Merge branch 'master' into remove-opensmt

This commit is contained in:
Michael Raskin 2021-01-14 14:22:22 +00:00 committed by GitHub
commit f2210b7287
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
9080 changed files with 100965 additions and 53917 deletions

26
.github/CODEOWNERS vendored
View file

@ -26,17 +26,18 @@
/lib/asserts.nix @edolstra @nbp @Profpatsch
# Nixpkgs Internals
/default.nix @nbp
/pkgs/top-level/default.nix @nbp @Ericson2314
/pkgs/top-level/impure.nix @nbp @Ericson2314
/pkgs/top-level/stage.nix @nbp @Ericson2314 @matthewbauer
/pkgs/top-level/splice.nix @Ericson2314 @matthewbauer
/pkgs/top-level/release-cross.nix @Ericson2314 @matthewbauer
/pkgs/stdenv/generic @Ericson2314 @matthewbauer
/pkgs/stdenv/cross @Ericson2314 @matthewbauer
/pkgs/build-support/cc-wrapper @Ericson2314 @orivej
/pkgs/build-support/bintools-wrapper @Ericson2314 @orivej
/pkgs/build-support/setup-hooks @Ericson2314
/default.nix @nbp
/pkgs/top-level/default.nix @nbp @Ericson2314
/pkgs/top-level/impure.nix @nbp @Ericson2314
/pkgs/top-level/stage.nix @nbp @Ericson2314 @matthewbauer
/pkgs/top-level/splice.nix @Ericson2314 @matthewbauer
/pkgs/top-level/release-cross.nix @Ericson2314 @matthewbauer
/pkgs/stdenv/generic @Ericson2314 @matthewbauer
/pkgs/stdenv/cross @Ericson2314 @matthewbauer
/pkgs/build-support/cc-wrapper @Ericson2314 @orivej
/pkgs/build-support/bintools-wrapper @Ericson2314 @orivej
/pkgs/build-support/setup-hooks @Ericson2314
/pkgs/build-support/setup-hooks/auto-patchelf.sh @aszlig
# Nixpkgs build-support
/pkgs/build-support/writers @lassulus @Profpatsch
@ -220,3 +221,6 @@
/pkgs/development/compilers/go @kalbasit @Mic92 @zowoq
/pkgs/development/go-modules @kalbasit @Mic92 @zowoq
/pkgs/development/go-packages @kalbasit @Mic92 @zowoq
# Cinnamon
/pkgs/desktops/cinnamon @mkg20001

View file

@ -25,7 +25,7 @@ jobs:
- name: Fetch editorconfig-checker
if: env.PR_DIFF
env:
ECC_VERSION: "2.2.0"
ECC_VERSION: "2.3.1"
ECC_URL: "https://github.com/editorconfig-checker/editorconfig-checker/releases/download"
run: |
curl -sSf -O -L -C - "$ECC_URL/$ECC_VERSION/ec-linux-amd64.tar.gz" && \

28
.github/workflows/manual-nixos.yml vendored Normal file
View file

@ -0,0 +1,28 @@
name: "Build NixOS manual"
on:
pull_request_target:
branches:
- master
paths:
- 'nixos/**'
jobs:
nixos:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
with:
# pull_request_target checks out the base branch by default
ref: refs/pull/${{ github.event.pull_request.number }}/merge
- uses: cachix/install-nix-action@v12
with:
# explicitly enable sandbox
extra_nix_config: sandbox = true
- uses: cachix/cachix-action@v8
with:
# This cache is for the nixos/nixpkgs manual builds and should not be trusted or used elsewhere.
name: nixpkgs-ci
signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
- name: Building NixOS manual
run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.x86_64-linux

28
.github/workflows/manual-nixpkgs.yml vendored Normal file
View file

@ -0,0 +1,28 @@
name: "Build Nixpkgs manual"
on:
pull_request_target:
branches:
- master
paths:
- 'doc/**'
jobs:
nixpkgs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
with:
# pull_request_target checks out the base branch by default
ref: refs/pull/${{ github.event.pull_request.number }}/merge
- uses: cachix/install-nix-action@v12
with:
# explicitly enable sandbox
extra_nix_config: sandbox = true
- uses: cachix/cachix-action@v8
with:
# This cache is for the nixos/nixpkgs manual builds and should not be trusted or used elsewhere.
name: nixpkgs-ci
signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
- name: Building Nixpkgs manual
run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual

View file

@ -11,6 +11,10 @@ jobs:
runs-on: ubuntu-latest
if: github.repository_owner == 'NixOS' && github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase-staging')
steps:
- uses: peter-evans/create-or-update-comment@v1
with:
comment-id: ${{ github.event.comment.id }}
reactions: eyes
- uses: scherermichael-oss/action-has-permission@1.0.6
id: check-write-access
with:

View file

@ -1,4 +1,4 @@
Copyright (c) 2003-2020 Eelco Dolstra and the Nixpkgs/NixOS contributors
Copyright (c) 2003-2021 Eelco Dolstra and the Nixpkgs/NixOS contributors
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the

View file

@ -1,4 +1,4 @@
# Cataclysm: Dark Days Ahead
# Cataclysm: Dark Days Ahead {#cataclysm-dark-days-ahead}
## How to install Cataclysm DDA

View file

@ -2,12 +2,12 @@
## Configuring Emacs {#sec-emacs-config}
The Emacs package comes with some extra helpers to make it easier to configure. `emacsWithPackages` allows you to manage packages from ELPA. This means that you will not have to install that packages from within Emacs. For instance, if you wanted to use `company` `counsel`, `flycheck`, `ivy`, `magit`, `projectile`, and `use-package` you could use this as a `~/.config/nixpkgs/config.nix` override:
The Emacs package comes with some extra helpers to make it easier to configure. `emacs.pkgs.withPackages` allows you to manage packages from ELPA. This means that you will not have to install that packages from within Emacs. For instance, if you wanted to use `company` `counsel`, `flycheck`, `ivy`, `magit`, `projectile`, and `use-package` you could use this as a `~/.config/nixpkgs/config.nix` override:
```nix
{
packageOverrides = pkgs: with pkgs; {
myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
myEmacs = emacs.pkgs.withPackages (epkgs: (with epkgs.melpaStablePackages; [
company
counsel
flycheck
@ -84,7 +84,7 @@ You can install it like any other packages via `nix-env -iA myEmacs`. However, t
(projectile-global-mode))
'';
myEmacs = emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [
myEmacs = emacs.pkgs.withPackages (epkgs: (with epkgs.melpaStablePackages; [
(runCommand "default.el" {} ''
mkdir -p $out/share/emacs/site-lisp
cp ${myEmacsConfig} $out/share/emacs/site-lisp/default.el
@ -103,14 +103,14 @@ You can install it like any other packages via `nix-env -iA myEmacs`. However, t
This provides a fairly full Emacs start file. It will load in addition to the user's presonal config. You can always disable it by passing `-q` to the Emacs command.
Sometimes `emacsWithPackages` is not enough, as this package set has some priorities imposed on packages (with the lowest priority assigned to Melpa Unstable, and the highest for packages manually defined in `pkgs/top-level/emacs-packages.nix`). But you can't control this priorities when some package is installed as a dependency. You can override it on per-package-basis, providing all the required dependencies manually - but it's tedious and there is always a possibility that an unwanted dependency will sneak in through some other package. To completely override such a package you can use `overrideScope'`.
Sometimes `emacs.pkgs.withPackages` is not enough, as this package set has some priorities imposed on packages (with the lowest priority assigned to Melpa Unstable, and the highest for packages manually defined in `pkgs/top-level/emacs-packages.nix`). But you can't control this priorities when some package is installed as a dependency. You can override it on per-package-basis, providing all the required dependencies manually - but it's tedious and there is always a possibility that an unwanted dependency will sneak in through some other package. To completely override such a package you can use `overrideScope'`.
```nix
overrides = self: super: rec {
haskell-mode = self.melpaPackages.haskell-mode;
...
};
((emacsPackagesGen emacs).overrideScope' overrides).emacsWithPackages
((emacsPackagesFor emacs).overrideScope' overrides).emacs.pkgs.withPackages
(p: with p; [
# here both these package will use haskell-mode of our own choice
ghc-mod

View file

@ -0,0 +1,50 @@
# Fish {#sec-fish}
Fish is a "smart and user-friendly command line shell" with support for plugins.
## Vendor Fish scripts {#sec-fish-vendor}
Any package may ship its own Fish completions, configuration snippets, and
functions. Those should be installed to
`$out/share/fish/vendor_{completions,conf,functions}.d` respectively.
When the `programs.fish.enable` and
`programs.fish.vendor.{completions,config,functions}.enable` options from the
NixOS Fish module are set to true, those paths are symlinked in the current
system environment and automatically loaded by Fish.
## Packaging Fish plugins {#sec-fish-plugins-pkg}
While packages providing standalone executables belong to the top level,
packages which have the sole purpose of extending Fish belong to the
`fishPlugins` scope and should be registered in
`pkgs/shells/fish/plugins/default.nix`.
The `buildFishPlugin` utility function can be used to automatically copy Fish
scripts from `$src/{completions,conf,conf.d,functions}` to the standard vendor
installation paths. It also sets up the test environment so that the optional
`checkPhase` is executed in a Fish shell with other already packaged plugins
and package-local Fish functions specified in `checkPlugins` and
`checkFunctionDirs` respectively.
See `pkgs/shells/fish/plugins/pure.nix` for an example of Fish plugin package
using `buildFishPlugin` and running unit tests with the `fishtape` test runner.
## Fish wrapper {#sec-fish-wrapper}
The `wrapFish` package is a wrapper around Fish which can be used to create
Fish shells initialised with some plugins as well as completions, configuration
snippets and functions sourced from the given paths. This provides a convenient
way to test Fish plugins and scripts without having to alter the environment.
```nix
wrapFish {
pluginPkgs = with fishPlugins; [ pure foreign-env ];
completionDirs = [];
functionDirs = [];
confDirs = [ "/path/to/some/fish/init/dir/" ];
}
```

View file

@ -11,6 +11,7 @@
<xi:include href="elm.xml" />
<xi:include href="emacs.section.xml" />
<xi:include href="firefox.section.xml" />
<xi:include href="fish.section.xml" />
<xi:include href="ibus.xml" />
<xi:include href="kakoune.section.xml" />
<xi:include href="linux.section.xml" />

View file

@ -37,7 +37,7 @@ This works just like `runCommand`. The only difference is that it also provides
Variant of `runCommand` that forces the derivation to be built locally, it is not substituted. This is intended for very cheap commands (<1s execution time). It saves on the network roundrip and can speed up a build.
::: {.note}
::: note
This sets [`allowSubstitutes` to `false`](https://nixos.org/nix/manual/#adv-attr-allowSubstitutes), so only use `runCommandLocal` if you are certain the user will always have a builder for the `system` of the derivation. This should be true for most trivial use cases (e.g. just copying some files to a different location or adding symlinks), because there the `system` is usually the same as `builtins.currentSystem`.
:::

View file

@ -178,6 +178,15 @@ args.stdenv.mkDerivation (args // {
</programlisting>
</para>
</listitem>
<listitem>
<para>
Prefer using the top-level <varname>lib</varname> over its alias
<literal>stdenv.lib</literal>. <varname>lib</varname> is unrelated to
<varname>stdenv</varname>, and so <literal>stdenv.lib</literal> should only
be used as a convenience alias when developing to avoid having to modify
the function inputs just to test something out.
</para>
</listitem>
</itemizedlist>
</section>
<section xml:id="sec-package-naming">

View file

@ -1,9 +1,4 @@
---
title: Agda
author: Alex Rice (alexarice)
date: 2020-01-06
---
# Agda
# Agda {#agda}
## How to use Agda

