Commit graph

6587 commits

Author SHA1 Message Date
Antoine Eiche 6c94d6437d nixos/glance: init at liberty version
This commit is based on initial works made by domenkozar.
2016-12-31 09:36:57 +01:00
Joachim Fasting d8659f24e6
dnscrypt-proxy service: order before nss-lookup.target 2016-12-30 20:27:05 +01:00
Alexey Lebedeff 59361a2a81 i2pd module: fix typo (#21525) 2016-12-30 15:14:05 +01:00
Данило Глинський (Danylo Hlynskyi) 970a09eb74 Fix typo 2016-12-30 13:29:43 +02:00
Charles Strahan 7ebcada020
mesos: 1.0.1 -> 1.1.0 2016-12-29 20:09:46 -05:00
Graham Christensen bf659128a0
openssh: test that startWhenNeeded works 2016-12-29 17:04:52 -05:00
Graham Christensen 8ed4c8b73b
openssh: 7.4p1 no longer backgrounds when systemd is starting it. 2016-12-29 17:04:46 -05:00
Eelco Dolstra bbd03e236a
Use looser 9pfs caching in VM tests/builds
This can give significant speed ups, see
7e20254412.
2016-12-29 21:26:16 +01:00
Eelco Dolstra bb0ce819b3
nixos/tests/gnome3.nix: Speed up test
It turns out that "journalctl -f | grep -m 1 pattern" will block for
one more line after "pattern" appears, which can take a long time.
2016-12-29 16:23:31 +01:00
Eelco Dolstra 996e0ef777
test-driver: Show test duration 2016-12-29 16:23:27 +01:00
Robin Gloster d8ef63fc73
crowd module: fix OpenID server 2016-12-29 00:41:42 +01:00
Tim Digel 81d8a457ed Fix asterisk & asterisk: 13.6.0 -> 14.1.2 (#20788)
* fix/asterisk-module: use unix-group for asterisk-files
* fix/asterisk-module: add configOption to use some default config-files
* fix/asterisk-module: correction of skel copy
* fix/asterisk-module: use /etc/asterisk as configDir
* fix/asterisk-module: add reload; do not restart unit
* asterisk: 13.6.0 -> 14.1.2
* fix/asterisk: compile with lua, pjsip, format_mp3
* fix/asterisk: fix indentation
* fix/asterisk: remove broken flag
2016-12-28 23:04:58 +01:00
Lluís Batlle i Rossell e0078b2cb5 Make the minimal iso not use profile/minimal, +vim
The profile minimal has several drawbacks: no man pages, unusual 'dbus'
lib that makes many X11 pieces to rebuild, etc.

With xz compression in the squashfs, despite these additions, the iso is
smaller than what it was in 16.09.
2016-12-28 16:07:16 +01:00
Lluís Batlle i Rossell 897b10998b Tune mksquashfs for smaller isos.
Bigger block size, more suitable for xz.
2016-12-28 16:07:16 +01:00
Lluís Batlle i Rossell 33d07c7ea9 zfs cannot be distributed. Disabling it in the isos.
It seems that it is a GPL violation to distribute zfs in the
installation ISOs.

https://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/

If anyone knows the issue better and has a reason to reenable it
legally, feel free to reenable it. I don't know much about it.
2016-12-28 14:57:06 +01:00
Bjørn Forsman 9ec867f59f nixos/prometheus: unbreak alertmanager default config
The current default value of listenAddress = null blows up:

  $ nixos-rebuild build
  error: cannot coerce null to a string, at
  .../nixpkgs/nixos/modules/services/monitoring/prometheus/alertmanager.nix:97:16

With listenAddress = "" we use the same default as upstream and there is
no blow up :-)
2016-12-28 13:52:15 +01:00
Michael Raskin 400886f3d0 Merge pull request #19854 from andjscott/mlocate
[WIP] mlocate: init at version 0.26
2016-12-28 10:24:11 +00:00
Franz Pletz 7ae2d221cd
bird service: add bird to systemPackages
For the tool birdc to monitor and configure bird.
2016-12-28 06:35:31 +01:00
Christopher League 6eead52e12 gphoto2: nixos programs module to configure udev
Closes #21420.
2016-12-27 17:47:38 -05:00
Michael Raskin c311871a6d xserver.wacom: update xorg.conf.d name after upstream change of the number 2016-12-27 23:47:29 +01:00
lassulus cfbe501d4e nixos/graphite: fix beacon config parameter 2016-12-27 19:38:18 +01:00
Bjørn Forsman b20fdff521 nixos/prometheus: make scrapeConfigs.*.static_configs.*.labels optional
...by providing a default value of "no labels" (an empty attrset).

Without this change we get

  $ nixos-rebuild test -I nixpkgs=.
  building Nix...
  building the system configuration...
  error: The option `services.prometheus.scrapeConfigs.[definition 1-entry 1].static_configs.[definition 1-entry 1].labels' is used but not defined.

which is unneeded, because labels _are_ optional.
2016-12-25 15:38:55 +01:00
Jörg Thalheim 585c642bf8
docker: use upstream service file from package 2016-12-25 00:09:13 +01:00
Jörg Thalheim f4e58c2eb2 Merge pull request #21395 from jerith666/plex-firewall
plex: add config option to open recommended network ports
2016-12-24 23:31:04 +01:00
Matt McHenry b64214f66f plex: add config option to open recommended network ports
as prescribed at https://support.plex.tv/hc/en-us/articles/201543147-What-network-ports-do-I-need-to-allow-through-my-firewall-
2016-12-24 15:36:52 -05:00
Jörg Thalheim c23032a8b1 docker: update service units from upstream
All the new options in detail:

Enable docker in multi-user.target make container created with restart=always
to start. We still want socket activation as it decouples dependencies between
the existing of /var/run/docker.sock and the docker daemon. This means that
services can rely on the availability of this socket. Fixes #11478 #21303

  wantedBy = ["multi-user.target"];

This allows us to remove the postStart hack, as docker reports on its own when
it is ready.

