Merge master into staging-next

This commit is contained in:
github-actions[bot] 2021-06-23 00:09:33 +00:00 committed by GitHub
commit e8122c3628
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
20 changed files with 154 additions and 96 deletions

View File

@ -115,8 +115,8 @@ let
mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
pushDownProperties dischargeProperties filterOverrides
sortProperties fixupOptionType mkIf mkAssert mkMerge mkOverride
mkOptionDefault mkDefault mkForce mkVMOverride mkStrict
mkFixStrictness mkOrder mkBefore mkAfter mkAliasDefinitions
mkOptionDefault mkDefault mkForce mkVMOverride
mkOrder mkBefore mkAfter mkAliasDefinitions
mkAliasAndWrapDefinitions fixMergeModules mkRemovedOptionModule
mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule
mkAliasOptionModule doRename;

View File

@ -713,10 +713,6 @@ rec {
mkForce = mkOverride 50;
mkVMOverride = mkOverride 10; # used by nixos-rebuild build-vm
mkStrict = builtins.trace "`mkStrict' is obsolete; use `mkOverride 0' instead." (mkOverride 0);
mkFixStrictness = id; # obsolete, no-op
mkOrder = priority: content:
{ _type = "order";
inherit priority content;

View File

@ -321,7 +321,26 @@
</section>
<section xml:id="sec-release-21.11-notable-changes">
<title>Other Notable Changes</title>
<para>
</para>
<itemizedlist>
<listitem>
<para>
The setting
<link xlink:href="options.html#opt-services.openssh.logLevel"><literal>services.openssh.logLevel</literal></link>
<literal>&quot;VERBOSE&quot;</literal>
<literal>&quot;INFO&quot;</literal>. This brings NixOS in line
with upstream and other Linux distributions, and reduces log
spam on servers due to bruteforcing botnets.
</para>
<para>
However, if
<link xlink:href="options.html#opt-services.fail2ban.enable"><literal>services.fail2ban.enable</literal></link>
is <literal>true</literal>, the <literal>fail2ban</literal>
will override the verbosity to
<literal>&quot;VERBOSE&quot;</literal>, so that
<literal>fail2ban</literal> can observe the failed login
attempts from the SSH logs.
</para>
</listitem>
</itemizedlist>
</section>
</section>

View File

@ -79,3 +79,7 @@ In addition to numerous new and upgraded packages, this release has the followin
old 2.7.7 version.
## Other Notable Changes {#sec-release-21.11-notable-changes}
- The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
However, if [`services.fail2ban.enable`](options.html#opt-services.fail2ban.enable) is `true`, the `fail2ban` will override the verbosity to `"VERBOSE"`, so that `fail2ban` can observe the failed login attempts from the SSH logs.

View File

@ -351,15 +351,12 @@ in
logLevel = mkOption {
type = types.enum [ "QUIET" "FATAL" "ERROR" "INFO" "VERBOSE" "DEBUG" "DEBUG1" "DEBUG2" "DEBUG3" ];
default = "VERBOSE";
default = "INFO"; # upstream default
description = ''
Gives the verbosity level that is used when logging messages from sshd(8). The possible values are:
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is VERBOSE. DEBUG and DEBUG1
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1
are equivalent. DEBUG2 and DEBUG3 each specify higher levels of debugging output. Logging with a DEBUG level
violates the privacy of users and is not recommended.
LogLevel VERBOSE logs user's key fingerprint on login.
Needed to have a clear audit track of which key was used to log in.
'';
};

View File

@ -45,7 +45,12 @@ in
enable = mkOption {
default = false;
type = types.bool;
description = "Whether to enable the fail2ban service.";
description = ''
Whether to enable the fail2ban service.
See the documentation of <option>services.fail2ban.jails</option>
for what jails are enabled by default.
'';
};
package = mkOption {
@ -221,6 +226,15 @@ in
defined in <filename>/etc/fail2ban/action.d</filename>,
while filters are defined in
<filename>/etc/fail2ban/filter.d</filename>.
NixOS comes with a default <literal>sshd</literal> jail;
for it to work well,
<option>services.openssh.logLevel</option> should be set to
<literal>"VERBOSE"</literal> or higher so that fail2ban
can observe failed login attempts.
This module sets it to <literal>"VERBOSE"</literal> if
not set otherwise, so enabling fail2ban can make SSH logs
more verbose.
'';
};
@ -313,6 +327,9 @@ in
banaction_allports = ${cfg.banaction-allports}
'';
# Block SSH if there are too many failing connection attempts.
# Benefits from verbose sshd logging to observe failed login attempts,
# so we set that here unless the user overrode it.
services.openssh.logLevel = lib.mkDefault "VERBOSE";
services.fail2ban.jails.sshd = mkDefault ''
enabled = true
port = ${concatMapStringsSep "," (p: toString p) config.services.openssh.ports}

