Commit graph

826 commits

Author SHA1 Message Date
Masayuki Takeda 65faff97ff nixos/lxd: partial fix 2018-02-10 17:18:53 +09:00
Jan Malakhovski 0d1a643210 nixos/xen-dom0: add related packages, make it play well with them
This is a custom attribute set example of `relatedPackages` option usage.
2018-02-09 19:51:07 +00:00
Tuomas Tynkkynen 71631a922b runInLinuxVM: Use QEMU command line that works on other architectures
... by moving the existing definition to qemu-flags.nix and reusing
that.
2018-01-30 16:57:27 +02:00
Tuomas Tynkkynen 8e83158f12 nixos/qemu: Deduplicate QEMU serialDevice into qemu-flags.nix 2018-01-30 16:57:27 +02:00
Jesper 2b270c1596 nixos/containers: Enable use of the network.useHostResolvConf option (#34354) 2018-01-28 14:42:15 +00:00
Jörg Thalheim e45dfded2b
Merge pull request #34052 from volth/patch-86
nixos/libvirtd: add qemu-img to $PATH of the daemon
2018-01-22 14:39:29 +00:00
Tuomas Tynkkynen 962e79ef32 nixos/make-disk-image.nix: Support EFI images
- Add a new parameter `imageType` that can specify either "efi" or
  "legacy" (the default which should see no change in behaviour by
  this patch).

- EFI images get a GPT partition table (instead of msdos) with a
  mandatory ESP partition (so we add an assert that `partitioned`
  is true).

- Use the partx tool from util-linux to determine exact start + size
  of the root partition. This is required because GPT stores a secondary
  partition table at the end of the disk, so we can't just have
  mkfs.ext4 create the filesystem until the end of the disk.

- (Unrelated to any EFI changes) Since we're depending on the
  `-E offset=X` option to mkfs which is only supported by e2fsprogs,
  disallow any attempts of creating partitioned disk images where
  the root filesystem is not ext4.
2018-01-22 11:18:23 +02:00
volth c4eb23062e
nixos/libvirtd: add qemu-img to $PATH of the daemon
...because daemon's $PATH does not include "/run/current-system/sw/bin"
2018-01-19 16:28:01 +00:00
Rob Vermaas 38538f3206
Merge pull request #33423 from AmineChikhaoui/gce-ssh-keys
Fix ssh keys retrieval in GCE instances
2018-01-18 13:06:00 +01:00
Eelco Dolstra 6bbd67d45a
EC2 AMIs: 17.09.2356.cb751f9b1c3 -> 17.09.2681.59661f21be6 2018-01-10 13:16:49 +01:00
zimbatm eddf30cc93
nixos: introduce boot.growPartition (#33521)
Move it from being a profile
2018-01-06 13:52:51 +00:00
AmineChikhaoui 5dba59d494
Fixes https://github.com/NixOS/nixops/issues/756.
Seems the google compute metadata service behavior changed a bit
recently which caused this issue ?
see: https://cloud.google.com/compute/docs/storing-retrieving-metadata
2018-01-04 16:50:05 +01:00
Peter Hoeg 85e507ebea hyperv-daemons: add nixos module 2018-01-04 21:09:01 +08:00
Jörg Thalheim 0bbf671b5a
Merge pull request #31157 from sorki/lxcfs_pam_related
[wip] lxcfs,pam: disable cgmanager, enable pam_cgfs, lxcfs 2.0.7 -> 2.0.8
2018-01-01 15:42:03 +01:00
Graham Christensen b5a61f2c59
Revert "nixos: doc: implement related packages in the manual" 2017-12-23 07:19:45 -05:00
Arseniy Seroka 36e02645eb
Merge pull request #32424 from oxij/nixos/related-packages
nixos: doc: implement related packages in the manual
2017-12-23 03:34:58 +03:00
volth 363cdde475 nixos/libvirt: remove 'virtualisation.libvirtd.enableKVM' option 2017-12-21 03:56:41 +00:00
volth a52aa6aafb nixos/libvirt: avoid dependency on two qemu packages
Currently libvirt requires two qemu derivations: qemu and qemu_kvm which is just a truncated version of qemu (defined as qemu.override { hostCpuOnly = true; }).

This patch exposes an option virtualisation.libvirtd.qemuPackage which allows to choose which package to use:

 * pkgs.qemu_kvm if all your guests have the same CPU as host, or
 * pkgs.qemu which allows to emulate alien architectures (for example ARMV7L on X86_64), or
 * a custom derivation

virtualisation.libvirtd.enableKVM option is vague and could be deprecate in favor of virtualisation.libvirtd.qemuPackage, anyway it does allow to enable/disable kvm.
2017-12-21 03:56:40 +00:00
Eelco Dolstra 3c82e6fc82
Add AMI for eu-west-3 2017-12-20 16:19:33 +01:00
Jörg Thalheim 5687f61b19
Merge pull request #32637 from makefu/pkgs/openstack/nuke
nuke openstack (again)
2017-12-15 10:06:23 -08:00
makefu 269d8a17b5
openstack module: rip
part of openstack cleanup
2017-12-15 16:08:38 +01:00
makefu 71767ee3c7
glance: rip
part of openstack cleanup
2017-12-15 16:08:10 +01:00
makefu d3d94992cf
keystone: rip
part of openstack cleanup
2017-12-15 16:06:44 +01:00
Eelco Dolstra e4847b797e
Update NixOS 17.09 AMIs
This adds support for c5.* instances.

Fixes #32612.
2017-12-13 23:42:09 +01:00
makefu 5369400bb0
nova: rip
part of openstack cleanup
2017-12-13 18:16:29 +01:00
Robert Helgesson 5eb4a8339c
nixos containers: remove stray , from pattern
See #31888.
2017-12-12 18:35:06 +01:00
Bas van Dijk 5572de75a0
containers: deny networkmanager from managing the ve-* and vb-* NICs
Without this, when you've enabled networkmanager and start a
nixos-container the container will briefly have its specified IP
address but then networkmanager starts managing it causing the IP
address to be dropped.
2017-12-12 18:22:15 +01:00
Jan Malakhovski 3be0e1bd72 nixos/xen-dom0: add related packages, make it play well with them 2017-12-07 21:27:32 +00:00
Tuomas Tynkkynen b2e315f97f nixos/qemu-vm: Pass gic-version=host for AArch64
This is required on the ThunderX CPUs on the Packet.net Type-2A
machines that have a GICv3. For some reason the default is to create a
GICv2 independent of the host hardware...
2017-12-06 17:29:09 +02:00
Daniel Peebles 5fd528d043
amazon-image: use NTP provided by the hypervisor
See http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html for more information.

Fixes #32187
2017-11-29 22:48:00 -05:00
Tuomas Tynkkynen e56da6a464 nixos/qemu-vm: Use different serial port on ARM/AArch64 2017-11-26 11:13:21 +02:00
Tuomas Tynkkynen 0a2eda7a7e nixos/qemu-vm: Don't try enabling graphics/mouse on non-x86
Needs to be figured out some day, just disable them for now.
2017-11-26 11:13:21 +02:00
Tuomas Tynkkynen 43cb964e17 nixos/qemu-vm: Set QEMU command line depending on architecture 2017-11-26 11:13:21 +02:00
Luke Adams 2ce30c5b53 remove prlcc from global systemd services 2017-11-11 17:05:08 -06:00
Luke Adams 0f047e612b prl-tools: Add all user services using systemd.user 2017-11-11 17:05:08 -06:00
Luke Adams 26d6eab655 prl-tools: remove unnecessary kernel modules 2017-11-11 17:05:08 -06:00
Eelco Dolstra 54da9cc944
Amazon image: Add NVMe support to the initrd
This is required by the new c5.* instance types.

