Commit Graph

22826 Commits

Author SHA1 Message Date
Maximilian Bosch
e55554491d
Merge pull request #133587 from TredwellGit/linux_5_12
linux_5_12: remove
2021-08-16 11:08:42 +02:00
misuzu
6802eb4241 nixos/syncoid: add global and per-dataset permissions options 2021-08-16 10:14:05 +03:00
Robert Hensing
1f20a1097d treewide: runCommandNoCCLocal -> runCommandLocal
It has always been a synonym.
2021-08-15 17:36:41 +02:00
Robert Hensing
fbafeb7ad5 treewide: runCommandNoCC -> runCommand
This has been synonymous for ~5y.
2021-08-15 17:36:41 +02:00
Ruby Iris Juric
035dcc0e7e
nixos/nginx: fix typo in listenAdresses 2021-08-15 20:51:09 +10:00
rnhmjoj
d857340c8e
nixos/installer: simplify and document wifi setup
The wpa_supplicant service in the NixOS installer is unusable because
the control socket is disabled and /etc/wpa_supplicant.conf ignored.

The manual currently recommends manually starting the daemon and using
wpa_passphrase, but this requires figuring out the interface name,
driver and only works for WPA2 personal networks.

By enabling the control socket, instead, a user can configure the
network via wpa_cli (or wpa_gui in the graphical installer), which
support more advanced network configurations.
2021-08-15 12:08:32 +02:00
Anderson Torres
5605b561ce
Merge pull request #109302 from SrTobi-Forks/tobias/grub-savedefault
nixos/grub: implements GRUB_SAVEDEFAULT feature
2021-08-14 10:35:16 -03:00
Aaron Andersen
cf17e439bc
Merge pull request #133671 from jlesquembre/caddy
nixos/caddy: update ca option
2021-08-14 08:53:45 -04:00
Robert Scott
dca4f32819 graphene-hardened-malloc: 2 -> 8
significantly overhaul tests to cover build-time-linking and
LD_PRELOAD use, simplifying the hardened nixos test to allow
it to reuse this test setup.
2021-08-14 11:52:11 +01:00
Andreas Rammhold
6e1421013a
paperless: remove package & module as it has been superseded by paperless-ng
The paperless project has moved on to paperless-ng and the original
paperless package in Nixpkgs has stopped working recently (due to
version incompatibility with the providede Django package).

Instead of investing more time into the old module we should migrate all
users to the new module instead.
2021-08-14 10:10:44 +02:00
Flakebi
95f2dc650d
paperless-ng: init at 1.4.5 2021-08-14 10:10:43 +02:00
Bernardo Meurer
c934bb6771
nixos/hqplayerd: don't add config to restartTriggers when it doesn't exist
Previously when the use didn't set `hqplayer.config`, we would still
attempt to reference the config file in the restartTriggers, causing an
error.
2021-08-13 15:16:21 -07:00
Stig Palmquist
5e13c58f78 nixos/mod_perl: add test 2021-08-13 21:03:15 +02:00
Alexandru Scvortov
6c38bb6d5d kubernetes: fix breakage introduced by upgrade to 1.22 2021-08-13 17:55:03 +01:00
Maximilian Bosch
1ba3f7927f
nixos/testing: only create nixos-run-vms for nixos-build-vms(8)
This is the case when the test-script is empty. `nixos-build-vms(8)` is
primarily supposed to be used as tool to test changes or to reproduce
bugs (IMHO) where "just spinning up a few VMs" is the primary use-case.

In the ongoing discussion about these changes[1] it was suggested to
only expose it when needed (i.e. in the case I described above) to keep
the API surface as slim as possible.

[1] https://github.com/NixOS/nixpkgs/pull/133675#discussion_r688112485
2021-08-13 17:39:49 +02:00
edef
9451a23e9f
Merge pull request #130265 from liclac/gce-image-compression-level
google-compute-image: Add a setting for GZIP compression level
2021-08-13 14:31:08 +00:00
Maciej Krüger
03ad23df49
Merge pull request #133585 from mkg20001/fc-nginx-hash 2021-08-13 16:19:34 +02:00
Michele Guerini Rocco
95c7f7ed58
Merge pull request #118583 from rnhmjoj/roaming
nixos/wireless: add options for better roaming
2021-08-13 11:02:15 +02:00
rnhmjoj
0d082b464d
nixos/wireless: add rnhmjoj as maintainer 2021-08-13 10:16:22 +02:00
rnhmjoj
704f33c888
nixos/wireless: add one service per interface
This sets up a different systemd service for each interface. This way
each wpa_supplicant instance waits for his inteface to become ready
using the respective device unit, and that only. The configuration file
is still shared between all instances, though.

