Commit Graph

5649 Commits

Author SHA1 Message Date
José Romildo Malaquias
98a630586e enlightenment: adapt service for efl-0.18.0 2016-08-23 11:50:45 -03:00
Nikolay Amiantov
1df4dd6bf5 initrd-ssh service: ensure that keys got copied into initrd
Fixes #17927.
2016-08-23 16:20:26 +03:00
obadz
ab08440f9c Revert "Temporarily disable chromium test"
This reverts commit 9e6eec201b.

Verified locally that cd063d7 fixes the problem.
cc @edolstra @aszlig
2016-08-23 14:16:58 +01:00
Joachim Fasting
f3ef4383c6
nix-daemon service: fix unbalanced parens in description 2016-08-23 13:06:25 +02:00
Eelco Dolstra
3fe93d2f75 Fix virtualbox test evaluation 2016-08-23 13:05:14 +02:00
Eelco Dolstra
9e6eec201b Temporarily disable chromium test
It's hanging and blocking the unstable channel.

http://hydra.nixos.org/build/38984676

@aszlig
2016-08-23 13:01:34 +02:00
Tuomas Tynkkynen
01c197df68 glib: Add some FIXMEs about inappropriate outputs 2016-08-23 05:05:42 +03:00
Tuomas Tynkkynen
b61fbf3132 treewide: Fix output references to openssl 2016-08-23 04:53:27 +03:00
Tuomas Tynkkynen
8877efa65b treewide: Fix output references to gnome.GConf 2016-08-23 04:52:57 +03:00
Tuomas Tynkkynen
c73aa79a8f graphite service: Use correct output of cairo 2016-08-23 03:20:21 +03:00
Thomas Tuegel
cb78ef0eb3 kde5: colord-kde moved 2016-08-22 18:49:13 -05:00
Tuomas Tynkkynen
282277dbc8 treewide: Use more makeBinPath 2016-08-23 01:18:10 +03:00
Tuomas Tynkkynen
74a3a2cd7e treewide: Use makeBinPath 2016-08-23 01:18:10 +03:00
Tuomas Tynkkynen
d3705faa56 treewide: Use makeLibraryPath in LD_LIBRARY_PATHs 2016-08-23 00:14:00 +03:00
Bjørn Forsman
8b18f3814f treewide: update cifs-utils attr references (cifs_utils -> cifs-utils) 2016-08-22 17:28:26 +02:00
obadz
ba50fd7170 Merge branch 'master' into staging 2016-08-22 01:18:11 +01:00
obadz
3d16af70bf nixos/stage-1: add mechanism which lustrates all impurities from / (#17784)
lustrate /ˈlʌstreɪt/ verb.
  purify by expiatory sacrifice, ceremonial washing, or some other
  ritual action.

- sudo touch /etc/NIXOS_LUSTRATE
  ⇒ on next reboot, during stage 1, everything but /nix and /boot
  is moved to /old-root
- echo "etc/passwd" | sudo tee -a /etc/NIXOS_LUSTRATE
  ⇒ on next reboot, during stage 1, everything but /nix and /boot
  is moved to /old-root; except /etc/passwd is copied back.

Useful for installing NixOS in place on another distro. For instance:

$ nix-env -iE '_: with import <nixpkgs/nixos> { configuration = {}; }; with config.system.build; [ nixos-generate-config manual.manpages ]'
$ sudo mkdir /etc/nixos
$ sudo `which nixos-generate-config`

… edit the configuration files in /etc/nixos using man configuration.nix
  if needed

  maybe add: users.extraUsers.root.initialHashedPassword = "" ?

… Build the entire NixOS system and link it to the system profile:
$ nix-env -p /nix/var/nix/profiles/system -f '<nixpkgs/nixos>' -A system --set

… If you were using a single user install:
$ sudo chown -R 0.0 /nix

… NixOS is about to take over
$ sudo touch /etc/NIXOS
$ sudo touch /etc/NIXOS_LUSTRATE

… Let's keep the configuration files we just created
$ echo etc/nixos | sudo tee -a /etc/NIXOS_LUSTRATE

$ sudo mv -v /boot /boot.bak &&
  sudo /nix/var/nix/profiles/system/bin/switch-to-configuration boot
$ sudo reboot

… NixOS boots, Stage 1 moves all the old distro stuff in /old-root.
2016-08-22 01:15:13 +01:00
Domen Kožar
36f851813b Merge pull request #17891 from abbradar/hibernation-test
nixos tests: add hibernation test to blockers
2016-08-21 21:40:46 +02:00
Ruslan Babayev
159412db2e mattermost: cosmetic: remove stray character (#17897) 2016-08-21 19:20:10 +02:00
Nikolay Amiantov
74a5c99904 nixos tests: add hibernation test to blockers 2016-08-21 17:34:00 +03:00
obadz
68936edfb3 Merge branch 'master' into staging 2016-08-21 12:03:41 +01:00
Vladimír Čunát
b4821ece01 nixos: blacklist radeon module if using amdgpu 2016-08-21 11:58:14 +02:00
Domen Kožar
acaa6a4c2b Merge pull request #17469 from ericsagnes/module/hydra
Improvements to Hydra module
2016-08-20 19:50:50 +02:00
Nikolay Amiantov
3b22b8add0 Merge branch 'font-updates' into staging
Closes #16730. Closes #17770. Closes #17846.

