Commit graph

4907 commits

Author SHA1 Message Date
Robert Helgesson bf371a8b06 radicale service: use "simple" service type (#18406)
Radicale can run as a foreground service and will then emits logging and
errors on the standard output. This helps the logging end up in the
systemd journal.
2016-09-08 12:34:22 +02:00
Damien Cassou 6dc9ed317c Merge pull request #18244 from DamienCassou/emacs-gtk_data_prefix
emacs module: Fix to get properly themed GTK apps
2016-09-08 09:05:11 +02:00
aszlig dd98b6fb9f
nixos/stage2: Fix mounting special filesystems
This partially reverts commit ab9537ca22.

From the manpage of systemd-nspawn(1):

  Note that systemd-nspawn will mount file systems private to the
  container to /dev, /run and similar.

Testing this in a shell turns out:

$ sudo systemd-nspawn --bind-ro=/nix/store "$(readlink "$(which ls)")" /proc
Spawning container aszlig on /home/aszlig.
Press ^] three times within 1s to kill container.
/etc/localtime does not point into /usr/share/zoneinfo/, not updating
container timezone.
1          execdomains  kpageflags    stat
acpi       fb           loadavg       swaps
asound     filesystems  locks         sys
buddyinfo  fs           meminfo       sysrq-trigger
bus        interrupts   misc          sysvipc
cgroups    iomem        modules       thread-self
cmdline    ioports      mounts        timer_list
config.gz  irq          mtrr          timer_stats
consoles   kallsyms     net           tty
cpuinfo    kcore        pagetypeinfo  uptime
crypto     key-users    partitions    version
devices    keys         scsi          vmallocinfo
diskstats  kmsg         self          vmstat
dma        kpagecgroup  slabinfo      zoneinfo
driver     kpagecount   softirqs
Container aszlig exited successfully.

So the test on whether PID 1 exists in /proc is enough, because if we
use PID namespaces there actually _is_ a PID 1 (as shown above) and the
special file systems are already mounted. A test on the $containers
variable actually mounts them twice.

This unbreaks NixOS containers and I've tested this against the
containers-imperative NixOS test.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @rickynils, @shlevy, @edolstra
2016-09-07 18:10:08 +02:00
Rob Vermaas 2410608814 NixOS 17.03 will be called Gorilla 2016-09-07 15:05:00 +00:00
aszlig fb46df8a9a
nixos: Fix ordering of firewall.service
Follow-up to the following commits:

  abdc5961c3cdf9f5893ea1e91ba08ff5089f53a4: Fix starting the firewall
  e090701e2d09aec3e8866ab9a8e53c37973ffeb4: Order before sysinit

Solely use sysinit.target here instead of multi-user.target because we
want to make sure that the iptables rules are applied *before* any
socket units are started.

The reason I've dropped the wantedBy on multi-user.target is that
sysinit.target is already a part of the dependency chain of
multi-user.target.

To make sure that this holds true, I've added a small test case to
ensure that during switch of the configuration the firewall.service is
considered as well.

Tested using the firewall NixOS test.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @edolstra
2016-09-07 15:11:24 +02:00
Eelco Dolstra e090701e2d firewall: Order before sysinit
Suggested by @aszlig.
2016-09-07 14:42:30 +02:00
Eelco Dolstra abdc5961c3 Fix starting the firewall
Probably as a result of 992c514a20, it
was not being started anymore.

My understanding of systemd.special(7) (section "Special passive
system units") is that the firewall should want network-pre.target,
rather than the other way around (not very intuitive...). This in
itself does not cause the firewall to be wanted, which is why the
wanted-by relationship with multi-user.target is necessary.

