Commit Graph

2158 Commits

Author SHA1 Message Date
Lassulus
ef0f57ff8a
Merge pull request #86712 from rardiol/hostapd
nixos/hostapd: country selection, CRDA, logging
2020-05-05 19:51:09 +02:00
Ricardo Ardissone
a55b736a65 nixos/hostapd: conditionally enable ieee80211d 2020-05-04 21:28:56 -03:00
Ricardo Ardissone
d6d0442243 nixos/hostapd: add logLevel option 2020-05-04 00:31:09 -03:00
Ricardo Ardissone
c09c054231 nixos/hostapd: add countryCode option 2020-05-04 00:31:09 -03:00
Ricardo Ardissone
151d32d22c nixos/hostapd: use CRDA
Needed for regulatory compliance and unlocking some channels.
2020-05-03 23:57:33 -03:00
Martin Milata
ce0c39be0b nixos/prosody: add MUC extraConfig, fix extraConfig order
Add extraConfig option for the muc submodule.

Also move the global extraConfig before all components and
virtualhosts, because the manual states:

    The configuration is divided into two parts. The first part is known as
    the "global" section. All settings here apply to the whole server, and
    are the default for all virtual hosts.

    The second half of the file is a series of VirtualHost and Component
    definitions. Settings under each VirtualHost or Component line apply
    only to that host.

Before, if at least one muc was defined, or uploadHttp enabled, the
global extraConfig would end up after "muc" or "http_upload" component
making it apply to that component only and not globally.
2020-05-04 00:10:33 +02:00
Frederik Rietdijk
afb1041148 Merge master into staging-next 2020-05-02 09:39:00 +02:00
Emery Hemingway
0d49162aa0 nixos/yggdrasil: add group option
Allow users to access the Yggdrasil control socket by group.
2020-05-02 01:21:55 +05:30
Florian Klink
e148a72377
Merge pull request #86067 from NinjaTrappeur/nin-sane-prosody-defaults
nixos/prosody: make module defaults comply with XEP-0423
2020-05-01 20:07:13 +02:00
Félix Baylac-Jacqué
f5b1e6bc21
nixos/prosody: add NixOS manual entry
We add a Prosody entry to the NixOS manual showing how to setup a
basic XEP-0423 compliant Prosody service. This example also showcase
how to generate the associated ACME certificates.

Note: The <programlisting> body might look poorly indented, but trust
me, it's necessary. If we try to increase their indentation level, the
HTML output will end up containing a lot of unecesseray heading spaces
breaking the formatting...
2020-05-01 19:57:33 +02:00
Ed Cragg
df2f8d9150 thelounge: write out default path for thelounge
The output file is found and handled by thelounge itself [1], leaving
the user free to override THELOUNGE_HOME in the environment if they
choose, but having a sensible default to make `thelounge` generally
usable in most cases.

This solution follows discussion on #70318.

[1] 9ef5c6c67e/src/command-line/utils.js (L56)
2020-05-01 14:46:46 +01:00
Félix Baylac-Jacqué
353a8b58e6
nixos/prosody: leverage systemd sandbox features to harden service
We are leveraging the systemd sandboxing features to prevent the
service accessing locations it shouldn't do. Most notably, we are here
preventing the prosody service from accessing /home and providing it
with a private /dev and /tmp.

Please consult man systemd.exec for further informations.
2020-04-30 20:40:00 +02:00
Félix Baylac-Jacqué
8aea528872
nixos/prosody: make defaults comply with XEP-0423
Setting up a XMPP chat server is a pretty deep rabbit whole to jump in
when you're not familiar with this whole universe. Your experience
with this environment will greatly depends on whether or not your
server implements the right set of XEPs.

To tackle this problem, the XMPP community came with the idea of
creating a meta-XEP in charge of listing the desirable XEPs to comply
with. This meta-XMP is issued every year under an new XEP number. The
2020 one being XEP-0423[1].

This prosody nixos module refactoring makes complying with XEP-0423
easier. All the necessary extensions are enabled by default. For some
extensions (MUC and HTTP_UPLOAD), we need some input from the user and
cannot provide a sensible default nixpkgs-wide. For those, we guide
the user using a couple of assertions explaining the remaining manual
steps to perform.

We took advantage of this substential refactoring to refresh the
associated nixos test.

Changelog:
- Update the prosody package to provide the necessary community
  modules in order to comply with XEP-0423. This is a tradeoff, as
  depending on their configuration, the user might end up not using them
  and wasting some disk space. That being said, adding those will
  allow the XEP-0423 users, which I expect to be the majority of
  users, to leverage a bit more the binary cache.
- Add a muc submodule populated with the prosody muc defaults.
- Add a http_upload submodule in charge of setting up a basic http
  server handling the user uploads. This submodule is in is
  spinning up an HTTP(s) server in charge of receiving and serving the
  user's attachments.
- Advertise both the MUCs and the http_upload endpoints using mod disco.
- Use the slixmpp library in place of the now defunct sleekxmpp for
  the prosody NixOS test.
- Update the nixos test to setup and test the MUC and http upload
  features.
- Add a couple of assertions triggered if the setup is not xep-0423
  compliant.

[1] https://xmpp.org/extensions/xep-0423.html
2020-04-30 20:39:54 +02:00
Thibaut Marty
4a0beed5c0 treewide: fix modules options types where the default is null
They can be caught with `nixos-option -r` on an empty ({...}:{}) NixOS
configuration.
2020-04-28 19:13:59 +02:00
zowoq
c59c4e3589 nixos/*: use $out instead of $bin with buildGoPackage 2020-04-28 20:30:29 +10:00
Dominik Xaver Hörl
c10d82358f treewide: add types to boolean / enable options or make use of mkEnableOption 2020-04-27 09:32:01 +02:00
Florian Klink
c1a6e60335
Merge pull request #85598 from danderson/tailscale-fix-cachedir
nixos/tailscale: set a CacheDir in the systemd unit.
2020-04-21 22:38:32 +02:00
Dominik Xaver Hörl
0412bde942 treewide: add bool type to enable options, or make use of mkEnableOption
Add missing type information to manually specified enable options or replace them by mkEnableOption where appropriate.
2020-04-21 08:55:36 +02:00
David Anderson
cee5ddbb28 nixos/tailscale: set a CacheDir in the systemd unit.
Fixes a bug where tailscaled drops some files into / when CacheDir
is unset.

Signed-off-by: David Anderson <dave@natulte.net>
2020-04-20 15:35:55 -07:00
worldofpeace
f882896cc8
Merge pull request #73934 from flokli/nixos-test-port-cockroachdb
nixosTests.cockroachdb: port to python
2020-04-19 16:30:45 -04:00
Langston Barrett
5de2e78016 nixos/networkmanager: restart dispatcher when nameservers change
Without this, you can change the list of appended or prepended nameservers in
your NetworkManager config, and nixos-rebuild doesn't cause those changes to
come into effect.
2020-04-15 13:50:51 -07:00
snicket2100
2b0ee787dd mosquitto: systemd service sandboxing
running the service in a sandbox. read-only root file system,
with tmpfs mounted in /tmp, hidden /root and /home,
temporary /dev. the only writeable path is the data directory,
which according to my experiments is enough for the service
to work correctly.
2020-04-13 10:46:56 +02:00
Tony Olagbaiye
c1c9905aae nixos/nftables: fix typo in ruleset example 2020-04-10 23:48:52 +01:00
Florian Klink
502073b09a nixos/rxe: fix option description
This caused an opening xml tag in our docbook pipeline and failed the
manual build.
2020-04-05 15:30:08 +02:00
Frederik Rietdijk
e50c67ad7e
Merge pull request #83618 from NixOS/staging-next
Staging next
2020-04-05 13:13:21 +02:00
Frederik Rietdijk
518d5be4f5 ssh validationPackage is a single value, not a list 2020-04-05 13:04:25 +02:00
Frederik Rietdijk
92124ed660 Merge master into staging-next 2020-04-03 21:54:40 +02:00
Silvan Mosberger
eb0148e90b
Merge pull request #84074 from Infinisil/fix-literal-option-examples
nixos/treewide: Fix incorrectly rendered examples
2020-04-03 15:41:53 +02:00
Bastian Köcher
644d643d68 nixos/wg-quick: Fix after wireguard got upstreamed 2020-04-03 12:39:35 +02:00
Florian Klink
f25a301a0a nixos/chrony: move to StateDirectory and tmpfiles.d 2020-04-03 00:34:18 +02:00
Bruno Bigras
544821654d
nixos/pixiecore: init (#83406)
Co-authored-by: raunovv <rauno@oyenetwork.com>
Co-authored-by: Jörg Thalheim <joerg@thalheim.io>
2020-04-02 13:06:21 +01:00
Silvan Mosberger
1d0fc9729d
nixos/treewide: Fix incorrectly rendered examples
Many options define their example to be a Nix value without using
literalExample. This sometimes gets rendered incorrectly in the manual,
causing confusion like in https://github.com/NixOS/nixpkgs/issues/25516

