Commit graph

17134 commits

Author SHA1 Message Date
Jan Tojnar 09c4736405
Merge pull request #83755 from jtojnar/jcat-0.1 2020-04-18 20:38:24 +02:00
Jörg Thalheim 35eb7793a3
Merge pull request #83166 from avnik/nix-build-location 2020-04-18 18:37:15 +01:00
Alexander V. Nikolaev 5291925fd2 nixos: Introduce nix.buildLocation option
Allow to specify where package build will happens.
It helps big packages (like browsers) not to overflow tmpfs.
2020-04-18 20:31:04 +03:00
worldofpeace 996ae856b6
Merge pull request #85365 from immae/fix_acme_postrun
nixos/acme: Fix postRun in acme certificate being ran at every run
2020-04-18 13:16:16 -04:00
Alyssa Ross 1b0d8015fe nixos/rss2email: globally install rss2email
For man pages.
2020-04-18 14:16:00 +00:00
Pavol Rusnak fadcfc3ea4
treewide: per RFC45, remove more unquoted URLs 2020-04-18 14:04:37 +02:00
Edmund Wu 4727e95eb6
manual/rl-2009.xml: fix build (#85478)
16a4332d60 (diff-43de86228df91216c5cfc9446cb041feL249)
2020-04-18 07:51:06 +02:00
Vladimír Čunát d96487b9ca
Merge branch 'master' into staging-next
Hydra nixpkgs: ?compare=1582510
2020-04-18 07:42:26 +02:00
Emily 21f183a3fe nixos/tests/common/acme: don't set nameservers for client
The resolver is mainly useful for the ACME server, and acme.nix uses its
own DNS server to test DNS-01 challenges.
2020-04-18 05:15:47 +01:00
Emily e6d5e83cf1 nixos/tests/common/acme: enable Pebble strict mode
This lets us get early warning about any bugs or backwards-compatibility
hazards in lego.

Pebble will default to this in the future, but doesn't currently;
see https://github.com/letsencrypt/pebble/blob/v2.3.0/README.md#strict-mode.
2020-04-18 05:15:47 +01:00
Emily 695fd78ac4 nixos/tests/acme: use CAP_NET_BIND_SERVICE 2020-04-18 05:15:47 +01:00
Emily d0f04c1623 nixos/tests/acme: use *.test domains
Shimming out the Let's Encrypt domain name to reuse client configuration
doesn't work properly (Pebble uses different endpoint URL formats), is
recommended against by upstream,[1] and is unnecessary now that the ACME
module supports specifying an ACME server. This commit changes the tests
to use the domain name acme.test instead, and renames the letsencrypt
node to acme to reflect that it has nothing to do with the ACME server
that Let's Encrypt runs. The imports are renamed for clarity:

* nixos/tests/common/{letsencrypt => acme}/{common.nix => client}
* nixos/tests/common/{letsencrypt => acme}/{default.nix => server}

The test's other domain names are also adjusted to use *.test for
consistency (and to avoid misuse of non-reserved domain names such
as standalone.com).

[1] https://github.com/letsencrypt/pebble/issues/283#issuecomment-545123242

Co-authored-by: Yegor Timoshenko <yegortimoshenko@riseup.net>
2020-04-18 05:15:47 +01:00
Emily 352e30df8a nixos/tests/acme: don't restrict to x86_64
This was added in aade4e577b, but the
implementation of the ACME module has been entirely rewritten since
then, and the test seems to run fine on AArch64.
2020-04-18 05:15:47 +01:00
John Ericson e3d50e5cb0 Merge branch 'master' of github.com:NixOS/nixpkgs into staging 2020-04-18 00:10:08 -04:00
Milan Pässler 16a4332d60 nixos/deluge: support 2.x 2020-04-18 02:00:04 +02:00
John Ericson 33c2a76c5e Merge remote-tracking branch 'upstream/master' into staging 2020-04-17 18:40:51 -04:00
Ismaël Bouya 8e88b8dce2
nixos/acme: Fix postRun in acme certificate being ran at every run 2020-04-17 22:16:50 +02:00
worldofpeace 40f3faedbd nixos/manual: 19.09 -> 20.03 2020-04-17 12:41:24 -04:00
Emily 2e31fb407e nixos/release-combined: add {,latestKernel.}hardened
These now depend on an external patch set; add them to the release tests
to ensure that the build doesn't break silently as new kernel updates
are merged.
2020-04-17 16:13:39 +01:00
Emily e133e396df nixos/release-{small,combined}: add latestKernel.login
Seems like a good idea to ensure that you can always use the latest
stable upstream kernel.
2020-04-17 16:13:39 +01:00
Emily fe031d07f8 nixos/tests/hardened: add latestKernel argument 2020-04-17 16:13:39 +01:00
Emily b0d5032ee4 nixos/hardened: add emily to maintainers 2020-04-17 16:13:39 +01:00
Emily ad9bfe2254 nixos/hardened: enable user namespaces for root
linux-hardened sets kernel.unprivileged_userns_clone=0 by default; see
anthraxx/linux-hardened@104f44058f.

This allows the Nix sandbox to function while reducing the attack
surface posed by user namespaces, which allow unprivileged code to
exercise lots of root-only code paths and have lead to privilege
escalation vulnerabilities in the past.

We can safely leave user namespaces on for privileged users, as root
already has root privileges, but if you're not running builds on your
machine and really want to minimize the kernel attack surface then you
can set security.allowUserNamespaces to false.

Note that Chrome's sandbox requires either unprivileged CLONE_NEWUSER or
setuid, and Firefox's silently reduces the security level if it isn't
allowed (see about:support), so desktop users may want to set:

    boot.kernel.sysctl."kernel.unprivileged_userns_clone" = true;
2020-04-17 16:13:39 +01:00
Emily 84f258bf09 nixos/hardened: don't set vm.unprivileged_userfaultfd
Upstreamed in anthraxx/linux-hardened@a712392b88.
2020-04-17 16:13:39 +01:00
Emily cc28d51237 nixos/hardened: don't set vm.mmap_min_addr
Upstreamed in anthraxx/linux-hardened@f1fe0a64dd.
2020-04-17 16:13:39 +01:00
Emily 46d12cca56 nixos/hardened: don't set vm.mmap_rnd{,_compat}_bits
Upstreamed in anthraxx/linux-hardened@ae6d85f437.
2020-04-17 16:13:39 +01:00
Emily af4f57b2c4 nixos/hardened: don't set net.core.bpf_jit_harden
Upstreamed in anthraxx/linux-hardened@82e384401d.
2020-04-17 16:13:39 +01:00
Emily 71bbd876b7 nixos/hardened: don't set kernel.unprivileged_bpf_disabled
Upstreamed in anthraxx/linux-hardened@1a3e0c2830.
2020-04-17 16:13:39 +01:00
Emily 9da578a78f nixos/hardened: don't set kernel.dmesg_restrict
Upstreamed in anthraxx/linux-hardened@e3d3f13ffb.
2020-04-17 16:13:39 +01:00
Emily cf1bce6a7a nixos/hardened: don't set vsyscall=none
Upstreamed in anthraxx/linux-hardened@d300b0fdad.
2020-04-17 16:13:39 +01:00
Emily 3b32cd2a5b nixos/hardened: don't set slab_nomerge
Upstreamed in anthraxx/linux-hardened@df29f9248c.
2020-04-17 16:13:39 +01:00
Euan Kemp bc138f407f
nixos/k3s: add initial k3s service
* nixos/k3s: simplify config expression

* nixos/k3s: add config assertions and trim unneeded bits

* nixos/k3s: add a test that k3s works; minor module improvements

This is a single-node test. Eventually we should also have a multi-node
test to verify the agent bit works, but that one's more involved.

* nixos/k3s: add option description

* nixos/k3s: add defaults for token/serveraddr

Now that the assertion enforces their presence, we dont' need to use the typesystem for it.

* nixos/k3s: remove unneeded sudo in test

* nixos/k3s: add to test list
2020-04-17 16:39:54 +02:00
Jan Tojnar 4816b426a0
nixos/httpd: remove unnecessary override
This was introduced in c801cd1a04
but it no longer seems necessary.
2020-04-17 14:41:21 +02:00
Jan Tojnar 23a6903bb7
nixosTests.php.fpm: Clean up to match httpd test 2020-04-17 14:41:20 +02:00
Jan Tojnar b69556c580
nixosTests.php.pcre: Clean up
And add assertion messages
2020-04-17 14:41:20 +02:00
Jan Tojnar aac9832b96
nixosTests.php.httpd: init 2020-04-17 14:40:12 +02:00
Jan Tojnar c214e63f2e
nixos/httpd: Use extensions from php package
After the recent rewrite, enabled extensions are passed to php programs
through an extra ini file by a wrapper. Since httpd uses shared module
instead of program, the wrapper did not affect it and no extensions
other than built-ins were loaded.

To fix this, we are passing the extension config another way – by adding it
to the service's generated config.

For now we are hardcoding the path to the ini file. It would be nice to add
the path to the passthru and use that once the PHP expression settles down.
2020-04-17 14:38:29 +02:00
adisbladis 5340ebe085
mopidy: Create a mopidyPackages set
This is to avoid mixing python versions in the same plugin closure.
2020-04-17 12:39:03 +01:00
Kirill Elagin a9e9d37fc8 systemd: Add prefix to unit script derivations
Add a distinctive `unit-script` prefix to systemd unit scripts to make
them easier to find in the store directory. Do not add this prefix to
actual script file name as it clutters logs.
2020-04-17 13:55:48 +03:00
Kirill Elagin f1a78e1b5e fixup! systemd: Simplify unit script names 2020-04-17 13:44:48 +03:00
Kirill Elagin 5822d03851 systemd: Simplify unit script names
Current journal output from services started by `script` rather than
`ExexStart` is unreadable because the name of the file (which journalctl
records and outputs) quite literally takes 1/3 of the screen (on smaller
screens).

