Commit graph

993 commits

Author SHA1 Message Date
talyz 041cbd860d nixos/gitlab: Abort on error and use of unset variables
Default behavior is to continue executing the script even when one or
multiple steps fail. We want to abort early if any part of the
initialization fails to not run with a partially initialized state.

Default behavior also allows dereferencing non-existent variables,
potentially resulting in hard-to-find bugs.
2019-10-28 14:56:37 +01:00
Eelco Dolstra 52e739cc58 nix-daemon.nix: Fix checkConfig 2019-10-23 21:30:28 +02:00
Aaron Andersen 43a3d8dc29
Merge pull request #71461 from etu/lidarr-specify-datadir-option
nixos/lidarr: Add dataDir option
2019-10-22 05:07:49 -04:00
Florian Klink 1125fb02cc
Merge pull request #71428 from talyz/gitlab-already-initialized-constant
gitlab: Get rid of most 'already initialized constant'-warnings
2019-10-21 20:52:54 +02:00
edef 0599c89d58
Merge pull request #71338 from edef1c/nix-daemon-opt-aliases
nixos/nix-daemon: don't refer to deprecated option aliases
2019-10-21 09:59:13 +00:00
Elis Hirwing 9319dd17d8
nixos/lidarr: Add dataDir option
This will bring this module to a state to be consistent with how the
other forks (sonarr & radarr) works.
2019-10-20 21:20:53 +02:00
talyz ed4a09c6f3 gitlab: Get rid of most 'already initialized constant'-warnings
On start, unicorn, sidekiq and other parts running ruby code emits
quite a few warnings similar to

/var/gitlab/state/config/application.rb:202: warning: already initialized constant Gitlab::Application::LOOSE_EE_APP_ASSETS
/nix/store/ysb0lgbzxp7a9y4yl8d4f9wrrzy9kafc-gitlab-ee-12.3.5/share/gitlab/config/application.rb:202: warning: previous definition of LOOSE_EE_APP_ASSETS was here
/var/gitlab/state/lib/gitlab.rb:38: warning: already initialized constant Gitlab::COM_URL
/nix/store/ysb0lgbzxp7a9y4yl8d4f9wrrzy9kafc-gitlab-ee-12.3.5/share/gitlab/lib/gitlab.rb:38: warning: previous definition of COM_URL was here

This seems to be caused by the same ruby files being evaluated
multiple times due to the paths being different - sometimes they're
loaded using the direct path and sometimes through a symlink, due to
our split between config and package data. To fix this, we make sure
that the offending files in the state directory always reference the
store path, regardless of that being the real file or a symlink.
2019-10-19 19:30:28 +02:00
edef a68219b79b nixos/nix-daemon: don't refer to deprecated option aliases
The `gc-` prefixed versions of these options have been
deprecated since Nix 2.0.
2019-10-18 12:27:43 +00:00
talyz 201cca9a04 Revert "nixos/gitlab: properly clear out initializers"
This reverts commit 2ee14c34ed.

This caused the initializers directory to be cleaned out while gitlab
was running in some instances. We clean out the directory on the
preStart stage already, so ensuring existance and permissions should
suffice.
2019-10-18 08:00:56 +02:00
Maximilian Bosch 7774945b70
Merge pull request #70469 from Vskilet/matrix-synapse-update
matrix-synapse: 1.3.1 -> 1.4.0
2019-10-15 01:31:21 +02:00
Victor SENE 372422390f
matrix-synapse: 1.3.1 -> 1.4.0
Bumps `matrix-synapse` to version 1.4.0[1]. With this version the
following changes in the matrix-synapse module were needed:

* Removed `trusted_third_party_id_servers`: option is marked as deprecated
  and ignored by matrix-synapse[2].
* Added `account_threepid_delegates` options as replacement for 3rdparty
  server features[3].
* Added `redaction_retention_period` option to configure how long
  redacted options should be kept in the database.
* Added `ma27` as maintainer for `matrix-synapse`.