This fixes it by using literalExample for such options. The list of
option to fix was determined with this expression:

  let
    nixos = import ./nixos { configuration = {}; };
    lib = import ./lib;
    valid = d: {
      # escapeNixIdentifier from https://github.com/NixOS/nixpkgs/pull/82461
      set = lib.all (n: lib.strings.escapeNixIdentifier n == n) (lib.attrNames d) && lib.all (v: valid v) (lib.attrValues d);
      list = lib.all (v: valid v) d;
    }.${builtins.typeOf d} or true;

    optionList = lib.optionAttrSetToDocList nixos.options;

  in map (opt: {
    file = lib.elemAt opt.declarations 0;
    loc = lib.options.showOption opt.loc;
  }) (lib.filter (opt: if opt ? example then ! valid opt.example else false) optionList)

which when evaluated will output all options that use a Nix identifier
that would need escaping as an attribute name.
2020-04-02 07:49:25 +02:00
worldofpeace
b0ac19e050 nixos: add freedesktop/gnome/myself maintainers 2020-04-01 20:53:09 -04:00
Mario Rodas
c47ec3067d
Merge pull request #70762 from xfix/nixos-mullvad-vpn
nixos/mullvad-vpn: add service
2020-04-01 08:26:07 -05:00
Marek Mahut
dd3da96318 nixos/magic-wormhole-mailbox-server: moving from mail to networking 2020-03-31 16:29:39 +02:00
Jörg Thalheim
10059e4b71
Merge remote-tracking branch 'upstream/master' into HEAD 2020-03-29 14:08:10 +01:00
worldofpeace
d5cfaf5c39
Merge pull request #83473 from doronbehar/update-connman
connman: 1.37 -> 1.38
2020-03-28 18:18:14 -04:00
Frederik Rietdijk
a36be028f5 Merge staging-next into staging 2020-03-28 21:15:15 +01:00
Doron Behar
bffec3d884 nixos/connman: add TODOs regarding connman + network-manager 2020-03-28 12:28:29 +03:00
Doron Behar
480397693e nixos/connman: add option to use specific package 2020-03-28 12:06:54 +03:00
Marek Mahut
870a6e262d nixos/quorum: init 2020-03-27 19:31:01 +01:00
Serval
75afd2fc34
nixos/v2ray: check v2ray config during the build time 2020-03-25 01:51:56 +08:00
Orivej Desh
1b89aa3f7a Merge branch 'master' into staging 2020-03-23 00:53:16 +00:00
markuskowa
a9d7a1ee5b
Merge pull request #81277 from markuskowa/upd-rdma-core
nixos/rdma-core: 27.0 -> 28.0, update RXE module
2020-03-22 18:01:09 +01:00
Darius Jahandarie
5fa345922f nixos/supplicant: Don't *stop* supplicant on machine resume. Fixes #51582 2020-03-20 11:08:34 -04:00
Jesper Geertsen Jonsson
02c2c864d1 resilio: fix a list being assigned to the option config.users.groups 2020-03-19 11:25:56 -05:00
Florian Klink
4e53f84c79 nixos/zerotierone: switch from manually generating the .link file to use the module
Previously, systemd.network.links was only respected with networkd
enabled, but it's really udev taking care of links, no matter if
networkd is enabled or not.

With our module fixed, there's no need to manually manage the text file
anymore.

This was originally applied in 3d1079a20d,
but was reverted due to 1115959a8d causing
evaluation errors on hydra.
2020-03-19 14:16:26 +01:00
Martin Baillie
6e055c9f4a tailscale: init at 0.96-33
Signed-off-by: Martin Baillie <martin@baillie.email>
2020-03-18 05:07:47 +00:00
Niklas Hambüchen
9d45737ae7
Merge pull request #82767 from thefloweringash/rpfilter-assertion-types
nixos/firewall: fix types in reverse path assertion
2020-03-18 04:11:01 +01:00
Andrew Childs
e110f5ecc1 nixos/firewall: fix types in reverse path assertion
Broken by 0f973e273c284a97a8dffeab7d9c0b09a88b7139 in #73533

The type of the checkReversePath option allows "strict" and "loose" as
well as boolean values.
2020-03-18 10:54:55 +09:00
goibhniu
5241e5a193
Merge pull request #79851 from mmilata/supybot-enhancements
nixos/supybot: switch to python3, enable systemd sandboxing, add option for installing plugins
2020-03-17 19:07:41 +00:00
Léo Gaspard
a0307bad46
Merge pull request #79120 from symphorien/iodine
Iodine: ipv6 support, updates, hardening, nixos test....
2020-03-16 23:42:12 +01:00
Pierre Bourdon
b8ef2285b5 nixos/stubby: set Type=notify on the systemd service
Fixes some dependency ordering problems at boot time with services that
require DNS. Without Type=notify these services might be started before
stubby was ready to accept DNS requests.
2020-03-16 10:10:45 +05:30
Silvan Mosberger
779b7ff3d8
Merge pull request #80931 from LEXUGE/master
smartdns: init at 30
2020-03-15 15:36:05 +01:00
adisbladis
c00777042f
Merge pull request #82620 from aanderse/ssh-silent
nixos/ssh: silence ssh-keygen during configuration validation
2020-03-15 01:21:38 +00:00
Harry Ying
629d3bab18
nixos/smartdns: init first generation config 2020-03-15 08:53:20 +08:00
Aaron Andersen
f383fa344e nixos/sshd: only include AuthorizedKeysCommand and AuthorizedKeysCommandUser options if explicitly set 2020-03-14 19:50:11 -04:00
Aaron Andersen
f5951f520c nixos/ssh: silence ssh-keygen during configuration validation 2020-03-14 19:37:30 -04:00
Florian Klink
74f451b851
Merge pull request #82413 from aanderse/authorized-keys-command
nixos/sshd: add authorizedKeysCommand and authorizedKeysCommandUser options
2020-03-14 23:58:47 +01:00
Andrew Childs
2c121f4215 nixos/firewall: fix inverted assertion for reverse path filtering
Previously the assertion passed if the kernel had support OR the
filter was *enabled*. In the case of a kernel without support, the
`checkReversePath` option defaulted to false, and then failed the
assertion.
2020-03-14 04:32:07 +00:00
Vladimír Čunát
0729b8c55e
Revert Merge #82310: nixos/systemd: apply .link
...even when networkd is disabled

This reverts commit ce78f3ac70, reversing
changes made to dc34da0755.