Note that this changes disk names from /dev/xvd* to
/dev/nvme0n*. Amazon Linux has a udev rule that calls a Python script
named "ec2nvme-nsid" to create compatibility symlinks. We could use
that, but it would mean adding Python to the AMI closure...
2017-11-09 17:53:26 +01:00
Jörg Thalheim ea78f0f06c lxcfs: remove cgmanager dependency 2017-11-07 11:04:12 +00:00
Frederik Rietdijk ae23084237
Merge pull request #30107 from danbst/patch-13
declarative containers: improve example config
2017-11-04 09:59:09 +01:00
Richard Marko 0810111ced lxcfs: don't enable cgmanager
Related to #30023
2017-11-02 02:52:07 +01:00
Danylo Hlynskyi 398705ba86
containers: autoStart doc typo 2017-11-01 10:25:26 +02:00
Eelco Dolstra 8f349a3bf3
Add function closureInfo to replace pathsFromGraph
Unlike pathsFromGraph, on Nix 1.12, this function produces a
registration file containing correct NAR hash/size information.

https://hydra.nixos.org/build/62832723
2017-10-25 15:38:14 +02:00
Bjørn Forsman 0ff4bb5f87 nixos: run parted with --script option
-s, --script: never prompts for user intervention

Sometimes the NixOS installer tests fail when they invoke parted, e.g.
https://hydra.nixos.org/build/62513826/nixlog/1. But instead of exiting
right there, the tests hang until the Nix builder times out (and kills
the build). With this change the tests would instead fail immediately,
which is preferred.

While at it, use "parted --script" treewide, so nobody gets build
timeout due to parted error (or misuse). (Only nixos/ use it, and only
non-interactive.)

A few instances already use the short option "-s", convert them to long
option "--short".
2017-10-14 15:29:02 +02:00
Peter Hoeg b366760cf5 Revert "hyperv-daemons: add nixos module"
This reverts commit 0944d44f1b.
2017-10-14 14:42:49 +08:00
Peter Hoeg 0944d44f1b hyperv-daemons: add nixos module 2017-10-14 14:38:04 +08:00
Danylo Hlynskyi dc8500165c declarative containers: improve example config
Container config example code mentions `postgresql` service, but the correct use of that service involves setting `system.stateVersion` option (as discovered in https://github.com/NixOS/nixpkgs/issues/30056).

The actual system state version is set randomly to 17.03 because I have no preferences here
2017-10-05 00:42:50 +00:00
Eelco Dolstra 9b3aa19a88
Add NixOS 17.09 AMIs
Fixes #29976.
2017-10-03 16:56:59 +02:00
Jörg Thalheim 2354e0f05a cloud-utils: 0.29 -> 0.30 2017-10-02 09:11:20 +01:00
Rob Vermaas 0783efb41c
google-instance-setup: add openssh to path 2017-09-15 10:43:09 +00:00
lewo 3a377e26b2 nixos/nova-image: cleanup image builders (#29242)
There are currently two ways to build Openstack image. This just picks
best of both, to keep only one!

- Image is resizable
- Cloudinit is enable
- Password authentication is disable by default
- Use the same layer than other image builders (ec2, gce...)
2017-09-11 17:33:33 +01:00
Tim Steinbach a54b2e3ba2 Merge pull request #29002 from NeQuissimus/docker_edge_module_test
docker: Package in module, tests
2017-09-06 15:03:56 -04:00
Franz Pletz 1bed4773f5
postgresql92: remove last references 2017-09-05 18:20:56 +02:00
Tim Steinbach 2bb57ef776
docker: Allow package selection in module 2017-09-04 19:02:05 -04:00
Robin Gloster 8994b27c54
libvirtd module: add qemu_kvm to path 2017-08-28 12:54:41 +02:00
evujumenuk 36dd8edde1 containers: remove EXIT_ON_REBOOT
EXIT_ON_REBOOT has been obsolete since sometime in 2014.
2017-08-24 20:48:24 +02:00
Peter Hoeg 698efcb7b5 open-vm-tools: do not pull x dependencies unconditionally
The "headless" configuration option is ignored because we unconditionally
reference pkgs.open-vm-tools.

This fixes that.
2017-08-15 17:05:30 +08:00
Franz Pletz 9fda9f8c79 Merge pull request #27903 from volth/issue-27857-libvirt-xml-manipulation
libvirt: 3.5.0 -> 3.6.0
2017-08-12 21:45:01 +02:00
volth 15351c4780 apply 'restartIfChanged = false' to all libvirtd services
Although it is quite safe to restart ```libvirtd``` when there are only ```qemu``` machines, in case if there are ```libvirt_lxc``` containers, a restart may result in putting the whole system into an odd state: the containers go on running but the new ```libvirtd``` daemons do not see them.
2017-08-10 11:34:32 +00:00
Alexander Gall a0a4bea2a6 nixos/cloud-image: add module
The module creates an image for an openstack-based cloud using the
cloud-init package.
2017-08-07 13:03:02 +02:00
Robin Gloster 2dddc6dcf6 libvirt: don't suspend and resume on change 2017-08-05 11:00:02 +00:00
Robin Gloster 485a8fef73
modules: specify some types 2017-08-04 02:20:31 +02:00
Volth 84a6a3683b libvirt: 3.5.0 -> 3.6.0 2017-08-03 13:53:57 +00:00
Franz Pletz 1697684591
docker module: fix autoPrune.enable description
cc #27503
2017-07-21 16:54:40 +02:00
Pascal Bach 22acfd0327 docker service: add option to do automatic pruning
This allows to run the prune job periodically on a machine.
By default the if enabled the job is run once a week.

The structure is similar to how system.autoUpgrade works.
2017-07-20 20:33:16 +02:00
zimbatm 14f53e5251 Merge pull request #26214 from zimbatm/google-compute-image
Google compute image
2017-07-19 09:49:20 +01:00
Rob Vermaas ec313abdce
Add file with Azure image locations, similar to ec2-amis.nix. Will be used by nixops.
(cherry picked from commit e93f26847ea41cce6633b6a0feb6ce31b0722d5d)
2017-07-18 09:18:51 +00:00
Rob Vermaas 412bfda422
Add file with GCE image locations, similar to ec2-amis.nix. Will be used by nixops.
(cherry picked from commit 9d810ddcc1938a90090fd60f8924f4e83acbeee2)
2017-07-18 09:16:15 +00:00
zimbatm c93d68b6ed google-compute-image module: use google services
This adds a few google-specific services to setup the machine.

Accounts are now dynamically created using the google-accounts-daemon,
which allows to click on the "SSH" button in the console and have it
working.

The NixOS image now supports the userdata startup and shutdown scripts.