View File

@ -188,27 +188,27 @@ let cfg = config.services.xserver.libinput;
};
mkX11ConfigForDevice = deviceType: matchIs: ''
Identifier "libinput ${deviceType} configuration"
MatchDriver "libinput"
MatchIs${matchIs} "${xorgBool true}"
${optionalString (cfg.${deviceType}.dev != null) ''MatchDevicePath "${cfg.${deviceType}.dev}"''}
Option "AccelProfile" "${cfg.${deviceType}.accelProfile}"
${optionalString (cfg.${deviceType}.accelSpeed != null) ''Option "AccelSpeed" "${cfg.${deviceType}.accelSpeed}"''}
${optionalString (cfg.${deviceType}.buttonMapping != null) ''Option "ButtonMapping" "${cfg.${deviceType}.buttonMapping}"''}
${optionalString (cfg.${deviceType}.calibrationMatrix != null) ''Option "CalibrationMatrix" "${cfg.${deviceType}.calibrationMatrix}"''}
${optionalString (cfg.${deviceType}.clickMethod != null) ''Option "ClickMethod" "${cfg.${deviceType}.clickMethod}"''}
Option "LeftHanded" "${xorgBool cfg.${deviceType}.leftHanded}"
Option "MiddleEmulation" "${xorgBool cfg.${deviceType}.middleEmulation}"
Option "NaturalScrolling" "${xorgBool cfg.${deviceType}.naturalScrolling}"
${optionalString (cfg.${deviceType}.scrollButton != null) ''Option "ScrollButton" "${toString cfg.${deviceType}.scrollButton}"''}
Option "ScrollMethod" "${cfg.${deviceType}.scrollMethod}"
Option "HorizontalScrolling" "${xorgBool cfg.${deviceType}.horizontalScrolling}"
Option "SendEventsMode" "${cfg.${deviceType}.sendEventsMode}"
Option "Tapping" "${xorgBool cfg.${deviceType}.tapping}"
Option "TappingDragLock" "${xorgBool cfg.${deviceType}.tappingDragLock}"
Option "DisableWhileTyping" "${xorgBool cfg.${deviceType}.disableWhileTyping}"
${cfg.${deviceType}.additionalOptions}
'';
Identifier "libinput ${deviceType} configuration"
MatchDriver "libinput"
MatchIs${matchIs} "${xorgBool true}"
${optionalString (cfg.${deviceType}.dev != null) ''MatchDevicePath "${cfg.${deviceType}.dev}"''}
Option "AccelProfile" "${cfg.${deviceType}.accelProfile}"
${optionalString (cfg.${deviceType}.accelSpeed != null) ''Option "AccelSpeed" "${cfg.${deviceType}.accelSpeed}"''}
${optionalString (cfg.${deviceType}.buttonMapping != null) ''Option "ButtonMapping" "${cfg.${deviceType}.buttonMapping}"''}
${optionalString (cfg.${deviceType}.calibrationMatrix != null) ''Option "CalibrationMatrix" "${cfg.${deviceType}.calibrationMatrix}"''}
${optionalString (cfg.${deviceType}.clickMethod != null) ''Option "ClickMethod" "${cfg.${deviceType}.clickMethod}"''}
Option "LeftHanded" "${xorgBool cfg.${deviceType}.leftHanded}"
Option "MiddleEmulation" "${xorgBool cfg.${deviceType}.middleEmulation}"
Option "NaturalScrolling" "${xorgBool cfg.${deviceType}.naturalScrolling}"
${optionalString (cfg.${deviceType}.scrollButton != null) ''Option "ScrollButton" "${toString cfg.${deviceType}.scrollButton}"''}
Option "ScrollMethod" "${cfg.${deviceType}.scrollMethod}"
Option "HorizontalScrolling" "${xorgBool cfg.${deviceType}.horizontalScrolling}"
Option "SendEventsMode" "${cfg.${deviceType}.sendEventsMode}"
Option "Tapping" "${xorgBool cfg.${deviceType}.tapping}"
Option "TappingDragLock" "${xorgBool cfg.${deviceType}.tappingDragLock}"
Option "DisableWhileTyping" "${xorgBool cfg.${deviceType}.disableWhileTyping}"
${cfg.${deviceType}.additionalOptions}
'';
in {
imports =

