Sandro
7ec767ff54
Merge pull request #173697 from jmbaur/avahi-daemon-deny-interfaces
...
nixos/avahi: add denyInterfaces option
2023-03-17 17:11:49 +01:00
Weijia Wang
32f39395a7
Merge pull request #210101 from helsinki-systems/upd/jitsi
...
Update of all Jitsi Meet components
2023-03-17 12:23:14 +02:00
Bernardo Meurer
6e55733359
Merge pull request #219747 from Stunkymonkey/deprecate-isNull
2023-03-16 11:10:22 -03:00
Lassulus
47233b27c9
Merge pull request #167319 from schnusch/cgit
2023-03-13 09:51:08 +07:00
Ben Wolsieffer
b92dae961c
nixos/chrony: allow @chown syscall set
...
The module was allowing specific chown syscalls, which is brittle because
there are several and different ones are used by glibc on different
architectures. For example, fchownat was already added to the allowlist for
aarch64, while on armv6l chrony crashes because chown32 is not in the
allowlist.
systemd provides the @chown syscall set, which includes all the chown
syscalls and avoids this brittleness. I believe the syscalls would all be
equivalent from an attacker's perspective, so there is unlikely to be any
security impact.
2023-03-12 18:10:56 -05:00
Jonas Heinrich
9f10a2e82a
Merge pull request #218633 from onny/networkd-dispatcher-rules
...
nixos/networkd-dispatcher: add rules option
2023-03-08 20:41:06 +01:00
K900
23b0152ffb
Merge pull request #218530 from K900/murmur-dbus
...
nixos/murmur: expose dbus
2023-03-08 18:35:56 +03:00
K900
d8d8b55e7d
nixos/murmur: expose dbus
2023-03-08 18:03:51 +03:00
Jonas Heinrich
26e14e57af
nixos/networkd-dispatcher: add rules option
2023-03-08 10:20:47 +01:00
Felix Buehler
d10e69c86b
treewide: deprecate isNull
...
https://nixos.org/manual/nix/stable/language/builtins.html#builtins-isNull
2023-03-06 22:40:04 +01:00
SEIAROTg
5a4dc2128e
nixos/wireguard: fix mtu after switching netns.
...
mtu is set after switching netns and thus the new netns should be used.
2023-03-04 18:51:12 +00:00
K900
18f85de76d
nixos/firewall: assert that the kernel supports conntrack helper auto-loading
2023-03-04 10:53:47 +03:00
Arian van Putten
17ca3dd2a6
Merge pull request #217852 from justinas/teleport-12
...
teleport: 11.3.4 -> 12.0.2, reintroduce teleport_11
2023-03-02 11:18:24 +01:00
Yureka
55da71c10e
nixos/nftables: add checkRuleset option ( #216531 )
...
* nixos/nftables: add checkRuleset option
* lkl: 2022-05-18 -> 2023-01-27
2023-03-02 10:28:01 +01:00
Justinas Stankevicius
31b5597cbd
nixos/teleport: add "package" option
2023-02-28 13:22:50 +02:00
Jared Baur
ea0dc2c5eb
nixos/avahi: add denyInterfaces option
2023-02-27 15:41:53 -08:00
Daniel Olsen
ea31ef91af
nixos/headscale: update oidc options
2023-02-27 15:17:16 +01:00
Robert Schütz
9e1d4dff3e
nixos/openvpn: use writeShellScript
...
Previously the upScript would fail with
Syntax error: "(" unexpected (expecting "done")
on line 7 if /bin/sh is not bash.
2023-02-26 10:12:28 -08:00
Naïm Favier
129b6f7812
Merge pull request #216504 from ncfavier/unbound-state-dir-writable
...
nixos/unbound: make stateDir writable
2023-02-23 14:23:53 +01:00
Robert Schütz
89c8ef30a6
nixos/imaginary: bind to localhost by default
2023-02-22 17:37:36 -08:00
Sandro
5b7d323435
Merge pull request #216909 from emilytrau/tailscale-tweaks
2023-02-21 23:21:09 +01:00
Jonas Heinrich
553c376a49
nixos/networkd-dispatcher: init
2023-02-19 04:42:25 -05:00
Nick Cao
a1291d0d02
Merge pull request #205784 from Eliot00/v2raya-fix
...
v2raya: v2rayA should start after nftables
2023-02-19 15:08:29 +08:00
Emily Trau
949b1df785
nixos/tailscale: fix config priority conflict
2023-02-18 13:28:04 +11:00
pennae
047bd73c5e
nixos/wireguard: make publicKeys singleLineStrs
...
using readFile instead of fileContents (or using indented strings) can
leave a trailing newline that causes build errors in systemd units and
has previously caused runtime errors in wireguard scripts. use
singleLineStr to strip a trailing newline if it exists, and to fail if
more than one is present.