View file

@ -1,9 +1,4 @@
---
title: Android
author: Sander van der Burg
date: 2018-11-18
---
# Android
# Android {#android}
The Android build environment provides three major features and a number of
supporting features.
@ -18,21 +13,19 @@ with import <nixpkgs> {};
let
androidComposition = androidenv.composeAndroidPackages {
toolsVersion = "25.2.5";
platformToolsVersion = "27.0.1";
buildToolsVersions = [ "27.0.3" ];
toolsVersion = "26.1.1";
platformToolsVersion = "30.0.5";
buildToolsVersions = [ "30.0.3" ];
includeEmulator = false;
emulatorVersion = "27.2.0";
platformVersions = [ "24" ];
emulatorVersion = "30.3.4";
platformVersions = [ "28" "29" "30" ];
includeSources = false;
includeDocs = false;
includeSystemImages = false;
systemImageTypes = [ "default" ];
abiVersions = [ "armeabi-v7a" ];
lldbVersions = [ "2.0.2558144" ];
cmakeVersions = [ "3.6.4111459" ];
includeNDK = false;
ndkVersion = "16.1.4479499";
systemImageTypes = [ "google_apis_playstore" ];
abiVersions = [ "armeabi-v7a" "arm64-v8a" ];
cmakeVersions = [ "3.10.2" ];
includeNDK = true;
ndkVersion = "22.0.7026061";
useGoogleAPIs = false;
useGoogleTVAddOns = false;
includeExtras = [
@ -51,13 +44,11 @@ The following parameters are supported:
* `toolsVersion`, specifies the version of the tools package to use
* `platformsToolsVersion` specifies the version of the `platform-tools` plugin
* `buildToolsVersion` specifies the versions of the `build-tools` plugins to
* `buildToolsVersions` specifies the versions of the `build-tools` plugins to
use.
* `includeEmulator` specifies whether to deploy the emulator package (`false`
by default). When enabled, the version of the emulator to deploy can be
specified by setting the `emulatorVersion` parameter.
* `includeDocs` specifies whether the documentation catalog should be included.
* `lldbVersions` specifies what LLDB versions should be deployed.
* `cmakeVersions` specifies which CMake versions should be deployed.
* `includeNDK` specifies that the Android NDK bundle should be included.
Defaults to: `false`.
@ -87,6 +78,38 @@ For each requested system image we can specify the following options:
Most of the function arguments have reasonable default settings.
You can specify license names:
* `extraLicenses` is a list of of license names.
You can get these names from repo.json or `querypackages.sh licenses`. The SDK
license (`android-sdk-license`) is accepted for you if you set accept_license
to true. If you are doing something like working with preview SDKs, you will
want to add `android-sdk-preview-license` or whichever license applies here.
Additionally, you can override the repositories that composeAndroidPackages will
pull from:
* `repoJson` specifies a path to a generated repo.json file. You can generate this
by running `generate.sh`, which in turn will call into `mkrepo.rb`.
* `repoXmls` is an attribute set containing paths to repo XML files. If specified,
it takes priority over `repoJson`, and will trigger a local build writing out a
repo.json to the Nix store based on the given repository XMLs.
```nix
repoXmls = {
packages = [ ./xml/repository2-1.xml ];
images = [
./xml/android-sys-img2-1.xml
./xml/android-tv-sys-img2-1.xml
./xml/android-wear-sys-img2-1.xml
./xml/android-wear-cn-sys-img2-1.xml
./xml/google_apis-sys-img2-1.xml
./xml/google_apis_playstore-sys-img2-1.xml
];
addons = [ ./xml/addon2-1.xml ];
};
```
When building the above expression with:
```bash
@ -109,8 +132,8 @@ in
androidComposition.platform-tools
```
Using predefine Android package compositions
--------------------------------------------
Using predefined Android package compositions
---------------------------------------------
In addition to composing an Android package set manually, it is also possible
to use a predefined composition that contains all basic packages for a specific
Android version, such as version 9.0 (API-level 28).
@ -214,27 +237,104 @@ androidenv.emulateApp {
In addition to prebuilt APKs, you can also bind the APK parameter to a
`buildApp {}` function invocation shown in the previous example.
Notes on environment variables in Android projects
--------------------------------------------------
* `ANDROID_SDK_ROOT` should point to the Android SDK. In your Nix expressions, this should be
`${androidComposition.androidsdk}/libexec/android-sdk`. Note that `ANDROID_HOME` is deprecated,
but if you rely on tools that need it, you can export it too.
* `ANDROID_NDK_ROOT` should point to the Android NDK, if you're doing NDK development.
In your Nix expressions, this should be `${ANDROID_SDK_ROOT}/ndk-bundle`.
If you are running the Android Gradle plugin, you need to export GRADLE_OPTS to override aapt2
to point to the aapt2 binary in the Nix store as well, or use a FHS environment so the packaged
aapt2 can run. If you don't want to use a FHS environment, something like this should work:
```nix
let
buildToolsVersion = "30.0.3";
# Use buildToolsVersion when you define androidComposition
androidComposition = <...>;
in
pkgs.mkShell rec {
ANDROID_SDK_ROOT = "${androidComposition.androidsdk}/libexec/android-sdk";
ANDROID_NDK_ROOT = "${ANDROID_SDK_ROOT}/ndk-bundle";
# Use the same buildToolsVersion here
GRADLE_OPTS = "-Dorg.gradle.project.android.aapt2FromMavenOverride=${ANDROID_SDK_ROOT}/build-tools/${buildToolsVersion}/aapt2";
}
```
If you are using cmake, you need to add it to PATH in a shell hook or FHS env profile.
The path is suffixed with a build number, but properly prefixed with the version.
So, something like this should suffice:
```nix
let
cmakeVersion = "3.10.2";
# Use cmakeVersion when you define androidComposition
androidComposition = <...>;
in
pkgs.mkShell rec {
ANDROID_SDK_ROOT = "${androidComposition.androidsdk}/libexec/android-sdk";
ANDROID_NDK_ROOT = "${ANDROID_SDK_ROOT}/ndk-bundle";
# Use the same cmakeVersion here
shellHook = ''
export PATH="$(echo "$ANDROID_SDK_ROOT/cmake/${cmakeVersion}".*/bin):$PATH"
'';
}
```
Note that running Android Studio with ANDROID_SDK_ROOT set will automatically write a
`local.properties` file with `sdk.dir` set to $ANDROID_SDK_ROOT if one does not already
exist. If you are using the NDK as well, you may have to add `ndk.dir` to this file.
An example shell.nix that does all this for you is provided in examples/shell.nix.
This shell.nix includes a shell hook that overwrites local.properties with the correct
sdk.dir and ndk.dir values. This will ensure that the SDK and NDK directories will
both be correct when you run Android Studio inside nix-shell.
Notes on improving build.gradle compatibility
---------------------------------------------
Ensure that your buildToolsVersion and ndkVersion match what is declared in androidenv.
If you are using cmake, make sure its declared version is correct too.
Otherwise, you may get cryptic errors from aapt2 and the Android Gradle plugin warning
that it cannot install the build tools because the SDK directory is not writeable.
```gradle
android {
buildToolsVersion "30.0.3"
ndkVersion = "22.0.7026061"
externalNativeBuild {
cmake {
version "3.10.2"
}
}
}
```
Querying the available versions of each plugin
----------------------------------------------
When using any of the previously shown functions, it may be a bit inconvenient
to find out what options are supported, since the Android SDK provides many
plugins.
repo.json provides all the options in one file now.
A shell script in the `pkgs/development/mobile/androidenv/` sub directory can be used to retrieve all
A shell script in the `pkgs/development/mobile/androidenv/` subdirectory can be used to retrieve all
possible options:
```bash
sh ./querypackages.sh packages build-tools
./querypackages.sh packages
```
The above command-line instruction queries all build-tools versions in the
generated `packages.nix` expression.
The above command-line instruction queries all package versions in repo.json.
Updating the generated expressions
----------------------------------
Most of the Nix expressions are generated from XML files that the Android
package manager uses. To update the expressions run the `generate.sh` script
that is stored in the `pkgs/development/mobile/androidenv/` sub directory:
repo.json is generated from XML files that the Android Studio package manager uses.
To update the expressions run the `generate.sh` script that is stored in the
`pkgs/development/mobile/androidenv/` subdirectory:
```bash
./generate.sh

View file

@ -1,40 +1,79 @@
# Coq {#sec-language-coq}
# Coq and coq packages {#sec-language-coq}
Coq libraries should be installed in `$(out)/lib/coq/${coq.coq-version}/user-contrib/`. Such directories are automatically added to the `$COQPATH` environment variable by the hook defined in the Coq derivation.
## Coq derivation: `coq`
Some extensions (plugins) might require OCaml and sometimes other OCaml packages. The `coq.ocamlPackages` attribute can be used to depend on the same package set Coq was built against.
The Coq derivation is overridable through the `coq.override overrides`, where overrides is an attribute set which contains the arguments to override. We recommend overriding either of the following
Coq libraries may be compatible with some specific versions of Coq only. The `compatibleCoqVersions` attribute is used to precisely select those versions of Coq that are compatible with this derivation.
* `version` (optional, defaults to the latest version of Coq selected for nixpkgs, see `pkgs/top-level/coq-packages` to witness this choice), which follows the conventions explained in the `coqPackages` section below,
* `customOCamlPackage` (optional, defaults to `null`, which lets Coq choose a version automatically), which can be set to any of the ocaml packages attribute of `ocaml-ng` (such as `ocaml-ng.ocamlPackages_4_10` which is the default for Coq 8.11 for example).
* `coq-version` (optional, defaults to the short version e.g. "8.10"), is a version number of the form "x.y" that indicates which Coq's version build behavior to mimic when using a source which is not a release. E.g. `coq.override { version = "d370a9d1328a4e1cdb9d02ee032f605a9d94ec7a"; coq-version = "8.10"; }`.
Here is a simple package example. It is a pure Coq library, thus it depends on Coq. It builds on the Mathematical Components library, thus it also takes `mathcomp` as `buildInputs`. Its `Makefile` has been generated using `coq_makefile` so we only have to set the `$COQLIB` variable at install time.
## Coq packages attribute sets: `coqPackages`
The recommended way of defining a derivation for a Coq library, is to use the `coqPackages.mkCoqDerivation` function, which is essentially a specialization of `mkDerivation` taking into account most of the specifics of Coq libraries. The following attributes are supported:
* `pname` (required) is the name of the package,
* `version` (optional, defaults to `null`), is the version to fetch and build,
this attribute is interpreted in several ways depending on its type and pattern:
* if it is a known released version string, i.e. from the `release` attribute below, the according release is picked, and the `version` attribute of the resulting derivation is set to this release string,
* if it is a majorMinor `"x.y"` prefix of a known released version (as defined above), then the latest `"x.y.z"` known released version is selected (for the ordering given by `versionAtLeast`),
* if it is a path or a string representing an absolute path (i.e. starting with `"/"`), the provided path is selected as a source, and the `version` attribute of the resulting derivation is set to `"dev"`,
* if it is a string of the form `owner:branch` then it tries to download the `branch` of owner `owner` for a project of the same name using the same vcs, and the `version` attribute of the resulting derivation is set to `"dev"`, additionally if the owner is not provided (i.e. if the `owner:` prefix is missing), it defaults to the original owner of the package (see below),
* if it is a string of the form `"#N"`, and the domain is github, then it tries to download the current head of the pull request `#N` from github,
* `defaultVersion` (optional). Coq libraries may be compatible with some specific versions of Coq only. The `defaultVersion` attribute is used when no `version` is provided (or if `version = null`) to select the version of the library to use by default, depending on the context. This selection will mainly depend on a `coq` version number but also possibly on other packages versions (e.g. `mathcomp`). If its value ends up to be `null`, the package is marked for removal in end-user `coqPackages` attribute set.
* `release` (optional, defaults to `{}`), lists all the known releases of the library and for each of them provides an attribute set with at least a `sha256` attribute (you may use the shell command `nix-prefetch-url --unpack <archive-url>` to find it, where `<archive-url>` is for example `https://github.com/owner/repo/archive/version.tar.gz`), each attribute set of the list of releases also takes optional overloading arguments for the fetcher as below (i.e.`domain`, `owner`, `repo`, `rev` assuming the default fetcher is used) and optional overrides for the result of the fetcher (i.e. `version` and `src`).
* `fetcher` (optional, default to a generic fetching mechanism supporting github or gitlab based infrastructures), is a function that takes at least an `owner`, a `repo`, a `rev`, and a `sha256` and returns an attribute set with a `version` and `src`.
* `repo` (optional, defaults to the value of `pname`),
* `owner` (optional, defaults to `"coq-community"`).
* `domain` (optional, defaults to `"github.com"`), domains including the strings `"github"` or `"gitlab"` in their names are automatically supported, otherwise, one must change the `fetcher` argument to support them (cf `pkgs/development/coq-modules/heq/default.nix` for an example),
* `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
* `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
* `namePrefix` (optional), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
* `extraBuildInputs` (optional), by default `buildInputs` just contains `coq`, this allows to add more build inputs,
* `mlPlugin` (optional, defaults to `false`). Some extensions (plugins) might require OCaml and sometimes other OCaml packages. Standard dependencies can be added by setting the current option to `true`. For a finer grain control, the `coq.ocamlPackages` attribute can be used in `extraBuildInputs` to depend on the same package set Coq was built against.
* `enableParallelBuilding` (optional, defaults to `true`), since it is activated by default, we provide a way to disable it.
* `extraInstallFlags` (optional), allows to extend `installFlags` which initializes the variable `COQMF_COQLIB` so as to install in the proper subdirectory. Indeed Coq libraries should be installed in `$(out)/lib/coq/${coq.coq-version}/user-contrib/`. Such directories are automatically added to the `$COQPATH` environment variable by the hook defined in the Coq derivation.
* `setCOQBIN` (optional, defaults to `true`), by default, the environment variable `$COQBIN` is set to the current Coq's binary, but one can disable this behavior by setting it to `false`,
* `useMelquiondRemake` (optional, default to `null`) is an attribute set, which, if given, overloads the `preConfigurePhases`, `configureFlags`, `buildPhase`, and `installPhase` attributes of the derivation for a specific use in libraries using `remake` as set up by Guillaume Melquiond for `flocq`, `gappalib`, `interval`, and `coquelicot` (see the corresponding derivation for concrete examples of use of this option). For backward compatibility, the attribute `useMelquiondRemake.logpath` must be set to the logical root of the library (otherwise, one can pass `useMelquiondRemake = {}` to activate this without backward compatibility).
* `dropAttrs`, `keepAttrs`, `dropDerivationAttrs` are all optional and allow to tune which attribute is added or removed from the final call to `mkDerivation`.
It also takes other standard `mkDerivation` attributes, they are added as such, except for `meta` which extends an automatically computed `meta` (where the `platform` is the same as `coq` and the homepage is automatically computed).
Here is a simple package example. It is a pure Coq library, thus it depends on Coq. It builds on the Mathematical Components library, thus it also takes some `mathcomp` derivations as `extraBuildInputs`.
```nix
{ stdenv, fetchFromGitHub, coq, mathcomp }:
stdenv.mkDerivation rec {
name = "coq${coq.coq-version}-multinomials-${version}";
version = "1.0";
src = fetchFromGitHub {
owner = "math-comp";
repo = "multinomials";
rev = version;
sha256 = "1qmbxp1h81cy3imh627pznmng0kvv37k4hrwi2faa101s6bcx55m";
{ coq, mkCoqDerivation, mathcomp, mathcomp-finmap, mathcomp-bigenough,
lib, version ? null }:
with lib; mkCoqDerivation {
/* namePrefix leads to e.g. `name = coq8.11-mathcomp1.11-multinomials-1.5.2` */
namePrefix = [ "coq" "mathcomp" ];
pname = "multinomials";
owner = "math-comp";
inherit version;
defaultVersion = with versions; switch [ coq.version mathcomp.version ] [
{ cases = [ (range "8.7" "8.12") "1.11.0" ]; out = "1.5.2"; }
{ cases = [ (range "8.7" "8.11") (range "1.8" "1.10") ]; out = "1.5.0"; }
{ cases = [ (range "8.7" "8.10") (range "1.8" "1.10") ]; out = "1.4"; }
{ cases = [ "8.6" (range "1.6" "1.7") ]; out = "1.1"; }
] null;
release = {
"1.5.2".sha256 = "15aspf3jfykp1xgsxf8knqkxv8aav2p39c2fyirw7pwsfbsv2c4s";
"1.5.1".sha256 = "13nlfm2wqripaq671gakz5mn4r0xwm0646araxv0nh455p9ndjs3";
"1.5.0".sha256 = "064rvc0x5g7y1a0nip6ic91vzmq52alf6in2bc2dmss6dmzv90hw";
"1.5.0".rev = "1.5";
"1.4".sha256 = "0vnkirs8iqsv8s59yx1fvg1nkwnzydl42z3scya1xp1b48qkgn0p";
"1.3".sha256 = "0l3vi5n094nx3qmy66hsv867fnqm196r8v605kpk24gl0aa57wh4";
"1.2".sha256 = "1mh1w339dslgv4f810xr1b8v2w7rpx6fgk9pz96q0fyq49fw2xcq";
"1.1".sha256 = "1q8alsm89wkc0lhcvxlyn0pd8rbl2nnxg81zyrabpz610qqjqc3s";
"1.0".sha256 = "1qmbxp1h81cy3imh627pznmng0kvv37k4hrwi2faa101s6bcx55m";
};
buildInputs = [ coq ];
propagatedBuildInputs = [ mathcomp ];
installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
propagatedBuildInputs =
[ mathcomp.ssreflect mathcomp.algebra mathcomp-finmap mathcomp-bigenough ];
meta = {
description = "A Coq/SSReflect Library for Monoidal Rings and Multinomials";
inherit (src.meta) homepage;
license = stdenv.lib.licenses.cecill-b;
inherit (coq.meta) platforms;
};
passthru = {
compatibleCoqVersions = v: builtins.elem v [ "8.5" "8.6" "8.7" ];
license = licenses.cecill-c;
};
}
```

View file

@ -1,4 +1,4 @@
# Crystal
# Crystal {#crystal}
## Building a Crystal package

View file

@ -1,4 +1,4 @@
# Emscripten
# Emscripten {#emscripten}
[Emscripten](https://github.com/kripken/emscripten): An LLVM-to-JavaScript Compiler
@ -102,7 +102,7 @@ See the `zlib` example:
echo "================= /testing zlib using node ================="
'';
postPatch = pkgs.stdenv.lib.optionalString pkgs.stdenv.isDarwin ''
postPatch = pkgs.lib.optionalString pkgs.stdenv.isDarwin ''
substituteInPlace configure \
--replace '/usr/bin/libtool' 'ar' \
--replace 'AR="libtool"' 'AR="ar"' \

View file

@ -1,10 +1,4 @@
---
title: User's Guide for Haskell in Nixpkgs
author: Peter Simons
date: 2015-06-01
---
# Haskell
# Haskell {#haskell}
The documentation for the Haskell infrastructure is published at
<https://haskell4nix.readthedocs.io/>. The source code for that

View file

@ -1,4 +1,4 @@
# Idris
# Idris {#idris}
## Installing Idris

View file

@ -1,9 +1,4 @@
---
title: iOS
author: Sander van der Burg
date: 2019-11-10
---
# iOS
# iOS {#ios}
This component is basically a wrapper/workaround that makes it possible to
expose an Xcode installation as a Nix package by means of symlinking to the

View file

@ -1,10 +1,4 @@
---
title: Lua
author: Matthieu Coudron
date: 2019-02-05
---
# User's Guide to Lua Infrastructure
# User's Guide to Lua Infrastructure {#users-guide-to-lua-infrastructure}
## Using Lua
@ -187,7 +181,7 @@ luaposix = buildLuarocksPackage {
disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
propagatedBuildInputs = [ bit32 lua std_normalize ];
meta = with stdenv.lib; {
meta = with lib; {
homepage = "https://github.com/luaposix/luaposix/";
description = "Lua bindings for POSIX";
maintainers = with maintainers; [ vyp lblasc ];
@ -249,4 +243,3 @@ Following rules should be respected:
* Make sure libraries build for all Lua interpreters.
* Commit names of Lua libraries should reflect that they are Lua libraries, so write for example `luaPackages.luafilesystem: 1.11 -> 1.12`.

View file

@ -1,10 +1,4 @@
---
title: Maven
author: Farid Zakaria
date: 2020-10-15
---
# Maven
# Maven {#maven}
Maven is a well-known build tool for the Java ecosystem however it has some challenges when integrating into the Nix build system.
@ -122,7 +116,7 @@ The first step will be to build the Maven project as a fixed-output derivation i
> Traditionally the Maven repository is at `~/.m2/repository`. We will override this to be the `$out` directory.
```nix
{ stdenv, maven }:
{ stdenv, lib, maven }:
stdenv.mkDerivation {
name = "maven-repository";
buildInputs = [ maven ];
@ -145,7 +139,7 @@ stdenv.mkDerivation {
outputHashAlgo = "sha256";
outputHashMode = "recursive";
# replace this with the correct SHA256
outputHash = stdenv.lib.fakeSha256;
outputHash = lib.fakeSha256;
}
```

View file

@ -1,5 +1,5 @@
Node.js
=======
# Node.js {#node.js}
The `pkgs/development/node-packages` folder contains a generated collection of
[NPM packages](https://npmjs.com/) that can be installed with the Nix package
manager.

View file

@ -7,7 +7,7 @@ Given that most of the OCaml ecosystem is now built with dune, nixpkgs includes
Here is a simple package example. It defines an (optional) attribute `minimumOCamlVersion` that will be used to throw a descriptive evaluation error if building with an older OCaml is attempted. It uses the `fetchFromGitHub` fetcher to get its source. It sets the `doCheck` (optional) attribute to `true` which means that tests will be run with `dune runtest -p angstrom` after the build (`dune build -p angstrom`) is complete. It uses `alcotest` as a build input (because it is needed to run the tests) and `bigstringaf` and `result` as propagated build inputs (thus they will also be available to libraries depending on this library). The library will be installed using the `angstrom.install` file that dune generates.
```nix
{ stdenv
{ lib
, fetchFromGitHub
, buildDunePackage
, alcotest
@ -35,8 +35,8 @@ buildDunePackage rec {
meta = {
homepage = "https://github.com/inhabitedtype/angstrom";
description = "OCaml parser combinators built for speed and memory efficiency";
license = stdenv.lib.licenses.bsd3;
maintainers = with stdenv.lib.maintainers; [ sternenseemann ];
license = lib.licenses.bsd3;
maintainers = with lib.maintainers; [ sternenseemann ];
};
}
```
@ -44,7 +44,7 @@ buildDunePackage rec {
Here is a second example, this time using a source archive generated with `dune-release`. It is a good idea to use this archive when it is available as it will usually contain substituted variables such as a `%%VERSION%%` field. This library does not depend on any other OCaml library and no tests are run after building it.
```nix
{ stdenv
{ lib
, fetchurl
, buildDunePackage
}:
@ -60,7 +60,7 @@ buildDunePackage rec {
sha256 = "1msg3vycd3k8qqj61sc23qks541cxpb97vrnrvrhjnqxsqnh6ygq";
};
meta = with stdenv.lib; {
meta = with lib; {
homepage = "https://github.com/flowtype/ocaml-wtf8";
description = "WTF-8 is a superset of UTF-8 that allows unpaired surrogates.";
license = licenses.mit;

