Commit Graph

6642 Commits

Author SHA1 Message Date
Jörg Thalheim
a5ad8b4f69
stage-2: simplify exporting path 2017-04-05 09:05:13 +02:00
Profpatsch
a1e6176cbf modules/searx: fix configFile type 2017-04-04 20:40:31 +02:00
Eelco Dolstra
e84d5b23e1
Allow systemd-fsck@.service to find fsck.*
Fixes "fsck.ext4 doesn't exist, not checking file system on ...".
2017-04-04 18:17:05 +02:00
Eelco Dolstra
de51ad6cd1
Don't restart systemd-fsck@ units
Restarting them is useless since the filesystem is already
checked. Worse, restarting them causes the filesystem to be unmounted.

Also remove an override for systemd-rkill@.service which no longer
exists.
2017-04-04 16:40:18 +02:00
Eelco Dolstra
01dbf03628
network-link-*.service: Set stopIfChanged = false
This reduces the time window during which IP addresses are gone during
switch-to-configuration. A complication is that with stopIfChanged =
true, preStop would try to delete the *new* IP addresses rather than
the old one (since the preStop script now runs after the switch to the
new configuration). So we now record the actually configured addresses
in /run/nixos/network/addresses/<interface>. This is more robust in
any case.

Issue https://github.com/NixOS/nixops/issues/640.
2017-04-04 15:13:49 +02:00
Eelco Dolstra
35dbcbb296
Fix eval error due to config.ec2.hvm 2017-04-04 13:49:13 +02:00
Eelco Dolstra
279565c3d6
Revert "Revert "EC2: Disable PV support""
This reverts commit 71710fd099.
2017-04-04 13:03:05 +02:00
Jörg Thalheim
847fdaaddc Merge pull request #24502 from Mic92/rtl8192su-firmware
rtl8192su-firmware: init at unstable-2016-10-05
2017-04-04 12:09:13 +02:00
Jörg Thalheim
71710fd099
Revert "EC2: Disable PV support"
This reverts commit fbe6d23624.

this breaks every non-ec2 (non-hvm) system

cc @edolstra
2017-04-04 12:05:21 +02:00
Piotr Bogdan
c91c3209f3 unclutter: Fix default value of $DISPLAY 2017-04-03 18:41:11 +01:00
Eelco Dolstra
8cc3db6b67
Add 17.03 AMIs 2017-04-03 17:46:34 +02:00
Eelco Dolstra
fbe6d23624
EC2: Disable PV support
Unfortunately, somewhere between 16.09 and 17.03, paravirtualized
instances stopped working. They hang at the pv-grub prompt
("grubdom>"). I tried reverting to a 4.4 kernel, reverting kernel
compression from xz to bzip2 (even though pv-grub is supposed to
support xz), and reverting the only change to initrd generation
(5a8147479e). Nothing worked so I'm
giving up.
2017-04-03 17:46:34 +02:00
Thomas Tuegel
bd0163fc34
Merge branch 'fontconfig-penultimate' 2017-04-03 09:31:20 -05:00
Thomas Tuegel
89bfa112cf
fontconfig-penultimate: 0.2.1 -> 0.3.2 2017-04-03 09:26:19 -05:00
Thomas Tuegel
03942659ca
nixos/fontconfig: remove renderMonoTTFAsBitmap 2017-04-03 08:24:32 -05:00
Thomas Tuegel
21c9190a5f
nixos/fontconfig: remove forceAutohint option 2017-04-03 08:23:32 -05:00
Thomas Tuegel
7a78892c47
nixos/fontconfig: disable autohint by default 2017-04-03 08:22:03 -05:00
Alexey Shmalko
fa4fe71105
docker: fix socket permissions
Docker socket is world writable. This means any user on the system is
able to invoke docker command. (Which is equal to having a root access
to the machine.)

This commit makes socket group-writable and owned by docker group.

Inspired by
https://github.com/docker/docker/blob/master/contrib/init/systemd/docker.socket
2017-04-03 09:05:37 -04:00
Shea Levy
3a26d09e15 initrd-ssh: Use initrd secrets for host keys 2017-04-02 16:33:37 -04:00
Shea Levy
b09490a322 systemd-boot: Support initrd secrets 2017-04-02 16:33:37 -04:00
Shea Levy
59c0977300 Add facility to append secrets to the initrd 2017-04-02 16:33:37 -04:00
Niklas Hambüchen
ee0f3e7ad9 acme: Use chown -R for challenges directory. Fixes #24529.
Commit 75f131da02 added
`chown 'nginx:nginx' '/var/lib/acme'` to the pre-start script,
but since it doesn't use `chown -R`, it is possible that there
are older existing subdirs (like `acme-challenge`)
that are owned to `root` from before that commit went it.
2017-04-01 15:22:01 +02:00
Eelco Dolstra
80b40fdf03
sshd.nix: Alternative fix for #19589
AFAICT, this issue only occurs when sshd is socket-activated. It turns
out that the preStart script's stdout and stderr are connected to the
socket, not just the main command's. So explicitly connect stderr to
the journal and redirect stdout to stderr.
2017-03-31 16:18:58 +02:00
Eelco Dolstra
4e79b0b075
Revert "sshd: separate key generation into another service"
This reverts commit 1a74eedd07. It
breaks NixOps, which expects that

  rm -f /etc/ssh/ssh_host_ed25519_key*
  systemctl restart sshd
  cat /etc/ssh/ssh_host_ed25519_key.pub

works.
2017-03-31 16:18:58 +02:00
Jörg Thalheim
50f7a7ca2e
rtl8192su-firmware: init at unstable-2016-10-05 2017-03-31 10:49:38 +02:00
Scott R. Parish
7138b55918
slock: needs the ability to be install with suid privileges 2017-03-30 14:36:53 -07:00
sternenseemann
fd3a99633b 2bwm: init at 0.2 2017-03-30 19:21:27 +02:00
Robin Gloster
8a18e1f7f1
quagga service: disable 2017-03-30 16:23:33 +02:00
Robin Gloster
a79891f6b2
sitecopy: remove 2017-03-30 12:06:09 +02:00
Eelco Dolstra
a57bcd38b4
update-users-groups.pl: Keep track of deallocated UIDs/GIDs
When a user or group is revived, this allows it to be allocated the
UID/GID it had before.

A consequence is that UIDs and GIDs are no longer reused.

Fixes #24010.
2017-03-29 18:13:18 +02:00
romildo
2630e7384f qt5ct: add a nixos module to enable qt5ct
In order to use qt5ct (Qt5 Configuration Tool) to configure Qt5
settings (theme, font, icons, etc.) under DE/WM without Qt
integration, the environment variable QT_QPA_PLATFORMTHEME should be
set to "qt5ct".

It can be done automatically by this module, or by setting the
variable explicitly in the user or in the system configuration.
2017-03-29 06:17:23 -03:00
Bas van Dijk
1d52c677be ssmtp: use the authPassFile option instead of authPass
This gives users the option of storing the authPass outside the
world-readable Nix store.
2017-03-29 00:34:23 +02:00
Tim Steinbach
eb70ae34b1 Merge pull request #24254 from bachp/gitlab-runner-9
Upgrade Gitlab Runner
2017-03-28 18:21:35 -04:00
Jörg Thalheim
36fca93290
rename iana_etc to iana-etc
fixes #23621
2017-03-28 22:35:15 +02:00
Pascal Bach
8373124202 gitlab-runner: make v1 runner available
gitlab-runner 9.0.0 is only compatible with gitlab >= 9.0
gitlab-runner1 1.11.1 is only compatible with gitlab < 9.4
2017-03-28 21:02:43 +02:00
Bas van Dijk
6f2eca1744 wordpress: replace the dbPassword option with dbPasswordFile (#24146)
We shouldn't force users to store passwords in the world-readable Nix store.
2017-03-28 17:38:16 +02:00
Clemens Fruhwirth
72ec884cc6 Make GCE image as small as possible and incorporate partition growing
when users of nixops specified a larger root disk via
deployment.gce.rootDiskSize

1GB is the smallest possible size as GCP doesn't support
fractions of GB for RAW images, see
https://cloud.google.com/compute/docs/images/import-existing-image#requirements
2017-03-27 17:41:42 +02:00
Robin Gloster
d1228f95e9
Revert "Revert "gdm module: only make xserver args overrideable""
This reverts commit 4e57e7f7c6.

This actually broke gnome3 and didn't fix anything, I failed bisecting.
2017-03-27 17:20:56 +02:00
Franz Pletz
1b95985b71 Merge pull request #24148 from volth/libvirt-3.1.0
libvirt: 3.0.0 -> 3.1.0
2017-03-27 10:02:06 +02:00
Rodney Lorrimar
db14ea3926 longview service: don't write passwords to nix store
Adds services.longview.{apiKeyFile,mysqlPasswordFile} options as
alternatives to apiKey and mysqlPassword, which still work, but are
deprecated with a warning message.

Related to #24288.
2017-03-26 23:06:42 +01:00
c74d
a4ac5506f5 google-compute-image: fix Yama LSM option conflict
Having fixed the Google Compute Engine image build process's copying
of store paths in PR #24264, I ran `nixos-rebuild --upgrade switch`...
and the GCE image broke again, because it sets the NixOS configuration
option for the sysctl variable `kernel.yama.ptrace_scope` to
`mkDefault "1"`, i.e., with override priority 1000, and now the
`sysctl` module sets the same option to `mkDefault "0"` (this was
changed in commit 86721a5f78).

This patch raises the override priority of the Google Compute Engine
image configuration's definition of the Yama sysctl option to 500
(still lower than the priority of an unmodified option definition).

I have tested that this patch allows the Google Compute Engine image
to again build successfully for me.
2017-03-26 21:09:58 +02:00
Arnold Krille
68729958e8
network-interfaces: reload bridges on conf changes
And adopt the tests to add an interface and remove it again.

It should work when deactivating rstp, it will not work when activating
rstp for the first bridge as then the userspace daemon is not yet
available. But once one bridge is active with stp, it should work with
the reload for any further bridge.

Fixes #21745. Also see #22547.
2017-03-26 18:47:43 +02:00
Daniel Ehlers
20a5b5bead sshguard: new package 2017-03-26 14:46:22 +02:00
Edward Tjörnhammar
b35d22b30c
radarr: init at 0.2.0.553 + nixos module 2017-03-25 21:19:55 +01:00
Edward Tjörnhammar
2db5c5cfe2
jackett: init at 0.7.1197 + nixos module 2017-03-25 21:19:44 +01:00
Edward Tjörnhammar
958668ab80
nixos, openafs-client: correct serviceConfig 2017-03-25 21:19:34 +01:00
Richard Zetterberg
dc10688edb nftables: adds information regarding nftables and Docker (#24326) 2017-03-25 16:34:02 +01:00
Franz Pletz
d545772640
libvirt: make guest suspend work, use upstream units 2017-03-25 14:59:01 +01:00
Nikolay Amiantov
417844b596 phpfpm service: don't use private /tmp
This breaks local PostgreSQL connections.
2017-03-25 14:52:44 +01:00
Robin Gloster
6b8ad8b581
networkd: fix setting both defaultGateway{,6} 2017-03-25 14:30:05 +01:00
Tuomas Tynkkynen
60788745c9 channel.nix: Use filterSource to exclude unnecessary files from nixpkgs
Currently, if you try to build a NixOS config including channel.nix, e.g.:

nix-build -I nixpkgs=. -I nixos-config=nixos/modules/installer/cd-dvd/installation-cd-minimal.nix nixos -A config.system.build.isoImage

twice in a row, you end up with two different build results. This is
caused by the 'result' symlink of the first build affecting the channel
contents of the second build.