2023-02-16 11:56:12 +01:00
Naïm Favier
5cf311c036
nixos/unbound: make stateDir writable
2023-02-15 18:14:58 +01:00
Robert Schütz
7b60fce843
Merge pull request #215222 from dotlambda/nixos-imaginary-init
...
nixos/imaginary: init
2023-02-12 08:42:19 -08:00
Andreas Stührk
8dade1f713
nixos/envoy: add option requireValidConfig to make config validation errors non-fatal
...
Co-authored-by: Vincent Haupert <vincent@yaxi.tech>
2023-02-11 18:21:21 +01:00
Vincent Haupert
84220a7098
nixos/envoy: add package option
2023-02-11 18:21:21 +01:00
Vincent Haupert
3c3da8768b
nixos/envoy: further service hardening
2023-02-11 18:21:21 +01:00
Vincent Haupert
8fff553f7e
nixos/envoy: sort serviceConfig entries
2023-02-11 18:21:21 +01:00
Vincent Haupert
989a1a6ef5
nixos/envoy: use lists in serviceConfig where appropriate
...
Using type `list` instead of `str` in `serviceConfig` entries which
accept multiple values allows easier extension of the unit
configuration.
2023-02-11 18:21:21 +01:00
Robert Schütz
efee1b5234
nixos/imaginary: init
2023-02-11 09:18:42 -08:00
Naïm Favier
86a387351a
Merge branch 'master' into nixos/hostapd
2023-02-11 14:03:56 +01:00
bb2020
76bf633dc2
nixos/minidlna: minor changes
2023-02-09 21:11:20 +03:00
pennae
bf4c0c1900
nixos/*: remove trailing period in mkEnableOptions
...
those are added by mkEnableOption, and .. is replaced to … by markdown
processing.
2023-02-08 15:23:34 +01:00
Will Fancher
1406dd02a9
sshd: Cyphers -> Ciphers
2023-02-07 13:54:36 -05:00
Sandro
98a5726add
Merge pull request #204390 from gbtb/openvpn_client_restart_after_suspend
...
Resolves https://github.com/NixOS/nixpkgs/issues/52528
2023-02-07 01:06:24 +01:00
Matthieu Coudron
ef5da70d66
services.openssh: rename several settings ( #211991 )
...
* services.openssh: rename several settings
... to match the sshd config format (makes transition smoother), namely:
services.openssh.forwardX11 -> services.openssh.settings.X11Forwarding
services.openssh.cyphers -> services.openssh.settings.Cyphers
services.openssh.macs -> services.openssh.settings.Macs
services.openssh.kexAlgorithms -> services.openssh.settings.KexAlgorithms
services.openssh.gatewayPorts -> services.openssh.settings.GatewayPorts
* release-notes: mention openssh renaming
* chore: regenerated release-notes
2023-02-07 00:11:18 +01:00
Sandro
d47709d1ef
Merge pull request #208189 from numinit/update-nebula-module
2023-02-06 23:14:58 +01:00
Robert Obryk
0a6dd02620
nixos/firefox-syncserver: enable recommendedProxySettings
...
The syncserver requires a Host header identical to the one provided by
the client.
2023-02-05 23:47:19 +01:00
Malte Voos
3449f83618
maintainers/malvo: update information
2023-02-05 15:05:51 +01:00
Morgan Jones
e99f342f11
nixos/nebula: harden systemd unit
2023-02-04 16:24:45 -08:00
Morgan Jones
9d649fd78c
nixos/nebula: add tests for relays; clean up nebula passthru test
2023-02-04 16:24:45 -08:00
Morgan Jones
90581c977f
nixos/nebula: don't run as root; support relays
2023-02-04 16:24:45 -08:00
Elliot
e78f2115bf
v2raya: v2rayA should start after nftables
2023-02-03 10:22:23 +08:00
Sebastian Sellmeier
f531b17f7d
avahi-daemon: add ConfigurationDirectory to ensure "avahi/services" exists
2023-02-01 21:43:29 +01:00
ajs124
adc59137e9
nixos/jicofo: fix after update
...
2943c21ff7
2023-02-01 16:32:23 +01:00
Izorkin
59dbe319ce
nixos/gitea: update SystemCallFilter
2023-01-31 10:08:32 -06:00
Izorkin
48ecda0962
nixos/chrony: disable PrivateDevices setting
2023-01-31 10:08:32 -06:00
