Commit Graph

1819 Commits

Author SHA1 Message Date
volth
6abba2294d nixos/nat: use nixos-nat-out instead of OUTPUT 2020-01-12 00:06:49 +01:00
0x4A6F
c9ca370e32
nixos/xandikos: init 2020-01-11 16:08:45 +01:00
Daniel Fullmer
27b8253655 nixos/zerotierone: prevent systemd from changing MAC address 2020-01-09 17:51:44 -05:00
markuskowa
2913973aa7
Merge pull request #76938 from lourkeur/fix_76184_gnunet
nixos/gnunet: Add types to the options
2020-01-09 21:33:50 +01:00
Pascal Bach
0319241132 nixos/mxisd: fix empty user name 2020-01-08 23:18:26 +01:00
Milan Pässler
2a31a6a412 tree-wide: fix errors and warning related to loaOf deprecation 2020-01-07 06:23:28 +01:00
rnhmjoj
1d61efb7f1 treewide: use attrs instead of list for types.loaOf options 2020-01-06 10:39:18 -05:00
Louis Bettens
d49737836a nixos/gnunet: Add types to the options 2020-01-05 00:07:50 +01:00
Christian Kauhaus
129c73802f
Merge pull request #76153 from arcnmx/connman-iwd
nixos/connman: optional iwd backend
2020-01-02 21:35:54 +01:00
Silvan Mosberger
cdf79db19d
Module system improvements for NixOS as a submodule (#75031)
Module system improvements for NixOS as a submodule
2020-01-02 20:38:45 +01:00
Silvan Mosberger
bc42515736
nixos/syncthing: Fix submodule name usage
Module arguments should be taken from the arguments directly. This
allows evalModule's specialArgs to override them if necessary
2020-01-02 09:59:35 +01:00
Tim J. Baumann
36b98fdf26 networkmanager: fix dispatcherScripts example
Before, the example script didn't actually exit when the event type
didn't match "up".
2020-01-01 15:32:15 +01:00
Ryan Mulligan
3a644e30b9
Merge pull request #46131 from ju1m/shorewall
shorewall: init at 5.2.3.3
2019-12-30 10:04:31 -08:00
Julien Moutinho
56a73dfb35 shorewall: init at 5.2.3.3
nixos/shorewall: init
2019-12-30 09:42:03 -08:00
Vladimír Čunát
c3d4998e41
Merge #75803: kresd service: unify listen declarations 2019-12-27 15:55:38 +01:00
Tad Fisher
b4bacff13f nixos/keybase, nixos/kbfs: update service configs; add redirector 2019-12-23 22:55:06 -08:00
Florian Klink
eeaf1f702d
Merge pull request #75103 from sternenseemann/spacecookie
services/spacecookie: init
2019-12-23 11:09:52 +01:00
arcnmx
7753d58e89 nixos/connman: optional iwd backend 2019-12-21 13:48:15 -08:00
Florian Klink
e46abc6b8d
Merge pull request #76069 from misuzu/package-3proxy
nixos/3proxy: manual validation fix
2019-12-20 02:15:45 +01:00
misuzu
b6f87c688b nixos/3proxy: manual validation fix 2019-12-20 00:17:49 +02:00
Michael Raskin
6210c15573
Merge pull request #67507 from misuzu/package-3proxy
3proxy: init at 0.8.13
2019-12-19 15:42:15 +00:00
sternenseemann
25503db8e8 nixos/spacecookie: add service module and test 2019-12-17 14:17:03 +01:00
Dustin Frisch
f886a14dbd
kresd: Unified listen declarations
Deperecates the interfaces option which was used to generate a host:port
list whereas the port was always hardcoded to 53. This unifies the
listen configuration for plain and TLS sockets and allows to specify a
port without an address for wildcard binds.
2019-12-17 12:44:24 +01:00
Netix (Espinet François)
cd3597b486
openvswitch: better integration with systemd
Systemd dependencies for scripted mode
were refactored according to analysis in #34586.

networking.vswitches can now be used with systemd-networkd,
although they are not supported by the daemon, a nixos receipe
creates the switch and attached required interfaces (just like
the scripted version).

