Commit graph

7973 commits

Author SHA1 Message Date
symphorien 1addf1fd94
nixos/iodine: improve description of some options
Co-Authored-By: Martin Weinelt <mweinelt@users.noreply.github.com>
2020-02-05 19:42:07 +00:00
Symphorien Gibol 00a91d919d nixos/iodine: hardening 2020-02-04 20:54:29 +01:00
Symphorien Gibol 7437bff7d1 nixos/iodine: nixpkgs-fmt 2020-02-04 20:54:29 +01:00
Aaron Andersen b8cf3411d9
Merge pull request #78378 from Izorkin/unit-fix
nixos/unit: fix attrs
2020-01-23 15:46:23 -05:00
Profpatsch 166d8247d0 modules/at-spi2-core: add debugging help to description
This makes the error message greppable.
2020-01-23 19:31:05 +01:00
Izorkin f2c9bcf009 nixos/unit: fix attrs 2020-01-23 20:40:49 +03:00
Maximilian Bosch 2d9e51adc3
Merge pull request #77532 from symphorien/roundcube
nixos/roundcube: security improvements
2020-01-22 21:58:25 +01:00
Florian Klink dea2d64c35
Merge pull request #78134 from NinjaTrappeur/nin-harden-syncthing
nixos/syncthing.nix: Sandbox the systemd service.
2020-01-21 22:30:04 +01:00
Florian Klink 0daae2e08c nixos/buildkite: drop user option (#78160)
* nixos/buildkite: drop user option

This reverts 8c6b1c3eaa.

Turns out, buildkite-agent has logic to write .ssh/known_hosts files and
only really works when $HOME and the user homedir are in sync.

On top of that, we provision ssh keys in /var/lib/buildkite-agent, which
doesn't work if that other users' homedir points elsewhere (we can cheat
by setting $HOME, but then getent and $HOME provide conflicting
results).

So after all, it's better to only run the system-wide buildkite agent as
the "buildkite-agent" user only - if one wants to run buildkite as
different users, systemd user services might be a better fit.

* nixosTests.buildkite-agent: add node with separate user and no ssh key
2020-01-21 13:21:57 +00:00
zimbatm 93204f1d8a
nixos/matterbridge: fix package access
was broken by 4371ecb8a6 due to the
switch to buildGoModule
2020-01-21 13:17:18 +01:00
zimbatm b54c60b689
nixos/zerotierone: simplify the unit
There is no need to stop/start the unit when the machine is online or
offline.

This should fix the shutdown locking issues.

nixos zerotier: sometimes it doesn't shutdown
2020-01-21 13:14:38 +01:00
Jörg Thalheim 71c19d3efa
Merge pull request #76537 from Izorkin/unit
unit: 1.13.0 -> 1.14.0
2020-01-21 11:39:41 +00:00
worldofpeace 348e48fdcc
Merge pull request #78004 from worldofpeace/mtrack-remove
nixos/multitouch: remove (properly known as mtrack)
2020-01-20 17:07:59 -05:00
worldofpeace afe27e517b nixos/multitouch: remove
On numerous occasions I have seen users mistake this
module as libinput because it being called "multitouch"
and them being unaware that the actually module they want
is libinput. They then run into several decrepit bugs due
to the completely out-of-date nature of the underlying package.
The underlying package hasn't been changed to an up-to-date
fork in a period of 8 years. I don't consider this to be production quality.
However, I'm not opposed for the module being readded to NixOS
with new packaging, and a better name.
2020-01-20 16:09:29 -05:00
Félix Baylac-Jacqué ff8f2928ee
nixos/syncthing.nix: Sandbox the systemd service.
Using systemd sandboxing features to harden the syncthing service.
2020-01-20 21:48:48 +01:00
zimbatm e20de6b57a
Merge pull request #78045 from flokli/buildkite-agent-user-runtime-test
nixos/buildkite: add option to configure user, add nix-required packages to runtime, add test
2020-01-20 13:50:10 +00:00
Florian Klink 4b73d3c444 nixos/buildkite: make privateSshKeyPath optional
When only cloning public repos, or when the ssh key is provided by
different means, we don't need to manage it here.
2020-01-20 11:10:56 +01:00
Florian Klink 70308a7daf nixos/buildkite-agent: add gnutar, gzip and git to runtimePackages
These are required for nix to do builtins.fetchTarball and
builtins.fetchGit, so most likely we want them to be around.
2020-01-20 10:30:24 +01:00
Florian Klink 7838f00824 nixos/buildkite: stop using deprecated option 2020-01-20 10:30:22 +01:00
Alexey Lebedeff ed16f830b0 rabbitmq: make all dependencies explicit
Some things were provided by default, some by systemd unit and some
were just miraculously working. This turns them into explicit
dependencies of the package itself, making everything properly
overrideable.