Misc:
* add all the google services from https://github.com/GoogleCloudPlatform/compute-image-packages/tree/master/google_compute_engine_init/systemd
* add udev rules for disk labels
* synched sysctl rules with https://github.com/GoogleCloudPlatform/compute-image-packages/blob/master/google_config/sysctl/11-gce-network-security.conf
2017-07-15 19:36:38 +01:00
Bjørn Forsman b8e109d6ac nixos/libvirt: prevent OVMF path from being garbage collected
Use xmlstarlet to update the OVMF path on each startup, like we do for
<emulator>...qemu-kvm</emulator>.

A libvirt domain using UEFI cannot start if the OVMF path is garbage
collected/missing.
2017-07-14 22:07:57 +02:00
Bjørn Forsman 292827b0e0 nixos/libvirt: modify xml with xmlstarlet
Instead of grep and sed, which is brittle.

(I don't know how to preserve the comment we currently add to say that
this line is auto-updated. But I don't think it adds much value, so I'm
not spending any effort on it.)
2017-07-14 22:07:57 +02:00
Michał Pałka 9e6bfbb2f9 xen_4_8: init at 4.8.1
This commit adds the xen_4_8 package to be used instead of
xen (currently at 4.5.5):
 * Add packages xen_4_8, xen_4_8-slim and xen_4_8-light
 * Add packages qemu_xen_4_8 and qemu_xen_4_8-light to be used
   with xen_4_8-slim and xen_4_8-light respectively.
 * Add systemd to buildInputs of xen (it is required by oxenstored)
 * Adapt xen service to work with the new version of xen
 * Use xen-init-dom0 to initlilise dom0 in xen-store
 * Currently, the virtualisation.xen.stored option is ignored
   if xen 4.8 is used
2017-06-27 12:01:53 +00:00
Bastian Köcher 179c504a66 lxd: 2.0.2 -> 2.12 (#25685)
* Upgrades lxd to version 2.12

* Adds missing packages to path for lxd
2017-05-24 19:29:38 +01:00
Joachim F 8f89e43427 Merge pull request #25700 from michalpalka/xen-bridge-stop-fix
xen service: Fix removing netfilter rules while stopping xen-bridge
2017-05-21 17:22:33 +01:00
Joachim F 07ceaa2ec8 Merge pull request #25896 from joachifm/ovmf
ovmf: split firmware image files
2017-05-21 14:48:29 +01:00
Mateusz Kowalczyk a2c900dc87 GCE-service: Update fetch-ssh-keys API usage 2017-05-20 22:54:07 +01:00
Joachim Fasting 252dcd62f3
OVMF: separate output for ovmf binaries
OVMF{,CODE,VARS}.fd are now available in a dedicated fd output, greatly
reducing the closure in the common case where only those files are used (a
few MBs versus several hundred MBs for the full OVMF).

Note: it's unclear why `dontPatchELF` is now necessary for the build to
pass (on my end, at any rate) but it doesn't make much sense to run this
fixup anyway,

Note: my reading of xen's INSTALL suggests that --with-system-ovmf should
point directly to the OVMF binary.  As such, the previous invocation was
incorrect (it pointed to the root of the OVMF tree).  In any case, I have
only built xen with `--with-system-ovmf`, I have not tested it.

Fixes https://github.com/NixOS/nixpkgs/issues/25854
Closes https://github.com/NixOS/nixpkgs/pull/25855
2017-05-20 12:33:48 +02:00
Michał Pałka 1c7629ce63 xen service: Fix removing netfilter rules while stopping xen-bridge
This fixes a bug in the stopping script for the xen-bridge service,
which caused the script to crash and fail to remove some
netfilter rules.
2017-05-11 09:52:36 +00:00
Peter Hoeg 112b5556af Merge pull request #25397 from clefru/qemu-OVMF-on-channels
Introduce virtualisation.libvirtd.qemuOvmf.
2017-05-09 16:36:45 +08:00
Joachim F dc2fc5ed57 Merge pull request #25495 from michalpalka/xen-forward-dns
xen service: Forward DNS queries from Xen guests
2017-05-06 13:56:10 +01:00
Joachim F 6ef9875edb Merge pull request #25494 from michalpalka/xendomains
xen service: Add the possibility to override configuration of xendomains
2017-05-06 13:55:59 +01:00
Michał Pałka e7203cb03d xen service: Forward DNS queries from Xen guests
Provide the option forwardDns in virtualisation.xen.bridge, which
enables forwarding of DNS queries to the default resolver, allowing
outside internet access for the xen guests.
2017-05-04 08:48:03 +00:00
Michał Pałka 3b0daa1a28 xen service: Add the possibility to override configuration of xendomains
Add the option virtualisation.xen.domain.extraConfig, which
allows overriding options passed to xendomains.
2017-05-04 08:31:40 +00:00
Clemens Fruhwirth df5d588f13 Introduce virtualisation.libvirtd.qemuOvmf. 2017-05-01 18:36:13 +02:00
Michał Pałka 2fcb8714ba xen service: fix xen-bridge not setting the configured netmask
The xen-bridge service accepts the option prefixLength, but does not
use it to set the actual netmask on the bridge. This commit makes
it set the correct netmask.
2017-04-28 07:48:51 +00:00
Jörg Thalheim 7b96e3d6a7 Merge pull request #25245 from bachp/docker-proxy
docker: pass all proxy variables to docker daemon
2017-04-27 11:03:46 +02:00
Pascal Bach 846f36203c docker: pass all proxy variables to docker daemon
This makes things as noProxy work too.
2017-04-26 16:55:36 +02:00
Jörg Thalheim 9d3c118320
google-compute-image: append .raw.tar.gz suffix
This restores behavior of image generation before f1708a9d7d
2017-04-26 16:40:38 +02:00
Dan Peebles ee2cffbdb4 azure-image: switch to use the common make-disk-image.nix 2017-04-25 02:59:13 +00:00
Graham Christensen 3ab98d0971 Merge pull request #24999 from grahamc/qemu
qemu module: add virtualisation.cores option
2017-04-24 21:30:39 -04:00
Graham Christensen 4585fdb9d4
qemu module: add virtualisation.cores option
QEMU can allow guests to access more than one host core at a time.
Previously, this had to be done via ad-hoc arguments:

    virtualisation.qemu.options = ["-smp 12"];

Now you can simply specify:

    virtualisation.cores = 12;
2017-04-24 15:23:46 -04:00
Dan Peebles 9fae0f3f38 google-compute-image: switch to use the common make-disk-image.nix 2017-04-24 18:38:10 +00:00
Jörg Thalheim fa4eff9b52 Merge pull request #24360 from clefru/gce-image-shrink-on-master
Shrink GCE bootstrap image to minimum size, and auto-expand it to actual size on first boot.
2017-04-10 12:01:53 +02:00
Eelco Dolstra 35dbcbb296
Fix eval error due to config.ec2.hvm 2017-04-04 13:49:13 +02:00
Eelco Dolstra 279565c3d6
Revert "Revert "EC2: Disable PV support""
This reverts commit 71710fd099.
2017-04-04 13:03:05 +02:00
Jörg Thalheim 71710fd099
Revert "EC2: Disable PV support"
This reverts commit fbe6d23624.

this breaks every non-ec2 (non-hvm) system

cc @edolstra
2017-04-04 12:05:21 +02:00
Eelco Dolstra 8cc3db6b67
Add 17.03 AMIs 2017-04-03 17:46:34 +02:00
Eelco Dolstra fbe6d23624
EC2: Disable PV support
Unfortunately, somewhere between 16.09 and 17.03, paravirtualized
instances stopped working. They hang at the pv-grub prompt
("grubdom>"). I tried reverting to a 4.4 kernel, reverting kernel
compression from xz to bzip2 (even though pv-grub is supposed to
support xz), and reverting the only change to initrd generation
(5a8147479e). Nothing worked so I'm
giving up.
2017-04-03 17:46:34 +02:00
Alexey Shmalko fa4fe71105
docker: fix socket permissions
Docker socket is world writable. This means any user on the system is
able to invoke docker command. (Which is equal to having a root access
to the machine.)