Make it shorter. In particular:

* Drop the `unit-script` prefix as it is not very useful.
* Use `writeShellScriptBin` to write them because:
  * It has a `checkPhase` which is better than no checkPhase.
  * The script itself ends up having a short name.
2020-04-17 10:17:46 +03:00
Maximilian Bosch ab0a10b39b
Merge pull request #85341 from Ma27/bump-hydra
hydra: 2020-04-07 -> 2020-04-16
2020-04-16 21:48:45 +02:00
Yegor Timoshenko 8262ecd369
Merge pull request #85004 from emilazy/add-initrd-secrets-path-assertion
nixos/stage-1: check secret paths before copying
2020-04-16 17:42:40 +03:00
worldofpeace b61999e4ad
Merge pull request #85332 from arianvp/revert-acme
Revert "nixos/acme: Fix allowKeysForGroup not applying immediately"
2020-04-16 08:43:36 -04:00
Jörg Thalheim 4cc7c2e55a
tmpfiles: load user-defined entries first
systemd-tmpfiles will load all files in lexicographic order and ignores rules
for the same path in later files with a warning Since we apply the default rules
provided by systemd, we should load user-defines rules first so users have a
chance to override defaults.
2020-04-16 13:02:24 +01:00
Maximilian Bosch 74d6e86ec2
nixos/doc: fix database-setup example for matrix-synapse
Closes #85327
2020-04-16 11:38:15 +02:00
Arian van Putten 5c1c642939 Revert "nixos/acme: Fix allowKeysForGroup not applying immediately"
This reverts commit 5532065d06.

As far as I can tell setting RemainAfterExit=true here completely breaks
certificate renewal, which is really bad!

the sytemd timer will activate the service unit every OnCalendar=,
however with RemainAfterExit=true the service is already active! So the
timer doesn't rerun the service!

The commit also broke the actual tests, (As it broke activation too)
but this was fixed later in https://github.com/NixOS/nixpkgs/pull/76052
I wrongly assumed that PR fixed renewal too, which it didn't!

testing renewals is hard, as we need to sleep in tests.
2020-04-16 10:37:04 +02:00
Jan Tojnar 4b706490da
Merge branch 'staging-next' into staging 2020-04-16 10:10:38 +02:00
Jan Tojnar 3d8e436917
Merge branch 'master' into staging-next 2020-04-16 10:09:43 +02:00
Maximilian Bosch 5e124e5abd
nixos/tests: fix inclusion of hydra test 2020-04-16 02:17:25 +02:00
Maximilian Bosch 2d55f9c01a
Merge pull request #84266 from Ma27/nspawn-overrides
nixos/systemd-nspawn: disallow multiple packages with `.nspawn`-units
2020-04-16 00:24:33 +02:00
Maximilian Bosch 70ecf83c33
Merge pull request #82339 from Ma27/captive-browser-xdg
nixos/captive-browser: set chromium's data-dir to a XDG-compliant location
2020-04-16 00:06:12 +02:00
Jan Tojnar 1fade973fc
libjcat: init at 0.1.1 2020-04-15 20:30:06 +02:00
Florian Klink 7835641e77
Merge pull request #85252 from flokli/nixos-flannel-fix
nixosTests.flannel: port to python, unbreak
2020-04-15 20:01:13 +02:00
Maximilian Bosch dca0b71876
Merge pull request #85162 from Ma27/build-vms-file-loc
nixos/build-vms: propagate file location
2020-04-15 17:42:12 +02:00
jakobrs 34f242c13d nixos/installer: Add terminus_font to installation_iso_base 2020-04-15 14:21:42 +02:00
Michele Guerini Rocco da232ea497
Merge pull request #78129 from flyfloh/airsonic-vhost
airsonic: fix virtualHost option
2020-04-15 09:18:28 +02:00
Florian Klink 28ef43824b nixosTests.flannel: port to python, unbreak
For reasons yet unknown, the vxlan backend doesn't work (at least inside
the qemu networking), so this is moved to the udp backend.

Note changing the backend apparently also changes the interface name,
it's now `flannel0`, not `flannel.1`

fixes #74941
2020-04-14 23:56:42 +02:00
Matthew Bauer 57e20c5d87
Merge pull request #83362 from bachp/boinc
nixos/boinc: simplify setup of boinc service
2020-04-14 15:55:54 -04:00
Maximilian Bosch 57087ea280
Merge pull request #85165 from mayflower/alertmanager-clustering
prometheus/alertmanager: implement HA clustering support
2020-04-14 16:13:34 +02:00
worldofpeace 6304c9af48
Merge pull request #85222 from mayflower/libinput-manual-ref
nixos/libinput: refer to libinput manual
2020-04-14 09:42:55 -04:00
worldofpeace e4c5e68fca
Merge pull request #84255 from prikhi/lightdm-mini-greeter-040
lightdm-mini-greeter: 0.3.4 -> 0.4.0
2020-04-14 08:38:23 -04:00
Linus Heckemann 9953a26be1 nixos/libinput: refer to libinput manual 2020-04-14 14:31:49 +02:00
Sander van der Burg 0ffb720e8c nixos/dysnomia: fix documentRoot property 2020-04-14 14:31:13 +02:00
Michele Guerini Rocco 86d71ddbed
Merge pull request #85170 from flokli/networking-virtual
nixos/networking: fix setting MAC Address and MTU in networkd, fix tests
2020-04-14 14:20:49 +02:00
Jörg Thalheim fd438d5f09
Merge pull request #85185 from m1cr0man/legoaccounts
acme: share accounts between certificates
2020-04-14 13:12:57 +01:00
worldofpeace 57b862bb53
Merge pull request #85125 from iblech/patch-iodine-test
iodine: improve test in view of #58806
2020-04-14 08:03:23 -04:00
Thibaut Marty 8fb54e7168 herbstluftwm: add option to the X Window System manual chapter 2020-04-14 11:04:47 +02:00
Jaka Hudoklin de6891ffd0
Merge pull request #83930 from xtruder/nixos/virtualisation/hyperv-image
modules/virtualisation: add hyperv-image
2020-04-14 03:27:22 +00:00
John Ericson c8a6ea5161 Merge remote-tracking branch 'upstream/master' into staging 2020-04-13 22:17:15 -04:00
Lucas Savva 827d5e6b44
acme: share accounts between certificates
There are strict rate limits on account creation for Let's Encrypt
certificates. It is important to reuse credentails when possible.
2020-04-14 00:15:16 +01:00
Matthew Bauer e520d6af29
Merge pull request #84415 from matthewbauer/mb-cross-fixes-april2020
Cross compilation fixes [april 2020]
2020-04-13 16:48:38 -04:00
Florian Klink d1edd8b2f6 nixosTests.networking: test setting MTU and MAC Address
Both the scripted and networkd backend now support setting MTU and MAC
Address, so do this in a test to ensure it doesn't break.
2020-04-13 22:03:35 +02:00
Florian Klink 5150378c2f nixosTests.networking.virtual: fix with networkd
We only need to wait for network.target to get up, and the
network-addresses-${interfaceName} units are scripted networking only.
2020-04-13 22:03:35 +02:00
Florian Klink 1e1945319c nixosTests.networking: make routing table comparison more reliable
This was whitespace-sensitive, kept fighting with my editor and broke
the tests easily. To fix this, let python convert the output to
individual lines, and strip whitespace from them before comparing.
2020-04-13 22:03:35 +02:00
Florian Klink 532528190b nixos/networking: move network-link-${i.name} to scripted networking
The unit sets MTU and MAC Address even with networkd enabled, which
isn't necessary anymore, as networkd handles this by itself.
2020-04-13 22:03:35 +02:00
Florian Klink ca391c8a4f nixos/networking: add assertion catching setting mac addresses on tun devices
Setting a MAC Address on a tun interface isn't supported, and invoking
the corresponding command fails.
2020-04-13 22:03:35 +02:00
Florian Klink cddc7a28b8 nixos/networking: fix setting .macAddress and .mtu with networkd
This needs to be set in the .linkConfig of a .network
2020-04-13 22:03:35 +02:00
Jan Tojnar a04625379a
Merge branch 'master' into staging-next 2020-04-13 18:50:35 +02:00
Robin Gloster e484ca3d9b
alertmanager: implement HA clustering support 2020-04-13 18:39:51 +02:00
Jörg Thalheim 4c3f1d321a
Merge pull request #76723 from jokogr/u/traefik-2.1.1
Traefik: 1.7.14 -> 2.2.0
2020-04-13 17:16:54 +01:00
Maximilian Bosch ec6bac99cc
nixos/build-vms: propagate file location
When trying to build a VM using `nixos-build-vms` with a configuration
that doesn't evaluate, an error "at `<unknown-file>`" is usually shown.

This happens since the `build-vms.nix` creates a VM-network of
NixOS-configurations that are attr-sets or functions and don't contain
any file information. This patch manually adds the `_file`-attribute to
tell the module-system which file contained broken configuration:

```
$ cat vm.nix
{ vm.invalid-option = 1; }

$ nixos-build-vms vm.nix
error: The option `invalid-option' defined in `/home/ma27/Projects/nixpkgs/vm.nix@node-vm' does not exist.
(use '--show-trace' to show detailed location information)
```
2020-04-13 17:50:13 +02:00
Mario Rodas 66e43c6588
Merge pull request #84599 from doronbehar/nodejs-python3
nodejs: use python3 if possible
2020-04-13 07:44:05 -05:00
Maximilian Bosch 1bf1ae3966
Merge pull request #85092 from mayflower/prometheus-local-config-gen
prometheus: use runCommandNoCCLocal for config gen
2020-04-13 11:03:16 +02:00
Ingo Blechschmidt f379e74f1e iodine: improve test in view of #58806 2020-04-13 06:22:27 +02:00
Ioannis Koutras 9360e3723d nixos/traefik: add test 2020-04-12 22:50:36 +02:00
Ioannis Koutras 1f61fbf326 nixos/traefik: make config deep mergeable 2020-04-12 22:50:36 +02:00
Ioannis Koutras bc766b003a nixos/traefik: Adapt to traefik v2
This commit:

1. Updates the path of the traefik package, so that the out output is
   used.
2. Adapts the configuration settings and options to Traefik v2.
3. Formats the NixOS traefik service using nixfmt.
2020-04-12 22:50:36 +02:00
John Ericson 923dc61c9b
Merge pull request #85085 from Ericson2314/document-haskell-env-changes
nixos/doc: Document breaking change to Haskell dev shells
2020-04-12 16:33:53 -04:00
Robin Gloster 0e040d16e8
prometheus: use runCommandNoCCLocal for config gen 2020-04-12 20:13:23 +02:00
John Ericson 8594285c25 nixos/doc: Document breaking change to Haskell dev shells 2020-04-12 11:58:05 -04:00
Graham Christensen 56c8b7eeda
Merge pull request #84946 from bqv/nftables
nixos/nftables: fix typo in ruleset example
2020-04-12 09:38:55 -04:00
Graham Christensen 35d8514a91
Merge pull request #81848 from grahamc/nested-specialisation
specialisation: replace nesting with named configurations
2020-04-12 08:56:11 -04:00
Graham Christensen ec2d28e323
specialisation: replace nesting with named configurations
Co-authored-by: worldofpeace <worldofpeace@protonmail.ch>
2020-04-12 08:12:50 -04:00
Rouven Czerwinski e670094109 rl-2003: remove section on intel GPU workaround
According to my analysis the last critical fix went into v5.4.23, I have
confirmed this by running WebGL over night and haven't seen a single
i915 GPU hang. Lets remove the notes from the release notes.

