Commit Graph

249 Commits

Author SHA1 Message Date
Eelco Dolstra
febb15f722 systemd: Enable keeping backlight / rfkill state across reboots 2014-04-18 19:37:15 +02:00
Eelco Dolstra
48d90cf3b6 Revert "Put /nix/var/nix/{temproots,userpool} on a tmpfs"
This reverts commit dd49094a25. Nix
barfs if /nix/var/nix/temproots is a symlink :-(
2014-04-18 18:37:07 +02:00
Eelco Dolstra
1e540af43b Fix broken upstream user unit symlinks 2014-04-18 17:38:06 +02:00
Eelco Dolstra
dd49094a25 Put /nix/var/nix/{temproots,userpool} on a tmpfs 2014-04-18 16:56:20 +02:00
Eelco Dolstra
c13cede19d Remove long-obsolete /nix/var/nix/chroots directory 2014-04-18 16:50:37 +02:00
Eelco Dolstra
21573af9fb Containers: Use /etc/resolv.conf supplied by the host
This used to work with systemd-nspawn 203, because it bind-mounted
/etc/resolv.conf (so openresolv couldn't overwrite it). Now it's just
copied, so we need some special handling.
2014-04-18 16:48:11 +02:00
Eelco Dolstra
359935a1ef kmod-static-nodes: Drop superfluous wantedBy 2014-04-18 14:51:18 +02:00
Eelco Dolstra
64b968f81f Remove debug line 2014-04-18 02:31:10 +02:00
Eelco Dolstra
12f06ae499 Doh 2014-04-18 01:36:43 +02:00
Eelco Dolstra
e34a1589fe Add support for user units
With ‘systemd.user.units’ and ‘systemd.user.services’, you can specify
units used by per-user systemd instances.  For example,

  systemd.user.services.foo =
    { description = "foo";
      wantedBy = [ "default.target" ];
      serviceConfig.ExecStart = "${pkgs.foo}/bin/foo";
    };

declares a unit ‘foo.service’ that gets started automatically when the
user systemd instance starts, and is stopped when the user systemd
instance stops.

Note that there is at most one systemd instance per user: it's created
when a user logs in and there is no systemd instance for that user
yet, and it's removed when the user fully logs out (i.e. has no
sessions anymore). So if you're simultaneously logged in via X11 and a
virtual console, you get only one copy of foo.
2014-04-18 00:38:40 +02:00
Eelco Dolstra
073351a5cf Refactor unit option declarations
This gets rid of some duplication.
2014-04-17 23:35:05 +02:00
Eelco Dolstra
2ad6933a22 Remove special handling of systemd-journal-gatewayd 2014-04-17 19:05:29 +02:00
Eelco Dolstra
179acfb664 Allow upstream systemd units to be extended
If you define a unit, and either systemd or a package in
systemd.packages already provides that unit, then we now generate a
file /etc/systemd/system/<unit>.d/overrides.conf. This makes it
possible to use upstream units, while allowing them to be customised
from the NixOS configuration. For instance, the module nix-daemon.nix
now uses the units provided by the Nix package. And all unit
definitions that duplicated upstream systemd units are finally gone.

This makes the baseUnit option unnecessary, so I've removed it.
2014-04-17 18:52:31 +02:00
Eelco Dolstra
560a1103ad Add option ‘systemd.tmpfiles.rules’
This allows specifying rules for systemd-tmpfiles.

