Merge master into staging-next
This commit is contained in:
commit
e8122c3628
|
@ -115,8 +115,8 @@ let
|
|||
mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
|
||||
pushDownProperties dischargeProperties filterOverrides
|
||||
sortProperties fixupOptionType mkIf mkAssert mkMerge mkOverride
|
||||
mkOptionDefault mkDefault mkForce mkVMOverride mkStrict
|
||||
mkFixStrictness mkOrder mkBefore mkAfter mkAliasDefinitions
|
||||
mkOptionDefault mkDefault mkForce mkVMOverride
|
||||
mkOrder mkBefore mkAfter mkAliasDefinitions
|
||||
mkAliasAndWrapDefinitions fixMergeModules mkRemovedOptionModule
|
||||
mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule
|
||||
mkAliasOptionModule doRename;
|
||||
|
|
|
@ -713,10 +713,6 @@ rec {
|
|||
mkForce = mkOverride 50;
|
||||
mkVMOverride = mkOverride 10; # used by ‘nixos-rebuild build-vm’
|
||||
|
||||
mkStrict = builtins.trace "`mkStrict' is obsolete; use `mkOverride 0' instead." (mkOverride 0);
|
||||
|
||||
mkFixStrictness = id; # obsolete, no-op
|
||||
|
||||
mkOrder = priority: content:
|
||||
{ _type = "order";
|
||||
inherit priority content;
|
||||
|
|
|
@ -321,7 +321,26 @@
|
|||
</section>
|
||||
<section xml:id="sec-release-21.11-notable-changes">
|
||||
<title>Other Notable Changes</title>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
The setting
|
||||
<link xlink:href="options.html#opt-services.openssh.logLevel"><literal>services.openssh.logLevel</literal></link>
|
||||
<literal>"VERBOSE"</literal>
|
||||
<literal>"INFO"</literal>. This brings NixOS in line
|
||||
with upstream and other Linux distributions, and reduces log
|
||||
spam on servers due to bruteforcing botnets.
|
||||
</para>
|
||||
<para>
|
||||
However, if
|
||||
<link xlink:href="options.html#opt-services.fail2ban.enable"><literal>services.fail2ban.enable</literal></link>
|
||||
is <literal>true</literal>, the <literal>fail2ban</literal>
|
||||
will override the verbosity to
|
||||
<literal>"VERBOSE"</literal>, so that
|
||||
<literal>fail2ban</literal> can observe the failed login
|
||||
attempts from the SSH logs.
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
</section>
|
||||
|
|
|
@ -79,3 +79,7 @@ In addition to numerous new and upgraded packages, this release has the followin
|
|||
old 2.7.7 version.
|
||||
|
||||
## Other Notable Changes {#sec-release-21.11-notable-changes}
|
||||
|
||||
- The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
|
||||
|
||||
However, if [`services.fail2ban.enable`](options.html#opt-services.fail2ban.enable) is `true`, the `fail2ban` will override the verbosity to `"VERBOSE"`, so that `fail2ban` can observe the failed login attempts from the SSH logs.
|
||||
|
|
|
@ -351,15 +351,12 @@ in
|
|||
|
||||
logLevel = mkOption {
|
||||
type = types.enum [ "QUIET" "FATAL" "ERROR" "INFO" "VERBOSE" "DEBUG" "DEBUG1" "DEBUG2" "DEBUG3" ];
|
||||
default = "VERBOSE";
|
||||
default = "INFO"; # upstream default
|
||||
description = ''
|
||||
Gives the verbosity level that is used when logging messages from sshd(8). The possible values are:
|
||||
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is VERBOSE. DEBUG and DEBUG1
|
||||
QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1
|
||||
are equivalent. DEBUG2 and DEBUG3 each specify higher levels of debugging output. Logging with a DEBUG level
|
||||
violates the privacy of users and is not recommended.
|
||||
|
||||
LogLevel VERBOSE logs user's key fingerprint on login.
|
||||
Needed to have a clear audit track of which key was used to log in.