(cherry picked from commit da764d22ce3b698707861d58824843ded87cbb0a)
2020-04-12 06:05:42 -04:00
Emily 91c6809946 nixos/stage-1: check secret paths before copying
Fixes #84976.
2020-04-11 16:42:47 +01:00
Emily 8a37c3dd1a nixos/initrd-ssh: fix typo in docs 2020-04-11 16:19:48 +01:00
Frederik Rietdijk f8c6921e97
hydra: wrap executables with hydra env vars
We already set the relevant env vars in the systemd services. That does
not help one when executing any of the executables outside a service,
e.g. when creating a new user.
2020-04-11 14:36:42 +02:00
Maximilian Bosch c9504b0b68
Merge pull request #84940 from symphorien/rouncube-spell
roundcube: use pspell for spellchecking
2020-04-11 14:33:43 +02:00
worldofpeace afd2e244c4 rl-2003: qa touchups
Fixes https://github.com/NixOS/nixpkgs/issues/82777

(cherry picked from commit 7c9f30befaa5360a9c3d7d566fdf1922f84ee6c5)
2020-04-11 12:13:47 +02:00
Florian Klink 3bc5c8bb5c nixos/release-notes/rl-2003.xml: add highlights
Fixes #79180.

(cherry picked from commit ec11fd21637535d87cdbac95c8caa095a73674ef)
2020-04-11 12:13:45 +02:00
Maximilian Bosch 9cddcac995
nixos/release-notes: fix minor spelling mistake in the Nextcloud section
As discovered by flokli.
2020-04-11 10:36:08 +02:00
worldofpeace 15d5a2adc1
Merge pull request #84849 from samueldr/fix/nextcloud-upgrade-wording
nextcloud: Review installation upgrade warning wording
2020-04-10 22:55:20 -04:00
Niklas Hambüchen ba50a7a3f1 release notes: Explain how to run nginx master as root. Fixes #84391 2020-04-11 02:57:15 +02:00
Tony Olagbaiye c1c9905aae nixos/nftables: fix typo in ruleset example 2020-04-10 23:48:52 +01:00
Eelco Dolstra aa084e2a24
nix: Fix fallback paths 2020-04-10 21:13:15 +02:00
Michael Reilly 84cf00f980
treewide: Per RFC45, remove all unquoted URLs 2020-04-10 17:54:53 +01:00
edef 6fbacea8e5
Merge pull request #84602 from alyssais/ssh
nixos/ssh: don't accept ssh-dss keys
2020-04-10 16:05:36 +00:00
Eelco Dolstra cea352d276
nix: 2.3.3 -> 2.3.4 2020-04-10 17:23:28 +02:00
Symphorien Gibol 9e417bc9e3 roundcube: use pspell for spellchecking
By default, upstream enables a third party service in the cloud:
https://github.com/roundcube/roundcubemail/blob/1.4.3/config/defaults.inc.php#L790-L798
2020-04-10 12:00:00 +00:00
Jan Tojnar 1ab03c3a76
Merge branch 'master' into staging-next 2020-04-10 12:12:56 +02:00
worldofpeace df8c30fa25 iso-image: make $ARCH shorter
we use stdenv.hostPlatform.uname.processor, which I believe is just like
`uname -p`.

Example values:
```
(import <nixpkgs> { system = "x86_64-linux"; }).stdenv.hostPlatform.uname.processor
"x86_64"

(import <nixpkgs> { system = "aarch64-linux"; }).stdenv.hostPlatform.uname.processor
aarch64

(import <nixpkgs> { system = "armv7l-linux"; }).stdenv.hostPlatform.uname.processor
"armv7l"
```
2020-04-09 20:10:01 -04:00
worldofpeace a775961c8f Revert "Revert "iso-image: normalize volumeID""
This reverts commit 21b50e6f68.
2020-04-09 20:06:32 -04:00
worldofpeace 21b50e6f68
Revert "iso-image: normalize volumeID" 2020-04-09 19:43:59 -04:00
worldofpeace 8583d99e42
Merge pull request #83551 from worldofpeace/iso-id
iso-image: normalize volumeID
2020-04-09 19:31:52 -04:00
Samuel Dionne-Riel a1efbdb600 nextcloud: Review installation upgrade warning wording
The new wording does not assume the user is upgrading.

This is because a user could be setting up a new installation on 20.03
on a server that has a 19.09 or before stateVersion!!

The new wording ensures that confusion is reduced by stating that they
do not have to care about the assumed 16→17 transition.

Then, the wording explains that they should, and how to upgrade to
version 18.

It also reviews the confusing wording about "multiple" upgrades.

* * *

The only thing we cannot really do is stop a fresh install of 17 if
there was no previous install, as it cannot be detected. That makes a
useless upgrade forced for new users with old state versions.

It is also important to state that they must set their package to
Nextcloud 18, as future upgrades to Nextcloud will not allow an uprade
from 17!

I assume future warning messages will exist specifically stating what to
do to go from 18 to 19, then 19 to 20, etc...
2020-04-09 16:52:25 -04:00
Jörg Thalheim d7ff6ab94a
acme: create certificates in subdirectory
This allows to have multiple certificates with the same common name.
Lego uses in its internal directory the common name to name the certificate.

fixes #84409
2020-04-09 08:26:07 +01:00
Maximilian Bosch 2577ec2932
Merge pull request #84570 from Mic92/max-jobs
nixos: default nix.maxJobs to auto
2020-04-09 00:36:14 +02:00
Justin Humm 788f572380 nixos/release-notes: mention that dhcpcd stopped giving IPv4 addresses to bridges by default
This is an backward incompatible change from upstream dhcpcd [0], as
this could have easily locked me out of my box.

As dhcpcd doesn't allow to use only a blacklist (denyinterfaces in
dhcpcd.conf) of devices and use all remaining devices, while explicitly
allowing some interfaces like bridges, I think the best option would be
to not change anything about it and just educate the users here about
that edge case and how to solve it.

[0] https://roy.marples.name/archives/dhcpcd-discuss/0002621.html

(cherry picked from commit eeeb2bf8035b309a636d596de6a3b1d52ca427b1)
2020-04-08 17:46:13 -04:00
Nejc Zupan 479c521af9
Automatically restart netdata on failures
I've had Netdata crash on me sometimes. Rarely but more than once. And I lost days of data before I noticed.

Let's be nice and restart it on failures by default.
2020-04-08 20:58:06 +01:00
Maximilian Bosch e8a4b9fe9b
Merge pull request #84501 from Ma27/bump-hydra
hydra: 2020-03-24 -> 2020-04-07
2020-04-08 20:08:29 +02:00
devhell beae5a9caf manual/rl-2009.xml: Fix literal closing tag
Cc: @flokli
2020-04-08 17:14:06 +01:00
Jan Tojnar 521ddb1397
Merge pull request #83400 from jtojnar/malcontent-0.7
malcontent: 0.6.0 → 0.7.0
2020-04-08 17:38:17 +02:00
Jörg Thalheim 0b5d6d9e39
Merge pull request #84556 from Mic92/runtime-shell
treewide: use runtimeShell in nixos/
2020-04-08 16:34:55 +01:00
worldofpeace 309fed2b2f
nixos/malcontent: enable accounts-daemon, tweak description 2020-04-08 17:08:16 +02:00
Jan Tojnar f3d1333f0d
malcontent-ui: split from malcontent
The 0.7.0 update allows us to split the package.
2020-04-08 17:08:15 +02:00
B YI 07bc7b971d
nixos/initrd-ssh: fix typo (#84719) 2020-04-08 17:04:29 +02:00
Benno Fünfstück 918cb88d1f nixos/release-combined.nix: test hibernate only on x86_64 2020-04-08 14:30:53 +02:00
Benno Fünfstück bb44abe563 nixos/release-combined.nix: fix tested/supportedSystems
This properly supports the `supportedSystems` and
`limitedSupportedSystems` arguments of `release-combined.nix`.
Previously, evaluation would fail if `x86_64-linux` was not part either
of those, since the tested job always referenced the `x86_64-linux`
nixos tests (which won't exist in an aarch64-only eval).

Since the hydra configuration for the jobset`trunk-combined` has both
`aarch64-linux` and `x86_64-linux` as supported systems, this will make
aarch64 be part of the tested job on that jobset.
2020-04-08 14:30:51 +02:00
Florian Klink 68d37fe0c0
Merge pull request #84663 from flokli/notmuch-multiple-output
notmuch: add separate `emacs` output
2020-04-08 13:31:52 +02:00
worldofpeace 94eb65a287 nixos/gnome-remote-desktop: enable pipewire
We need the pipewire service to actually use this.
Tested with g-c-c Sharing.
2020-04-08 10:18:23 +02:00
Florian Klink d0dd8e6cca notmuch: make emacs a separate output
This puts all emacs-related binaries and code to a separate output,
removing emacs from the runtime closure of neomutt.
2020-04-07 22:02:48 +02:00
Michael Bishop 8b7e843dab
nixos: kafka test: fix building for other arches 2020-04-07 12:50:58 -03:00
Alyssa Ross 387b9bf352
nixos/ssh: don't accept ssh-dss keys
These have been deprecated long enough.  I think this default was even
made non-functional by 2337c7522a.  But
it's still a scary thing to see there.

Fixes https://github.com/NixOS/nixpkgs/issues/33381.
2020-04-07 13:35:51 +00:00
Doron Behar 16243290e2 nixos/npm: enable using a specific nodejs package 2020-04-07 15:34:06 +03:00
Maximilian Bosch 0f5c38feed
hydra: 2020-03-24 -> 2020-04-07
Also removed `pkgs.hydra-flakes` since flake-support has been merged
into master[1]. Because of that, `pkgs.hydra-unstable` is now compiled
against `pkgs.nixFlakes` and currently requires a patch since Hydra's
master doesn't compile[2] atm.