  Type=notify

The following will set unset some limits because overhead in kernel's ressource
accounting was observed. Note that these limit only apply to containerd.
Containers will have their own limit set.

  LimitNPROC=infinity
  LimitCORE=infinity
  TasksMax=infinity

Upgrades may require schema migrations. This can delay the startup of dockerd.

  TimeoutStartSec=0

Allows docker to create its own cgroup subhierarchy to apply ressource limits on
containers.

  Delegate=true

When dockerd is killed, container should be not affected to allow
`live restore` to work.

  KillMode=process
2016-12-23 21:39:38 +01:00
Matt McHenry 3c10e68c40
plex: fix a minor syntax issue in systemd ExecStart 2016-12-23 08:02:08 -05:00
tv de44544ceb nginx service: use default_server parameter instead of default (#21371) 2016-12-23 11:52:44 +01:00
Felix Richter d8478c7912 services.nginx: allow startup with ipv6 disabled (#21360)
currently services.nginx does not start up if `networking.enableIPv6 = false`
the commit changes the nginx behavior to handle this case accordingly.
The commit resolves #21308
2016-12-23 11:49:35 +01:00
Rok Garbas e6fa6b21e1 apacheHttpdPackages.mod_perl: init at 2.0.10 2016-12-22 13:36:44 +01:00
Eelco Dolstra 2c03037450
Work around slowness in the KDE 5 test
The use of unionfs-fuse (57a0f140643cde409022e297ed05e05f8d34d778)
slows down the KDE 5 test enough that it hits Hydra timeouts. (E.g. on
my laptop it went from ~5 min to ~30 min.) So disable it for the KDE
test.

http://hydra.nixos.org/build/45127422
(cherry picked from commit 3fcbcf25568cd629644a680562f47762d1ae15b2)
2016-12-21 19:30:35 -05:00
Eelco Dolstra ea46420fc0
Use overlayfs instead of unionfs-fuse in the VM tests
Overlayfs is quite a bit faster, e.g. with it the KDE 5 test takes ~7m
instead of ~30m on my laptop (which is still not great, since plain
9pfs is ~4m30s).
2016-12-21 20:49:08 +01:00
Bjørn Forsman caa476b357 nixos/prometheus: add services.prometheus.configText option
The structured options are incomplete compared to upstream and I think
it will be a maintenance burden to try to keep up. Instead, provide an
option for the raw config file contents (prometheus.yml).
2016-12-21 00:32:24 +01:00
Bjørn Forsman 3fb785b0ad nixos: unbreak prometheus test
target_groups was renamed to static_configs in d459916504
("prometheus service: rename values to match prometheus 1.0 naming.").
Catch up.
2016-12-20 23:26:51 +01:00
Joachim Fasting 168fe999e7
make-system-tarball: create reproducible tarballs
Ensure that archive members are added in sorted order with a fixed
mtime.  This allows `nix-build --check` to succeed (when building a
tarball of a simple system configuration).

We also remove env-vars which doesn't appear to do much apart from
capture a bunch of store paths we probably don't want.

This is an alternative to
4b78a5b5fb
2016-12-20 15:26:21 +01:00
Eelco Dolstra a02bb00156
Enable virtualisation.writableStore by default
This works around:

  machine: must succeed: nix-store -qR /run/current-system | grep nixos-
  machine# error: changing ownership of path ‘/nix/store’: Invalid argument

Probably Nix shouldn't be anal about the ownership of the store unless
it's trying to build/write to the store.

http://hydra.nixos.org/build/45093872/nixlog/17/raw
(cherry picked from commit 57a0f140643cde409022e297ed05e05f8d34d778)
2016-12-20 10:52:47 +01:00
Eelco Dolstra f173da375d
Use only one build of qemu in VM tests
Previously we were using two or three (qemu_kvm, qemu_test, and
qemu_test with a different dbus when minimal.nix is included).

(cherry picked from commit 8bfa4ce82ea7d23a1d4c6073bcc044e6bf9c4dbe)
2016-12-20 10:52:46 +01:00
Eelco Dolstra aad5d1f9a7
virtualisation.qemu.program: Remove
This option is defined in qemu-vm.nix, but that module is not always
imported.

http://hydra.nixos.org/build/44817443
(cherry picked from commit 03c55005dfd6fbcd5cf8e00128a3bb6336b3bc0f)
2016-12-20 10:52:46 +01:00
Markov Dmitry efd5508b89 systemd: add slice support 2016-12-20 10:49:08 +01:00
aszlig 02a9da65c9
nixos: Disable OCR for tests that do not use it
Found out during testing of the Tesseract upgrade the kde5 and sddm
tests don't actually use OCR, so let's disable support for it.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @ttuegel
2016-12-19 22:25:42 +01:00
aszlig 68bc260ca2
tesseract: 3.02.02 -> 3.04.01
From the upstream changelog:

 * Tesseract development is now done with Git and hosted at github.com
   (Previously we used Subversion as a VCS and code.google.com for
   hosting).

So let's move over to the GitHub repository, where the organisation also
includes a full repository for tessdata, so we no longer need to fetch
it one-by-one.

The build also got significantly simpler, because we no longer need to
run autoconf, neither do we need to patch the configure script for
Leptonica headers.

This also has the advantage that we don't need to use the
enableLanguages attribute for the test runner anymore.

