Package composition

Authenticated meta-packages may contribute only named nginx.virtualHosts and nginx.upstreams entries. They cannot enable nginx or replace global policy.

TLS credentials

Certificate and private-key values are opaque references resolved into optional volatile systemd credentials. Secret bytes never enter Nix evaluation, the store, or generated configuration.

Quick start

Install nginx, set nginx.enable, and declare at least one virtual host. AOS validates each candidate with nginx -t before activation and reloads a running master in place.

{
  aos.apm.desiredPackages = ["nginx"];
  nginx.enable = true;
  nginx.virtualHosts.default.listen = [8080];
}