Test plan:

* Check that `fonts.fontconfig.ultimate.preset` changes things;
* Check that `fonts.fontconfig.dpi` changes things;
* Check that `fonts.fontconfig.defaultFonts.monospace` changes things;

Tested with AbiWord, mousepad and Firefox.
2016-08-20 03:23:02 +03:00
Nikolay Amiantov
f961fc7dd1 freetype: re-add infinality patches
archfan has updated those patches for the new version.
2016-08-20 03:21:05 +03:00
cmfwyp
1c7114da69 freetype: 2.6.2 -> 2.6.5
The fontconfig-ultimate patches are unmaintained. Since they were
not updated for newer FreeType versions, this removes them and
disables fontconfig-ultimate by default.
2016-08-20 03:21:05 +03:00
Nikolay Amiantov
e3ab0826c2 fontconfig-ultimate: 2015-12-06 -> 2016-04-23
This removes our hardcoded presets which weren't updated for quite some time.
Infinality now has new hardcoded presets in freetype, which can be overriden if
desired with environment variables (as before). Accordingly, updated NixOS
module to set the hardcoded preset.

Additionally used a more "right" type for substitutions.
2016-08-20 03:21:05 +03:00
Eric Sagnes
e80e8b9dc9 fontconfig module: respect upstream definitions 2016-08-20 03:21:05 +03:00
Eric Sagnes
cd2948a72e fontconfig: fix etc priority 2016-08-20 03:21:05 +03:00
Vladimír Čunát
c74145467d Merge #17852: gtk3: 3.20.8 -> 3.20.9
Note: the merge also adds a few master commits,
but those should matter.
2016-08-20 01:18:04 +02:00
Nikolay Amiantov
6b41f1132c nixos treewide: don't set MODULE_DIR 2016-08-19 17:56:54 +03:00
Nikolay Amiantov
5ff6e98486 modprobe service: drop kmod wrapper 2016-08-19 17:56:49 +03:00
Nikolay Amiantov
ff22705793 treewide: replace several /sbin paths by /bin 2016-08-19 17:56:45 +03:00
Benno Fünfstück
51b165c7d2 nixos/shadow: setuid wrappers for new{uid,gid}map
These utils are not related to user management, so they should be
available even if immutable users are enabled.
2016-08-19 14:59:33 +02:00
Joachim F
65ef681c94 Merge pull request #17803 from mfine/mfine-always-write-ssh-keys
buildkite-agent: always write ssh keys
2016-08-19 03:33:58 +02:00
Ricardo M. Correia
1cf9bcaa3f zfs: print the output of the zpool command (if any) when it succeeds 2016-08-18 17:27:57 +02:00
Ricardo M. Correia
c2e5fd959d Merge pull request #16901 from Baughn/zfs-nvme-fix
zfs: Keep trying root import until it works
2016-08-18 17:26:43 +02:00
Corbin
09e75a4c29 services/graphite: Fix paths to some Python packages.
Unbreaks some private Graphite deployments.
2016-08-17 21:14:31 -07:00
Shea Levy
2942895d55 Merge branch 'install-bootloader-flag' 2016-08-17 21:16:29 -04:00
Joachim F
c2bfce8de8 Merge pull request #16762 from matthewbauer/gnustep2
Add "gnustep" to nixpkgs
2016-08-17 23:38:56 +02:00
Mark Fine
c8c4f504f7 buildkite-agent: always write out the ssh keys. 2016-08-17 14:24:48 -07:00
Franz Pletz
b4cc9bd63a Merge remote-tracking branch 'origin/master' into hardened-stdenv
Fixes #17801 and #17802.
2016-08-17 19:43:43 +02:00
8573
34435a9502 redshift: Fix default value of $DISPLAY (#17746)
Before commit 54fa0cfe4e, the `redshift`
service was run with the environment variable `DISPLAY` set to `:0`.

Commit 54fa0cfe4e changed this to
instead use the value of the `services.xserver.display` configuration
option in the value of the `DISPLAY` variable. In so doing, no default
value was provided for the case where `services.xserver.display` is
`null`.

While the default value of `services.xserver.display` is `0`, use of
which by the `redshift` module would result in `DISPLAY` again being
set to `:0`, `services.xserver.display` may also be `null`, to which
value it is set by, e.g., the `lightdm` module.

In the case that `services.xserver.display` is `null`, with the change
made in commit 54fa0cfe4e, the `DISPLAY`
variable in the environment of the `redshift` service would be set to
`:` (a single colon), which, according to my personal experience,
would result in —

  - the `redshift` service failing to start; and

  - systemd repeatedly attempting to restart the `redshift` service,
    looping indefinitely, while the hapless `redshift` spews error
    messages into the journal.

It can be observed that the malformed value of `DISPLAY` is likely at
fault for this issue by executing the following commands in an
ordinary shell, with a suitable `redshift` executable, and the X11
display not already tinted:

  - `redshift -O 2500` — This command should reduce the color
    temperature of the display (making it more reddish).

  - `DISPLAY=':' redshift -O 6500` — This command should raise the
    color temperature back up, were it not for the `DISPLAY`
    environment variable being set to `:` for it, which should cause
    it to, instead, fail with several error messages.

This commit attempts to fix this issue by having the `DISPLAY`
environment variable for the `redshift` service default to its old
value of `:0` in the case that `services.xserver.display` is `null`.