Full upstream changelog can be found at:

https://github.com/tesseract-ocr/tesseract/blob/c4d273d33cc36e/ChangeLog

Tested against all NixOS tests with enabled OCR (chromium, emacs-daemon,
installer.luksroot and lightdm).

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @viric
2016-12-19 22:25:38 +01:00
Maximilian Güntner 0cf907ae12
nixos-rebuild: Fix SSHOPTS typo
Signed-off-by: Maximilian Güntner <code@klandest.in>
2016-12-18 22:39:27 +01:00
Vladimír Čunát 2b8566f556
release notes: grammar nitpicks in an entry
/cc #21257.
2016-12-18 13:31:56 +01:00
Joachim Fasting 361633db3b
rmilter service: fix invalid directive
RuntimeDirectoryPermissions -> RuntimeDirectoryMode

Would result in warnings like "unknown lvalue" on startup
2016-12-18 12:42:37 +01:00
Joachim Fasting c27eeeafd9
brltty service: wait for devices to settle
Otherwise it starts way too early, only to fail and having to restart
until devices are available.  It is less wasteful to simply wait until
there's a reasonable chance of success.  This is consistent with
upstream.
2016-12-18 12:42:14 +01:00
Jörg Thalheim feb6dbc916 ntp: document new default ntp service in release notes 2016-12-18 12:25:46 +01:00
Joachim Fasting 142930113c
Revert "mysql service: specify a default package"
This reverts commit 4358d3d439.

Not having a default was deliberate, see
1ce6fff4e2

Thanks to @ocharles for making me aware of this.
2016-12-17 22:36:38 +01:00
Joachim Fasting c2219007e8
Revert "mysql service: specify defaultText for package option"
This reverts commit 52d12b473a.
2016-12-17 22:36:15 +01:00
Peter Hoeg 987aac7794
/etc/hosts and /etc/nsswitch.conf cleanups
fixes #18183
2016-12-17 16:01:35 +01:00
Jörg Thalheim 579051fe66 networkd: add extraConfig to all units
networkd options are always correct or up to date. This option allows to by
pass type checking. It is also easier to write because examples can be just copy
and paste from manpages.
2016-12-17 15:23:34 +01:00
Jörg Thalheim d49e0d5fa5 networkd: allow to supply own unit files
Networkd units can contain secrets. In future also wireguard vpn will be supported by
networkd. To avoid leakage of private keys, those could be then also put outside
of the /nix/store

Having a writeable /etc/systemd/network also allows to quick fix network issues,
when upgrading `nixos-rebuild switch` would require network on its own (due
updates).
2016-12-17 15:23:34 +01:00
Bjørn Forsman 3af715af90 Revert "fix 2 xml errors in the description of boot.loader.grub.efiInstallAsRemovable"
This reverts commit 656cc3acaf because it
causes building the manual to fail:

  $ nixos-rebuild build
  ...
  building path(s) ‘/nix/store/s9y5z78z5pssvmixcmv9ix13gs8xj87f-manual-olinkdb’
  Writing /nix/store/s9y5z78z5pssvmixcmv9ix13gs8xj87f-manual-olinkdb/manual.db for book(book-nixos-manual)
  ./man-pages.xml:625: element para: Relax-NG validity error : Did not expect element para there
  ./man-pages.xml:3: element variablelist: Relax-NG validity error : Element refsection has extra content: variablelist
  ./man-pages.xml:29: element refsection: Relax-NG validity error : Element refentry has extra content: refsection
  ./man-pages.xml:3: element reference: Relax-NG validity error : Element reference failed to validate content
  ./man-pages.xml fails to validate

CC @cleverca22, @Mic92
2016-12-17 11:45:31 +01:00
Jörg Thalheim 1590461887 ntp: make timesyncd the new default
- most nixos user only require time synchronisation,
  while ntpd implements a battery-included ntp server (1,215 LOCs of C-Code vs 64,302)
- timesyncd support ntp server per interface (if configured through dhcp for instance)
- timesyncd is already included in the systemd package, switching to it would
  save a little disk space (1,5M)
2016-12-17 00:00:45 +01:00
rnhmjoj 993cbf8acb uxrvtd: Fix clipboard 2016-12-16 23:55:50 +01:00
Bjørn Forsman ebe67d69d0 collectd service: change /var/lib/collectd perms: 700 -> 755
The collectd service runs as an unprivileged user by default, so it does
not leak more information to its data directory than any user can obtain
elsewhere by other means.

If people are running it as root and are worried about information leak,
we can add collectd group and set perms to 750.

CC @offlinehacker.

Fixes #21198.
2016-12-16 23:04:42 +01:00
Antoine Eiche 086e5d09a1 nixos/keystone: add test in release.nix 2016-12-16 20:53:32 +01:00
Antoine Eiche a932f68d9c nixos/keystone: secrets can be read from files
A secret can be stored in a file. It is written at runtime in the
configuration file.
Note it is also possible to write them in the nix store for dev
purposes.
2016-12-16 20:53:32 +01:00
Antoine Eiche 415c9ff90b nixos/keystone: init at liberty version
This commit introduces a nixos module for the Openstack Keystone
service. It also provides a optional bootstrap step that creates some
basic initial resources (tenants, endpoints,...).

The provided test starts Keystone by enabling bootstrapping and checks
if user creation works well.

This commit is based on initial works made by domenkozar.
2016-12-16 20:53:32 +01:00
michael bishop 656cc3acaf fix 2 xml errors in the description of boot.loader.grub.efiInstallAsRemovable 2016-12-16 20:39:40 +01:00
michael bishop e5cefadef7 fix indentation in several nixos option descriptions 2016-12-16 18:29:25 +01:00
romildo 2e7105467b lxqt: better organize system packages
Split packages in three categories, all of them going into the system
package list:
- pre-requisite packages
- core packages
- optional packages

Add a new configuration option 'environment.lxqt.excludePackages' to
specify optional LXQt packages that should be excluded from system
packages.

