Commit graph

7572 commits

Author SHA1 Message Date
Jörg Thalheim 3156ef2dfd Merge pull request #25478 from zraexy/zraexy-broadcom-bt-firmware
broadcom-bt-firmware: init at 12.0.1.1011
2017-05-04 22:33:06 +01:00
Domen Kožar 14f5a3d760
nixos datadog module: add processConfig option 2017-05-04 13:25:45 +02:00
Rob Vermaas a9f054c834
dd-agent: Add default config files of dd-agent and auto_conf dir
to /etc/dd-agent/conf.d by default, and make sure
/etc/dd-agent/conf.d is used.

Before NixOS 17.03, we were using dd-agent 5.5.X which
used configuration from /etc/dd-agent/conf.d

In NixOS 17.03 the default conf.d location is first used relative,
meaning that $out/agent/conf.d was used without NixOS overrides.

This change implements similar functionality as PR #25288, without
breaking backwards compatibility.

(cherry picked from commit 77c85b0ecbc1070d7adff31b339bede92e4193fa)
2017-05-04 09:47:21 +00:00
Michał Pałka e7203cb03d xen service: Forward DNS queries from Xen guests
Provide the option forwardDns in virtualisation.xen.bridge, which
enables forwarding of DNS queries to the default resolver, allowing
outside internet access for the xen guests.
2017-05-04 08:48:03 +00:00
Michał Pałka 3b0daa1a28 xen service: Add the possibility to override configuration of xendomains
Add the option virtualisation.xen.domain.extraConfig, which
allows overriding options passed to xendomains.
2017-05-04 08:31:40 +00:00
zraexy d900478e3c broadcom-bt-firmware: init at 12.0.1.1011
broadcom-bt-firmware: init at 12.0.1.1011
2017-05-03 12:51:32 -08:00
Frederik Rietdijk 9e48fc3268 Merge pull request #24131 from nand0p/buildbot-0.9.5
buildbot: 0.9.4 -> 0.9.5
2017-05-03 07:56:29 +02:00
jammerful d8c1977bb5 shibboleth-sp module: Set Config File Path for FastCGI Units
Without this environment variable both shibauthorizer and
shibresponder default to ${pkgs.shibboleth-sp}etc/shibboleth/shibboleth2.xml
2017-05-02 19:58:03 -04:00
aszlig 9dca737d62
Merge pull request #15353 (improve xrandrHeads)
When you have a setup consisting of multiple monitors, the default is
that the first monitor detected by xrandr is set to the primary monitor.

However this may not be the monitor you need to be set as primary. In
fact this monitor set to primary may in fact be disconnected.

This has happened for the original submitter of the pull request and it
affected these programs:

 * XMonad: Gets confused with Super + {w,e,r}
 * SDDM: Puts the login screen on the wrong monitor, and does not
         currently duplicate the login screen on all monitors
 * XMobar: Puts the XMobar on the wrong monitor, as it only puts the
           taskbar on the primary monitor

These changes should fix that not only by setting a primary monitor in
xrandrHeads but also make it possible to make a different monitor the
primary one.