View file

@ -110,7 +110,7 @@ ClassC3Componentised = buildPerlPackage rec {
On Darwin, if a script has too many `-Idir` flags in its first line (its “shebang line”), it will not run. This can be worked around by calling the `shortenPerlShebang` function from the `postInstall` phase:
```nix
{ stdenv, buildPerlPackage, fetchurl, shortenPerlShebang }:
{ stdenv, lib, buildPerlPackage, fetchurl, shortenPerlShebang }:
ImageExifTool = buildPerlPackage {
pname = "Image-ExifTool";
@ -121,8 +121,8 @@ ImageExifTool = buildPerlPackage {
sha256 = "0d8v48y94z8maxkmw1rv7v9m0jg2dc8xbp581njb6yhr7abwqdv3";
};
buildInputs = stdenv.lib.optional stdenv.isDarwin shortenPerlShebang;
postInstall = stdenv.lib.optional stdenv.isDarwin ''
buildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;
postInstall = lib.optional stdenv.isDarwin ''
shortenPerlShebang $out/bin/exiftool
'';
};
@ -151,7 +151,7 @@ $ nix-generate-from-cpan XML::Simple
propagatedBuildInputs = [ XMLNamespaceSupport XMLSAX XMLSAXExpat ];
meta = {
description = "An API for simple XML files";
license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
license = with lib.licenses; [ artistic1 gpl1Plus ];
};
};
```