This closes a longstanding "fixme" from cbfba81.
2021-08-13 10:16:22 +02:00
Maciej Krüger
934698a378
nixos/nginx: make serverNamesHash{Bucket,Max}Size configurable 2021-08-13 07:27:39 +02:00
Artturi
bb03a951c9
Merge pull request #116290 from aaronjanse/mar2021-hidpi
nixos/hidpi: add xserver dpi
2021-08-13 01:50:36 +03:00
Maximilian Bosch
e1ec5acd31
nixos/test-driver: start interactive mode if testScript is empty
This is relevant for `nixos-build-vms(8)` which doesn't have a
test-script. In that case it's more intuitive to directly go into the
interactive mode which is IMHO more intuitive.
2021-08-12 23:01:03 +02:00
Maximilian Bosch
260d9cc7e1
nixos/testing: re-add nixos-run-vms script
Originally removed in 926fb93968. This
one is actually quite useful for `nixos-build-vms(8)`.
2021-08-12 22:50:29 +02:00
José Luis Lafuente
679d54dcb3
nixos/caddy: update ca option
The generated json configuration returns this warning:
the 'issuer' field is deprecated and will be removed in the future; use 'issuers' instead

Updated the config to use "issuers" instead of "issuer"

Also, now it's possible to set the ca option null to not inject
automatically any ca. This is useful if you don't want to generate any
certificates or if you want to define a more fine-graned ca config
manually (e.g.: use different ca per domain)
2021-08-12 22:02:12 +02:00
Artturi
17265bc319
Merge pull request #133622 from erikarvstedt/fix-recursive-doas
nixos/doas: fix recursive calls to doas
2021-08-12 22:39:24 +03:00
Bernardo Meurer
d11ed5661e
Merge pull request #133603 from lovesegfault/hqplayerd-settings
nixos/hqplayerd: allow configuration from Nix
2021-08-12 19:30:23 +00:00
ajs124
ce278bf9d9
Merge pull request #131537 from helsinki-systems/upd/varnish
varnish: update & fix
2021-08-12 19:46:38 +02:00
ajs124
586ca51a78 varnishPackages: update default, because we dropped 6.3.x 2021-08-12 19:10:11 +02:00
Sandro
991eaaa024
Merge pull request #133607 from SuperSandro2000/SuperSandro2000-patch-1 2021-08-12 18:18:48 +02:00
Erik Arvstedt
781ab443c2
nixos/doas: fix recursive calls to doas
Previously, for processes launched by doas the unwrapped doas binary preceded the
setuid-wrapped doas binary in PATH.

This caused error `doas: not installed setuid` when running doas from
processes launched by doas.

doas seems to short-circuit the PATH lookup when called like
`doas -u myuser doas -u myuser ...` so the error doesn't appear in this case.
2021-08-12 14:40:22 +02:00
Maciej Krüger
5d73f669a8
Merge pull request #131962 from mkg20001/fc-nginx 2021-08-12 14:07:48 +02:00
Sandro
0a31b7df57
nixos/ssh: cleanup UseDNS setting 2021-08-12 12:13:10 +02:00
Bernardo Meurer
e5aa940305
nixos/hqplayerd: allow configuration from Nix 2021-08-12 02:37:38 -07:00
Bernardo Meurer
b43049dbd7
nixos/hqplayerd: also open controller port 2021-08-12 02:36:42 -07:00
rnhmjoj
bef963963a
nixos/wireless: add options for better roaming
- Add an option to automatically launch a scan when the
signal of the current network is low

- Enable 802.11r (fast access point transition) by default for all
protected networks
2021-08-12 10:11:51 +02:00
rnhmjoj
33372e8b75
nixos/wireless: generate pretty configuration
Turns this mess

    ctrl_interface=DIR=/run/wpa_supplicant GROUP=wheel
    update_config=1

    network={
      ssid="cool-network"

      psk="ciao"

    }

    network={
      ssid="fancy-network"

      eap=PEAP
    identity="user@example.com"
    password="secret"