The changes are also backwards-compatible.
2017-05-02 23:14:26 +02:00
Volth 9bce416637 xrdp: environment.pathsToLink from xserver.nix 2017-05-02 21:08:07 +00:00
Volth 830669ca05 xrdp: do not restart xrdp-sesman on nixos-rebuild 2017-05-02 21:08:07 +00:00
jammerful 9f18af5991 Add Shibboleth Service Provider Module 2017-05-02 11:29:58 -04:00
Daniel Ehlers 4338f096f5 nullmailer + service: init at 2.0 2017-05-02 01:46:12 +02:00
Jörg Thalheim 4c576fd946 Merge pull request #25323 from Ma27/zsh/support-pattern-highlighters
programs.zsh.syntax-highlighting: support custom highlighting patterns
2017-05-01 22:23:36 +02:00
Maximilian Bosch f6e612bb8f
programs.zsh.syntax-highlighting: support custom highlighting patterns
see https://github.com/zsh-users/zsh-syntax-highlighting/blob/master/docs/highlighters/pattern.md
for further reference.
2017-05-01 20:58:56 +02:00
goibhniu 248a06695f Merge pull request #22236 from Baughn/mediawiki
apache-httpd: Add 'extensions' config option for mediawiki
2017-05-01 19:17:36 +02:00
Clemens Fruhwirth df5d588f13 Introduce virtualisation.libvirtd.qemuOvmf. 2017-05-01 18:36:13 +02:00
Renzo Carbonara 9a5916dc47 tarsnap service: add 'verbose' config option (#25353) 2017-05-01 16:09:45 +01:00
Daniel Peebles daf16b5679 Merge pull request #25391 from Mic92/nixos-prepare-root
nixos-prepare-root: force symlink at /run
2017-05-01 10:15:36 -04:00
Jörg Thalheim 361314ca71
nixos-prepare-root: force symlink at /run
Otherwise a reinstall will fail.
2017-05-01 16:10:58 +02:00
Michael Raskin 3ecaf3b4b5 Merge pull request #25168 from tadfisher/ups-fix
ups: fix config generation
2017-05-01 16:09:18 +02:00
Michael Raskin 938fbf6873 Merge pull request #25116 from rvl/gogs
Gogs service password handling improvements
2017-05-01 14:26:22 +02:00
Michael Raskin b28e2788e2 Merge pull request #25009 from dermetfan/fix-znapzend-service
znapzend service: fix reload
2017-05-01 13:24:24 +02:00
Michael Raskin 98a36b2847 Merge pull request #23709 from lheckemann/xserver-layout-existence
xserver: check that selected layout exists
2017-05-01 12:16:59 +02:00
Jörg Thalheim 036e0f114a gogs: improve cookieSecure documentation 2017-05-01 11:37:12 +02:00
Michael Raskin 4d2f7b63e0 Merge pull request #24803 from pajowu/master
browserpass: init at 1.0.2
2017-05-01 11:27:17 +02:00
Peter Marheine fd1f1aca9e release notes: incompatible flexget upgrade 2017-05-01 10:10:34 +02:00
Michael Raskin 7e19fcddcc Merge pull request #24366 from rvl/longview-password-file
longview service: don't write passwords to nix store
2017-05-01 09:39:35 +02:00
Michael Raskin 90ce1aa28a Merge branch 'master' into clickhouse 2017-05-01 07:33:31 +02:00
Michael Raskin 01ba1a40d3 Merge pull request #24341 from LumiGuide/cadviser-storageDriverPasswordFile
cadviser: add storageDriverPasswordFile option
2017-05-01 02:01:49 +02:00
Michael Raskin 6b31de49cf Merge pull request #24005 from ambrop72/xcursor-path
nixos: Define XCURSOR_PATH environment variable.
2017-04-30 23:01:57 +02:00
Armijn Hemel cdebfa80ab mediawiki: 1.27.1 -> 1.27.3 2017-04-30 22:38:00 +02:00
Michael Raskin 1c8d388201 Merge pull request #23865 from volth/xrdp-tests
xrdp: init at 0.9.2
2017-04-30 22:35:48 +02:00
Michael Raskin d5ec7bc748 Merge pull request #23697 from sargon/master
sshguard + service: init at 2.0.0
2017-04-30 21:43:12 +02:00
Bjørn Forsman c282de7103 nixos/munin: remove duplicated /run/current-system/sw/bin path
A side effect of commit ff21171921
("Fix references to current-system/sw/sbin"). It changed "sbin" to "bin"
but didn't check for duplicates.
2017-04-30 21:04:51 +02:00
Michael Raskin eedc0f0a78 Merge pull request #23333 from romildo/upd.qt5ct
qt5ct: 0.24 -> 0.30
2017-04-30 19:42:31 +02:00
Michael Raskin 929ae39dbe Merge pull request #22683 from aneeshusa/add-nixos-test-for-radicale
Add nixos test for radicale
2017-04-30 18:51:46 +02:00
Michael Raskin a5d36429dc Merge pull request #22489 from avnik/nixos-locales
nixos:  allow supply customized locale package
2017-04-30 18:19:31 +02:00
Joachim Fasting 56e1133d75
nixos/lock-kernel-modules: fix typo in unitConfig
I managed to miss this one somehow ... meh
2017-04-30 15:17:29 +02:00
Joachim Fasting a1678269f9
nixos/hardened profile: disable user namespaces at runtime 2017-04-30 15:17:27 +02:00
Thomas Tuegel 4e0d21edd1 Merge pull request #25285 from ttuegel/qt--fix-plugin-paths
Qt: purify plugin paths, unify Linux and Darwin builders
2017-04-30 07:33:50 -05:00
Vladimír Čunát eb4792a03f
nixos manual: add a note about "nofail" FS option
Close #1858, as I think the points have been well resolved.
2017-04-30 14:10:30 +02:00
Michael Raskin 689916b98f Merge pull request #25337 from benley/nm-dnsmasq
nixos: optional NetworkManager dnsmasq integration
2017-04-30 12:18:34 +02:00
Joachim Fasting 1dd3ba924b
nixos/hardened profile: disable hibernation
Recommended by KSPP
2017-04-30 12:06:11 +02:00
Joachim Fasting ffa83edf4a
nixos/tests: add tests for exercising various hardening features
This test exercises the linux_hardened kernel along with the various
hardening features (enabled via the hardened profile).

