Commit graph

12945 commits

Author SHA1 Message Date
Symphorien Gibol 00a91d919d nixos/iodine: hardening 2020-02-04 20:54:29 +01:00
Symphorien Gibol 7437bff7d1 nixos/iodine: nixpkgs-fmt 2020-02-04 20:54:29 +01:00
Silvan Mosberger 3a4e550944
nixos/amazon-init.nix: add git/tar/gz, fix AMI configuration (#78363)
nixos/amazon-init.nix: add git/tar/gz, fix AMI configuration
2020-01-23 23:05:27 +01:00
Aaron Andersen b8cf3411d9
Merge pull request #78378 from Izorkin/unit-fix
nixos/unit: fix attrs
2020-01-23 15:46:23 -05:00
Profpatsch 166d8247d0 modules/at-spi2-core: add debugging help to description
This makes the error message greppable.
2020-01-23 19:31:05 +01:00
Izorkin f2c9bcf009 nixos/unit: fix attrs 2020-01-23 20:40:49 +03:00
Michael Weiss 5a4b93e33c
Merge pull request #76787 from primeos/sway
sway: 1.2 -> 1.4, wlroots: 0.8.1 -> 0.10.0
2020-01-23 14:19:59 +01:00
Christian Höppner 94899871b8
nixos/amazon-init.nix: Add gzip to amazon-init path 2020-01-23 14:15:26 +01:00
Christian Höppner 6d68699809
nixos/amazon-init.nix: Add gnutar to amazon-init PATH 2020-01-23 14:15:25 +01:00
Christian Höppner 52d5ce38fb
nixos/amazon-init.nix: add git to amazon-init script PATH 2020-01-23 14:15:18 +01:00
Graham Christensen ebb644a980
Merge pull request #76585 from serokell/mkaito/amazon-userdata-multiple-channels
virtualization/amazon-init: log multiple nix channels, fix nix path.
2020-01-22 19:02:44 -05:00
Maximilian Bosch 2d9e51adc3
Merge pull request #77532 from symphorien/roundcube
nixos/roundcube: security improvements
2020-01-22 21:58:25 +01:00
Michael Weiss e99b32d27f
nixos/sway: Install the new default terminal emulator
The default changed in Sway 1.3 from rxvt_unicode to alacritty. For
backward compatibility we'll install both terminal emulators by default.
2020-01-22 21:38:01 +01:00
Florian Klink dea2d64c35
Merge pull request #78134 from NinjaTrappeur/nin-harden-syncthing
nixos/syncthing.nix: Sandbox the systemd service.
2020-01-21 22:30:04 +01:00
Florian Klink a3d67f417e
Merge pull request #77665 from zaninime/ifxfrm
systemd-networkd: add configuration for XFRM interfaces
2020-01-21 22:14:53 +01:00
Florian Klink 0daae2e08c nixos/buildkite: drop user option (#78160)
* nixos/buildkite: drop user option

This reverts 8c6b1c3eaa.

Turns out, buildkite-agent has logic to write .ssh/known_hosts files and
only really works when $HOME and the user homedir are in sync.

On top of that, we provision ssh keys in /var/lib/buildkite-agent, which
doesn't work if that other users' homedir points elsewhere (we can cheat
by setting $HOME, but then getent and $HOME provide conflicting
results).

So after all, it's better to only run the system-wide buildkite agent as
the "buildkite-agent" user only - if one wants to run buildkite as
different users, systemd user services might be a better fit.

* nixosTests.buildkite-agent: add node with separate user and no ssh key
2020-01-21 13:21:57 +00:00
zimbatm ab10bac1b1
nixos-rebuild: fix the maybeSudo usage
* properly expand the command using arrays instead of strings
* also handle sudo on the localhost
2020-01-21 13:17:38 +01:00
zimbatm 93204f1d8a
nixos/matterbridge: fix package access
was broken by 4371ecb8a6 due to the
switch to buildGoModule
2020-01-21 13:17:18 +01:00
zimbatm b54c60b689
nixos/zerotierone: simplify the unit
There is no need to stop/start the unit when the machine is online or
offline.