Vlans and internal interfaces are implemented following the
  template format i.e. each interface is
described using an attributeSet (vlan and type at the moment).
If vlan is present, then interface is added to the vswitch with
given tag (access mode). Type internal enabled vswitch to create
interfaces (see openvswitch docs).

Added configuration for configuring supported openFlow version on
the vswitch

This commit is a split from the original PR #35127.
2019-12-15 21:16:26 +01:00
Bernardo Meurer
5ee439eb08
nixos: fix ip46tables invocation in nat 2019-12-14 20:13:12 -08:00
volth
018c0445ba nixos/unbound: add package option 2019-12-12 23:49:47 +00:00
Andreas Rammhold
e8bb94fca9
Merge pull request #68459 from volth/patch-364
nixos/nat: create nixos-nat-{pre,post,out} in ip6tables too
2019-12-12 15:55:51 +01:00
Silvan Mosberger
4ee3e8b21d
nixos/treewide: Move rename.nix imports to their respective modules
A centralized list for these renames is not good because:
- It breaks disabledModules for modules that have a rename defined
- Adding/removing renames for a module means having to find them in the
central file
- Merge conflicts due to multiple people editing the central file
2019-12-10 02:51:19 +01:00
Emery Hemingway
6c1c99d6b4 nixos/yggdrasil: fix for configFile option
The configFile was not being merged with the declarative configuration at
runtime.
2019-12-07 19:56:49 +01:00
rnhmjoj
1a2e7c3b00
nixos: add myself to maintainers 2019-12-04 17:09:53 +01:00
Mario Rodas
93ff0446ca
Merge pull request #66089 from servalcatty/v2ray
v2ray: init at 4.21.3
2019-12-03 04:42:50 -05:00
Renaud
e37e7b413c
Merge pull request #72987 from rnhmjoj/dnschain
nixos/dnschain: use forwardZonesRecurse in pdns-recursor
2019-11-29 19:56:21 +01:00
Serval
899d38170c
v2ray: fixups and change to buildGoModule 2019-11-28 02:10:37 +08:00
misuzu
823d6698bb nixos/3proxy: note about htpasswd 2019-11-27 11:01:48 +02:00
Robin Gloster
c33110db9e
Merge pull request #73299 from toonn/wpa_supplicant-unit-start-bonding
nixos/wpa_supplicant: fix unit-start script
2019-11-26 16:48:48 +01:00
worldofpeace
38178a9a5b
Merge pull request #74030 from ckauhaus/connman-to-services.networking
connman: move "networking.connman" options to "services.connman"
2019-11-24 21:24:33 +00:00
Christian Kauhaus
edbf94d2ee connman: move options to services
As part of the networking.* name space cleanup, connman should be moved
to services.connman. The same will happen for example with
networkmanager in a separate PR.
2019-11-24 16:23:32 -05:00
John Ericson
d0d5136cce Merge remote-tracking branch 'upstream/master' into wrapper-pname-support 2019-11-24 17:25:07 +00:00
John Ericson
9b090ccbca treewide: Get rid of most parseDrvName without breaking compat
That is because this commit should be merged to both master and
release-19.09.
2019-11-24 17:22:28 +00:00
Serval
740e85f847
v2ray: add v2ray service 2019-11-21 21:51:10 +08:00
William G Hatch
9abc97dc65 bind: Expand description of services.bind.cacheNetworks
The new description should give more clear understanding of when to
edit the option.

I used NixOS to set up a DNS server that is authoritative for certain
zones.  The description of the `cacheNetworks` option made me think I
needed to set it to `"any"` to allow people to query the zone I set
up.  Reading the source of the module would have clarified my
understanding, but at the time I just read the description and thought
little of it.  Later I discovered I was getting tons of DNS requests
and presumably being used for a DNS amplification attack or similar.
I have fixed the problem now, but I would like the option to have a
clearer description so others don't make the same mistake I did.
2019-11-19 22:24:30 +01:00
Ingolf Wagner
dcdf4cec3a nixos/syncthing: add versioning 2019-11-19 20:31:30 +01:00
Erik Arvstedt
8aa5f30a8f nixos/bitcoind: remove PermissionsStartOnly
Unneded because there are no extra commands like ExecStartPre
2019-11-18 21:48:02 +01:00
Jelle Besseling
823852a6a9 nixos/eternal-terminal: add firewall information
(#71917)
2019-11-18 16:12:12 +01:00
Emery Hemingway
7a1b4d1964 nixos/yggdrasil: remove /etc effects
Use of the /etc directory should be avoided for software without
hardcoded configuration paths.
2019-11-16 16:36:17 +01:00
Franz Pletz
e84840117b
Merge pull request #71510 from asymmetric/wg-ns
Add namespace support to Wireguard module
2019-11-14 01:24:59 +00:00
Félix Baylac-Jacqué
a628f5efd9
modules/vsftpd: Add virtual users support
Add a virtual user system based around pam and a Berkeley
user database.