Move hidepid test from misc, so that misc can go back to testing a vanilla
configuration.
2017-04-30 12:05:42 +02:00
Joachim Fasting ab4fa1cce4
tree-wide: prune some dead grsec leaves
The beginning of pruning grsecurity/PaX from the tree.
2017-04-30 12:05:41 +02:00
Joachim Fasting 8c98e8ca2f
nixos/hardened profile: use the linux_hardened kernel 2017-04-30 12:05:40 +02:00
Joachim Fasting 6a5a5728ee
nixos/hardened profile: lock kernel modules 2017-04-30 12:05:38 +02:00
Joachim Fasting 878ad1ce6e
nixos: add option to lock kernel modules
Adds an option `security.lockKernelModules` that, when enabled, disables
kernel module loading once the system reaches its normal operating state.

The rationale for this over simply setting the sysctl knob is to allow
some legitmate kernel module loading to occur; the naive solution breaks
too much to be useful.

The benefit to the user is to help ensure the integrity of the kernel
runtime: only code loaded as part of normal system initialization will be
available in the kernel for the duration of the boot session.  This helps
prevent injection of malicious code or unexpected loading of legitimate
but normally unused modules that have exploitable bugs (e.g., DCCP use
after free CVE-2017-6074, n_hldc CVE-2017-2636, XFRM framework
CVE-2017-7184, L2TPv3 CVE-2016-10200).

From an aestethic point of view, enabling this option helps make the
configuration more "declarative".

Closes https://github.com/NixOS/nixpkgs/pull/24681
2017-04-30 12:05:37 +02:00
Jörg Thalheim fa5196e47e Merge pull request #25005 from Lassulus/copytoram
nixos/stage1: add copytoram support
2017-04-30 11:22:45 +02:00
Benjamin Staffin 9827d5f95c
nixos: optional NetworkManager dnsmasq integration 2017-04-30 00:44:19 -07:00
Volth 5e8ad49de8 do not create non-deterministic file (rsakeys.ini) in nixstore 2017-04-29 17:23:35 +00:00
volth dad760061e xrdp: init at 0.9.1 2017-04-29 17:23:35 +00:00
Michael Weiss 852813689a desktop-managers: Use a black BG as fallback
Use a solid black background when no background image (via
~/.background-image) is provided. In my case this fixes the really
strange behaviour when i3 without a desktop manager starts with the SDDM
login screen as background image.
2017-04-29 19:03:30 +02:00
Joachim Fasting 63433537ce
nixos/hardened profile: disable legacy virtual syscalls
This eliminates a theoretical risk of ASLR bypass due to the fixed address
mapping used by the legacy vsyscall mechanism.  Modern glibc use vdso(7)
instead so there is no loss of functionality, but some programs may fail
to run in this configuration.  Programs that fail to run because vsyscall
has been disabled will be logged to dmesg.

For background on virtual syscalls see https://lwn.net/Articles/446528/

Closes https://github.com/NixOS/nixpkgs/pull/25289
2017-04-29 17:27:11 +02:00
Jörg Thalheim ffdc1b0ab0 Merge pull request #25310 from jerith666/command-not-found-is-a-dir
fix 'command-not-found: is a directory' error
2017-04-29 11:41:22 +02:00
Robin Gloster edb1ea055e
confluence module: needs bash for health checks 2017-04-29 11:15:59 +02:00
Matt McHenry 48a3e1a88d fix 'command-not-found: is a directory' error 2017-04-28 23:11:21 -04:00
Michael Weiss 1273f414a7 display-managers: Fix the xsession parameters
The xsession script was called with inconsistent (depending on the
display managers) and wrong parameters. The main reason for this where
the spaces the parameter syntax. In order to fix this the old syntax:
$1 = '<desktop-manager> + <window-manager>'
Will be replaced with a new syntax:
$1 = "<desktop-manager>+<window-manager>"

This assumes that neither "<desktop-manager>" nor "<window-manager>"
contain the "+" character but this shouldn't be a problem.