This commit makes socket group-writable and owned by docker group.

Inspired by
https://github.com/docker/docker/blob/master/contrib/init/systemd/docker.socket
2017-04-03 09:05:37 -04:00
Clemens Fruhwirth 72ec884cc6 Make GCE image as small as possible and incorporate partition growing
when users of nixops specified a larger root disk via
deployment.gce.rootDiskSize

1GB is the smallest possible size as GCP doesn't support
fractions of GB for RAW images, see
https://cloud.google.com/compute/docs/images/import-existing-image#requirements
2017-03-27 17:41:42 +02:00
Franz Pletz 1b95985b71 Merge pull request #24148 from volth/libvirt-3.1.0
libvirt: 3.0.0 -> 3.1.0
2017-03-27 10:02:06 +02:00
c74d a4ac5506f5 google-compute-image: fix Yama LSM option conflict
Having fixed the Google Compute Engine image build process's copying
of store paths in PR #24264, I ran `nixos-rebuild --upgrade switch`...
and the GCE image broke again, because it sets the NixOS configuration
option for the sysctl variable `kernel.yama.ptrace_scope` to
`mkDefault "1"`, i.e., with override priority 1000, and now the
`sysctl` module sets the same option to `mkDefault "0"` (this was
changed in commit 86721a5f78).

This patch raises the override priority of the Google Compute Engine
image configuration's definition of the Yama sysctl option to 500
(still lower than the priority of an unmodified option definition).

I have tested that this patch allows the Google Compute Engine image
to again build successfully for me.
2017-03-26 21:09:58 +02:00
Franz Pletz d545772640
libvirt: make guest suspend work, use upstream units 2017-03-25 14:59:01 +01:00
c74d e0e520a519 google-compute-image: copy store paths with rsync
In `nixos/modules/virtualisation/google-compute-image.nix`, copy store
paths with `rsync -a` rather than `cp -prd`, because `rsync` seems
better able to handle the hard-links that may be present in the store,
whereas `cp` may fail to copy them.

I have tested that the Google Compute Engine image builds successfully
for me with this patch, whereas it did not without this patch.

This is the same fix applied for Azure images in commit
097ef6e435d5b3fcde92e67abbaaaaaf05c0723d.

Fixes #23973.
2017-03-24 02:14:10 +01:00
Jan Malakhovski 2822bacd60
nixos: xen: condition default packages on enable
Closes #23690.
2017-03-24 01:54:04 +01:00
Franz Pletz fb50cde71e
nixos/treewide: systemd.time is in manvolume 7
cc #23396
2017-03-21 08:28:53 +01:00
Franz Pletz 9536169074
nixos/treewide: remove boolean examples for options
They contain no useful information and increase the length of the
autogenerated options documentation.

See discussion in #18816.
2017-03-17 23:36:19 +01:00
Volth bcc4c261be lxc: ensure directory /var/lib/lxc/rootfs 2017-03-15 12:42:27 +01:00
Daiderd Jordan b52af49d36
virtualisation-xen: fix defaultText interpolation 2017-03-11 00:09:22 +01:00
Graham Christensen 9e6ae2f60a Merge pull request #23441 from oxij/pkg/pretty-xen
xen: modular expression
2017-03-07 18:52:40 -05:00
Joachim Fasting 15da23d5c1
nixos/modules: use defaultText/literalExample where applicable
Primarily to fix rendering of default values/examples but also
to avoid unnecessary work.
2017-03-07 14:06:08 +01:00
Jan Malakhovski 442b8d49d0 nixos: xen: make packages configurable 2017-03-05 14:01:17 +00:00
Jaka Hudoklin f5d81ed79b Merge pull request #20904 from offlinehacker/nixos/xserver/xpra
Add xpra display-manager
2017-03-05 01:32:23 +01:00
Thomas Strobel b9a7aacef7 improve: modules/virtualisation/qemu-vm.nix
disk image for qemu VM with bootloader:
* remove redundant command
* improve readability
* improve execution speed
* make output more reproducible
2017-03-04 11:31:47 +01:00
Thomas Strobel 0a8d9779c5 fix: "nixos-rebuild build-vm-with-bootloader" 2017-03-03 19:14:20 +01:00
Dan Peebles 6018cf4a69 amazon-init.service: fix starting services at startup
We now make it happen later in the boot process so that multi-user
has already activated, so as to not run afoul of the logic in
switch-to-configuration.pl. It's not my favorite solution, but at
least it works. Also added a check to the VM test to catch the failure
so we don't break in future.

Fixes #23121
2017-02-27 16:51:36 +00:00
Antoine Eiche 386c19a224 nova-image: support partition resizing 2017-02-24 22:19:53 +01:00
Antoine Eiche dec7ecbbbc nova-image: refactoring
The nova image configuration is separated from the image build.
2017-02-24 22:17:52 +01:00
Dan Peebles 15c05ad213 google-compute-image.nix: fix evaluation failure 2017-02-22 23:51:57 +00:00
Tristan Helmich 1d64f5f41b
libvirt: expose libvirt qemu configuration file
fixes #22823
2017-02-21 19:20:22 +01:00
Franz Pletz 05c2c13182 Merge pull request #22715 from phi-gamma/fix-22709-xen-domU
xen: update domU config for pvgrub2
2017-02-21 06:14:12 +01:00
Eelco Dolstra 4b833facf1 Add ca-central-1 AMIs 2017-02-19 23:46:08 +01:00
Dan Peebles b172684c17 amazon-init NixOS module: fix (I think) race condition with network
The initialization code is now a systemd service that explicitly
waits for network-online, so the occasional failure I was seeing
because the `nixos-rebuild` couldn't get anything from the binary
cache should stop. I hope!
2017-02-16 16:03:58 +00:00
Bjørn Forsman 34c1b74421 nixos/virtualbox: unbreak wrt. new security.wrappers
The new option takes an attrset, not a list.
2017-02-15 07:25:33 +01:00
Ian-Woo Kim 5ca0f72472 nixos-container: break lines in description of forwardPorts. 2017-02-15 05:12:46 +01:00
Ian-Woo Kim 4f0b663c2e nixos-container: hostPort -> forwardPort and forwardPort is now a list of (protocol,hostPort,containerPort). 2017-02-15 05:12:46 +01:00
Ian-Woo Kim 0bfc631de2 nixos-container: support multiple port forwarding. change type of hostPort from 'string' to 'listOf str' 2017-02-15 05:12:46 +01:00
Ian-Woo Kim 8684285251 nixos-container: introduce hostPort in declarative container options. 2017-02-15 05:12:46 +01:00
Ian-Woo Kim a238c8a575 nixos-container: add --port option for nixos-container (forward network ports to systemd-nspawn container) 2017-02-15 05:12:46 +01:00
Parnell Springmeyer 9e36a58649
Merging against upstream master 2017-02-13 17:16:28 -06:00
Eelco Dolstra a4ec1841da
VM tests: veryloose -> cache=loose 2017-02-13 12:18:10 +01:00
Rob Vermaas af3732b6c6
Azure: switch back to qemu 2.2.0 for generating image. Seems to work best.
(cherry picked from commit 2da8a5dac8674501ba9ed10e44650088b466688a)
2017-02-13 09:55:03 +00:00
Rob Vermaas eff0752dbc
Use default qemu for azure image generation, and use option to enforce sizing of image to be compliant with Azure/HyperV.
(cherry picked from commit e16db5666af987f8a76be82ff219e138e92af442)
2017-02-13 08:54:41 +00:00
Dan Peebles e63d15f173 ecs-agent NixOS module: enable docker 2017-02-13 04:06:31 +00:00
Philipp Gesang 3dad33227f
xen: update domU config for pvgrub2
fix #22709