I have tested this solution on NixOS, albeit without the benefit of a
system with multiple displays.
2016-08-17 13:34:26 +02:00
Franz Pletz
131bc22b84 gitlab service: add option for db_key_base secret 2016-08-17 13:17:47 +02:00
Julien Langlois
552c30c155 stage-1: exclude zram devices from resumeDevices 2016-08-17 00:21:47 -07:00
Franz Pletz
efab1cb928 Merge pull request #17782 from Baughn/unifi-fix
Unifi controller fixes
2016-08-17 06:24:55 +02:00
Matthew Bauer
f541715057 gnustep: fix gdomap service
This gets rid of the rest of the pidfile stuff and makes gdomap just act
like a normal systemd process. Also reword "enable" option.
2016-08-16 21:11:06 +00:00
Matthew Bauer
08ce2d9d40 gnustep: remove gdnc service
gdnc is a user process and can't be made into a NixOS module very
easily. It can still be put in the user's login script. According to the
GNUstep documentation it will be started as soon as it is needed.
2016-08-16 21:11:05 +00:00
Matthew Bauer
5ea9bd0920 gnustep: fix naming of gnustep stuff
This should fix the NixOS issues.
2016-08-16 21:11:05 +00:00
Artyom Shalkhakov
697982b91b gnustep: fix gdnc, gdomap
Both gdnc and gdomap seem to work.
2016-08-16 21:00:31 +00:00
Artyom Shalkhakov
d3d580ebbe gnustep: cleanup
Major clean-up. Everything builds fine.
2016-08-16 21:00:27 +00:00
Artyom Shalkhakov
9b17cd8fab gnustep: add nixos deamons
Adding basic daemons: gdomap and gdnc. It seems that GWorkspace
does is unable to work properly without the daemons.
2016-08-16 21:00:21 +00:00
Svein Ove Aas
102472b8de unifi: Open required ports by default.
The controller does not work at all if they aren't, with the exception
of special configurations involving L3 or custom ports.
2016-08-16 21:01:49 +01:00
Svein Ove Aas
e3f0a09b6d unifi: chown the data dir as well.
It needs to be writeable.
2016-08-16 21:01:49 +01:00
Domen Kožar
bab8a2ebe3 netboot: prepare for https://github.com/NixOS/nixos-channel-scripts/issues/6 2016-08-16 17:27:11 +02:00
obadz
24f8cf08cc nixos/lib/make-disk-image: refactor to use nixos-install
- Replace hand-rolled version of nixos-install in make-disk-image by an
  actual call to nixos-install
- Required a few cleanups of nixos-install
- nixos-install invokes an activation script which the hand-rolled version
  in make-disk-image did not do. We remove /etc/machine-id as that's
  a host-specific, impure, output of the activation script

Testing:

nix-build '<nixpkgs/nixos/release.nix>' -A tests.installer.simple passes

Also tried generating an image with:

nix-build -E 'let
    pkgs = import <nixpkgs> {};
    lib = pkgs.lib;
    nixos = import <nixpkgs/nixos> {
      configuration = {
        fileSystems."/".device = "/dev/disk/by-label/nixos";
        boot.loader.grub.devices = [ "/dev/sda" ];
        boot.loader.grub.extraEntries = '"''"'
          menuentry "Ubuntu" {
             insmod ext2
             search --set=root --label ubuntu
             configfile /boot/grub/grub.cfg
          }
        '"''"';
      };
    };
  in import <nixpkgs/nixos/lib/make-disk-image.nix> {
    inherit pkgs lib;
    config = nixos.config;
    diskSize = 2000;
    partitioned = false;
    installBootLoader = false;
  }'

Then installed the image:
$ sudo df if=./result/nixos.img of=/dev/sdaX bs=1M
$ sudo resize2fs /dev/disk/by-label/nixos
$ sudo mount /dev/disk/by-label/nixos /mnt
$ sudo mount --rbind /proc /mnt/proc
$ sudo mount --rbind /dev /mnt/dev
$ sudo chroot /mnt /nix/var/nix/profiles/system/bin/switch-to-configuration boot

[ … optionally do something about passwords … ]

and successfully rebooted to that image.

Was doing all this from inside a Ubuntu VM with a single user nix install.
2016-08-16 15:31:16 +01:00
Franz Pletz
35654b7fc1 Merge pull request #17743 from mayflower/service/mattermost 2016-08-16 14:54:25 +02:00
Shea Levy
b4954a8f38 Deprecate --install-grub in favor of --install-bootloader for nixos-rebuild.
Fixes #14293
2016-08-16 07:51:58 -04:00
Eelco Dolstra
38f306f492 Merge pull request #17768 from obadz/nixos-install
nixos-install: cleanups & improvements to run on non-NixOS systems
2016-08-16 13:31:50 +02:00
Robin Gloster
33e1c78ae3 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-08-16 07:54:01 +00:00
obadz
806e88c137 nixos-install: cleanups & improvements to run on non-NixOS systems
- Fix --no-bootloader which didn't do what it advertised
- Hardcode nixbld GID so that systems which do not have a nixbld user
  can still run nixos-install (only with --closure since they can't
  build anything)
- Cleanup: get rid of NIX_CONF_DIR(=/tmp)/nix.conf and pass arguments instead
- Cleanup: don't assume that the target system has '<nixpkgs/nixos>' or
  '<nixos-config>' to see if config.users.mutableUsers. Instead check if
  /var/setuid-wrappers/passwd is there

Installing NixOS now works from a Ubuntu host (using --closure).

nix-build -A tests.installer.simple '<nixpkgs/nixos/release.nix>' succeeds ✓
2016-08-16 02:47:49 +01:00
obadz
1759825b34 nixos/tests/ecryptfs: placate some commands causing many builds failure
These commands shouldn't have to be here in the first place as ecryptfs
homes should be automatically unmounted during logoff.
2016-08-16 02:47:08 +01:00
Svein Ove Aas
98b213a110 zfs: Keep trying root import until it works
Works around #11003.
2016-08-16 01:45:02 +01:00
Shea Levy
9adad8612b Revert "Merge branch 'modprobe-fix' of git://github.com/abbradar/nixpkgs"
Was meant to go into staging, sorry