If we use filterSource with a predicate that ignores the 'result'
symlinks, the problem is gone. Do the same thing for VIM/Emacs
swap/backup files to avoid even more 'spurious' rebuilds.

Additionally, filter out the '.git' directory at the same time, as we
'rm -rf' it from the result anyway. This avoids a considerable amount of
unnecessary file I/O copying and deleting the .git directory.
2017-03-25 01:42:28 +02:00
Leon Isenberg
db30cff500 earlyoom service: init 2017-03-24 23:16:16 +01:00
Vladimír Čunát
455ce3528c
Merge branch 'staging' 2017-03-24 21:07:55 +01:00
Joachim Fasting
f815a7697e
dnscrypt-proxy service: systemd notification under apparmor 2017-03-24 14:37:44 +01:00
Robin Gloster
4e57e7f7c6
Revert "gdm module: only make xserver args overrideable"
This reverts commit a5aa926902.

This allows gdm to run again, the test is still failing.
2017-03-24 10:35:20 +01:00
c74d
e0e520a519 google-compute-image: copy store paths with rsync
In `nixos/modules/virtualisation/google-compute-image.nix`, copy store
paths with `rsync -a` rather than `cp -prd`, because `rsync` seems
better able to handle the hard-links that may be present in the store,
whereas `cp` may fail to copy them.

I have tested that the Google Compute Engine image builds successfully
for me with this patch, whereas it did not without this patch.

This is the same fix applied for Azure images in commit
097ef6e435d5b3fcde92e67abbaaaaaf05c0723d.

Fixes #23973.
2017-03-24 02:14:10 +01:00
Jan Malakhovski
2822bacd60
nixos: xen: condition default packages on enable
Closes #23690.
2017-03-24 01:54:04 +01:00
Linus Heckemann
79872b9e39 Document possibility of multiple keyboard layouts
In services.xserver.layout
2017-03-23 21:15:14 +00:00
Linus Heckemann
c5c0459a60 xserver: check that selected layout exists
Fixes #5638
2017-03-23 21:02:38 +00:00
Robin Gloster
c2b9b8031f Merge pull request #24026 from benley/use-xkbDir
nixos: Use xkbDir consistently so it has an effect
2017-03-23 18:02:26 +01:00
Robin Gloster
e82baf043e
security-wrapper: link old wrapper dir to new one
This makes setuid wrappers not fail after upgrading.

references #23641, #22914, #19862, #16654
2017-03-23 15:57:30 +01:00
Robin Gloster
45f486f096
Revert "security-wrapper: Don't remove the old paths yet as that can create migration pain"
This reverts commit 4c751ced37.

This does not fix the issue as /run is now mounted with nosuid.
2017-03-23 15:57:23 +01:00
Vladimír Čunát
c1a9dc3d37
Merge branch 'master' into staging 2017-03-23 13:31:28 +01:00
Symphorien Gibol
a6665adde8 grub module: fix useOSProber when installing grub as EFI 2017-03-23 12:53:44 +01:00
Jörg Thalheim
b2ba188656 Merge pull request #24182 from ndowens/munin
munin: 2.0.30 -> 2.0.33; for CVE-2017-6188
2017-03-22 19:21:02 +01:00
Piotr Bogdan
a4b4cd0710 lightdm-greeters service: add extraConfig option (#24135) 2017-03-22 15:33:22 +01:00
Thomas Tuegel
a96e047b31
nixos/sddm: replace themes option with package option 2017-03-22 07:44:55 -05:00
Thomas Tuegel
7ca62935bb
nixos/plasma5: do not include extra-cmake-modules in sddm
Fixes #24126.
2017-03-22 07:44:55 -05:00
Joachim Fasting
95eaa3aec3
nixos/tor: add missing option type 2017-03-22 02:27:23 +01:00
Jörg Thalheim
b4169bb8dd
munin: fix tests by replacing cron with systemd timer 2017-03-22 00:16:36 +01:00
Eelco Dolstra
86721a5f78
Allow attaching to non-child processes by default
The inability to run strace or gdb is the kind of
developer-unfriendliness that we're used to from OS X, let's not do it
on NixOS.

This restriction can be re-enabled by setting

  boot.kernel.sysctl."kernel.yama.ptrace_scope" = 1;

It might be nice to have a NixOS module for enabling hardened defaults.

Xref #14392.

Thanks @abbradar.
2017-03-21 18:48:35 +01:00
Eelco Dolstra
78bb734452
nix-daemon.nix: Make the 1.12 check less strict 2017-03-21 18:48:35 +01:00
Nikolay Amiantov
6555ec03c3 udev module: filter duplicate udev paths
Fixes #24174
2017-03-21 20:22:27 +03:00
Nikolay Amiantov
d3e2957c90 octoprint: 1.3.1 -> 1.3.2
Fix startup wizard and cleanup dependencies.
2017-03-21 20:22:27 +03:00
Domen Kožar
02129a8788 Merge pull request #23672 from edanaher/nginx-alias
Nginx alias directive
2017-03-21 15:04:02 +01:00
Eelco Dolstra
2cb25f8b59
nix: 1.11.7 -> 1.11.8 2017-03-21 14:49:23 +01:00
Robin Gloster
f2ff646e59 Merge pull request #23641 from awakenetworks/parnell/fix-wrapper-migration
security-wrapper: Don't remove the old paths yet as that can create migration pain
2017-03-21 13:40:15 +01:00
Franz Pletz
4bd12fa7b2
gitlab module: explicitely create pages shared path
Fixes creation of backups.
2017-03-21 13:16:51 +01:00
Frederik Rietdijk
94eb74eaad Merge remote-tracking branch 'upstream/master' into HEAD 2017-03-21 13:04:37 +01:00
Franz Pletz
fb50cde71e
nixos/treewide: systemd.time is in manvolume 7
cc #23396
2017-03-21 08:28:53 +01:00
Robin Gloster
c808801937
nix-daemon: fix autoOptimiseStore option 2017-03-21 02:17:09 +01:00
Franz Pletz
295a824abc Merge pull request #21866 from pjones/pjones/rmilter
rmilter: Fix a couple of bugs
2017-03-20 20:50:56 +01:00
Franz Pletz
c13922f012
nginx: explicitly use stable version
Also updates the documention of the NixOS option `services.nginx.package`
that upstream recommends using the mainline version instead.

Fixes #21665.
2017-03-20 20:04:09 +01:00
Eelco Dolstra
337f731c2b Merge pull request #24134 from pstn/nix-auto-optimise
Added option and description for nix store auto-optimisation.
2017-03-20 20:01:48 +01:00
Philipp Steinpass
68c6d90417 Added option and description for nix store auto-optimisation. 2017-03-20 19:09:19 +01:00
Franz Pletz
fff8cc79df Merge pull request #23279 from mbbx6spp/make-nginx-module-less-gross
nginx service: add commonHttpConfig option
2017-03-20 19:03:20 +01:00
Thomas Tuegel
1b0d9e9ae6 Merge pull request #23819 from ttuegel/freetype
FreeType 2.7.1 and Fontconfig defaults
2017-03-20 11:43:50 -05:00
Thomas Tuegel
020791f7e1 Merge pull request #24125 from ttuegel/disable-kimpanel
nixos/plasma5: do not set kimpanel as default IBus panel
2017-03-20 10:23:09 -05:00
Nikolay Amiantov
179fe96a03 Merge pull request #24112 from abbradar/odroid
Add ODROID-XU{3,4} support
2017-03-20 17:44:09 +03:00
Thomas Tuegel
d709cdd829
nixos/plasma5: do not set kimpanel as default IBus panel
kimpanel does not show installed IBus engines or allow switching input
methods. kimpanel does show configured keyboard layouts through kxkb, so I
believe there is some problem communicating with IBus. No error messages are
produced in the log and I have been unable to discover the cause. I have no
intention of continuing to work on kimpanel at this time, so it should be
disabled. The GTK+ 3-based panel provided by IBus is perfectly serviceable in
the interim.
2017-03-20 09:31:05 -05:00
Thomas Tuegel
4837aba1ee Merge pull request #24101 from romildo/fix.lumina
lumina: fix kwindowsystem and oxygen-icons5 attributes
2017-03-20 09:00:25 -05:00
Kristoffer Søholm
f9e8ef7e6d nixos/bluetooth: add extraConfig option (#23427) 2017-03-20 14:28:02 +01:00
Nikolay Amiantov
15d3f8e783 sd-image-armv7l-multiplatform module: enable ODROID-XU3 console 2017-03-20 11:07:04 +03:00
romildo
501d9c7186 lumina: fix kwindowsystem and oxygen-icons5 attributes 2017-03-19 21:46:35 -03:00
Will Dietz
cb73cb9e62 neo4j service: neo4j-wrapper is deprecated, merge into neo4j.conf 2017-03-19 16:56:53 -05:00
Will Dietz
515fc22263 neo4j service: fix package installed into env to match running service 2017-03-19 16:56:52 -05:00
Michael Walker
b29bc8d41c vsftpd: Expose the no_anon_password flag. 2017-03-19 01:53:29 +00:00
Benjamin Staffin
b79c284952
nixos: Use xkbDir consistently so it has an effect 2017-03-18 17:56:38 -04:00
Daiderd Jordan
a48df6fba6 Merge pull request #22508 from matthewbauer/remove-emacs24macport
emacs24macport: remove
2017-03-18 22:19:20 +01:00
Philipp Hausmann
c904e68e53 Remove static uid/gid 2017-03-18 13:54:39 +01:00
Ambroz Bizjak
f80eeb5d85 nixos: Define XCURSOR_PATH environment variable.
In the absence of XCURSOR_PATH, the function XcursorLibraryPath
in libXcursor will return a hardcoded value unsuitable for NixOS.
Some desktops as well as display managers in NixOS currently do
set XCURSOR_PATH, but there are combinations where neither does
(e.g. SDDM+XFCE), resulting in no cursor themes being available.

The new definition if XCURSOR_PATH is effectively the same as what
KDE's startkde currently does.

Fixes issue #21442.
2017-03-18 12:00:23 +01:00
Vladimír Čunát
742b120ddc
Merge branch 'master' into staging
Nontrivial rebuilds from master, again :-/
2017-03-18 11:00:31 +01:00
Will Dietz
63f1a14ae5 neo4j service: increase file limit, per warning emitted at startup (#23961) 2017-03-18 01:03:09 +01:00
Joachim F
9a976c09ba Merge pull request #23963 from dtzWill/feature/irkerd
irker: init at 2017-02-12
2017-03-18 00:35:32 +01:00
Franz Pletz
9536169074
nixos/treewide: remove boolean examples for options
They contain no useful information and increase the length of the
autogenerated options documentation.