Co-Authored-By: Notkea <pacien@users.noreply.github.com>
Co-authored-by: Maximilian Bosch <maximilian@mbosch.me>

[1] https://matrix.org/blog/2019/10/03/synapse-1-4-0-released
[2] https://github.com/matrix-org/synapse/pull/5875
[3] https://github.com/matrix-org/synapse/pull/5876
2019-10-15 01:11:18 +02:00
Florian Klink 1aad3acf15
nixos/gitlab: Don't print sensitive data to log on startup (#70861)
nixos/gitlab: Don't print sensitive data to log on startup
2019-10-11 18:10:16 +02:00
Eelco Dolstra 9d0de0dc57
nix-daemon.nix: Shut up warning 2019-10-10 16:24:33 +02:00
Eelco Dolstra 27d2857a99
nix-daemon.nix: Use 'nix ping-store' to initialize directories 2019-10-10 16:24:33 +02:00
Eelco Dolstra 4b950c42cd
nix-daemon.nix: Drop Nix 1.x compatibility
Probably didn't work anyway anymore.
2019-10-10 16:24:33 +02:00
Eelco Dolstra 4e0d6a5ff8
Don't create /nix/var/nix/{gcroots,per-user}/per-user with 1777 permission
In fact, don't create them at all because Nix does that automatically.

Also remove modules/programs/shell.nix because everything it did is
now done automatically by Nix.
2019-10-10 16:24:33 +02:00
talyz dc29a45fc9 nixos/gitlab: Don't print sensitive data to log on startup
gitlab:db:configure prints the root user's password to stdout on
successful setup, which means it will be logged to the
journal. Silence this informational output. Errors are printed to
stderr and will thus still be let through.
2019-10-09 16:59:18 +02:00
Robin Gloster b5449e65b5
Merge pull request #69344 from talyz/gitlab-create-database
nixos/gitlab: Fix databaseCreateLocally evaluation and operation
2019-10-09 00:28:21 +02:00
talyz c6efa9fd2d nixos/gitlab: Clean up the initializers on start
The initializers directory is populated with files from the gitlab
distribution on start, but old files will be left in the state folder
even if they're removed from the distribution, which can lead to
startup failures. Fix this by always purging the directory on start
before populating it.
2019-10-03 14:38:54 +02:00
talyz 0f8133d633 nixos/gitlab: Fix state directory permissions
Since the preStart script is no longer running in privileged mode, we
reassign the files in the state directory and its config subdirectory
to the user we're running as. This is done by splitting the preStart
script into a privileged and an unprivileged part where the privileged
part does the reassignment.

Also, delete the database.yml symlink if it exists, since we want to
create a real file in its place.

Fixes #68696.
2019-10-03 09:02:00 +02:00
Silvan Mosberger e463c7cd75
nixos/nix-daemon: Prevent network warning when checking config
Since version 2.3 (https://github.com/NixOS/nix/pull/2949 which was
cherry-picked to master) Nix issues a warning when --no-net wasn't
passed and there is no network interface. This commit adds the --no-net
flag to the nix.conf check such that no warning is issued.
2019-09-28 17:00:47 +02:00
Peter Hoeg 8cc9d24fe1
Merge pull request #69387 from peterhoeg/f/optimise
nixos/nix-optimise: be smarter about when we run the store optimiser
2019-09-26 13:10:39 +08:00
Peter Hoeg 81cd220c67 nixos/pymks: log to journal 2019-09-25 06:33:34 +08:00
Peter Hoeg 4b34dd3120
Merge pull request #69300 from peterhoeg/f/ha2
nixos/home-assistant: set bluetooth perms
2019-09-25 04:49:31 +08:00
talyz 58a7502421 nixos/gitlab: Only create the database when databaseHost is unset
Make sure that we don't create a database if we're not going to
connect to it. Also, fix the assertion that usernames be equal to only
trig when peer authentication is used (databaseHost == "").
2019-09-24 15:04:20 +02:00
talyz ec958d46ac nixos/gitlab: Fix evaluation failure when postgresql is disabled
config.services.postgresql.package is only defined when the postgresql
service is activated, which means we fail to evaluate when
databaseCreateLocally == false. Fix this by using the default
postgresql package when the postgresql service is disabled.
2019-09-24 15:04:19 +02:00
talyz dfc43f7d0a nixos/gitlab: Document the restriction introduced on statePath
The state path now, since the transition from initialization in
preStart to using systemd-tmpfiles, has the following restriction: no
parent directory can be owned by any other user than root or the user
specified in services.gitlab.user. This is a potentially breaking
change and the cause of the error isn't immediately obvious, so
document it both in the release notes and statePath description.
2019-09-23 17:55:58 +02:00
Peter Hoeg e537a0a11e home-assistant: set capabilities for bluetooth 2019-09-23 21:54:16 +08:00
Florian Klink 6262e83f5f
nixos/gitlab: Add gnutar and gzip to gitlab-sidekiq's path (#68908)
nixos/gitlab: Add gnutar and gzip to gitlab-sidekiq's path
2019-09-23 06:40:52 +02:00
Jos van Bakel 86b83f37b8
nixos/gitea: fix dump 2019-09-21 09:28:53 +02:00
talyz aceac9d531 nixos/gitlab: Add gnutar and gzip to gitlab-sidekiq's path
Tar and gzip are needed when importing GitLab project exports.
2019-09-17 09:27:16 +02:00
schneefux bab6e6eb04
nixos/gitlab: Remove todo about mysql support
GitLab has ended MySQL support.
https://about.gitlab.com/2019/06/27/removing-mysql-support/
2019-09-14 11:26:22 +02:00
talyz 4b6ba5b27c nixos/gitlab: Fix swap of secrets
Fix accidental swap of the otp and db secrets in the secrets.yml
file. Fixes #68613.
2019-09-13 08:40:59 +02:00
Sander van der Burg e987e3fef9 nixos/dysnomia: enable InfluxDB support 2019-09-09 23:28:10 +02:00
Florian Klink 2f3b9cd52c
Merge pull request #66274 from talyz/gitlab
nixos/gitlab: Add support for secure secrets and more
2019-09-07 12:52:44 -07:00
talyz 240649a510 nixos/gitlab: Extract arbitrary secrets from extraConfig
Adds the ability to make any parameter specified in extraConfig secret
by defining it an attrset containing the attr _secret, which in turn
is a path to a file containing the actual secret.
2019-09-06 16:57:23 +02:00
talyz b351454cac nixos/gitlab: Use postgresql module options to provision local db
Use the postgresql module to provision a local db (if
databaseCreateLocally is true) instead of doing this locally.