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
|
@ -45,7 +45,12 @@ in
|
|||
enable = mkOption {
|
||||
default = false;
|
||||
type = types.bool;
|
||||
description = "Whether to enable the fail2ban service.";
|
||||
description = ''
|
||||
Whether to enable the fail2ban service.
|
||||
|
||||
See the documentation of <option>services.fail2ban.jails</option>
|
||||
for what jails are enabled by default.
|
||||
'';
|
||||
};
|
||||
|
||||
package = mkOption {
|
||||
|
@ -221,6 +226,15 @@ in
|
|||
defined in <filename>/etc/fail2ban/action.d</filename>,
|
||||
while filters are defined in
|
||||
<filename>/etc/fail2ban/filter.d</filename>.
|
||||
|
||||
NixOS comes with a default <literal>sshd</literal> jail;
|
||||
for it to work well,
|
||||
<option>services.openssh.logLevel</option> should be set to
|
||||
<literal>"VERBOSE"</literal> or higher so that fail2ban
|
||||
can observe failed login attempts.
|
||||
This module sets it to <literal>"VERBOSE"</literal> if
|
||||
not set otherwise, so enabling fail2ban can make SSH logs
|
||||
more verbose.
|
||||
'';
|
||||
};
|
||||
|
||||
|
@ -313,6 +327,9 @@ in
|
|||
banaction_allports = ${cfg.banaction-allports}
|
||||
'';
|
||||
# Block SSH if there are too many failing connection attempts.
|
||||
# Benefits from verbose sshd logging to observe failed login attempts,
|
||||
# so we set that here unless the user overrode it.
|
||||
services.openssh.logLevel = lib.mkDefault "VERBOSE";
|
||||
services.fail2ban.jails.sshd = mkDefault ''
|
||||
enabled = true
|
||||
port = ${concatMapStringsSep "," (p: toString p) config.services.openssh.ports}
|
||||
|
|
|
@ -81,13 +81,7 @@ let
|
|||
monitors = forEach xrandrHeads (h: ''
|
||||
Option "monitor-${h.config.output}" "${h.name}"
|
||||
'');
|
||||
# First option is indented through the space in the config but any
|
||||
# subsequent options aren't so we need to apply indentation to
|
||||
# them here
|
||||
monitorsIndented = if length monitors > 1
|
||||
then singleton (head monitors) ++ map (m: " " + m) (tail monitors)
|
||||
else monitors;
|
||||
in concatStrings monitorsIndented;
|
||||
in concatStrings monitors;
|
||||
|
||||
# Here we chain every monitor from the left to right, so we have:
|
||||
# m4 right of m3 right of m2 right of m1 .----.----.----.----.
|
||||
|
@ -138,10 +132,15 @@ let
|
|||
|
||||
echo '${cfg.filesSection}' >> $out
|
||||
echo 'EndSection' >> $out
|
||||
echo >> $out
|
||||
|
||||
echo "$config" >> $out
|
||||
''; # */
|
||||
|
||||
prefixStringLines = prefix: str:
|
||||
concatMapStringsSep "\n" (line: prefix + line) (splitString "\n" str);
|
||||
|
||||
indent = prefixStringLines " ";
|
||||
in
|
||||
|
||||
{
|
||||
|
@ -358,6 +357,13 @@ in
|
|||
description = ''
|
||||
The contents of the configuration file of the X server
|
||||
(<filename>xorg.conf</filename>).
|
||||
|
||||
This option is set by multiple modules, and the configs are
|
||||
concatenated together.
|
||||
|
||||
In Xorg configs the last config entries take precedence,
|
||||
so you may want to use <literal>lib.mkAfter</literal> on this option
|
||||
to override NixOS's defaults.