Adding the:

- localRoot
- userDbPath
- allowWriteableChroot
- virtualUseLocalPrivs

Vsftpd options.
2019-11-13 18:17:04 +01:00
toonn
82fc9ab5c8 nixos/wpa_supplicant: fix unit-start script
Ever since setting up bonding the `wpa_supplicant-unit-start` script has
been failing. This is because the file `bonding_masters` in
`/sys/class/net/` is *not* a directory containing `uevent`.

Adding a test to verify the `uevent` path to be sourced exists resolves
the problem.
2019-11-12 17:53:29 +01:00
misuzu
08eb63b5ac nixos/3proxy: init 2019-11-11 16:15:29 +02:00
worldofpeace
488e6b7a23
Merge pull request #73059 from flokli/nixos-test-port-tinydns
nixos/tinydns: port test to python
2019-11-09 21:53:07 +00:00
Peter Hoeg
954e234b98 nixos/haproxy: support hot-reload without dropping packets 2019-11-09 10:11:57 -08:00
Lorenzo Manacorda
412f6a967d wireguard: add creation and destination namespaces
The two new options make it possible to create the interface in one namespace
and move it to a different one, as explained at https://www.wireguard.com/netns/.
2019-11-09 11:59:14 +01:00
Silvan Mosberger
3022fde292
Merge pull request #71576 from ShaRose/patch-1
nixos/dnsdist: Add CAP_NET_BIND_SERVICE to AmbientCapabilities
2019-11-09 00:07:09 +01:00
Florian Klink
cbd9e9e01f nixos/tinydns: order service after network.target
In cases where you boot up really quickly (like in the VM test on a
non-busy host), tinydns might want to bind before the loopback interface
is fully up. Order tinydns after network.target to fix that.
2019-11-08 17:26:34 +01:00
rnhmjoj
38d573426a
nixos/dnschain: use forwardZonesRecurse in pdns-recursor 2019-11-07 17:09:24 +01:00
rnhmjoj
28c8884e62
nixos/pdns-recursor: add option for recursive forward zones 2019-11-07 17:08:09 +01:00
Silvan Mosberger
d34194badd
nixos/networkmanager: fix merging options (#72916)
nixos/networkmanager: fix merging options
2019-11-06 23:34:40 +01:00
Jan Tojnar
894fdfaf1f
nixos/networkmanager: fix merging options
Incorrect merging of modules resulted in dhcpcd being enabled causing flaky network connection.

https://github.com/NixOS/nixpkgs/pull/64364

Fixing it uncovered an infinite recursion from the same commit, previously masked by the incorrect merge.

We can just drop the `mkDefault` for `networking.wireless.enable` as it is already `false` by default.

Closes: https://github.com/NixOS/nixpkgs/issues/72416
2019-11-06 21:26:03 +01:00
Maximilian Bosch
51d1821509
nixos/dhcpcd: restart dhcpcd if exit hook changed
This change ensures that `dhcpcd.service` is restarted as soon as the
exit hook changes. I use this hook to do additional configuration for my
network (like setting a route via the given gateway to my WireGuard) and
when changing parts of this exit hook I'd expect to get this activated
when switching to my new configuration.
2019-11-06 20:49:22 +01:00
Eelco Dolstra
aa98348f88
jormungandr: Remove
This is a good example of a package/module that should be distributed
externally (e.g. as a flake [1]): it's not stable yet so anybody who
seriously wants to use it will want to use the upstream repo. Also,
it's highly specialized so NixOS is not really the right place at the
moment (every NixOS module slows down NixOS evaluation for everybody).