I'm sorry; Hydra has been unable to evaluate, always returning
> error: unexpected EOF reading a line
and I've been unable to reproduce the problem locally.  Bisecting
pointed to this merge, but I still can't see what exactly was wrong.
2020-03-13 22:05:33 +01:00
Aaron Andersen
dbe59eca84 nixos/sshd: add authorizedKeysCommand and authorizedKeysCommandUser options 2020-03-12 21:00:12 -04:00
Florian Klink
ce78f3ac70
Merge pull request #82310 from flokli/systemd-network-link-no-networkd
nixos/systemd: apply .link even when networkd is disabled
2020-03-12 15:47:59 -07:00
Markus Kowalewski
2c7f8d56dc
nixos/rxe: use iproute instead of rdma-core
The rdma-core packages dropped rxe_cfg in favour
of iproute's rdma utility (see https://github.com/linux-rdma/rdma-core/pull/678/files)
2020-03-12 22:32:44 +01:00
adisbladis
f3adcbd150
Merge pull request #82411 from adisbladis/ntpd-extraconfig
services.ntpd: Add extraConfig parameter
2020-03-12 16:37:25 +00:00
Silvan Mosberger
8f2109cda4
Merge pull request #81945 from Infinisil/hostFiles
Introduce `networking.hostFiles` option
2020-03-12 15:56:30 +01:00
adisbladis
63c35a9c28
services.ntpd: Add extraConfig parameter 2020-03-12 14:44:59 +00:00
Jörg Thalheim
154f9e1bd9
Merge pull request #82340 from nyanloutre/vsftpd_pam_fix
nixos/vsftpd: fix missing default pam_service_name
2020-03-11 22:29:43 +00:00
Jörg Thalheim
9aa23e31b3
Merge pull request #80904 from talyz/haproxy-fixes
nixos/haproxy: Revive the haproxy user and group
2020-03-11 22:23:13 +00:00
nyanloutre
7ab00c48d8
nixos/vsftpd: fix missing default pam_service_name
9458ec4 removed the ftp pam service which was used by default by vsftpd
2020-03-11 21:15:47 +01:00
talyz
bb7ad853fb nixos/haproxy: Revive the haproxy user and group
Running haproxy with "DynamicUser = true" doesn't really work, since
it prohibits specifying a TLS certificate bundle with limited
permissions. This revives the haproxy user and group, but makes them
dynamically allocated by NixOS, rather than statically allocated. It
also adds options to specify which user and group haproxy runs as.
2020-03-11 19:52:37 +01:00
Florian Klink
3d1079a20d nixos/zerotierone: switch from manually generating the .link file to use the module
Previously, systemd.network.links was only respected with networkd
enabled, but it's really udev taking care of links, no matter if
networkd is enabled or not.

With our module fixed, there's no need to manually manage the text file
anymore.
2020-03-11 10:21:37 +01:00
Linus Heckemann
dfc70d37f4
Merge pull request #82252 from mayflower/radius-http2
FreeRADIUS improvements
2020-03-10 16:01:46 +01:00
Linus Heckemann
065716ab95 nixos/freeradius: depend on network.target, not online 2020-03-10 15:54:29 +01:00
Linus Heckemann
0587329191 freeradius: make debug logging optional 2020-03-10 15:54:02 +01:00
Martin Milata
1affd47cc1 nixos/supybot: python3 switch, add plugin options
Python2 seems to be no longer supported by limnoria upstream.
2020-03-09 23:32:54 +01:00
Martin Milata
57f5fb62d4 nixos/supybot: enable systemd sandboxing options 2020-03-09 23:32:54 +01:00
Martin Milata
b150e08169 nixos/supybot: stateDir in /var/lib, use tmpfiles
Moving the stateDir is needed in order to use ProtectSystem=strict
systemd option.
2020-03-09 23:29:04 +01:00
Silvan Mosberger
64ee425a01
nixos/cjdns: Fix connectTo example rendering 2020-03-07 02:01:41 +01:00
Silvan Mosberger
1906320e68
nixos/cjdns: Don't use IFD for extra hosts 2020-03-07 02:01:19 +01:00
Luis Ressel
b19c485b22
nixos/wireguard: Fix typo in error message
generatePrivateKey -> generatePrivateKeyFile
2020-03-06 16:19:23 +01:00
Julien Moutinho
47f27938e7 shorewall: fix RestartTriggers 2020-03-05 00:01:44 +01:00
Thomas Dy
97a61c8903 nixos/nat: fix multiple destination ports with loopback 2020-03-04 18:11:31 +09:00
Andreas Rammhold
ca5048cba4
Merge pull request #79925 from mrkkrp/mk/add-nix-store-gcs-proxy-service
Add nix-store-gcs-proxy service
2020-03-02 16:04:16 +01:00
Mark Karpov
96b472e95d
module/nix-store-gcs-proxy: init 2020-03-02 16:01:14 +01:00
obadz
c31958449f
Merge pull request #77405 from danielfullmer/zerotier-mac-fix
nixos/zerotierone: prevent systemd from changing MAC address
2020-03-01 18:49:00 -07:00
worldofpeace
21c971a732
Merge pull request #81118 from tilpner/gitdaemon-usercreation
nixos/git-daemon: only create git user if it will be used
2020-03-01 13:40:57 +00:00
Jörg Thalheim
9218a58964
nixos/sslh: don't run as nogroup
See #55370
2020-02-28 15:32:36 +00:00
Vladimír Čunát
5f881209f9
nixos/kresd: never force extraFeatures = false
Fixes #81109.  Regressed in PR #78392 (26858063).
2020-02-26 15:10:53 +01:00
tilpner
6df119a6ec
nixos/git-daemon: only create git user if it will be used 2020-02-26 15:04:36 +01:00
Jörg Thalheim
8cfd003295
stubby: configure cache directory
This is needed for local dnssec validation
2020-02-24 10:51:43 +00:00
Lengyel Balazs
50fb52d4e1 fix wireguard service as well after it got upstreamed. 2020-02-22 00:32:15 +01:00
Jörg Thalheim
1ddb140d95
Merge pull request #53033 from netixx/openvswitch-improved-systemd
openvswitch: better integration with systemd
2020-02-21 08:24:49 +00:00
Edward Tjörnhammar
9bab9e2ec6
nixos/i2pd: address #63103
As a comment to 1d61efb7f1
Note that collect returns a list from a set
2020-02-19 13:15:28 +01:00
Julien Moutinho
f9be656873
shorewall: fix warnings due to types.loaOf being deprecated (#80154) 2020-02-16 12:53:49 +02:00
Jörg Thalheim
466c1df3e2
Merge pull request #79266 from Mic92/knot
nixos/knot: add keyFiles option
2020-02-15 11:15:03 +00:00
Jyun-Yan You
0f8d1ac47d nixos/pppd: fix build error 2020-02-14 12:51:50 +08:00
Symphorien Gibol
44fd320c0f nixos/iodine: protect passwordFiles with toString
It should prevent copying the files to a store path
2020-02-13 21:30:14 +01:00
Will Dietz
ac8a92543b
iwd: drop tmpfiles snippet, services use StateDirectory already
Originally added in [1], and iwd added StateDirectory to its services
in [2] -- 4 days later.

("StateDirectory wasn't used when tmpfile snippet was added to NixOS")
(nevermind git -> release delay)

[1] 6e54e9253a
[2] upstream iwd git rev: 71ae0bee9c6320dae0083ed8c1700bc8fff1defb
2020-02-12 19:29:28 -06:00
Jörg Thalheim
e2ef8b439f
knot: add keyFiles option
This useful to include tsig keys using nixops without adding those
world-readable to the nix store.
2020-02-12 16:36:42 +00:00
Jörg Thalheim
88029bce39
knot: drop dynamic user
This makes it hard to include secret files.
Also using tools like keymgr becomes harder.
2020-02-12 16:34:10 +00:00
Martin Milata
d99808c720 nixos/supybot: fix username
Broken in 1d61efb7f1.
2020-02-10 17:56:51 +01:00
Silvan Mosberger
6169eef798
Merge pull request #78024 from wamserma/minidlna-interval
minidlna: provide configuration option for announce interval
2020-02-10 01:25:47 +01:00
Markus S. Wamser
696979e0bc modules/wireguard: fix typo in documentation 2020-02-07 20:54:35 +01:00
symphorien
d2d5d89c2c
nixos/iodine: improve wording of some descriptions
Co-Authored-By: Martin Weinelt <mweinelt@users.noreply.github.com>
2020-02-05 19:47:43 +00:00
symphorien
dfa67635d6
nixos/iodine: fix typo in description
Co-Authored-By: Martin Weinelt <mweinelt@users.noreply.github.com>
2020-02-05 19:42:27 +00:00
symphorien
1addf1fd94
nixos/iodine: improve description of some options
Co-Authored-By: Martin Weinelt <mweinelt@users.noreply.github.com>
2020-02-05 19:42:07 +00:00
Frederik Rietdijk
419bc0a4cd Revert "Revert "Merge master into staging-next""
In 87a19e9048 I merged staging-next into master using the GitHub gui as intended.
In ac241fb7a5 I merged master into staging-next for the next staging cycle, however, I accidentally pushed it to master.
Thinking this may cause trouble, I reverted it in 0be87c7979. This was however wrong, as it "removed" master.