|
||||
'';
|
||||
};
|
||||
|
||||
|
@ -736,29 +742,29 @@ in
|
|||
Section "ServerFlags"
|
||||
Option "AllowMouseOpenFail" "on"
|
||||
Option "DontZap" "${if cfg.enableCtrlAltBackspace then "off" else "on"}"
|
||||
${cfg.serverFlagsSection}
|
||||
${indent cfg.serverFlagsSection}
|
||||
EndSection
|
||||
|
||||
Section "Module"
|
||||
${cfg.moduleSection}
|
||||
${indent cfg.moduleSection}
|
||||
EndSection
|
||||
|
||||
Section "Monitor"
|
||||
Identifier "Monitor[0]"
|
||||
${cfg.monitorSection}
|
||||
${indent cfg.monitorSection}
|
||||
EndSection
|
||||
|
||||
# Additional "InputClass" sections
|
||||
${flip concatMapStrings cfg.inputClassSections (inputClassSection: ''
|
||||
${flip (concatMapStringsSep "\n") cfg.inputClassSections (inputClassSection: ''
|
||||
Section "InputClass"
|
||||
${inputClassSection}
|
||||
${indent inputClassSection}
|
||||
EndSection
|
||||
'')}
|
||||
|
||||
|
||||
Section "ServerLayout"
|
||||
Identifier "Layout[all]"
|
||||
${cfg.serverLayoutSection}
|
||||
${indent cfg.serverLayoutSection}
|
||||
# Reference the Screen sections for each driver. This will
|
||||
# cause the X server to try each in turn.
|
||||
${flip concatMapStrings (filter (d: d.display) cfg.drivers) (d: ''
|
||||
|
@ -781,9 +787,9 @@ in
|
|||
Identifier "Device-${driver.name}[0]"
|
||||
Driver "${driver.driverName or driver.name}"
|
||||
${if cfg.useGlamor then ''Option "AccelMethod" "glamor"'' else ""}
|
||||
${cfg.deviceSection}
|
||||
${driver.deviceSection or ""}
|
||||
${xrandrDeviceSection}
|
||||
${indent cfg.deviceSection}
|
||||
${indent (driver.deviceSection or "")}
|
||||
${indent xrandrDeviceSection}
|
||||
EndSection
|
||||
${optionalString driver.display ''
|
||||
|
||||
|
@ -794,18 +800,22 @@ in
|
|||
Monitor "Monitor[0]"
|
||||
''}
|
||||
|
||||
${cfg.screenSection}
|
||||
${driver.screenSection or ""}
|
||||
${indent cfg.screenSection}
|
||||
${indent (driver.screenSection or "")}
|
||||
|
||||
${optionalString (cfg.defaultDepth != 0) ''
|
||||
DefaultDepth ${toString cfg.defaultDepth}
|
||||
''}
|
||||
|
||||
${optionalString
|
||||
(driver.name != "virtualbox" &&
|
||||
(
|
||||
driver.name != "virtualbox"
|
||||
&&
|
||||
(cfg.resolutions != [] ||
|
||||
cfg.extraDisplaySettings != "" ||
|
||||
cfg.virtualScreen != null))
|
||||
cfg.virtualScreen != null
|
||||
)
|
||||
)
|
||||
(let
|
||||
f = depth:
|
||||
''
|
||||
|
@ -813,7 +823,7 @@ in
|
|||
Depth ${toString depth}
|
||||
${optionalString (cfg.resolutions != [])
|
||||
"Modes ${concatMapStrings (res: ''"${toString res.x}x${toString res.y}"'') cfg.resolutions}"}
|
||||
${cfg.extraDisplaySettings}
|
||||
${indent cfg.extraDisplaySettings}