[1] https://github.com/edolstra/jormungandr/tree/flake
2019-11-05 15:00:58 +01:00
Max Veytsman
de1cbcc692 nixos/nat: fix typo in comment
This iptables directive is marking packets coming from the internal interfaces so they can later be NATed by the rule in 22378e6996/nixos/modules/services/networking/nat.nix (L38-L42) .

Fix the comment accordingly.
2019-11-04 17:00:22 +01:00
Marek Mahut
43a0b4b31f
Merge pull request #72415 from 1000101/trickster
nixos/trickster: init
2019-11-01 15:39:50 +01:00
Silvan Mosberger
dd0a47e7ae
treewide: Switch to system users (#71055)
treewide: Switch to system users
2019-11-01 13:26:43 +01:00
Jan Hrnko
9b0aefac86 nixos/trickster: init 2019-11-01 10:57:29 +01:00
ShaRose
9e2308ed80 nixos/dnsdist: Add CAP_NET_BIND_SERVICE to AmbientCapabilities
It seems that dnsdist doesn't actually request CAP_NET_BIND_SERVICE, which is why normally it's executed and root and setuids to another, unprivileged, user. This means that as it is, dnsdist will be unable to bind to any port under 1024 and will fail with access denied.

Removing CAP_SETGID and CAP_SETUID is also related to this as we don't actually change the uid or gid after the fact as we use DynamicUser. (That part isn't strictly NEEDED but there's no reason to have those capabilities if we don't use them).

There are also some additional sandboxing we can remove from the service definition as they are assumed true or strict by DynamicUser: specifically PrivateTmp and ProtectSystem respectively.

ProtectHome is still there, despite being assumed read-only as setting it to true means they are seen as empty. I don't think it really matters as I don't know if systemd will ignore it or not, but I didn't see any reason to go hunting for excuses to make it a bigger change.
2019-10-31 13:27:55 -02:30
Silvan Mosberger
90e30394f5
go-shadowsocks2: init at 0.0.11 (#67516)
go-shadowsocks2: init at 0.0.11
2019-10-30 01:05:59 +01:00
Gemini Lasswell
d6549a2c42 nixos/yggdrasil: remove DynamicUser for systemd 243 2019-10-26 13:51:31 +02:00
Gemini Lasswell
b8cb8c39d6 nixos/yggdrasil: add service 2019-10-26 13:51:31 +02:00
Janne Heß
2abe2b2cda nixos/stunnel: Add maintainers 2019-10-25 16:19:57 +02:00
Janne Heß
4a32dbd1e1 nixos/stunnel: Fix CA files 2019-10-25 16:19:57 +02:00
Ricardo M. Correia
4cd2cb43fb
Merge pull request #71137 from erictapen/smokeping-fix-permission
nixos/smokeping: replace smokeping.fcgi with a symlink
2019-10-23 18:19:15 +00:00
Florian Klink
f24b4fb411
nixos/networkmanager: remove networking.networkmanager.dynamic… (#71337)
nixos/networkmanager: remove networking.networkmanager.dynamicHosts
2019-10-21 02:33:28 +02:00
Florian Klink
ca6c91e395 nixos/networkmanager: remove networking.networkmanager.dynamicHosts
This option was removed because allowing (multiple) regular users to
override host entries affecting the whole system opens up a huge attack
vector. There seem to be very rare cases where this might be useful.
Consider setting system-wide host entries using networking.hosts,
provide them via the DNS server in your network, or use
networking.networkmanager.appendNameservers to point your system to
another (local) nameserver to set those entries.
2019-10-20 16:37:41 +02:00
Symphorien Gibol
a37b9636f7 networkmanager-fortisslvpn: create the local state directory
Otherwise connecting simply fails:
VPN connection: failed to connect: 'La création du fichier « /tmp/lib/NetworkManager-fortisslvpn/0507e3ef-f0e0-4153-af64-b3d9a025877c.config.XSB19Z » a échoué : No such file or directory'
2019-10-18 19:49:56 -04:00
Florian Klink
c41b37ef25
nixos/networkmanager: use tmpfiles to setup state directories (#71322)
nixos/networkmanager: use tmpfiles to setup state directories
2019-10-18 17:58:45 +02:00
Florian Klink
5e593038d1 nixos/networkmanager: use tmpfiles to setup state directories 2019-10-18 12:11:55 +02:00
Frederik Rietdijk
0256080d11 nixos/pppd: add description for peers, unbreaks metrics job and channel
services.pppd.peers was lacking a description, causing a trace warning
resulting in a parse error in the metrics job.
2019-10-17 13:59:52 +02:00
David Anderson
997a6f6f1e nixos/pppd: init 2019-10-15 08:36:09 -07:00
Justin Humm
b8cd11f347
smokeping: add erictapen as maintainer 2019-10-14 21:23:11 +02:00
Justin Humm
9eb067b0d7
nixos/smokeping: replace smokeping.fcgi with a symlink
This fixes a regression from bb649d96b0.
There were permission problems, when the preStart script tried to copy
the smokeping.fcgi file over the old file.
2019-10-14 21:11:47 +02:00
Janne Heß
d6c08776ba treewide: Switch to system users 2019-10-12 22:25:28 +02:00
Jan Tojnar
6c8aed6391
Merge branch 'master' into staging-next 2019-10-12 00:50:21 +02:00
Frederik Rietdijk
a0c34f54cc Merge master into staging-next 2019-10-08 11:56:52 +02:00
Maximilian Güntner
176b1aeb4e
nixos/mxisd: add support for ma1sd
both servers only differ slighly so the module
can be reused
2019-10-07 18:57:15 +02:00
geistesk
7f9767954b nixos/go-shadowsocks2: init 2019-10-06 11:18:20 +02:00
Jörg Thalheim
bf3360cdcf
nixos/zeronet: Improved config, dynamic user, remove static UI… (#70305)
nixos/zeronet: Improved config, dynamic user, remove static UID and GID
2019-10-04 10:23:13 +01:00
Okinan
5c18c08da9 nixos/zeronet: improved config, dynamic user 2019-10-03 17:03:32 -05:00
Elias Probst
86dea5559f nixos/networkmanager: allow iwd as Wi-Fi backend
This introduces an option wifi.backend to the networkmanager module.