[1] https://github.com/NixOS/hydra/pull/730
[2] https://github.com/NixOS/hydra/pull/732
2020-04-07 14:11:12 +02:00
Michael Weiss 230b54c3cb
Merge pull request #83792 from primeos/gollum
gollum: 4.1.4 -> 5.0.1
2020-04-07 12:36:25 +02:00
Jörg Thalheim e6a15db534
nixos: default nix.maxJobs to auto
Instead of making the configuration less portable by hard coding the number of
jobs equal to the cores we can also let nix set the same number at runtime.
2020-04-07 08:45:56 +01:00
Jörg Thalheim cf3328e7e3
treewide: use runtimeShell in nixos/
This is needed for cross-compilation.
2020-04-07 07:26:47 +01:00
worldofpeace 0594a76774 rl-2003: mention python driver
(cherry picked from commit a435d41af5ca29c879ee84b19186c55f2caa35ee)
2020-04-06 20:31:50 -04:00
Silvan Mosberger 85e866db6f
nixos/lib/test-driver: Fix require_unit_state hardcoded formatting 2020-04-06 23:55:04 +02:00
Matthew Bauer 7cc40e15e4 treewide/nixos: use stdenv.cc.libc instead of glibc when available
This prevents duplication in cross-compiled nixos machines. The
bootstrapped glibc differs from the natively compiled one, so we get
two glibc’s in the closure. To reduce closure size, just use
stdenv.cc.libc where available.
2020-04-06 16:36:27 -04:00
Matthew Bauer 8a5059e1cc fontconfig: only generate cache on native compilation
We can’t cross-compile the cache, so just skip it for now.
2020-04-06 16:36:22 -04:00
Matthew Bauer 6c5983a291 gdk-pixbuf: make target env hook
Unfortunately, we need to emulate the system to get a real cache.
Native version doesn’t know the right paths.
2020-04-06 16:36:22 -04:00
Michael Weiss bce93ec4c6
gollum: 4.1.4 -> 5.0.1
Some changes might require manual migration steps:
"Due to changes to the way in which Gollum handles filenames, you may
have to change some links in your wiki when migrating from gollum 4.x.
See the release notes [0] for more details. You may find the
bin/gollum-migrate-tags script helpful to accomplish this. Also see the
--lenient-tag-lookup option for making tag lookup backwards compatible
with 4.x, though note that this will decrease performance on large wikis
with many tags." (source: [1])

[0]: https://github.com/gollum/gollum/wiki/5.0-release-notes
[1]: https://github.com/gollum/gollum/blob/v5.0.0/HISTORY.md
2020-04-06 18:09:35 +02:00
Frederik Rietdijk 2420184727 Merge staging into staging-next 2020-04-06 08:54:28 +02:00
worldofpeace 50fe769887 nixos/pantheon: use new notifications
We have this bug https://github.com/elementary/gala/issues/636
when using notifications in gala. It's likely to not really be fixed
because all development is on the new notifications server.
2020-04-06 02:48:07 -04:00
Sarah Brofeldt b256b2253c
Merge pull request #83749 from srhb/ceph-14.2.8
ceph: 14.2.7 -> 14.2.8
2020-04-06 07:44:02 +02:00
worldofpeace 92e9009172
Merge pull request #84215 from worldofpeace/pantheon-update-04-03
Pantheon update 2020-04-03
2020-04-05 22:23:32 -04:00
José Romildo Malaquias 9908785fa7
Merge pull request #84230 from romildo/upd.gnome-icon-theme
gnome2.gnome_icon_theme: 2.91.93 -> 3.12.0
2020-04-05 22:42:58 -03:00
José Romildo Malaquias 737586bf4f gnome2.gnome-icon-theme: move to pkgs/data/icons 2020-04-05 22:14:23 -03:00
worldofpeace 6949162361 pantheon.xml: drop slow shutdown workaround
Them removing cerbere and registering with the SessionManager
should make shutdown very fast. This was even done in plank [0]
which was the last factor outside cerbere causing this.

[0]]: a8d2f255b2
2020-04-05 20:39:12 -04:00
worldofpeace 4fa0ae2f1f pantheon.elementary-dock: init at 2020-02-28
It seems Pantheon has forked Plank.
2020-04-05 20:39:11 -04:00
worldofpeace 120a2f3033 pantheon.cerbere: remove 2020-04-05 20:39:11 -04:00
Maximilian Bosch 3da7656ad9
Merge pull request #84395 from rycee/spelling
documentation: minor spelling and stylistic fixes
2020-04-06 02:35:43 +02:00
Jan Tojnar 39247f8d04
nixos: try to fix channel eval
It was failing with

	error: aggregate job 'tested' references non-existent job 'nixos.tests.php.x86_64-linux'

cc @etu
2020-04-06 00:25:11 +02:00
Robert Helgesson 40bbbb8f7d
documentation: minor spelling and stylistic fixes 2020-04-05 23:12:15 +02:00
Elis Hirwing 3b6539896b
Merge pull request #83896 from etu/slim-down-default-php-v3
PHP: Make the default package more sane [v3]
2020-04-05 20:00:03 +02:00
Florian Klink a8989b353a Revert "nixos/hardened: build sandbox incompatible with namespaces"
As discussed in https://github.com/NixOS/nixpkgs/pull/73763, prevailing
consensus is to revert that commit. People use the hardened profile on
machines and run nix builds, and there's no good reason to use
unsandboxed builds at all unless you're in a platform that doesn't
support them.

This reverts commit 00ac71ab19.
2020-04-05 17:38:15 +02:00
talyz 5ace72cd6c
nixos/nextcloud: Use php.enabledExtensions 2020-04-05 16:46:44 +02:00
talyz 4ff523f691
php: Simplify php-packages import, rename exts -> extensions 2020-04-05 16:45:41 +02:00
Elis Hirwing a2099156ec
php: split php.packages to php.packages and php.extensions
So now we have only packages for human interaction in php.packages and
only extensions in php.extensions. With this php.packages.exts have
been merged into the same attribute set as all the other extensions to
make it flat and nice.

The nextcloud module have been updated to reflect this change as well
as the documentation.
2020-04-05 16:45:17 +02:00
Elis Hirwing a4bc30c802
docs/rl: Update release log to match the updates to the default attributes 2020-04-05 16:45:11 +02:00
Elis Hirwing 0dc95728ba
nixos/php: Move the pcre tests to the php test attribute 2020-04-05 16:44:59 +02:00
Elis Hirwing 29e1f0d169
nixos/php: Add tests for phpfpm
This test checks that we evaluate PHP properly and that certain
extensions are actually loaded.
2020-04-05 16:44:54 +02:00
Elis Hirwing fc1034a1fa
nixos/nextcloud: upgrade to php74 2020-04-05 16:44:48 +02:00
talyz ed20aae86c
nixos/nextcloud: Get nextcloud working 2020-04-05 16:44:42 +02:00
Jan Tojnar f74f2f3548
nixos/gdm: fix startup
In 7f838b4dde, we dropped systemd-udev-settle.service from display-manager.service's wants.
Unfortunately, we are doing something wrong since without it both Xorg and Wayland fail to start:

	Failed to open gpu '/dev/dri/card0': GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: Operation not permitted

Until we sort this out, let's add systemd-udev-settle.service to GDM to unblock the channels.
2020-04-05 16:40:30 +02:00
Florian Klink 502073b09a nixos/rxe: fix option description
This caused an opening xml tag in our docbook pipeline and failed the
manual build.
2020-04-05 15:30:08 +02:00
Frederik Rietdijk aaf632bdbb Merge staging-next into staging 2020-04-05 13:14:01 +02:00
Frederik Rietdijk e50c67ad7e
Merge pull request #83618 from NixOS/staging-next
Staging next
2020-04-05 13:13:21 +02:00
Frederik Rietdijk 518d5be4f5 ssh validationPackage is a single value, not a list 2020-04-05 13:04:25 +02:00
Frederik Rietdijk ce2321f938 Merge staging-next into staging 2020-04-05 08:34:03 +02:00
Frederik Rietdijk 866c5aa090 Merge master into staging-next 2020-04-05 08:33:39 +02:00
gnidorah a6580c3164 nixos/qt5: support adwaita-dark theme 2020-04-05 08:38:08 +03:00
Tor Hedin Brønner c9d988b0e1 nixos/ibus: fix evaluation
Need to reference through `config` when checking what other modules have set.
2020-04-05 02:23:38 +02:00
Maximilian Bosch a9e3ec1d6e
nixos/systemd-nspawn: disallow multiple packages with .nspawn-units
In contrast to `.service`-units, it's not possible to declare an
`overrides.conf`, however this is done by `generateUnits` for `.nspawn`
units as well. This change breaks the build if you have two derivations
configuring one nspawn unit.

This will happen in a case like this:

``` nix
{ pkgs, ... }: {
  systemd.packages = [
    (pkgs.writeTextDir "etc/systemd/nspawn/container0.nspawn" ''
      [Files]
      Bind=/tmp
    '')
  ];
  systemd.nspawn.container0 = {
    /* ... */
  };
}
```
2020-04-04 21:11:21 +02:00
Pavan Rikhi 84b8775a67
lightdm-mini-greeter: 0.3.4 -> 0.4.0 2020-04-04 09:40:49 -04:00
Martin Milata 2acddcb28f nixos/matrix-synapse: remove web_client option
Removed in matrix-synapse-0.34.
2020-04-04 14:05:08 +02:00
José Romildo Malaquias 4d9a57bd76 treewide: rename gnome2.gnome_icon_theme package to use dashes 2020-04-03 23:24:53 -03:00
Frederik Rietdijk edaa972160 Merge staging-next into staging 2020-04-03 21:55:10 +02:00
Frederik Rietdijk 92124ed660 Merge master into staging-next 2020-04-03 21:54:40 +02:00
Joachim F 18b89e7abd
Merge pull request #73763 from kmcopper/hardening-profile
Improvements to the NixOS Hardened Profile
2020-04-03 18:48:12 +00:00
Evils b7b99c93f5 nixosTests.tuptime: init test 2020-04-03 17:30:35 +02:00
Evils b29d48acfb nixos/tuptime: init module 2020-04-03 17:29:56 +02:00
Silvan Mosberger eb0148e90b
Merge pull request #84074 from Infinisil/fix-literal-option-examples
nixos/treewide: Fix incorrectly rendered examples
2020-04-03 15:41:53 +02:00
Bastian Köcher 644d643d68 nixos/wg-quick: Fix after wireguard got upstreamed 2020-04-03 12:39:35 +02:00
Florian Klink fe6dd71f72 nixosTests.cockroachdb: set ConditionPathExists=/dev/ptp0 to chronyd 2020-04-03 00:34:18 +02:00
Florian Klink f25a301a0a nixos/chrony: move to StateDirectory and tmpfiles.d 2020-04-03 00:34:18 +02:00
Florian Klink 98906dfdef nixosTests.cockroachdb: bump memory
cockroachdb complained about not enough memory available.
2020-04-03 00:34:18 +02:00
Florian Klink 4009ef44e9 cockroachdb: remove stray trailing whitespace 2020-04-03 00:34:18 +02:00
Florian Klink e7e05ad957 nixosTests.cockroachdb: port to python 2020-04-03 00:34:18 +02:00
Florian Klink 8e9e77ee7d nixosTests.cockroachdb: add to all-tests.nix 2020-04-03 00:34:18 +02:00
Silvan Mosberger c06bcddaad
Merge pull request #83258 from mmilata/sympa-6.2.54
nixos/sympa: fix outgoing emails, update package version
2020-04-03 00:24:57 +02:00
Florian Klink 44c20fb83e
Merge pull request #84087 from Izorkin/mariadb-tokudb
mariadb: update build configuration.
2020-04-02 23:44:03 +02:00
Sarah Brofeldt 6ccd347e46 nixos/tests/ceph: Fix pg number to power of 2 2020-04-02 21:11:45 +02:00
Eelco Dolstra 74e7ef35fe nix-daemon.nix: Add option nix.registry
This allows you to specify the system-wide flake registry. One use is
to pin 'nixpkgs' to the Nixpkgs version used to build the system:

  nix.registry.nixpkgs.flake = nixpkgs;

where 'nixpkgs' is a flake input. This ensures that commands like

  $ nix run nixpkgs#hello

pull in a minimum of additional store paths.