This patch also fixes the quoting by using double quotes (") instead of
single quotes (') [0].

Last but not least this'll add some comments for the better
understanding of the script.

[0]: https://specifications.freedesktop.org/desktop-entry-spec/latest/ar01s06.html
2017-04-28 22:00:14 +02:00
lassulus 87a4615e27 nixos/stage1: add copytoram support 2017-04-28 20:48:09 +02:00
Pascal Wittmann c03d1df5b8 Merge pull request #25110 from iSma/fix/trackpoint-scrolling-etps-elantech
Add Elantech ETPS/2 Trackpoint (ThinkPad Yoga 260)
2017-04-28 15:46:39 +02:00
Domen Kožar 330e800496
nixos: hydra: sync with upstream hydra module 2017-04-28 14:51:25 +02:00
Joachim F 38c98d1072 Merge pull request #25128 from jb55/fix/plex-startup
plex: fix startup issue
2017-04-28 12:48:55 +01:00
Joachim F 0c40ea7340 Merge pull request #21227 from lheckemann/vgaswitcheroo
amd-hybrid-graphics: fix race condition
2017-04-28 12:47:00 +01:00
Thomas Tuegel b70837e054
nixos/plasma5: set system-wide QT_PLUGIN_PATH 2017-04-28 05:54:18 -05:00
Joachim Fasting 32b8512e54
grsecurity: discontinue support
Upstream has decided to make -testing patches private, effectively ceasing
free support for grsecurity/PaX [1].  Consequently, we can no longer
responsibly support grsecurity on NixOS.

This patch turns the kernel and patch expressions into build errors and
adds a warning to the manual, but retains most of the infrastructure, in
an effort to make the transition smoother.  For 17.09 all of it should
probably be pruned.

[1]: https://grsecurity.net/passing_the_baton.php
2017-04-28 12:35:15 +02:00
Alexey Shmalko a012b15f87 Merge pull request #25181 from indiscipline/aria2.service
Implement aria2 service for controlling a daemon via rpc.
2017-04-28 12:37:06 +03:00
Michał Pałka 2fcb8714ba xen service: fix xen-bridge not setting the configured netmask
The xen-bridge service accepts the option prefixLength, but does not
use it to set the actual netmask on the bridge. This commit makes
it set the correct netmask.
2017-04-28 07:48:51 +00:00
Judson Lester 0d72629570 nixos/display-managers: Quote "$vars" (#25199) 2017-04-27 18:01:48 +02:00
Franz Pletz dab5f92ed5 Merge pull request #25210 from Ma27/zsh/refactor-syntax-highlighting
programs.zsh.syntax-highlighting: refactor `highlighters` option for proper validation
2017-04-27 17:37:43 +02:00
Andrew Martin e289b94fbe graphite service: no recursive chown when starting (#24442)
Fixes #24444
2017-04-27 17:33:42 +02:00
Kirill 64a7be7f3c Merge branch 'master' into aria2.service 2017-04-27 17:50:13 +03:00
Kirill 31c4498a47 Fix indentation. Fix openPorts option default to false. 2017-04-27 17:13:27 +03:00
Orivej Desh 8f634a78b9 clickhouse: init at 1.1.54190 2017-04-27 13:25:58 +00:00
Jörg Thalheim 7b96e3d6a7 Merge pull request #25245 from bachp/docker-proxy
docker: pass all proxy variables to docker daemon
2017-04-27 11:03:46 +02:00
Graham Christensen bdd89faebb
Revert "openvpn service: source up/down scripts"
This reverts commit 50ad243f78.
2017-04-26 12:32:59 -04:00
David McFarland 7deb425286 nixos: use pkgsi686Linux for pkgs_i686 (#24772) 2017-04-26 18:20:38 +02:00
Pascal Bach 846f36203c docker: pass all proxy variables to docker daemon
This makes things as noProxy work too.
2017-04-26 16:55:36 +02:00
Jörg Thalheim 9d3c118320
google-compute-image: append .raw.tar.gz suffix
This restores behavior of image generation before f1708a9d7d
2017-04-26 16:40:38 +02:00
Graham Christensen 5dd731b801
mysql test: test replication persists between slave stop / start cycle 2017-04-25 18:51:49 -04:00
Graham Christensen da0ef84c0c
mysql test: use OpenPort check over blind sleep 2017-04-25 18:51:46 -04:00
Daniel Peebles 1ec8afdfdc Merge pull request #25197 from copumpkin/azure-image-common
azure-image: switch to use the common make-disk-image.nix
2017-04-25 17:18:08 -04:00
Tristan Helmich 50ad243f78
openvpn service: source up/down scripts
source the up/down scripts instead of executing them to avoid loosing
access to special variables like $1
2017-04-25 13:18:54 -04:00
Eelco Dolstra e4190943c8
nix: 1.11.8 -> 1.11.9 2017-04-25 17:19:10 +02:00
Maximilian Bosch baa3b3efff
programs.zsh.syntax-highlighting: refactor highlighters option for proper validation
Right now the `programs.zsh.syntax-highlighting.highlighters` option
lacks appropriate validation which can cause confusing things when
mistyping a higlighter for zsh-syntax-highlighting.
2017-04-25 16:00:26 +02:00
Edward Tjörnhammar 45470c65f5
nixos: static ids for jackett, radarr, sonarr 2017-04-25 12:08:21 +02:00
aszlig 72f2b506c7
nixos/grub: Add another example for extraEntries
Someone on IRC wanted to boot Fedora from another disk. While I'm not
too familiar with UEFI booting in conjunction with GRUB2 it took some
time to get it to work.