See discussion in #18816.
2017-03-17 23:36:19 +01:00
Franz Pletz
00239ce8e9
rmilter/rspamd service: tighten unix socket permissions 2017-03-17 23:01:24 +01:00
Franz Pletz
8ab2d2ee27
rmilter service: support only one socket 2017-03-17 23:00:34 +01:00
Peter Jones
4defb788eb
rmilter service: Fix a couple of bugs
* The module uses `stringSplit` but it should be `splitString`

  * `rmilter` doesn't actually support binding to multiple sockets.
    Therefore, bind to the last one specified if `socketActivation` is
    `false`.

I also believe there is a bug in this module related to systemd
`ListenStream`.  If `socketActivation` is true, Postfix gets
connection timeouts trying to connect to one of the `ListenStream`
inet addresses.  I don't know enough about `ListenStream` passing
connections on to `fd:3` to understand what's going on.

These changes are in production (with `socketActivation = false`) via NixOps.
2017-03-17 20:15:48 +01:00
Thomas Tuegel
a6fce585e4
nixos/fontconfig: set rendering defaults, not overrides 2017-03-17 13:50:10 -05:00
Thomas Tuegel
354ea69ae4
fontconfig-penultimate: init at 0.2
Also provides a NixOS module.
2017-03-17 13:50:05 -05:00
Joachim F
01f8e2161c Merge pull request #23962 from oxij/nixos/tor-sec
nixos: tor: usability and security fixes
2017-03-17 16:14:41 +01:00
Pascal Bach
3728143cbc prometheus-unifi-exporter: init at 0.4.0 2017-03-17 15:41:22 +01:00
Will Dietz
2807d75dca irkerd service: init 2017-03-17 09:16:32 -05:00
Léo Gaspard
66e54f25a1 dhparams module: condition on enable option (#23661)
Hence, the init/cleanup service only runs when the dhparams module is enabled.
2017-03-17 01:56:13 +01:00
Jan Malakhovski
a04782581a nixos: torify: disable by default, add some documentation as of why
This `tsocks` wrapper leaks DNS requests to clearnet, meanwhile Tor comes with
`torsocks` which doesn't.

Previous commits to this file state that all of this still useful somehow.
Assuming that it's true, at least let's not confuse users with two different tools
and don't clash with the `tsocks` binary from nixpkgs by disabling this by default.
2017-03-16 21:06:12 +00:00
Jan Malakhovski
6d25f77a64 nixos: tor: add enableGeoIP 2017-03-16 21:06:12 +00:00
Daiderd Jordan
00ed0f792e Merge pull request #22897 from timor/couchdb-2.0.0
couchdb: add support for version 2.0.0
2017-03-16 22:03:32 +01:00
Philipp Hausmann
ffa0a87774 Remove unused options 2017-03-16 20:51:06 +01:00
Philipp Hausmann
0bd6fdcfc4 Cosmetics 2017-03-16 20:50:10 +01:00
Philipp Hausmann
45d8d6ebeb Add slimserver nixos module 2017-03-16 20:43:09 +01:00
Profpatsch
6da60bb101 modules/mlmmj: fix a typo in listaddress folder 2017-03-16 18:47:11 +01:00
Graham Christensen
e4c0613470 Merge pull request #23674 from c0bw3b/sec/jboss7
JBoss AS: list known vulnerability
2017-03-15 17:33:27 -04:00
Vladimír Čunát
e99bc64552
Merge branch 'master' into staging
More larger rebuilds from master, unfortunately.
2017-03-15 19:09:56 +01:00
Pascal Bach
a8cca7037e prometheus-fritzbox-exporter: init at 1.0 2017-03-15 17:22:36 +01:00
Volth
bcc4c261be lxc: ensure directory /var/lib/lxc/rootfs 2017-03-15 12:42:27 +01:00
Bart Brouns
bb3ef8a95c physlock: fix issue 21935 2017-03-15 11:47:02 +01:00
Benjamin Staffin
98e4c5dd45 Merge pull request #23861 from benley/nixos-manual-launcher
nixos: Add a menu launcher for the NixOS manual
2017-03-15 04:37:16 -04:00
Joachim Fasting
f122f0147b
nixos/dnscrypt-proxy: log resolver list verification failure
Otherwise, the service unit just fails for no discernable
reason.  Verifcation failure is bad so it ought to be easily
discoverable.
2017-03-15 01:13:08 +01:00
Joachim Fasting
de15e7894b
nixos/dnscrypt-proxy: get resolver list from github
The list has disappeared from its ordinary location at
download.dnscrypt.org.
2017-03-15 01:12:46 +01:00
Joachim Fasting
472002f216
nixos/dnscrypt-proxy: remove the resolverList option
This option was initially added to make it easier to use an
up-to-date list, but now that we always use an up-to-date list
from upstream, there's no point to the option.

From now on, you can either use a resolver listed by dnscrypt
upstream or a custom resolver.
2017-03-15 01:12:43 +01:00
Joachim Fasting
540740598e
nixos/dnscrypt-proxy: add example of how to use the cache plugin 2017-03-15 01:12:39 +01:00
Joachim Fasting
719813caf6
nixos/dnscrypt-proxy: replace unimportant options with extraArgs
Removes tcpOnly and ephemeralKeys: reifying them as nixos
options adds little beyond improved discoverability.  Until
17.09 we'll automatically translate these options into extraArgs
for convenience.

Unless reifying an option is necessary for conditional
computation or greatly simplifies configuration/reduces risk of
misconfiguration, it should go into extraArgs instead.
2017-03-15 01:12:37 +01:00
Joachim Fasting
9325c3a616
nixos/dnscrypt-proxy: simplify module logic related to apparmor 2017-03-15 01:12:35 +01:00
Joachim Fasting
83052ef9db
nixos/dnscrypt-proxy: support reload 2017-03-15 01:12:29 +01:00
Franz Pletz
91744f31b0 Merge pull request #23623 from mayflower/fix/users-create-home
nixos/users-groups: chown home on createHome
2017-03-14 23:07:57 +01:00
Bas van Dijk
308c09d41f wordpress: security upgrade: 4.7.2 -> 4.7.3 & other improvements (#23837)
* Moved the wordpress sources derivation to the attribute pkgs.wordpress. This
  makes it easier to override.

* Also introduce the `package` option for the wordpress virtual host config which
  defaults to pkgs.wordpress.

* Also fixed the test in nixos/tests/wordpress.nix.
2017-03-14 16:11:51 +01:00
Benjamin Staffin
638e1b8243 nixos: Add a menu launcher for the NixOS manual 2017-03-14 06:04:43 -04:00
Peter Hoeg
80750f459c Merge pull request #17303 from peterhoeg/iio
iio-sensor-proxy: init at 2.2 and nixos module
2017-03-14 11:16:09 +08:00
Tuomas Tynkkynen
aba0b45b86 Merge remote-tracking branch 'upstream/master' into staging
Conflicts:
      pkgs/development/libraries/qt-5/5.7/qtbase/default.nix
2017-03-14 00:49:22 +02:00
Renaud
72619a86c9 JBoss AS: list known vulnerability
CVE-2015-7501

Warning in JBoss module
2017-03-13 18:45:19 +01:00
Thomas Tuegel
65592837b6
freetype: 2.6.5 -> 2.7.1
The Infinality bytecode interpreter is removed in favor of the new v40 TrueType
interpreter. In the past, the Infinality interpreter provided support for
ClearType-style hinting instructions while the default interpreter (then v35)
provided support only for original TrueType-style instructions. The v40
interpreter corrects this deficiency, so the Infinality interpreter is no longer
necessary.

To understand why the Infinality interpreter is no longer necessary, we should
understand how ClearType differs from TrueType and how the v40 interpreter
works. The following is a summary of information available on the FreeType
website [1] mixed with my own editorializing.

TrueType instructions use horizontal and vertical hints to improve glyph
rendering. Before TrueType, fonts were only vertically hinted; horizontal hints
improved rendering by snapping stems to pixel boundaries. Horizontal hinting is
a risk because it can significantly distort glyph shapes and kerning. Extensive
testing at different resolutions is needed to perfect the TrueType
hints. Microsoft invested significant effort to do this with its "Core fonts for
the Web" project, but few other typefaces have seen this level of attention.

With the advent of subpixel rendering, the effective horizontal resolution of
most displays increased significantly. ClearType eschews horizontal hinting in
favor of horizontal supersampling. Most fonts are designed for the Microsoft
bytecode interpreter, which implements a compatibility mode with
TrueType-style (horizontal and vertical) instructions. However, applying the
full horizontal hints to subpixel-rendered fonts leads to color fringes and
inconsistent stem widths. The Infinality interpreter implements several
techniques to mitigate these problems, going so far as to embed font- and
glyph-specific hacks in the interpreter. On the other hand, the v40 interpreter
ignores the horizontal hinting instructions so that glyphs render as they are
intended to on the Microsoft interpreter. Without the horizontal hints, the
problems of glyph and kerning distortion, color fringes, and inconsistent stem
widths--the problems the Infinality interpreter was created to solve--simply
don't occur in the first place.

There are also security concerns which motivate removing the Infinality patches.
Although there is an updated version of the Infinality interpreter for FreeType
2.7, the lack of a consistent upstream maintainer is a security concern. The
interpreter is a Turing-complete virtual machine which has had security
vulnerabilities in the past. While the default interpreter is used in billions
of devices and is maintained by an active developer, the Infinality interpreter
is neither scrutinized nor maintained. We will probably never know if there are
defects in the Infinality interpreter, and if they were discovered they would
likely never be fixed. I do not think that is an acceptable situtation for a
core library like FreeType.

Dropping the Infinality patches means that font rendering will be less
customizable. I think this is an acceptable trade-off. The Infinality
interpreter made many compromises to mitigate the problems with horizontal
hinting; the main purpose of customization is to tailor these compromises to the
user's preferences. The new interpreter does not have to make these compromises
because it renders fonts as their designers intended, so this level of
customization is not necessary.

The Infinality-associated patches are also removed from cairo. These patches
only set the default rendering options in case they aren't set though
Fontconfig. On NixOS, the rendering options are always set in Fontconfig, so
these patches never actually did anything for us!

The Fontconfig test suite is patched to account for a quirk in the way PCF fonts
are named.

The fontconfig option `hintstyle` is no longer configurable in NixOS. This
option selects the TrueType interpreter; the v40 interpreter is `hintslight` and
the older v35 interpreter is `hintmedium` or `hintfull` (which have actually
always been the same thing). The setting may still be changed through the
`localConf` option or by creating a user Fontconfig file.

Users with HiDPI displays should probably disable hinting and antialiasing: at
best they have no visible effect.

The fontconfig-ultimate settings are still available in NixOS, but they are no
longer the default. They still work, but their main purpose is to set rendering
quirks which are no longer necessary and may actually be
detrimental (e.g. setting `hintfull` for some fonts). Also, the vast array of
font substitutions provided is not an appropriate default; the default setting
should be to give the user the font they asked for.

[1]. https://www.freetype.org/freetype2/docs/subpixel-hinting.html
2017-03-12 17:31:33 -05:00
Jörg Thalheim
9e6fe2e4f2 Merge pull request #23765 from benley/ykpers-duplicate
ykpers: consolidate into yubikey-personalization
2017-03-12 22:26:32 +01:00
Vladimír Čunát
50fadc8b18
cups: split the $lib output
This saves > 10 MB from most closures.
Printing test succeeds on x86_64-linux.
2017-03-12 18:36:30 +01:00
Rodney Lorrimar
f488b1811b
pumpio service: don't keep secrets in nix store
Added extra config options to allow reading passwords from file rather
than the world-readable nix store.