+ providing glibcLocales fixes elixir compile warnings

+ providing systemd dependency allows rabbit to use systemctl for unit
  activation check instead of falling back to sleep. This was seen as
  a warning during startup.
2020-01-19 23:24:27 +01:00
Florian Klink 8c6b1c3eaa nixos/buildkite-agent: add "user" option
This allows buildkite-agent to run as another user.

It'll still run builds from /var/lib/buildkite-agent and setup things in
there.
2020-01-19 21:21:15 +01:00
Florian Klink eba10dcbcb
Merge pull request #77950 from flokli/buildkite-3
nixos/buildkite-agent: move to v3
2020-01-19 14:23:49 +01:00
Florian Klink b32b29963f
Merge pull request #78018 from rnhmjoj/typo
nixos/unclutter: fix old typo
2020-01-19 14:19:32 +01:00
rnhmjoj bac3e6841b
nixos/unclutter: fix old typo 2020-01-19 10:09:12 +01:00
Antonio Nuno Monteiro e2c11ad3c0 nixos/kubernetes: allow configuring cfssl API server SANs 2020-01-18 23:39:21 -08:00
worldofpeace c6022f7abf nixos/gnome3: add gnome-shell to systemd.packages
This actually gets added via xdg.portal having gnome-shell.
However, that could change and it still for sure should be here.
2020-01-18 20:26:45 -05:00
Symphorien Gibol b5d692e123 nixos/roundcube: provide path to mime.types file
fixes this warning:
WARNING: Mimetype to file extension mapping doesn't work properly!
2020-01-18 16:12:50 +01:00
Symphorien Gibol b6e6bec57c nixos/roundcube: don't use the default and insecure des_key
The php installer creates a random one, but we bypass it, so we have
to create one ourselves.

This should be backward compatible as encryption is used for session
cookies only: users at the time of the upgrade will be logged out but
nothing more.

259b7fa065/config/config.inc.php.sample (L73)
2020-01-18 16:12:50 +01:00
Symphorien Gibol 52cf727a53 nixos/roundcube: do not write passwords to the store nor run php as root
If the database is local, use postgres peer authentication.
Otherwise, use a password file.

Leave database initialisation to postgresql.ensure*.
Leave /var/lib/roundcube creation to systemd.
Run php upgrade script as unpriviledged user.
2020-01-18 15:27:45 +01:00
Elyhaka d18ac2bca1 gdm: refactor to properly handle wayland sessions 2020-01-18 10:56:11 +01:00
Florian Klink 63c310c07e nixos/buildkite-agent: change option meta-data into tags attrset
This is called tags in the buildkite 3.
2020-01-17 23:11:26 +01:00
Yorick van Pelt e1ad9d1685 nixos/buildkite-agent: add a shell attribute to specify the shell being used
This gets passed to BUILDKITE_SHELL, which will specify the shell being
used to executes script in.