You can also use this to redirect flakes, e.g.

  nix.registry.nixpkgs.to = {
    type = "github";
    owner = "my-org";
    repo = "my-nixpkgs";
  };
2020-04-02 19:38:00 +02:00
Izorkin 0296e678cf mariadb: add option to build server without tokudb storage 2020-04-02 18:05:04 +03:00
Silvan Mosberger 49859351ea
Merge pull request #84103 from mmilata/moinmoin-b42
nixos/moinmoin: fix maintainer reference
2020-04-02 17:02:59 +02:00
Jörg Thalheim 5fb2a9d8c7
Merge pull request #79828 from Mic92/zed
nixos/zfs: populate PATH with needed programs for zed
2020-04-02 13:42:01 +01:00
Jörg Thalheim 212b574d89
Merge pull request #81298 from Mic92/buildkite
nixos/buildkite-agents: don't run as nogroup
2020-04-02 13:39:34 +01:00
Bruno Bigras 544821654d
nixos/pixiecore: init (#83406)
Co-authored-by: raunovv <rauno@oyenetwork.com>
Co-authored-by: Jörg Thalheim <joerg@thalheim.io>
2020-04-02 13:06:21 +01:00
Martin Milata f35d65850e nixos/moinmoin: fix maintainer reference 2020-04-02 13:49:28 +02:00
Jörg Thalheim 35359bb3e3
nixos/borgbackup: fix evaluation 2020-04-02 12:40:02 +01:00
Jörg Thalheim 61e6520d8c
Merge pull request #83529 from ngiger/83525
borgbackup: Improve documentation
2020-04-02 12:27:38 +01:00
worldofpeace 60a1732276
Revert "nixos/none: remove" 2020-04-02 04:07:18 -04:00
Silvan Mosberger 1d0fc9729d
nixos/treewide: Fix incorrectly rendered examples
Many options define their example to be a Nix value without using
literalExample. This sometimes gets rendered incorrectly in the manual,
causing confusion like in https://github.com/NixOS/nixpkgs/issues/25516

This fixes it by using literalExample for such options. The list of
option to fix was determined with this expression:

  let
    nixos = import ./nixos { configuration = {}; };
    lib = import ./lib;
    valid = d: {
      # escapeNixIdentifier from https://github.com/NixOS/nixpkgs/pull/82461
      set = lib.all (n: lib.strings.escapeNixIdentifier n == n) (lib.attrNames d) && lib.all (v: valid v) (lib.attrValues d);
      list = lib.all (v: valid v) d;
    }.${builtins.typeOf d} or true;

    optionList = lib.optionAttrSetToDocList nixos.options;

  in map (opt: {
    file = lib.elemAt opt.declarations 0;
    loc = lib.options.showOption opt.loc;
  }) (lib.filter (opt: if opt ? example then ! valid opt.example else false) optionList)

which when evaluated will output all options that use a Nix identifier
that would need escaping as an attribute name.
2020-04-02 07:49:25 +02:00
worldofpeace ed073806a4
Merge pull request #84037 from worldofpeace/remove-none.nix
nixos/none: remove
2020-04-01 22:00:47 -04:00
worldofpeace af6d2c822c nixos/none: remove
This windowManager and desktopManager doesn't even have
an option to use it. git history suggests to me that there's no way anyone
finds this useful anymore.
2020-04-01 21:25:05 -04:00
worldofpeace b0ac19e050 nixos: add freedesktop/gnome/myself maintainers 2020-04-01 20:53:09 -04:00
Jan Tojnar 513cec9b81
Revert "make-options-doc: fix string context issues"
This reverts commit 3c15d578d4.

See https://github.com/NixOS/nixpkgs/issues/83863
2020-04-02 01:13:33 +02:00
Jan Tojnar cab6b019b1
Revert "make-options-doc: fix string context issues"
This reverts commit 3c15d578d4.

See https://github.com/NixOS/nixpkgs/issues/83863
2020-04-02 00:53:54 +02:00
Niklaus Giger c027937d9a borgbackup: Moved documentation to NixOS manual and added examples for
* creating a local backup
* creating a borgbackup server
* backing up to a borgbackup server
* hints about the Vorta graphical desktop application
* Added documentation about Vorta desktop client

Tested the examples locally and with my borgbase.com account.
2020-04-01 22:21:10 +02:00
Dave Anderson 19a831d853 nixos/iio: adjust formatting of option description.
Co-Authored-By: Alyssa Ross <hi@alyssa.is>
2020-04-01 18:37:52 +00:00
David Anderson d2bb8d232b nixos/iio: explain why you might want IIO sensor support.
Signed-off-by: David Anderson <dave@natulte.net>
2020-04-01 18:37:52 +00:00
Mario Rodas c47ec3067d
Merge pull request #70762 from xfix/nixos-mullvad-vpn
nixos/mullvad-vpn: add service
2020-04-01 08:26:07 -05:00
Jan Tojnar 15002f1cfd
tree-wide: Switch from gnome3.maintainers to lib.teams.gnome 2020-04-01 14:41:43 +02:00
Marek Mahut 5422f18a12
Merge pull request #83876 from mmahut/magic-wormhole-mailbox-server
nixos/magic-wormhole-mailbox-server: moving from mail to networking
2020-04-01 12:44:26 +02:00
Jonathan Ringer 3459038852 Revert "nixos/geoclue2: set location.provider to geoclue2"
This reverts commit f8a78afd5c.
2020-04-01 01:18:50 -07:00
Jaka Hudoklin 54b04af86e modules/virtualisation: add hyperv-image
This module implements builder for hyper-v images.
2020-04-01 13:26:51 +07:00
worldofpeace 252ca376fa
Merge pull request #83717 from worldofpeace/drop-pulseaudio-cruft-display-manager
nixos/display-managers: don't start pulseaudio
2020-04-01 02:23:21 -04:00
worldofpeace 8c093bd477
Merge pull request #83625 from worldofpeace/ibus-portal
nixos/ibus: add ibus portal if portals are enabled
2020-04-01 02:21:03 -04:00
worldofpeace 8838045333 nixos/contractor: delete file
It looks like I forgot to actually delete this file.
2020-04-01 02:13:29 -04:00
worldofpeace f8a78afd5c nixos/geoclue2: set location.provider to geoclue2 2020-04-01 01:31:05 -04:00
Léo Gaspard bb5c622963
Merge pull request #82739 from danbst/document-postgresql-upgrade
Document postgresql upgrade
2020-03-31 23:50:06 +02:00
Léo Gaspard a3ee24b2ff
Merge pull request #83894 from symphorien/unbreak-os-prober-test
Unbreak os prober test
2020-03-31 22:17:27 +02:00
Maximilian Bosch 12c634ca2a
Merge pull request #83617 from Ma27/mongodb-changelog
nixos/release-notes: mention that mongodb is unfree now
2020-03-31 22:03:03 +02:00
Jan Tojnar 3e0f4e202f
Merge branch 'master' into staging-next 2020-03-31 21:32:15 +02:00
Jan Tojnar 0cb43d3151
Merge pull request #83732 from jansol/xow
xow: init at 0.4
2020-03-31 20:41:17 +02:00
Florian Klink a3d67bfd42
Merge pull request #83765 from Izorkin/mariadb-test
nixos/mysql: add test mariadb with tokudb plugin
2020-03-31 20:23:45 +02:00
Florian Klink 9faea55282
Merge pull request #74379 from bachp/gitlab-runner-reload
nixos/gitlab-runner: reload on config change
2020-03-31 20:18:28 +02:00
Maximilian Bosch 9157ff4e74
Merge pull request #83704 from Ma27/acme-container
nixos/acme: don't depend on multi-user.target inside a container
2020-03-31 19:13:51 +02:00
Marek Mahut dd3da96318 nixos/magic-wormhole-mailbox-server: moving from mail to networking 2020-03-31 16:29:39 +02:00
Jan Solanti 081ed8f012 xow: 0.2 -> 0.4 2020-03-31 17:24:37 +03:00
Marek Mahut 63f3adfc3b
Merge pull request #83768 from mmahut/magic-wormhole-mailbox-server
nixos/magic-wormhole-mailbox-server: init
2020-03-31 15:01:38 +02:00
Izorkin 6af90a3df8 nixos/mysql: add test mariadb with rocksdb plugin 2020-03-31 14:46:04 +03:00
Dmitry Kalinkin 61a79754bd
Merge pull request #77478 from artemist/nixos-factorio
nixos/factorio: add extraSettings and package options
2020-03-30 15:36:16 -04:00
Marek Mahut af75bb17b9 nixos/tests: add magic-wormhole-mailbox-server 2020-03-30 16:15:15 +02:00
Robin Gloster d6fa642608
Merge pull request #81161 from wedens/libvirt-6.0.0
libvirt: 5.4.0 -> 6.1.0
2020-03-30 13:19:00 +00:00
Marek Mahut 05195040c0 nixos/magic-wormhole-mailbox-server: init 2020-03-30 13:29:30 +02:00
Izorkin ba55f84b5d nixos/mysql: add test mariadb with tokudb plugin 2020-03-30 13:42:51 +03:00
Robin Gloster b80edca6be
libvirt: fix escapeShellArg usage
Co-Authored-By: conferno <conferno@camfex.cz>
2020-03-30 09:45:28 +00:00
Philipp Middendorf 35035a543c xow: init at 0.2 2020-03-30 00:16:21 +03:00
Cole Mickens 1992768157 nixos/azure: clarify how users work in basic example 2020-03-29 13:56:55 -07:00
Cole Mickens 627ae7e057 nixos/azure: upload-image.sh cleanup $1 handling 2020-03-29 13:56:55 -07:00
Cole Mickens a5de97f21e nixos/azure: upload-image names the image better 2020-03-29 13:56:55 -07:00
Cole Mickens c2b2cc6dbd nixos/azure: simplify example image 2020-03-29 13:56:55 -07:00
Cole Mickens 20f981de08 azure: init nixos/maintainers/scripts/azure-new 2020-03-29 13:56:55 -07:00
Cole Mickens a5a6d77508 azure: boot.growPartition = true 2020-03-29 13:56:55 -07:00
Cole Mickens f37aa7dd69 nixos/azure: add diskSize module option 2020-03-29 13:56:55 -07:00
Maximilian Bosch d25b558038
Merge pull request #83653 from nlewo/nextcloud-firstrunwizard
nixos/nextcloud: add bcmap, mp4 and webm in nginx configuration
2020-03-29 22:07:02 +02:00
Maximilian Bosch f178f960b4
Merge pull request #83633 from zarelit/fix_literalExample
network-interfaces: fix literalExample arguments
2020-03-29 22:04:01 +02:00
Florian Klink f4f8921f97
nixos/gerrit: stop setting jvmPackage (#83696)
jdk12_headless disappeared in d00559ebb8,
and just using the default in the VM test should be fine IMHO.
2020-03-29 18:50:19 +00:00
Maximilian Bosch 1a5289f803
nixos/acme: don't depend on multi-user.target inside a container
On boot, a container doesn't have an uplink and would run into a timeout
while waiting for cert renewal[1].