The full config.json file is created at service startup.

Relevant to #18881
2017-03-12 16:01:02 +01:00
Rodney Lorrimar
f1a1490135
pumpio service: adjust upload directory config for 3.0.0
These changes are backwards compatible.
2017-03-12 16:00:57 +01:00
zetok
4ca17dd6c0 gresecurity docs: fix incorrect option (#23789) 2017-03-12 15:05:14 +01:00
Benjamin Staffin
f474f82860 ykpers: consolidate into yubikey-personalization
Looks like this accidentally got packaged twice.
2017-03-11 16:23:00 -05:00
Franz Pletz
323d0fdd5a
phpfpm module: set correct nixos sendmail path 2017-03-11 09:39:12 +01:00
Daiderd Jordan
b52af49d36
virtualisation-xen: fix defaultText interpolation 2017-03-11 00:09:22 +01:00
Joachim Fasting
bb6361b81a
nixos/dnscrypt-proxy: grant daemon access to load plugins 2017-03-10 18:54:54 +01:00
Joachim Fasting
5279ec111f
nixos/dnscrypt-proxy docs: reword section on forwarding
Newer versions of DNSCrypt proxy *can* cache lookups (via
plugin); make the wording more neutral wrt. why one might want
to run the proxy in a forwarding setup.
2017-03-10 18:54:52 +01:00
Joachim Fasting
c0a8a9205b
nixos/dnscrypt-proxy: inline option renamings
In an effort to make the module more self-contained.
2017-03-10 18:54:51 +01:00
Joachim Fasting
563c8e1496
nixos/dnscrypt-proxy: inline top-level binding (cleanup) 2017-03-10 18:54:50 +01:00
Joachim Fasting
c6da2c7c2b
nixos/dnscrypt-proxy: use example.com in example values
It is the canonical example domain after all.
2017-03-10 18:54:44 +01:00
Thomas Tuegel
64b88c3017 Merge branch 'master' into phonon-gstreamer 2017-03-10 07:30:14 -06:00
Thomas Tuegel
edd43351cf
nixos/plasma5: no need to set gstreamer plugin path 2017-03-10 07:26:40 -06:00
Dan Peebles
c390cec122 buildbot NixOS modules: switch to not daemonize
1) The forking behavior of `buildbot start` is temporarily broken for
   mysterious reasons that I'm still looking into
2) Let systemd do the forking: no point in using two different process
   startup wait loops
2017-03-10 00:11:57 -05:00
Thomas Tuegel
e3cb24d1e0 Merge pull request #23503 from ttuegel/fontconfig
Generalize Fontconfig options
2017-03-09 19:29:28 -06:00
Evan Danaher
a09246948c nginx: disallow alias directive on server level; it doesn't work. 2017-03-09 16:54:44 -05:00
Evan Danaher
e7358b192a nginx: Assert that either root or alias is null.
If both are set, nginx won't start.  More error checking is certainly in
order, but this seems like a reasonable start.
2017-03-09 13:02:49 -05:00
Evan Danaher
ff2e2e82cc nginx: Add alias configuration option for hosts and locations.
It's like root, but doesn't keep the prefix.
2017-03-09 13:02:29 -05:00
Dan Peebles
c3939cbcf5 buildbot modules: don't put BB users in nixbld group
The nixbld group belongs to nix-daemon and you really don't want to be
in it. If you are in it, nix-daemon will kill your processes when you
least expect it :)
2017-03-09 11:46:26 -05:00
Gregor Kleen
899fd868ea das_watchdog: fix service type 2017-03-09 16:14:17 +01:00
Orivej Desh
838051e9cd nixos/iso-image: support boot from USB disks 2017-03-09 15:35:30 +02:00
Joachim Fasting
06520c7fb7
nixos/dnscrypt-proxy: indicate update status
Make it easier for the user to tell when the list is updated
and, at their option, see what changed.
2017-03-08 19:07:53 +01:00
Joachim Fasting
5f27abec23
nixos/dnscrypt-proxy: more fs isolation for the updater
It'd be better to do the update as an unprivileged user; for
now, we do our best to minimize the surface available.  We
filter mount syscalls to prevent the process from undoing the fs
isolation.
2017-03-08 19:07:51 +01:00
Joachim Fasting
e72aaa73ea
nixos/dnscrypt-proxy: support updating before nss is up
Resolve download.dnscrypt.org using hostip with a bootstrap
resolver (hard-coded to Google Public DNS for now), to ensure
that we can get an up-to-date resolver list without working name
service lookups. This makes us more robust to the upstream
resolver list getting out of date and other DNS configuration
problems.

We use the curl --resolver switch to allow https cert validation
(we'd need to do --insecure if using just the ip addr). Note
that we don't rely on https for security but it's nice to have
it ...
2017-03-08 19:07:50 +01:00
Joachim Fasting
adf044e1fb
nixos/dnscrypt-proxy: refactoring
Use mkMerge to make the code a little more ergonomic and easier
to follow (to my eyes, anyway ...).  Also take the opportunity
to do some minor cleanups & tweaks, but no functional changes.
2017-03-08 19:07:44 +01:00
Parnell Springmeyer
4c751ced37
security-wrapper: Don't remove the old paths yet as that can create migration pain 2017-03-08 08:57:52 -06:00
Profpatsch
22c265182f networking/bonds: fix examples
After the change of the bonding options, the examples were not quite correct.
The diff is over-the top because the new `let` needs everything indented.

Also add a small docstring to the `networkd` attr in the networking test.
2017-03-08 04:54:17 +01:00
Graham Christensen
9e6ae2f60a Merge pull request #23441 from oxij/pkg/pretty-xen
xen: modular expression
2017-03-07 18:52:40 -05:00
Franz Pletz
9ea35eae7a
nixos/users-groups: chown home on createHome
Fixes #23619.
2017-03-08 00:29:20 +01:00
Daniel Ehlers
0bd211d84f
ddclient: Make verbose logging deactivatable. 2017-03-07 22:03:22 +01:00
Franz Pletz
d7674dabba
phpfpm service: fix phpOptions
Broken due to #23216.
2017-03-07 15:08:55 +01:00
Joachim Fasting
15da23d5c1
nixos/modules: use defaultText/literalExample where applicable
Primarily to fix rendering of default values/examples but also
to avoid unnecessary work.
2017-03-07 14:06:08 +01:00
Joachim Fasting
540163e4a4
search module: add missing types 2017-03-07 14:06:02 +01:00
Tom
9a7bad2c17 networkmanager service: support changing the mac-address (#23464)
Set `networking.networkmanager.wifi.macAddress` or `networking.networkmanager.ethernet.macAddress`
to one of these values to change your macAddress.

* "XX:XX:XX:XX:XX:XX": set the MAC address of the interface.
* "permanent": use the permanent MAC address of the device.
* "preserve": don’t change the MAC address of the device upon activation.
* "random": generate a randomized value upon each connect.
* "stable": generate a stable, hashed MAC address.

See https://blogs.gnome.org/thaller/2016/08/26/mac-address-spoofing-in-networkmanager-1-4-0/ for more information
2017-03-07 03:50:37 +01:00
Graham Christensen
2027f8e74a Merge pull request #23522 from oxij/nixos/mstpd-rstp
nixos: network-interfaces-scripted: don't require mstpd when rstp is off
2017-03-06 20:42:44 -05:00
Graham Christensen
710973e354 Merge pull request #23492 from zarelit/xfce_lockscreen
xfce: add screenLock option
2017-03-06 19:42:47 -05:00
Fernando J Pando
9f062c2c0b buildbot: 0.9.3 -> 0.9.4
- adds jwt
- adds module tests
- master.cfg as path in module
- fix systemd worker config
- builds on darwin
- tested on nixos
2017-03-07 00:45:37 +01:00
Philipp Hausmann
a0f4a720c8 cloud-init module: Replace hard-coded config by option. 2017-03-06 17:36:24 +01:00
Joachim Fasting
f278793fdb
btsync module: remove redundant example
The default value already gives a good example of what values to
put here.
2017-03-06 15:59:23 +01:00
Eelco Dolstra
d72a34311a
Remove nixFallback
This causes unintended schema upgrades, and is no longer needed now
that we have nixos/modules/installer/tools/nix-fallback-paths.nix.
2017-03-06 15:54:50 +01:00
Wei Tang
99013f853a
jenkins-job-builder: allow setting access tokens for reloading 2017-03-06 07:57:01 -05:00
Jörg Thalheim
4487a993b2 Merge pull request #23396 from mayflower/feature/zfs-auto-scrub
zfs.autoScrub service: init
2017-03-06 13:51:25 +01:00
timor
f40b961378 couchdb: add support for version 2.0.0
Version 2.0.0 is installed as a separate package called "couchdb2".
When setting the config option "package" attribute to pkgs.couchdb2, a
corresponding service configuration will be generated.  If a previous
1.6 installation exists, the databases can still be found on the local
port (default: 5986) and can be replicated from there.