Defaults to `${pkgs.bash}/bin/bash -e -c`, matching how buildkite
behaves on other distros.
2020-01-17 18:40:11 +01:00
Florian Klink 99d0f4c380 nixos/buildkite-agent: tweak TimeoutStopSec and KillMode
This improves behaviour when the service is being stopped.
2020-01-17 18:40:11 +01:00
Florian Klink 9237767277 nixos/buildkite-agent: actually use services.buildkite-agent.package
We were currently just using pkgs.buildkite-agent, no matter what was
configured in services.buildkite-agent.package
2020-01-17 18:40:11 +01:00
Florian Klink c154dd5101 nixos/buildkite-agent: stop deploying public keys, make ssh private key optional.
SSH public keys aren't needed to clone private repos, and if we only
need to configure a single attribute, there's no need for the "openssh"
attrset anymore.
2020-01-17 18:40:11 +01:00
Matt Layher 5089214a3d nixos/corerad: init 2020-01-16 12:38:36 -08:00
Aaron Andersen fc1bee555e
Merge pull request #75602 from vanyaklimenko/nginx-gitweb-more-options
nixos/nginx/gitweb: add some (crucial) options
2020-01-15 21:16:24 -05:00
Aaron Andersen 7260d2eb13
Merge pull request #77326 from aanderse/apacheHttpd
nixos/httpd: symlink apache configuration to /etc/httpd/httpd.conf for use in the apachectl command
2020-01-15 21:02:05 -05:00
Mark Karpov a8cdfd30ff
Make buildkite agent service compatible with buildkite-agent3 2020-01-15 17:16:44 +01:00
Bas van Dijk b0b37569a7
Merge pull request #77669 from basvandijk/hydra-sync-buildMachinesFiles-with-upstream
hydra: only set buildMachinesFiles when nix.buildMachines is defined
2020-01-15 09:39:25 +01:00
Bas van Dijk b517409c6b
Merge pull request #77668 from basvandijk/hydra-rm-option-build-use-substitutes
hydra: remove the build-use-substitutes option
2020-01-15 09:30:18 +01:00
Bas van Dijk ad554b3e4e hydra: only set buildMachinesFiles when nix.buildMachines is defined
This applies [hydra PR #432](https://github.com/NixOS/hydra/pull/432)
to the NixOS module in nixpkgs:

```
commit 4efd078977e5ea20e1104783efc324cba11690bc
Author: Bas van Dijk <v.dijk.bas@gmail.com>
Date:   Sun Dec 11 15:35:38 2016 +0100

    Only set buildMachinesFiles when nix.buildMachines is defined
```
2020-01-14 12:32:40 +01:00
Bas van Dijk f34aaa6646 hydra: remove the build-use-substitutes option
The following commit from 2016 in hydra removed the `--option
build-use-substitutes` from the hydra-queue-runner service:

```
commit ee2e9f5335c8c0288c102975b506f6b275793cfe
Author: Eelco Dolstra <edolstra@gmail.com>
Date:	Fri Oct 7 20:23:05 2016 +0200

    Update to reflect BinaryCacheStore changes

    BinaryCacheStore no longer implements buildPaths() and ensurePath(),
    so we need to use copyPath() / copyClosure().
```

It would be better if the hydra module in NixOS matches the upstream
module.
2020-01-14 12:14:25 +01:00
Jacek Galowicz 7f69fdd182 nixos/transmission: Fix module code 2020-01-14 10:10:45 +01:00
Vanya Klimenko ed52a6567c nixos/nginx/gitweb: add some (crucial) options
This replaces some hardcoded values in nginx's VirtualHosts's
configuration with customizable options. Previous values are kept as
default, so nothing should break for existing users.

Co-Authored-By: Florian Klink <flokli@flokli.de>
2020-01-14 00:11:10 +00:00
Silvan Mosberger 55b0129a14
Merge pull request #76178 from 0x4A6F/master-xandikos
xandikos: add tests and module
2020-01-13 23:48:22 +01:00
Martin Milata d9319e8e87 nixos/ndppd: enable systemd sandboxing 2020-01-13 11:11:32 +00:00
Robin Gloster 8305186bb4
Merge pull request #77554 from lheckemann/fix-wpa-multiple1
nixos/wpa_supplicant: fix use with multiple interfaces
2020-01-13 12:07:54 +01:00
markuskowa 9bedc18507
Merge pull request #77553 from c0deaddict/fix/gitea-typo
nixos/gitea: fix typo
2020-01-13 09:29:08 +01:00
Erik Arvstedt 9ed03f2103 nixos/paperless: fix tmpfiles rules
Previously, the service expected the paperless user to have a group with
the user's name. This is not necessarily the case for custom users.
2020-01-13 02:01:23 +00:00