[1] https://github.com/NixOS/nixpkgs/pull/81371#issuecomment-605526099
2020-03-29 19:59:52 +02:00
worldofpeace 3ad74e3997 nixos/display-managers: don't start pulseaudio
Hey, we have sockets.
2020-03-29 13:59:41 -04:00
Florian Klink 01365622ad
Merge pull request #83660 from Emantor/fix/system-duplicate-line
nixos/systemd: remove one DefaultBlockIOAccounting
2020-03-29 19:42:28 +02:00
worldofpeace bedf13071b
Merge pull request #83637 from romildo/desktopManager.desktopNames
nixos.display-manager: set DesktopNames from a new attribute
2020-03-29 12:58:08 -04:00
Florian Klink 50b48ddd95
Merge pull request #83598 from mmilata/test-driver-delete-vdectl
test-driver.py: don't leave vde1.ctl around
2020-03-29 18:19:53 +02:00
Symphorien Gibol 6a2f64a542 nixos/tests/os-prober.nix: fix out of memory 2020-03-29 15:30:33 +02:00
Elis Hirwing cdad5f9134
php: Add release log entry for the php changes 2020-03-29 11:07:50 +02:00
Rouven Czerwinski d22373b2b1 nixos/systemd: remove one DefaultBlockIOAccounting
DefaultBlockIOAccounting=yes is set twice in the same file, remove one
copy.
2020-03-29 10:56:34 +02:00
Antoine Eiche 24ee2e8dc0 nixos/nextcloud: add bcmap, mp4 and webm in nginx configuration
This is used by the `firstrunwizard` and has been added in the nginx
configuration documentation of the latest
manual (cda627b7c8/admin_manual/installation/nginx.rst).
2020-03-29 09:34:52 +02:00
Aaron Andersen 24d456a48d
Merge pull request #82784 from davidak/fpm
nixos/phpfpm: add example to socket
2020-03-28 22:22:24 -04:00
Maximilian Bosch 2c133fbb4b
nixos/tests/mongodb: also test mongodb-3_4 2020-03-29 01:09:53 +01:00
David Costa 2e4a45c921 nixos/network-interfaces: fix examples types
make literalExample receive string arguments.
Fix nixos/nixos-homepage#255
2020-03-29 01:00:59 +01:00
Jan Tojnar fa4e1bbe07
Merge branch 'master' into staging-next
Fix eval of nixos/nginx
2020-03-29 00:35:29 +01:00
Jan Tojnar 3c4ab13243
nixos/nginx: fix eval
Fixes a typo introduced in https://github.com/NixOS/nixpkgs/pull/83611
2020-03-29 00:20:07 +01:00
Graham Christensen 4d226bad77
Merge pull request #83600 from Ma27/hydra-two-stage-deploy
hydra: 2020-02-06 -> 2020-03-{24,27}
2020-03-28 19:18:10 -04:00
Martin Milata d4cbe042ef test-driver.py: use temporary dir for vde1.ctl
Send SIGTERM instead of SIGKILL to vde_switch to give it chance to
delete the directories.
2020-03-29 00:03:59 +01:00
Maximilian Bosch bd5324c4fc
hydra: 2020-02-06 -> 2020-03-{24,27}
Upgrades Hydra to the latest master/flake branch. To perform this
upgrade, it's needed to do a non-trivial db-migration which provides a
massive performance-improvement[1].

The basic ideas behind multi-step upgrades of services between NixOS versions
have been gathered already[2]. For further context it's recommended to
read this first.

Basically, the following steps are needed:

* Upgrade to a non-breaking version of Hydra with the db-changes
  (columns are still nullable here). If `system.stateVersion` is set to
  something older than 20.03, the package will be selected
  automatically, otherwise `pkgs.hydra-migration` needs to be used.

* Run `hydra-backfill-ids` on the server.

* Deploy either `pkgs.hydra-unstable` (for Hydra master) or
  `pkgs.hydra-flakes` (for flakes-support) to activate the optimization.

The steps are also documented in the release-notes and in the module
using `warnings`.

`pkgs.hydra` has been removed as latest Hydra doesn't compile with
`pkgs.nixStable` and to ensure a graceful migration using the newly
introduced packages.

To verify the approach, a simple vm-test has been added which verifies
the migration steps.

[1] https://github.com/NixOS/hydra/pull/711
[2] https://github.com/NixOS/nixpkgs/pull/82353#issuecomment-598269471
2020-03-28 23:33:25 +01:00
worldofpeace b1bffdf67f
Merge pull request #83425 from xfix/mark-hibernation-test-as-broken-on-aarch
nixos/tests/hibernate: disable for platforms other than x86_64
2020-03-28 18:22:08 -04:00
worldofpeace d5cfaf5c39
Merge pull request #83473 from doronbehar/update-connman
connman: 1.37 -> 1.38
2020-03-28 18:18:14 -04:00
worldofpeace 76f7fc1476 nixos/ibus: add ibus portal if portals are enabled 2020-03-28 18:09:26 -04:00
Frederik Rietdijk a36be028f5 Merge staging-next into staging 2020-03-28 21:15:15 +01:00
Maximilian Bosch 27121521b8
nixos/release-notes: mention that mongodb is unfree now 2020-03-28 21:03:15 +01:00
Vincent Bernat 7c451c3b6b
nginx: increase types_hash_max_size to 4096 (#83609)
After upgrading to NixOS 20.03, I've got the following warning:

    nginx: [warn] could not build optimal types_hash, you should increase either types_hash_max_size: 2048 or types_hash_bucket_size: 64; ignoring types_hash_bucket_size

The documentation states that "if nginx emits the message requesting
to increase either hash max size or hash bucket size then the first
parameter should first be increased" (aka types_hash_max_size).

In 19.03, the size of mime.types was around 100 entries. In 20.03, we
are around 900 entries. This is due to ff0148d868 which makes nginx
use mailcap mime.types.
2020-03-28 20:40:44 +01:00
Vincent Bernat 8f8cbec985
nixos/nginx: use mailcap mimetypes in all cases (#83611)
In ff0148d868, nginx configuration was modified to use mime.types
from mailcap package as it is more complete. However, there are two
places where mime.types is included in configuration. When the user
was setting `cfg.httpConfig`, the mime.types from nginx was still
used. This commit fix that by moving the common snippet in a variable
of its own and ensure it is used at both places.
2020-03-28 20:29:09 +01:00
Maximilian Bosch 63e81053b0
Merge pull request #74504 from xwvvvvwx/wg-quick-tests
tests/wireguard: init wg-quick
2020-03-28 16:26:43 +01:00
José Romildo Malaquias e9d707cf8e nixos.xfce: set desktopNames 2020-03-28 11:14:59 -03:00
José Romildo Malaquias fb47c6fbac nixos.display-managers: use new attribute for desktop names 2020-03-28 11:13:13 -03:00
Peter Hoeg 1859f129d2
Merge pull request #25311 from peterhoeg/f/udev-settle
display-manager: systemd-udev-settle serves no purpose, boot 10% faster
2020-03-28 21:24:32 +08:00
Doron Behar bffec3d884 nixos/connman: add TODOs regarding connman + network-manager 2020-03-28 12:28:29 +03:00
Doron Behar 480397693e nixos/connman: add option to use specific package 2020-03-28 12:06:54 +03:00
Konrad Borowski d85fb28414 nixos/tests/hibernate: disable for platforms other than x86_64
Due to 9pnet_virtio bugs, /nix is no longer available after
hibernation. It happens to work on x86_64, but not on other
platforms.
2020-03-28 09:31:36 +01:00
lewo afb035a32b
Merge pull request #82808 from nlewo/fix-alertmanager
nixos/alertmanager: start after the network-online target
2020-03-28 09:29:01 +01:00
Yegor Timoshenko 5626cb9486
Merge pull request #82603 from emilazy/nixos-initrd-openssh
nixos/initrd-ssh: switch from Dropbear to OpenSSH
2020-03-28 09:22:02 +01:00
Marek Mahut 42d03aabbd
Merge pull request #83309 from mmahut/quorum
nixos/quorum: init
2020-03-28 09:04:12 +01:00
aszlig e1d63ada02
nginx: Fix ETag patch to ignore realpath(3) error
While our ETag patch works pretty fine if it comes to serving data off
store paths, it unfortunately broke something that might be a bit more
common, namely when using regexes to extract path components of
location directives for example.