View file

@ -1,4 +1,4 @@
# Python
# Python {#python}
## User Guide

View file

@ -1,5 +1,4 @@
R
=
# R {#r}
## Installation
@ -106,6 +105,12 @@ mv cran-packages.nix.new cran-packages.nix
Rscript generate-r-packages.R bioc > bioc-packages.nix.new
mv bioc-packages.nix.new bioc-packages.nix
Rscript generate-r-packages.R bioc-annotation > bioc-annotation-packages.nix.new
mv bioc-annotation-packages.nix.new bioc-annotation-packages.nix
Rscript generate-r-packages.R bioc-experiment > bioc-experiment-packages.nix.new
mv bioc-experiment-packages.nix.new bioc-experiment-packages.nix
```
`generate-r-packages.R <repo>` reads `<repo>-packages.nix`, therefor the renaming.

View file

@ -1,10 +1,4 @@
---
title: Rust
author: Matthias Beyer
date: 2017-03-05
---
# Rust
# Rust {#rust}
To install the rust compiler and cargo put
@ -27,18 +21,18 @@ Rust applications are packaged by using the `buildRustPackage` helper from `rust
```
rustPlatform.buildRustPackage rec {
pname = "ripgrep";
version = "11.0.2";
version = "12.1.1";
src = fetchFromGitHub {
owner = "BurntSushi";
repo = pname;
rev = version;
sha256 = "1iga3320mgi7m853la55xip514a3chqsdi1a1rwv25lr9b1p7vd3";
sha256 = "1hqps7l5qrjh9f914r5i6kmcz6f1yb951nv4lby0cjnp5l253kps";
};
cargoSha256 = "17ldqr3asrdcsh4l29m3b5r37r5d0b3npq1lrgjmxb6vlx6a36qh";
cargoSha256 = "03wf9r2csi6jpa7v5sw5lpxkrk4wfzwmzx7k3991q3bdjzcwnnwp";
meta = with stdenv.lib; {
meta = with lib; {
description = "A fast line-oriented regex search tool, similar to ag and ack";
homepage = "https://github.com/BurntSushi/ripgrep";
license = licenses.unlicense;
@ -47,10 +41,31 @@ rustPlatform.buildRustPackage rec {
}
```
`buildRustPackage` requires a `cargoSha256` attribute which is computed over
all crate sources of this package. Currently it is obtained by inserting a
fake checksum into the expression and building the package once. The correct
checksum can then be taken from the failed build.
`buildRustPackage` requires either the `cargoSha256` or the
`cargoHash` attribute which is computed over all crate sources of this
package. `cargoHash256` is used for traditional Nix SHA-256 hashes,
such as the one in the example above. `cargoHash` should instead be
used for [SRI](https://www.w3.org/TR/SRI/) hashes. For example:
```
cargoHash = "sha256-l1vL2ZdtDRxSGvP0X/l3nMw8+6WF67KPutJEzUROjg8=";
```
Both types of hashes are permitted when contributing to nixpkgs. The
Cargo hash is obtained by inserting a fake checksum into the
expression and building the package once. The correct checksum can
then be taken from the failed build. A fake hash can be used for
`cargoSha256` as follows:
```
cargoSha256 = lib.fakeSha256;
```
For `cargoHash` you can use:
```
cargoHash = lib.fakeHash;
```
Per the instructions in the [Cargo Book](https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html)
best practices guide, Rust applications should always commit the `Cargo.lock`

View file

@ -1,4 +1,3 @@
# TeX Live {#sec-language-texlive}
Since release 15.09 there is a new TeX Live packaging that lives entirely under attribute `texlive`.

View file

@ -1,9 +1,4 @@
---
title: Titanium
author: Sander van der Burg
date: 2018-11-18
---
# Titanium
# Titanium {#titanium}
The Nixpkgs repository contains facilities to deploy a variety of versions of
the [Titanium SDK](https://www.appcelerator.com) versions, a cross-platform

View file

@ -1,9 +1,4 @@
---
title: User's Guide for Vim in Nixpkgs
author: Marc Weber
date: 2016-06-25
---
# Vim
# Vim {#vim}
Both Neovim and Vim can be configured to include your favorite plugins
and additional libraries.

View file

@ -1,10 +1,4 @@
---
title: Preface
author: Frederik Rietdijk
date: 2015-11-25
---
# Preface
# Preface {#preface}
The Nix Packages collection (Nixpkgs) is a set of thousands of packages for the
[Nix package manager](https://nixos.org/nix/), released under a

View file

@ -5,7 +5,7 @@
<para>
Nix packages can declare <emphasis>meta-attributes</emphasis> that contain information about a package such as a description, its homepage, its license, and so on. For instance, the GNU Hello package has a <varname>meta</varname> declaration like this:
<programlisting>
meta = with stdenv.lib; {
meta = with lib; {
description = "A program that produces a familiar, friendly greeting";
longDescription = ''
GNU Hello is a program that prints "Hello, world!" when you run it.
@ -155,7 +155,7 @@ hello-2.3 A program that produces a familiar, friendly greeting
<itemizedlist>
<listitem>
<para>
Single license referenced by attribute (preferred) <literal>stdenv.lib.licenses.gpl3Only</literal>.
Single license referenced by attribute (preferred) <literal>lib.licenses.gpl3Only</literal>.
</para>
</listitem>
<listitem>
@ -170,7 +170,7 @@ hello-2.3 A program that produces a familiar, friendly greeting
</listitem>
<listitem>
<para>
Multiple licenses referenced by attribute (preferred) <literal>with stdenv.lib.licenses; [ asl20 free ofl ]</literal>.
Multiple licenses referenced by attribute (preferred) <literal>with lib.licenses; [ asl20 free ofl ]</literal>.
</para>
</listitem>
<listitem>
@ -211,9 +211,9 @@ hello-2.3 A program that produces a familiar, friendly greeting
<para>
The list of Nix platform types on which the package is supported. Hydra builds packages according to the platform specified. If no platform is specified, the package does not have prebuilt binaries. An example is:
<programlisting>
meta.platforms = stdenv.lib.platforms.linux;
meta.platforms = lib.platforms.linux;
</programlisting>
Attribute Set <varname>stdenv.lib.platforms</varname> defines <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/lib/systems/doubles.nix"> various common lists</link> of platforms types.
Attribute Set <varname>lib.platforms</varname> defines <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/lib/systems/doubles.nix"> various common lists</link> of platforms types.
</para>
</listitem>
</varlistentry>
@ -262,7 +262,7 @@ meta.platforms = stdenv.lib.platforms.linux;
<para>
The list of Nix platform types for which the Hydra instance at <literal>hydra.nixos.org</literal> will build the package. (Hydra is the Nix-based continuous build system.) It defaults to the value of <varname>meta.platforms</varname>. Thus, the only reason to set <varname>meta.hydraPlatforms</varname> is if you want <literal>hydra.nixos.org</literal> to build the package on a subset of <varname>meta.platforms</varname>, or not at all, e.g.
<programlisting>
meta.platforms = stdenv.lib.platforms.linux;
meta.platforms = lib.platforms.linux;
meta.hydraPlatforms = [];
</programlisting>
</para>
@ -294,7 +294,7 @@ meta.hydraPlatforms = [];
<title>Licenses</title>
<para>
The <varname>meta.license</varname> attribute should preferrably contain a value from <varname>stdenv.lib.licenses</varname> defined in <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix"> <filename>nixpkgs/lib/licenses.nix</filename></link>, or in-place license description of the same format if the license is unlikely to be useful in another expression.
The <varname>meta.license</varname> attribute should preferrably contain a value from <varname>lib.licenses</varname> defined in <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/lib/licenses.nix"> <filename>nixpkgs/lib/licenses.nix</filename></link>, or in-place license description of the same format if the license is unlikely to be useful in another expression.
</para>
<para>
@ -302,7 +302,7 @@ meta.hydraPlatforms = [];
<variablelist>
<varlistentry>
<term>
<varname>stdenv.lib.licenses.free</varname>, <varname>"free"</varname>
<varname>lib.licenses.free</varname>, <varname>"free"</varname>
</term>
<listitem>
<para>
@ -312,7 +312,7 @@ meta.hydraPlatforms = [];
</varlistentry>
<varlistentry>
<term>
<varname>stdenv.lib.licenses.unfreeRedistributable</varname>, <varname>"unfree-redistributable"</varname>
<varname>lib.licenses.unfreeRedistributable</varname>, <varname>"unfree-redistributable"</varname>
</term>
<listitem>
<para>
@ -325,7 +325,7 @@ meta.hydraPlatforms = [];
</varlistentry>
<varlistentry>
<term>
<varname>stdenv.lib.licenses.unfree</varname>, <varname>"unfree"</varname>
<varname>lib.licenses.unfree</varname>, <varname>"unfree"</varname>
</term>
<listitem>
<para>
@ -335,7 +335,7 @@ meta.hydraPlatforms = [];
</varlistentry>
<varlistentry>
<term>
<varname>stdenv.lib.licenses.unfreeRedistributableFirmware</varname>, <varname>"unfree-redistributable-firmware"</varname>
<varname>lib.licenses.unfreeRedistributableFirmware</varname>, <varname>"unfree-redistributable-firmware"</varname>
</term>
<listitem>
<para>

View file

@ -32,7 +32,7 @@ stdenv.mkDerivation {
stdenv.mkDerivation {
name = "libfoo-1.2.3";
# ...
makeFlags = stdenv.lib.optional stdenv.isDarwin "LDFLAGS=-Wl,-install_name,$(out)/lib/libfoo.dylib";
makeFlags = lib.optional stdenv.isDarwin "LDFLAGS=-Wl,-install_name,$(out)/lib/libfoo.dylib";
}
</programlisting>
</listitem>

View file

@ -157,7 +157,7 @@
The following example configuration whitelists the licenses <literal>amd</literal> and <literal>wtfpl</literal>:
<programlisting>
{
whitelistedLicenses = with stdenv.lib.licenses; [ amd wtfpl ];
whitelistedLicenses = with lib.licenses; [ amd wtfpl ];
}
</programlisting>
</para>
@ -165,7 +165,7 @@
The following example configuration blacklists the <literal>gpl3Only</literal> and <literal>agpl3Only</literal> licenses:
<programlisting>
{
blacklistedLicenses = with stdenv.lib.licenses; [ agpl3Only gpl3Only ];
blacklistedLicenses = with lib.licenses; [ agpl3Only gpl3Only ];
}
</programlisting>
</para>

View file

@ -39,6 +39,11 @@
modules = modules ++ [
./nixos/modules/virtualisation/qemu-vm.nix
{ virtualisation.useBootLoader = true; }
({ config, ... }: {
virtualisation.useEFIBoot =
config.boot.loader.systemd-boot.enable ||
config.boot.loader.efi.canTouchEfiVariables;
})
];
})).config;
in

View file

@ -817,14 +817,54 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
};
} // {
# TODO: remove legacy aliases
agpl3 = lib.licenses.agpl3Only;
fdl11 = lib.licenses.fdl11Only;
fdl12 = lib.licenses.fdl12Only;
fdl13 = lib.licenses.fdl13Only;
gpl1 = lib.licenses.gpl1Only;
gpl2 = lib.licenses.gpl2Only;
gpl3 = lib.licenses.gpl3Only;
lgpl2 = lib.licenses.lgpl2Only;
lgpl21 = lib.licenses.lgpl21Only;
lgpl3 = lib.licenses.lgpl3Only;
agpl3 = spdx {
spdxId = "AGPL-3.0";
fullName = "GNU Affero General Public License v3.0";
deprecated = true;
};
fdl11 = spdx {
spdxId = "GFDL-1.1";
fullName = "GNU Free Documentation License v1.1";
deprecated = true;
};
fdl12 = spdx {
spdxId = "GFDL-1.2";
fullName = "GNU Free Documentation License v1.2";
deprecated = true;
};
fdl13 = spdx {
spdxId = "GFDL-1.3";
fullName = "GNU Free Documentation License v1.3";
deprecated = true;
};
gpl1 = spdx {
spdxId = "GPL-1.0";
fullName = "GNU General Public License v1.0";
deprecated = true;
};
gpl2 = spdx {
spdxId = "GPL-2.0";
fullName = "GNU General Public License v2.0";
deprecated = true;
};
gpl3 = spdx {
spdxId = "GPL-3.0";
fullName = "GNU General Public License v3.0";
deprecated = true;
};
lgpl2 = spdx {
spdxId = "LGPL-2.0";
fullName = "GNU Library General Public License v2";
deprecated = true;
};
lgpl21 = spdx {
spdxId = "LGPL-2.1";
fullName = "GNU Lesser General Public License v2.1";
deprecated = true;
};
lgpl3 = spdx {
spdxId = "LGPL-3.0";
fullName = "GNU Lesser General Public License v3.0";
deprecated = true;
};
}

View file

@ -124,6 +124,8 @@ rec {
then "${qemu-user}/bin/qemu-${final.qemuArch}"
else if final.isWasi
then "${pkgs.wasmtime}/bin/wasmtime"
else if final.isMmix
then "${pkgs.mmixware}/bin/mmix"
else throw "Don't know how to run ${final.config} executables.";
} // mapAttrs (n: v: v final.parsed) inspect.predicates

View file

@ -490,8 +490,9 @@ rec {
# ARM
else if platform.isAarch32 then let
version = platform.parsed.cpu.version or "";
in if lib.versionOlder version "6" then sheevaplug
version = platform.parsed.cpu.version or null;
in if version == null then pcBase
else if lib.versionOlder version "6" then sheevaplug
else if lib.versionOlder version "7" then raspberrypi
else armv7l-hf-multiplatform
else if platform.isAarch64 then aarch64-multiplatform

View file

@ -70,6 +70,18 @@
githubId = 7414843;
name = "Nicholas von Klitzing";
};
_3noch = {
email = "eacameron@gmail.com";
github = "3noch";
githubId = 882455;
name = "Elliot Cameron";
};
_6AA4FD = {
email = "f6442954@gmail.com";
github = "6AA4FD";
githubId = 12578560;
name = "Quinn Bohner";
};
a1russell = {
email = "adamlr6+pub@gmail.com";
github = "a1russell";
@ -1150,6 +1162,12 @@
githubId = 37907;
name = "Julian Stecklina";
};
bloomvdomino = {
name = "Laura Fäßler";
email = "0x@ytex.de";
github = "bloomvdomino";
githubId = 33204710;
};
bluescreen303 = {
email = "mathijs@bluescreen303.nl";
github = "bluescreen303";
@ -3613,6 +3631,12 @@
email = "t@larkery.com";
name = "Tom Hinton";
};
hirenashah = {
email = "hiren@hiren.io";
github = "hirenashah";
githubId = 19825977;
name = "Hiren Shah";
};
hjones2199 = {
email = "hjones2199@gmail.com";
github = "hjones2199";
@ -3693,6 +3717,12 @@
githubId = 2789926;
name = "Imran Hossain";
};
iammrinal0 = {
email = "nixpkgs@mrinalpurohit.in";
github = "iammrinal0";
githubId = 890062;
name = "Mrinal";
};
iand675 = {
email = "ian@iankduncan.com";
github = "iand675";
@ -3741,6 +3771,12 @@
githubId = 7481521;
name = "Balázs Lengyel";
};
ilian = {
email = "ilian@tuta.io";
github = "ilian";
githubId = 25505957;
name = "Ilian";
};
ilikeavocadoes = {
email = "ilikeavocadoes@hush.com";
github = "ilikeavocadoes";
@ -3923,6 +3959,12 @@
githubId = 2179419;
name = "Arseniy Seroka";
};
jakeisnt = {
name = "Jacob Chvatal";
email = "jake@isnt.online";
github = "jakeisnt";
githubId = 29869612;
};
jakelogemann = {
email = "jake.logemann@gmail.com";
github = "jakelogemann";
@ -4618,12 +4660,24 @@
githubId = 2029444;
name = "James Kent";
};
ketzacoatl = {
email = "ketzacoatl@protonmail.com";
github = "ketzacoatl";
githubId = 10122937;
name = "ketzacoatl";
};
kevincox = {
email = "kevincox@kevincox.ca";
github = "kevincox";
githubId = 494012;
name = "Kevin Cox";
};
kevingriffin = {
email = "me@kevin.jp";
github = "kevingriffin";
githubId = 209729;
name = "Kevin Griffin";
};
kfollesdal = {
email = "kfollesdal@gmail.com";
github = "kfollesdal";
@ -5448,6 +5502,12 @@
githubId = 346094;
name = "Michael Alyn Miller";
};
manojkarthick = {
email = "smanojkarthick@gmail.com";
github = "manojkarthick";
githubId = 7802795;
name = "Manoj Karthick";
};
manveru = {
email = "m.fellinger@gmail.com";
github = "manveru";
@ -5648,6 +5708,12 @@
githubId = 2971615;
name = "Marius Bergmann";
};
mcaju = {
email = "cajum.bugs@yandex.com";
github = "CajuM";
githubId = 10420834;
name = "Mihai-Drosi Caju";
};
mcbeth = {
email = "mcbeth@broggs.org";
github = "mcbeth";
@ -5869,6 +5935,12 @@
githubId = 1387206;
name = "Mike Sperber";
};
milesbreslin = {
email = "milesbreslin@gmail.com";
github = "milesbreslin";
githubId = 38543128;
name = "Miles Breslin";
};
millerjason = {
email = "mailings-github@millerjason.com";
github = "millerjason";
@ -6343,6 +6415,12 @@
githubId = 364510;
name = "Tobias Geerinckx-Rice";
};
ndl = {
email = "ndl@endl.ch";
github = "ndl";
githubId = 137805;
name = "Alexander Tsvyashchenko";
};
neeasade = {
email = "nathanisom27@gmail.com";
github = "neeasade";
@ -6487,12 +6565,6 @@
github = "NobbZ";
githubId = 58951;
};
nocent = {
email = "nocent@protonmail.ch";
github = "nocent";
githubId = 25505957;
name = "nocent";
};
nocoolnametom = {
email = "nocoolnametom@gmail.com";
github = "nocoolnametom";
@ -6699,6 +6771,12 @@
githubId = 111265;
name = "Ozan Sener";
};
otavio = {
email = "otavio.salvador@ossystems.com.br";
github = "otavio";
githubId = 25278;
name = "Otavio Salvador";
};
otwieracz = {
email = "slawek@otwiera.cz";
github = "otwieracz";
@ -6937,6 +7015,12 @@
githubId = 28323;
name = "Peter Simons";
};
petterstorvik = {
email = "petterstorvik@gmail.com";
github = "storvik";
githubId = 3438604;
name = "Petter Storvik";
};
philandstuff = {
email = "philip.g.potter@gmail.com";
github = "philandstuff";
@ -7509,6 +7593,12 @@
githubId = 395821;
name = "rht";
};
rhoriguchi = {
email = "ryan.horiguchi@gmail.com";
github = "rhoriguchi ";
githubId = 6047658;
name = "Ryan Horiguchi";
};
richardipsum = {
email = "richardipsum@fastmail.co.uk";
github = "richardipsum";
@ -7947,6 +8037,12 @@
githubId = 720864;
name = "Sébastien Bourdeauducq";
};
sbond75 = {
name = "sbond75";
email = "43617712+sbond75@users.noreply.github.com";
github = "sbond75";
githubId = 43617712;
};
sboosali = {
email = "SamBoosalis@gmail.com";
github = "sboosali";
@ -8801,6 +8897,12 @@
githubId = 2389333;
name = "Andy Tockman";
};
Technical27 = {
email = "38222826+Technical27@users.noreply.github.com";
github = "Technical27";
githubId = 38222826;
name = "Aamaruvi Yogamani";
};
teh = {
email = "tehunger@gmail.com";
github = "teh";
@ -8819,6 +8921,12 @@
githubId = 649832;
name = "Teo Klestrup Röijezon";
};
terin = {
email = "terinjokes@gmail.com";
github = "terinjokes";
githubId = 273509;
name = "Terin Stock";
};
terlar = {
email = "terlar@gmail.com";
github = "terlar";
@ -9396,6 +9504,12 @@
fingerprint = "4D23 ECDF 880D CADF 5ECA 4458 874B D6F9 16FA A742";
}];
};
vel = {
email = "llathasa@outlook.com";
github = "llathasa-veleth";
githubId = 61933599;
name = "vel";
};
velovix = {
email = "xaviosx@gmail.com";
github = "velovix";
@ -10132,6 +10246,16 @@
github = "ymarkus";
githubId = 62380378;
};
ymatsiuk = {
name = "Yurii Matsiuk";
email = "ymatsiuk@users.noreply.github.com";
github = "ymatsiuk";
githubId = 24990891;
keys = [{
longkeyid = "rsa4096/0x61302290298601AA";
fingerprint = "7BB8 84B5 74DA FDB1 E194 ED21 6130 2290 2986 01AA";
}];
};
ymeister = {
name = "Yuri Meister";
email = "47071325+ymeister@users.noreply.github.com";

View file

@ -0,0 +1,67 @@
{ maintainer }:
let
pkgs = import ./../../default.nix { };
maintainer_ = pkgs.lib.maintainers.${maintainer};
packagesWith = cond: return: prefix: set:
(pkgs.lib.flatten
(pkgs.lib.mapAttrsToList
(name: pkg:
let
result = builtins.tryEval
(
if pkgs.lib.isDerivation pkg && cond name pkg then
# Skip packages whose closure fails on evaluation.
# This happens for pkgs like `python27Packages.djangoql`
# that have disabled Python pkgs as dependencies.
builtins.seq pkg.outPath
[ (return "${prefix}${name}") ]
else if pkg.recurseForDerivations or false || pkg.recurseForRelease or false
# then packagesWith cond return pkg
then packagesWith cond return "${name}." pkg
else [ ]
);
in
if result.success then result.value
else [ ]
)
set
)
);
packages = packagesWith
(name: pkg:
(
if builtins.hasAttr "meta" pkg && builtins.hasAttr "maintainers" pkg.meta
then
(
if builtins.isList pkg.meta.maintainers
then builtins.elem maintainer_ pkg.meta.maintainers
else maintainer_ == pkg.meta.maintainers
)
else false
)
)
(name: name)
("")
pkgs;
in
pkgs.stdenv.mkDerivation {
name = "nixpkgs-update-script";
buildCommand = ''
echo ""
echo "----------------------------------------------------------------"
echo ""
echo "nix-shell maintainers/scripts/check-hydra-by-maintainer.nix --argstr maintainer SuperSandro2000"