|
||||
${optionalString (cfg.virtualScreen != null)
|
||||
"Virtual ${toString cfg.virtualScreen.x} ${toString cfg.virtualScreen.y}"}
|
||||
EndSubSection
|
||||
|
|
|
@ -87,8 +87,8 @@ with lib;
|
|||
})
|
||||
|
||||
(mkIf (cfg.emulateWheel) {
|
||||
services.xserver.inputClassSections =
|
||||
[''
|
||||
services.xserver.inputClassSections = [
|
||||
''
|
||||
Identifier "Trackpoint Wheel Emulation"
|
||||
MatchProduct "${if cfg.fakeButtons then "PS/2 Generic Mouse" else "ETPS/2 Elantech TrackPoint|Elantech PS/2 TrackPoint|TPPS/2 IBM TrackPoint|DualPoint Stick|Synaptics Inc. Composite TouchPad / TrackPoint|ThinkPad USB Keyboard with TrackPoint|USB Trackpoint pointing device|Composite TouchPad / TrackPoint|${cfg.device}"}"
|
||||
MatchDevicePath "/dev/input/event*"
|
||||
|
@ -97,7 +97,8 @@ with lib;
|
|||
Option "Emulate3Buttons" "false"
|
||||
Option "XAxisMapping" "6 7"
|
||||
Option "YAxisMapping" "4 5"
|
||||
''];
|
||||
''
|
||||
];
|
||||
})
|
||||
|
||||
(mkIf cfg.fakeButtons {
|
||||
|
|
|
@ -175,12 +175,6 @@ let
|
|||
sha256 = "1bxdhxmiy6h4acq26lq43x2mxx6rawmfmlgsh5j7w8kyhkw5af0c";
|
||||
revert = true;
|
||||
})
|
||||
# To fix building from a release tarball (which we do):
|
||||
(githubPatch {
|
||||
# Revert back to generating chromium_git_revision.h via version.py
|
||||
commit = "bd524d08f8465364d12d32a84fd1aa983aecc502";
|
||||
sha256 = "1jsxidg5jzwkrcpx3lylx4gyg56zjyd7sc957kaaqqc853bn83b4";
|
||||
})
|
||||
];
|
||||
|
||||
postPatch = ''
|
||||
|
|
|
@ -31,15 +31,15 @@
|
|||
}
|
||||
},
|
||||
"dev": {
|
||||
"version": "93.0.4542.2",
|
||||
"sha256": "0sfyi52kaxg5mllcvn61285fjnj72vglv9fjf36ri93v6gh34rgw",
|
||||
"sha256bin64": "0hk31b9nk834gykv977dv7f1hyl7jp527bx5ldxhwcy27333h1hr",
|
||||
"version": "93.0.4549.3",
|
||||
"sha256": "0bkr67n1d75ayd1d9sa57c99j85r83gadzfs8iw7kwiha9g0mjgp",
|
||||
"sha256bin64": "1hac6m668nrdzvfqx3vyc74pnx8lf973m1jxnm3cfy83g7wynphz",
|
||||
"deps": {
|
||||
"gn": {
|
||||
"version": "2021-06-11",
|
||||
"version": "2021-06-18",
|
||||
"url": "https://gn.googlesource.com/gn",
|
||||
"rev": "e0c476ffc83dc10897cb90b45c03ae2539352c5c",
|
||||
"sha256": "01p5w57kksihzg9nb5096a74cw2rp8zzgdjcjm1pgrqvd1mxpjm4"
|
||||
"rev": "170c2dba1e0c0299fe8c6a441caf2f2352a42ae0",
|
||||
"sha256": "1ylx8a5fxq7aciqs0mx7fld763sqkqn39lb9k951w6gksm15lrn3"
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
|
@ -28,7 +28,7 @@ let
|
|||
else "");
|
||||
in stdenv.mkDerivation rec {
|
||||
pname = "signal-desktop";
|
||||
version = "5.5.0"; # Please backport all updates to the stable channel.
|
||||
version = "5.6.1"; # Please backport all updates to the stable channel.