Recently, @devhell has reported a bug with a nginx location directive
like this:

  location ~^/\~([a-z0-9_]+)(/.*)?$" {
    alias /home/$1/public_html$2;
  }

While this might look harmless at first glance, it does however cause
issues with our ETag patch. The alias directive gets broken up by nginx
like this:

  *2 http script copy: "/home/"
  *2 http script capture: "foo"
  *2 http script copy: "/public_html/"
  *2 http script capture: "bar.txt"

In our patch however, we use realpath(3) to get the canonicalised path
from ngx_http_core_loc_conf_s.root, which returns the *configured* value
from the root or alias directive. So in the example above, realpath(3)
boils down to the following syscalls:

  lstat("/home", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
  lstat("/home/$1", 0x7ffd08da6f60) = -1 ENOENT (No such file or directory)

During my review[1] of the initial patch, I didn't actually notice that
what we're doing here is returning NGX_ERROR if the realpath(3) call
fails, which in turn causes an HTTP 500 error.

Since our patch actually made the canonicalisation (and thus additional
syscalls) necessary, we really shouldn't introduce an additional error
so let's - at least for now - silently skip return value if realpath(3)
has failed.

However since we're using the unaltered root from the config we have
another issue, consider this root:

  /nix/store/...-abcde/$1

Calling realpath(3) on this path will fail (except if there's a file
called "$1" of course), so even this fix is not enough because it
results in the ETag not being set to the store path hash.

While this is very ugly and we should fix this very soon, it's not as
serious as getting HTTP 500 errors for serving static files.

I added a small NixOS VM test, which uses the example above as a
regression test.

It seems that my memory is failing these days, since apparently I *knew*
about this issue since digging for existing issues in nixpkgs, I found
this similar pull request which I even reviewed:

https://github.com/NixOS/nixpkgs/pull/66532

However, since the comments weren't addressed and the author hasn't
responded to the pull request, I decided to keep this very commit and do
a follow-up pull request.

[1]: https://github.com/NixOS/nixpkgs/pull/48337

Signed-off-by: aszlig <aszlig@nix.build>
Reported-by: @devhell
Acked-by: @7c6f434c
Acked-by: @yorickvP
Merges: https://github.com/NixOS/nixpkgs/pull/80671
Fixes: https://github.com/NixOS/nixpkgs/pull/66532
2020-03-28 02:57:21 +01:00
worldofpeace 591e8d5708 iso-image: make sure volumeID is less than 32 chars 2020-03-27 21:35:12 -04:00
worldofpeace 70a8e9ace9 iso-image: normalize volumeID
The volumeID will now be in the format of:
nixos-$EDITON-$RELEASE-$ARCH

an example for the minimal image would look like:
nixos-minimal-20.09-x86-64-linux
2020-03-27 21:30:54 -04:00
worldofpeace f59aa66fc1 make-iso9660-image.sh: enable joliet extension
This is per the advice of the osinfo-db maintainers https://gitlab.com/libosinfo/osinfo-db/-/merge_requests/107#note_313094852
2020-03-27 19:48:54 -04:00
Marek Mahut 870a6e262d nixos/quorum: init 2020-03-27 19:31:01 +01:00
Rouven Czerwinski 1685cd7fa7 nixos/test: update test-driver.py for mypy 0.770 2020-03-27 01:57:48 -07:00
Samuel Dionne-Riel eb35d21d77 nixos/rigel: Fix evaluation 2020-03-26 19:29:08 -04:00
Martin Milata 9bbd1037ec nixos/mediawiki: allow using default extensions 2020-03-26 18:26:07 +01:00
Maximilian Bosch 90dcc33603
Merge pull request #40082 from jarjee/update/mongodb
mongodb: 3.4.10 -> 4.0.12
2020-03-26 18:15:09 +01:00
worldofpeace b3ef282fd5 nixos/rygel: link rygel.conf
Fixes https://github.com/NixOS/nixpkgs/issues/83108.
In the future we should make this configurable.
2020-03-26 10:52:10 -04:00
Maximilian Bosch b65ff5d455
nixos/release-notes: mention mongodb update 2020-03-26 14:04:42 +01:00
Maximilian Bosch 2934f04641
nixos/tests/mongodb: rewrite with python
perl-based VM tests are deprecated.
2020-03-26 14:02:49 +01:00
Nathan Smyth 44641ed00b
nixos/tests/mongodb: test against mongodb versions 3.4, 3.6, 4.0
Now has tests for 3.4, 3.6, 4.0. Has some duplication, but it appears to
work on my machine.
2020-03-26 14:02:49 +01:00
zimbatm d8f0c5407e
Merge pull request #82929 from zimbatm/nixos-gerrit
nixos gerrit module
2020-03-26 12:47:15 +01:00
Maximilian Bosch 89bcf4b7e2
Merge pull request #82353 from Ma27/nextcloud-upgrade-path
nixos/nextcloud: fix upgrade path from 19.09 to 20.03
2020-03-26 11:00:23 +01:00
zimbatm d37a0dca13
nixos: add gerrit module
Co-authored-by: edef <edef@edef.eu>
Co-authored-by: Florian Klink <flokli@flokli.de>
2020-03-26 09:28:42 +01:00
Michael Weiss 216a7e7a98
nixosTests.installer: Don't wait for the nixos-manual service
The nixos-manual service was removed in #83199 but we missed the check
in this test which prevents the "tested" job from succeeding [0][1].

[0]: https://hydra.nixos.org/build/115472896
[1]: https://hydra.nixos.org/build/115472896/nixlog/94/tail
2020-03-26 01:21:34 +01:00
Maximilian Bosch 702f645aa8
nixos/nextcloud: implement a safe upgrade-path between 19.09 and 20.03
It's impossible to move two major-versions forward when upgrading
Nextcloud. This is an issue when comming from 19.09 (using Nextcloud 16)
and trying to upgrade to 20.03 (using Nextcloud 18 by default).

This patch implements the measurements discussed in #82056 and #82353 to
improve the update process and to circumvent similar issues in the
future:

* `pkgs.nextcloud` has been removed in favor of versioned attributes
  (currently `pkgs.nextcloud17` and `pkgs.nextcloud18`). With that
  approach we can safely backport major-releases in the future to
  simplify those upgrade-paths and we can select one of the
  major-releases as default depending on the configuration (helpful to
  decide whether e.g. `pkgs.nextcloud17` or `pkgs.nextcloud18` should be
  used on 20.03 and `master` atm).

* If `system.stateVersion` is older than `20.03`, `nextcloud17` will be
  used (which is one major-release behind v16 from 19.09). When using a
  package older than the latest major-release available (currently v18),
  the evaluation will cause a warning which describes the issue and
  suggests next steps.

  To make those package-selections easier, a new option to define the
  package to be used for the service (namely
  `services.nextcloud.package`) was introduced.

* If `pkgs.nextcloud` exists (e.g. due to an overlay which was used to
  provide more recent Nextcloud versions on older NixOS-releases), an
  evaluation error will be thrown by default: this is to make sure that
  `services.nextcloud.package` doesn't use an older version by accident
  after checking the state-version. If `pkgs.nextcloud` is added
  manually, it needs to be declared explicitly in
  `services.nextcloud.package`.

* The `nixos/nextcloud`-documentation contains a
  "Maintainer information"-chapter  which describes how to roll out new
  Nextcloud releases and how to deal with old (and probably unsafe)
  versions.

Closes #82056
2020-03-25 22:07:29 +01:00
Pascal Bach 2e5835c6b5 nixos/boinc: create boinc group
This allows users that are members of the boinc group
to interact with the boinc service by running:

boincmgr -d /var/lib/boinc
2020-03-25 13:26:31 +01:00
Pascal Bach bb549ca2d4 nixos/boinc: log to journal instead of log file 2020-03-25 13:25:34 +01:00
Emily d930466b77 nixos/initrd-ssh: switch from Dropbear to OpenSSH
Dropbear lags behind OpenSSH significantly in both support for modern
key formats like `ssh-ed25519`, let alone the recently-introduced
U2F/FIDO2-based `sk-ssh-ed25519@openssh.com` (as I found when I switched
my `authorizedKeys` over to it and promptly locked myself out of my
server's initrd SSH, breaking reboots), as well as security features
like multiprocess isolation. Using the same SSH daemon for stage-1 and
the main system ensures key formats will always remain compatible, as
well as more conveniently allowing the sharing of configuration and
host keys.

The main reason to use Dropbear over OpenSSH would be initrd space
concerns, but NixOS initrds are already large (17 MiB currently on my
server), and the size difference between the two isn't huge (the test's
initrd goes from 9.7 MiB to 12 MiB with this change). If the size is
still a problem, then it would be easy to shrink sshd down to a few
hundred kilobytes by using an initrd-specific build that uses musl and
disables things like Kerberos support.

This passes the test and works on my server, but more rigorous testing
and review from people who use initrd SSH would be appreciated!
2020-03-25 08:26:50 +00:00
Eelco Dolstra e51c7f60cb
nixos/release-small.nix: Export options job 2020-03-24 21:17:53 +01:00
Eelco Dolstra 4052f9b849
Compress optionsJSON using brotli 2020-03-24 16:42:04 +01:00
Eelco Dolstra 98481cfdfa
Merge pull request #83199 from edolstra/remove-manual-service
Remove manual service
2020-03-24 15:26:54 +01:00
Eelco Dolstra bd379be538
Remove unused 'rogue' service 2020-03-24 15:25:20 +01:00
Eelco Dolstra aebf9a4709
services/misc/nixos-manual.nix: Remove
Running the manual on a TTY is useless in the graphical ISOs and not
particularly useful in non-graphical ISOs (since you can also run
'nixos-help').