http://hydra.nixos.org/build/39965589
2016-09-07 14:30:11 +02:00
Eelco Dolstra 58b028f9ee nfs module: Fix dependency on statd and idmapd
http://hydra.nixos.org/build/40038016
2016-09-07 14:15:57 +02:00
Eelco Dolstra 015c984537 nfs module: Improve descriptions 2016-09-07 14:15:57 +02:00
Alexey Shmalko b7237abc08 avahi-daemon: remove default browse-domains
These domains are not actually default but examples. See
https://github.com/lathiat/avahi/blob/master/avahi-daemon/avahi-daemon.conf#L24
for default config.
2016-09-07 13:58:21 +02:00
Shea Levy 03b888e205 Merge branch 'stage2-generalise-containers' of https://github.com/rickynils/nixpkgs 2016-09-07 05:39:22 -04:00
Eelco Dolstra 70be99c645 Merge pull request #18365 from NixOS/fix-sshd-failure
Make /var/empty immutable (with chattr +i)
2016-09-07 11:18:49 +02:00
Domen Kožar 8f95e6f6aa hardcode e2fsprogs, idempotent chmod, remove care condition 2016-09-07 10:49:27 +02:00
Rickard Nilsson ab9537ca22 nixos: Generalise the container tests in stage-2 boot
This way, stage-2 behaves correctly also for libvirt-lxc containers.

Some more discussion on this:
a7a08188bf
bfe46a653b
2016-09-07 07:50:04 +00:00
Langston Barrett 492a90f1c9 dovecot service: require mail{User,Group} with sieveScripts
fixes #17702.
2016-09-07 01:50:59 +00:00
Nikolay Amiantov aed2cd32f8 nixos containers: hopefully fix test failures
Closes #18377.
2016-09-07 02:55:48 +03:00
Franz Pletz 9190dbcc0e Merge pull request #18366 from groxxda/acme-loop
security.acme: require networking for client, remove loop without fallbackHost
2016-09-06 23:02:07 +02:00
Domen Kožar 3877ec5b2f Make /var/empty immutable
Fixes #14910 and #18358

Deployed to an existing server, restarted sshd and polkit to verify
they don't fail.
2016-09-06 20:13:33 +02:00
Thomas Tuegel caac16a924 Merge pull request #18362 from ericsagnes/fix/im-description
input-methods modules: fix engine description
2016-09-06 11:42:28 -05:00
Alexander Ried e84b803300 security.acme: remove loop when no fallbackHost is given 2016-09-06 17:47:00 +02:00
Alexander Ried 7f98dca782 security.acme: the client really needs networking
Actually this can be improved since the client only needs network
connectivity if it needs to renew the certificate.
2016-09-06 17:47:00 +02:00
Eelco Dolstra 98102ebd92 Enable the runuser command from util-linux
Fixes #14701.
2016-09-06 17:23:27 +02:00
Eelco Dolstra f2ddf2a9be nix: 1.11.3 -> 1.11.4 2016-09-06 16:15:22 +02:00
Eelco Dolstra 1fef99942e nixos-rebuild: Move the Nix fallback store paths into a separate file 2016-09-06 16:07:47 +02:00
Eric Sagnes 314c30cbf1 input-methods modules: fix engine description 2016-09-06 22:53:15 +09:00
obadz 3f1ceae281 Partially revert "Revert "nixos: remove rsync from base install and add explicit path in nixos-install""
This partially reverts commit 0aa7520670.

Fine for rsync to be in system path but we still need the explicit path
in nixos-install in case it is invoked from non-NixOS systems and also
to fix OVA test failure