|
||||
# All releases have a limited lifetime and "expire" 90 days after the release.
|
||||
# When releases "expire" the application becomes unusable until an update is
|
||||
# applied. The expiration date for the current release can be extracted with:
|
||||
|
@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
|
|||
|
||||
src = fetchurl {
|
||||
url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
|
||||
sha256 = "0l12hwwv0ks2hgp1xc5nmn5rcqzwxdpjqhwysix550m26bz4jczp";
|
||||
sha256 = "00q99r3p49fa5j54h1faxrzxfgz1pkx86b1jg3vi94hddlw3xm9c";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [
|
||||
|
|
|
@ -1,8 +1,8 @@
|
|||
{ lib
|
||||
, callPackage
|
||||
, buildPythonPackage
|
||||
, fetchPypi
|
||||
, installShellFiles
|
||||
, ansible-collections
|
||||
, cryptography
|
||||
, jinja2
|
||||
, junit-xml
|
||||
|
@ -20,13 +20,19 @@
|
|||
, xmltodict
|
||||
}:
|
||||
|
||||
let
|
||||
ansible-collections = callPackage ./collections.nix {
|
||||
version = "3.4.0"; # must be < 4.0
|
||||
sha256 = "096rbgz730njk0pg8qnc27mmz110wqrw354ca9gasb7rqg0f4d6a";
|
||||
};
|
||||
in
|
||||
buildPythonPackage rec {
|
||||
pname = "ansible-base";
|
||||
version = "2.10.10";
|
||||
version = "2.10.11";
|
||||
|
||||
src = fetchPypi {
|
||||
inherit pname version;
|
||||
sha256 = "046ynyk9ldw35jbyw6jp0dmms735cd5i1f046f2lis8xv27bci3p";
|
||||
sha256 = "0jr3cxqiami9k07g2kmvfp54iafbcnd1d66l8fdnaqka5bc19wdw";
|
||||
};
|
||||
|
||||
# ansible_connection is already wrapped, so don't pass it through
|
||||
|
@ -69,6 +75,10 @@ buildPythonPackage rec {
|
|||
# internal import errors, missing dependencies
|
||||
doCheck = false;
|
||||
|
||||
passthru = {
|
||||
collections = ansible-collections;
|
||||
};
|
||||
|
||||
meta = with lib; {
|
||||
description = "Radically simple IT automation";
|
||||
homepage = "https://www.ansible.com";
|
||||
|
|
|
@ -14,21 +14,23 @@
|
|||
, xmltodict
|
||||
, withJunos ? false
|
||||
, withNetbox ? false
|
||||
|
||||
, version
|
||||
, sha256
|
||||
}:
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "ansible";
|
||||
version = "3.4.0";
|
||||
inherit version;
|
||||
format = "setuptools";
|
||||
|
||||
src = fetchPypi {
|
||||
inherit pname version;
|
||||
sha256 = "096rbgz730njk0pg8qnc27mmz110wqrw354ca9gasb7rqg0f4d6a";
|
||||
inherit pname version sha256;
|
||||
};
|
||||
|
||||
postPatch = ''
|
||||
# make ansible-base depend on ansible-collection, not the other way around
|
||||
sed -i '/ansible-base/d' setup.py
|
||||
sed -Ei '/ansible-(base|core)/d' setup.py
|
||||
'';
|
||||
|
||||
propagatedBuildInputs = lib.unique ([
|
||||
|
|
|
@ -1,8 +1,8 @@
|
|||
{ lib
|
||||
, callPackage
|
||||
, buildPythonPackage
|
||||
, fetchPypi
|
||||
, installShellFiles
|
||||
, ansible-collections
|
||||
, cryptography
|
||||
, jinja2
|
||||
, junit-xml
|
||||
|
@ -21,13 +21,19 @@
|
|||
, xmltodict
|
||||
}:
|
||||
|
||||
let
|
||||
ansible-collections = callPackage ./collections.nix {
|
||||
version = "4.1.0";
|
||||
sha256 = "0rrivq1g0vizah8zmf012lzig2xxfk5x1371k16s3nn4zfkwqqgm";
|
||||
};
|
||||
in
|
||||
buildPythonPackage rec {
|
||||