This reverts commit 0be87c7979.
2020-02-05 19:41:25 +01:00
Frederik Rietdijk
0be87c7979 Revert "Merge master into staging-next"
I merged master into staging-next but accidentally pushed it to master.
This should get us back to 87a19e9048.

This reverts commit ac241fb7a5, reversing
changes made to 76a439239e.
2020-02-05 19:18:35 +01:00
Vladimír Čunát
baeed035ea
Merge #78628: knot-resolver: 4.3.0 -> 5.0.1
The service needed lots of changes. A few smaller changes
are added into the PR, e.g. replacement for PR #72014.
See the commit messages for details.
2020-02-05 16:57:02 +01:00
Symphorien Gibol
00a91d919d nixos/iodine: hardening 2020-02-04 20:54:29 +01:00
Symphorien Gibol
7437bff7d1 nixos/iodine: nixpkgs-fmt 2020-02-04 20:54:29 +01:00
worldofpeace
74e4cb7ea4
Merge pull request #78543 from Atemu/dnscrypt-proxy2-service
nixos/dnscrypt-proxy2: init
2020-02-02 23:02:06 -05:00
Maximilian Bosch
c2d2c2d0ca
Merge pull request #72931 from Ma27/restart-dhcp-on-exit-hook-change
nixos/dhcpcd: restart dhcpcd if exit hook changed
2020-02-02 18:33:34 +01:00
Yegor Timoshenko
92d689d66b nixos/dnscrypt-proxy2: init
This removes the original dnscrypt-proxy module as well.

Co-authored-by: Atemu <atemu.main@gmail.com>
Co-authored-by: Silvan Mosberger <contact@infinisil.com>
Co-authored-by: ryneeverett <ryneeverett@gmail.com>
Co-authored-by: worldofpeace <worldofpeace@protonmail.ch>
2020-02-02 11:11:27 -05:00
Maximilian Bosch
f9bb054180
Merge pull request #78968 from ju1m/nsd_types_lines
nsd : use types.lines where appropriate
2020-02-01 09:51:23 +01:00
Julien Moutinho
1a1e5f7be5 nsd: use types.lines where appropriate 2020-01-31 20:40:48 +01:00
Vladimír Čunát
02bf0557c0
nixos/kresd: add .instances option 2020-01-31 15:22:52 +01:00
Vladimír Čunát
ae74a0e27c
(nixos/)knot-resolver: 4.3.0 -> 5.0.0
Minor incompatibilities due to moving to upstream defaults:
  - capabilities are used instead of systemd.socket units
  - the control socket moved:
    /run/kresd/control -> /run/knot-resolver/control/1
  - cacheDir moved and isn't configurable anymore
  - different user+group names, without static IDs

Thanks Mic92 for multiple ideas.
2020-01-31 15:22:52 +01:00
Vladimír Čunát
0a8fb01b80
nixos/kresd: fix a recent error in description 2020-01-31 15:06:27 +01:00
Aaron Andersen
7adffb14cd
Merge pull request #78419 from utsl42/fix-unifi-install
nixos/unifi: use systemd tmpfiles instead of preStart
2020-01-29 18:55:57 -05:00
worldofpeace
c693bd142c
Merge pull request #78745 from bene1618/dhcpcd
nixos/dhcpcd: Add option for dhcpcd waiting behaviour
2020-01-29 18:08:20 -05:00
Mario Rodas
deedf24c88
Merge pull request #75922 from tadfisher/kbfs-fixes
kbfs, nixos/keybase, nixos/kbfs: fix KBFS, add enableRedirector option
2020-01-28 19:13:40 -05:00
Benedikt Hunger
0767de3dc8 nixos/dhcpcd: Add option for dhcpcd waiting behaviour 2020-01-28 12:52:19 +01:00
Alyssa Ross
e99ec699a4 nixos/bitlbee: don't assign list to users.groups
Warns about loaOf deprecation warning.
2020-01-27 02:51:02 +00:00
Nathan Hawkins
b0208cb80f nixos/unifi: use systemd tmpfiles instead of preStart 2020-01-24 10:06:29 -05:00
Jörg Thalheim
2685806371
nixos/kresd: add listenDoH option 2020-01-23 23:22:37 +00:00
Jörg Thalheim
bfa278ee5a
nixos/knot: set defaultText for package option
the package attributes looks nicer in the manual
2020-01-23 23:17:04 +00:00
Florian Klink
dea2d64c35
Merge pull request #78134 from NinjaTrappeur/nin-harden-syncthing
nixos/syncthing.nix: Sandbox the systemd service.
2020-01-21 22:30:04 +01:00
zimbatm
93204f1d8a
nixos/matterbridge: fix package access
was broken by 4371ecb8a6 due to the
switch to buildGoModule
2020-01-21 13:17:18 +01:00
zimbatm
b54c60b689
nixos/zerotierone: simplify the unit
There is no need to stop/start the unit when the machine is online or
offline.

This should fix the shutdown locking issues.

nixos zerotier: sometimes it doesn't shutdown
2020-01-21 13:14:38 +01:00
Félix Baylac-Jacqué
ff8f2928ee
nixos/syncthing.nix: Sandbox the systemd service.
Using systemd sandboxing features to harden the syncthing service.
2020-01-20 21:48:48 +01:00
Markus S. Wamser
d4718f180b minidlna: provide configuration option for announce interval
Signed-off-by: Markus S. Wamser <github-dev@mail2013.wamser.eu>
2020-01-19 14:06:27 +01:00
Matt Layher
5089214a3d nixos/corerad: init 2020-01-16 12:38:36 -08:00
Silvan Mosberger
55b0129a14
Merge pull request #76178 from 0x4A6F/master-xandikos
xandikos: add tests and module
2020-01-13 23:48:22 +01:00
Martin Milata
d9319e8e87 nixos/ndppd: enable systemd sandboxing 2020-01-13 11:11:32 +00:00
Robin Gloster
8305186bb4
Merge pull request #77554 from lheckemann/fix-wpa-multiple1
nixos/wpa_supplicant: fix use with multiple interfaces
2020-01-13 12:07:54 +01:00
Linus Heckemann
bbd6d219e4 nixos/wpa_supplicant: fix #61391 2020-01-12 14:14:16 +01:00
volth
6abba2294d nixos/nat: use nixos-nat-out instead of OUTPUT 2020-01-12 00:06:49 +01:00
0x4A6F
c9ca370e32
nixos/xandikos: init 2020-01-11 16:08:45 +01:00
Daniel Fullmer
27b8253655 nixos/zerotierone: prevent systemd from changing MAC address 2020-01-09 17:51:44 -05:00
markuskowa
2913973aa7
Merge pull request #76938 from lourkeur/fix_76184_gnunet
nixos/gnunet: Add types to the options
2020-01-09 21:33:50 +01:00
Pascal Bach
0319241132 nixos/mxisd: fix empty user name 2020-01-08 23:18:26 +01:00
Milan Pässler
2a31a6a412 tree-wide: fix errors and warning related to loaOf deprecation 2020-01-07 06:23:28 +01:00
rnhmjoj
1d61efb7f1 treewide: use attrs instead of list for types.loaOf options 2020-01-06 10:39:18 -05:00
Louis Bettens
d49737836a nixos/gnunet: Add types to the options 2020-01-05 00:07:50 +01:00
Christian Kauhaus
129c73802f
Merge pull request #76153 from arcnmx/connman-iwd
nixos/connman: optional iwd backend
2020-01-02 21:35:54 +01:00
Silvan Mosberger
cdf79db19d
Module system improvements for NixOS as a submodule (#75031)
Module system improvements for NixOS as a submodule
2020-01-02 20:38:45 +01:00
Silvan Mosberger
bc42515736
nixos/syncthing: Fix submodule name usage
Module arguments should be taken from the arguments directly. This
allows evalModule's specialArgs to override them if necessary
2020-01-02 09:59:35 +01:00
Tim J. Baumann
36b98fdf26 networkmanager: fix dispatcherScripts example
Before, the example script didn't actually exit when the event type
didn't match "up".
2020-01-01 15:32:15 +01:00
Ryan Mulligan
3a644e30b9
Merge pull request #46131 from ju1m/shorewall
shorewall: init at 5.2.3.3
2019-12-30 10:04:31 -08:00
Julien Moutinho
56a73dfb35 shorewall: init at 5.2.3.3
nixos/shorewall: init
2019-12-30 09:42:03 -08:00
Vladimír Čunát
c3d4998e41
Merge #75803: kresd service: unify listen declarations 2019-12-27 15:55:38 +01:00
Tad Fisher
b4bacff13f nixos/keybase, nixos/kbfs: update service configs; add redirector 2019-12-23 22:55:06 -08:00
Florian Klink
eeaf1f702d
Merge pull request #75103 from sternenseemann/spacecookie
services/spacecookie: init
2019-12-23 11:09:52 +01:00
arcnmx
7753d58e89 nixos/connman: optional iwd backend 2019-12-21 13:48:15 -08:00
Florian Klink
e46abc6b8d
Merge pull request #76069 from misuzu/package-3proxy
nixos/3proxy: manual validation fix
2019-12-20 02:15:45 +01:00
misuzu
b6f87c688b nixos/3proxy: manual validation fix 2019-12-20 00:17:49 +02:00
Michael Raskin
6210c15573
Merge pull request #67507 from misuzu/package-3proxy
3proxy: init at 0.8.13
2019-12-19 15:42:15 +00:00
sternenseemann
25503db8e8 nixos/spacecookie: add service module and test 2019-12-17 14:17:03 +01:00
Dustin Frisch
f886a14dbd
kresd: Unified listen declarations
Deperecates the interfaces option which was used to generate a host:port
list whereas the port was always hardcoded to 53. This unifies the
listen configuration for plain and TLS sockets and allows to specify a
port without an address for wildcard binds.
2019-12-17 12:44:24 +01:00
Netix (Espinet François)
cd3597b486
openvswitch: better integration with systemd
Systemd dependencies for scripted mode
were refactored according to analysis in #34586.