Note that single-node or cluster setup still needs to be configured
manually, as described in
http://docs.couchdb.org/en/2.0.0/install/index.html.
2017-03-06 11:42:02 +01:00
Jörg Thalheim
947815f59f
fcron: 3.1.2 -> 3.2.1
fixes #23320 #23413
2017-03-05 22:41:11 +01:00
Jesper Geertsen Jonsson
056e57678d
grsecurity docs: fix syntax and indentation errors
Closes https://github.com/NixOS/nixpkgs/pull/23515
2017-03-05 16:05:43 +01:00
Jan Malakhovski
55996b8daf nixos: network-interfaces-scripted: don't require mstpd when rstp is off 2017-03-05 14:40:59 +00:00
Jan Malakhovski
442b8d49d0 nixos: xen: make packages configurable 2017-03-05 14:01:17 +00:00
Bjørn Forsman
316e7d6764 nixos/nix-daemon: doc: use literalExample
Makes the example more readable by not squashed everything onto one
single line.
2017-03-05 14:07:23 +01:00
Jaka Hudoklin
f5d81ed79b Merge pull request #20904 from offlinehacker/nixos/xserver/xpra
Add xpra display-manager
2017-03-05 01:32:23 +01:00
Thomas Tuegel
cc7c3c6bb8
nixos/plasma5: set GST_PLUGIN_SYSTEM_PATH_1_0 to list of paths 2017-03-04 16:31:22 -06:00
Thomas Tuegel
286b007bd3
nixos/fontconfig: lift some settings out of fontconfig.ultimate 2017-03-04 14:59:24 -06:00
Thomas Tuegel
42cf524f2d
nixos/plasma5: set default fonts for Plasma desktop 2017-03-04 14:59:11 -06:00
David Costa
fc6c50f1b5 xfce: add screenLock option
screenLock option is needed to provide at least one application for
xflock4 to lock the screen
2017-03-04 18:01:02 +01:00
Léo Gaspard
0e2bd7e248 openldap module: fix paths for example includes 2017-03-04 13:30:29 +01:00
Thomas Strobel
b9a7aacef7 improve: modules/virtualisation/qemu-vm.nix
disk image for qemu VM with bootloader:
* remove redundant command
* improve readability
* improve execution speed
* make output more reproducible
2017-03-04 11:31:47 +01:00
Thomas Strobel
0a8d9779c5 fix: "nixos-rebuild build-vm-with-bootloader" 2017-03-03 19:14:20 +01:00
Eelco Dolstra
3971876585
nix-daemon: Remove a bunch of unnecessary environment variables 2017-03-03 16:50:37 +01:00
Eelco Dolstra
3070c88798
Fix incorrect $NIX_BUILD_HOOK on Nix 1.12 2017-03-03 16:50:26 +01:00
Eelco Dolstra
136f77b7b9
nixos-rebuild: Sync /nix/store only
We only care about /nix/store because its contents might be out of
sync with /nix/var/nix/db. Syncing other filesystems might cause
unnecessary delays or hangs (e.g. I encountered a case where an NFS
mount was taking a very long time to sync).
2017-03-03 16:50:25 +01:00
Thomas Tuegel
044c7d091b Merge pull request #23388 from ttuegel/nixos-plasma5
NixOS: Plasma 5 tests and warnings
2017-03-03 09:50:08 -06:00
Thomas Tuegel
d91637c546
nixos-generate-config: rename plasma5 desktop 2017-03-03 07:28:29 -06:00
Thomas Tuegel
8e6bdcc731
nixos: fix renaming warning in graphical profile 2017-03-03 07:27:41 -06:00
Dan Peebles
3f116702cc buildbot-master module: fix overly restrictive option type for masterCfg 2017-03-03 01:33:18 +00:00
Florian Jacob
518e5c09a8 avahi-daemon service: Add option to enable point-to-point interfaces. 2017-03-02 23:52:08 +01:00
Franz Pletz
7566b36259
zfs.autoScrub service: init 2017-03-02 17:13:54 +01:00
Thomas Tuegel
80e883a7c3
iso_graphical: fix warning about Plasma 5 desktop module name 2017-03-02 07:01:34 -06:00
Gregor Kleen
3deb85bc63 locate: fix security.wrappers 2017-03-02 13:41:31 +01:00
Nikolay Amiantov
516a7fc7bd kmscon service: disable systemd-vconsole-setup
cc #22470.
2017-03-01 13:47:34 +03:00
Nikolay Amiantov
2e80b50a7e cura, curaengine: 14.04 -> 2.4.0
Move old Cura to {cura,curaengine}_stable
2017-03-01 02:23:18 +03:00
Susan Potter
251b9ca0e7
nginx service: add commonHttpConfig option 2017-02-28 09:36:56 -06:00
Franz Pletz
ec4ead0bfe
phpfpm service: add target and slice 2017-02-28 00:00:57 +01:00
Franz Pletz
e3d58dae7f
phpfpm service: one service per pool for isolation 2017-02-27 23:38:53 +01:00
Robin Gloster
b7d15edd9e
bump version to 17.10
This will be the Hummingbird release
2017-02-27 20:21:13 +01:00
Dan Peebles
8def08a56c apache-kafka.service: pass in log4j config more explicitly
The implicit behavior of pulling it out of the classpath seemed not
to work properly and could be thrown off by other things on the
classpath also providing the properties file. This guarantees that
our settings stick.
2017-02-27 18:32:12 +00:00
Thomas Tuegel
127bf18a35
extra-cmake-modules: Lift Qt dependency 2017-02-27 11:49:46 -06:00
Thomas Tuegel
f21d4d0015
nixos/plasma5: Rename Plasma 5 desktop
- There is no such thing as KDE 5
2017-02-27 11:49:31 -06:00
Thomas Tuegel
8eb4d2afbc
Remove top-level kde5 attribute
- There is no such thing as KDE 5
2017-02-27 11:49:10 -06:00
Dan Peebles
6018cf4a69 amazon-init.service: fix starting services at startup
We now make it happen later in the boot process so that multi-user
has already activated, so as to not run afoul of the logic in
switch-to-configuration.pl. It's not my favorite solution, but at
least it works. Also added a check to the VM test to catch the failure
so we don't break in future.

Fixes #23121
2017-02-27 16:51:36 +00:00
Franz Pletz
bccac381b2
microcode updates: prepend first in initrd
Prevents crashing the kernel on boot if other blobs are prepended
before the microkernel update image.

Fixes #22674.
2017-02-27 17:12:33 +01:00
Edward Tjörnhammar
fa367c2d02
nixos, dhcpd: make machines assignable 2017-02-27 10:52:21 +01:00
Domen Kožar
c013f9240e Merge pull request #23168 from nlewo/nova-image-refactoring
Nova image refactoring and partition resizing
2017-02-27 10:03:13 +01:00
Fabian Schmitthenner
ae67f060f2 phpfpm: eliminate build at evaluation time
phpfpm currently uses `readFile` to read the php.ini file from the
phpPackage. This causes php to be build at evaluation time.

This eliminates the use of readFile and builds the php.ini at build
time.
2017-02-26 23:35:12 +01:00
Graham Christensen
4f3d06dc7d Merge pull request #23214 from grahamc/mcelog-service
mcelog: init Machine Check Exception Logging Daemon service
2017-02-26 11:42:56 -05:00
Graham Christensen
1430506666
mcelog: init Machine Check Exception Logging Daemon service 2017-02-26 11:42:00 -05:00
obadz
4b6f021251 Revert "lightdm: obbey services.xserver.{window/desktop}Manager.default"
This reverts commit 29caa185a7.

Not clear what the proper thing to do is. cf94cdb59b renders this
question mostly moot. Reverting before 17.03 branch to avoid a repeat
of #19054.
2017-02-26 16:22:21 +00:00
Jörg Thalheim
6c36d9fa20
nftables: make default configuration null
reason:
 - We currently have an open discussion regarding a more modular
   firewall (https://github.com/NixOS/nixpkgs/issues/23181) and
   leaving null makes future extension easier.
 - the current default might not cover all use cases (different ssh port)
   and might break setups, if applied blindly
2017-02-26 16:24:20 +01:00
Jookia
e2c95b46e5
nftables module: Add new module for nftables firewall settings
fixes #18842
2017-02-26 13:41:14 +01:00
Daniel Peebles
2f36be3816 Merge pull request #23190 from primeos/os-release
[RFC] version: Extend /etc/os-release
2017-02-26 00:03:33 -05:00
Michael Weiss
7e97cbe5a4 version: Extend /etc/os-release
- Provide additional link for support and bug reporting.
- Use HTTPS links (related: "The IAB encourages all web servers to
employ TLS to protect their content, and use OCSP stapling to improve
the efficiency and privacy of revocation checking." [0].
- Add VERSION_CODENAME

[0]: https://www.iab.org/documents/correspondence-reports-documents/2017-2/iab-statement-on-ocsp-stapling/
2017-02-25 22:24:34 +01:00
Franz Pletz
26a2822cf0
nginx service: restart instead of stop to reduce downtime
cc #23127
2017-02-25 20:12:37 +01:00
Thomas Tuegel
a1431f35db Merge pull request #23169 from Kendos-Kenlen/kde-hack
kde5: Install default monospace font, Hack
2017-02-25 11:59:33 -06:00
Franz Pletz
3a4dd97c55
nginx module: fix acme if vhost name != serverName
cc #21931 @bobvanderlinden
2017-02-25 08:04:38 +01:00
Peter Hoeg
e4d8cb8dab iio-sensor-proxy: init at 2.2 and nixos module
This PR adds support for ```iio-sensor-proxy``` used by GNOME v3 and
others for reading data from the accelerometer, gps, compass and similar sensors
built into some relatively recent laptops.

Additionally, there is a NixOS module exposed via hardware.sensor.iio
for enabling services, udev rules and dbus services.
2017-02-25 08:46:46 +08:00
Gauthier POGAM--LE MONTAGNER
b65cc5c59e kde5: add hack font dependency (fix #22975) 2017-02-25 00:35:59 +01:00
Antoine Eiche
386c19a224 nova-image: support partition resizing 2017-02-24 22:19:53 +01:00
Antoine Eiche
dec7ecbbbc nova-image: refactoring
The nova image configuration is separated from the image build.
2017-02-24 22:17:52 +01:00
Benjamin Staffin
1c555e772e Merge pull request #23155 from doshitan/fix-prometheus-basic-auth
prometheus service: fix basic auth option
2017-02-24 15:08:35 -05:00
Tanner Doshier
b846ce5243 prometheus service: fix basic auth option
If some configuration is provided, we need to filter out the `_module` key or
else it breaks prometheus.
2017-02-24 13:32:01 -06:00
Ryan Mulligan
41b56b4b8a f2fs module: add crc32 dependency to initrd kernel modules, closes #23093
f2fs.fsck depends on crc32 module being present in the initrd system,
otherwise, if f2fs is used as the root disk, the system is unbootable.
2017-02-24 18:32:50 +01:00
Eelco Dolstra
8e1fa01f3a
nix: 1.11.6 -> 1.11.7 2017-02-24 12:53:53 +01:00
Franz Pletz
4730993ca6 Merge pull request #23109 from dtzWill/update/neo4j
neo4j: update and fix JVM parameters in NixOS module
2017-02-23 19:02:32 +01:00
Franz Pletz
d508ef88f7 Merge pull request #23082 from mayflower/graylog_update
graylog: update + module plugin support
2017-02-23 17:42:57 +01:00
Robin Gloster
940492cef5 Merge pull request #22634 from Ekleog/dhparams
dhparams module: initialize
2017-02-23 17:16:04 +01:00
Franz Pletz
4905c1c54f
prosody service: needs working network connectivity 2017-02-23 16:07:41 +01:00
Franz Pletz
66f553974b
dhcpcd service: fix network-online.target integration
When dhcpcd instead of networkd is used, the network-online.target behaved
the same as network.target, resulting in broken services that need a working
network connectivity when being started.