Also, enable systemd-tmpfiles-clean.timer so that stuff is cleaned up
automatically 15 minutes after boot and every day, *if* you have the
appropriate cleanup rules (which we don't have by default).
2014-04-17 16:14:56 +02:00
Eelco Dolstra
bb9304e280 Remove creation of /tmp/.ICE-unix
This is now done by tmpfiles.
2014-04-17 16:14:56 +02:00
Mathijs Kwik
c1e638abb6 systemd: oneshot units should be allowed to restart on failure/abort 2014-04-17 15:20:39 +02:00
Eelco Dolstra
7ea51b1c6c Enable kmod-static-nodes.service
This creates static device nodes such as /dev/fuse or
/dev/snd/seq. The kernel modules for these devices will be loaded on
demand when the device node is opened.
2014-04-17 14:35:05 +02:00
Eelco Dolstra
317a81ada2 Enable systemd-tmpfiles 2014-04-17 13:23:06 +02:00
Eelco Dolstra
518f710547 Fix module loading in systemd-udevd 2014-04-17 12:26:12 +02:00
Eelco Dolstra
89155dbc01 systemd: Enable user systemd instances 2014-04-17 12:03:04 +02:00
Eelco Dolstra
e8af68d2dc Make machinectl work 2014-04-16 10:48:14 +02:00
Eelco Dolstra
566a5c33e8 Set MODULE_DIR in systemd-load-modules.service 2014-04-16 10:43:33 +02:00
William A. Kennington III
85e9ad1b2f stage1: Systemd libraries were renamed 2014-04-16 01:49:42 +02:00
Eelco Dolstra
2fc520d699 Simplify assertion 2014-04-16 01:08:14 +02:00
William A. Kennington III
eda854d50f systemd: Add an assertion to guarantee oneshot units do not have restart set
This prevents insidious errors once systemd begins handling the unit. If
the unit is loaded at boot, any errors of this nature are logged to the
console before the journal service is running. This makes it very hard
to diagnose the issue. Therefore, this assertion helps guarantee the
mistake is not made.
2014-04-16 01:05:56 +02:00
Eelco Dolstra
ee9c068b0c systemd: Update to 212
Note that systemd no longer depends on dbus, so we're rid of the
cyclic dependency problem between systemd and dbus.

This commit incorporates from wkennington's systemd branch
(203dcff45002a63f6be75c65f1017021318cc839,
1f842558a95947261ece66f707bfa24faf5a9d88).
2014-04-16 00:59:26 +02:00
William A. Kennington III
d2ee6e6a24 stage 1: Remove scsi_wait_scan as it is not supported after kernel 3.7 2014-04-15 14:59:39 +02:00
Eelco Dolstra
29027fd1e1 Rewrite ‘with pkgs.lib’ -> ‘with lib’
Using pkgs.lib on the spine of module evaluation is problematic
because the pkgs argument depends on the result of module
evaluation. To prevent an infinite recursion, pkgs and some of the
modules are evaluated twice, which is inefficient. Using ‘with lib’
prevents this problem.
2014-04-14 16:26:48 +02:00
Eelco Dolstra
d2155649af Merge branch 'containers'
Fixes #2105.
2014-04-10 15:55:51 +02:00
aszlig
9d8a8126e9
systemd: Add support for path units.
This allows to define systemd.path(5) units, for example like this:

{
  systemd = let
    description = "Set Key Permissions for xyz.key";
  in {
    paths.set-key-perms = {
      inherit description;
      before = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      pathConfig.PathChanged = "/run/keys/xyz.key";
    };

    services.set-key-perms = {
      inherit description;
      serviceConfig.Type = "oneshot";
      script = "chown myspecialkeyuser /run/keys/xyz.key";
    };
  };
}

The example here is actually useful in order to set permissions for the
NixOps keys target to ensure those permisisons aren't reset whenever the
key file is reuploaded.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-03-31 12:33:25 +02:00
Shea Levy
77181be713 Set /run/keys ownership based on numerical ids
See comments on 4ab5646417
2014-03-19 05:18:24 -04:00
Eelco Dolstra
7d8fea797a Run hwclock --hctosys to initialize the system time 2014-03-18 23:14:34 +01:00
Eelco Dolstra
08095f97ce Typo 2014-03-18 22:40:39 +01:00
Eelco Dolstra
511b86d22d Add an option to reload rather than restart changed units 2014-03-17 15:02:53 +01:00
Shea Levy
0c12dd3ded Merge branch 'pkgs/systemd/journald_http_gateway' of git://github.com/offlinehacker/nixpkgs
systemd: python support & journal http gateway

Conflicts:
	nixos/modules/misc/ids.nix
2014-03-14 19:16:59 -04:00
Shea Levy
59a060523e Don't override the baseUnit's PATH by default 2014-03-12 20:03:14 -04:00
Eelco Dolstra
e1984f029d autovt@.service really has to be a symlink 2014-03-13 00:19:10 +01:00
Eelco Dolstra
f198c40608 Don't depend on the text of disabled units
This prevents pulling in unnecessary dependencies.
2014-03-12 18:52:11 +01:00
Eelco Dolstra
207c881df9 Don't include superfluous lines in generated units 2014-03-12 18:52:11 +01:00
Eelco Dolstra
691c0cd72e systemd: Allow customisation of upstream units
You can now say:

  systemd.services.foo.baseUnit = "${pkgs.foo}/.../foo.service";

This will cause NixOS' generated foo.service file to include
foo.service from the foo package.  You can then apply local
customization in the usual way:

  systemd.services.foo.serviceConfig.MemoryLimit = "512M";

Note however that overriding options in the original unit may not
work.  For instance, you cannot override ExecStart.