View File

@ -81,13 +81,7 @@ let
monitors = forEach xrandrHeads (h: ''
Option "monitor-${h.config.output}" "${h.name}"
'');
# First option is indented through the space in the config but any
# subsequent options aren't so we need to apply indentation to
# them here
monitorsIndented = if length monitors > 1
then singleton (head monitors) ++ map (m: " " + m) (tail monitors)
else monitors;
in concatStrings monitorsIndented;
in concatStrings monitors;
# Here we chain every monitor from the left to right, so we have:
# m4 right of m3 right of m2 right of m1 .----.----.----.----.
@ -138,10 +132,15 @@ let
echo '${cfg.filesSection}' >> $out
echo 'EndSection' >> $out
echo >> $out
echo "$config" >> $out
''; # */
prefixStringLines = prefix: str:
concatMapStringsSep "\n" (line: prefix + line) (splitString "\n" str);
indent = prefixStringLines " ";
in
{
@ -358,6 +357,13 @@ in
description = ''
The contents of the configuration file of the X server
(<filename>xorg.conf</filename>).
This option is set by multiple modules, and the configs are
concatenated together.
In Xorg configs the last config entries take precedence,
so you may want to use <literal>lib.mkAfter</literal> on this option
to override NixOS's defaults.
'';
};
@ -736,29 +742,29 @@ in
Section "ServerFlags"
Option "AllowMouseOpenFail" "on"
Option "DontZap" "${if cfg.enableCtrlAltBackspace then "off" else "on"}"
${cfg.serverFlagsSection}
${indent cfg.serverFlagsSection}
EndSection
Section "Module"
${cfg.moduleSection}
${indent cfg.moduleSection}
EndSection
Section "Monitor"
Identifier "Monitor[0]"
${cfg.monitorSection}
${indent cfg.monitorSection}
EndSection
# Additional "InputClass" sections
${flip concatMapStrings cfg.inputClassSections (inputClassSection: ''
Section "InputClass"
${inputClassSection}
EndSection
${flip (concatMapStringsSep "\n") cfg.inputClassSections (inputClassSection: ''
Section "InputClass"
${indent inputClassSection}
EndSection
'')}
Section "ServerLayout"
Identifier "Layout[all]"
${cfg.serverLayoutSection}
${indent cfg.serverLayoutSection}
# Reference the Screen sections for each driver. This will
# cause the X server to try each in turn.
${flip concatMapStrings (filter (d: d.display) cfg.drivers) (d: ''
@ -781,9 +787,9 @@ in
Identifier "Device-${driver.name}[0]"
Driver "${driver.driverName or driver.name}"
${if cfg.useGlamor then ''Option "AccelMethod" "glamor"'' else ""}
${cfg.deviceSection}
${driver.deviceSection or ""}
${xrandrDeviceSection}
${indent cfg.deviceSection}
${indent (driver.deviceSection or "")}
${indent xrandrDeviceSection}
EndSection
${optionalString driver.display ''
@ -794,18 +800,22 @@ in
Monitor "Monitor[0]"
''}
${cfg.screenSection}
${driver.screenSection or ""}
${indent cfg.screenSection}
${indent (driver.screenSection or "")}
${optionalString (cfg.defaultDepth != 0) ''
DefaultDepth ${toString cfg.defaultDepth}
''}
${optionalString
(driver.name != "virtualbox" &&
(
driver.name != "virtualbox"
&&
(cfg.resolutions != [] ||
cfg.extraDisplaySettings != "" ||
cfg.virtualScreen != null))
cfg.virtualScreen != null
)
)
(let
f = depth:
''
@ -813,7 +823,7 @@ in
Depth ${toString depth}
${optionalString (cfg.resolutions != [])
"Modes ${concatMapStrings (res: ''"${toString res.x}x${toString res.y}"'') cfg.resolutions}"}
${cfg.extraDisplaySettings}
${indent cfg.extraDisplaySettings}
${optionalString (cfg.virtualScreen != null)
"Virtual ${toString cfg.virtualScreen.x} ${toString cfg.virtualScreen.y}"}
EndSubSection

