Commit graph

21795 commits

Author SHA1 Message Date
markuskowa f188138af3
Merge pull request #124181 from pmenke-de/sdrplay
sdrplay: init at 3.07.1
2021-05-29 22:21:10 +02:00
Martin Weinelt ee8cf6a664
Merge pull request #124839 from mweinelt/wordpress/secret-key-regen
nixos/wordpress: regenerate secret keys if misspelled key name is found
2021-05-29 22:13:03 +02:00
Martin Weinelt 724ed08df0
nixos/wordpress: regenerate secret keys if misspelled key name is found
A secret key generated by the nixos module was misspelled, which could
possibly impact the security of session cookies.

To recover from this situation we will wipe all security keys that were
previously generated by the NixOS module, when the misspelled one is
found. This will result in all session cookies being invalidated. This
is confirmed by the wordpress documentation:

> You can change these at any point in time to invalidate all existing
> cookies. This does mean that all users will have to login again.

https://wordpress.org/support/article/editing-wp-config-php/#security-keys

Meanwhile this issue shouldn't be too grave, since the salting function
of wordpress will rely on the concatenation of both the user-provided
and automatically generated values, that are stored in the database.

> Secret keys are located in two places: in the database and in the
> wp-config.php file. The secret key in the database is randomly
> generated and will be appended to the secret keys in wp-config.php.

https://developer.wordpress.org/reference/functions/wp_salt/

Fixes: 2adb03fdae ("nixos/wordpress:
generate secrets locally")

Reported-by: Moritz Hedtke <Moritz.Hedtke@t-online.de>
2021-05-29 04:24:42 +02:00
Dominik Xaver Hörl b7630d5591 rl-2105: mention linux_latest and potential zfs issues 2021-05-28 18:10:43 -07:00
Niklas Hambüchen d344dccf3d nixos/wireguard: Remove .path systemd unit for privkey. Fixes #123203
As per `man systemd.path`:

> When a service unit triggered by a path unit terminates
> (regardless whether it exited successfully or failed),
> monitored paths are checked immediately again,
> **and the service accordingly restarted instantly**.

Thus the existence of the path unit made it impossible to stop the
wireguard service using e.g.

    systemctl stop wireguard-wg0.service

Systemd path units are not intended for program inputs such
as private key files.
This commit simply removes this usage; the private key is still
generated by the `generateKeyServiceUnit`.
2021-05-28 17:44:19 -07:00
talyz cb80b67993 nixos/discourse: Assert deployed PostgreSQL version
Assert that the PostgreSQL version being deployed is the one used
upstream. Allow the user to override this assertion, since it's not
always possible or preferable to use the recommended one.
2021-05-28 17:43:02 -07:00
talyz 1f6b48be74 discourse: 2.6.5 -> 2.7.0 2021-05-28 17:43:02 -07:00
Antoine R. Dumont (@ardumont) 38cfb84ff0 mediatomb/gerbera: Add release note information for 21.03
Note that it made into 2 entries, one about new options in the first section.
Another in the breaking compatibility section due to the openFirewall option
which changes the behavior.

Co-authored-by: schmittlauch <t.schmittlauch+nixos@orlives.de>
2021-05-28 10:56:19 -07:00
pmenke 9e0ed182aa
sdrplay: init at 3.07.1
this adds support for software defined radio (SDR) devices by SDRplay.
SDRplay provides an unfree binary library and api-service as well
as a MIT licensed adapter library for SoapySDR for integration
with many popular SDR applications.
2021-05-28 15:40:04 +02:00
Jan Tojnar b2f86e6662
nixos/gnome: Do not enable metacity by default
Did not realize this is not conditional on gnome-flashback being enabled.

Partially reverts https://github.com/NixOS/nixpkgs/pull/113957
2021-05-28 14:57:36 +02:00
Jan Tojnar e923fc2d2b
Merge pull request #113957 from chpatrick/gnome-flashback-panel-fix
gnome-flashback: add option to remove gnome-panel, auto-generate wmName
2021-05-28 13:32:22 +02:00
Patrick Chilton 424cd7d999 gnome-flashback: add option to remove gnome-panel, auto-generate wmName 2021-05-28 13:10:17 +02:00
Domen Kožar b72c2d3806
duplicati: 2.0.5.1 -> 2.0.6.1, fix nixos module 2021-05-28 10:33:53 +02:00
Robert Hensing 490aeb3cfa
Merge pull request #124494 from hercules-ci/dockerTools-omit-store
dockerTools: Allow omitting all store paths
2021-05-28 08:55:33 +02:00
Michael Weiss 2f671ccc7a
nixos/tests/{sway,cage,cagebreak}: Fix the tests on aarch64-linux
Since the update to wlroots 0.13 (e03dde82a7) the default VGA card
isn't supported anymore and we needed to switch to virtio (qxl didn't
work either). However, as it turned out "-vga virtio" (28b8cff301)
broke the test on AArch64. Luckily there's a third option that works on
all three supported platforms: virtio-gpu-pci