See also 0aa7520670

cc @edolstra
2016-09-06 11:49:03 +01:00
Eelco Dolstra 520cb14f16 Fix infinite recursion introduced by f3c32cb2c1 2016-09-05 18:17:22 +02:00
Eelco Dolstra 1a1a31c9d8 Merge pull request #18321 from groxxda/cleanup
various: minor cleanup
2016-09-05 17:11:45 +02:00
Eelco Dolstra 5b5c2fb9c0 Make the default fonts conditional on services.xserver.enable
We were pulling in 44 MiB of fonts in the default configuration, which
is a bit excessive for headless configurations like EC2
instances. Note that dejavu_minimal ensures that remote X11-forwarded
applications still have a basic font regardless.
2016-09-05 15:51:37 +02:00
Eelco Dolstra f3c32cb2c1 Let services.openssh.forwardX11 imply programs.ssh.setXAuthLocation 2016-09-05 15:38:42 +02:00
Alexander Ried 53f3c2a278 systemd: add some missing upstream units 2016-09-05 15:03:46 +02:00
Alexander Ried 322c823193 agetty: remove override for container-getty@.service since it's upstream
Added in systemd/systemd@68ac53e
2016-09-05 15:03:35 +02:00
Alexander Ried 2fd6b36c51 networkd.module: remove before network-online
this is already upstream default
2016-09-05 15:03:35 +02:00
Alexander Ried 992c514a20 (network,remote-fs)-pre: remove duplicate wantedBy and before
this is part of (network,remote-fs).target, repectively
2016-09-05 15:03:35 +02:00
Eelco Dolstra ab49ebe6fa Make it possible to disable "info" 2016-09-05 14:53:27 +02:00
Eelco Dolstra 5e5df88457 modules/profiles/minimal.nix: Disable "man" 2016-09-05 14:53:27 +02:00
Eelco Dolstra ba70ce28ae no-x-libs.nix: Ensure that dbus doesn't use X11
It appears that packageOverrides no longer overrides aliases, so
aliases like

  dbus_tools = self.dbus.out;
  dbus_daemon = self.dbus.daemon;

now use the old, non-overriden version of dbus. That seems like a
pretty serious regression in general, but for this particular problem,
I've fixed it by replacing dbus_daemon by dbus.daemon and dbus_tools
by dbus.
2016-09-05 13:45:59 +02:00
Eelco Dolstra 0aa7520670 Revert "nixos: remove rsync from base install and add explicit path in nixos-install"
This reverts commit 582313bafe.

Removing rsync is actually pointless because nixos-install depends on
it. So if it's part of the system closure, we may as well provide it
to users.

Probably with the next Nix release we can drop the use of rsync and
use "nix copy" instead.
2016-09-05 13:45:59 +02:00
Joachim Fasting 269f739ded
grsecurity module: set nixpkgs.config.grsecurity = true 2016-09-05 00:56:17 +02:00
Domen Kožar 393e646e4f setuid-wrappers: correctly umount the tmpfs 2016-09-04 17:56:00 +02:00
Jaka Hudoklin c083ab99b2 Merge pull request #17969 from offlinehacker/pkgs/etcd/update-3.0.6
Update etcd, improve nixos module, fix nixos tests
2016-09-04 16:31:50 +02:00
Rok Garbas 095c7aefe1
nixos/manual: mentioning other zsh options at program.zsh.enable
fixes #13224
2016-09-04 16:31:29 +02:00
Karn Kallio 8d977ead38
setuid-wrappers : Prepare permissions for running wrappers
The new setuid-wrappers in /run cannot be executed by users due to:

1) the temporary directory does not allow access
2) the /run is mounted nosuid
2016-09-04 03:19:32 +02:00
Alexander Ried 1542bddcc8 nixos-install.sh: Create /var (#18266)
Got lost in a6670c1a0b
2016-09-03 19:17:44 +02:00
Joachim F 3db5311be9 Merge pull request #18207 from tavyc/quagga-module
quagga service: init
2016-09-03 16:23:23 +02:00
Damien Cassou f96cd1ea64 emacs module: Fix to get properly themed GTK apps 2016-09-03 08:25:25 +02:00
Tuomas Tynkkynen e2c6740c37 Merge commit 'adaee73' from staging into master
This one was already merged into release-16.09, so let's not have the
stable branch is ahead of master and confuse things. In addition to
that, currently we have an odd situation that master has less things
actually finished building than in staging.

Conflicts:
	pkgs/data/documentation/man-pages/default.nix
2016-09-03 01:02:51 +03:00
Vladimír Čunát 02217bf697 Merge #17838: postgresql: Fix use with extensions 2016-09-02 20:09:40 +02:00
Octavian Cerna a30d4654f2 quagga service: New NixOS module. 2016-09-02 13:59:51 +03:00
Rob Vermaas d6dbe43af2 bightbox-image.nix: use lib in stead of stdenv.lib. Fixes #18208 2016-09-02 10:04:09 +00:00