So in order to safe others from frustration I'm adding this as another
example to the extraEntries option.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-04-25 08:50:43 +02:00
Dan Peebles ee2cffbdb4 azure-image: switch to use the common make-disk-image.nix 2017-04-25 02:59:13 +00:00
Graham Christensen 3ab98d0971 Merge pull request #24999 from grahamc/qemu
qemu module: add virtualisation.cores option
2017-04-24 21:30:39 -04:00
Daniel Peebles f2d1aa05de Merge pull request #25165 from copumpkin/google-image-common
google-compute-image: switch to use the common make-disk-image.nix
2017-04-24 18:30:26 -04:00
Данило Глинський (Danylo Hlynskyi) 84b1c0c481 Fix imperative container code examples
Since some time Nixos has firewall enabled by default, so update example.
Also, remove newline escaping (it isn't needed).

Closes https://github.com/NixOS/nixpkgs/issues/25174
2017-04-24 22:31:02 +02:00
Graham Christensen 4585fdb9d4
qemu module: add virtualisation.cores option
QEMU can allow guests to access more than one host core at a time.
Previously, this had to be done via ad-hoc arguments:

    virtualisation.qemu.options = ["-smp 12"];

Now you can simply specify:

    virtualisation.cores = 12;
2017-04-24 15:23:46 -04:00
Franz Pletz e74ea4282a
avahi service: add reflector option 2017-04-24 21:06:42 +02:00
Edward Tjörnhammar 0277345265
nixos, i2pd: remove, no longer needed, extip hack 2017-04-24 20:49:13 +02:00
Dan Peebles 9fae0f3f38 google-compute-image: switch to use the common make-disk-image.nix 2017-04-24 18:38:10 +00:00
Kirill 7a6738fefc Implement aria2 service for controlling a daemon via rpc. 2017-04-24 18:50:40 +03:00
aszlig 79e712822f
nixos/xserver: Document xrandrHeads.apply
It was asked by @CMCDragonkai to elaborate on that, so let's just do
this by actually providing a code comment.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-04-24 12:02:10 +02:00
aszlig d7a8876c13
nixos/doc: Improve release notes for xrandrHeads
The xrandrHeads option has been there since a long time, so there is no
need to advertise it as a new feature.

Instead, let's focus on just what has changed, which is that we now
assign one head to be primary.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-04-24 11:54:38 +02:00
aszlig 8266c89b55
nixos/xserver: Fix up/refactor xrandrHeads option
Using invalid module options in the submodule isn't very nice, because
it doesn't give very useful errors in case of type mismatch, also we
don't get descriptions of these options as they're effecively
nonexistent to the module system. Another downside of this is that
merging of these options isn't done correctly as well (eg. for
types.lines).

So we now have proper submodules for each xrandrHead and we also use
corcedTo in the type of xrandrHeads so that we can populate the
submodule's "output" option in case a plain string is defined for a list
item.