echo ""
echo "----------------------------------------------------------------"
exit 1
'';
shellHook = ''
unset shellHook # do not contaminate nested shells
echo "Please stand by"
echo nix-shell -p hydra-check --run "hydra-check ${builtins.concatStringsSep " " packages}"
nix-shell -p hydra-check --run "hydra-check ${builtins.concatStringsSep " " packages}"
exit $?
'';
}

View file

@ -14,13 +14,12 @@ fi
tmp=$(mktemp -d)
pushd $tmp >/dev/null
wget -nH -r -c --no-parent "${WGET_ARGS[@]}" -A '*.tar.xz.sha256' -A '*.mirrorlist' >/dev/null
find -type f -name '*.mirrorlist' -delete
wget -nH -r -c --no-parent "${WGET_ARGS[@]}" >/dev/null
csv=$(mktemp)
find . -type f | while read src; do
# Sanitize file name
filename=$(gawk '{ print $2 }' "$src" | tr '@' '_')
filename=$(basename "$src" | tr '@' '_')
nameVersion="${filename%.tar.*}"
name=$(echo "$nameVersion" | sed -e 's,-[[:digit:]].*,,' | sed -e 's,-opensource-src$,,' | sed -e 's,-everywhere-src$,,')
version=$(echo "$nameVersion" | sed -e 's,^\([[:alpha:]][[:alnum:]]*-\)\+,,')
@ -40,8 +39,8 @@ gawk -F , "{ print \$1 }" $csv | sort | uniq | while read name; do
latestVersion=$(echo "$versions" | sort -rV | head -n 1)
src=$(gawk -F , "/^$name,$latestVersion,/ { print \$3 }" $csv)
filename=$(gawk -F , "/^$name,$latestVersion,/ { print \$4 }" $csv)
url="$(dirname "${src:2}")/$filename"
sha256=$(gawk '{ print $1 }' "$src")
url="${src:2}"
sha256=$(nix-hash --type sha256 --base32 --flat "$src")
cat >>"$SRCS" <<EOF
$name = {
version = "$latestVersion";

View file

@ -309,7 +309,7 @@ sub render_license {
# "GPL v2" or to "GPL v2 or later".
my $amb = 0;
# Whether the license is available inside `stdenv.lib.licenses`.
# Whether the license is available inside `lib.licenses`.
my $in_set = 1;
my $nix_license = $LICENSE_MAP{$cpan_license};
@ -331,7 +331,7 @@ sub render_license {
# Avoid defining the license line.
}
elsif ($in_set) {
my $lic = 'stdenv.lib.licenses';
my $lic = 'lib.licenses';
if ( @$licenses == 1 ) {
$license_line = "$lic.$licenses->[0]";
}
@ -449,7 +449,7 @@ print <<EOF;
meta = {
EOF
print <<EOF if defined $homepage;
homepage = $homepage;
homepage = "$homepage";
EOF
print <<EOF if defined $description && $description ne "Unknown";
description = "$description";

View file

@ -36,6 +36,14 @@ with lib.maintainers; {
scope = "Maintain Cinnamon desktop environment and applications made by the LinuxMint team.";
};
deshaw = {
# Verify additions to this team with at least one already existing member of the team.
members = [
limeytexan
];
scope = "Group registration for D. E. Shaw employees who collectively maintain packages.";
};
freedesktop = {
members = [ jtojnar worldofpeace ];
scope = "Maintain Freedesktop.org packages for graphical desktop.";

View file

@ -22,6 +22,11 @@ let
[ configuration
./modules/virtualisation/qemu-vm.nix
{ virtualisation.useBootLoader = true; }
({ config, ... }: {
virtualisation.useEFIBoot =
config.boot.loader.systemd-boot.enable ||
config.boot.loader.efi.canTouchEfiVariables;
})
];
}).config;

View file

@ -7,7 +7,7 @@
<para>
A profile with most (vanilla) hardening options enabled by default,
potentially at the cost of features and performance.
potentially at the cost of stability, features and performance.
</para>
<para>
@ -21,4 +21,12 @@
xlink:href="https://github.com/nixos/nixpkgs/tree/master/nixos/modules/profiles/hardened.nix">
profile source</literal> for further detail on which settings are altered.
</para>
<warning>
<para>
This profile enables options that are known to affect system
stability. If you experience any stability issues when using the
profile, try disabling it. If you report an issue and use this
profile, always mention that you do.
</para>
</warning>
</section>

View file

@ -1343,6 +1343,14 @@ CREATE ROLE postgres LOGIN SUPERUSER;
It was chosen to do this as it has a usability breaking issue (see issue <link xlink:href="https://github.com/NixOS/nixpkgs/issues/98819">#98819</link>)
that makes it unsuitable to be a default app.
</para>
<note>
<para>
Issue <link
xlink:href="https://github.com/NixOS/nixpkgs/issues/98819">#98819</link>
is now fixed and <package>gnome3.epiphany</package> is once
again installed by default.
</para>
</note>
</listitem>
<listitem>
<para>

View file

@ -107,6 +107,15 @@
user D-Bus session available also for non-graphical logins.
</para>
</listitem>
<listitem>
<para>
The <varname>networking.wireless.iwd</varname> module now installs
the upstream-provided 80-iwd.link file, which sets the NamePolicy=
for all wlan devices to "keep kernel", to avoid race conditions
between iwd and networkd. If you don't want this, you can set
<literal>systemd.network.links."80-iwd" = lib.mkForce {}</literal>.
</para>
</listitem>
<listitem>
<para>
<literal>rubyMinimal</literal> was removed due to being unused and
@ -168,6 +177,38 @@
<literal>/var/lib/powerdns</literal> to <literal>/run/pdns</literal>.
</para>
</listitem>
<listitem>
<para>
xfsprogs was update from 4.19 to 5.10. It now enables reflink support by default on filesystem creation.
Support for reflinks was added with an experimental status to kernel 4.9 and deemed stable in kernel 4.16.
If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than those, you need to format them
with <literal>mkfs.xfs -m reflink=0</literal>.
</para>
</listitem>
<listitem>
<para>
The uWSGI server is now built with POSIX capabilities. As a consequence,
root is no longer required in emperor mode and the service defaults to
running as the unprivileged <literal>uwsgi</literal> user. Any additional
capability can be added via the new option
<xref linkend="opt-services.uwsgi.capabilities"/>.
The previous behaviour can be restored by setting:
<programlisting>
<xref linkend="opt-services.uwsgi.user"/> = "root";
<xref linkend="opt-services.uwsgi.group"/> = "root";
<xref linkend="opt-services.uwsgi.instance"/> =
{
uid = "uwsgi";
gid = "uwsgi";
};
</programlisting>
</para>
<para>
Another incompatibility from the previous release is that vassals running under a
different user or group need to use <literal>immediate-{uid,gid}</literal>
instead of the usual <literal>uid,gid</literal> options.
</para>
</listitem>
<listitem>
<para>
<package>btc1</package> has been abandoned upstream, and removed.
@ -215,6 +256,22 @@
which is the new stable release. OpenAFS 1.6 was removed.
</para>
</listitem>
<listitem>
<para>
MariaDB has been updated to 10.5.
Before you upgrade, it would be best to take a backup of your database and read
<link xlink:href="https://mariadb.com/kb/en/upgrading-from-mariadb-104-to-mariadb-105/#incompatible-changes-between-104-and-105">
Incompatible Changes Between 10.4 and 10.5</link>.
After the upgrade you will need to run <literal>mysql_upgrade</literal>.
</para>
</listitem>
<listitem>
<para>
The TokuDB storage engine dropped in <package>mariadb</package> 10.5 and removed in <package>mariadb</package> 10.6.
It is recommended to switch to RocksDB. See also <link xlink:href="https://mariadb.com/kb/en/tokudb/">TokuDB</link> and
<link xlink:href="https://jira.mariadb.org/browse/MDEV-19780">MDEV-19780: Remove the TokuDB storage engine</link>.
</para>
</listitem>
<listitem>
<para>
The <literal>openldap</literal> module now has support for OLC-style
@ -278,6 +335,16 @@
<xref linkend="opt-services.privoxy.enableTor" /> = true;
</programlisting>
</listitem>
<listitem>
<para>
The <literal>services.tor</literal> module has a new exhaustively typed <xref linkend="opt-services.tor.settings" /> option following RFC 0042; backward compatibility with old options has been preserved when aliasing was possible.
The corresponding systemd service has been hardened,
but there is a chance that the service still requires more permissions,
so please report any related trouble on the bugtracker.
Onion services v3 are now supported in <xref linkend="opt-services.tor.relay.onionServices" />.
A new <xref linkend="opt-services.tor.openFirewall" /> option as been introduced for allowing connections on all the TCP ports configured.
</para>
</listitem>
<listitem>
<para>
The options <literal>services.slurm.dbdserver.storagePass</literal>
@ -287,6 +354,12 @@
This avoids that the password gets exposed in the nix store.
</para>
</listitem>
<listitem>
<para>
The <literal>wafHook</literal> hook does not wrap Python anymore.
Packages depending on <literal>wafHook</literal> need to include any Python into their <literal>nativeBuildInputs</literal>.
</para>
</listitem>
<listitem>
<para>
Starting with version 1.7.0, the project formerly named <literal>CodiMD</literal>
@ -295,6 +368,68 @@
Based on <xref linkend="opt-system.stateVersion" />, existing installations will continue to work.
</para>
</listitem>
<listitem>
<para>
The <package>fish-foreign-env</package> package has been replaced with
<package>fishPlugins.foreign-env</package>, in which the fish
functions have been relocated to the
<literal>vendor_functions.d</literal> directory to be loaded automatically.
</para>
</listitem>
<listitem>
<para>
The prometheus json exporter is now managed by the prometheus community. Together with additional features
some backwards incompatibilities were introduced.
Most importantly the exporter no longer accepts a fixed command-line parameter to specify the URL of the
endpoint serving JSON. It now expects this URL to be passed as an URL parameter, when scraping the exporter's
<literal>/probe</literal> endpoint.
In the prometheus scrape configuration the scrape target might look like this:
<programlisting>
http://some.json-exporter.host:7979/probe?target=https://example.com/some/json/endpoint
</programlisting>
</para>
<para>
Existing configuration for the exporter needs to be updated, but can partially be re-used.
Documentation is available in the upstream repository and a small example for NixOS is available
in the corresponding NixOS test.
</para>
<para>
These changes also affect <xref linkend="opt-services.prometheus.exporters.rspamd.enable" />, which is
just a preconfigured instance of the json exporter.
</para>
<para>
For more information, take a look at the <link xlink:href="https://github.com/prometheus-community/json_exporter">
official documentation</link> of the json_exporter.
</para>
</listitem>
<listitem>
<para>
Androidenv was updated, removing the <literal>includeDocs</literal> and <literal>lldbVersions</literal>
arguments. Docs only covered a single version of the Android SDK, LLDB is now bundled with the NDK,
and both are no longer available to download from the Android package repositories. Additionally, since
the package lists have been updated, some older versions of Android packages may not be bundled. If you
depend on older versions of Android packages, we recommend overriding the repo.
</para>
<para>
Android packages are now loaded from a repo.json file created by parsing Android repo XML files. The arguments
<literal>repoJson</literal> and <literal>repoXmls</literal> have been added to allow overriding the built-in
androidenv repo.json with your own. Additionally, license files are now written to allow compatibility
with Gradle-based tools, and the <literal>extraLicenses</literal> argument has been added to accept more
SDK licenses if your project requires it. See the androidenv documentation for more details.
</para>
</listitem>
<listitem>
<para>
The Searx module has been updated with the ability to configure the
service declaratively and uWSGI integration.
The option <literal>services.searx.configFile</literal> has been renamed
to <xref linkend="opt-services.searx.settingsFile"/> for consistency with
the new <xref linkend="opt-services.searx.settings"/>. In addition, the
<literal>searx</literal> uid and gid reservations have been removed
since they were not necessary: the service is now running with a
dynamically allocated uid.
</para>
</listitem>
</itemizedlist>
</section>
@ -446,6 +581,17 @@
The option's description was incorrect regarding ownership management and has been simplified greatly.
</para>
</listitem>
<listitem>
<para>
The GNOME desktop manager once again installs <package>gnome3.epiphany</package> by default.
</para>
</listitem>
<listitem>
<para>
NixOS now generates empty <literal>/etc/netgroup</literal>.
<literal>/etc/netgroup</literal> defines network-wide groups and may affect to setups using NIS.
</para>
</listitem>
</itemizedlist>
</section>
</section>

View file

@ -219,7 +219,7 @@ upload_image() {
log "Registering snapshot $snapshot_id as AMI"
local block_device_mappings=(
"DeviceName=/dev/xvda,Ebs={SnapshotId=$snapshot_id,VolumeSize=$image_logical_gigabytes,DeleteOnTermination=true,VolumeType=gp2}"
"DeviceName=/dev/xvda,Ebs={SnapshotId=$snapshot_id,VolumeSize=$image_logical_gigabytes,DeleteOnTermination=true,VolumeType=gp3}"
)
local extra_flags=(

View file

@ -145,7 +145,8 @@ in
'';
systemd.services.systemd-vconsole-setup =
{ before = [ "display-manager.service" ];
{
before = optional config.services.xserver.enable "display-manager.service";
after = [ "systemd-udev-settle.service" ];
restartTriggers = [ vconsoleConf consoleEnv ];
};

View file

@ -193,6 +193,10 @@ in
cat ${escapeShellArgs cfg.hostFiles} > $out
'';
# /etc/netgroup: Network-wide groups.
netgroup.text = mkDefault ''
'';
# /etc/host.conf: resolver configuration file
"host.conf".text = ''
multi on

View file

@ -144,6 +144,7 @@ in
"/share/kservicetypes5"
"/share/kxmlgui5"
"/share/systemd"
"/share/thumbnailers"
];
system.path = pkgs.buildEnv {

View file

@ -227,6 +227,15 @@ foreach my $u (@{$spec->{users}}) {
$u->{hashedPassword} = hashPassword($u->{password});
}
if (!defined $u->{shell}) {
if (defined $existing) {
$u->{shell} = $existing->{shell};
} else {
warn "warning: no declarative or previous shell for $name, setting shell to nologin\n";
$u->{shell} = "/run/current-system/sw/bin/nologin";
}
}
$u->{fakePassword} = $existing->{fakePassword} // "x";
$usersOut{$name} = $u;

View file

@ -153,7 +153,7 @@ let
};
shell = mkOption {
type = types.either types.shellPackage types.path;
type = types.nullOr (types.either types.shellPackage types.path);
default = pkgs.shadow;
defaultText = "pkgs.shadow";
example = literalExample "pkgs.bashInteractive";

View file

@ -5,6 +5,8 @@ let
cfg = config.hardware.opentabletdriver;
in
{
meta.maintainers = with lib.maintainers; [ thiagokokada ];
options = {
hardware.opentabletdriver = {
enable = mkOption {
@ -24,6 +26,15 @@ in
'';
};
package = mkOption {
type = types.package;
default = pkgs.opentabletdriver;
defaultText = "pkgs.opentabletdriver";
description = ''
OpenTabletDriver derivation to use.
'';
};
daemon = {
enable = mkOption {
default = true;
@ -37,9 +48,9 @@ in
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [ opentabletdriver ];
environment.systemPackages = [ cfg.package ];
services.udev.packages = with pkgs; [ opentabletdriver ];
services.udev.packages = [ cfg.package ];
boot.blacklistedKernelModules = cfg.blacklistedKernelModules;
@ -50,7 +61,7 @@ in
serviceConfig = {
Type = "simple";
ExecStart = "${opentabletdriver}/bin/otd-daemon -c ${opentabletdriver}/lib/OpenTabletDriver/Configurations";
ExecStart = "${cfg.package}/bin/otd-daemon -c ${cfg.package}/lib/OpenTabletDriver/Configurations";
Restart = "on-failure";
};
};

View file

@ -29,7 +29,7 @@ in
options.i18n = {
inputMethod = {
enabled = mkOption {
type = types.nullOr (types.enum [ "ibus" "fcitx" "nabi" "uim" "hime" ]);
type = types.nullOr (types.enum [ "ibus" "fcitx" "fcitx5" "nabi" "uim" "hime" ]);
default = null;
example = "fcitx";
description = ''

View file

@ -0,0 +1,33 @@
{ config, pkgs, lib, ... }:
with lib;
let
im = config.i18n.inputMethod;
cfg = im.fcitx5;
fcitx5Package = pkgs.fcitx5-with-addons.override { inherit (cfg) addons; };
in
{
options = {
i18n.inputMethod.fcitx5 = {
addons = mkOption {
type = with types; listOf package;
default = [];
example = with pkgs; [ fcitx5-rime ];
description = ''
Enabled Fcitx5 addons.
'';
};
};
};
config = mkIf (im.enabled == "fcitx5") {
i18n.inputMethod.package = fcitx5Package;
environment.variables = {
GTK_IM_MODULE = "fcitx";
QT_IM_MODULE = "fcitx";
XMODIFIERS = "@im=fcitx";
};
};
}

View file

@ -17,8 +17,7 @@
# The serial ports listed here are:
# - ttyS0: for Tegra (Jetson TX1)
# - ttyAMA0: for QEMU's -machine virt
# Also increase the amount of CMA to ensure the virtual console on the RPi3 works.
boot.kernelParams = ["cma=32M" "console=ttyS0,115200n8" "console=ttyAMA0,115200n8" "console=tty0"];
boot.kernelParams = ["console=ttyS0,115200n8" "console=ttyAMA0,115200n8" "console=tty0"];
boot.initrd.availableKernelModules = [
# Allows early (earlier) modesetting for the Raspberry Pi
@ -30,13 +29,25 @@
sdImage = {
populateFirmwareCommands = let
configTxt = pkgs.writeText "config.txt" ''
[pi3]
kernel=u-boot-rpi3.bin
[pi4]
kernel=u-boot-rpi4.bin
enable_gic=1
armstub=armstub8-gic.bin
# Otherwise the resolution will be weird in most cases, compared to
# what the pi3 firmware does by default.
disable_overscan=1
[all]
# Boot in 64-bit mode.
arm_64bit=1
# U-Boot used to need this to work, regardless of whether UART is actually used or not.
# TODO: check when/if this can be removed.
# U-Boot needs this to work, regardless of whether UART is actually used or not.
# Look in arch/arm/mach-bcm283x/Kconfig in the U-Boot tree to see if this is still
# a requirement in the future.
enable_uart=1
# Prevent the firmware from smashing the framebuffer setup done by the mainline kernel
@ -45,8 +56,17 @@
'';
in ''
(cd ${pkgs.raspberrypifw}/share/raspberrypi/boot && cp bootcode.bin fixup*.dat start*.elf $NIX_BUILD_TOP/firmware/)
cp ${pkgs.ubootRaspberryPi3_64bit}/u-boot.bin firmware/u-boot-rpi3.bin
# Add the config
cp ${configTxt} firmware/config.txt
# Add pi3 specific files
cp ${pkgs.ubootRaspberryPi3_64bit}/u-boot.bin firmware/u-boot-rpi3.bin
# Add pi4 specific files
cp ${pkgs.ubootRaspberryPi4_64bit}/u-boot.bin firmware/u-boot-rpi4.bin
cp ${pkgs.raspberrypi-armstubs}/armstub8-gic.bin firmware/armstub8-gic.bin
cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2711-rpi-4-b.dtb firmware/
'';
populateRootCommands = ''
mkdir -p ./files/boot

View file

@ -3,36 +3,6 @@
{ config, lib, pkgs, ... }:
{
imports = [
../../profiles/base.nix
../../profiles/installation-device.nix
./sd-image.nix
];
boot.loader.grub.enable = false;
boot.loader.raspberryPi.enable = true;
boot.loader.raspberryPi.version = 4;
imports = [ ./sd-image-aarch64.nix ];
boot.kernelPackages = pkgs.linuxPackages_rpi4;
boot.consoleLogLevel = lib.mkDefault 7;
sdImage = {
firmwareSize = 128;
firmwarePartitionName = "NIXOS_BOOT";
# This is a hack to avoid replicating config.txt from boot.loader.raspberryPi
populateFirmwareCommands =
"${config.system.build.installBootLoader} ${config.system.build.toplevel} -d ./firmware";
# As the boot process is done entirely in the firmware partition.
populateRootCommands = "";
};
fileSystems."/boot/firmware" = {
# This effectively "renames" the attrsOf entry set in sd-image.nix
mountPoint = "/boot";
neededForBoot = true;
};