Switch to using the local unix socket for db connections by default;
this is needed since dbs created by the postgresql module only support
peer authentication.

Instead of running the rake tasks db:schema:load, db:migrate and
db:seed_fu, run gitlab:db:configure, which in turn runs these tasks
when needed.

Solves issue #53852 for gitlab.
2019-09-06 16:56:20 +02:00
talyz cbdf94c0f3 nixos/gitlab: Add support for storing secrets in files
Add support for storing secrets in files outside the nix store, since
files in the nix store are world-readable and secrets therefore can't
be stored safely there.

The old string options are kept, since they can potentially be handy
for testing purposes, but their descriptions now state that they
shouldn't be used in production. The manual section is updated to use
the file options rather than the string options and the tests now test
both.
2019-09-06 16:54:22 +02:00
talyz 7648b4f8ba nixos/gitlab: Fix missing ca_file for SMTP
Work around upstream issue #790 by explicitly referencing the
ca-certificates.crt file.
2019-09-06 10:17:31 +02:00
Jan Tojnar cdf426488b
Merge branch 'master' into staging-next
Fixed trivial conflicts caused by removing rec.
2019-09-06 03:20:09 +02:00
Aaron Andersen b54a120a82 nixos/zookeeper: recursively set permissions and ownership on dataDir 2019-09-03 11:57:57 -04:00
Vladimír Čunát f21211ebfe
Merge branch 'master' into staging 2019-09-02 23:25:24 +02:00
Florian Klink f74735c9d7 nixos: remove dependencies on local-fs.target
Since https://github.com/NixOS/nixpkgs/pull/61321, local-fs.target is
part of sysinit.target again, meaning units without
DefaultDependencies=no will automatically depend on it, and the manual
set dependencies can be dropped.
2019-09-01 19:06:38 +02:00
Silvan Mosberger 478e7184f8
nixos/modules: Remove all usages of types.string
And replace them with a more appropriate type

Also fix up some minor module problems along the way
2019-08-31 18:19:00 +02:00
Frederik Rietdijk ad1d58c622 Merge staging-next into staging 2019-08-31 10:04:20 +02:00
volth 08f68313a4 treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
Frederik Rietdijk 5061fe0c2c Merge staging-next into staging 2019-08-28 08:26:42 +02:00
Eelco Dolstra 35c1c170d7 nix.conf: Set sandbox-fallback = false
For security, we don't want the sandbox to be disabled silently.
2019-08-27 21:17:20 +02:00
volth 35d68ef143 treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
Peter Hoeg 574ec28ef1 nixos/zoneminder: open telnet port for remote admin 2019-08-26 14:47:00 +08:00