    }

    network={
      ssid="free-network"

      key_mgmt=NONE

    }

    network={
      ssid="raw-network"

      psk=fafafa

    }

into something more human readable:

    network={
      ssid="cool-network"
      psk="ciao"
    }

    network={
      ssid="fancy-network"
      eap=PEAP
      identity="user@example.com"
      password="secret"
    }

    network={
      ssid="free-network"
      key_mgmt=NONE
    }

    network={
      ssid="raw-network"
      psk=fafafa
    }

    ctrl_interface=/run/wpa_supplicant
    ctrl_interface_group=wheel
    update_config=1
2021-08-12 10:11:51 +02:00
Bernardo Meurer
7c122d687b
nixos/hqplayerd: sort options 2021-08-12 00:37:36 -07:00
TredwellGit
957f0485da linux_5_12: remove
https://lwn.net/ml/linux-kernel/1626791065147152@kroah.com/
2021-08-12 05:30:46 +00:00
Artturi
bf7caecbf4
Merge pull request #133204 from j0hax/display-manager-start
nixos/xserver: fix a display-manager race condition
2021-08-12 03:36:48 +03:00
Artturi
34f276d133
Merge pull request #133304 from Artturin/gdmfix
nixos/gdm: disable the gdm services as it is redundant
2021-08-12 03:32:28 +03:00
Johannes Arnold
358ab44a45 nixos/xserver: fix a display-manager race condition 2021-08-12 03:17:38 +03:00
Timothy DeHerrera
90016afdb1
Merge pull request #133557 from SuperSandro2000/SuperSandro2000-patch-1
nixos/ssh: cleanup X11Forwarding setting
2021-08-11 17:18:48 -06:00
Sandro
cbf6bbac91
nixos/ssh: cleanup X11Forwarding setting 2021-08-12 01:00:50 +02:00
Martin Weinelt
41eb076ed8
Merge pull request #127595 from rnhmjoj/wpa-auto
nixos/wireless: use udev to wait for interfaces
2021-08-12 00:49:33 +02:00
rnhmjoj
99e8af51b2
nixos/wireless: use udev to wait for interfaces
I may have finally found a clean solution to the issues[1][2][3] with
the automatic discovery of wireless network interfaces.

[1]: https://github.com/NixOS/nixpkgs/issues/101963
[2]: https://github.com/NixOS/nixpkgs/issues/23196
[3]: https://github.com/NixOS/nixpkgs/pull/125917#issuecomment-856000426

Currently the start script fails right away if no interface is available
by the time it's running, possibly leaving the system without network.
This happens when running a little early in the boot. A solution is to
instead wait for at least one interface to appear before scanning the
/sys/class/net/ directory. This is done here by listening for the right
udev events (from the net/wlan subsystem) using the `udevadm monitor`
command and grep to match its output.

This methods guarantees the availability of at least one interface to
wpa_supplicant, but won't add additional interfaces once it has started.
However, if the current interface is lost, say unplugged, the service is
automatically stopped and will be restarted as soon as a one (not
necessarily the same) is detected. It would be possible make this fully
dynamic by running another service that continously listen for udev
events and manages the main wpa_supplicant daemon, but this is probably
overkill.

I tested the following cases:

  - one interface, starting at boot, w/o predictable naming scheme
  - two interfaces, starting at boot (intel wireless and a usb adapter),
    w/o predictable naming scheme
  - one interface after the system booted, w/o predictable naming scheme
  - two interfaces after the system booted, w/o predictable naming scheme
  - unplugging and plugging back the current interface
2021-08-12 00:31:06 +02:00
Sandro
2e4b2ad74b
Merge pull request #126750 from d-xo/erigon-2021-06-03 2021-08-11 13:30:51 +02:00
Sandro
3e80403848
Merge pull request #133436 from nagy/port-types
treewide: Port type adaptations
2021-08-11 10:54:27 +02:00
Emery Hemingway
0ac49d7c7b nixos: rewrite uhub module
* Support for hosting multiple hubs
* Using "settings" style configuration
* Remove "uhub" user, use DynamicUser
* Configuration reloading
2021-08-11 09:51:23 +02:00
DavHau
df0f76b39f cryptpad: add test for nixos module 2021-08-11 11:04:39 +09:00
Daniel Nagy
79a86e7ef5
treewide: Port type adaptations 2021-08-11 00:45:08 +02:00
Pascal Bach
1c54ce56ab nixos/minio: add release notes 2021-08-10 22:37:30 +02:00
Pascal Bach
3417f18f96 nixos/minio: allow configuring console port 2021-08-10 22:37:30 +02:00
Sandro
6df7b8f398
Merge pull request #133389 from SuperSandro2000/cleanup 2021-08-10 17:16:34 +02:00
Sandro Jäckel
4477421b05
changelog: re-add by accident deleted sections 2021-08-10 16:26:18 +02:00
Vladimír Čunát
c0097aa84a
nixos/tests: unbreak the tested job
I expect it suffices that the channel only blocks on one firefox ESR
test - the one for the default ESR.  I didn't want to have the
information about the default in two places, so either of the tests will
be evaluated twice (but to the same *.drv I hope).
2021-08-10 16:15:57 +02:00
Benjamin Asbach
86296623c6 isso: added NixOS module to configure isso in NixOS 2021-08-09 17:42:54 -06:00
Benjamin Asbach
c1a7bbc38f isso: added a test to verify that the server is able to start and a generated javascript file is available 2021-08-09 17:41:35 -06:00
Martin Weinelt
afb0e73ebc firefox-esr-91: init at 91.0esr 2021-08-10 07:43:50 +09:00
Artturin
47f6591706 nixos/gdm: disable the gdm services as it is redundant
and causes issues
2021-08-10 01:43:38 +03:00
Pascal Bach
37d93c80c1
Merge pull request #133174 from symphorien/nagios-alias
nixos/tests/nagios.nix: fix eval
2021-08-09 23:22:55 +02:00
Félix Baylac-Jacqué
7b554c9477 nixosTests.pleroma: increase server memory size
The server VM machine is sometimes OOMing, making the test flaky.
Increasing the memory size to 512MB fixes the issue.
2021-08-09 21:30:42 +02:00
Félix Baylac-Jacqué
885ab9286e nixosTests.pleroma: increase certificate validity duration
Analogous to 6325d15e90.