networking.vswitches can now be used with systemd-networkd,
although they are not supported by the daemon, a nixos receipe
creates the switch and attached required interfaces (just like
the scripted version).

Vlans and internal interfaces are implemented following the
  template format i.e. each interface is
described using an attributeSet (vlan and type at the moment).
If vlan is present, then interface is added to the vswitch with
given tag (access mode). Type internal enabled vswitch to create
interfaces (see openvswitch docs).

Added configuration for configuring supported openFlow version on
the vswitch

This commit is a split from the original PR #35127.
2019-12-15 21:16:26 +01:00
Bernardo Meurer
5ee439eb08
nixos: fix ip46tables invocation in nat 2019-12-14 20:13:12 -08:00
volth
018c0445ba nixos/unbound: add package option 2019-12-12 23:49:47 +00:00
Andreas Rammhold
e8bb94fca9
Merge pull request #68459 from volth/patch-364
nixos/nat: create nixos-nat-{pre,post,out} in ip6tables too
2019-12-12 15:55:51 +01:00
Silvan Mosberger
4ee3e8b21d
nixos/treewide: Move rename.nix imports to their respective modules
A centralized list for these renames is not good because:
- It breaks disabledModules for modules that have a rename defined
- Adding/removing renames for a module means having to find them in the
central file
- Merge conflicts due to multiple people editing the central file
2019-12-10 02:51:19 +01:00
Emery Hemingway
6c1c99d6b4 nixos/yggdrasil: fix for configFile option
The configFile was not being merged with the declarative configuration at
runtime.
2019-12-07 19:56:49 +01:00
rnhmjoj
1a2e7c3b00
nixos: add myself to maintainers 2019-12-04 17:09:53 +01:00
Mario Rodas
93ff0446ca
Merge pull request #66089 from servalcatty/v2ray
v2ray: init at 4.21.3
2019-12-03 04:42:50 -05:00
Renaud
e37e7b413c
Merge pull request #72987 from rnhmjoj/dnschain
nixos/dnschain: use forwardZonesRecurse in pdns-recursor
2019-11-29 19:56:21 +01:00
Serval
899d38170c
v2ray: fixups and change to buildGoModule 2019-11-28 02:10:37 +08:00
misuzu
823d6698bb nixos/3proxy: note about htpasswd 2019-11-27 11:01:48 +02:00
Robin Gloster
c33110db9e
Merge pull request #73299 from toonn/wpa_supplicant-unit-start-bonding
nixos/wpa_supplicant: fix unit-start script
2019-11-26 16:48:48 +01:00
worldofpeace
38178a9a5b
Merge pull request #74030 from ckauhaus/connman-to-services.networking
connman: move "networking.connman" options to "services.connman"
2019-11-24 21:24:33 +00:00
Christian Kauhaus
edbf94d2ee connman: move options to services
As part of the networking.* name space cleanup, connman should be moved
to services.connman. The same will happen for example with
networkmanager in a separate PR.
2019-11-24 16:23:32 -05:00
John Ericson
d0d5136cce Merge remote-tracking branch 'upstream/master' into wrapper-pname-support 2019-11-24 17:25:07 +00:00
John Ericson
9b090ccbca treewide: Get rid of most parseDrvName without breaking compat
That is because this commit should be merged to both master and
release-19.09.
2019-11-24 17:22:28 +00:00
Serval
740e85f847
v2ray: add v2ray service 2019-11-21 21:51:10 +08:00
William G Hatch
9abc97dc65 bind: Expand description of services.bind.cacheNetworks
The new description should give more clear understanding of when to
edit the option.

I used NixOS to set up a DNS server that is authoritative for certain
zones.  The description of the `cacheNetworks` option made me think I
needed to set it to `"any"` to allow people to query the zone I set
up.  Reading the source of the module would have clarified my
understanding, but at the time I just read the description and thought
little of it.  Later I discovered I was getting tons of DNS requests
and presumably being used for a DNS amplification attack or similar.
I have fixed the problem now, but I would like the option to have a
clearer description so others don't make the same mistake I did.
2019-11-19 22:24:30 +01:00
Ingolf Wagner
dcdf4cec3a nixos/syncthing: add versioning 2019-11-19 20:31:30 +01:00
Erik Arvstedt
8aa5f30a8f nixos/bitcoind: remove PermissionsStartOnly
Unneded because there are no extra commands like ExecStartPre
2019-11-18 21:48:02 +01:00
Jelle Besseling
823852a6a9 nixos/eternal-terminal: add firewall information
(#71917)
2019-11-18 16:12:12 +01:00
Emery Hemingway
7a1b4d1964 nixos/yggdrasil: remove /etc effects
Use of the /etc directory should be avoided for software without
hardcoded configuration paths.
2019-11-16 16:36:17 +01:00
Franz Pletz
e84840117b
Merge pull request #71510 from asymmetric/wg-ns
Add namespace support to Wireguard module
2019-11-14 01:24:59 +00:00
Félix Baylac-Jacqué
a628f5efd9
modules/vsftpd: Add virtual users support
Add a virtual user system based around pam and a Berkeley
user database.

Adding the:

- localRoot
- userDbPath
- allowWriteableChroot
- virtualUseLocalPrivs

Vsftpd options.
2019-11-13 18:17:04 +01:00
toonn
82fc9ab5c8 nixos/wpa_supplicant: fix unit-start script
Ever since setting up bonding the `wpa_supplicant-unit-start` script has
been failing. This is because the file `bonding_masters` in
`/sys/class/net/` is *not* a directory containing `uevent`.