Recent pvgrub (from Grub built with “--with-platform=xen”) understands
the Grub2 configuration format. Grub legacy configuration (menu.lst) is
ignored.
2017-02-12 20:53:54 +01:00
Dan Peebles 3809938208 ecs-agent module: remove debug print
Whoops :)
2017-02-10 15:16:17 -05:00
Tuomas Tynkkynen a14ef4ad52 open-vm-tools: 10.0.7 -> 10.1.0
Also add an option to disable all the X11 stuff.
2017-02-10 20:12:00 +02:00
Dan Peebles a0ebb1497f ecs-agent NixOS module: init
A very simple skeleton for now that doesn't attempt to model any of
the agent configuration, but we can grow it later. Tested and works
on an EC2 instance with ECS.
2017-02-10 05:37:38 +00:00
Nikolay Amiantov 9eb540b807 qemu-vm module: fix boot.tmpOnTmpfs
This option caused systemd to mount /tmp on top of /tmp/{xchg,shared}.

Fixes #21490.
2017-02-03 15:02:34 +03:00
Parnell Springmeyer 4aa0923009
Getting rid of the var indirection and using a bin path instead 2017-01-29 04:11:01 -06:00
Parnell Springmeyer a8cb2afa98
Fixing a bunch of issues 2017-01-29 01:58:12 -06:00
Parnell Springmeyer e92b8402b0
Addressing PR feedback 2017-01-28 20:48:03 -08:00
Parnell Springmeyer a26a796d5c
Merging against master - updating smokingpig, rebase was going to be messy 2017-01-26 02:00:04 -08:00
Parnell Springmeyer bae00e8aa8
setcap-wrapper: Merging with upstream master and resolving conflicts 2017-01-25 11:08:05 -08:00
Eelco Dolstra 42a7d906d9
EC2 AMIs: 16.09.666.3738950 -> 16.09.1508.3909827
In particular, this includes a fix for using ephemeral disks for /tmp,
and adds AMIs for the new eu-west-2 (London) and us-east-2 (Ohio)
regions.
2017-01-18 12:42:39 +01:00
Jörg Thalheim 30a554acfb
apparmor: support for lxc profiles 2017-01-10 23:01:03 +01:00
Eelco Dolstra d496f23df0
amazon-image.nix: Remove redundant log message
(cherry picked from commit c4b5ed5db74cde94b19d519a8d875e3f7df48a76)
2017-01-03 17:32:47 +01:00
Jörg Thalheim ce99e34b17
docker: deprecate socketActivation option 2017-01-01 09:03:09 +01:00
Antoine Eiche 49efa083c7 nixos/glance: set default glance package
Before, it was overridden in the config section to avoid problem related
to manual generation.
2016-12-31 09:36:57 +01:00
Antoine Eiche 6c94d6437d nixos/glance: init at liberty version
This commit is based on initial works made by domenkozar.
2016-12-31 09:36:57 +01:00
Eelco Dolstra bbd03e236a
Use looser 9pfs caching in VM tests/builds
This can give significant speed ups, see
7e20254412.
2016-12-29 21:26:16 +01:00
Jörg Thalheim 585c642bf8
docker: use upstream service file from package 2016-12-25 00:09:13 +01:00
Jörg Thalheim c23032a8b1 docker: update service units from upstream
All the new options in detail:

Enable docker in multi-user.target make container created with restart=always
to start. We still want socket activation as it decouples dependencies between
the existing of /var/run/docker.sock and the docker daemon. This means that
services can rely on the availability of this socket. Fixes #11478 #21303

  wantedBy = ["multi-user.target"];

This allows us to remove the postStart hack, as docker reports on its own when
it is ready.

  Type=notify

The following will set unset some limits because overhead in kernel's ressource
accounting was observed. Note that these limit only apply to containerd.
Containers will have their own limit set.

  LimitNPROC=infinity
  LimitCORE=infinity
  TasksMax=infinity

Upgrades may require schema migrations. This can delay the startup of dockerd.

  TimeoutStartSec=0

Allows docker to create its own cgroup subhierarchy to apply ressource limits on
containers.

  Delegate=true

When dockerd is killed, container should be not affected to allow
`live restore` to work.

  KillMode=process
2016-12-23 21:39:38 +01:00
Eelco Dolstra ea46420fc0
Use overlayfs instead of unionfs-fuse in the VM tests
Overlayfs is quite a bit faster, e.g. with it the KDE 5 test takes ~7m
instead of ~30m on my laptop (which is still not great, since plain
9pfs is ~4m30s).
2016-12-21 20:49:08 +01:00
Eelco Dolstra a02bb00156
Enable virtualisation.writableStore by default
This works around:

  machine: must succeed: nix-store -qR /run/current-system | grep nixos-
  machine# error: changing ownership of path ‘/nix/store’: Invalid argument

Probably Nix shouldn't be anal about the ownership of the store unless
it's trying to build/write to the store.

http://hydra.nixos.org/build/45093872/nixlog/17/raw
(cherry picked from commit 57a0f140643cde409022e297ed05e05f8d34d778)
2016-12-20 10:52:47 +01:00
Eelco Dolstra f173da375d
Use only one build of qemu in VM tests
Previously we were using two or three (qemu_kvm, qemu_test, and
qemu_test with a different dbus when minimal.nix is included).

(cherry picked from commit 8bfa4ce82ea7d23a1d4c6073bcc044e6bf9c4dbe)
2016-12-20 10:52:46 +01:00
Eelco Dolstra aad5d1f9a7
virtualisation.qemu.program: Remove
This option is defined in qemu-vm.nix, but that module is not always
imported.

http://hydra.nixos.org/build/44817443
(cherry picked from commit 03c55005dfd6fbcd5cf8e00128a3bb6336b3bc0f)
2016-12-20 10:52:46 +01:00
Jörg Thalheim 1590461887 ntp: make timesyncd the new default
- most nixos user only require time synchronisation,
  while ntpd implements a battery-included ntp server (1,215 LOCs of C-Code vs 64,302)
- timesyncd support ntp server per interface (if configured through dhcp for instance)
- timesyncd is already included in the systemd package, switching to it would
  save a little disk space (1,5M)
2016-12-17 00:00:45 +01:00
Antoine Eiche a932f68d9c nixos/keystone: secrets can be read from files
A secret can be stored in a file. It is written at runtime in the
configuration file.
Note it is also possible to write them in the nix store for dev
purposes.
2016-12-16 20:53:32 +01:00
Antoine Eiche 415c9ff90b nixos/keystone: init at liberty version
This commit introduces a nixos module for the Openstack Keystone
service. It also provides a optional bootstrap step that creates some
basic initial resources (tenants, endpoints,...).