Instead of silently skipping multiple primary heads, we now have an
assertion, which displays a message and aborts configuration evaluation
appropriately.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-04-24 11:22:55 +02:00
Tad Fisher bf427b9bae ups: fix config generation 2017-04-23 21:35:48 -07:00
Dan Peebles f1708a9d7d make-disk-image: change to be less VM-centric
This changes much of the make-disk-image.nix logic (and thus most NixOS
image building) to use LKL to set up the target directory structure rather
than a Linux VM. The only work we still do in a VM is less IO-heavy stuff
that while still time-consuming, is less of the overall load. The goal is
to kill more of that stuff, but that will require deeper changes to NixOS
activation scripts and switch-to-configuration.pl, and I don't want to
bite off too much at once.
2017-04-24 02:30:00 +00:00
Maximilian Bosch 0a12aafde4 zsh-syntax-highlighting: Add more configuration options and move to module (#25153)
* programs.zsh: factor zsh-syntax-highlighting out into its own module

* programs.zsh.syntax-highlighting: add `highlighters` option

* programs.zsh: document BC break introduced by moving zsh-syntax-completion into its own module
2017-04-23 21:17:31 +02:00
aszlig dc87b5587e
nixos: Add a VM test for the SLiM display manager
This is currently our default display manager, so I'm adding this to the
"tested" job as well to ensure we don't ship broken revisions where X is
most likely not working.

The test uses a custom SLiM theme that's specifically tailored for good
OCR results (mainly white background and black fonts without anything
else), because our default NixOS theme has a very small contrast between
background and fonts in some places.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-04-23 19:25:27 +02:00
aszlig 83e1400e0c
nixos/slim: Implement logging to journal
The main change here is a patch of SLiM to tread a log file of
/dev/stderr specially in that it now uses std::cerr instead of a file
for logging.

This allows us to set the logfile to stderr in NixOS for the generated
SLiM configuration file and we now get logging to the systemd journal.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-04-23 19:25:23 +02:00
Rodney Lorrimar ced172010a gogs service: add option for enabling "secure" cookies 2017-04-23 16:27:43 +01:00
William Casarin 35eeb08dc6 plex: fix startup issue
Fixes an issue with plex on startup

Fixes #24090
2017-04-23 08:26:18 -07:00
Rodney Lorrimar 0e90a05a52 gogs service: generate the secret key only once, then reuse 2017-04-23 15:05:44 +01:00
Maximilian Bosch 9ec64d2890 oh-my-zsh: add module (#25140)
* programs.zsh: add enableOhMyZsh option to automate setup of oh-my-zsh in global zshrc

* programs.zsh: make oh-my-zsh plugins configurable

* programs.zsh: add ohMyZshCustom option

* programs.zsh: add ohMyZshTheme option

* programs.zsh: applying minor fixes to evaluate expressions properly

* programs.zsh: fix ordering of oh-my-zsh config and execution

* programs.zsh: move all oh-my-zsh params into its own scope named programs.zsh.oh-my-zsh
2017-04-23 13:58:07 +02:00
Jörg Thalheim 44c3726dca
fcron: install systab
fixes #25072
2017-04-23 11:44:04 +02:00
Joachim Fasting 063ac40304
nixos: add a "hardened" profile
The idea is to provide a convenient way to enable most vanilla hardening
features in one go.  The hardened profile, then, will serve as a place for
features that enhance security but cannot be enabled for all deployments
because they interfere with legitimate use cases (e.g., using ptrace to
debug problems in an already running process).

Closes https://github.com/NixOS/nixpkgs/pull/24680
2017-04-23 11:00:52 +02:00
Joachim Fasting 1b3300bf01
nixos/tests/misc: check hidepid mount via /proc/mounts 2017-04-23 11:00:46 +02:00
Michael Weiss e1244f6e8a Revert "display-manager: fix argument handling of sddm"
This reverts commit 6b7c5ba535.

Unfortunately it seems like this broke slim, lightdm and gdm (see #25068
and #23264). This is already reverted in the 17.03 branch (99dfb6d).