This reverts commit 57b2d1e9b0, reversing
changes made to 760b2b9048.
2016-08-15 19:05:52 -04:00
Shea Levy
57b2d1e9b0 Merge branch 'modprobe-fix' of git://github.com/abbradar/nixpkgs 2016-08-15 19:01:44 -04:00
Nikolay Amiantov
1f63958772 nixos treewide: don't set MODULE_DIR 2016-08-16 00:19:25 +03:00
Nikolay Amiantov
b2ebecd9e5 modprobe service: drop kmod wrapper 2016-08-16 00:19:25 +03:00
Nikolay Amiantov
1afd250676 treewide: replace several /sbin paths by /bin 2016-08-16 00:19:25 +03:00
obadz
760b2b9048 nixos/make-disk-image: add ability to defer bootloader install until image has been flashed 2016-08-15 20:01:55 +01:00
Joachim Fasting
f9c3076e58
grsecurity docs: mention chromium setuid sandbox 2016-08-15 20:36:47 +02:00
Joachim Fasting
050b7eec16
grsecurity module: systemd-nspawn requires cap_sys_admin
As with 9ca3504a798291fbd7c49fcfeec8b64daa2022ad

Closes https://github.com/NixOS/nixpkgs/issues/17714
2016-08-15 20:36:47 +02:00
Joachim Fasting
7fd99066c4
grsecurity module: permit chmod +s in sandboxed builds
While useless, some builds may dabble with setuid bits (e.g.,
util-linux), which breaks under grsec.  In the interest of user
friendliness, we once again compromise by disabling an otherwise useful
feature ...

Closes https://github.com/NixOS/nixpkgs/issues/17501
2016-08-15 20:36:47 +02:00
Joachim Fasting
567640d80c
grsecurity docs: add note about user namespaces 2016-08-15 20:36:46 +02:00
Robin Lambertz
dacc3fa985 phpfpm: allow old config format as well (#17754) 2016-08-15 14:41:26 +02:00
Franz Pletz
7c6d253544 mattermost service: init 2016-08-15 04:15:11 +02:00
Nikolay Amiantov
4a35d08970 autofs service: make service more like upstream one 2016-08-14 22:39:23 +03:00
Nikolay Amiantov
bda3423b3a networkmanager service: make wanted by network.target, drop networkmanager-init 2016-08-14 22:38:58 +03:00
Nikolay Amiantov
0f59901b57 ejabberd service: move service to foreground 2016-08-14 22:37:06 +03:00
Svein Ove Aas
ed83a0ec8b crashplan: Wait for filesystems to be mounted before starting 2016-08-14 11:56:21 +02:00
Franz Pletz
bd4490e277 Merge branch 'master' into hardened-stdenv 2016-08-13 16:59:55 +02:00
Robin Gloster
bea8972d96 nixos.tests.boot-stage1: disable pic for kernel module 2016-08-13 09:49:24 +00:00
Vladimír Čunát
c4d17c530e release-small: drop mysql51, removed in 975d33e6
There's still mysql55.
2016-08-13 09:46:42 +02:00
Franz Pletz
e082cfcaaa gitlab module: restart services on failure
Sidqkiq regularly dies due to memory leaks.
2016-08-12 19:18:23 +02:00
Eelco Dolstra
52f21069d0 Remove the Cassandra module
It uses import-from-derivation, which is a bad thing, because this
causes hydra-evaluator to build Cassandra at evaluation time.

  $ nix-instantiate nixos/release.nix -A tests.cassandra.i686-linux --dry-run
  error: cannot read ‘/nix/store/c41blyjz6pfvk9fnvrn6miihq5w3j0l4-cassandra-2.0.16/conf/cassandra-env.sh’, since path ‘/nix/store/0j9ax4z8xhaz5lhrwl3bwj10waxs3hgy-cassandra-2.0.16.drv’ is not valid, at /home/eelco/Dev/nixpkgs/nixos/modules/services/databases/cassandra.nix:373:11

Also, the module is a mess (bad option descriptions, poor indentation,
a gazillion options where a generic "config" option would suffice, it
opens ports in the firewall, it sets vm.swappiness, ...).
2016-08-12 16:39:42 +02:00
Robin Gloster
b7787d932e Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-08-12 09:46:53 +00:00
Hoàng Minh Thắng
fed0c0f5bf fcitx-unikey: mention in dockbook 2016-08-12 14:36:36 +07:00
Graham Christensen
5d2980aa8e
gocd-agent / gocd-server: Reduce test memory requirements so Hydra builds 2016-08-10 16:21:35 -04:00
Graham Christensen
d969f3fa51
gocd-agent: 16.7.0 startup fixes + test improvements
- Agent now takes a full URL to the Go.CD server
 - Instruct the agent to attempt restart every 30s upon failure
 - Test's Accept header did not match the server's expectation
 - Replace the tests' complex Awk matches with calls to `jq`
2016-08-10 15:47:29 -04:00
Eelco Dolstra
dc7e32e618 Revert "command-not-found: disable module until it's fixed again"
This reverts commit 2a3c0ca3d5.
2016-08-10 18:09:40 +02:00
Eric Sagnes
4cdfeb78f9 modules: move meta at top level 2016-08-11 00:29:48 +09:00
Eric Sagnes
898435d16e manual: automatically generate modules entries 2016-08-11 00:24:41 +09:00
Shawn Warren
8750b4892e bump gocd-agent version to 16.6.0-3590 (#17311)
Update gocd-agent package version to 16.6.0-3590 including new sha.  Modify heapSize
and maxMemory mkOption to accurately reflect their intended purpose of configuring
initial java heap sizes.
2016-08-10 17:10:13 +02:00
obadz
52a875fb23 further fix manual evaluation
cc @cransom @domenkozar