Add 'gvfs' as a pre-requisite package, needed by 'pcmanfm-qt' to
handle virtual places, like "Computer" and "Network".
2016-12-15 22:45:06 +01:00
aszlig 1471426749
nixos/test-instrumentation: Fix eval of boot tests
The boot tests import test-instrumentation.nix directly to create a VM
image that only contains things such as the backdoor and serial console
the same way as used by other NixOS VM tests.

With one difference though: It doesn't need nor want to have 9p
filesystems mounted, because we actually want to test an image rather
than re-using most stuff from the host's store.

Change tested against the boot.uefiUsb and ipv6 tests, just that it
becomes clear we don't break either the tests with 9p nor the boot
tests (which were already broken but now succeed).

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-12-15 21:07:19 +01:00
Jörg Thalheim 3b763fef44 nssModules: include correct systemd output
fixes libnss_myhost, libnss_mymachines, libnss_resolve are located here
2016-12-15 20:23:16 +01:00
Théo Zimmermann fba6537341 doc: correct typo (#21176) 2016-12-15 17:13:44 +01:00
Eelco Dolstra 705829b29a Merge pull request #20500 from aszlig/qemu-patched-for-nixos-tests
nixos/tests: Use a patched QEMU for testing
2016-12-15 12:38:29 +01:00
Jörg Thalheim cc864af928 bird: refactor module
- syntax check before deploying configuration
- remove static unnessary static uid/gid (configuration is opened as root)
- add service hardening
2016-12-15 11:38:45 +01:00
Jörg Thalheim 9871d3cb42 Merge pull request #21087 from offlinehacker/nixos/kubernetes1/fixdns
kubernetes module: fix default dns ip
2016-12-15 01:14:54 +01:00
Jörg Thalheim ebd85b632a
ferm: reload rules on updates instead of restart 2016-12-14 16:09:11 +01:00
Renaud fa0a63ec13 fail2ban service : improve ssh jail (#21131)
Improvement to the ssh-iptables to block the port(s) actually defined
for sshd in config.services.openssh.ports
2016-12-14 14:58:02 +01:00
Nikolay Amiantov 17d0a570ab Merge pull request #21137 from jerith666/cupsd-path
use symlink to ensure cupsd.conf PATH always points to a valid store path
2016-12-14 14:42:27 +03:00
Matt McHenry 05fb82732c use symlink to ensure cupsd.conf PATH always points to a valid store path
even if cups rewrites its config file due to config changes made through
its web-based management UI, we need to keep the PATH pointing to
currently-live nix store directories.  fixes #20806.
2016-12-13 21:35:56 -05:00
Joachim Fasting d893c86b34
terraria service: fixup worldPath option type
Otherwise, using the defaults results in a type error.
2016-12-13 15:12:33 +01:00
Joachim Fasting 33088accc8
terraria service: fix tmux output
tmux.bin was removed in 5535d94394

Use `lib.getBin` to be more robust to future changes.
2016-12-13 15:12:31 +01:00
Joachim Fasting 64a64c6b14
grsecurity test: refactoring 2016-12-13 15:12:11 +01:00
Fernando J Pando 50466c2d4f
buildbot: 0.9.0rc4 -> 0.9.0.post1
- updates buildbot to version 9 release
- adds nixos configuration module
- fixes buildbot-www package deps
- re-hardcode path to tail
- builbot configuration via module vars

fixes #19759
2016-12-13 10:52:56 +01:00
montag451 aa1364affd containers: add tests for hosts and macvlans 2016-12-12 14:25:28 +01:00
montag451 ea5551b551 containers: fix broken /etc/hosts entries when localAddress contains a netmask 2016-12-12 09:20:28 +01:00
montag451 4889c271ca Add macvlan support for declarative containers 2016-12-12 07:34:28 +01:00
Jaka Hudoklin 2867f88781 kubernetes module: fix default dns ip 2016-12-12 01:25:23 +01:00
Gregor Kleen d5ec2a2c9d
postsrsd: additional configuration
fixes #19933
2016-12-11 21:43:45 +01:00
Domen Kožar 073cb330ca doc: remove last mention of <nixos> 2016-12-11 19:51:35 +01:00
Joachim F 9af356258b Merge pull request #20971 from kierdavis/boinc
boinc service: add to module list
2016-12-11 13:06:09 +01:00
Jaka Hudoklin a033906969 chromium module: add support for chromium policies as nixos module 2016-12-10 20:45:16 +01:00
Joachim Fasting 230994a30a
psd service: assert that at least one user must be configured
Using the default config, a user will experience a run-time failure.
This is poor UX, assert the requirement up-front.
2016-12-10 20:35:44 +01:00
Joachim Fasting 4697f83984
openfire service: more informative assertion failure message
Explain why the assertion fails; the user already knows that it *has*
failed.
2016-12-10 20:35:43 +01:00
Joachim Fasting 2a4902dd80
dante service: fix config option type
The type was simply str but the default is null, thus resulting in a
conversion error if the user fails to declare a value.
2016-12-10 20:35:41 +01:00
Joachim Fasting fafb6657c1
syslogd service: assert conflict with rsyslogd
Enabling both these at the same time fails because they implement the
same interface.
2016-12-10 20:35:39 +01:00
Joachim Fasting 19b96176b4
couchdb service: fix test in preStart
Otherwise you'd get errors like "-f no such command".
2016-12-10 20:35:20 +01:00
Nikolay Amiantov 9cca8e3f87 uwsgi service: fix for new pythonPackages 2016-12-08 21:03:41 +03:00
Kier Davis 2606994cc6
boinc service: use <link> instead of <ulink> 2016-12-08 15:50:52 +00:00
Kier Davis 2994123161
boinc service: add to module list
The module itself was added in 811c39c6a4,
but it looks like I forgot to reference it to module-list.nix.
2016-12-08 15:46:51 +00:00
Joachim Fasting f39d13cd3e
grsecurity doc: describe work-around for gitlab
Fixes https://github.com/NixOS/nixpkgs/issues/20959
2016-12-08 11:59:57 +01:00
Domen Kožar b6363c7bc8 make-disk-image: make store validity fix optional
This is useful for EC2 AMI generation to speedup the process.