TODO: We need tests for slim and lightdm and fix the test for gdm
(failing since 2016-10-26) to prevent such breakage in the future.
2017-04-23 03:19:07 +02:00
Rodney Lorrimar cfa1faa37c gogs service: chmod 440 config file
Directory which contains the config file /var/lib/gogs already
has mode 700 but users are liable to change these things.
2017-04-22 17:51:04 +01:00
Rodney Lorrimar 79d52bc26c gogs service: don't copy database password to nix store
Relevant to #24288
2017-04-22 17:07:21 +01:00
Rodney Lorrimar 0c9512d263 gogs service: fix encoding of secret key
I was getting a secret key like this:

  [security]
  SECRET_KEY = 7X

Use coreutils base64 instead to get the full 256 bits of randomness.
2017-04-22 17:07:20 +01:00
Ismaïl Senhaji 9497aec292 Add Elantech ETPS/2 Trackpoint (ThinkPad Yoga 260) 2017-04-22 13:42:57 +02:00
Benno Fünfstück 855155083a Merge pull request #24755 from LumiGuide/bepasty-secretKeyFile
bepasty: add secretKeyFile option
2017-04-22 00:07:04 +02:00
Fernando J Pando 4ac06ea6a1 buildbot: 0.9.4 -> 0.9.5
- adds distro dependency
- buildbot nodaemon in service module
- fakerepo for module tests
- service module parameter fixup
- tested on nixos
- tested on darwin
2017-04-21 10:32:36 -04:00
Roger Qiu bb6a5b079f nixos/xserver: Changed xrandrHeads to support corresponding monitor section configuration in Xorg 2017-04-21 22:01:29 +10:00
Philipp Hausmann 59ca1f6486 cloud-init: Disable broken hostname functionality by default 2017-04-20 19:12:27 +02:00
Marius Bergmann 6572f5e81b keepalived service: init (#22755) 2017-04-20 12:50:59 +01:00
aszlig e662e035f9
nixos/systemd-boot-builder: Don't write .pyc files
This has surfaced since d990aa7163.

The "simpleUefiGummiboot" installer test fails since this commit,
because that commit introduced a small check to verify whether the store
was altered.

While installing NixOS for the first time, the store is usually in
/mnt/nix/store and without the read-only bind mount that's preventing
programs from altering the store.

So after nixos-install is done creating the system closure and setting
it as the active system profile, the bootloader is written from the
closure inside the chroot. The systemd-boot-builder is invoked during
this step, which adds .pyc files for various Python modules of the
Python 3 store path, which in turn invalidates the hash of the Python 3
store path itself.

At the time the system is booted up again, the nix-store is verified and
fails with something like this:

path /nix/store/zvm545rqc4d97caqq9h7344bnd06jhzb-python3-3.5.3 was
modified! expected hash
b2c975f4b8d197443fbb09690fb3f6545e165dd44c9309d7d6df2fce0579ebeb, got
bccca19f39c9d26d857ccf1fb72818b2b817967e6d497a25a1283e36ed0acf01

Running the interpreter with the -B argument prevents Python from
writing those byte code files:

https://docs.python.org/3/using/cmdline.html#cmdoption-B

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-04-20 00:37:02 +02:00
Benno Fünfstück 149656581d Merge pull request #24601 from pbogdan/unclutter
unclutter: Fix default value of $DISPLAY
2017-04-19 18:40:43 +02:00
Jörg Thalheim 8174b447a2 znapsend: do not spawn a shell in the service 2017-04-19 13:56:51 +02:00
Robin Stumm 725b84be18 znapzend service: fix reload 2017-04-19 01:05:55 +02:00
Jörg Thalheim b2ed3db94a Merge pull request #24962 from makefu/modules/command-not-found/refactor
Refactor command-not-found
2017-04-18 17:18:20 +02:00
Vladimír Čunát 91ad6b3597
Revert "grub module: fix efiInstallAsRemovable description"
This reverts commit c2b56626f1.
It broke creating the manual.  I suspect the descriptions are
auto-wrapped by <para> and </para>.

We've been through this already in 3af715af90.
/cc #24978, @zraexy, @Mic92.
2017-04-18 14:26:36 +02:00
Jörg Thalheim 6b7c5ba535
display-manager: fix argument handling of sddm
previously session type was not correctly set.