According to [0] "This device lacks VGA compatibility mode but is
otherwise identical to the virtio vga device. UEFI firmware can handle
this, and if your guests has drivers too you can use this instead of
virtio-vga. This will reduce the attack surface (no complex VGA
emulation support) and reduce the memory footprint by 8 MB (no pci
memory bar for VGA compatibility). This device can be placed in a PCI
Express slot."
So in the end this seems like the ideal choice :)
See also [1].

[0]: https://www.kraxel.org/blog/2019/09/display-devices-in-qemu/#virtio-gpu-pci
[1]: https://patches.openembedded.org/patch/164351/
2021-05-27 21:29:54 +02:00
Michael Weiss abb9ea73f7
nixos/tests/{sway,cagebreak}: Disable on aarch64-linux
The tests timeout on AArch64 (e.g. [0] and [1]), likely because the QEMU
option "-vga virtio" isn't supported there (unfortunately I currently
lack access to an AArch64 system with NixOS to investigate).

This also affects the test for Cage but that one is already limited to
x86_64-linux.

[0]: https://hydra.nixos.org/build/144148809
[1]: https://hydra.nixos.org/build/144103034
2021-05-27 14:14:49 +02:00
David Arnold 13750b25a5 kubernetes: fix generated kubeconfig
The absence of current-context in the right place resulted in obscure
bugs. The reason this has not been detected before can only be that
it was unused.
2021-05-26 23:39:48 -07:00
Sandro 5619e3eb35
Merge pull request #124147 from superherointj/package-firebird-v4.0.0 2021-05-27 05:13:50 +02:00
Sandro 5584b49a46
Merge pull request #123363 from FliegendeWurst/trilium-update-0.47.3 2021-05-27 04:52:55 +02:00
Maximilian Bosch b5a12b4b61
nixos/release-notes: fix slaptest command for openldap section
When running - as suggested - `slaptest -f slapd.conf $TMPDIR` I get the
following result:

    [root@ldap:/tmp/tmp.De46ABIbFf]# slaptest -f /nix/store/lks3ihydj40ff6yqvz0k33ycrc9vbyry-slapd.conf $TMPDIR
    usage: slaptest [-v] [-d debuglevel] [-f configfile] [-F configdir] [-o <name>[=<value>]] [-n databasenumber] [-u] [-Q]