In my case it removes 13min out of 45min when generating an image
on EC2.
2016-12-07 13:30:20 +01:00
Domen Kožar e5cca82d79 make-disk-image: run tune2fs after umount to skip fsck
tune2fs marks the filesystem as clean to prevent resize2fs from
complaining.

But we were invoking it before we mounted the filesystem, so the
counters would increase to 1 and it broke the functionality.

By moving the call after the mount, I have confirmed it works by:

   $ nix-build nixos/tests/ec2.nix

cc @rbvermaa @edolstra
2016-12-07 13:30:20 +01:00
David Terry f067bca841 nixos: docs: note that channels are per user 2016-12-07 09:06:25 +01:00
Joachim Fasting 984d9ebb56
hidepid: polkit and systemd-logind compatibility
`systemd.hideProcessInformation = true`, would break interactions
requiring polkit arbitration such as initating poweroff/reboot as a
normal user; the polkit daemon cannot be expected to make decisions
about processes that don't exist as far as it is concerned.

systemd-logind lacks the `sys_ptrace` capability and so needs to be part
of the designated proc gid, even though it runs as root.

Fixes https://github.com/NixOS/nixpkgs/issues/20948
2016-12-07 01:12:05 +01:00
Joachim F e436874ef0 Merge pull request #20919 from joachifm/privoxy-service-improvements
Privoxy service improvements
2016-12-06 14:16:28 +01:00
Joachim Fasting 0e765c72e5
grsecurity: enable module hardening 2016-12-06 01:23:58 +01:00
Joachim Fasting 31d79afbe5
grsecurity docs: note that pax_sanitize_slab defaults to fast 2016-12-06 01:23:51 +01:00
Joachim Fasting 071fbcda24
grsecurity: enable optional sysfs restrictions
Fairly severe, but can be disabled at bootup via
grsec_sysfs_restrict=0. For the NixOS module we ensure that it is
disabled, for systemd compatibility.
2016-12-06 01:23:36 +01:00
Joachim Fasting 8c1f5afdf3
grsecurity: delay toggling of sysctls until system is up
We generally trust init, so there's little point in having these enabled
during early bootup; it accomplishes little except fill our logs with
spam.
2016-12-06 01:22:53 +01:00
Joachim Fasting 3dcdc2d2b0
privoxy service: remove static uid
The service owns no data, having a static uid serves no purpose.

This frees up uid/gid 32
2016-12-05 13:37:08 +01:00
Joachim Fasting ad88f1040e
privoxy service: additional isolation 2016-12-05 13:21:31 +01:00
Vladimír Čunát a1ae627362
nixos GDM: fix #19896
- As noted on github, GDM needs different parameters for X.
- Making xserverArgs a true list instead of concat-string helps to
  filter it and it feels more correct anyway.
- Tested: gdm+gnome, lightdm+gnome.  There seems to be no logout option
  in gnome, and gdm doesn't offer other sessions, but maybe these are normal.
2016-12-04 14:54:31 +01:00
Jörg Thalheim e00632e200 Merge pull request #20858 from Mic92/lxcfs
lxcfs: init at 2.0.4
2016-12-04 11:33:07 +01:00
Jörg Thalheim 7c7dc15cbf
lxcfs: add module 2016-12-04 11:26:17 +01:00
Franz Pletz 69bee1b361 Merge pull request #20770 from mguentner/more_ipfs
services: IPFS: add test and more config parameters
2016-12-04 01:46:09 +01:00
Franz Pletz 2401f06801
containers: disable dhcpcd on veth bridge interfaces 2016-12-04 01:41:10 +01:00
Graham Christensen d5cb4d8734
ecryptfs test: use TTY output to stabilize test 2016-12-02 19:36:27 -05:00
Jörg Thalheim aa854f192e
cgmanager: add module 2016-12-02 13:52:04 +01:00
lbonn 288e75c5f9 wireguard: remove dependency on ip-up.target
It was deprecated and removed from all modules in the tree by #18319.

The wireguard module PR (#17933) was still in the review at the time and
the deprecated usage managed to slip inside.
2016-12-01 00:11:16 +01:00
Graham Christensen b28d21fd50 Merge pull request #20808 from grahamc/fancy-test-tty
login test: Create and use direct reads of the TTY contents.
2016-11-30 11:27:49 -05:00
Graham Christensen cb74fd75d7
login test: Create and use direct reads of the TTY contents. 2016-11-30 00:17:18 -05:00
Tuomas Tynkkynen 8a4d6516ee Merge remote-tracking branch 'upstream/staging' into master 2016-11-30 00:34:23 +02:00
Franz Pletz 3000ae8602
gitlab service: fix sidekiq queue config 2016-11-29 17:42:46 +01:00
Domen Kožar 75f131da02 acme: ensure nginx challenges directory is writeable 2016-11-29 15:56:01 +01:00
Domen Kožar 69e0740baa Merge pull request #20795 from cleverca22/netboot
make the /nix/store writable under netboot images
2016-11-29 15:47:39 +01:00
michael bishop e710edeecf
make the /nix/store writable under netboot images 2016-11-29 10:31:07 -04:00
Erik Rybakken 2f0cc0d3f0 unclutter-xfixes service: init
Closes #18398
2016-11-29 14:25:32 +01:00
Joachim F 8eefcb5c09 Merge pull request #19900 from michalpalka/xen-fix-xen-bridge2
xen service: fix wrong netmask handed out by xen-bridge.service
2016-11-28 16:31:05 +01:00
Joachim F 944868dd9b Merge pull request #19851 from michalpalka/xen-fix-xen-bridge
xen service: fix iptables race condition in xen-bridge.service
2016-11-28 16:30:16 +01:00
Maximilian Güntner f7c099bd8c
tests: added basic ipfs test
$getter can be used once ipfs supports private/local networks
and or internet gets routed to the VMs