It's also possible to customize instances of template units:

  systemd.services."getty@tty4" =
    { baseUnit = "/etc/systemd/system/getty@.service";
      serviceConfig.MemoryLimit = "512M";
    };

This replaces the unit options linkTarget (which didn't allow
customisation) and extraConfig (which did allow customisation, but in
a non-standard way).
2014-03-12 18:52:10 +01:00
Ellis Whitehead
9af5d4731d typo: occured -> occurred 2014-03-07 19:39:55 +01:00
Eelco Dolstra
6572708d39 Always load the "configs" kernel module
We used to have the configuration of the kernel available in a
somewhat convenient place (/run/booted-system/kernel-modules/config)
but that has disappeared.  So instead just make /proc/configs.gz
available.  It only eats a few kilobytes.
2014-03-05 15:22:32 +01:00
Shea Levy
32470621d5 Restart keys.target on reconfiguration 2014-02-26 13:35:04 -05:00
Eelco Dolstra
d2aa2ac494 memtest.nix: Use toString 2014-02-18 19:13:07 +01:00
Petr Rockai
42ce480a52 nixos: Try harder to get LVM-hosted filesystems up in stage1. 2014-02-15 12:57:17 +01:00
Shea Levy
4ab5646417 Add a keys group with read access to /run/keys
This allows processes running as unprivileged users access to keys they might need
2014-02-11 07:00:10 -05:00
Bjørn Forsman
48851fa749 nixos/memtest: use docbook formatting
Without this the HTML manual and manpage is quite unreadable (newlines
are squashed so it doesn't look like a list anymore).

(Unfortunately, this makes the source unreadable.)
2014-02-09 13:56:09 +01:00
Ricardo M. Correia
cba2444d11 nixos/memtest: Allow user to specify memtest86 boot parameters 2014-02-09 13:55:37 +01:00
Petr Rockai
12315a278c Merge branch 'yubikey' of git://github.com/Calrama/nixpkgs 2014-02-08 16:01:22 +01:00
Moritz Maxeiner
09f9af17b4 Update to the Yubikey PBA
Security-relevant changes:
 * No (salted) passphrase hash send to the yubikey, only hash of the salt (as it was in the original implementation).
 * Derive $k_luks with PBKDF2 from the yubikey $response (as the PBKDF2 salt) and the passphrase $k_user
   (as the PBKDF2 password), so that if two-factor authentication is enabled
   (a) a USB-MITM attack on the yubikey itself is not enough to break the system
   (b) the potentially low-entropy $k_user is better protected against brute-force attacks
 * Instead of using uuidgen, gather the salt (previously random uuid / uuid_r) directly from /dev/random.
 * Length of the new salt in byte added as the parameter "saltLength", defaults to 16 byte.
   Note: Length of the challenge is 64 byte, so saltLength > 64 may have no benefit over saltLengh = 64.
 * Length of $k_luks derived with PBKDF2 in byte added as the parameter "keyLength", defaults to 64 byte.
   Example: For a luks device with a 512-bit key, keyLength should be 64.
 * Increase of the PBKDF2 iteration count per successful authentication added as the
   parameter "iterationStep", defaults to 0.

Other changes:
 * Add optional grace period before trying to find the yubikey, defaults to 2 seconds.

Full overview of the yubikey authentication process:

  (1) Read $salt and $iterations from unencrypted device (UD).
  (2) Calculate the $challenge from the $salt with a hash function.
      Chosen instantiation: SHA-512($salt).
  (3) Challenge the yubikey with the $challenge and receive the $response.
  (4) Repeat three times:
    (a) Prompt for the passphrase $k_user.
    (b) Derive the key $k_luks for the luks device with a key derivation function from $k_user and $response.
        Chosen instantiation: PBKDF2(HMAC-SHA-512, $k_user, $response, $iterations, keyLength).
    (c) Try to open the luks device with $k_luks and escape loop (4) only on success.
  (5) Proceed only if luks device was opened successfully, fail otherwise.