See also 9ecc587 5ccfe7e
2016-08-10 15:51:01 +01:00
Domen Kožar
5ccfe7e8f2 fix manual evaluation 2016-08-10 16:12:05 +02:00
Frederik Rietdijk
8955dc5e7e Merge pull request #17464 from cransom/cassandra
Cassandra
2016-08-10 11:42:57 +02:00
obadz
582313bafe nixos: remove rsync from base install and add explicit path in nixos-install
As per 60b3f95ad8 (commitcomment-18507812)
2016-08-09 21:39:40 +01:00
obadz
57b7c3c545 nixos-install: more robust way of sourcing fresh version of self 2016-08-09 21:39:40 +01:00
Robin Gloster
3cf5d5ebed nginx module: fixup events in config 2016-08-09 17:11:28 +00:00
obadz
74b3ad148d nixos/tests/installer.nix: add libxml2 & libxslt to prevent download attempts 2016-08-09 17:01:42 +01:00
aszlig
f8fad62c8e
Merge branch 'nixpkgs-git-revision-fix'
Addresses #17218 in a better way in that it doesn't create a
".git-revision" file on every nixos-rebuild, because we already have
".git" available. Even if we don't nixos-rebuild can't create the
"git-revision" file.

Tested via:

nix-build -E '(import ./nixos/tests/make-test.nix {
  name = "foo";
  machine = {};
  testScript = "startAll; $machine->execute(\"nixos-version >&2\");";
})'

Closes: #17610
Acked-by: @bennofs
2016-08-09 17:34:35 +02:00
aszlig
0b9d9eded1
nixos/version: Try to get Git revison from .git
Let's first try if we can determine the Git revision from the .git
directory and if that fails, fall back to get the info from the
".git-revision" file... and after that use something generic like
"master".

This should address #17218 in better way, because we don't need to
create another redundant file in the source checkout of nixpkgs.

I'm not going to route of falling back to using .git, because after
55d881e, we already have ".git-revision" files in people's Git
repositories, which in turn means that nixos-version will report that
old file every time even if the working tree has updated.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @bennofs, Profpatsch
Reported-by: @devhell
Fixes: #17218
2016-08-09 14:18:20 +02:00
aszlig
55d881eea3
Revert adding .git-revision unconditionally
This reverts commit 1e534e234b.

We already should have a .git directory if it is managed via Git,
otherwise there is no way to get the Git revision if neither
.git-revision or .git is present.

But having .git-revision _and_ .git present seems very much redundant to
me.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @bennofs, @Profpatsch
Issue: #17218
2016-08-09 14:15:06 +02:00
Robin Gloster
b0b0a45bb1 nginx module: fix cfg.config backwards compatibility
fixes #17604
2016-08-09 12:02:21 +00:00
Thomas Tuegel
68922e3f74 nixos/stage-1: use readlink -e in builder
The builder has this convoluted `while` loop which just replicates
`readlink -e`. I'm sure there was a reason at one point, because the
loop has been there since time immemorial. It kept getting copied
around, I suspect because nobody bothered to understand what it actually
did.

Incidentally, this fixes #17513, but I have no idea why.
2016-08-08 09:45:45 -05:00
Thomas Tuegel
ee36bb8588 nixos/stage-1: fix antiquotation 2016-08-08 09:28:17 -05:00
Profpatsch
85ed3ca9c7 libinput.accelProfile: improve docs & new default
The link to some (of course non-existing, i.e. freedesktop) “libinput”
documentation is replaced by a piece of the API documentation.

The default is changed since the documentation suggests `adaptive`
should be it.
https://wayland.freedesktop.org/libinput/doc/latest/group__config.html#gad63796972347f318b180e322e35cee79

Also fix a missing string conversion for `scrollButton`.
2016-08-08 14:01:07 +02:00
Wout Mertens
db8401f603 Merge pull request #17100 from abbradar/resume-delay
nixos stage-1: wait for resume devices to appear
2016-08-08 11:34:38 +02:00
Nikolay Amiantov
1e8894f085 unity3d: use chromium-suid-sandbox 2016-08-08 10:49:00 +03:00
Nikolay Amiantov
b2413e48ae chromium-suid-sandbox module: fix description 2016-08-08 10:17:31 +03:00
Al Zohali
2aba1c4962 phpfpm service: restructured pool configuration
From @fpletz: Keep poolConfigs option for backwards-compatibility.

The original commit 6b3f5b5a42 was previously
reverted by c7860cae1a but the issues were
resolved.
2016-08-08 05:53:53 +02:00
Nikolay Amiantov
986a40421a nixos stage-1: wait for devices during resumption attempt
Also a microimprovement -- use `test -n` instead of `test -e`
since we have already checked that the file exists.
2016-08-08 01:35:43 +03:00
Nikolay Amiantov
3ae468e835 nixos stage-1: move resumption below helper functions' definitions 2016-08-08 01:34:23 +03:00
Nikolay Amiantov
59aa3bb5c8 nixos stage-1: factor device waiting into a function 2016-08-08 01:32:18 +03:00
David Reaver
ed4a061c34 NixOS manual: Add docs for Virtualbox guest (#17454)
Fixes #13311
2016-08-07 04:10:29 +02:00
Rok Garbas
a741978f20 Merge pull request #17479 from elitak/factorio
Factorio: 0.13.8 -> 0.13.13, mod support
2016-08-07 04:09:52 +02:00
Paul Hendry
486b8e7f5c Add Terraria server service (#16832) 2016-08-07 03:58:38 +02:00
jokogr
adeab67bd8 syncthing service: add syncthing-inotify (#17320) 2016-08-06 17:20:18 +02:00
obadz
66d5edf654 chromium: add nixos module security.chromiumSuidSandbox
Closes #17460

Changed the wrapper derivation to produce a second output containing the sandbox.
Add a launch wrapper to try and locate the sandbox (either in /var/setuid-wrappers or in /nix/store).
This launch wrapper also sheds libredirect.so from LD_PRELOAD as Chromium does not tolerate it.