Signed-off-by: Maximilian Güntner <code@klandest.in>
2016-11-28 15:33:58 +01:00
Maximilian Güntner 0526a5c90a
services: add gatewayAddress and apiAddress to ipfs
Signed-off-by: Maximilian Güntner <code@klandest.in>
2016-11-28 15:33:51 +01:00
Aycan iRiCAN 37715d1f46 hydra-module: add cfg.package to hydra-evaluator path 2016-11-28 15:53:44 +02:00
Joachim Fasting e99228db30
grsecurity module: force a known good kernel package set
Previously, we would only set a default value, on the theory that
`boot.kernelPackages` could be used to sanely configure a custom grsec
kernel.  Regrettably, this is not the case and users who expect e.g.,
`boot.kernelPackages = pkgs.linuxPackages_latest` to work will end up
with a non-grsec kernel (this problem has come up twice on the bug
tracker recently).

With this patch, `security.grsecurity.enable = true` implies
`boot.kernelPackages = linuxPackages_grsec_nixos` and any customization
must be done via package override or by eschewing the module.
2016-11-28 12:11:04 +01:00
Sophie Taylor 016fa06c71
cjdns: Improving systemd unit description 2016-11-27 22:07:51 -05:00
Ruben Maher 9c9a21d525 matrix-synapse service: Make url_preview_enabled optional (#20609) 2016-11-28 03:33:48 +01:00
Franz Pletz e394c305a8 Merge pull request #20620 from rnhmjoj/fakeroute
fakeroute: init at 0.3
2016-11-28 03:01:15 +01:00
pngwjpgh bcc9a6ac75 infinoted service: init
Service module for the dedicated gobby server included in libinfinity
2016-11-27 17:23:21 +01:00
Michael Raskin 36010e7046 Merge pull request #20366 from MarcWeber/submit/apache-port-to-listen
apache-httpd
2016-11-26 13:37:02 +00:00
Vladimír Čunát 925b335607
Merge branch 'master' into staging 2016-11-26 11:27:09 +01:00
Vladimír Čunát 8ebfce0eda
display-managers module: improve variable quoting
Fixes #20713, though I'm certain nixpkgs contains loads of places
without proper quoting, as (ba)sh unfortunately encourages that.

The only plus side is that most of such problems in nixpkgs aren't
actually security problems but mere annoyance to those who are foolish
enough to use "weird" characters in critical names.
2016-11-26 11:23:31 +01:00
Robert Helgesson 8a424e3fbd
tahoe service: use ExecStart instead of script
Since only a single command is necessary to start Tahoe it is sufficient
to use ExecStart and thereby skip starting up Bash (and leaving it
running).
2016-11-25 21:49:34 +01:00
Jaka Hudoklin 3b500d37f5 Merge pull request #19023 from offlinehacker/kube-update
WIP: kubernetes update package and module
2016-11-24 23:10:01 +01:00
Frederik Rietdijk 25a9889f0e blivet test: use python2 2016-11-24 22:28:03 +01:00
Corbin Simpson 27f1def068 nixos/collectd: Fix syntax error on some hostnames. (#20694)
Without this, hostnames that e.g. end in digits will cause syntax errors for
collectd.
2016-11-24 21:47:17 +01:00
rnhmjoj 7eb9a03221
fakeroute: add service 2016-11-23 15:23:10 +01:00
Eelco Dolstra d97a379510 Merge pull request #20641 from mayflower/fix/installer-closure-size
Reduce closure size of installer images
2016-11-23 12:49:46 +01:00
Joachim F a6f392abd6 Merge pull request #20385 from ericsagnes/feat/i3-refactor
i3 module: refactor
2016-11-23 05:11:14 +01:00
Franz Pletz 6de991bd95
nixos: compress squashfs with xz 2016-11-23 02:24:13 +01:00
Franz Pletz da600849e3
nixos: disable sound for minimal ISO
Saves a few megabytes of ALSA stuff.
2016-11-23 02:24:13 +01:00
Franz Pletz f983743d75
w3m-nox: use imlib2 without X11 support
Also, the minimal live CD previously installed both the X11 and
non-X11 versions (through services.nixosManual) of w3m.
2016-11-23 02:24:12 +01:00
Franz Pletz ffac67fcf3
nixos/base: don't include dar & cabextract in ISO
Should free up lots of space due to dependency on gnupg, which dpeends on
openldap which pull in gcc.
2016-11-23 02:24:11 +01:00
Eric Sagnes 2b1d67a275 manual: reviewing contributions nixos -> nixpkgs (#20626) 2016-11-22 15:15:02 +01:00
Franz Pletz d94e93ccdf Merge pull request #19588 from Shados/add-dante
Add dante package & accompanying service module
2016-11-22 15:10:46 +01:00
Franz Pletz 2f1be760da
nixos/release: add containers-tmpfs test
cc #20557
2016-11-22 15:05:45 +01:00
Alexei Robyn 49d679d7a8 dante service: init 2016-11-22 21:33:54 +11:00
Kier Davis db50ae78d0
boinc service: init 2016-11-22 01:14:40 +00:00
Christian Kampka 35ecef2c6d containers module: Add tmpfs options (#20557)
Allows one or more directories to be mounted as a read-only file system.