# the installation media is also the installation target,
# so we don't want to provide the installation configuration.nix.
installer.cloneConfig = false;
}

View file

@ -104,7 +104,7 @@ in
'';
# Some more help text.
services.mingetty.helpLine =
services.getty.helpLine =
''
Log in as "root" with an empty password. ${

View file

@ -122,7 +122,7 @@ in
device = "/dev/something";
};
services.mingetty = {
services.getty = {
# Some more help text.
helpLine = ''
Log in as "root" with an empty password. ${

View file

@ -69,6 +69,9 @@ mount --rbind /sys "$mountPoint/sys"
# Run the activation script. Set $LOCALE_ARCHIVE to supress some Perl locale warnings.
LOCALE_ARCHIVE="$system/sw/lib/locale/locale-archive" chroot "$mountPoint" "$system/activate" 1>&2 || true
# Create /tmp
chroot "$mountPoint" systemd-tmpfiles --create --remove --exclude-prefix=/dev 1>&2 || true
)
exec chroot "$mountPoint" "${command[@]}"

View file

@ -261,7 +261,7 @@ in
++ optionals cfg.doc.enable ([ manual.manualHTML nixos-help ]
++ optionals config.services.xserver.enable [ pkgs.nixos-icons ]);
services.mingetty.helpLine = mkIf cfg.doc.enable (
services.getty.helpLine = mkIf cfg.doc.enable (
"\nRun 'nixos-help' for the NixOS manual."
);
})

View file

@ -143,7 +143,7 @@ in
nix-ssh = 104;
dictd = 105;
couchdb = 106;
searx = 107;
#searx = 107; # dynamically allocated as of 2020-10-27
kippo = 108;
jenkins = 109;
systemd-journal-gateway = 110;
@ -457,7 +457,7 @@ in
#nix-ssh = 104; # unused
dictd = 105;
couchdb = 106;
searx = 107;
#searx = 107; # dynamically allocated as of 2020-10-27
kippo = 108;
jenkins = 109;
systemd-journal-gateway = 110;

View file

@ -82,6 +82,7 @@
./hardware/xpadneo.nix
./i18n/input-method/default.nix
./i18n/input-method/fcitx.nix
./i18n/input-method/fcitx5.nix
./i18n/input-method/hime.nix
./i18n/input-method/ibus.nix
./i18n/input-method/nabi.nix
@ -101,6 +102,7 @@
./misc/version.nix
./misc/nixops-autoluks.nix
./programs/adb.nix
./programs/appgate-sdp.nix
./programs/atop.nix
./programs/autojump.nix
./programs/bandwhich.nix
@ -226,6 +228,7 @@
./services/audio/icecast.nix
./services/audio/liquidsoap.nix
./services/audio/mpd.nix
./services/audio/mpdscribble.nix
./services/audio/mopidy.nix
./services/audio/roon-server.nix
./services/audio/slimserver.nix
@ -492,6 +495,7 @@
./services/misc/nix-ssh-serve.nix
./services/misc/novacomd.nix
./services/misc/nzbget.nix
./services/misc/nzbhydra2.nix
./services/misc/octoprint.nix
./services/misc/osrm.nix
./services/misc/packagekit.nix
@ -540,6 +544,7 @@
./services/monitoring/do-agent.nix
./services/monitoring/fusion-inventory.nix
./services/monitoring/grafana.nix
./services/monitoring/grafana-image-renderer.nix
./services/monitoring/grafana-reporter.nix
./services/monitoring/graphite.nix
./services/monitoring/hdaps.nix
@ -745,6 +750,7 @@
./services/networking/skydns.nix
./services/networking/shadowsocks.nix
./services/networking/shairport-sync.nix
./services/networking/shellhub-agent.nix
./services/networking/shorewall.nix
./services/networking/shorewall6.nix
./services/networking/shout.nix
@ -850,7 +856,7 @@
./services/torrent/peerflix.nix
./services/torrent/rtorrent.nix
./services/torrent/transmission.nix
./services/ttys/agetty.nix
./services/ttys/getty.nix
./services/ttys/gpm.nix
./services/ttys/kmscon.nix
./services/wayland/cage.nix
@ -894,6 +900,7 @@
./services/web-apps/selfoss.nix
./services/web-apps/shiori.nix
./services/web-apps/virtlyst.nix
./services/web-apps/whitebophir.nix
./services/web-apps/wordpress.nix
./services/web-apps/youtrack.nix
./services/web-apps/zabbix.nix
@ -949,6 +956,7 @@
./services/x11/urxvtd.nix
./services/x11/window-managers/awesome.nix
./services/x11/window-managers/default.nix
./services/x11/window-managers/clfswm.nix
./services/x11/window-managers/fluxbox.nix
./services/x11/window-managers/icewm.nix
./services/x11/window-managers/bspwm.nix

View file

@ -3,8 +3,10 @@
# enabled in the initrd. Its primary use is in the NixOS installation
# CDs.
{ ... }:
{ pkgs, lib,... }:
let
platform = pkgs.stdenv.hostPlatform;
in
{
# The initrd has to contain any module that might be necessary for
@ -42,7 +44,10 @@
"virtio_net" "virtio_pci" "virtio_blk" "virtio_scsi" "virtio_balloon" "virtio_console"
# VMware support.
"mptspi" "vmw_balloon" "vmwgfx" "vmw_vmci" "vmw_vsock_vmci_transport" "vmxnet3" "vsock"
"mptspi" "vmxnet3" "vsock"
] ++ lib.optional platform.isx86 "vmw_balloon"
++ lib.optionals (!platform.isAarch64) [ # not sure where else they're missing
"vmw_vmci" "vmwgfx" "vmw_vsock_vmci_transport"
# Hyper-V support.
"hv_storvsc"

View file

@ -1,5 +1,10 @@
# A profile with most (vanilla) hardening options enabled by default,
# potentially at the cost of features and performance.
# potentially at the cost of stability, features and performance.
#
# This profile enables options that are known to affect system
# stability. If you experience any stability issues when using the
# profile, try disabling it. If you report an issue and use this
# profile, always mention that you do.
{ config, lib, pkgs, ... }:

View file

@ -45,10 +45,10 @@ with lib;
};
# Automatically log in at the virtual consoles.
services.mingetty.autologinUser = "nixos";
services.getty.autologinUser = "nixos";
# Some more help text.
services.mingetty.helpLine = ''
services.getty.helpLine = ''
The "nixos" and "root" accounts have empty passwords.
An ssh daemon is running. You then must set a password

View file

@ -0,0 +1,23 @@
{ config, pkgs, lib, ... }:
with lib;
{
options = {
programs.appgate-sdp = {
enable = mkEnableOption
"AppGate SDP VPN client";
};
};
config = mkIf config.programs.appgate-sdp.enable {
boot.kernelModules = [ "tun" ];
environment.systemPackages = [ pkgs.appgate-sdp ];
services.dbus.packages = [ pkgs.appgate-sdp ];
systemd = {
packages = [ pkgs.appgate-sdp ];
# https://github.com/NixOS/nixpkgs/issues/81138
services.appgatedriver.wantedBy = [ "multi-user.target" ];
};
};
}

View file

@ -27,8 +27,8 @@ if (!defined $res || scalar @$res == 0) {
my $package = @$res[0]->{package};
if ($ENV{"NIX_AUTO_INSTALL"} // "") {
print STDERR <<EOF;
The program $program is currently not installed. It is provided by
the package $package, which I will now install for you.
The program '$program' is currently not installed. It is provided by
the package '$package', which I will now install for you.
EOF
;
exit 126 if system("nix-env", "-iA", "nixos.$package") == 0;
@ -36,16 +36,17 @@ EOF
exec("nix-shell", "-p", $package, "--run", shell_quote("exec", @ARGV));
} else {
print STDERR <<EOF;
The program $program is currently not installed. You can install it by typing:
nix-env -iA nixos.$package
The program '$program' is not in your PATH. You can make it available in an
ephemeral shell by typing:
nix-shell -p $package
EOF
}
} else {
print STDERR <<EOF;
The program $program is currently not installed. It is provided by
several packages. You can install it by typing one of the following:
The program '$program' is not in your PATH. It is provided by several packages.
You can make it available in an ephemeral shell by typing one of the following:
EOF
print STDERR " nix-env -iA nixos.$_->{package}\n" foreach @$res;
print STDERR " nix-shell -p $_->{package}\n" foreach @$res;
}
exit 127;

View file

@ -112,7 +112,7 @@ in
environment.etc."fish/nixos-env-preinit.fish".text = ''
# This happens before $__fish_datadir/config.fish sets fish_function_path, so it is currently
# unset. We set it and then completely erase it, leaving its configuration to $__fish_datadir/config.fish
set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $__fish_datadir/functions
set fish_function_path ${pkgs.fishPlugins.foreign-env}/share/fish/vendor_functions.d $__fish_datadir/functions
# source the NixOS environment config
if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ]
@ -128,7 +128,7 @@ in
# if we haven't sourced the general config, do it
if not set -q __fish_nixos_general_config_sourced
set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $fish_function_path
set --prepend fish_function_path ${pkgs.fishPlugins.foreign-env}/share/fish/vendor_functions.d
fenv source /etc/fish/foreign-env/shellInit > /dev/null
set -e fish_function_path[1]
@ -142,7 +142,7 @@ in
# if we haven't sourced the login config, do it
status --is-login; and not set -q __fish_nixos_login_config_sourced
and begin
set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $fish_function_path
set --prepend fish_function_path ${pkgs.fishPlugins.foreign-env}/share/fish/vendor_functions.d
fenv source /etc/fish/foreign-env/loginShellInit > /dev/null
set -e fish_function_path[1]
@ -158,7 +158,7 @@ in
and begin
${fishAliases}
set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $fish_function_path
set --prepend fish_function_path ${pkgs.fishPlugins.foreign-env}/share/fish/vendor_functions.d
fenv source /etc/fish/foreign-env/interactiveShellInit > /dev/null
set -e fish_function_path[1]

View file

@ -394,7 +394,7 @@ let
${optionalString cfg.requireWheel
"auth required pam_wheel.so use_uid"}
${optionalString cfg.logFailures
"auth required pam_tally.so"}
"auth required pam_faillock.so"}
${optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth)
"auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles}"}
${optionalString cfg.fprintAuth

View file

@ -10,6 +10,14 @@ let
gid = config.ids.gids.mpd;
cfg = config.services.mpd;
credentialsPlaceholder = (creds:
let
placeholders = (imap0
(i: c: ''password "{{password-${toString i}}}@${concatStringsSep "," c.permissions}"'')
creds);
in
concatStringsSep "\n" placeholders);
mpdConf = pkgs.writeText "mpd.conf" ''
# This file was automatically generated by NixOS. Edit mpd's configuration
# via NixOS' configuration.nix, as this file will be rewritten upon mpd's
@ -32,6 +40,8 @@ let
}
''}
${optionalString (cfg.credentials != []) (credentialsPlaceholder cfg.credentials)}
${cfg.extraConfig}
'';
@ -152,16 +162,35 @@ in {
'';
};
credentialsFile = mkOption {
type = types.path;
credentials = mkOption {
type = types.listOf (types.submodule {
options = {
passwordFile = mkOption {
type = types.path;
description = ''
Path to file containing the password.
'';
};
permissions = let
perms = ["read" "add" "control" "admin"];
in mkOption {
type = types.listOf (types.enum perms);
default = [ "read" ];
description = ''
List of permissions that are granted with this password.
Permissions can be "${concatStringsSep "\", \"" perms}".
'';
};
};
});
description = ''
Path to a file to be merged with the settings during the service startup.
Useful to merge a file which is better kept out of the Nix store
because it contains sensible data like MPD's password. Example may look like this:
<literal>password "myMpdPassword@read,add,control,admin"</literal>
Credentials and permissions for accessing the mpd server.
'';
default = "/dev/null";
example = "/var/lib/secrets/mpd.conf";
default = [];
example = [
{passwordFile = "/var/lib/secrets/mpd_readonly_password"; permissions = [ "read" ];}
{passwordFile = "/var/lib/secrets/mpd_admin_password"; permissions = ["read" "add" "control" "admin"];}
];
};
fluidsynth = mkOption {
@ -201,12 +230,16 @@ in {
serviceConfig = mkMerge [
{
User = "${cfg.user}";
ExecStart = "${pkgs.mpd}/bin/mpd --no-daemon /etc/mpd.conf";
ExecStartPre = pkgs.writeScript "mpd-start-pre" ''
#!${pkgs.runtimeShell}
ExecStart = "${pkgs.mpd}/bin/mpd --no-daemon /run/mpd/mpd.conf";
ExecStartPre = pkgs.writeShellScript "mpd-start-pre" ''
set -euo pipefail
cat ${mpdConf} ${cfg.credentialsFile} > /etc/mpd.conf
install -m 600 ${mpdConf} /run/mpd/mpd.conf
${optionalString (cfg.credentials != [])
"${pkgs.replace}/bin/replace-literal -fe ${
concatStringsSep " -a " (imap0 (i: c: "\"{{password-${toString i}}}\" \"$(cat ${c.passwordFile})\"") cfg.credentials)
} /run/mpd/mpd.conf"}
'';
RuntimeDirectory = "mpd";
Type = "notify";
LimitRTPRIO = 50;
LimitRTTIME = "infinity";
@ -230,14 +263,6 @@ in {
})
];
};
environment.etc."mpd.conf" = {
mode = "0640";
group = cfg.group;
user = cfg.user;
# To be modified by the service' ExecStartPre
text = ''
'';
};
users.users = optionalAttrs (cfg.user == name) {
${name} = {

View file

@ -0,0 +1,202 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.mpdscribble;
mpdCfg = config.services.mpd;
endpointUrls = {
"last.fm" = "http://post.audioscrobbler.com";
"libre.fm" = "http://turtle.libre.fm";
"jamendo" = "http://postaudioscrobbler.jamendo.com";
"listenbrainz" = "http://proxy.listenbrainz.org";
};
mkSection = secname: secCfg: ''
[${secname}]
url = ${secCfg.url}
username = ${secCfg.username}
password = {{${secname}_PASSWORD}}
journal = /var/lib/mpdscribble/${secname}.journal
'';
endpoints = concatStringsSep "\n" (mapAttrsToList mkSection cfg.endpoints);
cfgTemplate = pkgs.writeText "mpdscribble.conf" ''
## This file was automatically genenrated by NixOS and will be overwritten.
## Do not edit. Edit your NixOS configuration instead.
## mpdscribble - an audioscrobbler for the Music Player Daemon.
## http://mpd.wikia.com/wiki/Client:mpdscribble
# HTTP proxy URL.
${optionalString (cfg.proxy != null) "proxy = ${cfg.proxy}"}
# The location of the mpdscribble log file. The special value
# "syslog" makes mpdscribble use the local syslog daemon. On most
# systems, log messages will appear in /var/log/daemon.log then.
# "-" means log to stderr (the current terminal).
log = -
# How verbose mpdscribble's logging should be. Default is 1.
verbose = ${toString cfg.verbose}
# How often should mpdscribble save the journal file? [seconds]
journal_interval = ${toString cfg.journalInterval}
# The host running MPD, possibly protected by a password
# ([PASSWORD@]HOSTNAME).
host = ${(optionalString (cfg.passwordFile != null) "{{MPD_PASSWORD}}@") + cfg.host}
# The port that the MPD listens on and mpdscribble should try to
# connect to.
port = ${toString cfg.port}
${endpoints}
'';
cfgFile = "/run/mpdscribble/mpdscribble.conf";
replaceSecret = secretFile: placeholder: targetFile:
optionalString (secretFile != null) ''
${pkgs.replace}/bin/replace-literal -ef ${placeholder} "$(cat ${secretFile})" ${targetFile}'';
preStart = pkgs.writeShellScript "mpdscribble-pre-start" ''
cp -f "${cfgTemplate}" "${cfgFile}"
${replaceSecret cfg.passwordFile "{{MPD_PASSWORD}}" cfgFile}
${concatStringsSep "\n" (mapAttrsToList (secname: cfg:
replaceSecret cfg.passwordFile "{{${secname}_PASSWORD}}" cfgFile)
cfg.endpoints)}
'';
localMpd = (cfg.host == "localhost" || cfg.host == "127.0.0.1");
in {
###### interface
options.services.mpdscribble = {
enable = mkEnableOption "mpdscribble";
proxy = mkOption {
default = null;
type = types.nullOr types.str;
description = ''
HTTP proxy URL.
'';
};
verbose = mkOption {
default = 1;
type = types.int;
description = ''
Log level for the mpdscribble daemon.
'';
};
journalInterval = mkOption {
default = 600;
example = 60;
type = types.int;
description = ''
How often should mpdscribble save the journal file? [seconds]
'';
};
host = mkOption {
default = (if mpdCfg.network.listenAddress != "any" then
mpdCfg.network.listenAddress
else
"localhost");
type = types.str;
description = ''
Host for the mpdscribble daemon to search for a mpd daemon on.
'';
};
passwordFile = mkOption {
default = if localMpd then
(findFirst
(c: any (x: x == "read") c.permissions)
{ passwordFile = null; }
mpdCfg.credentials).passwordFile
else
null;
type = types.nullOr types.str;
description = ''
File containing the password for the mpd daemon.
If there is a local mpd configured using <option>services.mpd.credentials</option>
the default is automatically set to a matching passwordFile of the local mpd.
'';
};
port = mkOption {
default = mpdCfg.network.port;
type = types.port;
description = ''
Port for the mpdscribble daemon to search for a mpd daemon on.
'';
};
endpoints = mkOption {
type = (let
endpoint = { name, ... }: {
options = {
url = mkOption {
type = types.str;
default = endpointUrls.${name} or "";
description =
"The url endpoint where the scrobble API is listening.";
};
username = mkOption {
type = types.str;
description = ''
Username for the scrobble service.
'';
};
passwordFile = mkOption {
type = types.nullOr types.str;
description =
"File containing the password, either as MD5SUM or cleartext.";
};
};
};
in types.attrsOf (types.submodule endpoint));
default = { };
example = {
"last.fm" = {
username = "foo";
passwordFile = "/run/secrets/lastfm_password";
};
};
description = ''
Endpoints to scrobble to.
If the endpoint is one of "${
concatStringsSep "\", \"" (attrNames endpointUrls)
}" the url is set automatically.
'';
};
};
###### implementation
config = mkIf cfg.enable {
systemd.services.mpdscribble = {
after = [ "network.target" ] ++ (optional localMpd "mpd.service");
description = "mpdscribble mpd scrobble client";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
DynamicUser = true;
StateDirectory = "mpdscribble";
RuntimeDirectory = "mpdscribble";
RuntimeDirectoryMode = "700";
# TODO use LoadCredential= instead of running preStart with full privileges?
ExecStartPre = "+${preStart}";
ExecStart =
"${pkgs.mpdscribble}/bin/mpdscribble --no-daemon --conf ${cfgFile}";
};
};
};
}

View file

@ -29,13 +29,7 @@ in
options = {
services.tarsnap = {
enable = mkOption {
type = types.bool;
default = false;
description = ''
Enable periodic tarsnap backups.
'';
};
enable = mkEnableOption "periodic tarsnap backups";
keyfile = mkOption {
type = types.str;
@ -279,7 +273,8 @@ in
Tarsnap archive configurations. Each attribute names an archive
to be created at a given time interval, according to the options
associated with it. When uploading to the tarsnap server,
archive names are suffixed by a 1 second resolution timestamp.
archive names are suffixed by a 1 second resolution timestamp,
with the format <literal>%Y%m%d%H%M%S</literal>.
For each member of the set is created a timer which triggers the
instanced <literal>tarsnap-archive-name</literal> service unit. You may use

View file

@ -244,7 +244,7 @@ in {
};
};
meta.maintainers = with lib.maintainters; [ mic92 kwohlfahrt ];
meta.maintainers = with lib.maintainers; [ mic92 kwohlfahrt ];
config = mkIf cfg.enable {
assertions = map (opt: {

View file

@ -4,31 +4,16 @@ with lib;
let
cfg = config.services.redis;
redisBool = b: if b then "yes" else "no";
condOption = name: value: if value != null then "${name} ${toString value}" else "";
redisConfig = pkgs.writeText "redis.conf" ''
port ${toString cfg.port}
${condOption "bind" cfg.bind}
${condOption "unixsocket" cfg.unixSocket}
daemonize no
supervised systemd
loglevel ${cfg.logLevel}
logfile ${cfg.logfile}
syslog-enabled ${redisBool cfg.syslog}
databases ${toString cfg.databases}
${concatMapStrings (d: "save ${toString (builtins.elemAt d 0)} ${toString (builtins.elemAt d 1)}\n") cfg.save}
dbfilename dump.rdb
dir /var/lib/redis
${if cfg.slaveOf != null then "slaveof ${cfg.slaveOf.ip} ${toString cfg.slaveOf.port}" else ""}
${condOption "masterauth" cfg.masterAuth}
${condOption "requirepass" cfg.requirePass}
appendOnly ${redisBool cfg.appendOnly}
appendfsync ${cfg.appendFsync}
slowlog-log-slower-than ${toString cfg.slowLogLogSlowerThan}