fixes #23264
2017-04-18 01:41:17 +02:00
zraexy c2b56626f1 grub module: fix efiInstallAsRemovable description 2017-04-17 14:45:56 -08:00
John Ericson 37e5e71fdf Merge pull request #24974 from Ericson2314/mapNullable
Introduce `mapNullable` into lib and use it in a few places
2017-04-17 17:12:14 -04:00
John Ericson 85aa5005af Introduce mapNullable into lib and use it in a few places
Also simply some configure flag logic my grep also alerted me too.
2017-04-17 17:04:04 -04:00
makefu 5a5db609e5
command-not-found: add options
add option to disable command-not-found as well as option to define dbPath.
Disabling this may remove the perl dependency for bash/zsh prompts
2017-04-17 16:48:47 +02:00
Daniel Peebles e9f1d8693a Merge pull request #23026 from copumpkin/nixos-install-wip
Refactor nixos-install to separate out filesystem build logic
2017-04-17 09:50:35 -04:00
Markus Mueller 5042e9d009
network-interfaces-scripted: Add static parameter for default gateway 2017-04-16 22:59:53 +02:00
Jörg Thalheim 002a2b479a Merge pull request #24486 from srp/master
slock needs suid privileges
2017-04-16 21:40:21 +02:00
Christian Kögler d2e46b9f70 dhcpcd service: clear exit code of exitHook (#24909)
* dhcpcd: clear exit code of exitHook

* dhcpcd: restart ntp server in oneshot in exit-hook
2017-04-16 20:10:44 +02:00
Jörg Thalheim 16f5bc07f8 Merge pull request #24948 from peterhoeg/m/bluetooth
bluetooth: use upstream's recommendation for enabling interfaces
2017-04-16 18:09:51 +02:00
Dan Peebles d990aa7163 Refactor nixos-install to separate out filesystem build logic
The key distinction I'm drawing is that there's a component that deals
with the store of the machine being built, and another component for
the store building it. The inner part of it assumes nothing from the
builder (doesn't need chroot or root powers) so it can run comfortably
inside a Nix build, as well as nixos-rebuild. I have some upcoming work
that will use that to significantly speed up and streamline image builds
for NixOS, especially on virtualized hosts like EC2, but it's also a
reasonable speedup on native hosts.
2017-04-16 16:09:41 +00:00
Joachim F 2db0cf0897 Merge pull request #24900 from pjones/pjones/plex-service
plex: Don't overwrite primary database on restart
2017-04-16 13:09:26 +01:00
Peter Hoeg 99d4ed5861 bluetooth: use upstream's recommendation for enabling interfaces
bluez no longer recommends spawning "hciconfig <device> up" from a udev rule as
the main bluez daemon now supports automatically enabling power for all devices.

Reference: http://www.bluez.org/release-of-bluez-5-35/
2017-04-16 16:57:11 +08:00
edef 27e750e29b etcd module: fix extraConf manual link 2017-04-16 00:26:23 +02:00
Jörg Thalheim b9d9083322
powertop: add module 2017-04-15 15:17:02 +02:00
Jaka Hudoklin a98c26cdc4 Merge pull request #24921 from peterhoeg/f/k8s
kubernetes: fix interpolation error and move services to own target
2017-04-15 10:43:25 +02:00
Peter Jones 5a50b26662
plex: Don't overwrite primary database on restart
This change fixes two major issues:

  1. If you don't use SIGQUIT to stop Plex it will corrupt its own
     database :(

  2. Newer versions of Plex keep metadata in the
     `com.plexapp.plugins.library.db` database.  This is the file that
     we copy into `/var/lib/plex/.skeleton`.  If we copy the empty
     database on top of this one the user will lose their entire
     library metadata.  This change skips the copy if the file
     already exists.
2017-04-14 11:19:29 -07:00
Vladimír Čunát 2090aa4f65
Merge: fixup a bad merge
For details see:
https://github.com/NixOS/nixpkgs/commit/24444513fb5#commitcomment-21767916
2017-04-14 19:11:17 +02:00
Thomas Tuegel 48b5b77bb7 Merge pull request #24813 from benley/nm-openvpn
nixos: Add nm-openvpn to the networkmanager group
2017-04-14 05:44:01 -05:00
Vladimír Čunát 5b3f807597
Merge #24179: openssh: 7.4p1 -> 7.5p1 2017-04-14 12:16:26 +02:00
Vladimír Čunát da20d0e488
murmur service: fix typos from #24830 2017-04-14 11:05:42 +02:00
Vladimír Čunát 24444513fb
Merge branch 'staging' 2017-04-14 10:32:13 +02:00
Daniel Peebles 09a9a472ee Merge pull request #24830 from mayflower/refactor/boolToString
treewide: use boolToString function
2017-04-13 09:45:31 -04:00