Does not trigger a Chromium rebuild.

cc @cleverca22 @joachifm @jasom
2016-08-06 10:27:47 +01:00
Gabriel Ebner
22088b4b25 nixos/x11: make nvidia driver work again
The nvidia driver module directly sets the services.xserver.drivers
option, while still having nvidia/nvidiaBeta/... etc. in the
videoDrivers option.
2016-08-06 07:26:25 +02:00
Robin Gloster
f4e1041e31 Merge pull request #17503 from peterhoeg/ssh
ssh module: ignore exit code when socket activated
2016-08-05 19:58:06 +02:00
Joachim F
f044035a9e Merge pull request #17470 from layus/synaptics-conflict
Warn for conflict between synaptics and libinput
2016-08-05 19:26:07 +02:00
Gabriel Ebner
5e6ac5fcf3 nixos/x11: output sections for modesetting driver
See #17487.
2016-08-05 18:31:04 +02:00
Joachim F
632f9060f1 Merge pull request #17363 from MatrixAI/zsh-helpdir
zsh: Added HELPDIR variable for interactive shells
2016-08-05 16:45:28 +02:00
Franz Pletz
792f96fbc7 Merge pull request #17489 from mayflower/pkg/gitlab-8-10
gitlab: 8.5.12 -> 8.10.3, update module
2016-08-04 23:35:22 +02:00
Tuomas Tynkkynen
2ea72fa9c8 nixos/luksroot: Reference correct output of openssl 2016-08-04 23:12:39 +03:00
obadz
037d9c6cab nixos-install: add options --closure, --no-channel-copy, --no-root-passwd, and --no-bootloader
Closes #17236

nix-build -A tests.installer.simple '<nixos/release.nix>' succeeds ✓
2016-08-04 16:22:25 +01:00
Benno Fünfstück
3f3d18c017 Merge pull request #17218 from bennofs/fix-nixos-version
fix nixos-version --hash when building from git
2016-08-04 15:56:08 +02:00
Christian Kauhaus
ea7e705cd9 varnish: fix localstatedir for varnish* tools (#17508)
The varnish tools (varnishstat, varnishlog, ...) tried to load the VSM
file from a spurious var directory in the Nix store. Fix the default so
the tools "just work" when also keeping services.varnish.stateDir at the
default.

Notes:
- The tools use $localstatedir/$HOSTNAME so I've adapted the default for
  stateDir as well to contain hostName.
- Added postStop action to remove the localstatedir. There is no point
  in keeping it around when varnish does not run, as it regenerates it
  on startup anyway.

Fixes #7495
2016-08-04 15:25:23 +02:00
Peter Hoeg
c4cba0e51f ssh module: ignore exit code when socket activated
sshd will at times fail when exiting. When socket activated, this will
leave a number of sshd@ service instances in the failed state, so we
simply ignore the error code if we are running socket activated.

Recommended by upstream:
http://systemd-devel.freedesktop.narkive.com/d0eapMCG/socket-activated-sshd-service-showing-up-as-a-failure-when-the-client-connection-fails

Fixes: #3279
2016-08-04 16:47:44 +08:00
Damien Cassou
c5d9dc9cfa Merge pull request #17418 from DamienCassou/offlineimap-module-reporting
offlineimap's module: change UI to syslog
2016-08-04 08:33:20 +02:00
Franz Pletz
8a8971788c gitlab module: update documentation 2016-08-04 02:29:50 +02:00
Franz Pletz
d8fd06641a gitlab module: split up gitlab-runner script
The name gitlab-runner clashes with a component of Gitlab CI with the
same name and only confuses people. It's now called gitlab-bundle and
a convenience-script gitlab-rake for easier invocation of rake tasks
was added. This was the primary use case of gitlab-runner.
2016-08-04 02:29:45 +02:00
Franz Pletz
c39b6025d8 gitlab: 8.5.12 -> 8.10.3, update module
Fixes #14795.
2016-08-04 02:29:44 +02:00
Eric Litak
d33540734f factorio: rudimentary mod support for factorio's nixos module 2016-08-03 16:44:51 -07:00
Robin Gloster
1b979d8384 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-08-03 13:34:44 +00:00
Joachim F
772a7bb49b Merge pull request #17425 from joachifm/grsec-efi
grsecurity module: disable EFI runtime services by default
2016-08-03 10:48:25 +02:00
Guillaume Maudoux
0f0be5e498 Warn for conflict between synaptics and libinput 2016-08-03 08:15:18 +02:00
Eric Sagnes
338c425e08 hydra-module: add default to buildMachinesFiles 2016-08-03 13:14:12 +09:00
Eric Sagnes
128389b60c hydra-module: honor user and group ids 2016-08-03 13:13:57 +09:00
Casey Ransom
9ecc587e3b cassandra service: init
The module will configure a Cassandra server with common options being
tweakable. Included is also a test which will spin up 3 nodes and
verify that the cluster can be formed, broken, and repaired.
2016-08-02 20:58:35 -04:00
Robin Gloster
1be4907ca2 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-08-02 13:46:36 +00:00
Rodney Lorrimar
6711e62d51 nixos manual: add Emacs section (fixes #13217)
In light of Emacs packaging improvements such as those mentioned
in #11503, and with the addition of a systemd service (#15807
and #16356), and considering that the wiki page is completely
out of date (#13217), it seems that some documentation is in order.
2016-08-02 11:17:52 +01:00
Joachim Fasting
43fc394a5c
grsecurity module: disable EFI runtime services by default
Enabling EFI runtime services provides a venue for injecting code into
the kernel.