This makes it convenient to run volatile containers that do not retain
application state.
2016-11-22 02:11:33 +01:00
Domen Kožar 49d608ac00 create-amis: use jq instead of json 2016-11-22 01:59:49 +01:00
Nikolay Amiantov 42a180352f bumblebee service: replace bbswitch option with pmMethod
I added this option just today, so I don't think this needs a rename entry.
2016-11-22 02:35:12 +03:00
Domen Kožar f940d65b2d create-amis: add us-east-2 2016-11-21 21:26:23 +01:00
Daiderd Jordan c531cc2303 Merge pull request #20606 from mdaiter/riak_extraAdvancedConfig
riak: added extraAdvancedConfig option to service module
2016-11-21 18:22:01 +01:00
Domen Kožar 1944c984c3 create-amis: order matters 2016-11-21 16:43:09 +01:00
Joachim Fasting f9f354faad
nixos/modules: use defaultText where applicable
Primarily to fix rendering of these default values in the manual but
it's also nice to avoid having to eval these things just to build the
manual.
2016-11-21 16:35:15 +01:00
Eelco Dolstra d69dce080d
Fix setting programs.ssh.setXAuthLocation
The configuration { services.openssh.enable = true;
services.openssh.forwardX11 = false; } caused
programs.ssh.setXAuthLocation to be set to false, which was not the
intent. The intent is that programs.ssh.setXAuthLocation should be
automatically enabled if needed or if xauth is already available.
2016-11-21 16:19:51 +01:00
Domen Kožar 6e08a55474 create-amis.sh: another dep needed for EBS images 2016-11-21 15:56:51 +01:00
Matthew Daiter f11899798e riak: added extraAdvancedConfig option to service module 2016-11-21 15:46:04 +01:00
Nikolay Amiantov f10ec922e0 bumblebee service: make bbswitch optional 2016-11-21 17:29:31 +03:00
Nikolay Amiantov 44808cac65 bumblebee service: fix service dependencies 2016-11-21 17:29:26 +03:00
Jörg Thalheim cb8af0ca51 Merge pull request #19379 from nixy/master
grub bootloader: add forceInstall option
2016-11-21 15:15:45 +01:00
Daiderd Jordan 86310553ca Merge pull request #20598 from mdaiter/riak_defaultText
riak: add defaultText to service
2016-11-21 12:38:18 +01:00
Matthew Daiter c51847e121 stanchion: added default 2016-11-21 12:35:08 +01:00
Matthew Daiter 68827cd79a riak-cs: init at 2.1.1
riak-cs: added to all-packages

Added Riak CS nix file to pkgs

Added service file for Riak CS

Removed Erlang_basho specific bindings from the Riak CS repo

riak-cs: changed description

riak-cs: added license

riak-cs: added maintainer

riak_cs: chgned indentations

riak-cs: removed overly complex srcs mechanism

riak-cs: added systemd module

riak-cs: changed Erlang module to Basho-specific version

riak-cs: made modular form

riak-cs: Added a default package in service options

riak-cs: Fixed default package in service options

riak-cs: Patched Makefile

riak_cs: added to module-list

riak_cs: changed from string to actual package in modules

riak-cs: changed example

riak-cs: removed default

riak-cs: changed to defaultText

stanchion: changed default option to defaultText

riak-cs: added defaults; changed types to str
2016-11-21 12:30:11 +01:00
Matthew Daiter ab43f932ce riak: add defaultText to service
riak: add default to service
2016-11-21 12:26:48 +01:00
Matthew Daiter 709631b47f stanchion: changed default option to defaultText 2016-11-21 12:07:06 +01:00
James Cook fc10bf81a1 Revert "riak-cs: add to nixpkgs" 2016-11-20 19:48:28 -08:00
Matthew Daiter bfc1ba475a riak-cs: init at 2.1.1
riak-cs: added to all-packages