The provided test starts Keystone by enabling bootstrapping and checks
if user creation works well.

This commit is based on initial works made by domenkozar.
2016-12-16 20:53:32 +01:00
Eelco Dolstra 705829b29a Merge pull request #20500 from aszlig/qemu-patched-for-nixos-tests
nixos/tests: Use a patched QEMU for testing
2016-12-15 12:38:29 +01:00
montag451 ea5551b551 containers: fix broken /etc/hosts entries when localAddress contains a netmask 2016-12-12 09:20:28 +01:00
montag451 4889c271ca Add macvlan support for declarative containers 2016-12-12 07:34:28 +01:00
Jaka Hudoklin 8ce94b6e89 virtualbox guest module: make x11 optional 2016-12-04 22:24:01 +01:00
Jörg Thalheim e00632e200 Merge pull request #20858 from Mic92/lxcfs
lxcfs: init at 2.0.4
2016-12-04 11:33:07 +01:00
Jörg Thalheim 7c7dc15cbf
lxcfs: add module 2016-12-04 11:26:17 +01:00
Franz Pletz 2401f06801
containers: disable dhcpcd on veth bridge interfaces 2016-12-04 01:41:10 +01:00
Joachim F 8eefcb5c09 Merge pull request #19900 from michalpalka/xen-fix-xen-bridge2
xen service: fix wrong netmask handed out by xen-bridge.service
2016-11-28 16:31:05 +01:00
Joachim F 944868dd9b Merge pull request #19851 from michalpalka/xen-fix-xen-bridge
xen service: fix iptables race condition in xen-bridge.service
2016-11-28 16:30:16 +01:00
Christian Kampka 35ecef2c6d containers module: Add tmpfs options (#20557)
Allows one or more directories to be mounted as a read-only file system.

This makes it convenient to run volatile containers that do not retain
application state.
2016-11-22 02:11:33 +01:00
Joachim F eca9955b83 Merge pull request #20485 from anoever/master
vmware-guest: fix vmmouse driver
2016-11-20 03:39:28 +01:00
Andreas Noever 9a1507f253 vmware-guest: fix vmmouse driver
Fix automatic mouse grabbing/releasing when running as a vmware guest.

1. The xf86inputvmmouse is not loaded by default. Add it.
2. InptutDevice sections for which specify a driver are ignored if
AutoAddDevices is enabled (which it is by default). See [1]. Instead use
an InputClass to load the vmmouse driver.

[1] https://www.x.org/archive/X11R7.7/doc/man/man5/xorg.conf.5.xhtml#heading8
2016-11-18 19:58:44 +01:00
aszlig 6cfb3b6364
nixos/tests: Use a patched QEMU for testing
The reason to patch QEMU is that with latest Nix, tests like "printing"
or "misc" fail because they expect the store paths to be owned by uid 0
and gid 0.

Starting with NixOS/nix@5e51ffb1c2, Nix
builds inside of a new user namespace. Unfortunately this also means
that bind-mounted store paths that are part of the derivation's inputs
are no longer owned by uid 0 and gid 0 but by uid 65534 and gid 65534.

This in turn causes things like sudo or cups to fail with errors about
insecure file permissions.

So in order to avoid that, let's make sure the VM always gets files
owned by uid 0 and gid 0 and does a no-op when doing a chmod on a store
path.

In addition, this adds a virtualisation.qemu.program option so that we
can make sure that we only use the patched version if we're *really*
running NixOS VM tests (that is, whenever we have imported
test-instrumentation.nix).

Tested against the "misc" and "printing" tests.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-17 17:16:16 +01:00
Domen Kožar 2326c8de4d cloud-utils: 0.27 -> 0.29
We keep the existing hacks for growpart to work
inside the initrd

Fixes #15736 #17015
2016-11-17 15:15:42 +01:00
Ricardo M. Correia af01fa71e0 nixos.libvirtd: fix broken VMs due to emulator path changes
This had already been fixed in f52f9bf7cd,
but the problem was reintroduced in
bce59a1a8b because the path to the XML
files changed.
2016-11-03 14:55:44 +01:00
Michał Pałka fc3eed2cb0 xen service: fix wrong netmask handed out by xen-bridge.service
The dnsmasq instance run by the xen-bridge.service errorenously
hands out 172.16.0.0 as the netmask over DHCP to the VMs. This
commit removes the option responsible for that from dnsmasq.conf,
so that the proper netmask is inferred by dnsmasq instead.

Addresses https://github.com/NixOS/nixpkgs/issues/19883
2016-10-26 16:26:01 +00:00
Michał Pałka 9553928486 xen service: fix iptables race condition in xen-bridge.service
The calls to iptables in xen-bridge.service were missing the -w switch,
which caused them to fail if another script was calling iptables
at the same time. Fix it by adding the -w switch.

Addresses https://github.com/NixOS/nixpkgs/issues/19849 .
2016-10-25 07:55:22 +00:00
Arnold Krille b6023f37ad container: fix extraVeth submodule usage
the submodule needs options, not a plain set.
2016-10-09 16:02:14 +02:00
Eelco Dolstra 4b89d47887 ec2-amis.nix: Create a "latest" attribute for NixOps 2016-10-03 18:16:34 +02:00
Eelco Dolstra 39b75f3b9f Add NixOS 16.09.666.3738950 AMIs 2016-10-03 18:02:17 +02:00
Jörg Thalheim cd673d3c26 Merge pull request #19138 from nhooyr/openssh
openssh: support prohibit-password for permitRootLogin
2016-10-02 15:26:21 +02:00
Eric Sagnes a67b597b22 container module: allowedDevices type to submodule
The optionSet type is deprecated in favor of submodule
2016-10-02 14:07:00 +09:00
Anmol Sethi 6891bb1c59
openssh: support prohibit-password for permitRootLogin
See 1dc8d93ce6

I also made it the default.
2016-10-01 13:23:56 -04:00
Joachim F 7e80c42b0e Merge pull request #18511 from ericsagnes/feat/remove-optionSet
modules: optionSet -> submodule
2016-10-01 17:57:45 +02:00
Jörg Thalheim a8c172ca4b Merge pull request #18822 from wlhlm/containers-dev-tun
Allow access to /dev/net/tun inside containers
2016-10-01 00:19:02 +02:00
Wilhelm Schuster 0d1e1b1810 containers module: Add option to enable tunnel access
This adds the containers.<name>.enableTun option allowing containers to
access /dev/net/tun. This is required by openvpn, tinc, etc. in order to
work properly inside containers.