When grsecurity is enabled, we close this by default by disabling access
to EFI runtime services.  The upshot of this is that
/sys/firmware/efi/efivars will be unavailable by default (and attempts
to mount it will fail).

This is not strictly a grsecurity related option, it could be made into
a general option, but it seems to be of particular interest to
grsecurity users (for non-grsecurity users, there are other, more
immediate kernel injection attack dangers to contend with anyway).
2016-08-02 10:24:49 +02:00
Joachim Fasting
79ac02ed64
dnscrypt-proxy service: update resolver list 2016-08-02 09:36:22 +02:00
Franz Pletz
c90a43f4c5 nginx module: fix evaluation of root location option 2016-08-01 19:38:10 +02:00
Joachim Fasting
d1572d06fe
grsecurity module: correct internal note 2016-08-01 16:27:14 +02:00
Rok Garbas
34237beca6 Merge pull request #15862 from mayflower/nginx-module
Declarative nginx module with ACME support
2016-08-01 13:10:06 +02:00
Joachim Fasting
c91d07b668
dnscrypt-proxy module: types.string should be types.str 2016-08-01 12:55:42 +02:00
Eric Sagnes
c7bd26e537 version module: refactor with fileContents 2016-08-01 18:40:36 +09:00
Eric Sagnes
1114ab41e6 release.nix: refactor with fileContents 2016-08-01 18:35:26 +09:00
Eelco Dolstra
0804f67024 Fix epub generation
* Hydra doesn't like spaces in filenames.

* The zip file contained nix/store/.../OEBPS rather than OEBPS at
  top-level, causing some programs (like okular) to barf.

* Remove the redundant $dst/epub directory.
2016-08-01 11:10:22 +02:00
Eelco Dolstra
d5756cdf0a Remove the PDF manual
PDF is very 20th century and nobody reads technical documentation this
way anymore.
2016-08-01 11:10:21 +02:00
Eelco Dolstra
83eb49220b Manual: Only include the release number (e.g. 16.03)
This prevents gratuitous rebuilds of the manual every time the Git
revision changes.

Should help a bit with #17261.
2016-08-01 11:10:21 +02:00
Eelco Dolstra
2a05368ff3 Remove $NIXOS_LABEL and $NIXOS_VERSION
Relying on environment variables to override configuration options is
ugly, and there is no reason for them.
2016-08-01 11:10:02 +02:00
Damien Cassou
19af5b444e offlineimap's module: change UI to syslog
The 'syslog' UI "allows better integration with systemd":
http://www.offlineimap.org/doc/Changelog.html#offlineimap-v660-rc2-2015-10-15
2016-08-01 09:37:53 +02:00
Gabriel Ebner
dbd856d724 Merge pull request #17387 from cko/redis
redis: 3.0.7 -> 3.2.2
2016-08-01 08:13:08 +02:00
Robin Gloster
63c7b4f9a7 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-07-31 20:51:34 +00:00
Franz Pletz
d7f7ef4c21 Merge pull request #15496 from kampfschlaefer/containers_more_veth_interfaces
Declarative containers: more veth interfaces
2016-07-31 19:13:59 +02:00
Langston Barrett
a28273df32 mopidy service: add default value for configuration (#17385)
Mopidy will start if the configuration is empty.

Fixes #17381.
2016-07-31 18:35:09 +02:00
Christine Koppelt
07ca9bd4bc Redis: add entry to release notes 2016-07-31 15:28:56 +02:00
Franz Pletz
76b21b7adb nixos/firewall: Refactor rpfilter, allow DHCPv4 (#17325)
Adds a new chain in the raw table for reverse path filtering and optional
logging. A rule to allow serving DHCPv4 was also added as it is commonly
needed and poses no security risk even when no DHCPv4 server is running.

Fixes #10101.
2016-07-31 13:49:24 +02:00
Profpatsch
8a6047a525 nixos/pulseaudio: increase service restart time
Pulseaudio doesn’t like being restarted too quickly.
2016-07-30 23:42:54 +02:00
Profpatsch
5074a79937 nixos/pulseaudio: tcp streaming & zeroconf
Adds options for tcp streaming and avahi zeroconf support (so that the
server can be easily found by clients).
There is also an option to allow anonymous clients to stream to the
server (by default pulseaudio uses a cookie mechanism, see manpage).
2016-07-30 23:42:54 +02:00
Thomas Tuegel
d5bec1a145 kde5: rename extra-cmake-modules variants
Instead of one package `extra-cmake-modules`, there is now `ecm` and
`ecmNoHooks`. The latter is used when one does not want to incur a Qt 5
dependency; it is also available as a top-level package
`extra-cmake-modules`.
2016-07-30 14:06:43 -05:00
Gabriel Ebner
07fc65289a nixos/x11: remove unneccessary special cases 2016-07-30 17:03:16 +02:00
Gabriel Ebner
5c9309c231 xorg.xorgserver: enable glamor support 2016-07-30 13:37:51 +02:00
Thomas Tuegel
3dea00d90e nixos/kde: phonon moved to qt5 2016-07-29 10:29:15 -05:00
Rob Vermaas
9494b764d2 dd-agent: support jmx, needs a separate daemon nowadays.
(cherry picked from commit 1425a1f964adc2e2eb668810f3f158089035cd3d)
2016-07-29 12:42:07 +00:00
Roger Qiu
c0ff64c2e8 zsh: Added HELPDIR variable for interactive shells, as the help directory is distribution specific, and will be useful for using run-help 2016-07-29 20:36:06 +10:00
Arnold Krille
07de11f165 containers: add myself to the maintainers of the tests
Seems like the right thing to do.
2016-07-28 23:06:41 +02:00
Arnold Krille
9045a8e24c declarative containers: additional veths
With these changes, a container can have more then one veth-pair. This allows for example to have LAN and DMZ as bridges on the host and add dedicated containers for proxies, ipv4-firewall and ipv6-firewall. Or to have a bridge for normal WAN, one bridge for administration and one bridge for customer-internal communication. So that web-server containers can be reached from outside per http, from the management via ssh and can talk to their database via the customer network.