The test certificate expiration date was set to the default 30 days.
This certificate is generated through its own derivation. As with
every derivation, it gets cached by cache.nixos.org once we build it.

In practice, we rebuild this derivation only if one of its input
changes. The only inputs here being openssl and stdenv.

While it's not an issue on the unstable branches, it can be
problematic on a stable release: the test will fail after 30 days.

Extending the certificate lifespan from 1 month to 100 years to prevent
it from getting expired while being cached.
2021-08-09 21:30:42 +02:00
Ryan Mulligan
33cdc784e8
Merge pull request #131545 from NickCao/influxdb2
nixos/influxdb2: init
2021-08-09 10:34:53 -07:00
Doron Behar
3d72b0b6b0
Merge pull request #114241 from sorki/tests/cntr 2021-08-09 05:40:37 +00:00
Martin Weinelt
b00dd3ac1f
nixos/tests/prometheus-exporters/kea: drop enable option
There is no generic services.kea.enable option. Instead kea consists of
four daemons (dhcp4, dhcp6, ddns, ctrlagent) that can be enabled
individually. In this test we're just looking at dhcp6.
2021-08-09 01:49:54 +02:00
David Terry
a74eaeba5a
erigon: 2021.05.02 -> 2021.08.01 2021-08-08 21:22:21 +02:00
Sandro
c9e66e9d45
Merge pull request #111442 from helsinki-systems/wakeonlan
nixos/wakeonlan: add types
2021-08-08 20:51:27 +02:00
David Terry
c1186b572f
maintainers: xwvvvvwx -> d-xo 2021-08-08 19:11:45 +02:00
Guillaume Girol
f626a23cd3
Merge pull request #130522 from Mic92/polkit
nixos/polkit: put polkituser into polkituser group
2021-08-08 15:09:15 +00:00
Guillaume Girol
71154a8a8a
Merge pull request #130519 from Mic92/journald
nixos/journald: don't set nogroup
2021-08-08 15:02:31 +00:00
Martin Weinelt
23e60ba325
Merge pull request #127606 from vincentbernat/fix/nginx-override-ssl-certs
nginx: allow overriding SSL trusted certificates when using ACME
2021-08-08 16:43:27 +02:00
Guillaume Girol
27cf2a42f2
Merge pull request #132872 from wentasah/nullmailer-failed-queue
nixos/nullmailer: Create "failed" directory
2021-08-08 14:40:29 +00:00
Nick Cao
5c2478ba3c
nixos/influxdb2: init 2021-08-08 22:39:57 +08:00
Guillaume Girol
25b4e3c741
Merge pull request #133098 from erdnaxe/nitter-hardening
nixos/nitter: systemd unit hardening
2021-08-08 14:33:23 +00:00
Artturi
c10ded1bb2
Merge pull request #131966 from ArctarusLimited/fix/containerd-restart
nixos/virtualisation/containerd: do not wipe runtime directory on restart or stop
2021-08-08 17:21:30 +03:00
Vincent Bernat
85209382c1 nginx: allow overriding SSL trusted certificates when using ACME
Some ACME providers (like Buypass) are using a different certificate
to sign OCSP responses than for server certificates. Therefore,
sslTrustedCertificate should be provided by the user and we need to
allow that.
2021-08-08 16:07:11 +02:00
Martin Weinelt
f49b03c40b
Merge pull request #123258 from mweinelt/acme-hardening 2021-08-08 15:50:24 +02:00
Martin Weinelt
a5c6a0006a
Merge pull request #130521 from Mic92/tinc
nixos/tinc: don't run as nogroup
2021-08-08 15:39:42 +02:00
Alexandre Iooss
2e8e8f2c92