This should fix the shutdown locking issues.

nixos zerotier: sometimes it doesn't shutdown
2020-01-21 13:14:38 +01:00
Jörg Thalheim 71c19d3efa
Merge pull request #76537 from Izorkin/unit
unit: 1.13.0 -> 1.14.0
2020-01-21 11:39:41 +00:00
worldofpeace 348e48fdcc
Merge pull request #78004 from worldofpeace/mtrack-remove
nixos/multitouch: remove (properly known as mtrack)
2020-01-20 17:07:59 -05:00
Silvan Mosberger 3929a0fbca
nixos/traceroute: init (#77953)
nixos/traceroute: init
2020-01-20 22:32:33 +01:00
worldofpeace afe27e517b nixos/multitouch: remove
On numerous occasions I have seen users mistake this
module as libinput because it being called "multitouch"
and them being unaware that the actually module they want
is libinput. They then run into several decrepit bugs due
to the completely out-of-date nature of the underlying package.
The underlying package hasn't been changed to an up-to-date
fork in a period of 8 years. I don't consider this to be production quality.
However, I'm not opposed for the module being readded to NixOS
with new packaging, and a better name.
2020-01-20 16:09:29 -05:00
Félix Baylac-Jacqué ff8f2928ee
nixos/syncthing.nix: Sandbox the systemd service.
Using systemd sandboxing features to harden the syncthing service.
2020-01-20 21:48:48 +01:00
zimbatm e20de6b57a
Merge pull request #78045 from flokli/buildkite-agent-user-runtime-test
nixos/buildkite: add option to configure user, add nix-required packages to runtime, add test
2020-01-20 13:50:10 +00:00
Florian Klink 4b73d3c444 nixos/buildkite: make privateSshKeyPath optional
When only cloning public repos, or when the ssh key is provided by
different means, we don't need to manage it here.
2020-01-20 11:10:56 +01:00
Florian Klink 70308a7daf nixos/buildkite-agent: add gnutar, gzip and git to runtimePackages
These are required for nix to do builtins.fetchTarball and
builtins.fetchGit, so most likely we want them to be around.
2020-01-20 10:30:24 +01:00
Florian Klink 7838f00824 nixos/buildkite: stop using deprecated option 2020-01-20 10:30:22 +01:00
Alexey Lebedeff ed16f830b0 rabbitmq: make all dependencies explicit
Some things were provided by default, some by systemd unit and some
were just miraculously working. This turns them into explicit
dependencies of the package itself, making everything properly
overrideable.

+ providing glibcLocales fixes elixir compile warnings

+ providing systemd dependency allows rabbit to use systemctl for unit
  activation check instead of falling back to sleep. This was seen as
  a warning during startup.
2020-01-19 23:24:27 +01:00
Florian Klink 8c6b1c3eaa nixos/buildkite-agent: add "user" option
This allows buildkite-agent to run as another user.

It'll still run builds from /var/lib/buildkite-agent and setup things in
there.
2020-01-19 21:21:15 +01:00
Florian Klink eba10dcbcb
Merge pull request #77950 from flokli/buildkite-3
nixos/buildkite-agent: move to v3
2020-01-19 14:23:49 +01:00
Florian Klink b32b29963f
Merge pull request #78018 from rnhmjoj/typo
nixos/unclutter: fix old typo
2020-01-19 14:19:32 +01:00
rnhmjoj bac3e6841b
nixos/unclutter: fix old typo 2020-01-19 10:09:12 +01:00
Antonio Nuno Monteiro e2c11ad3c0 nixos/kubernetes: allow configuring cfssl API server SANs 2020-01-18 23:39:21 -08:00
worldofpeace 765afd38fa
Merge pull request #76985 from Elyhaka/gdm_hides_gnome
gdm: refactor to properly handle wayland sessions
2020-01-18 20:39:07 -05:00
worldofpeace c6022f7abf nixos/gnome3: add gnome-shell to systemd.packages
This actually gets added via xdg.portal having gnome-shell.
However, that could change and it still for sure should be here.
2020-01-18 20:26:45 -05:00
worldofpeace ffcfb80781
Merge pull request #77690 from gnidorah/way-cooler
way-cooler: Remove
2020-01-18 14:50:41 -05:00
Matthias Beyer 29bb16a9cd way-cooler: Remove
As of 2020-01-09, way-cooler is officially dead:

    http://way-cooler.org/blog/2020/01/09/way-cooler-post-mortem.html

hence, remove the package and the module.

Signed-off-by: Matthias Beyer <mail@beyermatthias.de>

docs/release-notes: remove way-cooler

way-cooler: show warnings about removal

Apply suggestions from code review

Co-Authored-By: worldofpeace <worldofpeace@protonmail.ch>

way-cooler: add suggestion by @Infinisil
2020-01-18 18:25:01 +03:00
Symphorien Gibol b5d692e123 nixos/roundcube: provide path to mime.types file
fixes this warning:
WARNING: Mimetype to file extension mapping doesn't work properly!
2020-01-18 16:12:50 +01:00
Symphorien Gibol b6e6bec57c nixos/roundcube: don't use the default and insecure des_key
The php installer creates a random one, but we bypass it, so we have
to create one ourselves.

This should be backward compatible as encryption is used for session
cookies only: users at the time of the upgrade will be logged out but
nothing more.

259b7fa065/config/config.inc.php.sample (L73)
2020-01-18 16:12:50 +01:00
Symphorien Gibol 52cf727a53 nixos/roundcube: do not write passwords to the store nor run php as root
If the database is local, use postgres peer authentication.
Otherwise, use a password file.

Leave database initialisation to postgresql.ensure*.
Leave /var/lib/roundcube creation to systemd.
Run php upgrade script as unpriviledged user.
2020-01-18 15:27:45 +01:00
Elyhaka d18ac2bca1 gdm: refactor to properly handle wayland sessions 2020-01-18 10:56:11 +01:00
Florian Klink 63c310c07e nixos/buildkite-agent: change option meta-data into tags attrset
This is called tags in the buildkite 3.
2020-01-17 23:11:26 +01:00
volth d5d1293fe3 nixos/traceroute: init 2020-01-17 21:28:54 +00:00
worldofpeace b3c8534911
Merge pull request #77294 from worldofpeace/systemd-packages-duplicates
nixos/systemd-lib: don't fail on systemd.packages duplicates
2020-01-17 13:16:59 -05:00
Yorick van Pelt e1ad9d1685 nixos/buildkite-agent: add a shell attribute to specify the shell being used
This gets passed to BUILDKITE_SHELL, which will specify the shell being
used to executes script in.

Defaults to `${pkgs.bash}/bin/bash -e -c`, matching how buildkite
behaves on other distros.
2020-01-17 18:40:11 +01:00
Florian Klink 99d0f4c380 nixos/buildkite-agent: tweak TimeoutStopSec and KillMode
This improves behaviour when the service is being stopped.
2020-01-17 18:40:11 +01:00
Florian Klink 9237767277 nixos/buildkite-agent: actually use services.buildkite-agent.package
We were currently just using pkgs.buildkite-agent, no matter what was
configured in services.buildkite-agent.package
2020-01-17 18:40:11 +01:00
Florian Klink c154dd5101 nixos/buildkite-agent: stop deploying public keys, make ssh private key optional.
SSH public keys aren't needed to clone private repos, and if we only
need to configure a single attribute, there's no need for the "openssh"
attrset anymore.
2020-01-17 18:40:11 +01:00
Matt Layher 5089214a3d nixos/corerad: init 2020-01-16 12:38:36 -08:00