The scripts to set up the containers are now rendered several times instead of just one template. The scripts now contain per-container code to configure the extra veth interfaces. The default template without support for extra-veths is still rendered for the imperative containers.

Also a test is there to see if extra veths can be placed into host-bridges or can be reached via routing.
2016-07-28 23:06:41 +02:00
Eelco Dolstra
fd5bbdb436 nixos-containers: Set DevicePolicy=closed
This makes the container a bit more secure, by preventing root
creating device nodes to access the host file system, for
instance. (Reference: systemd-nspawn@.service in systemd.)
2016-07-28 17:58:55 +02:00
Eelco Dolstra
bf3edfbb3c nixos-containers: Use systemd 231's --notify-ready flag 2016-07-28 17:58:52 +02:00
Robin Gloster
a193fecf0e nginx module: improve statusPage generated code
Adds ::1 as allowed host and turns of access_log for the status page.
2016-07-28 11:59:13 +00:00
Robin Gloster
3ccfca7d6b nginx module: httpConfig backward compatibility
Revert httpConfig its old behaviour and make it mutually exclusive to
the new structured configuration. Adds appendHttpConfig to have the
ability to write custom config in the generated http block.
2016-07-28 11:59:13 +00:00
Robin Gloster
511410789b nginx module: make client_max_body_size configurable 2016-07-28 11:59:13 +00:00
Tristan Helmich
8c61b3af03 nginx: fixed duplicate http declaration 2016-07-28 11:59:13 +00:00
Robin Gloster
91680de317 nginx module: add statusPage option 2016-07-28 11:59:13 +00:00
Robin Gloster
a294ad01b3 nginx module: make recommended settings optional 2016-07-28 11:59:13 +00:00
Robin Gloster
186a8400ed nginx module: make httpConfig backward compatible 2016-07-28 11:59:13 +00:00
Robin Gloster
5dd7cf964a nginx module: improve documentation 2016-07-28 11:59:13 +00:00
Franz Pletz
de8008a1b1 nginx module: Enable http2 2016-07-28 11:59:13 +00:00
Franz Pletz
e982aeae6a nginx module: Add default proxy headers for tomcat 2016-07-28 11:59:13 +00:00
Robin Gloster
3830a890ab nginx module: add option to make vhost default 2016-07-28 11:59:13 +00:00
Robin Gloster
138945500e nginx module: implement basic auth 2016-07-28 11:59:13 +00:00
Robin Gloster
ff12ee35b7 nginx module: redirect to same protocol 2016-07-28 11:59:13 +00:00
Robin Gloster
e18f8e8b66 nginx module: turn off basic auth on acme locations 2016-07-28 11:59:13 +00:00
Franz Pletz
4e5c7913e9 nginx module: Add acmeFallbackHost vhost option 2016-07-28 11:59:13 +00:00
Franz Pletz
811f243ce6 nginx module: Add extraConfig for locations 2016-07-28 11:59:13 +00:00
Franz Pletz
d5a097fdb6 nginx module: Don't create acme certs if acme is not enabled 2016-07-28 11:59:13 +00:00
Tristan Helmich
c61157b7e6 nginx module: Add dhParams option 2016-07-28 11:59:13 +00:00
Tristan Helmich
35d76a72ab nginx module: Add sslCiphers option 2016-07-28 11:59:13 +00:00
Tristan Helmich
8bd1f401bb nginx module: Add sslProtocols option 2016-07-28 11:59:13 +00:00
Tristan Helmich
900b311a38 nginx module: Fix ACME extraDomains, fix challenge url to not redirect to allow renewals 2016-07-28 11:59:13 +00:00
Tristan Helmich
4676983990 nginx module: Add ACME support for ssl sites 2016-07-28 11:59:13 +00:00
Robin Gloster
f298be9ef4 nginx module: declarative config 2016-07-28 11:58:37 +00:00
Robin Gloster
356c2fe00d Revert "nginx: Verify that configuration is syntactically correct" (#17337) 2016-07-28 13:55:06 +02:00
Peter Hoeg
62f2f72e98 tmux module: do not override keys by default in VI mode (#17330)
We want to stick to upstream defaults as much as possible.

As pointed out by @8573 in #16999, this was not the case.
2016-07-28 13:10:42 +02:00
Peter Hoeg
65ef5d8f5b rspam module: use mkEnableOption
See #17329.
2016-07-28 07:06:35 +02:00
Franz Pletz
8a1e7cd556 rspamd service: fix runtime directory, log to syslog
Fixes #17144.
2016-07-28 06:22:29 +02:00