This commit makes dhcpcd wait for a lease and makes it wanted by
network-online.target. In turn, network-online.target is now wanted by
multi-user.target, so it will be activated at every boot.
2017-02-23 16:07:40 +01:00
Will Dietz
bc15b4222b nixos/neo4j: Update to default JVM options from current release.
The options previously listed here were the defaults back in 2.1.x.
2017-02-23 08:41:29 -06:00
Robin Gloster
274994785d
networking module: remove reference to removed ip-up.target 2017-02-23 15:25:19 +01:00
Tristan Helmich
7420922806 graylog module: add plugin support 2017-02-23 15:21:29 +01:00
Dan Peebles
15c05ad213 google-compute-image.nix: fix evaluation failure 2017-02-22 23:51:57 +00:00
Vladimír Čunát
4509487e82
nixos polkit: fixup setuid wrapper of pkexec
Broken in 628e6a8.  Fixes #23083.
2017-02-22 23:04:21 +01:00
Jörg Thalheim
5b14e91717 Merge pull request #22822 from Mic92/iputils
iputils: 20151218 -> 20161105
2017-02-22 00:37:13 +01:00
Tristan Helmich
1d64f5f41b
libvirt: expose libvirt qemu configuration file
fixes #22823
2017-02-21 19:20:22 +01:00
Robin Gloster
f1e6dc8750
networking.defaultGateway{,6}: fix example 2017-02-21 15:46:00 +01:00
Jörg Thalheim
0338817f62 vnstat: provide full path of "kill" in ExecReload 2017-02-21 09:26:25 +00:00
Nikolay Amiantov
2cc4703a2d wrappers service: make /run/wrappers a mountpoint
Also remove some compatibility code because the directory in question would be
shadowed by a mountpoint anyway.
2017-02-21 12:13:35 +03:00
Peter Hoeg
8e5b630b49 Merge pull request #22264 from peterhoeg/m/modeswitch
usb-modeswitch: 2.2.1 -> 2.5.0 and nixos module
2017-02-21 16:49:04 +08:00
Peter Hoeg
0789a2a4d6 usb-wwan: nixos module 2017-02-21 16:35:27 +08:00
Franz Pletz
05c2c13182 Merge pull request #22715 from phi-gamma/fix-22709-xen-domU
xen: update domU config for pvgrub2
2017-02-21 06:14:12 +01:00
Anders Papitto
3d963c3e8f herbstluftwm module: add configFile option
based on the equivalent for i3
2017-02-21 05:46:13 +01:00
Kevin Cox
da33c8a19d
systemd: Properly escape environment options.
Using toJSON on a string value works because the allowed JSON escape
sequences is almost a subset of the systemd allowed escape sequences.
The only exception is `\/` which JSON allows but systemd doesn't.
Luckily this sequence isn't required and toJSON don't produce it making
the result valid for systemd consumption.

Examples of things that this fixes are environment variables with double
quotes or newlines.
2017-02-20 22:20:13 -05:00
Robin Gloster
2f8aaf0c0a Merge pull request #22941 from mayflower/systemd-tmpfiles
systemd: setup tmpfiles on switching configuration
2017-02-20 23:14:31 +01:00
Ricardo M. Correia
d9ae886946 nixos.openntpd: don't spam systemd journal
Starting `ntpd` with the `-d` option spams the systemd journal.
Instead, let the server fork.
2017-02-20 22:35:51 +01:00
aszlig
dc31a1ea29
systemd-boot: Unlink loader.conf if it exists
Since systemd version 232 the install subcommand of bootctl opens the
loader.conf with fopen() modes "wxe", where the "e" stands for
exclusive, so the call will fail if the file exists.

For installing the boot loader just once this is fine, but if we're
using NIXOS_INSTALL_BOOTLOADER on a systemd where the bootloader is
already present this will fail.

Exactly this is done within the simpleUefiGummiboot installer test,
where nixos-install is called twice and thus the bootloader is also
installed twice, resulting in an error during the fopen call:

Failed to open loader.conf for writing: File exists

Removing the file prior to calling bootctl should fix this.

I've tested this using the installer.simpleUefiGummiboot test and it now
succeeds.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @edolstra, @shlevy, @mic92
Fixes: #22925
2017-02-20 14:54:48 +01:00
aszlig
4daccf208f
systemd-boot: Make sure /etc/machine-id exists
This leads to the following error when trying to install a new machine
where the machine ID wasn't yet initialized during boot:

Failed to get machine did: No such file or directory

In addition this was also detected by the simpleUefiGummiboot installer
test.

So let's generate a fallback machine ID by using
systemd-machine-id-setup before actually running bootctl.

Tested this by running the installer.simpleUefiGummiboot test, it still
fails but not because of the machine ID.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @edolstra, @shlevy, @mic92
Fixes: #22561
2017-02-20 14:54:44 +01:00
Nikolay Amiantov
d8fb60d1d4 Merge pull request #23014 from zraexy/zraexy-bumblebee-pmmethod
bumblebee service: Fix pmMethod bbswitch check
2017-02-20 16:18:45 +03:00
Robin Gloster
12b4556642 Merge pull request #22882 from bjornfor/wireshark
nixos: add programs.wireshark option
2017-02-20 14:03:30 +01:00
zraexy
5abca15f21 bumblebee service: Fix pmMethod bbswitch check
Made useBbswitch work when pmMethod is "auto" and removed invalid pmMethod option "nouveau".
2017-02-19 22:46:47 -09:00
florianjacob
c23c2c50de munin service: listen on IPv6 loopback as well (#23012)
munin service: listen on IPv6 loopback as well
2017-02-20 06:13:48 +01:00
Arian van Putten
252fbbf2d2 mattermost sevice: JoinsNamespaceOf for local pgsql (#22899) 2017-02-20 04:43:04 +01:00
Franz Pletz
60555c7c0a Merge pull request #22969 from symphorien/extrainitrd
grub module: add extraInitrd option
2017-02-20 04:32:48 +01:00
Eelco Dolstra
4b833facf1 Add ca-central-1 AMIs 2017-02-19 23:46:08 +01:00
Nikolay Amiantov
22750b36fd nvidia: support application profiles
Closes #22666.
2017-02-19 19:46:01 +03:00
Joachim F
6dbe55ca68 Merge pull request #20456 from ericsagnes/feat/loaf-dep-1
Use attrsOf in place of loaOf when relevant
2017-02-19 15:49:25 +01:00
Joachim F
ecdfffd9fc Merge pull request #22433 from laMudri/xfwm-option
xfce: make xfwm optional
2017-02-19 15:26:07 +01:00
Symphorien Gibol
9ed2846e04 grub module: add extraInitrd option 2017-02-19 10:50:22 +01:00
Ricardo M. Correia
f78f207f17 nixos.samba: add enableNmbd and enableWinbindd options
This allows for disabling these services, in case they are not needed.
2017-02-18 19:29:06 +03:00
Profpatsch
2b0469c48f modules/mpd: factor out name & mention man 5 mpd.conf 2017-02-18 16:03:16 +01:00
Franz Pletz
313ccd5be3
network-interfaces service: fix typo in bonding options 2017-02-18 15:51:52 +01:00
Cray Elliott
5e0b978eff mwprocapture: init at 1.2.3269 (#22160) 2017-02-18 15:44:31 +01:00
Robin Gloster
4e4161c212
systemd: setup tmpfiles on switching configuration
This fixes systemd.tmpfiles.rules on switching configuration so that
does not only get applied on a fresh boot. This e.g. fixes kubernetes.
2017-02-18 15:04:52 +01:00
Franz Pletz
c4c23f36ca Merge pull request #22727 from mayflower/fix/netdev-master-bindsto
network-interfaces service: fix bindsTo deps for masters
2017-02-18 13:37:50 +01:00
Franz Pletz
741770c99a
network-interface service: tuntap ifs have netdev services 2017-02-18 13:36:37 +01:00
Brice Waegeneire
47c214cc2a fix comments about nixos-hardware-scan
It has been renamed to nixos-generate-config in 3ed4173
2017-02-18 13:29:47 +01:00
Vladimír Čunát
432dba859e
Merge branch 'staging'
A security update of libxml2 is within.
2017-02-18 08:59:29 +01:00
Léo Gaspard
e2c78910d1
dhparams module: initialize 2017-02-18 00:07:03 +01:00
Robin Gloster
bd0d8ed807
programs.mtr: init setcap-wrapper 2017-02-17 20:18:19 +01:00
Nikolay Amiantov
213356c927 activation-script service: add utillinux to path 2017-02-17 21:54:58 +03:00
aszlig
08881b8cbe
taskserver: Remove taskserver from systemPackages
This is deliberate because using the taskd binary to configure
Taskserver has a good chance of messing up permissions.

The nixos-taskserver tool now can manage even manual configurations, so
there really is no need anymore to expose the taskd binary.

If people still want to use the taskd binary at their own risk they can
still add taskserver to systemPackages themselves.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-02-17 19:46:05 +01:00
aszlig
c7bbb93878
taskserver: Pass configuration via command line
Putting an include directive in the configuration file referencing a
store path with the real configuration file has the disavantage that
once we change the real configuration file the store path is also a
different one.

So we would have to replace that include directive with the new
configuration file, which is very much error-prone, because whenever
taskd modifies the configuration file on its own it generates a new one
with *only* the key/value options and without any include directives.

Another problem is that we only added the include directive on the first
initalization, so whenever there is *any* configuration change, it won't
affect anything.

We're now passing all the configuration options via command line,
because taskd treats everything in the form of --<name>=<value> to be a
configuration directive.

This also has the effect that we now no longer have extraConfig, because
configuration isn't a file anymore.

Instead we now have an attribute set that is mapped down to
configuration options.

Unfortunately this isn't so easy with the way taskd is configured,
because there is an option called "server" and also other options like
"server.cert", "server.key" and so on, which do not map very well to
attribute sets.

So we have an exception for the "server" option, which is now called
"server.listen", because it specifies the listening address.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fixes: #22705
2017-02-17 19:45:58 +01:00
aszlig
78fe00da7c
taskserver: Allow helper tool in manual config
The helper tool so far was only intended for use in automatic PKI
handling, but it also is very useful if you have an existing CA.

One of the main advantages is that you don't need to specify the data
directory anymore and the right permissions are also handled as well.

Another advantage is that we now have an uniform management tool for
both automatic and manual config, so the documentation in the NixOS
manual now applies to the manual PKI config as well.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-02-17 19:45:55 +01:00
aszlig
32c2e8f4ae
taskserver/helpertool: Fix error message on export
The error message displays that a specific user doesn't exist in an
organisation, but uses the User object's name attribute to show which
user it was.

This is basically a very stupid chicken and egg problem and easily fixed
by using the user name provided on the command line.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-02-17 19:45:52 +01:00
Michele Guerini Rocco
5231d0ac29 bluetooth module: add option to power up bluetooth controller (#22685) 2017-02-17 19:44:04 +01:00
Jörg Thalheim
fd78ff23f7
replace ping6 with ping
reason: after the upgrade of iputils from 20151218 to 20161105
functionality of ping6 and tracepath6 was merged into ping and tracepath.

Ping is now mostly a drop-in replacment for ping6, except that selecting a
specific interface is done by encoding it into the address (ex.: fe80::1%eth0)
rather then specifing it with the `-I` flag.
2017-02-17 16:04:49 +01:00
Robin Gloster
7ec5faa8a4
programs.wireshark: use setcap wrapper 2017-02-17 15:42:55 +01:00
Bjørn Forsman
8f3e6fdd8c
nixos: add programs.wireshark option
To be able to use Wireshark as an ordinary user, the 'dumpcap' program
must be installed setuid root. This module module simplifies such a
configuration to simply:

  programs.wireshark.enable = true;

The setuid wrapper is available for users in the 'wireshark' group.

Changes v1 -> v2:
  - add "defaultText" to the programs.wireshark.package option (AFAIK,
    that prevents the manual from being needlessly rebuilt when the
    package changes)
2017-02-17 15:42:54 +01:00
Robin Gloster
070825d443
setcapWrapper: add support for setting permissions 2017-02-17 15:42:54 +01:00
Matthew Daiter
336d6cc513 stanchion: remove ssl option 2017-02-17 13:24:51 +01:00
Nikolay Amiantov
8ecd5c4019 Merge pull request #22864 from abbradar/dbus-etc
Redo DBus configuration
2017-02-17 11:47:51 +03:00
Robin Gloster
6e12406e30
Revert "nginx: Format the config file"
This reverts commit e362a3d5c9.