The new option builds on top of two generic options
containers.<name>.additionalCapabilities and
containers.<name>.allowedDevices which also can be used for example when
adding support for FUSE later down the road.
2016-09-25 19:25:17 +02:00
Jörg Thalheim d6ce2e4bcb
containers: fix dynamic hash lookup
we want the content of attribute as a key:
b9df84cd4f broke this
2016-09-24 09:26:52 +02:00
Eelco Dolstra b9df84cd4f nixos-container: Syntax fixes
Get rid of the "or null" stuff. Also change 'cfg . "foo"' to 'cfg.foo'.

Also fixed what appears to be an actual bug: in postStartScript,
cfg.attribute (where attribute is a function argument) should be
cfg.${attribute}.
2016-09-22 14:06:22 +02:00
Evgeny Egorochkin 9dd366c385 add Azure bootstrap blob list 2016-09-15 16:27:47 +03:00
aszlig 1781e95577
Merge pull request #18567 (VirtualBox 5.1.6)
This introduces VirtualBox version 5.1.6 along with a few refactored
stuff, notably:

  * Kernel modules and user space applications are now separate
    derivations.
  * If config.pulseaudio doesn't exist in nixpkgs config, the default is
    now to build with PulseAudio modules.
  * A new updater to keep VirtualBox up to date.

All subtests in nixos/tests/virtualbox.nix succeed on my machine and
VirtualBox was reported to be working by @DamienCassou (although with
unrelated audio problems for another fix/branch) and @calbrecht.
2016-09-14 02:20:16 +02:00
Jaka Hudoklin 7a9dd489d6 Merge pull request #18481 from offlinehacker/pkgs/docker/1.12.1
docker: 1.10.3 -> 1.12.1
2016-09-13 15:59:18 +02:00
Jaka Hudoklin 5d9c62541a docker module: updates
- logDriver option, use journald for logging by default
- keep storage driver intact by default, as docker has sane defaults
- do not choose storage driver in tests, docker will choose by itself
- use dockerd binary as "docker daemon" command is deprecated and will be
  removed
- add overlay2 to list of storage drivers
2016-09-13 12:51:13 +02:00
aszlig eea4af1c4c
nixos/virtualbox-image: Fix path to virtualbox
VirtualBox user space binaries now no longer reside in linuxPackages, so
let's use the package for the real user space binaries instead.

Tested using the following command:

nix-build nixos/release.nix -A ova.x86_64-linux

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-09-13 07:26:59 +02:00
aszlig 8bd89c922d
virtualbox: Split kernel modules into own package
Putting the kernel modules into the same output path as the main
VirtualBox derivation causes all of VirtualBox to be rebuilt on every
single kernel update.

The build process of VirtualBox already outputs the kernel module source
along with the generated files for the configuration of the main
VirtualBox package. We put this into a different output called "modsrc"
which we re-use from linuxPackages.virtualbox, which is now only
containing the resulting kernel modules without the main user space
implementation.

This not only has the advantage of decluttering the Nix expression for
the user space portions but also gets rid of the need to nuke references
and the need to patch out "depmod -a".

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-09-13 06:12:38 +02:00
Eric Sagnes 69713a882c containers module: optionSet -> submodule 2016-09-13 12:54:59 +09:00
Alexander Ried 27bc34f1e4 treewide: deprecate ip-up.target (#18319)
Systemd upstream provides targets for networking. This also includes a target network-online.target.

In this PR I remove / replace most occurrences since some of them were even wrong and could delay startup.
2016-09-10 18:03:59 +02:00
Rob Vermaas d6dbe43af2 bightbox-image.nix: use lib in stead of stdenv.lib. Fixes #18208 2016-09-02 10:04:09 +00:00
Parnell Springmeyer 98c058a1ee Adapting everything for the merged permissions wrappers work. 2016-09-01 19:21:06 -05:00
Данило Глинський (Danylo Hlynskyi) 78cd9f8ebc virtualbox: add headless build (without Qt dependency) (#18026) 2016-09-01 20:54:58 +02:00
Mango Chutney 40d2fa2a1b Don't break grow-partition 2016-08-31 03:06:46 +00:00
Nathan Zadoks f503f648b3 virtualbox-image module: enable partition / filesystem growth 2016-08-30 16:48:05 -04:00
Nathan Zadoks 346c31000b amazon-grow-partition module: rename to grow-partition 2016-08-30 16:48:04 -04:00
Nathan Zadoks 1de8e1b02e amazon-grow-partition module: autodetect the root device 2016-08-30 16:48:04 -04:00
Guillaume Maudoux 3aef93e8f0 nixos/containers: Process config like toplevel options (#17365) 2016-08-29 18:25:50 +02:00
obadz f0da094b2e virtualbox-image: remove raw image (hopefully fixes ova tests)
See also 80660f8
2016-08-28 11:33:15 +01:00
obadz 80660f8261 virtualbox-image: use vmdk wrapper instead of vdi copy (avoids 1 disk copy) 2016-08-27 03:02:53 +01:00
obadz 58db7f508f virtualbox-image: remove configFile to let clone-config do its job in demo
Fixes #13927
cc @edolstra

configFile in make-disk-image clashes with clone-config as the latter does
nothing if it finds a a /etc/nixos/configuration.nix during stage-2.
2016-08-27 02:07:47 +01:00
obadz e208e698f9 deleted: nixos/modules/virtualisation/qemu-opts (file likely checked in by accident) 2016-08-24 18:07:43 +01:00
Tuomas Tynkkynen 74a3a2cd7e treewide: Use makeBinPath 2016-08-23 01:18:10 +03:00
Nikolay Amiantov 6b41f1132c nixos treewide: don't set MODULE_DIR 2016-08-19 17:56:54 +03:00
Nikolay Amiantov 5ff6e98486 modprobe service: drop kmod wrapper 2016-08-19 17:56:49 +03:00
Nikolay Amiantov ff22705793 treewide: replace several /sbin paths by /bin 2016-08-19 17:56:45 +03:00
Shea Levy 9adad8612b Revert "Merge branch 'modprobe-fix' of git://github.com/abbradar/nixpkgs"
Was meant to go into staging, sorry

This reverts commit 57b2d1e9b0, reversing
changes made to 760b2b9048.
2016-08-15 19:05:52 -04:00
Nikolay Amiantov 1f63958772 nixos treewide: don't set MODULE_DIR 2016-08-16 00:19:25 +03:00
Nikolay Amiantov b2ebecd9e5 modprobe service: drop kmod wrapper 2016-08-16 00:19:25 +03:00
Nikolay Amiantov 1afd250676 treewide: replace several /sbin paths by /bin 2016-08-16 00:19:25 +03:00
Arnold Krille 9045a8e24c declarative containers: additional veths
With these changes, a container can have more then one veth-pair. This allows for example to have LAN and DMZ as bridges on the host and add dedicated containers for proxies, ipv4-firewall and ipv6-firewall. Or to have a bridge for normal WAN, one bridge for administration and one bridge for customer-internal communication. So that web-server containers can be reached from outside per http, from the management via ssh and can talk to their database via the customer network.

The scripts to set up the containers are now rendered several times instead of just one template. The scripts now contain per-container code to configure the extra veth interfaces. The default template without support for extra-veths is still rendered for the imperative containers.