  (6) Gather $new_salt from a cryptographically secure pseudorandom number generator
      Chosen instantiation: /dev/random
  (7) Calculate the $new_challenge from the $new_salt with the same hash function as (2).
  (8) Challenge the yubikey with the $new_challenge and receive the $new_response.
  (9) Derive the new key $new_k_luks for the luks device in the same manner as in (4) (b),
      but with more iterations as given by iterationStep.
 (10) Try to change the luks device's key $k_luks to $new_k_luks.
 (11) If (10) was successful, write the $new_salt and the $new_iterations to the UD.
      Note: $new_iterations = $iterations + iterationStep

Known (software) attack vectors:

 * A MITM attack on the keyboard can recover $k_user. This, combined with a USB-MITM
   attack on the yubikey for the $response (1) or the $new_response (2) will result in
   (1) $k_luks being recovered,
   (2) $new_k_luks being recovered.
 * Any attacker with access to the RAM state of stage-1 at mid- or post-authentication
   can recover $k_user, $k_luks, and  $new_k_luks
 * If an attacker has recovered $response or $new_response, he can perform a brute-force
   attack on $k_user with it without the Yubikey needing to be present (using cryptsetup's
   "luksOpen --verify-passphrase" oracle. He could even make a copy of the luks device's
   luks header and run the brute-force attack without further access to the system.
 * A USB-MITM attack on the yubikey will allow an attacker to attempt to brute-force
   the yubikey's internal key ("shared secret") without it needing to be present anymore.

Credits:

 * Florian Klien,
   for the original concept and the reference implementation over at
   https://github.com/flowolf/initramfs_ykfde
 * Anthony Thysse,
   for the reference implementation of accessing OpenSSL's PBKDF2 over at
   http://www.ict.griffith.edu.au/anthony/software/pbkdf2.c
2014-02-08 14:59:52 +01:00
Jaka Hudoklin
616b4b5b0e nixos/systemd: add journal http gateway support 2014-02-06 16:21:19 +01:00
Shea Levy
bfc682ea37 Mount a ramfs on /run/keys for safe key storage for nixops
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-05 08:00:19 -05:00
Shea Levy
1e0352f801 Fix gummiboot builder
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-05 07:54:11 -05:00
Shea Levy
5e72e36f95 gummiboot-builder.py: Remove old entries before adding new ones
Fixes #1483

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-03 17:41:31 -05:00
Moritz Maxeiner
8e74e1fded Replace the current Yubikey PBA implementation with the previous one.
Rationale:
  * The main reason for choosing to implement the PBA in accordance
    with the Yubico documentation was to prevent a MITM-USB-attack
    successfully recovering the new LUKS key.
  * However, a MITM-USB-attacker can read user id and password when
    they were entered for PBA, which allows him to recover the new
    challenge after the PBA is complete, with which he can challenge
    the Yubikey, decrypt the new AES blob and recover the LUKS key.
  * Additionally, since the Yubikey shared secret is stored in the
    same AES blob, after such an attack not only is the LUKS device
    compromised, the Yubikey is as well, since the shared secret
    has also been recovered by the attacker.
  * Furthermore, with this method an attacker could also bruteforce
    the AES blob, if he has access to the unencrypted device, which
    would again compromise the Yubikey, should he be successful.
  * Finally, with this method, once the LUKS key has been recovered
    once, the encryption is permanently broken, while with the previous
    system, the LUKS key itself it changed at every successful boot,
    so recovering it once will not necessarily result in a permanent
    breakage and will also not compromise the Yubikey itself (since
    its secret is never stored anywhere but on the Yubikey itself).

Summary:
The current implementation opens up up vulnerability to brute-forcing
the AES blob, while retaining the current MITM-USB attack, additionally
making the consequences of this attack permanent and extending it to
the Yubikey itself.
2014-02-03 22:50:17 +01:00
Vladimír Čunát
b5a32b3944 Merge #1618: use ubuntu module blacklists by default 2014-02-02 15:51:07 +01:00
Moritz Maxeiner
7bf94cadad Add library dependencies explicitly 2014-01-29 18:49:26 +01:00
Moritz Maxeiner
e96f58ef5c Implement muli-user authentication for yubikey pba, i.e. multiple users can now share a single luks keyslot.
This is achieved by having multiple lines per storage file, one for each user (if the feature is enabled); each of these
lines has the same format as would be the case for the userless authentication, except that they are prepended with a
SHA-512 of the user's id.
2014-01-29 17:20:05 +01:00
Moritz Maxeiner
20cfaf0faa Change the crypt-storage file to be hex encoded instead of raw binary. To update from the previous configuration, convert your crypt-storage file from raw binary to hex. 2014-01-29 13:58:35 +01:00
Moritz Maxeiner
cce9712331 Enable two-factor authentication by default. Add proper descriptions to attributes. 2014-01-29 12:55:32 +01:00
Moritz Maxeiner
45b1ffb8db Cosmetic change to yubikey detection 2014-01-28 20:39:46 +01:00
Vladimír Čunát
5acaa980a5 pull module blacklist from Ubuntu and use it by default
People often have serious problems due to bogus modules like *fb.
2014-01-28 12:52:36 +01:00
Moritz Maxeiner
407a770161 Rewrite as a pre-boot authentication module (mostly) comforming to the design specification of
'YubiKey Integration for Full Disk Encryption Pre-Boot Authentication (Copyright) Yubico, 2011 Version: 1.1'.