View File

@ -87,9 +87,9 @@ with lib;
})
(mkIf (cfg.emulateWheel) {
services.xserver.inputClassSections =
[''
Identifier "Trackpoint Wheel Emulation"
services.xserver.inputClassSections = [
''
Identifier "Trackpoint Wheel Emulation"
MatchProduct "${if cfg.fakeButtons then "PS/2 Generic Mouse" else "ETPS/2 Elantech TrackPoint|Elantech PS/2 TrackPoint|TPPS/2 IBM TrackPoint|DualPoint Stick|Synaptics Inc. Composite TouchPad / TrackPoint|ThinkPad USB Keyboard with TrackPoint|USB Trackpoint pointing device|Composite TouchPad / TrackPoint|${cfg.device}"}"
MatchDevicePath "/dev/input/event*"
Option "EmulateWheel" "true"
@ -97,7 +97,8 @@ with lib;
Option "Emulate3Buttons" "false"
Option "XAxisMapping" "6 7"
Option "YAxisMapping" "4 5"
''];
''
];
})
(mkIf cfg.fakeButtons {

View File

@ -175,12 +175,6 @@ let
sha256 = "1bxdhxmiy6h4acq26lq43x2mxx6rawmfmlgsh5j7w8kyhkw5af0c";
revert = true;
})
# To fix building from a release tarball (which we do):
(githubPatch {
# Revert back to generating chromium_git_revision.h via version.py
commit = "bd524d08f8465364d12d32a84fd1aa983aecc502";
sha256 = "1jsxidg5jzwkrcpx3lylx4gyg56zjyd7sc957kaaqqc853bn83b4";
})
];
postPatch = ''

View File

@ -31,15 +31,15 @@
}
},
"dev": {
"version": "93.0.4542.2",
"sha256": "0sfyi52kaxg5mllcvn61285fjnj72vglv9fjf36ri93v6gh34rgw",
"sha256bin64": "0hk31b9nk834gykv977dv7f1hyl7jp527bx5ldxhwcy27333h1hr",
"version": "93.0.4549.3",
"sha256": "0bkr67n1d75ayd1d9sa57c99j85r83gadzfs8iw7kwiha9g0mjgp",
"sha256bin64": "1hac6m668nrdzvfqx3vyc74pnx8lf973m1jxnm3cfy83g7wynphz",
"deps": {
"gn": {
"version": "2021-06-11",
"version": "2021-06-18",
"url": "https://gn.googlesource.com/gn",
"rev": "e0c476ffc83dc10897cb90b45c03ae2539352c5c",
"sha256": "01p5w57kksihzg9nb5096a74cw2rp8zzgdjcjm1pgrqvd1mxpjm4"
"rev": "170c2dba1e0c0299fe8c6a441caf2f2352a42ae0",
"sha256": "1ylx8a5fxq7aciqs0mx7fld763sqkqn39lb9k951w6gksm15lrn3"
}
}
},

View File

@ -28,7 +28,7 @@ let
else "");
in stdenv.mkDerivation rec {
pname = "signal-desktop";
version = "5.5.0"; # Please backport all updates to the stable channel.
version = "5.6.1"; # Please backport all updates to the stable channel.
# All releases have a limited lifetime and "expire" 90 days after the release.
# When releases "expire" the application becomes unusable until an update is
# applied. The expiration date for the current release can be extracted with:
@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
src = fetchurl {
url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
sha256 = "0l12hwwv0ks2hgp1xc5nmn5rcqzwxdpjqhwysix550m26bz4jczp";
sha256 = "00q99r3p49fa5j54h1faxrzxfgz1pkx86b1jg3vi94hddlw3xm9c";
};
nativeBuildInputs = [

View File

@ -1,8 +1,8 @@
{ lib
, callPackage
, buildPythonPackage
, fetchPypi
, installShellFiles
, ansible-collections
, cryptography
, jinja2
, junit-xml
@ -20,13 +20,19 @@
, xmltodict
}:
let
ansible-collections = callPackage ./collections.nix {
version = "3.4.0"; # must be < 4.0
sha256 = "096rbgz730njk0pg8qnc27mmz110wqrw354ca9gasb7rqg0f4d6a";
};
in
buildPythonPackage rec {
pname = "ansible-base";
version = "2.10.10";
version = "2.10.11";
src = fetchPypi {
inherit pname version;
sha256 = "046ynyk9ldw35jbyw6jp0dmms735cd5i1f046f2lis8xv27bci3p";
sha256 = "0jr3cxqiami9k07g2kmvfp54iafbcnd1d66l8fdnaqka5bc19wdw";
};
# ansible_connection is already wrapped, so don't pass it through
@ -69,6 +75,10 @@ buildPythonPackage rec {
# internal import errors, missing dependencies
doCheck = false;
passthru = {
collections = ansible-collections;
};
meta = with lib; {
description = "Radically simple IT automation";
homepage = "https://www.ansible.com";