slowlog-max-len ${toString cfg.slowLogMaxLen}
${cfg.extraConfig}
'';
mkValueString = value:
if value == true then "yes"
else if value == false then "no"
else generators.mkValueStringDefault { } value;
redisConfig = pkgs.writeText "redis.conf" (generators.toKeyValue {
listsAsDuplicateKeys = true;
mkKeyValue = generators.mkKeyValueDefault { inherit mkValueString; } " ";
} cfg.settings);
in
{
imports = [
@ -37,6 +22,7 @@ in
(mkRemovedOptionModule [ "services" "redis" "dbFilename" ] "The redis module now uses /var/lib/redis/dump.rdb as database dump location.")
(mkRemovedOptionModule [ "services" "redis" "appendOnlyFilename" ] "This option was never used.")
(mkRemovedOptionModule [ "services" "redis" "pidFile" ] "This option was removed.")
(mkRemovedOptionModule [ "services" "redis" "extraConfig" ] "Use services.redis.settings instead.")
];
###### interface
@ -191,10 +177,20 @@ in
description = "Maximum number of items to keep in slow log.";
};
extraConfig = mkOption {
type = types.lines;
default = "";
description = "Extra configuration options for redis.conf.";
settings = mkOption {
type = with types; attrsOf (oneOf [ bool int str (listOf str) ]);
default = {};
description = ''
Redis configuration. Refer to
<link xlink:href="https://redis.io/topics/config"/>
for details on supported values.
'';
example = literalExample ''
{
unixsocketperm = "700";
loadmodule = [ "/path/to/my_module.so" "/path/to/other_module.so" ];
}
'';
};
};
@ -225,6 +221,30 @@ in
environment.systemPackages = [ cfg.package ];
services.redis.settings = mkMerge [
{
port = cfg.port;
daemonize = false;
supervised = "systemd";
loglevel = cfg.logLevel;
logfile = cfg.logfile;
syslog-enabled = cfg.syslog;
databases = cfg.databases;
save = map (d: "${toString (builtins.elemAt d 0)} ${toString (builtins.elemAt d 1)}") cfg.save;
dbfilename = "dump.rdb";
dir = "/var/lib/redis";
appendOnly = cfg.appendOnly;
appendfsync = cfg.appendFsync;
slowlog-log-slower-than = cfg.slowLogLogSlowerThan;
slowlog-max-len = cfg.slowLogMaxLen;
}
(mkIf (cfg.bind != null) { bind = cfg.bind; })
(mkIf (cfg.unixSocket != null) { unixsocket = cfg.unixSocket; })
(mkIf (cfg.slaveOf != null) { slaveof = "${cfg.slaveOf.ip} ${cfg.slaveOf.port}"; })
(mkIf (cfg.masterAuth != null) { masterauth = cfg.masterAuth; })
(mkIf (cfg.requirePass != null) { requirepass = cfg.requirePass; })
];
systemd.services.redis = {
description = "Redis Server";

View file

@ -93,11 +93,11 @@ in {
assertions = [
{
assertion = cfg.pulse.enable -> !config.hardware.pulseaudio.enable;
message = "PipeWire based PulseAudio server emulation replaces PulseAudio";
message = "PipeWire based PulseAudio server emulation replaces PulseAudio. This option requires `hardware.pulseaudio.enable` to be set to false";
}
{
assertion = cfg.jack.enable -> !config.services.jack.jackd.enable;
message = "PipeWire based JACK emulation doesn't use the JACK service";
message = "PipeWire based JACK emulation doesn't use the JACK service. This option requires `services.jack.jackd.enable` to be set to false";
}
];

View file

@ -49,6 +49,11 @@ in {
default = "https://hoogle.haskell.org";
};
host = mkOption {
type = types.str;
description = "Set the host to bind on.";
default = "127.0.0.1";
};
};
config = mkIf cfg.enable {
@ -59,7 +64,7 @@ in {
serviceConfig = {
Restart = "always";
ExecStart = ''${hoogleEnv}/bin/hoogle server --local --port ${toString cfg.port} --home ${cfg.home}'';
ExecStart = ''${hoogleEnv}/bin/hoogle server --local --port ${toString cfg.port} --home ${cfg.home} --host ${cfg.host}'';
DynamicUser = true;

View file

@ -156,7 +156,7 @@ $ ./result/bin/emacs
let
myEmacs = pkgs.emacs; <co xml:id="ex-emacsNix-2" />
emacsWithPackages = (pkgs.emacsPackagesGen myEmacs).emacsWithPackages; <co xml:id="ex-emacsNix-3" />
emacsWithPackages = (pkgs.emacsPackagesFor myEmacs).emacsWithPackages; <co xml:id="ex-emacsNix-3" />
in
emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [ <co xml:id="ex-emacsNix-4" />
magit # ; Integrate git &lt;C-x g&gt;
@ -254,10 +254,10 @@ in
<example xml:id="module-services-emacs-querying-packages">
<title>Querying Emacs packages</title>
<programlisting><![CDATA[
nix-env -f "<nixpkgs>" -qaP -A emacsPackages.elpaPackages
nix-env -f "<nixpkgs>" -qaP -A emacsPackages.melpaPackages
nix-env -f "<nixpkgs>" -qaP -A emacsPackages.melpaStablePackages
nix-env -f "<nixpkgs>" -qaP -A emacsPackages.orgPackages
nix-env -f "<nixpkgs>" -qaP -A emacs.pkgs.elpaPackages
nix-env -f "<nixpkgs>" -qaP -A emacs.pkgs.melpaPackages
nix-env -f "<nixpkgs>" -qaP -A emacs.pkgs.melpaStablePackages
nix-env -f "<nixpkgs>" -qaP -A emacs.pkgs.orgPackages
]]></programlisting>
</example>
</para>

View file

@ -367,7 +367,7 @@ in {
mailman-web-setup = {
description = "Prepare mailman-web files and database";
before = [ "uwsgi.service" "mailman-uwsgi.service" ];
before = [ "mailman-uwsgi.service" ];
requiredBy = [ "mailman-uwsgi.service" ];
restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
script = ''

View file

@ -25,8 +25,6 @@ let
clientRestrictions = concatStringsSep ", " (clientAccess ++ dnsBl);
smtpTlsSecurityLevel = if cfg.useDane then "dane" else "may";
mainCf = let
escape = replaceStrings ["$"] ["$$"];
mkList = items: "\n " + concatStringsSep ",\n " items;
@ -510,14 +508,6 @@ in
'';
};
useDane = mkOption {
type = types.bool;
default = false;
description = ''
Sets smtp_tls_security_level to "dane" rather than "may". See postconf(5) for details.
'';
};
sslCert = mkOption {
type = types.str;
default = "";
@ -819,13 +809,13 @@ in
// optionalAttrs cfg.enableHeaderChecks { header_checks = [ "regexp:/etc/postfix/header_checks" ]; }
// optionalAttrs (cfg.tlsTrustedAuthorities != "") {
smtp_tls_CAfile = cfg.tlsTrustedAuthorities;
smtp_tls_security_level = smtpTlsSecurityLevel;
smtp_tls_security_level = mkDefault "may";
}
// optionalAttrs (cfg.sslCert != "") {
smtp_tls_cert_file = cfg.sslCert;
smtp_tls_key_file = cfg.sslKey;
smtp_tls_security_level = smtpTlsSecurityLevel;
smtp_tls_security_level = mkDefault "may";
smtpd_tls_cert_file = cfg.sslCert;
smtpd_tls_key_file = cfg.sslKey;
@ -969,5 +959,9 @@ in
imports = [
(mkRemovedOptionModule [ "services" "postfix" "sslCACert" ]
"services.postfix.sslCACert was replaced by services.postfix.tlsTrustedAuthorities. In case you intend that your server should validate requested client certificates use services.postfix.extraConfig.")
(mkChangedOptionModule [ "services" "postfix" "useDane" ]
[ "services" "postfix" "config" "smtp_tls_security_level" ]
(config: mkIf config.services.postfix.useDane "dane"))
];
}

View file

@ -605,5 +605,5 @@ in
timerConfig.OnCalendar = cfg.dump.interval;
};
};
meta.maintainers = with lib.maintainers; [ srhb ];
meta.maintainers = with lib.maintainers; [ srhb ma27 ];
}

View file

@ -69,6 +69,9 @@ in {
# i.e. to delegate from the host being accessible as ${config.networking.domain}
# to another host actually running the Matrix homeserver.
"${config.networking.domain}" = {
<link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link> = true;
<link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;
<link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.extraConfig">locations."= /.well-known/matrix/server".extraConfig</link> =
let
# use 443 instead of the default 8448 port to unite

View file

@ -0,0 +1,78 @@
{ config, pkgs, lib, ... }:
with lib;
let cfg = config.services.nzbhydra2;
in {
options = {
services.nzbhydra2 = {
enable = mkEnableOption "NZBHydra2";
dataDir = mkOption {
type = types.str;
default = "/var/lib/nzbhydra2";
description = "The directory where NZBHydra2 stores its data files.";
};
openFirewall = mkOption {
type = types.bool;
default = false;
description =
"Open ports in the firewall for the NZBHydra2 web interface.";
};
package = mkOption {
type = types.package;
default = pkgs.nzbhydra2;
defaultText = "pkgs.nzbhydra2";
description = "NZBHydra2 package to use.";
};
};
};
config = mkIf cfg.enable {
systemd.tmpfiles.rules =
[ "d '${cfg.dataDir}' 0700 nzbhydra2 nzbhydra2 - -" ];
systemd.services.nzbhydra2 = {
description = "NZBHydra2";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
User = "nzbhydra2";
Group = "nzbhydra2";
ExecStart =
"${cfg.package}/bin/nzbhydra2 --nobrowser --datafolder '${cfg.dataDir}'";
Restart = "on-failure";
# Hardening
NoNewPrivileges = true;
PrivateTmp = true;
PrivateDevices = true;
DevicePolicy = "closed";
ProtectSystem = "strict";
ReadWritePaths = cfg.dataDir;
ProtectHome = "read-only";
ProtectControlGroups = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies ="AF_UNIX AF_INET AF_INET6 AF_NETLINK";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
LockPersonality = true;
};
};
networking.firewall = mkIf cfg.openFirewall { allowedTCPPorts = [ 5076 ]; };
users.users.nzbhydra2 = {
group = "nzbhydra2";
isSystemUser = true;
};
users.groups.nzbhydra2 = {};
};
}

View file

@ -0,0 +1,150 @@
{ lib, pkgs, config, ... }:
with lib;
let
cfg = config.services.grafana-image-renderer;
format = pkgs.formats.json { };
configFile = format.generate "grafana-image-renderer-config.json" cfg.settings;
in {
options.services.grafana-image-renderer = {
enable = mkEnableOption "grafana-image-renderer";
chromium = mkOption {
type = types.package;
description = ''
The chromium to use for image rendering.
'';
};
verbose = mkEnableOption "verbosity for the service";
provisionGrafana = mkEnableOption "Grafana configuration for grafana-image-renderer";
settings = mkOption {
type = types.submodule {
freeformType = format.type;
options = {
service = {
port = mkOption {
type = types.port;
default = 8081;
description = ''
The TCP port to use for the rendering server.
'';
};
logging.level = mkOption {
type = types.enum [ "error" "warning" "info" "debug" ];
default = "info";
description = ''
The log-level of the <filename>grafana-image-renderer.service</filename>-unit.
'';
};
};
rendering = {
width = mkOption {
default = 1000;
type = types.ints.positive;
description = ''
Width of the PNG used to display the alerting graph.
'';
};
height = mkOption {
default = 500;
type = types.ints.positive;
description = ''
Height of the PNG used to display the alerting graph.
'';
};
mode = mkOption {
default = "default";
type = types.enum [ "default" "reusable" "clustered" ];
description = ''
Rendering mode of <package>grafana-image-renderer</package>:
<itemizedlist>
<listitem><para><literal>default:</literal> Creates on browser-instance
per rendering request.</para></listitem>
<listitem><para><literal>reusable:</literal> One browser instance
will be started and reused for each rendering request.</para></listitem>
<listitem><para><literal>clustered:</literal> allows to precisely
configure how many browser-instances are supposed to be used. The values
for that mode can be declared in <literal>rendering.clustering</literal>.
</para></listitem>
</itemizedlist>
'';
};
args = mkOption {
type = types.listOf types.str;
default = [ "--no-sandbox" ];
description = ''
List of CLI flags passed to <package>chromium</package>.
'';
};
};
};
};
default = {};
description = ''
Configuration attributes for <package>grafana-image-renderer</package>.
See <link xlink:href="https://github.com/grafana/grafana-image-renderer/blob/ce1f81438e5f69c7fd7c73ce08bab624c4c92e25/default.json" />
for supported values.
'';
};
};
config = mkIf cfg.enable {
assertions = [
{ assertion = cfg.provisionGrafana -> config.services.grafana.enable;
message = ''
To provision a Grafana instance to use grafana-image-renderer,
`services.grafana.enable` must be set to `true`!
'';
}
];
services.grafana.extraOptions = mkIf cfg.provisionGrafana {
RENDERING_SERVER_URL = "http://localhost:${toString cfg.settings.service.port}/render";
RENDERING_CALLBACK_URL = "http://localhost:${toString config.services.grafana.port}";
};
services.grafana-image-renderer.chromium = mkDefault pkgs.chromium;
services.grafana-image-renderer.settings = {
rendering = mapAttrs (const mkDefault) {
chromeBin = "${cfg.chromium}/bin/chromium";
verboseLogging = cfg.verbose;
timezone = config.time.timeZone;
};
services = {
logging.level = mkIf cfg.verbose (mkDefault "debug");
metrics.enabled = mkDefault false;
};
};
systemd.services.grafana-image-renderer = {
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
description = " A Grafana backend plugin that handles rendering of panels & dashboards to PNGs using headless browser (Chromium/Chrome)";
environment = {
PUPPETEER_SKIP_CHROMIUM_DOWNLOAD = "true";
};
serviceConfig = {
DynamicUser = true;
PrivateTmp = true;
ExecStart = "${pkgs.grafana-image-renderer}/bin/grafana-image-renderer server --config=${configFile}";
Restart = "always";
};
};
};
meta.maintainers = with maintainers; [ ma27 ];
}

View file

@ -5,10 +5,11 @@ with lib;
let
cfg = config.services.grafana;
opt = options.services.grafana;
declarativePlugins = pkgs.linkFarm "grafana-plugins" (builtins.map (pkg: { name = pkg.pname; path = pkg; }) cfg.declarativePlugins);
envOptions = {
PATHS_DATA = cfg.dataDir;
PATHS_PLUGINS = "${cfg.dataDir}/plugins";
PATHS_PLUGINS = if builtins.isNull cfg.declarativePlugins then "${cfg.dataDir}/plugins" else declarativePlugins;
PATHS_LOGS = "${cfg.dataDir}/log";
SERVER_PROTOCOL = cfg.protocol;
@ -260,6 +261,12 @@ in {
defaultText = "pkgs.grafana";
type = types.package;
};
declarativePlugins = mkOption {
type = with types; nullOr (listOf path);
default = null;
description = "If non-null, then a list of packages containing Grafana plugins to install. If set, plugins cannot be manually installed.";
example = literalExample "with pkgs.grafanaPlugins; [ grafana-piechart-panel ]";
};
dataDir = mkOption {
description = "Data directory.";

View file

@ -112,17 +112,21 @@ let
http://tools.ietf.org/html/rfc4366#section-3.1
'';
};
remote_timeout = mkDefOpt types.str "30s" ''
Timeout for requests to the remote write endpoint.
'';
relabel_configs = mkOpt (types.listOf promTypes.relabel_config) ''
List of remote write relabel configurations.
List of relabel configurations.
'';
name = mkOpt types.string ''
Name of the remote write config, which if specified must be unique among remote write configs.
Name of the remote read config, which if specified must be unique among remote read configs.
The name will be used in metrics and logging in place of a generated value to help users distinguish between
remote write configs.
remote read configs.
'';
required_matchers = mkOpt (types.attrsOf types.str) ''
An optional list of equality matchers which have to be
present in a selector to query the remote read endpoint.
'';
remote_timeout = mkOpt types.str ''
Timeout for requests to the remote read endpoint.
'';
read_recent = mkOpt types.bool ''
Whether reads should be made for queries for time ranges that
the local storage should have complete data for.
'';
basic_auth = mkOpt (types.submodule {
options = {
@ -136,30 +140,22 @@ let
password_file = mkOpt types.str "HTTP password file";
};
}) ''
Sets the `Authorization` header on every remote write request with the
Sets the `Authorization` header on every remote read request with the
configured username and password.
password and password_file are mutually exclusive.
'';
bearer_token = mkOpt types.str ''
Sets the `Authorization` header on every remote write request with
Sets the `Authorization` header on every remote read request with
the configured bearer token. It is mutually exclusive with `bearer_token_file`.
'';
bearer_token_file = mkOpt types.str ''
Sets the `Authorization` header on every remote write request with the bearer token
Sets the `Authorization` header on every remote read request with the bearer token
read from the configured file. It is mutually exclusive with `bearer_token`.
'';
tls_config = mkOpt promTypes.tls_config ''
Configures the remote write request's TLS settings.
Configures the remote read request's TLS settings.
'';
proxy_url = mkOpt types.str "Optional Proxy URL.";
metadata_config = {
send = mkDefOpt types.bool "true" ''
Whether metric metadata is sent to remote storage or not.
'';
send_interval = mkDefOpt types.str "1m" ''
How frequently metric metadata is sent to remote storage.
'';
};
};
};
@ -172,13 +168,12 @@ let
http://tools.ietf.org/html/rfc4366#section-3.1
'';
};
remote_timeout = mkDefOpt types.str "30s" ''
remote_timeout = mkOpt types.str ''
Timeout for requests to the remote write endpoint.
'';
relabel_configs = mkOpt (types.listOf promTypes.relabel_config) ''
List of remote write relabel configurations.
List of relabel configurations.
'';
write_relabel_configs = mkOpt (types.listOf promTypes.relabel_config) ''
List of remote write relabel configurations.
'';
name = mkOpt types.string ''
Name of the remote write config, which if specified must be unique among remote write configs.
The name will be used in metrics and logging in place of a generated value to help users distinguish between
@ -212,14 +207,50 @@ let
Configures the remote write request's TLS settings.
'';
proxy_url = mkOpt types.str "Optional Proxy URL.";
metadata_config = {
send = mkDefOpt types.bool "true" ''
Whether metric metadata is sent to remote storage or not.
'';
send_interval = mkDefOpt types.str "1m" ''
How frequently metric metadata is sent to remote storage.
'';
};
queue_config = mkOpt (types.submodule {
options = {
capacity = mkOpt types.int ''
Number of samples to buffer per shard before we block reading of more
samples from the WAL. It is recommended to have enough capacity in each
shard to buffer several requests to keep throughput up while processing
occasional slow remote requests.
'';
max_shards = mkOpt types.int ''
Maximum number of shards, i.e. amount of concurrency.
'';
min_shards = mkOpt types.int ''
Minimum number of shards, i.e. amount of concurrency.
'';
max_samples_per_send = mkOpt types.int ''
Maximum number of samples per send.
'';
batch_send_deadline = mkOpt types.str ''
Maximum time a sample will wait in buffer.
'';
min_backoff = mkOpt types.str ''
Initial retry delay. Gets doubled for every retry.
'';
max_backoff = mkOpt types.str ''
Maximum retry delay.
'';
};
}) ''
Configures the queue used to write to remote storage.
'';
metadata_config = mkOpt (types.submodule {
options = {
send = mkOpt types.bool ''
Whether metric metadata is sent to remote storage or not.
'';
send_interval = mkOpt types.str ''
How frequently metric metadata is sent to remote storage.
'';
};
}) ''
Configures the sending of series metadata to remote storage.
Metadata configuration is subject to change at any point
or be removed in future releases.
'';
};
};
@ -339,6 +370,14 @@ let
List of file service discovery configurations.
'';
gce_sd_configs = mkOpt (types.listOf promTypes.gce_sd_config) ''
List of Google Compute Engine service discovery configurations.
See <link
xlink:href="https://prometheus.io/docs/prometheus/latest/configuration/configuration/#gce_sd_config">the
relevant Prometheus configuration docs</link> for more detail.
'';
static_configs = mkOpt (types.listOf promTypes.static_config) ''
List of labeled target groups for this job.
'';
@ -524,6 +563,52 @@ let
};
};