Adding a test to verify the `uevent` path to be sourced exists resolves
the problem.
2019-11-12 17:53:29 +01:00
misuzu
08eb63b5ac nixos/3proxy: init 2019-11-11 16:15:29 +02:00
worldofpeace
488e6b7a23
Merge pull request #73059 from flokli/nixos-test-port-tinydns
nixos/tinydns: port test to python
2019-11-09 21:53:07 +00:00
Peter Hoeg
954e234b98 nixos/haproxy: support hot-reload without dropping packets 2019-11-09 10:11:57 -08:00
Lorenzo Manacorda
412f6a967d wireguard: add creation and destination namespaces
The two new options make it possible to create the interface in one namespace
and move it to a different one, as explained at https://www.wireguard.com/netns/.
2019-11-09 11:59:14 +01:00
Silvan Mosberger
3022fde292
Merge pull request #71576 from ShaRose/patch-1
nixos/dnsdist: Add CAP_NET_BIND_SERVICE to AmbientCapabilities
2019-11-09 00:07:09 +01:00
Florian Klink
cbd9e9e01f nixos/tinydns: order service after network.target
In cases where you boot up really quickly (like in the VM test on a
non-busy host), tinydns might want to bind before the loopback interface
is fully up. Order tinydns after network.target to fix that.
2019-11-08 17:26:34 +01:00
rnhmjoj
38d573426a
nixos/dnschain: use forwardZonesRecurse in pdns-recursor 2019-11-07 17:09:24 +01:00
rnhmjoj
28c8884e62
nixos/pdns-recursor: add option for recursive forward zones 2019-11-07 17:08:09 +01:00
Silvan Mosberger
d34194badd
nixos/networkmanager: fix merging options (#72916)
nixos/networkmanager: fix merging options
2019-11-06 23:34:40 +01:00
Jan Tojnar
894fdfaf1f
nixos/networkmanager: fix merging options
Incorrect merging of modules resulted in dhcpcd being enabled causing flaky network connection.

https://github.com/NixOS/nixpkgs/pull/64364

Fixing it uncovered an infinite recursion from the same commit, previously masked by the incorrect merge.

We can just drop the `mkDefault` for `networking.wireless.enable` as it is already `false` by default.

Closes: https://github.com/NixOS/nixpkgs/issues/72416
2019-11-06 21:26:03 +01:00
Maximilian Bosch
51d1821509
nixos/dhcpcd: restart dhcpcd if exit hook changed
This change ensures that `dhcpcd.service` is restarted as soon as the
exit hook changes. I use this hook to do additional configuration for my
network (like setting a route via the given gateway to my WireGuard) and
when changing parts of this exit hook I'd expect to get this activated
when switching to my new configuration.
2019-11-06 20:49:22 +01:00
Eelco Dolstra
aa98348f88
jormungandr: Remove
This is a good example of a package/module that should be distributed
externally (e.g. as a flake [1]): it's not stable yet so anybody who
seriously wants to use it will want to use the upstream repo. Also,
it's highly specialized so NixOS is not really the right place at the
moment (every NixOS module slows down NixOS evaluation for everybody).

[1] https://github.com/edolstra/jormungandr/tree/flake
2019-11-05 15:00:58 +01:00
Max Veytsman
de1cbcc692 nixos/nat: fix typo in comment
This iptables directive is marking packets coming from the internal interfaces so they can later be NATed by the rule in 22378e6996/nixos/modules/services/networking/nat.nix (L38-L42) .

Fix the comment accordingly.
2019-11-04 17:00:22 +01:00
Marek Mahut
43a0b4b31f
Merge pull request #72415 from 1000101/trickster
nixos/trickster: init
2019-11-01 15:39:50 +01:00
Silvan Mosberger
dd0a47e7ae
treewide: Switch to system users (#71055)
treewide: Switch to system users
2019-11-01 13:26:43 +01:00
Jan Hrnko
9b0aefac86 nixos/trickster: init 2019-11-01 10:57:29 +01:00
ShaRose
9e2308ed80 nixos/dnsdist: Add CAP_NET_BIND_SERVICE to AmbientCapabilities
It seems that dnsdist doesn't actually request CAP_NET_BIND_SERVICE, which is why normally it's executed and root and setuids to another, unprivileged, user. This means that as it is, dnsdist will be unable to bind to any port under 1024 and will fail with access denied.

Removing CAP_SETGID and CAP_SETUID is also related to this as we don't actually change the uid or gid after the fact as we use DynamicUser. (That part isn't strictly NEEDED but there's no reason to have those capabilities if we don't use them).

There are also some additional sandboxing we can remove from the service definition as they are assumed true or strict by DynamicUser: specifically PrivateTmp and ProtectSystem respectively.

ProtectHome is still there, despite being assumed read-only as setting it to true means they are seen as empty. I don't think it really matters as I don't know if systemd will ignore it or not, but I didn't see any reason to go hunting for excuses to make it a bigger change.
2019-10-31 13:27:55 -02:30
Silvan Mosberger
90e30394f5
go-shadowsocks2: init at 0.0.11 (#67516)
go-shadowsocks2: init at 0.0.11
2019-10-30 01:05:59 +01:00
Gemini Lasswell
d6549a2c42 nixos/yggdrasil: remove DynamicUser for systemd 243 2019-10-26 13:51:31 +02:00
Gemini Lasswell
b8cb8c39d6 nixos/yggdrasil: add service 2019-10-26 13:51:31 +02:00
Janne Heß
2abe2b2cda nixos/stunnel: Add maintainers 2019-10-25 16:19:57 +02:00
Janne Heß
4a32dbd1e1 nixos/stunnel: Fix CA files 2019-10-25 16:19:57 +02:00
Ricardo M. Correia
4cd2cb43fb
Merge pull request #71137 from erictapen/smokeping-fix-permission
nixos/smokeping: replace smokeping.fcgi with a symlink
2019-10-23 18:19:15 +00:00
Florian Klink
f24b4fb411
nixos/networkmanager: remove networking.networkmanager.dynamic… (#71337)
nixos/networkmanager: remove networking.networkmanager.dynamicHosts
2019-10-21 02:33:28 +02:00
Florian Klink
ca6c91e395 nixos/networkmanager: remove networking.networkmanager.dynamicHosts
This option was removed because allowing (multiple) regular users to
override host entries affecting the whole system opens up a huge attack
vector. There seem to be very rare cases where this might be useful.
Consider setting system-wide host entries using networking.hosts,
provide them via the DNS server in your network, or use
networking.networkmanager.appendNameservers to point your system to
another (local) nameserver to set those entries.
2019-10-20 16:37:41 +02:00
Symphorien Gibol
a37b9636f7 networkmanager-fortisslvpn: create the local state directory
Otherwise connecting simply fails:
VPN connection: failed to connect: 'La création du fichier « /tmp/lib/NetworkManager-fortisslvpn/0507e3ef-f0e0-4153-af64-b3d9a025877c.config.XSB19Z » a échoué : No such file or directory'
2019-10-18 19:49:56 -04:00
Florian Klink
c41b37ef25
nixos/networkmanager: use tmpfiles to setup state directories (#71322)
nixos/networkmanager: use tmpfiles to setup state directories
2019-10-18 17:58:45 +02:00
Florian Klink
5e593038d1 nixos/networkmanager: use tmpfiles to setup state directories 2019-10-18 12:11:55 +02:00
Frederik Rietdijk
0256080d11 nixos/pppd: add description for peers, unbreaks metrics job and channel
services.pppd.peers was lacking a description, causing a trace warning
resulting in a parse error in the metrics job.
2019-10-17 13:59:52 +02:00
David Anderson
997a6f6f1e nixos/pppd: init 2019-10-15 08:36:09 -07:00
Justin Humm
b8cd11f347
smokeping: add erictapen as maintainer 2019-10-14 21:23:11 +02:00
Justin Humm
9eb067b0d7
nixos/smokeping: replace smokeping.fcgi with a symlink
This fixes a regression from bb649d96b0.
There were permission problems, when the preStart script tried to copy
the smokeping.fcgi file over the old file.
2019-10-14 21:11:47 +02:00
Janne Heß
d6c08776ba treewide: Switch to system users 2019-10-12 22:25:28 +02:00
Jan Tojnar
6c8aed6391
Merge branch 'master' into staging-next 2019-10-12 00:50:21 +02:00
Konrad Borowski
89f5dc24ed nixos/mullvad-vpn: add service
mullvad-vpn package is mostly useless without it.
2019-10-10 19:11:31 +02:00
Frederik Rietdijk
a0c34f54cc Merge master into staging-next 2019-10-08 11:56:52 +02:00
Maximilian Güntner
176b1aeb4e
nixos/mxisd: add support for ma1sd
both servers only differ slighly so the module
can be reused
2019-10-07 18:57:15 +02:00
geistesk
7f9767954b nixos/go-shadowsocks2: init 2019-10-06 11:18:20 +02:00
Jörg Thalheim
bf3360cdcf
nixos/zeronet: Improved config, dynamic user, remove static UI… (#70305)
nixos/zeronet: Improved config, dynamic user, remove static UID and GID
2019-10-04 10:23:13 +01:00
Okinan
5c18c08da9 nixos/zeronet: improved config, dynamic user 2019-10-03 17:03:32 -05:00
Elias Probst
86dea5559f nixos/networkmanager: allow iwd as Wi-Fi backend
This introduces an option wifi.backend to the networkmanager module.