Also a test is there to see if extra veths can be placed into host-bridges or can be reached via routing.
2016-07-28 23:06:41 +02:00
Eelco Dolstra fd5bbdb436 nixos-containers: Set DevicePolicy=closed
This makes the container a bit more secure, by preventing root
creating device nodes to access the host file system, for
instance. (Reference: systemd-nspawn@.service in systemd.)
2016-07-28 17:58:55 +02:00
Eelco Dolstra bf3edfbb3c nixos-containers: Use systemd 231's --notify-ready flag 2016-07-28 17:58:52 +02:00
Matthew Justin Bauer 802a700373 virtualbox: fix virtualbox guest additions (#16964) 2016-07-19 13:55:44 +02:00
Eric Merritt eb92804f91 nixos-containers: init package (#16959)
This moves nixos-containers into its own package so that it can be
relied upon by other packages/systems. This should make development
using dynamic containers much easier.
2016-07-19 08:13:06 +02:00
Nikolay Amiantov 399db54e35 nixos/qemu: don't recreate extra disks 2016-07-19 05:20:02 +03:00
Eelco Dolstra 9aa3e78ab2 Update 16.03 AMIs 2016-07-12 17:26:29 +02:00
Eelco Dolstra 56badfee94 amazon-image.nix: Add the ena driver
This is necessary for Enhanced Networking on x1.* instances.
2016-07-11 14:32:18 +02:00
Eelco Dolstra 3adb769776 amazon-image.nix: Add the ixgbevf driver 2016-07-07 17:51:15 +02:00
Rickard Nilsson 7d67a4da99 nixos/libvirtd: Don't use the --daemon flag now that we use the 'notify' service type 2016-07-01 18:21:42 +02:00
Rickard Nilsson a0c0f63811 nixos/libvirt: Syntactic-only refactoring 2016-06-27 13:32:24 +02:00
Rickard Nilsson 301b4e9018 nixos/libvirt: Add virtlogd and virtlockd systemd sockets and services 2016-06-27 13:32:21 +02:00
Rickard Nilsson 1b54e48561 nixos/libvirt: Adapt libvirtd.service to upstream sources 2016-06-27 13:04:52 +02:00
Rickard Nilsson 37f4889851 nixos/libvirt: Remove non-functional service libvirt-guests
It doesn't have a start script, so it hasn't worked at all in
a long time.
2016-06-27 10:34:29 +00:00
Zack Piper f36c8f5f54 lxd: pkg.lxd does not point to the binaries
`pkg.lxd.bin` does
2016-06-19 20:30:36 +01:00
Benno Fünfstück 3850123f32 nixos/docker: use wrapped modprobe
We need to use wrapped modprobe, so that it finds the right
modules. Docker needs modprobe to load overlay kernel module
for example.

This fixes an an error starting docker if the booted system's kernel
version is different from the /run/current-system profile's one.
2016-06-11 21:13:37 +02:00
Eelco Dolstra 7c19b395eb Explicitly specify the subsystem for /dev/vboxguest
Otherwise systemd gets confused and forgets about device units after
reloading.

https://github.com/NixOS/nixops/issues/391
https://github.com/systemd/systemd/issues/3423
2016-06-03 00:33:15 +02:00
aszlig dc38003af9
nixos/containers: Create an empty machine-id file
Since systemd version 230, it is required to have a machine-id file
prior to the startup of the container. If the file is empty, a transient
machine ID is generated by systemd-nspawn.

See systemd/systemd#3014 for more details on the matter.

This unbreaks all of the containers-* NixOS tests.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @edolstra
Closes: #15808
2016-05-29 18:38:37 +02:00
Eelco Dolstra b37d6d8996 Fix failure to start old containers
The existence of $root/var/lib/private/host-notify as a socket
prevented a bind mount:

  container foo[8083]: Failed to create mount point /var/lib/containers/foo/var/lib/private/host-notify: No such device or address
2016-05-26 16:19:40 +02:00
Eelco Dolstra 845c9b50bf boot.initrd.luks.devices: Change into an attribute set
This allows setting options for the same LUKS device in different
modules. For example, the auto-generated hardware-configuration.nix
can contain

  boot.initrd.luks.devices.crypted.device = "/dev/disk/...";

while configuration.nix can add

  boot.initrd.luks.devices.crypted.allowDiscards = true;

Also updated the examples/docs to use /disk/disk/by-uuid instead of
/dev/sda, since we shouldn't promote the use of the latter.
2016-05-25 18:04:21 +02:00
Eelco Dolstra 32bed83b18 Remove boot.loader.grub.timeout and boot.loader.gummiboot.timeout
There is a generic boot.loader.timeout option.
2016-05-25 11:39:17 +02:00
zimbatm 3ade1e7d3e Merge branch 'pr/14911' 2016-05-05 21:28:27 +01:00
Joaquim Pedro França Simão 133dc10e5a open-vm-tools: fixes host VMware errors 2016-05-05 21:27:54 +01:00
Eelco Dolstra ecfc523d32 Update EC2 AMIs to 16.03.659.011ea84
This includes the binutils mass rebuild.
2016-04-29 10:28:35 +02:00
Tuomas Tynkkynen 60f5659dad treewide: Use correct output in ${config.nix.package}/bin 2016-04-25 16:44:37 +02:00
Tuomas Tynkkynen bee04a37ad amazon-init.nix: Use makeBinPath
This also fixes the incorrect use of 'dev' outputs from
config.nix.package and pkgs.systemd.
2016-04-25 16:44:37 +02:00
Franz Pletz 8cca66f774 Merge pull request #14018 from kampfschlaefer/feature/hostbridge_and_ipv6_for_containers
containers: hostbridge and IPv6
2016-04-24 20:33:46 +02:00
Tuomas Tynkkynen d0c127487f qemu-img: Fix module paths
They are compressed nowadays.

Not sure if these are really needed since nobody noticed they were
broken, but anyway...
2016-04-22 10:42:31 +03:00
Tuomas Tynkkynen 01854a850a treewide: Replace module_init_tools -> kmod
The former is deprecated and doesn't handle compressed kernel modules,
so all current usages of it are broken.
2016-04-22 10:40:57 +03:00
Nikolay Amiantov 8b7ebaffeb replace makeSearchPath tree-wise to take care of possible multiple outputs 2016-04-13 22:09:41 +03:00
Vladimír Čunát 30f14243c3 Merge branch 'master' into closure-size
Comparison to master evaluations on Hydra:
  - 1255515 for nixos
  - 1255502 for nixpkgs
2016-04-10 11:17:52 +02:00
Vladimír Čunát d1df28f8e5 Merge 'staging' into closure-size
This is mainly to get the update of bootstrap tools.
Otherwise there were mysterious segfaults:
https://github.com/NixOS/nixpkgs/pull/7701#issuecomment-203389817
2016-04-07 14:40:51 +02:00
Eelco Dolstra ab2855b975 Add 16.03 AMIs 2016-04-05 11:25:12 +02:00
Arnold Krille 3c819f28f5 containers: Make declarative containers real systemd services
Without the templating (which is still present for imperative containers), it
will be possible to set individual dependencies. Like depending on the network
only if the hostbridge or hardware interfaces are used.

Ported from #3021
2016-04-02 17:07:41 +02:00
Arnold Krille aa46904490 containers: Add a hostbridge and ipv6 addresses
This allows the containers to have their interface in a bridge on the host.
Also this adds IPv6 addresses to the containers both with bridged and unbridged
network.
2016-04-02 17:07:41 +02:00