View File

@ -14,21 +14,23 @@
, xmltodict
, withJunos ? false
, withNetbox ? false
, version
, sha256
}:
buildPythonPackage rec {
pname = "ansible";
version = "3.4.0";
inherit version;
format = "setuptools";
src = fetchPypi {
inherit pname version;
sha256 = "096rbgz730njk0pg8qnc27mmz110wqrw354ca9gasb7rqg0f4d6a";
inherit pname version sha256;
};
postPatch = ''
# make ansible-base depend on ansible-collection, not the other way around
sed -i '/ansible-base/d' setup.py
sed -Ei '/ansible-(base|core)/d' setup.py
'';
propagatedBuildInputs = lib.unique ([

View File

@ -1,8 +1,8 @@
{ lib
, callPackage
, buildPythonPackage
, fetchPypi
, installShellFiles
, ansible-collections
, cryptography
, jinja2
, junit-xml
@ -21,13 +21,19 @@
, xmltodict
}:
let
ansible-collections = callPackage ./collections.nix {
version = "4.1.0";
sha256 = "0rrivq1g0vizah8zmf012lzig2xxfk5x1371k16s3nn4zfkwqqgm";
};
in
buildPythonPackage rec {
pname = "ansible-core";
version = "2.11.1";
version = "2.11.2";
src = fetchPypi {
inherit pname version;
sha256 = "sha256-fnWCepTUfRw+GTDXCPDvY3o6uaIfdXqvVd6rbp9HxoI=";
sha256 = "1syadgzn5ww5bhq9s2py4h1hkh11h7aac5b37zi8rw2xfvdc7r2s";
};
# ansible_connection is already wrapped, so don't pass it through
@ -74,6 +80,10 @@ buildPythonPackage rec {
# internal import errors, missing dependencies
doCheck = false;
passthru = {
collections = ansible-collections;
};
meta = with lib; {
description = "Radically simple IT automation";
homepage = "https://www.ansible.com";

View File

@ -18,13 +18,13 @@
buildPythonPackage rec {
pname = "ansible";
version = "2.9.22";
version = "2.9.23";
src = fetchFromGitHub {
owner = "ansible";
repo = "ansible";
rev = "v${version}";
sha256 = "0gkv59cfxzs0ahgkxmmx9sqnfb2xqr10q4yh2662nbzajmvqmfgm";
sha256 = "0mikykpzyqpmaiczz53f71mcyc4qvahi9ckn7wgfx7sw7s2z3skk";
};
prePatch = ''

View File

@ -7,13 +7,13 @@
buildPythonPackage rec {
pname = "resolvelib";
version = "0.7.0";
version = "0.7.1";
src = fetchFromGitHub {
owner = "sarugaku";
repo = "resolvelib";
rev = version;
sha256 = "0r7cxwrfvpqz4kd7pdf8fsynzlmi6c754jd5hzd6vssc1zlyvvhx";
sha256 = "1fqz75riagizihvf4j7wc3zjw6kmg1dd8sf49aszyml105kb33n8";
};
checkInputs = [

View File

@ -2,14 +2,14 @@
stdenv.mkDerivation rec {
pname = "byacc";
version = "20210520";
version = "20210619";
src = fetchurl {
urls = [
"ftp://ftp.invisible-island.net/byacc/${pname}-${version}.tgz"
"https://invisible-mirror.net/archives/byacc/${pname}-${version}.tgz"
];
sha256 = "sha256-19MdrnLLlzSC73+XVgmuQBzMEu4/sWi2emlSbGCv5D4=";
sha256 = "sha256-rN1ggNz5NXMqCOyOjEwWHGZs1W2MSQc5xtu2JnpJjA4=";
};
configureFlags = [

View File

@ -2,13 +2,13 @@
stdenv.mkDerivation rec {
pname = "atomicparsley";
version = "20210124.204813.840499f";
version = "20210617.200601.1ac7c08";
src = fetchFromGitHub {
owner = "wez";
repo = pname;
rev = version;
sha256 = "sha256-/bkfgIWlQobaiad2WD7DUUrTwfYurP7YAINaLTwBEcE=";
sha256 = "sha256-IhZe0vM41JhO8H79ZrRx4FRA4zfB6X0daC8QoE5MHmU=";
};
nativeBuildInputs = [ cmake ];

View File

@ -441,8 +441,6 @@ in {
ansible-base = callPackage ../development/python-modules/ansible/base.nix { };
ansible-collections = callPackage ../development/python-modules/ansible/collections.nix { };
ansible-core = callPackage ../development/python-modules/ansible/core.nix { };
ansible-kernel = callPackage ../development/python-modules/ansible-kernel { };