2 = (u_char *) ngx_strchr(ptr1, '-'); + +        if (ptr2 == NULL) { +            ngx_free(real); +            etag->hash = 0; +            return NGX_ERROR; +        } + +        *ptr2++ = '"'; +        *ptr2 = '0'; + +        etag->value.len = ngx_strlen(ptr1); +        etag->value.data = ngx_pnalloc(r->pool, etag->value.len); + +        if (etag->value.data == NULL) { +            ngx_free(real); +            etag->hash = 0; +            return NGX_ERROR; +        } + +        ngx_memcpy(etag->value.data, ptr1, etag->value.len); +    } else { +        etag->value.data = ngx_pnalloc(r->pool, NGX_OFF_T_LEN + NGX_TIME_T_LEN + 3); + +        if (etag->value.data == NULL) { +            ngx_free(real); +            etag->hash = 0; +            return NGX_ERROR; +        } + +        etag->value.len = ngx_sprintf(etag->value.data, ""%xT-%xO"", +                                      r->headers_out.last_modified_time, +                                      r->headers_out.content_length_n) +                          - etag->value.data; +    } + +    ngx_free(real); r->headers_out.etag = etag; -- 2.19.0 </ins>

Related discussion:
text: If you serve files from , nginx will set last-modified header to unix timestamp 1. The result is that browser will cache indefinitely. Not sure what we should do about it really, following nginx configuration helps:
Why do you need to turn etag off?
Ah, I see. nginx's etags aren't hashes.
I wonder if we could find a way to pull the hash out of the nix store path and put it into an etag header.
Thanks for finding this. I've been having issues with broken caching on my nginx/nixos server. Even when the files on the server were updated (files in the nix store), the browser was told that no change had happened. If I'm understanding this correctly, since nginx's etags are based on filesystem modification time; you can't have proper cache invalidation (ie. it will always send 304 not modified). Or is there a workaround?
+1 this is a problem. And turning off etag seems like overkill. Is there some way to 1) set the date on a file so that Nginx can pick it up, or 2) do something else awesome?
Is the zero-timestamp rule set in stone in Nix, or is there some way to override it if you really want a file in /nix/store to have a particular timestamp?
I think we could get away with: It's not perfect, as it will change on each Nix evaluation instead of being content addressed. Another way would be to turn the store path passed to nginx directive to translate into an etag.
The etag function is at called from and . Making it dependent on the realpath of the file seems doable.
Explanation how to configure nginx to use the hash from the nix path:
In my testing, this sends the correct etag, but does not send the 304 not modified, when the etag matches. Also, the header gets stripped out when compression is enabled.
It's working perfectly for me. I've gzip compression enabled, the etag header is sent and the browser gets a 304 when querying the header.
Nice! An example with a directory would be more common:
I've to correct what I said. your statement seems to be correct. What happens in my case is that Cloudflare is actually handling the caching of the ETag correctly, not nginx.