See #22883
2017-02-16 22:45:00 +01:00
Profpatsch
bb797c1390 networking.networkd: adjust autmatic mapping of bonds
Since the bonds interface changed to a lot more possible values we create a
mapping of kernel bond attribute names and values to networkd attributes.
Those match for the most part, but have to transformed slightly.

There is also an assert that unknown options won’t slip through silently.
2017-02-16 21:24:40 +01:00
Profpatsch
9debdaf512 networking.bonds: add support for arbitrary driverOptions
Until now the four attributes available very selectively provided a small
subset, while copying upstream documentation.

We make driver options an arbitrary key-value set and point to kernel
documentation, which is always up-to-date. This way every option can be set.
The four already existing options are deprecated with a warning.
2017-02-16 21:24:40 +01:00
Daniel Peebles
19a9099eb2 Merge pull request #22869 from copumpkin/amazon-init-fix
amazon-init NixOS module: fix (I think) race condition with network
2017-02-16 12:44:49 -05:00
Thomas Tuegel
7c260ad2cc Merge pull request #22813 from benley/pam-kwallet
nixos: add optional pam_kwallet5 integration
2017-02-16 10:20:47 -06:00
Dan Peebles
b172684c17 amazon-init NixOS module: fix (I think) race condition with network
The initialization code is now a systemd service that explicitly
waits for network-online, so the occasional failure I was seeing
because the `nixos-rebuild` couldn't get anything from the binary
cache should stop. I hope!
2017-02-16 16:03:58 +00:00
Nikolay Amiantov
0c81594a29 kbd service: use /dev/tty1 for systemd-vconsole-setup
Fixes #22470
2017-02-16 17:08:14 +03:00
Nikolay Amiantov
109ee2a338 kbd service: use systemd-vconsole-setup even with early setup
This way we have fonts reloaded on switches.
2017-02-16 17:08:13 +03:00
Nikolay Amiantov
ac0cdc1952 dbus service: use makeDBusConf 2017-02-16 15:41:23 +03:00
Benjamin Staffin
463e90273f pam: add optional pam_kwallet5 integration 2017-02-16 02:26:42 -05:00
Kier Davis
5e3a26e07b
Fix typo introduced by #22677 2017-02-15 23:44:11 +00:00
Bjørn Forsman
d4e5bb34b7 nixos/geoip-updater: run as user 'geoip' instead of 'nobody'
That way 'nobody' is prevented from messing with the databases.
2017-02-15 23:25:27 +01:00
Bjørn Forsman
ce0a52f9bf nixos/security.wrappers: improve documentation
* The source attribute is mandatory, not optional
* The program attribute is optional
* Move the info about the mandatory attribute first (most important,
  IMHO)
2017-02-15 20:05:27 +01:00
Profpatsch
91d0260feb modules/filesystems: disallow non-empty fstab fields (#22803)
It was possible to pass empty strings / strings with only separator characters;
this lead to broken fstab formatting.
2017-02-15 13:22:48 +01:00
Franz Pletz
188526da3d
prometheus.blackboxExporter service: add CAP_NET_RAW
The blackbox-exporter for prometheus needs CAP_NET_RAW for sending icmp
probes.
2017-02-15 09:35:27 +01:00
Bjørn Forsman
f9cb2b5640 nixos/security.wrappers: use literalExample in documentation
It's much more readable when the example attrset is pretty printed
instead of written as one line.
2017-02-15 09:08:41 +01:00
Bjørn Forsman
a45821e7a8 nixos/cron: unbreak since new security.wrapper 2017-02-15 08:30:58 +01:00
Bjørn Forsman
aaac02f6c4 nixos/atd: unbreak after new security.wrappers
* convert list -> attrset
* 'atd' doesn't exist, 'at' does
2017-02-15 08:25:59 +01:00
Bjørn Forsman
b1bfe9d3db nixos: hint about security.setuidOwners/Programs -> security.wrappers
Let users know about the option rename / change during nixos-rebuild
with a useful message instead of an error (with no way forward).
2017-02-15 07:25:33 +01:00
Bjørn Forsman
34c1b74421 nixos/virtualbox: unbreak wrt. new security.wrappers
The new option takes an attrset, not a list.
2017-02-15 07:25:33 +01:00
Bjørn Forsman
448acd8e5e nixos: remove remaining reference to setuidPrograms
The option doesn't exist anymore.
2017-02-15 07:25:33 +01:00
Ian-Woo Kim
5ca0f72472 nixos-container: break lines in description of forwardPorts. 2017-02-15 05:12:46 +01:00
Ian-Woo Kim
4f0b663c2e nixos-container: hostPort -> forwardPort and forwardPort is now a list of (protocol,hostPort,containerPort). 2017-02-15 05:12:46 +01:00
Ian-Woo Kim
0bfc631de2 nixos-container: support multiple port forwarding. change type of hostPort from 'string' to 'listOf str' 2017-02-15 05:12:46 +01:00
Ian-Woo Kim
8684285251 nixos-container: introduce hostPort in declarative container options. 2017-02-15 05:12:46 +01:00
Ian-Woo Kim
a238c8a575 nixos-container: add --port option for nixos-container (forward network ports to systemd-nspawn container) 2017-02-15 05:12:46 +01:00
Parnell Springmeyer
1f83f1c878
security-wrapper: Wrap <para> tags in a <note> tag 2017-02-14 21:30:04 -06:00
Graham Christensen
7483ba0932
Revert "nix-daemon: default useSandbox to true"
This reverts commit d0a086770a.
2017-02-14 14:13:39 -05:00
Graham Christensen
3be1388963 Merge pull request #22767 from grahamc/sandbox-by-default
nix-daemon: default useSandbox to true
2017-02-14 13:57:44 -05:00
Eelco Dolstra
14c47bd546 Merge pull request #22758 from dezgeg/pr-nixos-rebuild
nixos-rebuild: Don't rebuild nixos-rebuild when --fast is used
2017-02-14 16:35:43 +01:00
Parnell Springmeyer
69794e333a
Using para tags for manual formatting 2017-02-14 08:53:30 -06:00
Parnell Springmeyer
794b3721bc
Syntax wibble 2017-02-14 08:42:08 -06:00
Parnell Springmeyer
e856d6efe8
Default should be to set owner and group to root on setcap wrappers too 2017-02-14 08:40:12 -06:00
Parnell Springmeyer
c01689f8da
Fixing ref to old-wrappersDir 2017-02-14 08:33:07 -06:00
Parnell Springmeyer
f8b8c353ff
Simplifying the wrapper program derivation 2017-02-14 08:27:40 -06:00
Parnell Springmeyer
fb6d13c01a
Addressing feedback and fixing a bug 2017-02-14 07:38:45 -06:00
Parnell Springmeyer
467bb3f674
/run/wrapper is not a filesystem, no need to skip it 2017-02-14 07:32:24 -06:00
Parnell Springmeyer
ba499e3aa0
Removing unused module option old-wrapperDir 2017-02-14 07:30:21 -06:00
Parnell Springmeyer
a27f35993d
Derp, correctly write the source program's path 2017-02-13 18:28:13 -06:00
Parnell Springmeyer
cca2e11556
Resurrecting the single-wrapper read from sibling .real file behavior 2017-02-13 18:03:06 -06:00
Parnell Springmeyer
9e36a58649
Merging against upstream master 2017-02-13 17:16:28 -06:00
Graham Christensen
d0a086770a
nix-daemon: default useSandbox to true 2017-02-13 18:06:01 -05:00
Rickard Nilsson
cda4a4dcfc nixos/grafana: Don't print password warning if no password has been set 2017-02-13 23:11:40 +01:00
Tuomas Tynkkynen
2000f0941e nixos-rebuild: Don't build nixos-rebuild with --fast 2017-02-13 21:52:32 +02:00
Tuomas Tynkkynen
23fee8bfbd nixos-rebuild: Support passing e.g. '-j8'
Where there is no space between '-j' and the number.
2017-02-13 21:52:30 +02:00
Graham Christensen
1d2548772e Merge pull request #22724 from grahamc/pam-oath-fixup
pam_oath: require OATH and pam_unix credentials to be valid
2017-02-13 09:36:35 -05:00
Robin Gloster
af9f44dd57
grub: fix capitalisation
Missed this occurence while renaming the option
2017-02-13 14:55:36 +01:00
symphorien
0b87efacb1 grub: add grub.useOSProber option (#22558) 2017-02-13 14:53:15 +01:00
Eelco Dolstra
a4ec1841da
VM tests: veryloose -> cache=loose 2017-02-13 12:18:10 +01:00
Rob Vermaas
af3732b6c6
Azure: switch back to qemu 2.2.0 for generating image. Seems to work best.
(cherry picked from commit 2da8a5dac8674501ba9ed10e44650088b466688a)
2017-02-13 09:55:03 +00:00
Rob Vermaas
eff0752dbc
Use default qemu for azure image generation, and use option to enforce sizing of image to be compliant with Azure/HyperV.
(cherry picked from commit e16db5666af987f8a76be82ff219e138e92af442)
2017-02-13 08:54:41 +00:00
Dan Peebles
e63d15f173 ecs-agent NixOS module: enable docker 2017-02-13 04:06:31 +00:00
Dan Peebles
e928cb1c63 ssm-agent NixOS module: init 2017-02-13 04:01:38 +00:00
Franz Pletz
76a3c30471
network-interfaces service: fix bindsTo deps for masters
Previously, netdev units for network interfaces defined in the nixos
configurations would bindTo the systemd device unit of the interface if
not in a container.

In situations where you switch to a new nixos configration with changes
to network-setup.service (like nameservers) and have stacked interfaces
like vlans on a bond, it would fail to propagate restarts to the netdevs
correctly resulting with broken networking. The bond would be present
but no vlan interfaces rendering the machine unreachable.

My fear is that the udev events fail to propagate correctly while a systemd
transaction that is also restarting the triggered netdev service is running.
This commit changes this behaviour so netdev services bindTo other netdev
services if present and otherwise fall back to the previous behaviour.

We also noticed that stacked interfaces would sometimes seemingly be stopped
in the wrong order. For instance in the above example, the bond interface
would be deleted before the vlan interfaces resulting in the vlan interfaces
not being present when their service is being stopped. This would cause the
systemd transaction to fail and thus break networking. Their postStop hooks
are now allowed to fail as we have reached the desired state.
2017-02-13 01:57:25 +01:00
Graham Christensen
84d4e4277c Merge pull request #22723 from benley/fix-sessions-with-sddm
Fix sessions with sddm.
2017-02-12 19:01:15 -05:00
Franz Pletz
f5a82e4714
gitlab service: fix database creation
Providing custom a username and database name was broken. They were
hardcoded to "gitlab".
2017-02-13 00:57:22 +01:00
Graham Christensen
96d767de62
pam_oath: require OATH and pam_unix credentials to be valid 2017-02-12 18:27:11 -05:00
Karn Kallio
8a1fcaf5bd Fix sessions with sddm. 2017-02-12 18:19:20 -05:00
Vladimír Čunát
31eba21d1d
virtualbox: force xorg-server-1.18 for now
This is getting a little hacky, but hopefully it won't break anything.
2017-02-12 21:07:49 +01:00
Philipp Gesang
3dad33227f
xen: update domU config for pvgrub2
fix #22709

Recent pvgrub (from Grub built with “--with-platform=xen”) understands
the Grub2 configuration format. Grub legacy configuration (menu.lst) is
ignored.
2017-02-12 20:53:54 +01:00
georgewhewell
94b28a8072 fix systemd.services.kube-proxy to use correct extraOpts 2017-02-12 15:06:59 +00:00
Bjørn Forsman
824d82fa0f nixos/geoip-updater: new service
The GeoIP databases from MaxMind have no stable URLs and change every
month (or so). Our current method of packaging these database in Nix and
playing catch-up with ever-changing file hashes is a bad idea. For
instance, it makes it impossible to realize old NixOS configurations.