promTypes.gce_sd_config = types.submodule {
options = {
# Use `mkOption` instead of `mkOpt` for project and zone because they are
# required configuration values for `gce_sd_config`.
project = mkOption {
type = types.str;
description = ''
The GCP Project.
'';
};
zone = mkOption {
type = types.str;
description = ''
The zone of the scrape targets. If you need multiple zones use multiple
gce_sd_configs.
'';
};
filter = mkOpt types.str ''
Filter can be used optionally to filter the instance list by other
criteria Syntax of this filter string is described here in the filter
query parameter section: <link
xlink:href="https://cloud.google.com/compute/docs/reference/latest/instances/list"
/>.
'';
refresh_interval = mkDefOpt types.str "60s" ''
Refresh interval to re-read the cloud instance list.
'';
port = mkDefOpt types.port "80" ''
The port to scrape metrics from. If using the public IP address, this
must instead be specified in the relabeling rule.
'';
tag_separator = mkDefOpt types.str "," ''
The tag separator used to separate concatenated GCE instance network tags.
See the GCP documentation on network tags for more information: <link
xlink:href="https://cloud.google.com/vpc/docs/add-remove-network-tags"
/>
'';
};
};
promTypes.relabel_config = types.submodule {
options = {
source_labels = mkOpt (types.listOf types.str) ''
@ -554,10 +639,10 @@ let
regular expression matches.
'';
action = mkDefOpt (types.enum ["replace" "keep" "drop"]) "replace" ''
action =
mkDefOpt (types.enum ["replace" "keep" "drop" "hashmod" "labelmap" "labeldrop" "labelkeep"]) "replace" ''
Action to perform based on regex matching.
'';
};
};

View file

@ -23,6 +23,7 @@ let
exporterOpts = genAttrs [
"apcupsd"
"bind"
"bird"
"blackbox"
"collectd"
"dnsmasq"
@ -47,6 +48,7 @@ let
"rspamd"
"rtl_433"
"snmp"
"smokeping"
"sql"
"surfboard"
"tor"
@ -234,8 +236,6 @@ in
services.prometheus.exporters.minio.minioAddress = mkDefault "http://localhost:9000";
services.prometheus.exporters.minio.minioAccessKey = mkDefault config.services.minio.accessKey;
services.prometheus.exporters.minio.minioAccessSecret = mkDefault config.services.minio.secretKey;
})] ++ [(mkIf config.services.rspamd.enable {
services.prometheus.exporters.rspamd.url = mkDefault "http://localhost:11334/stat";
})] ++ [(mkIf config.services.prometheus.exporters.rtl_433.enable {
hardware.rtl-sdr.enable = mkDefault true;
})] ++ [(mkIf config.services.nginx.enable {

View file

@ -0,0 +1,46 @@
{ config, lib, pkgs, options }:
with lib;
let
cfg = config.services.prometheus.exporters.bird;
in
{
port = 9324;
extraOpts = {
birdVersion = mkOption {
type = types.enum [ 1 2 ];
default = 2;
description = ''
Specifies whether BIRD1 or BIRD2 is in use.
'';
};
birdSocket = mkOption {
type = types.path;
default = "/var/run/bird.ctl";
description = ''
Path to BIRD2 (or BIRD1 v4) socket.
'';
};
newMetricFormat = mkOption {
type = types.bool;
default = true;
description = ''
Enable the new more-generic metric format.
'';
};
};
serviceOpts = {
serviceConfig = {
SupplementaryGroups = singleton (if cfg.birdVersion == 1 then "bird" else "bird2");
ExecStart = ''
${pkgs.prometheus-bird-exporter}/bin/bird_exporter \
-web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
-bird.socket ${cfg.birdSocket} \
-bird.v2=${if cfg.birdVersion == 2 then "true" else "false"} \
-format.new=${if cfg.newMetricFormat then "true" else "false"} \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
};
};
}

View file

@ -8,28 +8,36 @@ in
{
port = 7979;
extraOpts = {
url = mkOption {
type = types.str;
description = ''
URL to scrape JSON from.
'';
};
configFile = mkOption {
type = types.path;
description = ''
Path to configuration file.
'';
};
listenAddress = {}; # not used
};
serviceOpts = {
serviceConfig = {
ExecStart = ''
${pkgs.prometheus-json-exporter}/bin/prometheus-json-exporter \
--port ${toString cfg.port} \
${cfg.url} ${escapeShellArg cfg.configFile} \
${pkgs.prometheus-json-exporter}/bin/json_exporter \
--config.file ${escapeShellArg cfg.configFile} \
--web.listen-address="${cfg.listenAddress}:${toString cfg.port}" \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
};
};
imports = [
(mkRemovedOptionModule [ "url" ] ''
This option was removed. The URL of the endpoint serving JSON
must now be provided to the exporter by prometheus via the url
parameter `target'.
In prometheus a scrape URL would look like this:
http://some.json-exporter.host:7979/probe?target=https://example.com/some/json/endpoint
For more information, take a look at the official documentation
(https://github.com/prometheus-community/json_exporter) of the json_exporter.
'')
({ options.warnings = options.warnings; options.assertions = options.assertions; })
];
}

View file

@ -10,64 +10,55 @@ let
echo '${builtins.toJSON conf}' | ${pkgs.buildPackages.jq}/bin/jq '.' > $out
'';
generateConfig = extraLabels: (map (path: {
name = "rspamd_${replaceStrings [ "." " " ] [ "_" "_" ] path}";
path = "$.${path}";
labels = extraLabels;
}) [
"actions.'add header'"
"actions.'no action'"
"actions.'rewrite subject'"
"actions.'soft reject'"
"actions.greylist"
"actions.reject"
"bytes_allocated"
"chunks_allocated"
"chunks_freed"
"chunks_oversized"
"connections"
"control_connections"
"ham_count"
"learned"
"pools_allocated"
"pools_freed"
"read_only"
"scanned"
"shared_chunks_allocated"
"spam_count"
"total_learns"
]) ++ [{
name = "rspamd_statfiles";
type = "object";
path = "$.statfiles[*]";
labels = recursiveUpdate {
symbol = "$.symbol";
type = "$.type";
} extraLabels;
values = {
revision = "$.revision";
size = "$.size";
total = "$.total";
used = "$.used";
languages = "$.languages";
users = "$.users";
};
}];
generateConfig = extraLabels: {
metrics = (map (path: {
name = "rspamd_${replaceStrings [ "." " " ] [ "_" "_" ] path}";
path = "$.${path}";
labels = extraLabels;
}) [
"actions.'add header'"
"actions.'no action'"
"actions.'rewrite subject'"
"actions.'soft reject'"
"actions.greylist"
"actions.reject"
"bytes_allocated"
"chunks_allocated"
"chunks_freed"
"chunks_oversized"
"connections"
"control_connections"
"ham_count"
"learned"
"pools_allocated"
"pools_freed"
"read_only"
"scanned"
"shared_chunks_allocated"
"spam_count"
"total_learns"
]) ++ [{
name = "rspamd_statfiles";
type = "object";
path = "$.statfiles[*]";
labels = recursiveUpdate {
symbol = "$.symbol";
type = "$.type";
} extraLabels;
values = {
revision = "$.revision";
size = "$.size";
total = "$.total";
used = "$.used";
languages = "$.languages";
users = "$.users";
};
}];
};
in
{
port = 7980;
extraOpts = {
listenAddress = {}; # not used
url = mkOption {
type = types.str;
description = ''
URL to the rspamd metrics endpoint.
Defaults to http://localhost:11334/stat when
<option>services.rspamd.enable</option> is true.
'';
};
extraLabels = mkOption {
type = types.attrsOf types.str;
default = {
@ -84,9 +75,25 @@ in
};
};
serviceOpts.serviceConfig.ExecStart = ''
${pkgs.prometheus-json-exporter}/bin/prometheus-json-exporter \
--port ${toString cfg.port} \
${cfg.url} ${prettyJSON (generateConfig cfg.extraLabels)} \
${pkgs.prometheus-json-exporter}/bin/json_exporter \
--config.file ${prettyJSON (generateConfig cfg.extraLabels)} \
--web.listen-address "${cfg.listenAddress}:${toString cfg.port}" \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
imports = [
(mkRemovedOptionModule [ "url" ] ''
This option was removed. The URL of the rspamd metrics endpoint
must now be provided to the exporter by prometheus via the url
parameter `target'.
In prometheus a scrape URL would look like this:
http://some.rspamd-exporter.host:7980/probe?target=http://some.rspamd.host:11334/stat
For more information, take a look at the official documentation
(https://github.com/prometheus-community/json_exporter) of the json_exporter.
'')
({ options.warnings = options.warnings; options.assertions = options.assertions; })
];
}

View file

@ -0,0 +1,60 @@
{ config, lib, pkgs, options }:
with lib;
let
cfg = config.services.prometheus.exporters.smokeping;
goDuration = types.mkOptionType {
name = "goDuration";
description = "Go duration (https://golang.org/pkg/time/#ParseDuration)";
check = x: types.str.check x && builtins.match "(-?[0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+" x != null;
inherit (types.str) merge;
};
in
{
port = 9374;
extraOpts = {
telemetryPath = mkOption {
type = types.str;
default = "/metrics";
description = ''
Path under which to expose metrics.
'';
};
pingInterval = mkOption {
type = goDuration;
default = "1s";
description = ''
Interval between pings.
'';
};
buckets = mkOption {
type = types.commas;
default = "5e-05,0.0001,0.0002,0.0004,0.0008,0.0016,0.0032,0.0064,0.0128,0.0256,0.0512,0.1024,0.2048,0.4096,0.8192,1.6384,3.2768,6.5536,13.1072,26.2144";
description = ''
List of buckets to use for the response duration histogram.
'';
};
hosts = mkOption {
type = with types; listOf str;
description = ''
List of endpoints to probe.
'';
};
};
serviceOpts = {
serviceConfig = {
AmbientCapabilities = [ "CAP_NET_RAW" ];
ExecStart = ''
${pkgs.prometheus-smokeping-prober}/bin/smokeping_prober \
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--web.telemetry-path ${cfg.telemetryPath} \
--buckets ${cfg.buckets} \
--ping.interval ${cfg.pingInterval} \
--privileged \
${concatStringsSep " \\\n " cfg.extraFlags} \
${concatStringsSep " " cfg.hosts}
'';
};
};
}

View file

@ -22,6 +22,11 @@ in {
systemd.packages = [ pkgs.iwd ];
systemd.network.links."80-iwd" = {
matchConfig.Type = "wlan";
linkConfig.NamePolicy = "keep kernel";
};
systemd.services.iwd.wantedBy = [ "multi-user.target" ];
};

View file

@ -109,6 +109,13 @@ in
description = "Host to bind to. Defaults binding on all addresses.";
};
package = mkOption {
type = types.package;
default = pkgs.murmur;
defaultText = "pkgs.murmur";
description = "Overridable attribute of the murmur package to use.";
};
password = mkOption {
type = types.str;
default = "";
@ -299,7 +306,7 @@ in
Type = if forking then "forking" else "simple";
PIDFile = mkIf forking "/run/murmur/murmurd.pid";
EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
ExecStart = "${pkgs.murmur}/bin/murmurd -ini /run/murmur/murmurd.ini";
ExecStart = "${cfg.package}/bin/murmurd -ini /run/murmur/murmurd.ini";
Restart = "always";
RuntimeDirectory = "murmur";
RuntimeDirectoryMode = "0700";

View file

@ -16,7 +16,7 @@ let
${concatMapStrings (f: "actionsfile ${f}\n") cfg.actionsFiles}
${concatMapStrings (f: "filterfile ${f}\n") cfg.filterFiles}
'' + optionalString cfg.enableTor ''
forward-socks4a / ${config.services.tor.client.socksListenAddressFaster} .
forward-socks5t / 127.0.0.1:9063 .
toggle 1
enable-remote-toggle 0
enable-edit-actions 0
@ -123,6 +123,11 @@ in
serviceConfig.ProtectSystem = "full";
};
services.tor.settings.SOCKSPort = mkIf cfg.enableTor [
# Route HTTP traffic over a faster port (without IsolateDestAddr).
{ addr = "127.0.0.1"; port = 9063; IsolateDestAddr = false; }
];
};
meta.maintainers = with lib.maintainers; [ rnhmjoj ];

View file

@ -1,34 +1,114 @@
{ config, lib, pkgs, ... }:
{ options, config, lib, pkgs, ... }:
with lib;
let
runDir = "/run/searx";
cfg = config.services.searx;
configFile = cfg.configFile;
generateConfig = ''
cd ${runDir}
# write NixOS settings as JSON
cat <<'EOF' > settings.yml
${builtins.toJSON cfg.settings}
EOF
# substitute environment variables
env -0 | while IFS='=' read -r -d ''' n v; do
sed "s#@$n@#$v#g" -i settings.yml
done
# set strict permissions
chmod 400 settings.yml
'';
settingType = with types; (oneOf
[ bool int float str
(listOf settingType)
(attrsOf settingType)
]) // { description = "JSON value"; };
in
{
imports = [
(mkRenamedOptionModule
[ "services" "searx" "configFile" ]
[ "services" "searx" "settingsFile" ])
];
###### interface
options = {
services.searx = {
enable = mkEnableOption
"the searx server. See https://github.com/asciimoo/searx";
enable = mkOption {
type = types.bool;
default = false;
relatedPackages = [ "searx" ];
description = "Whether to enable Searx, the meta search engine.";
};
configFile = mkOption {
environmentFile = mkOption {
type = types.nullOr types.path;
default = null;
description = "
The path of the Searx server configuration file. If no file
is specified, a default file is used (default config file has
debug mode enabled).
";
description = ''
Environment file (see <literal>systemd.exec(5)</literal>
"EnvironmentFile=" section for the syntax) to define variables for
Searx. This option can be used to safely include secret keys into the
Searx configuration.
'';
};
settings = mkOption {
type = types.attrsOf settingType;
default = { };
example = literalExample ''
{ server.port = 8080;
server.bind_address = "0.0.0.0";
server.secret_key = "@SEARX_SECRET_KEY@";
engines = lib.singleton
{ name = "wolframalpha";
shortcut = "wa";
api_key = "@WOLFRAM_API_KEY@";
engine = "wolframalpha_api";
};
}
'';
description = ''
Searx settings. These will be merged with (taking precedence over)
the default configuration. It's also possible to refer to
environment variables
(defined in <xref linkend="opt-services.searx.environmentFile"/>)
using the syntax <literal>@VARIABLE_NAME@</literal>.
<note>
<para>
For available settings, see the Searx
<link xlink:href="https://searx.github.io/searx/admin/settings.html">docs</link>.
</para>
</note>
'';
};
settingsFile = mkOption {
type = types.path;
default = "${runDir}/settings.yml";
description = ''
The path of the Searx server settings.yml file. If no file is
specified, a default file is used (default config file has debug mode
enabled). Note: setting this options overrides
<xref linkend="opt-services.searx.settings"/>.
<warning>
<para>
This file, along with any secret key it contains, will be copied
into the world-readable Nix store.
</para>
</warning>
'';
};
package = mkOption {
@ -38,6 +118,38 @@ in
description = "searx package to use.";
};
runInUwsgi = mkOption {
type = types.bool;
default = false;
description = ''
Whether to run searx in uWSGI as a "vassal", instead of using its
built-in HTTP server. This is the recommended mode for public or
large instances, but is unecessary for LAN or local-only use.
<warning>
<para>
The built-in HTTP server logs all queries by default.
</para>
</warning>
'';
};
uwsgiConfig = mkOption {
type = options.services.uwsgi.instance.type;
default = { http = ":8080"; };
example = literalExample ''
{
disable-logging = true;
http = ":8080"; # serve via HTTP...
socket = "/run/searx/searx.sock"; # ...or UNIX socket
}
'';
description = ''
Additional configuration of the uWSGI vassal running searx. It
should notably specify on which interfaces and ports the vassal
should listen.
'';
};
};
};
@ -45,36 +157,74 @@ in
###### implementation
config = mkIf config.services.searx.enable {
config = mkIf cfg.enable {
environment.systemPackages = [ cfg.package ];
users.users.searx =
{ uid = config.ids.uids.searx;
description = "Searx user";
createHome = true;
home = "/var/lib/searx";
{ description = "Searx daemon user";
group = "searx";
isSystemUser = true;
};
users.groups.searx =
{ gid = config.ids.gids.searx;
users.groups.searx = { };
systemd.services.searx-init = {
description = "Initialise Searx settings";
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
User = "searx";
RuntimeDirectory = "searx";
RuntimeDirectoryMode = "750";
} // optionalAttrs (cfg.environmentFile != null)
{ EnvironmentFile = builtins.toPath cfg.environmentFile; };
script = generateConfig;
};
systemd.services.searx = mkIf (!cfg.runInUwsgi) {
description = "Searx server, the meta search engine.";
wantedBy = [ "network.target" "multi-user.target" ];
requires = [ "searx-init.service" ];
after = [ "searx-init.service" ];
serviceConfig = {
User = "searx";
Group = "searx";
ExecStart = "${cfg.package}/bin/searx-run";
} // optionalAttrs (cfg.environmentFile != null)
{ EnvironmentFile = builtins.toPath cfg.environmentFile; };
environment.SEARX_SETTINGS_PATH = cfg.settingsFile;
};
systemd.services.uwsgi = mkIf (cfg.runInUwsgi)
{ requires = [ "searx-init.service" ];
after = [ "searx-init.service" ];
};
systemd.services.searx =
{
description = "Searx server, the meta search engine.";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
User = "searx";
ExecStart = "${cfg.package}/bin/searx-run";
};
} // (optionalAttrs (configFile != null) {
environment.SEARX_SETTINGS_PATH = configFile;
});
services.searx.settings = {
# merge NixOS settings with defaults settings.yml
use_default_settings = mkDefault true;
};
environment.systemPackages = [ cfg.package ];
services.uwsgi = mkIf (cfg.runInUwsgi) {
enable = true;
plugins = [ "python3" ];
instance.type = "emperor";
instance.vassals.searx = {
type = "normal";
strict = true;
immediate-uid = "searx";
immediate-gid = "searx";
lazy-apps = true;
enable-threads = true;
module = "searx.webapp";
env = [ "SEARX_SETTINGS_PATH=${cfg.settingsFile}" ];
pythonPackages = self: [ cfg.package ];
} // cfg.uwsgiConfig;
};
};
meta.maintainers = with lib.maintainers; [ rnhmjoj ];
meta.maintainers = with maintainers; [ rnhmjoj ];
}

View file

@ -0,0 +1,91 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.shellhub-agent;
in {
###### interface
options = {
services.shellhub-agent = {
enable = mkOption {
type = types.bool;
default = false;
description = ''
Whether to enable the ShellHub Agent daemon, which allows
secure remote logins.
'';
};
package = mkOption {
type = types.package;
default = pkgs.shellhub-agent;
defaultText = "pkgs.shellhub-agent";
description = ''
Which ShellHub Agent package to use.
'';
};
tenantId = mkOption {
type = types.str;
example = "ba0a880c-2ada-11eb-a35e-17266ef329d6";
description = ''
The tenant ID to use when connecting to the ShellHub
Gateway.
'';
};
server = mkOption {
type = types.str;
default = "https://cloud.shellhub.io";
description = ''
Server address of ShellHub Gateway to connect.
'';
};
privateKey = mkOption {
type = types.path;
default = "/var/lib/shellhub-agent/private.key";
description = ''
Location where to store the ShellHub Agent private
key.
'';
};
};
};
###### implementation
config = mkIf cfg.enable {
systemd.services.shellhub-agent = {
description = "ShellHub Agent";
wantedBy = [ "multi-user.target" ];
requires = [ "local-fs.target" ];
wants = [ "network-online.target" ];
after = [
"local-fs.target"
"network.target"
"network-online.target"
"time-sync.target"
];
environment.SERVER_ADDRESS = cfg.server;
environment.PRIVATE_KEY = cfg.privateKey;
environment.TENANT_ID = cfg.tenantId;
serviceConfig = {
# The service starts sessions for different users.
User = "root";
Restart = "on-failure";
ExecStart = "${cfg.package}/bin/agent";
};
};
environment.systemPackages = [ cfg.package ];
};
}

View file

@ -43,9 +43,9 @@ in
config = mkIf cfg.enable {
services.dbus.packages = [ pkgs.fprintd ];
services.dbus.packages = [ cfg.package ];
environment.systemPackages = [ pkgs.fprintd ];
environment.systemPackages = [ cfg.package ];
systemd.packages = [ cfg.package ];

File diff suppressed because it is too large Load diff

Some files were not shown because too many files have changed in this diff Show more