Co-authored-by: Cole Mickens <cole.mickens@gmail.com>
Co-authored-by: worldofpeace <worldofpeace@protonmail.ch>
2019-10-02 21:52:58 -04:00
worldofpeace
9bc8169695 nixos/networkmanager: remove basePackages option
This option in now completely useless.
All the default configs for these packages
already have GNOME features default,
2019-09-29 20:36:49 -04:00
Frederik Rietdijk
503081fa5b Merge staging into staging-next 2019-09-29 11:05:22 +02:00
Vladimír Čunát
217cf982c7
Merge branch 'master' into staging-next 2019-09-27 22:13:02 +02:00
worldofpeace
985697bff7
Merge pull request #66652 from craigem/clarify_wireless_examples
nixos/doc: Clarify wireless examples
2019-09-26 22:56:20 -04:00
Craige McWhirter
cce7486deb nixos/doc: Clarify wireless examples
This commits makes it clearer to a novice reader how to configure several
diferent types of SSID connections that were otherwise obscurely documented

Resolves #66650
2019-09-26 22:52:21 -04:00
Vladimír Čunát
192fb9d11b
Merge branch 'staging-next' into staging 2019-09-24 08:15:01 +02:00
Vladimír Čunát
eab41878ac
Merge branch 'master' into staging-next 2019-09-24 08:14:34 +02:00
Jörg Thalheim
bfed455de3
Merge pull request #68946 from volth/escape
treewide: fix string escapes
2019-09-24 04:19:12 +01:00
Jörg Thalheim
8c7667c325
Enable work variant firewall with iptables-compat (#66953)
Enable work variant firewall with iptables-compat
2019-09-22 09:28:16 +01:00
Jörg Thalheim
ffa80e75b7
nixos/firewall: rename iptables-compat to iptables-nftables-compat 2019-09-22 09:09:43 +01:00
Vladimír Čunát
22a216849b
Re-Revert "Merge branch 'staging-next'"
This reverts commit f8a8fc6c7c.
2019-09-22 09:38:09 +02:00
Peter Hoeg
1c7aaf227c nixos/networkmanager: tiny cleanups
These are the leftovers of an older PR.

a. Send messages to auditd if auditing is enabled.
b. Add missing dbus configuration if dnsmasq is used for DNS
2019-09-22 13:33:43 +08:00