Used binaries:
  * uuidgen - for generation of random sequence numbers
  * ykchalresp - for challenging a Yubikey
  * ykinfo - to check if a Yubikey is plugged in at boot (fallback to passphrase authentication otherwise)
  * openssl - for calculation of SHA-1, HMAC-SHA-1, as well as AES-256-CTR (de/en)cryption

Main differences to the specification mentioned above:
  * No user management (yet), only one password+yubikey per LUKS device
  * SHA-512 instead of CRC-16 for checksum

Main differences to the previous implementation:
  * Instead of changing the key slot of the LUKS device each boot,
    the actual key for the LUKS device will be encrypted itself
  * Since the response for the new challenge is now calculated
    locally with openssl, the MITM-USB-attack with which previously
    an attacker could obtain the new response (that was used as the new
    encryption key for the LUKS device) by listening to the
    Yubikey has ideally become useless (as long as uuidgen can
    successfuly generate new random sequence numbers).

Remarks:
  * This is not downwards compatible to the previous implementation
2014-01-28 04:02:51 +01:00
Moritz Maxeiner
333f5caaf9 Implement authentication for a LUKS device with a yubikey (HMAC-SHA1); supports simple challenge-response and two-factor authentication 2014-01-25 03:33:09 +01:00
Shea Levy
ca7805be94 systemd: Enable specifying extra config files for a unit
This will allow overriding package-provided units, or overriding only a
specific instance of a unit template.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-18 11:10:39 -05:00
Shea Levy
48daf624c5 Add module to use kmscon instead of linux-console for VTs
This required some changes to systemd unit handling:

* Add an option to specify that a unit is just a symlink
* Allow specified units to overwrite systemd-provided ones
* Have gettys.target require autovt@1.service instead of getty@1.service

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:17:19 -05:00
Shea Levy
b0000b29af gummiboot module: Don't use obsolete environment.nix option
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-05 15:53:39 -05:00
Lluís Batlle i Rossell
152da7671c nixos initrd: load atkbd, not xtkbd
I don't think anyone has a XT keyboard in a computer running nixos.
2013-12-23 09:01:45 +01:00
Song Wenwu
c4885173b6 systemd: add services.journald.extraConfig option 2013-11-30 22:42:01 +01:00
Eelco Dolstra
9ee30cd9b5 Add support for lightweight NixOS containers
You can now say:

  systemd.containers.foo.config =
    { services.openssh.enable = true;
      services.openssh.ports = [ 2022 ];
      users.extraUsers.root.openssh.authorizedKeys.keys = [ "ssh-dss ..." ];
    };

which defines a NixOS instance with the given configuration running
inside a lightweight container.

You can also manage the configuration of the container independently
from the host:

  systemd.containers.foo.path = "/nix/var/nix/profiles/containers/foo";

where "path" is a NixOS system profile.  It can be created/updated by
doing:

  $ nix-env --set -p /nix/var/nix/profiles/containers/foo \
      -f '<nixos>' -A system -I nixos-config=foo.nix

The container configuration (foo.nix) should define

  boot.isContainer = true;

to optimise away the building of a kernel and initrd.  This is done
automatically when using the "config" route.

On the host, a lightweight container appears as the service
"container-<name>.service".  The container is like a regular NixOS
(virtual) machine, except that it doesn't have its own kernel.  It has
its own root file system (by default /var/lib/containers/<name>), but
shares the Nix store of the host (as a read-only bind mount).  It also
has access to the network devices of the host.