pname = "ansible-core";
|
||||
version = "2.11.1";
|
||||
version = "2.11.2";
|
||||
|
||||
src = fetchPypi {
|
||||
inherit pname version;
|
||||
sha256 = "sha256-fnWCepTUfRw+GTDXCPDvY3o6uaIfdXqvVd6rbp9HxoI=";
|
||||
sha256 = "1syadgzn5ww5bhq9s2py4h1hkh11h7aac5b37zi8rw2xfvdc7r2s";
|
||||
};
|
||||
|
||||
# ansible_connection is already wrapped, so don't pass it through
|
||||
|
@ -74,6 +80,10 @@ buildPythonPackage rec {
|
|||
# internal import errors, missing dependencies
|
||||
doCheck = false;
|
||||
|
||||
passthru = {
|
||||
collections = ansible-collections;
|
||||
};
|
||||
|
||||
meta = with lib; {
|
||||
description = "Radically simple IT automation";
|
||||
homepage = "https://www.ansible.com";
|
||||
|
|
|
@ -18,13 +18,13 @@
|
|||
|
||||
buildPythonPackage rec {
|
||||
pname = "ansible";
|
||||
version = "2.9.22";
|
||||
version = "2.9.23";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "ansible";
|
||||
repo = "ansible";
|
||||
rev = "v${version}";
|
||||
sha256 = "0gkv59cfxzs0ahgkxmmx9sqnfb2xqr10q4yh2662nbzajmvqmfgm";
|
||||
sha256 = "0mikykpzyqpmaiczz53f71mcyc4qvahi9ckn7wgfx7sw7s2z3skk";
|
||||
};
|
||||
|
||||
prePatch = ''
|
||||
|
|
|
@ -7,13 +7,13 @@
|
|||
|
||||
buildPythonPackage rec {
|
||||
pname = "resolvelib";
|
||||
version = "0.7.0";
|
||||
version = "0.7.1";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "sarugaku";
|
||||
repo = "resolvelib";
|
||||
rev = version;
|
||||
sha256 = "0r7cxwrfvpqz4kd7pdf8fsynzlmi6c754jd5hzd6vssc1zlyvvhx";
|
||||
sha256 = "1fqz75riagizihvf4j7wc3zjw6kmg1dd8sf49aszyml105kb33n8";
|
||||
};
|
||||
|
||||
checkInputs = [
|
||||
|
|
|
@ -2,14 +2,14 @@
|
|||
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "byacc";
|
||||
version = "20210520";
|
||||
version = "20210619";
|
||||
|
||||
src = fetchurl {
|
||||
urls = [
|
||||
"ftp://ftp.invisible-island.net/byacc/${pname}-${version}.tgz"
|
||||
"https://invisible-mirror.net/archives/byacc/${pname}-${version}.tgz"
|
||||
];
|
||||
sha256 = "sha256-19MdrnLLlzSC73+XVgmuQBzMEu4/sWi2emlSbGCv5D4=";
|
||||
sha256 = "sha256-rN1ggNz5NXMqCOyOjEwWHGZs1W2MSQc5xtu2JnpJjA4=";
|
||||
};
|
||||
|
||||
configureFlags = [
|
||||
|
|
|
@ -2,13 +2,13 @@
|
|||
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "atomicparsley";
|
||||
version = "20210124.204813.840499f";
|
||||
version = "20210617.200601.1ac7c08";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "wez";
|
||||
repo = pname;
|
||||
rev = version;
|
||||
sha256 = "sha256-/bkfgIWlQobaiad2WD7DUUrTwfYurP7YAINaLTwBEcE=";
|
||||
sha256 = "sha256-IhZe0vM41JhO8H79ZrRx4FRA4zfB6X0daC8QoE5MHmU=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [ cmake ];
|
||||
|
|
|
@ -441,8 +441,6 @@ in {
|
|||
|
||||
ansible-base = callPackage ../development/python-modules/ansible/base.nix { };
|
||||
|
||||
ansible-collections = callPackage ../development/python-modules/ansible/collections.nix { };
|
||||
|
||||
ansible-core = callPackage ../development/python-modules/ansible/core.nix { };
|
||||
|
||||
ansible-kernel = callPackage ../development/python-modules/ansible-kernel { };
|
||||
|
|
Loading…
Reference in a new issue