Fixes #83157.
2020-03-24 15:25:20 +01:00
Tor Hedin Brønner 038a8890a7
rl-2009: note gnome desktop upgrade 2020-03-24 07:11:17 +01:00
Jan Tojnar 30ef9b92fa
gnome3.vino: remove
It has been removed from g-s-d, only a tiny bit remain in g-c-c.
2020-03-24 07:11:14 +01:00
Tor Hedin Brønner 859c46c933
gnome3.gnome-flashback: 3.34.2 -> 3.36.0
* Removed the use of gnome-screensaver (https://gitlab.gnome.org/GNOME/gnome-flashback/issues/18)
* Flashback's menu-related environment variables are now set in the gnome3.nix module instead of gnome-panel to resolve dependency conflict.
2020-03-24 07:10:58 +01:00
Tor Hedin Brønner 7ec546bc25
nixos/gnome-keyring: add portals 2020-03-24 07:10:48 +01:00
Martin Milata fdc36e2c89 nixos/sympa: fix outgoing messaging
Because ProtectKernelModules implies NoNewPrivileges, postfix's sendmail
executable, which is setgid, wasn't able to send mail.
2020-03-24 02:35:39 +01:00
Martin Milata 8f632b404f sympa: build with --enable-fhs
Update module accordingly.
2020-03-24 02:32:22 +01:00
Rail Aliiev ba7e3c6cba
Add new znapzend features to modules 2020-03-23 21:29:49 -04:00
Jan Tojnar 986fbf4799
Merge branch 'staging-next' into staging 2020-03-24 01:51:55 +01:00
worldofpeace a82c39f178
Merge pull request #80066 from worldofpeace/mate-upstream
nixos/mate: use upstream session
2020-03-23 13:37:10 -04:00
Orivej Desh (NixOS) aa049c802b
Merge pull request #83042 from aanderse/mysql-fixup
nixos/mysql: fix service so it works with mysql80 package
2020-03-23 16:37:58 +00:00
Izorkin d508a2f366 nixos/netdata: fix permissions for perf.plugin 2020-03-23 12:24:49 +03:00
Izorkin a3c769fef6 nixos/netdata: fix permissions for slabinfo.plugin 2020-03-23 12:24:49 +03:00
Lancelot SIX 37ffa6ea51 nixos/griphite: Migrate to python3, drop graphite-pager 2020-03-22 22:47:53 -07:00
Orivej Desh 1b89aa3f7a Merge branch 'master' into staging 2020-03-23 00:53:16 +00:00
Aaron Andersen b69b7a12af
Merge pull request #78938 from aanderse/duo-activation-scripts
nixos/duosec: replace insecure skey option with secure secretKeyFile option
2020-03-22 20:46:42 -04:00
Aaron Andersen 6f0c1cdbd9 nixos/duosec: rename ikey option to integrationKey 2020-03-22 20:25:11 -04:00
Aaron Andersen b9dca769f1 nixos/duosec: replace insecure skey option with secure secretKeyFile option 2020-03-22 20:23:55 -04:00
Maximilian Bosch e65c411356
Merge pull request #83153 from ciil/fail2ban-warning
fail2ban: fix firewall warning
2020-03-23 00:42:36 +01:00
markuskowa 667df74501
Merge pull request #83131 from ck3d/fix-kodi-lirc
kodi: fix lirc support
2020-03-22 21:29:45 +01:00
Simon Lackerbauer 017dca51fa
fail2ban: fix firewall warning 2020-03-22 18:11:36 +01:00
markuskowa a9d7a1ee5b
Merge pull request #81277 from markuskowa/upd-rdma-core
nixos/rdma-core: 27.0 -> 28.0, update RXE module
2020-03-22 18:01:09 +01:00
Maximilian Bosch fc316f7b31
nixos/ssmtp: declare all option renames manually
While renaming `networking.defaultMailServer` directly to
`services.ssmtp` is shorter and probably clearer, it causes eval errors
due to the second rename (directDelivery -> enable) when using e.g. `lib.mkForce`.

For instance,

``` nix
{ lib, ... }: {
  networking.defaultMailServer = {
    hostName = "localhost";
    directDelivery = lib.mkForce true;
    domain = "example.org";
  };
}
```

would break with the following (rather confusing) error:

```
error: The option value `services.ssmtp.enable' in `/home/ma27/Projects/nixpkgs/nixos/modules/programs/ssmtp.nix' is not of type `boolean'.
(use '--show-trace' to show detailed location information)
```
2020-03-22 15:52:01 +01:00
Michael Raskin afd997aab6
Merge pull request #83000 from djahandarie/master
nixos/supplicant: Don't *stop* supplicant on machine resume. Fixes #51582
2020-03-22 12:36:33 +00:00
Christian Kögler 8f12a72488 kodi: fix lirc support
* adapted to the way kodi finds the lircd socket
* added lirc package to build support for lirc
2020-03-22 12:47:25 +01:00
Graham Christensen 28cb73749b
Merge pull request #82696 from bhipple/u/ami
nixos-ami: update nvme_core.io_timeout for linux kernel >= 4.15
2020-03-22 07:18:53 -04:00
Jörg Thalheim 2edf67b62f
Merge pull request #82801 from Izorkin/fail2ban
nixos/fail2ban: add warning if work fail2ban without firewall
2020-03-22 08:31:50 +00:00
Matthew Bauer b94300945a
Merge pull request #75940 from davidtwco/wooting-init
wooting: init wootility, wooting-udev-rules and module
2020-03-22 02:03:52 -04:00
Emily 62e34d1c87 nixos/acme: change default keyType to ec256
Previously, the NixOS ACME module defaulted to using P-384 for
TLS certificates. I believe that this is a mistake, and that we
should use P-256 instead, despite it being theoretically
cryptographically weaker.

The security margin of a 256-bit elliptic curve cipher is substantial;
beyond a certain level, more bits in the key serve more to slow things
down than add meaningful protection. It's much more likely that ECDSA
will be broken entirely, or some fatal flaw will be found in the NIST
curves that makes them all insecure, than that the security margin
will be reduced enough to put P-256 at risk but not P-384. It's also
inconsistent to target a curve with a 192-bit security margin when our
recommended nginx TLS configuration allows 128-bit AES. [This Stack
Exchange answer][pornin] by cryptographer Thomas Pornin conveys the
general attitude among experts:

> Use P-256 to minimize trouble. If you feel that your manhood is
> threatened by using a 256-bit curve where a 384-bit curve is
> available, then use P-384: it will increases your computational and
> network costs (a factor of about 3 for CPU, a few extra dozen bytes
> on the network) but this is likely to be negligible in practice (in a
> SSL-powered Web server, the heavy cost is in "Web", not "SSL").

[pornin]: https://security.stackexchange.com/a/78624

While the NIST curves have many flaws (see [SafeCurves][safecurves]),
P-256 and P-384 are no different in this respect; SafeCurves gives
them the same rating. The only NIST curve Bernstein [thinks better of,
P-521][bernstein] (see "Other standard primes"), isn't usable for Web
PKI (it's [not supported by BoringSSL by default][boringssl] and hence
[doesn't work in Chromium/Chrome][chromium], and Let's Encrypt [don't
support it either][letsencrypt]).

[safecurves]: https://safecurves.cr.yp.to/
[bernstein]: https://blog.cr.yp.to/20140323-ecdsa.html
[boringssl]: https://boringssl.googlesource.com/boringssl/+/e9fc3e547e557492316932b62881c3386973ceb2
[chromium]: https://bugs.chromium.org/p/chromium/issues/detail?id=478225
[letsencrypt]: https://letsencrypt.org/docs/integration-guide/#supported-key-algorithms

So there's no real benefit to using P-384; what's the cost? In the
Stack Exchange answer I linked, Pornin estimates a factor of 3×
CPU usage, which wouldn't be so bad; unfortunately, this is wildly
optimistic in practice, as P-256 is much more common and therefore
much better optimized. [This GitHub comment][openssl] measures the
performance differential for raw Diffie-Hellman operations with OpenSSL
1.1.1 at a whopping 14× (even P-521 fares better!); [Caddy disables
P-384 by default][caddy] due to Go's [lack of accelerated assembly
implementations][crypto/elliptic] for it, and the difference there seems
even more extreme: [this golang-nuts post][golang-nuts] measures the key
generation performance differential at 275×. It's unlikely to be the
bottleneck for anyone, but I still feel kind of bad for anyone having
lego generate hundreds of certificates and sign challenges with them
with performance like that...

[openssl]: https://github.com/mozilla/server-side-tls/issues/190#issuecomment-421831599
[caddy]: 2cab475ba5/modules/caddytls/values.go (L113-L124)
[crypto/elliptic]: 2910c5b4a0/src/crypto/elliptic
[golang-nuts]: https://groups.google.com/forum/#!topic/golang-nuts/nlnJkBMMyzk

In conclusion, there's no real reason to use P-384 in general: if you
don't care about Web PKI compatibility and want to use a nicer curve,
then Ed25519 or P-521 are better options; if you're a NIST-fearing
paranoiac, you should use good old RSA; but if you're a normal person
running a web server, then you're best served by just using P-256. Right
now, NixOS makes an arbitrary decision between two equally-mediocre
curves that just so happens to slow down ECDH key agreement for every
TLS connection by over an order of magnitude; this commit fixes that.

Unfortunately, it seems like existing P-384 certificates won't get
migrated automatically on renewal without manual intervention, but
that's a more general problem with the existing ACME module (see #81634;
I know @yegortimoshenko is working on this). To migrate your
certificates manually, run:

    $ sudo find /var/lib/acme/.lego/certificates -type f -delete
    $ sudo find /var/lib/acme -name '*.pem' -delete
    $ sudo systemctl restart 'acme-*.service' nginx.service

(No warranty. If it breaks, you get to keep both pieces. But it worked
for me.)
2020-03-22 05:27:20 +00:00
Benjamin Hipple 129176452c nixos-ami: update nvme_core.io_timeout for linux kernel >= 4.15
NixOS 20.03 is built on kernel 5.4 and 19.09 is on 4.19, so we should update
this option to the highest value possible, per linked upstream instructions from
Amazon.
2020-03-22 00:35:56 -04:00
Matthew Bauer 9d8d66baf5
nixos/nixpkgs.nix: Allow just using config in system (#80818)
* nixos/nixpkgs.nix: Allow just using config in system

This assertion requires system to work properly. We might not have
this in cases where the user just sets config and wants Nixpkgs to
infer system from that. This adds a default for when this happens,
using doubleFromSystem.

* parens
2020-03-21 23:23:24 -04:00
Aaron Andersen 6c47902e01 nixos/mysql: test with mysql80 package 2020-03-21 15:47:38 -04:00
Aaron Andersen 4f9cea70bd nixos/duosec: fix indentation 2020-03-21 10:34:12 -04:00
Jörg Thalheim bfb747aacf
Merge pull request #82286 from yesbox/netdata_module_package_option
nixos/netdata: add module package option
2020-03-21 11:21:39 +00:00
Peter Hoeg 7f838b4dde display-manager: systemd-udev-settle serves no purpose 2020-03-21 11:15:42 +08:00
Peter Hoeg 8a31cf1459 zfs: document systemd-udev-settle dependency 2020-03-21 11:15:06 +08:00
Peter Hoeg 53a51f212a atd: systemd-udev-settle serves no purpose 2020-03-21 11:15:06 +08:00
bb010g 34dd64b0cc nixos/documentation: Allow specifying extraSources
Because there was absolutely no way of setting this without rewriting
parts of the module otherwise.
2020-03-20 19:05:32 -07:00