Currently, if the configuration of the container changes, running
"nixos-rebuild switch" on the host will cause the container to be
rebooted.  In the future we may want to send some message to the
container so that it can activate the new container configuration
without rebooting.

Containers are not perfectly isolated yet.  In particular, the host's
/sys/fs/cgroup is mounted (writable!) in the guest.
2013-11-27 17:14:10 +01:00
Eelco Dolstra
953f12995b nscd: Fix LD_LIBRARY_PATH
This ensures that nscd can find the NSS modules.

Fixes #1248.
2013-11-26 18:38:22 +01:00
Eelco Dolstra
14cd8bc248 Allow services to specify a pre-stop script 2013-11-26 18:24:55 +01:00
Eelco Dolstra
2b1f212494 Disable various services when running inside a container 2013-11-26 18:19:45 +01:00
Eelco Dolstra
dc87f8e080 Check whether fileSystems defines the root FS 2013-11-18 18:04:16 +01:00
Eelco Dolstra
8951be2d80 Allow overrides to work for unit options 2013-11-18 18:04:16 +01:00
Eelco Dolstra
33cb0bbb4b Use types.lines for script/preStart/postStart/postStop 2013-11-18 18:04:16 +01:00
Eelco Dolstra
5620e69b5d Apply better type checking to unitConfig/serviceConfig/...
In particular, complain if two modules define the same systemd option.
2013-11-18 18:04:16 +01:00
Eelco Dolstra
f8a034172a Fix broken Conflicts options 2013-11-18 18:04:16 +01:00
Eelco Dolstra
08a85c2152 Allow building/testing individual systemd units 2013-11-18 18:04:16 +01:00
Ricardo M. Correia
36a05c7b15 systemd: Add systemd.extraConfig option for /etc/systemd/system.conf 2013-11-16 16:50:59 +01:00
Ricardo M. Correia
e0171ef026 systemd: Change services.logind.extraConfig type to types.lines 2013-11-16 16:50:59 +01:00
Eelco Dolstra
4cada34b7f Properly handle unit names with dashes in them
We ended up with files in /etc/systemd/system called
"bigx2ddata.mount.wants" rather than "big\x2ddata.mount.wants".
2013-11-12 16:58:36 +01:00
Eelco Dolstra
408b8b5725 Add lots of missing option types 2013-10-30 18:47:43 +01:00
Eelco Dolstra
d882e19662 Shut up "failed to resume" warning if there is no resume device 2013-10-30 18:47:43 +01:00
Eelco Dolstra
be5d3a59dd Clean up some option examples 2013-10-30 18:47:43 +01:00
Eelco Dolstra
70a2c54527 Strictly check the arguments to mkOption
And fix various instances of bad arguments.
2013-10-30 15:35:09 +01:00
Eelco Dolstra
4680af6a93 Add some option types 2013-10-30 14:57:42 +01:00
Eelco Dolstra
862e3dd977 Substitute "types.uniq types.string" -> "types.str" 2013-10-30 14:57:42 +01:00
Eelco Dolstra
9a8516438e Fix NixOps evaluation 2013-10-28 22:45:57 +01:00
Eelco Dolstra
d5047faede Remove uses of the "merge" option attribute
It's redundant because you can (and should) specify an option type, or
an apply function.
2013-10-28 22:45:56 +01:00
Eelco Dolstra
a40583e7e4 Fix bogus mkOption types
Among others, systemd unit options were not being type-checked because
of this.  mkOption should really check its arguments better...
2013-10-28 22:45:56 +01:00
Eelco Dolstra
1408ac51a4 Add missing types 2013-10-28 22:45:56 +01:00
Eelco Dolstra
4b1a9dd00b Remove uses of mkFixStrictness
mkFixStrictness is no longer needed, woohoo!
2013-10-28 22:45:55 +01:00
Eelco Dolstra
c4149c7b56 Fix evaluation error in the ISOs 2013-10-24 02:03:10 +02:00
Eelco Dolstra
a3777ba4f9 Remove dependencies on the Nixpkgs location 2013-10-23 20:08:23 +02:00
Eelco Dolstra
8f4c5b05d5 Add a way to define obsolete options that have no replacement 2013-10-23 20:08:22 +02:00
Eelco Dolstra
b33657df03 grub: Make assertion lazier 2013-10-17 13:30:49 +02:00
Shea Levy
a63b4dc555 Remove old efi boot stub bootloader
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-10 10:54:35 -04:00
Eelco Dolstra
5c1f8cbc70 Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00