    [root@ldap:/tmp/tmp.De46ABIbFf]# echo $?
    1

Adding a `-F` option fixes the issue.
2021-05-26 20:50:01 +02:00
Naïm Favier a6788be01a
nixos/luksroot: add bypassWorkqueues (#118114)
https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Disable_workqueue_for_increased_solid_state_drive_(SSD)_performance
2021-05-26 09:43:38 -04:00
Robert Hensing 5259d66b74 dockerTools: Allow omitting all store paths
Adds includeStorePaths, allowing the omission of the store paths.
You generally want to leave it on, but tooling may disable this
to insert the store paths more efficiently via other means, such
as bind mounting the host store.
2021-05-26 15:11:42 +02:00
Jonathan Ringer 4d318bcb5a
nixos/doc/releases: remove
No one but release managers need to know this information.
Also, it has been moved to https://github.com/NixOS/release-wiki
2021-05-25 12:36:27 -07:00
Martin Weinelt fcd6d0bc14
Merge pull request #124263 from Lassulus/solanum3
solanum: remove obsolete BANDB settings/patches
2021-05-25 20:51:32 +02:00
Ryan Mulligan cf2f26fd89
Merge pull request #124043 from fgaz/staticjinja/2.0.0
staticjinja: 1.0.4 -> 2.0.0
2021-05-25 11:22:25 -07:00
Sandro Jäckel 140828ce38
nixos/kresd: tell resolveconf to use local resolver 2021-05-25 16:37:00 +02:00
Thomas Depierre f55c3e2f21 beam-packages: drop erlang R18 R19 R20 and cuter 2021-05-25 07:38:41 +09:00
Niklas Hambüchen 83a8acc392
Merge pull request #121331 from nh2/wireguard-dynamicEndpointRefreshSeconds
nixos/wireguard: Add `dynamicEndpointRefreshSeconds` option
2021-05-24 21:49:05 +02:00
Samuel Dionne-Riel db3199f8c3
Merge pull request #118993 from tomfitzhenry/serial-doc
nixos/manual: document how to install over a serial port
2021-05-24 15:26:23 -04:00
lassulus 8eb5701aaf solanum: remove obsolete BANDB settings/patches 2021-05-24 15:49:57 +02:00
Naïm Favier 821ca7d4cc
nixos/nginx: add option rejectSSL exposing ssl_reject_handshake 2021-05-24 15:10:09 +02:00
Francesco Gazzetta 5b42338f4e docs/release-notes: mention staticjinja 2021-05-24 14:17:51 +02:00
regnat 113823669b Revert "nixos/nix-daemon: fix sandbox-paths option"
This reverts commit aeeee447bc.
2021-05-24 10:51:02 +02:00
FliegendeWurst b9e2b878c5 nixos/trilium-server: noBackup option 2021-05-24 09:55:49 +02:00
FliegendeWurst 7cb492fb13 nixos/trilium-server: add myself as maintainer 2021-05-24 09:55:49 +02:00
Tom Fitzhenry 81e04717e8 nixos/manual: document how to install over a serial port
https://github.com/NixOS/nixpkgs/issues/58198
2021-05-24 17:29:19 +10:00
Ivan Kozik d95960e275 nixos/bitwarden_rs: fix startup on 32 thread machines
LimitNPROC=64 is too low for bitwarden_rs to start on a 32 thread machine.
Remove the limit.

This fixes:

```
bitwarden_rs[38701]: /--------------------------------------------------------------------\
bitwarden_rs[38701]: |                       Starting Bitwarden_RS                        |
bitwarden_rs[38701]: |--------------------------------------------------------------------|
bitwarden_rs[38701]: | This is an *unofficial* Bitwarden implementation, DO NOT use the   |
bitwarden_rs[38701]: | official channels to report bugs/features, regardless of client.   |
bitwarden_rs[38701]: | Send usage/configuration questions or feature requests to:         |
bitwarden_rs[38701]: |   https://bitwardenrs.discourse.group/                             |
bitwarden_rs[38701]: | Report suspected bugs/issues in the software itself at:            |
bitwarden_rs[38701]: |   https://github.com/dani-garcia/bitwarden_rs/issues/new           |
bitwarden_rs[38701]: \--------------------------------------------------------------------/
bitwarden_rs[38701]: [INFO] No .env file found.
bitwarden_rs[38701]: [2021-05-24 03:34:41.121][bitwarden_rs::api::core::sends][INFO] Initiating send deletion
bitwarden_rs[38701]: [2021-05-24 03:34:41.122][start][INFO] Rocket has launched from http://127.0.0.1:8222
bitwarden_rs[38701]: [2021-05-24 03:34:41.126][panic][ERROR] thread 'unnamed' panicked at 'failed to spawn thread: Os { code: 11, kind: WouldBlock, message: "Resource temporarily unavailable" }': /build/rustc-1.52.1-src/library/std/src/thread/mod.rs:620
bitwarden_rs[38701]:    0: bitwarden_rs::init_logging::{{closure}}
bitwarden_rs[38701]:    1: std::panicking::rust_panic_with_hook
bitwarden_rs[38701]:    2: std::panicking::begin_panic_handler::{{closure}}
bitwarden_rs[38701]:    3: std::sys_common::backtrace::__rust_end_short_backtrace
bitwarden_rs[38701]:    4: rust_begin_unwind
bitwarden_rs[38701]:    5: core::panicking::panic_fmt
bitwarden_rs[38701]:    6: core::result::unwrap_failed
bitwarden_rs[38701]:    7: hyper::server::listener::spawn_with
bitwarden_rs[38701]:    8: hyper::server::listener::ListenerPool<A>::accept
bitwarden_rs[38701]:    9: std::sys_common::backtrace::__rust_begin_short_backtrace
bitwarden_rs[38701]:   10: core::ops::function::FnOnce::call_once{{vtable.shim}}
bitwarden_rs[38701]:   11: std::sys::unix:🧵:Thread:🆕:thread_start
bitwarden_rs[38701]:   12: start_thread
bitwarden_rs[38701]:   13: __GI___clone
bitwarden_rs[38701]: [2021-05-24 03:34:41.126][panic][ERROR] thread 'main' panicked at 'internal error: entered unreachable code: the call to `handle_threads` should block on success': /build/bitwarden_rs-1.20.0-vendor.tar.gz/rocket/src/rocket.rs:751
bitwarden_rs[38701]:    0: bitwarden_rs::init_logging::{{closure}}
bitwarden_rs[38701]:    1: std::panicking::rust_panic_with_hook
bitwarden_rs[38701]:    2: std::panicking::begin_panic_handler::{{closure}}
bitwarden_rs[38701]:    3: std::sys_common::backtrace::__rust_end_short_backtrace
bitwarden_rs[38701]:    4: rust_begin_unwind
bitwarden_rs[38701]:    5: core::panicking::panic_fmt
bitwarden_rs[38701]:    6: rocket:🚀:Rocket::launch
bitwarden_rs[38701]:    7: bitwarden_rs::main
bitwarden_rs[38701]:    8: std::sys_common::backtrace::__rust_begin_short_backtrace
bitwarden_rs[38701]:    9: std::rt::lang_start::{{closure}}
bitwarden_rs[38701]:   10: std::rt::lang_start_internal
bitwarden_rs[38701]:   11: main
```
2021-05-24 04:36:17 +00:00
Sandro fd26001ead
Merge pull request #123304 from SuperSandro2000/pihole-exporter 2021-05-24 04:27:16 +02:00
Sandro Jäckel 0724518919
nixos/prometheus: init pihole-exporter 2021-05-24 04:05:59 +02:00
Anderson Torres e445fc8661
Merge pull request #123583 from superherointj/module-libvirtd-ovmf-aarch64-fix
libvirtd: fix ovmf for aarch64
2021-05-23 19:56:27 -03:00
Michael Raskin ab51a2dbd6
Merge pull request #123926 from pschyska/master
nixos/atop: Add defaultText to types.package options, Fix timing-related test failures.
2021-05-23 18:08:46 +00:00
José Romildo Malaquias de84bd18d7
Merge pull request #121031 from romildo/fix.lxqt
lxqt: does not explicitly require gvfs package
2021-05-23 15:06:55 -03:00
superherointj 97d9e7849b nixos/firebird: updated firebird package 2021-05-23 10:53:00 -03:00
Guillaume Girol d7555732bc
Merge pull request #123902 from hyperfekt/mount-pstore-quiet
nixos/filesystems: condition mount-pstore.service on unmounted /sys/fs/pstore
2021-05-23 12:18:14 +00:00
Samuel Dionne-Riel 20b023b5ea iso-image: Improve disk detection
This should help in rare hardware-specific situations where the root is
not automatically detected properly.