nixos/nitter: test with CAP_NET_BIND_SERVICE 2021-08-08 15:29:33 +02:00
Alexandre Iooss
9898f7e072
nixos/nitter: systemd unit hardening 2021-08-08 15:28:27 +02:00
Sandro
b739a14b37
Merge pull request #121906 from ymarkus/nixos-mullvad
nixos/mullvad-vpn: fix firewall issues & remove xfix as maintainer
2021-08-08 15:03:26 +02:00
Martin Weinelt
611bc7c23b
Merge pull request #111692 from lopsided98/chrony-initstepslew-types
nixos/chrony: split the initstepslew attrset into options
2021-08-08 15:03:06 +02:00
Guillaume Girol
582a9c13b5 nixos/tests/nagios.nix: fix eval 2021-08-08 12:00:00 +00:00
erdnaxe
7a0c6cdd39
nixos/miniflux: systemd unit hardening (#133123) 2021-08-08 13:58:30 +02:00
lewo
7aa78642c5
Merge pull request #125979 from blaggacao/nixos-test-ref/03-normalse-the-python-entrypoint
nixos/test-driver: normalize the python entrypoint
2021-08-08 10:24:47 +02:00
Sandro
7f9530c7c2
Merge pull request #133083 from polykernel/yambar-patch-1 2021-08-08 06:51:26 +02:00
polykernel
bc520477f4 yambar: document breaking changes
* Previously, both the xorg and wayland backend were built into the yambar
  package. The refactor breaks up each backends to its separate, with xorg
  being the default. Thus yambar users on wayland should switch to the
  yambar-wayland package.
2021-08-08 00:05:40 -04:00
Zane van Iperen
99d8d553da nixos/gitea: init/migrate db in startup script 2021-08-08 12:48:15 +09:00
Rouven Czerwinski
06667df72b
nixos/etc: use runCommandLocal (#133037)
Instead of setting preferLocalBuild & allowSubstitutes explicitly, use
runCommandLocal which sets the same options.
2021-08-07 14:56:21 -04:00
Martin Weinelt
4704dc2f1b
Merge pull request #130625 from rski/openrazer 2021-08-07 15:32:04 +02:00
Pascal Bach
463be7303e
Merge pull request #118855 from bachp/unifi-harden
nixos/unifi: harden service
2021-08-07 14:48:25 +02:00
Domen Kožar
2904cd7521
Merge pull request #132883 from Kranzes/bump-pipewire
pipewire: 0.3.32 -> 0.3.33
2021-08-07 12:47:25 +02:00
Sandro
53947a60c1
Merge pull request #132735 from ivan/victoriametrics-panic
nixos/victoriametrics: set LimitNOFILE=1048576 to fix panic and restart loop
2021-08-07 12:34:31 +02:00
Sandro
3384abd78a
Merge pull request #127711 from eadwu/nvidia_x11/127693 2021-08-07 12:24:35 +02:00
Romanos Skiadas
465c9269dd nixos/openrazer: Add a users option 2021-08-07 12:10:43 +03:00
Romanos Skiadas
42c6771744 nixos/openrazer: Change plugdev group to openrazer
For security reasons, and generally, it is best to create a more fine
grained group than plugdev. This way users that wish to tweak razer
devices don't have access to the entire plugdev group's permissions.

This is of course a breaking change.
2021-08-07 12:09:44 +03:00
Ninjatrappeur
d00f146ca5
Merge pull request #132932 from NinjaTrappeur/nin-fix-prosody-test
nixos/nixosTests.prosody: extend self-signed cert expiration date
2021-08-07 10:29:11 +02:00
Edmund Wu
573aae39e2
nixos/modules: assertion for required PM files 2021-08-07 01:41:58 -04:00
Artturi
8072e71d8e
Merge pull request #132853 from peterhoeg/f/devmon
Revert "nixos/devmon: add systemd service"
2021-08-07 02:34:09 +03:00