Co-authored-by: Cole Mickens <cole.mickens@gmail.com>
Co-authored-by: worldofpeace <worldofpeace@protonmail.ch>
2019-10-02 21:52:58 -04:00
worldofpeace
9bc8169695 nixos/networkmanager: remove basePackages option
This option in now completely useless.
All the default configs for these packages
already have GNOME features default,
2019-09-29 20:36:49 -04:00
Frederik Rietdijk
503081fa5b Merge staging into staging-next 2019-09-29 11:05:22 +02:00
Vladimír Čunát
217cf982c7
Merge branch 'master' into staging-next 2019-09-27 22:13:02 +02:00
worldofpeace
985697bff7
Merge pull request #66652 from craigem/clarify_wireless_examples
nixos/doc: Clarify wireless examples
2019-09-26 22:56:20 -04:00
Craige McWhirter
cce7486deb nixos/doc: Clarify wireless examples
This commits makes it clearer to a novice reader how to configure several
diferent types of SSID connections that were otherwise obscurely documented

Resolves #66650
2019-09-26 22:52:21 -04:00
Vladimír Čunát
192fb9d11b
Merge branch 'staging-next' into staging 2019-09-24 08:15:01 +02:00
Vladimír Čunát
eab41878ac
Merge branch 'master' into staging-next 2019-09-24 08:14:34 +02:00
Jörg Thalheim
bfed455de3
Merge pull request #68946 from volth/escape
treewide: fix string escapes
2019-09-24 04:19:12 +01:00
Jörg Thalheim
8c7667c325
Enable work variant firewall with iptables-compat (#66953)
Enable work variant firewall with iptables-compat
2019-09-22 09:28:16 +01:00
Jörg Thalheim
ffa80e75b7
nixos/firewall: rename iptables-compat to iptables-nftables-compat 2019-09-22 09:09:43 +01:00
Vladimír Čunát
22a216849b
Re-Revert "Merge branch 'staging-next'"
This reverts commit f8a8fc6c7c.
2019-09-22 09:38:09 +02:00
Peter Hoeg
1c7aaf227c nixos/networkmanager: tiny cleanups
These are the leftovers of an older PR.

a. Send messages to auditd if auditing is enabled.
b. Add missing dbus configuration if dnsmasq is used for DNS
2019-09-22 13:33:43 +08:00
Vladimír Čunát
f8a8fc6c7c
Revert "Merge branch 'staging-next'"
This reverts commit 41af38f372, reversing
changes made to f0fec244ca.

Let's delay this.  We have some serious regressions.
2019-09-21 20:05:09 +02:00
Vladimír Čunát
41af38f372
Merge branch 'staging-next' 2019-09-21 13:14:09 +02:00
Matthew Bauer
d8b7b95ac6 Merge remote-tracking branch 'origin/master' into staging 2019-09-20 23:25:24 -04:00
Eelco Dolstra
b0ccd6dd16
Revert "nixos/doc: re-format"
This reverts commit ea6e8775bd. The new
format is not an improvement.
2019-09-19 19:17:30 +02:00
Frederik Rietdijk
f81d43b94c Merge staging-next into staging 2019-09-19 17:00:07 +02:00
Frederik Rietdijk
0b12d44c06 Merge master into staging-next 2019-09-19 16:59:42 +02:00
Marek Mahut
0358bc174b nixos/jormungandr: moving to a new section topics_of_interest 2019-09-19 10:51:59 +02:00
Jan Tojnar
0902f08e0d
Merge branch 'staging-next' into staging 2019-09-18 22:40:42 +02:00
Jan Tojnar
105abdd52c
Merge branch 'master' into staging-next 2019-09-18 22:40:03 +02:00
Jan Tojnar
ea6e8775bd
nixos/doc: re-format 2019-09-18 22:13:35 +02:00
Jan Tojnar
f5ef80b46d
Merge branch 'staging-next' into staging 2019-09-18 21:16:01 +02:00
Jan Tojnar
62791c3743
Merge branch 'master' into staging-next 2019-09-18 21:15:35 +02:00
Antoine R. Dumont (@ardumont)
35fe50352f nixos/minidlna: Allow more configuration options
This commits allows the user to configure:
- more minidlna options
- the ones not yet disclosed in nix (extending the existing minimal subset)
2019-09-17 19:51:33 +02:00
volth
b384420f2c
nixos/prosody: fix escape 2019-09-17 00:20:05 +00:00
Vladimír Čunát
268872d996
Merge branch 'staging-next' into staging 2019-09-16 19:25:54 +02:00
Vladimír Čunát
b6c6e1f9e8
Merge branch 'master' into staging-next 2019-09-15 13:18:54 +02:00
worldofpeace
1ff3a0c498 networkmanager: 1.18.2 -> 1.20.2
* libnm-glib is gone 👋️
* correct dbus_conf_dir
* remove legacy service symlink
* upstream defaults to 'internal' for dhcp
  NixOS module reflects this.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/blob/1.20.2/NEWS
2019-09-14 09:01:46 -04:00
Will Dietz
447d625edc networkmanager,modemmanager: fix service symlinks for systemd v243
Fixes problems such as:

systemd[1]: Failed to put bus name to hashmap: File exists
systemd[1]: dbus-org.freedesktop.nm-dispatcher.service: Two services allocated for the same bus name org.freedesktop.nm_dispatcher, refusing operation.

Problem is that systemd treats symlinks to files outside the service
path differently, causing our old workaround to look like two separate services.

These symlinks are intended to be a means for manually emulating
the behavior of the `Alias=` directive in these services.
Unfortunately even making these symlinks relative isn't enough,
since they don't make it to where it matters--
that only makes the links in /etc/static/systemd/system/*
relative, with systemd still being shown non-relative links
in /etc/systemd/system/*.

To fix this, drop all of this at the package level
and instead simply specify the aliases in the NixOS modules.

Also handle the same for modemmanager,
since the networkmanager NixOS module also handles that.
2019-09-14 08:05:27 -04:00
worldofpeace
3cb0ae999f
Revert "networkmanager,modemmanager: fix service symlinks for systemd v243" 2019-09-14 08:04:28 -04:00
Will Dietz
f99bdb2b61
networkmanager,modemmanager: fix service symlinks for systemd v243
Fixes problems such as:

systemd[1]: Failed to put bus name to hashmap: File exists
systemd[1]: dbus-org.freedesktop.nm-dispatcher.service: Two services allocated for the same bus name org.freedesktop.nm_dispatcher, refusing operation.

Problem is that systemd treats symlinks to files outside the service
path differently, causing our old workaround to look like two separate services.