Added Riak CS nix file to pkgs

Added service file for Riak CS

Removed Erlang_basho specific bindings from the Riak CS repo

riak-cs: changed description

riak-cs: added license

riak-cs: added maintainer

riak_cs: chgned indentations

riak-cs: removed overly complex srcs mechanism

riak-cs: added systemd module

riak-cs: changed Erlang module to Basho-specific version

riak-cs: made modular form

riak-cs: Added a default package in service options

riak-cs: Fixed default package in service options

riak-cs: Patched Makefile

riak_cs: added to module-list

riak_cs: changed from string to actual package in modules
2016-11-20 23:55:17 +01:00
Matthew Daiter f7c097556b stanchion: init at 2.1.1 2016-11-20 23:17:49 +01:00
Joachim Fasting 2eb6ec1bc4
grsecurity module: remove code pertaining to zfs
I don't know if it still the case that zfs fails to boot; either way,
that's the user's responsibility to contend with.
2016-11-20 23:01:22 +01:00
Joachim Fasting 98935c7103
grsecurity module: remove requiredKernelConfig
Using a custom package set with the NixOS module is no longer
something I wish to support.  It's still *possible* but not
advertised.  Secondly, the requiredKernelConfig didn't really
do anything (setting kernelPackages to a non-grsec kernel would
just silently let the user boot into a non-grsec setup ...).
2016-11-20 23:00:41 +01:00
Joachim Fasting 5ad8a56d16
grsecurity module: remove use of mkEnableOption 2016-11-20 23:00:24 +01:00
goibhniu 322f5e5132 Merge pull request #20319 from NixOS/nm-containers
NixOS Manual: Container Networking with NM
2016-11-20 18:15:03 +01:00
Cillian de Roiste c9b0e88c0b NixOS Manual: Container Networking with NM
Network Manager calls dhclient on container interfaces and fails
which locks you out of the container after a few seconds, unless
you tell it not to manage these interfaces.
2016-11-20 17:25:33 +01:00
Nikolay Amiantov 15567e6d8e tarsnap service: fix multiple simultaneous archives with a single key 2016-11-20 19:15:52 +03:00
Nikolay Amiantov 6bb292d42b parsoid service: update, use declarative configuration
Old configuration format is disabled now (it can still be used, but with
additional steps). This is a backwards incompatible change.
2016-11-20 19:12:14 +03:00
Nikolay Amiantov 382047a135 sane service: support remote scanners 2016-11-20 19:09:03 +03:00
Nikolay Amiantov 65f9341370 sane service: add saned support 2016-11-20 19:09:02 +03:00
Nikolay Amiantov 4111710b8e bumblebee service: blacklist additional nvidia modules 2016-11-20 19:08:52 +03:00
Joachim F eca9955b83 Merge pull request #20485 from anoever/master
vmware-guest: fix vmmouse driver
2016-11-20 03:39:28 +01:00
Jörg Thalheim c54d2860dc Merge pull request #20469 from Mic92/initrd-ssh
initrd-ssh: fix authorized_key generation with multiple keys
2016-11-18 23:16:44 +01:00
Andreas Noever 9a1507f253 vmware-guest: fix vmmouse driver
Fix automatic mouse grabbing/releasing when running as a vmware guest.

1. The xf86inputvmmouse is not loaded by default. Add it.
2. InptutDevice sections for which specify a driver are ignored if
AutoAddDevices is enabled (which it is by default). See [1]. Instead use
an InputClass to load the vmmouse driver.

[1] https://www.x.org/archive/X11R7.7/doc/man/man5/xorg.conf.5.xhtml#heading8
2016-11-18 19:58:44 +01:00
Emery Hemingway 60ded3f363 nixos/cjdns: do not ammend /etc/hosts
Generating IPv6 addresses at eval time required building cjdns.

Fix #20422
2016-11-18 18:41:50 +01:00
Thomas Tuegel 6cd867dd4c Merge pull request #20433 from ttuegel/install-cd-kde-5
Use KDE 5 for the graphical installation DVD
2016-11-18 11:29:47 -06:00
Joachim F 2bb30e5d66 Merge pull request #20467 from ericsagnes/feat/module-enums-2
modules: use enum when relevant
2016-11-17 22:48:26 +01:00
Franz Pletz 6a5ae21c47 Merge pull request #20421 from mayflower/refactor/clamav-service
clamav service: refactor
2016-11-17 19:37:53 +01:00
aszlig 6cfb3b6364
nixos/tests: Use a patched QEMU for testing
The reason to patch QEMU is that with latest Nix, tests like "printing"
or "misc" fail because they expect the store paths to be owned by uid 0
and gid 0.

Starting with NixOS/nix@5e51ffb1c2, Nix
builds inside of a new user namespace. Unfortunately this also means
that bind-mounted store paths that are part of the derivation's inputs
are no longer owned by uid 0 and gid 0 but by uid 65534 and gid 65534.

This in turn causes things like sudo or cups to fail with errors about
insecure file permissions.

So in order to avoid that, let's make sure the VM always gets files
owned by uid 0 and gid 0 and does a no-op when doing a chmod on a store
path.

In addition, this adds a virtualisation.qemu.program option so that we
can make sure that we only use the patched version if we're *really*
running NixOS VM tests (that is, whenever we have imported
test-instrumentation.nix).

Tested against the "misc" and "printing" tests.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-17 17:16:16 +01:00
Joachim F 2c01da3654 Merge pull request #20384 from ericsagnes/feat/bspwm-refactor
bspwm module: refactor
2016-11-17 15:37:07 +01:00
Domen Kožar 2326c8de4d cloud-utils: 0.27 -> 0.29
We keep the existing hacks for growpart to work
inside the initrd

Fixes #15736 #17015
2016-11-17 15:15:42 +01:00
Jaka Hudoklin 5bc7ae7adb kubernetes module: support for kubernetes 1.4 2016-11-17 02:46:31 +01:00
Eelco Dolstra 69bea26ea9 sddm: Enable user switching
It was lacking the dbus configuration to bind to
org.freedesktop.DisplayManager, and it was passing fixed TTY/display
numbers to the X server (see 9be012f0d4).
2016-11-16 23:38:50 +01:00
Domen Kožar 67f3e2853b create-amis.sh: use nix-shell for convenience 2016-11-16 16:49:32 +01:00
Jörg Thalheim 7ad01f5f0c initrd-ssh: fix authorized_key generation with multiple keys
multiple entries should be separated by newline
2016-11-16 14:47:37 +00:00
Eric Sagnes 0ebc5ec7cb network-interfaces: use enum 2016-11-16 22:37:57 +09:00
Eric Sagnes 4a600b0437 raspberrypi module: use enum 2016-11-16 22:37:36 +09:00
Eric Sagnes 15d25df698 nsd module: use enum 2016-11-16 22:37:14 +09:00
Eric Sagnes 5259fb2181 nntp-proxy module: use enum 2016-11-16 22:36:53 +09:00
Eric Sagnes fb26d561ed hostapd module: use enum 2016-11-16 22:36:26 +09:00
Eric Sagnes 9513ab45aa duosec module: use enum 2016-11-16 22:36:05 +09:00
Eric Sagnes 61efe92e68 fontconfig module: use enum 2016-11-16 22:35:46 +09:00