This patch adds a NixOS service that periodically updates the GeoIP
databases in /var/lib/geoip-databases. Moving NixOS modules over can be
done in later patches.

I tried adding MD5 check, but not all databases have them, so i skipped
it. We are downloading over HTTPS though, it should be good. I also
tried adding zip support, but the first zip file I extracted had a
different filename inside than the archive name, which breaks an
assumption in this service, so I skipped that too.

Changes v9 -> v10:
  - Pass "--max-time" to curl to set upper bound on downloads (ensures
    no indefinite hanging if there's problem with networking).
    Timeout for network connectivity check: 60s.
    Timeout for geoip database (each): 15m.

Changes v8 -> v9:
  - Mention the random timer delay in the documentation for the
    'interval' option.

Changes v7 -> v8:
  - Add "RemainAfterExit=true" for the setup service, so it won't be
    restarted needlessly. (Thanks @danbst!)

Changes v6 -> v7:
  - Add --skip-existing flag to geoip-updater, which skips updating
    existing database files. Pass that flag when we run the service on
    boot (and on any NixOS configuration change).
    (IMHO, this is somewhat a workaround for systemd persistent timers
    not being triggered immediately when a timer has never expired
    before. But it does have the nice side effect of ensuring that the
    installed databases always correspond to the configured ones, since
    the service is now always run after configuration changes.)

Changes v5 -> v6:
  - Update database files atomically (per DB)
  - If a database is removed from the configuration, it'll be removed
    from /var/lib/geoip-databases too (on next run).
  - Add NixOS module assertion so that if user inputs non- .gz or .xz
    file there will be a build time error instead of runtime.
  - Run updater as user "nobody" instead of "root".
  - Rename NixOS service from "geoip-databases" to "geoip-updater".
  - Drop RemainAfterExit, or else the timer won't trigger the unit.
  - Bring back "curl --fail", or else we won't catch and log curl
    failures.

Changes v4 -> v5:
  - Add "GeoLite2-City.mmdb.gz" to default database list.

Changes v3 -> v4:
  - Remove unneeded geoip-updater-setup.service after adding
    'wantedBy = [ "multi-user.target" ]' directly to
    geoip-updater.service
  - Drop unneeded "Service" name from service descriptions.

Changes v2 -> v3:
  - Network may be down when starting from a cold boot, so try a few
    times. Possibly, if using systemd-networkd, it'll pass on the first
    try. But with default DHCP on NixOS, the service is started before
    hostnames can be resolved and thus we need a few extra seconds.
  - Add error handling and mark service as failed if fatal error.
  - Add proper syslog log levels.
  - Add RandomizedDelaySec=3600 to the timer to not put high load on the
    MaxMind servers. Suggested by @Mic92.
  - Set RemainAfterExit on geoip-updater.service instead of
    geoip-updater-setup.service. (The latter is only a proxy that pulls
    in the former service).

Changes v1 -> v2:
From Данило Глинський (Danylo Hlynskyi) <abcz2.uprola@gmail.com>:
  nixos/geoip-databases: add `databases` option and fix initial setup

  There were two great issues when using this service:
  - When you just enable service, databases aren't downloaded, they are
    downloaded when timer triggers. Fixed this with automatic download on
    first system activation.
  - When there is no internet, updater outputs nothing to logs, which is
    IMO misbehavior. Fixed this with removing `--fail` option, better be
    explicit here.
2017-02-12 15:07:34 +01:00
Tuomas Tynkkynen
9e04b57dde nixos top-level: Add 'dtbs' symlink when kernel uses device trees
Currently e.g. extlinux-conf-builder.sh uses
`readlink -m "$toplevel/kernel/../dtbs"` to figure out the directory.
That is obscenely ugly.
2017-02-12 15:47:49 +02:00
Graham Christensen
4f34e030a5 Merge pull request #22677 from grahamc/drop-kdm-kde4-modules
Drop kdm and kde4 modules
2017-02-12 08:36:33 -05:00
Ricardo M. Correia
123cbd40c2 raspberryPi boot loader: don't remove xx-initrd files
The Raspberry Pi boot loader was deleting all xx-initrd text files
(which simply contain the path to the actual initrd files) just after
having created them. The code was actually trying to delete real,
obsolete initrd files, which are named <hash>-initrd-initrd (after path
cleaning), but the glob was catching the other files as well.
2017-02-12 02:48:57 +02:00
Ricardo M. Correia
c19b17d14f raspberryPi boot loader: fix booting Raspberry Pi 3
The Raspberry Pi 3 seems to need the .DTB file when booting the kernel,
so we must copy it to /boot when installing a new kernel.
2017-02-12 02:48:57 +02:00
Graham Christensen
b1a05a0865
nixos: drop references to kde4
Excluding modules/programs/environment.nix for PATHand QT_PLUGIN_PATH to allow the programs to continue running.
2017-02-11 14:01:13 -05:00
Graham Christensen
3cec7d10df
kdm: drop service 2017-02-11 13:55:09 -05:00
Graham Christensen
c09004fba0 Merge pull request #22642 from grahamc/kde4-deprecate
kde4, kdm: mark services as deprecated
2017-02-11 10:17:15 -05:00
Tuomas Tynkkynen
607be4d88e sd-image-*: Copy all RPi firmware files
Turns out all variants of start.elf and fixup.dat are needed (depending
on what's in config.txt). I was under the mistaken impression that you
were supposed to rename one of the variants to switch using them, but
nope.
2017-02-11 12:23:16 +02:00
Franz Pletz
3fd44e2912
network-interfaces service: add metric option for defaultGateways 2017-02-11 04:53:56 +01:00
davidak
d4766e789b caddy: set file descriptor limit to 8192, fixes #22454
the value is recommended for production use
a warning is produced when not set
2017-02-11 01:44:29 +01:00
Graham Christensen
564e0c120b
kde4, kdm: mark services as deprecated 2017-02-10 17:35:52 -05:00
Profpatsch
ed8a0d8e5e modules/searx: add package option (#22636)
The user should be able to specify a patched version of searx.
2017-02-10 22:44:10 +01:00
Eelco Dolstra
1b1138d3e7 Merge pull request #22610 from grahamc/switch-to-kde5-by-default
nixos: update default cases from KDM/KDE4 to SDDM/KDE5
2017-02-10 22:06:21 +01:00
Nikolay Amiantov
442b4d65c3 Merge pull request #22304 from abbradar/nvidia
Refactor NVidia drivers
2017-02-10 23:53:34 +03:00
Dan Peebles
3809938208 ecs-agent module: remove debug print
Whoops :)
2017-02-10 15:16:17 -05:00
Tuomas Tynkkynen
a14ef4ad52 open-vm-tools: 10.0.7 -> 10.1.0
Also add an option to disable all the X11 stuff.
2017-02-10 20:12:00 +02:00
Dan Peebles
a0ebb1497f ecs-agent NixOS module: init
A very simple skeleton for now that doesn't attempt to model any of
the agent configuration, but we can grow it later. Tested and works
on an EC2 instance with ECS.
2017-02-10 05:37:38 +00:00
Graham Christensen
b12564cc1b
nixos: update default cases from KDM/KDE4 to SDDM/KDE5 2017-02-09 21:52:00 -05:00
afranchuk
a5e041ac08 libreswan service: make EnvironmentFile optional (#22591)
Recent versions of libreswan seem to omit this file, but it may be added/changed in the future. It is silly to have the service fail because a file is missing that only enriches the environment.
2017-02-10 00:53:44 +01:00
Joachim F
ca8fb930b1 Merge pull request #22356 from Ekleog/redsocks
Redsocks
2017-02-09 22:39:43 +01:00
Léo Gaspard
7a32b96697 redsocks module: initialize
redsocks module: use separate user for redsocks daemon
2017-02-09 18:01:14 +01:00
Daniel Peebles
7439fe083f Merge pull request #22297 from nand0p/buildbot-0.9.3
buildbot: 0.9.0.post1 -> 0.9.3
2017-02-09 11:15:03 -05:00
Franz Pletz
65a1762a9b
nginx module: make acme group overrideable easily 2017-02-08 23:50:59 +01:00
Nikolay Amiantov
5ff9a2a2cb kbd service: don't restart systemd-vconsole-setup
Fixes #22470. Also remove non-relevant comment (we don't deviate from upstream
systemd unit anymore).
2017-02-08 21:50:33 +03:00
Nikolay Amiantov
6f7811143d systemd service: don't install systemd-hwdb-update 2017-02-08 21:42:07 +03:00
Andrew Cann
3082647e74 trezord: init at 1.2.0 (#22054) 2017-02-08 17:18:22 +01:00
Graham Christensen
7db1f727f3
moodle: Remove due to continued security issues. 2017-02-08 09:10:45 -05:00
Nikolay Amiantov
2fd2fcf54d linuxPackages.nvidia_x11: refactor, build more from source
* Use libglvnd;
* Compile nvidia-settings, nvidia-persistenced from source;
* Generalize builder.
2017-02-08 16:57:46 +03:00
Antoine Eiche
9d30099b7f nixos/systemd: set r-x group permissions on /var/log/journal
This allows services such as systemd-journal-gateway to access the
systemd journal.

Closes #22288
2017-02-08 16:06:14 +03:00
Franz Pletz
626540e32e Merge pull request #22524 from wizeman/u/chrony-impr
nixos.chrony: add extraFlags config option
2017-02-07 21:50:58 +01:00
Vladimír Čunát
ce9d30e734
Merge #22241: amdgpu-pro: 16.50 -> 16.60 2017-02-07 20:49:58 +01:00
Peter Simons
bfd7fe8ba5 nixos: fix taskserver module to evaluate properly when keys are managed manually 2017-02-07 18:35:41 +01:00
Ricardo M. Correia
9293f86bf2 nixos.chrony: remove generatecommandkey option
It's deprecated and no longer used.
2017-02-07 18:01:58 +01:00
Ricardo M. Correia
e3fce56047 nixos.chrony: add extraFlags config option 2017-02-07 18:01:57 +01:00
Jörg Thalheim
3aff6c07ab Merge pull request #22518 from wizeman/u/fix-chrony-conf
nixos.chrony: pass config file directly to daemon
2017-02-07 17:17:17 +01:00
Fernando J Pando
34b5c9a4de buildbot: 0.9.0.post1 -> 0.9.3
- Fixes unneeded patching
- Adds worker to build inputs now needed for tests
- Replaces enableworker option with worker configuration module
- Openssh required for tests
- Fixes worker hardcoded paths
- Tested on Nixos Unstable
2017-02-07 11:14:42 -05:00
Svein Ove Aas
e362a3d5c9 nginx: Format the config file 2017-02-07 16:19:11 +01:00