We search using a marker file. This should help some weird UEFI setups
where the root is set to `(hd0,msdos2)` by default.

Defaulting to `(hd0)` by looking for the ESP **will break themeing**. It
is unclear why, but files in `(hd0,msdos2)` are not all present as they
should be.

This also fixes an issue introduced with cb5c4fcd3c
where rEFInd stopped booting in many cases. This is because it ended up
using (hd0) rather than using the `search` which was happening
beforehand, which in turn uses (hd0,msdos2), which is the ESP.
Putting back the `search` here fixes that.
2021-05-22 20:04:05 -07:00
Samuel Dionne-Riel c9bb054dd6 iso-image: unqualified root → ($root)
This technically changes nothing. In practice `$root` is always the
"CWD", whether searched for automatically or not.

But this serves to announce we are relying on `$root`... I guess...
2021-05-22 20:04:05 -07:00
Samuel Dionne-Riel 15eaed0718 iso-image: change date on all files
It may be that in some conditions dates earlier than 1980 on FAT on GRUB
2.06~ish will cause failures

https://github.com/NixOS/nixpkgs/issues/123376#issuecomment-845515035
2021-05-22 20:04:05 -07:00
Samuel Dionne-Riel f93f0e72e9 iso-image: Force gfxmode
https://www.gnu.org/software/grub/manual/grub/html_node/gfxmode.html
2021-05-22 20:04:05 -07:00
Jonathan Ringer 11a9ac00fc
Merge remote-tracking branch 'origin/master' into staging-next
Conflicts:
 pkgs/tools/networking/xh/default.nix
2021-05-22 18:19:10 -07:00
Ryan Mulligan 6543c61311 nixos/doc: add 21.11 release notes stub 2021-05-22 18:14:49 -07:00