These symlinks are intended to be a means for manually emulating
the behavior of the `Alias=` directive in these services.
Unfortunately even making these symlinks relative isn't enough,
since they don't make it to where it matters--
that only makes the links in /etc/static/systemd/system/*
relative, with systemd still being shown non-relative links
in /etc/systemd/system/*.

To fix this, drop all of this at the package level
and instead simply specify the aliases in the NixOS modules.

Also handle the same for modemmanager,
since the networkmanager NixOS module also handles that.
2019-09-13 21:02:39 -05:00
Robin Gloster
7782ffb89a
Merge pull request #64364 from JohnAZoidberg/nm-wireless
Allow NetworkManager and wireless together
2019-09-13 13:18:14 +02:00
Austin Seipp
5a1ae55bbc nixos/chrony: keep in foreground
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2019-09-12 11:45:51 -05:00
Austin Seipp
b8bda8cb4f nixos/chrony: remove redundant 'initstepslew.servers' option
This option was added in 6336048c58 but it
is essentially a complete duplicate of the existing cfg.servers and
there seems to be no reason to keep maintaining it.

Furthermore, it requires annoying duplication if you try to do option
merging, e.g. merging in sets into your configuration.nix that add
`services.chrony.initstepslew` options will overwrite the servers option
unless you keep it, but that means you just have to duplicate
config.networking.timeServers again anyway which is an implementation
detail!

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2019-09-12 11:45:51 -05:00
Austin Seipp
83180ea41f nixos/chrony: set iburst for ntp servers
'iburst' allows chrony to make very quick adjustments to the clock by
doing a couple rapid measurements outside of the default 'minpoll'
option. This helps improve rapid time adjustment at boot, and is enabled
by default.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2019-09-12 11:45:51 -05:00
Austin Seipp
f0ad5ebdfb nixos/{chrony,ntpd,openntpd}: add myself as maintainer
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2019-09-12 11:45:51 -05:00
Austin Seipp
a61e94329f nixos: shuffle all ntp services into their own dir
This is reckless, ill-advised, pointless, and I will be scorned for it,
but it makes me feel a lot better.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2019-09-12 11:45:51 -05:00
volth
3e792fb6df
nixos/nat: create nixos-nat-{pre,post,out} in ip6tables too 2019-09-10 21:58:19 +00:00
Michael Bishop
7256d10d00
Merge pull request #68368 from toonn/toxvpn-typo
nixos/toxvpn: Fix typo in option description
2019-09-09 14:35:22 -03:00
toonn
a34b61ab30 nixos/toxvpn: Fix typo in option description 2019-09-09 19:31:48 +02:00
volth
7b8fb5c06c treewide: remove redundant quotes 2019-09-08 23:38:31 +00:00
Marek Mahut
a2550e2af5
Merge pull request #68243 from mmahut/jormungandr
nixos/jormungandr: adding RUST_BACKTRACE until service is stable
2019-09-07 11:29:51 +02:00
worldofpeace
416f057bc3
Merge pull request #68213 from worldofpeace/ead/fix
nixos/iwd: add tmpfiles rule for ead service
2019-09-07 03:40:06 -04:00
Marek Mahut
af9c515c8b nixos/jormungandr: adding RUST_BACKTRACE until service is stable 2019-09-07 08:31:28 +02:00
Frederik Rietdijk
66bc7fc1b3 Merge master into staging-next 2019-09-06 22:46:05 +02:00
Nikolay Amiantov
daa9ea2987 murmur service: fix typo in description 2019-09-06 20:29:20 +03:00
worldofpeace
3722f1d20e nixos/iwd: add tmpfiles rule for ead service
This is needed for the wired service ead.service.
(in ReadWritePaths)
2019-09-06 11:32:55 -04:00
Vladimír Čunát
4aad2947f8
Merge branch 'master' into staging-next 2019-09-04 11:00:56 +02:00
Izorkin
32f6ce33ed nixos/firewall: add package option 2019-09-03 21:49:55 +03:00
Nikolay Amiantov
0a29a2e37c syncplay module: init 2019-09-03 00:30:12 +02:00
Vladimír Čunát
f21211ebfe
Merge branch 'master' into staging 2019-09-02 23:25:24 +02:00
Florian Klink
f74735c9d7 nixos: remove dependencies on local-fs.target
Since https://github.com/NixOS/nixpkgs/pull/61321, local-fs.target is
part of sysinit.target again, meaning units without
DefaultDependencies=no will automatically depend on it, and the manual
set dependencies can be dropped.
2019-09-01 19:06:38 +02:00
Silvan Mosberger
478e7184f8
nixos/modules: Remove all usages of types.string
And replace them with a more appropriate type

Also fix up some minor module problems along the way
2019-08-31 18:19:00 +02:00
Frederik Rietdijk
98ef78326d Merge staging-next into staging 2019-08-31 18:07:33 +02:00
Marek Mahut
74d7ce4248 nixos/{namecoind,bitcoind}: removing the altcoin prefix 2019-08-31 10:15:03 +02:00
Frederik Rietdijk
ad1d58c622 Merge staging-next into staging 2019-08-31 10:04:20 +02:00
volth
08f68313a4 treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
Frederik Rietdijk
5061fe0c2c Merge staging-next into staging 2019-08-28 08:26:42 +02:00
Maximilian Bosch
56a7bc05e1
nixos/treewide: drop dependencies to keys.target
The `keys.target` is used to indicate whether all NixOps keys were
successfully uploaded on an unattended reboot. However this can cause
startup issues e.g. with NixOS containers (see #67265) and can block
boots even though this might not be needed (e.g. with a dovecot2
instance running that doesn't need any of the NixOps keys).

As described in the NixOps manual[1], dependencies to keys should be
defined like this now:

``` nix
{
  systemd.services.myservice = {
    after = [ "secret-key.service" ];
    wants = [ "secret-key.service" ];
  };
}
```

However I'd leave the issue open until it's discussed whether or not to
keep `keys.target` in `nixpkgs`.

[1] https://nixos.org/nixops/manual/#idm140737322342384
2019-08-27 18:55:55 +02:00
rnhmjoj
05ddde928d
nixos/dnschain: disable DNSSEC for namecoin TLDs 2019-08-27 14:42:06 +02:00
volth
35d68ef143 treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
rnhmjoj
0e0a533d9a
nixos/pdns-recursor: add luaConfig option 2019-08-26 17:46:04 +02:00
rnhmjoj
92d956267a
nixos/pdns-recursor: implement a settings option 2019-08-26 17:46:03 +02:00
Marek Mahut
81fe072a8f nixos/unifi: restarting on failure (#67456) 2019-08-25 18:22:03 -06:00
Marek Mahut
18dfe1a3f5
Merge pull request #67449 from mmahut/jormungandr
nixos/jormungandr: adding genesis tests
2019-08-25 19:54:03 +02:00
Marek Mahut
f6ced211e6 nixos/jormungandr: changing the port to match upstream 2019-08-25 18:33:13 +02:00
Daniel Schaefer
b4044a3f2a networkmanager: Allow NetworkManager and wireless together
When NetworkManager is configured to not manage all interfaces, it's
perfectly fine to have the rest be managed by the standard nixos
wireless scripts.

I use
  networking.networkmanager.unmanaged = [
    "*" "except:type:wwan" "except:type:gsm"
  ];
to control everything using networking.wireless except for the mobile
LTE modem which only works with NetworkManager.
2019-08-25 12:00:31 +02:00
Jan Tojnar
edcecfee00
Merge pull request #67358 from jtojnar/ofono-progress
nixos/ofono: various improvements
2019-08-24 21:37:42 +02:00
Jan Tojnar
5db762126c
nixos/ofono: allow adding 3rd party plug-ins 2019-08-23 19:50:53 +02:00
Jan Tojnar
f66613b3b6
nixos/ofono: add module 2019-08-23 19:50:53 +02:00
Marek Mahut
ddc0521ebf nixos: adding jormungandr service 2019-08-22 07:10:16 +02:00
Marek Mahut
7c15694c29
Merge pull request #66271 from vdot0x23/patch-1
nixos/stubby: clearer wording for upstreamServers
2019-08-19 20:58:45 +02:00