Commit graph

513 commits

Author SHA1 Message Date
Maximilian Bosch ccd348f846
Merge pull request #129732 from nivadis/patch-2
nextcloud: remove expires header
2021-07-23 12:29:52 +02:00
Maximilian Bosch 65d60ae78b
Merge pull request #130062 from nh2/plausible-fix-shell-scripting-errors
nixos/plausible: Fix shell scripting errors, runtime fixes
2021-07-22 00:27:56 +02:00
Jean-Philippe Braun d4eca42de4 nixos/wordpress: nginx support 2021-07-16 08:51:08 +02:00
Kim Lindberger 4dcf295417
Merge pull request #129464 from talyz/discourse-plugins
discourse: Updates and fixes
2021-07-15 14:50:28 +02:00
talyz 20548f050e
nixos/discourse: Update plugin documentation
Update the documentation regarding plugins to reflect recent changes.
2021-07-14 13:18:06 +02:00
Niklas Hambüchen ea182cdb99 nixos/plausible: docs: Mention caveate of baseUrl 2021-07-14 03:28:57 +00:00
Janne Heß 6d203a68c6
nixos/icingaweb2: Add ipl and thirdparty libraries
These are required since 2.9.0
2021-07-13 18:31:15 +02:00
Niklas Hambüchen 8613698df0 nixos/plausible: Fix shell scripting errors.
See https://github.com/NixOS/nixpkgs/pull/124055/files#r668271575
2021-07-13 04:05:05 +02:00
Linus Heckemann f7dff9c649
Merge pull request #129620 from bbenno/update-nextcloud
nextcloud: init at 22.0.0; 21.0.2 -> 21.0.3; 20.0.7 -> 20.0.11
2021-07-12 20:53:35 +02:00
Valentin Conrad ceef268c4b
nextcloud: remove expires header
nextcloud default nginx config did not include the expires config
see: https://docs.nextcloud.com/server/latest/admin_manual/installation/nginx.html
2021-07-09 10:50:25 +02:00
Leo Maroni c0bd900632 nixos/vikunja: init
nixos/vikunka: Use RFC 0042 settings proposal (thanks to @aanderse)
2021-07-08 22:17:57 +02:00
Maximilian Bosch e05f4101c1
nextcloud22: init at 22.0.0 2021-07-08 17:00:04 +02:00
Luke Granger-Brown 272773e1cb
Merge pull request #127931 from talyz/discourse-plugins
discourse: Fix plugin support
2021-06-30 23:03:57 +01:00
Maciej Krüger 8ae5ade468
Merge pull request #112654 from 1000101/matomo
nixos/matomo: add periodicArchiveProcessingUrl option
2021-06-28 05:39:14 +02:00
talyz 9af3672f4f
discourse: Fix plugin support
For plugins to work properly, their assets need to be precompiled
along with the rest of Discourse's assets. This means we need to build
new packages when the list of plugins change.
2021-06-24 19:38:19 +02:00
github-actions[bot] 9c8cef37d2
Merge master into staging-next 2021-06-20 12:04:37 +00:00
illustris e0089c38ca nixos/jitsi-meet: include jitsi prosody plugins in prosody extraPluginPaths 2021-06-20 12:36:51 +02:00
illustris 34b9ba2e61 nixos/jitsi-meet: Update jitsi prosody configs
Changes made as per b6f7f8fba7
2021-06-20 12:36:51 +02:00
github-actions[bot] 0397e518b7
Merge staging-next into staging 2021-06-05 18:30:31 +00:00
talyz 59e0120aa5
treewide: Fix mysql alias deprecation breakage
62733b37b4 broke evaluation in all
places `pkgs.mysql` was used. Fix this by changing all occurrences to
`pkgs.mariadb`.
2021-06-04 21:42:08 +02:00
github-actions[bot] 0b0d0c21ec
Merge staging-next into staging 2021-06-04 13:00:29 +00:00
Luke Granger-Brown 39e225b0f4 nixos/engelsystem: don't rely on mysql alias
Since 3edde6562e, we can no longer use
aliases inside the test framework. This has the implication that we can
no longer use aliases in any NixOS modules used by the test framework as
well (which is good), but does mean we need to clean up any instances
where this is the case.
2021-06-04 08:43:48 +00:00
github-actions[bot] a261aaf9c2
Merge staging-next into staging 2021-06-02 13:08:16 +00:00
Maximilian Bosch cc88797ce0 plausible: minor polishing 2021-06-02 19:21:31 +09:00
Maximilian Bosch 6bc72cdd4a plausiblew: cleanup build & update script 2021-06-02 19:21:31 +09:00
Maximilian Bosch 02b15d0f5b plausible: first review fix iteration
* Most significant is probably the patching necessary to run plausible
  with postgres without superuser privilege. This change includes:
  * updating ecto_sql to 3.6 where `CREATE DATABASE` is only executed if
    it doesn't exist[1].
  * patching a migration to only modify the `users.email` column (to use
    `citext` rather than creating the extension. `plausible-postgres`
    takes care of that).
* Correctly declare dependencies in systemd.
* A few minor fixes.

[1] 051baf669e
2021-06-02 19:21:31 +09:00
Maximilian Bosch b06ea1146c plausible: init at 1.3.0 2021-06-02 19:21:31 +09:00
Sandro eb5c8e51b7
Merge pull request #124404 from nagy/option-types 2021-06-01 15:12:16 +02:00
Johannes Schleifenbaum 878103ce55
nixos/trilium: use boolToString for noBackup 2021-05-30 18:16:13 +02:00
Daniel Nagy 73f9c29a2c
nixos/discourse: set port type to types.port 2021-05-30 14:38:18 +02:00
Martin Weinelt ee8cf6a664
Merge pull request #124839 from mweinelt/wordpress/secret-key-regen
nixos/wordpress: regenerate secret keys if misspelled key name is found
2021-05-29 22:13:03 +02:00
Martin Weinelt 724ed08df0
nixos/wordpress: regenerate secret keys if misspelled key name is found
A secret key generated by the nixos module was misspelled, which could
possibly impact the security of session cookies.

To recover from this situation we will wipe all security keys that were
previously generated by the NixOS module, when the misspelled one is
found. This will result in all session cookies being invalidated. This
is confirmed by the wordpress documentation:

> You can change these at any point in time to invalidate all existing
> cookies. This does mean that all users will have to login again.

https://wordpress.org/support/article/editing-wp-config-php/#security-keys

Meanwhile this issue shouldn't be too grave, since the salting function
of wordpress will rely on the concatenation of both the user-provided
and automatically generated values, that are stored in the database.

> Secret keys are located in two places: in the database and in the
> wp-config.php file. The secret key in the database is randomly
> generated and will be appended to the secret keys in wp-config.php.

https://developer.wordpress.org/reference/functions/wp_salt/

Fixes: 2adb03fdae ("nixos/wordpress:
generate secrets locally")

Reported-by: Moritz Hedtke <Moritz.Hedtke@t-online.de>
2021-05-29 04:24:42 +02:00
talyz cb80b67993 nixos/discourse: Assert deployed PostgreSQL version
Assert that the PostgreSQL version being deployed is the one used
upstream. Allow the user to override this assertion, since it's not
always possible or preferable to use the recommended one.
2021-05-28 17:43:02 -07:00
talyz 1f6b48be74 discourse: 2.6.5 -> 2.7.0 2021-05-28 17:43:02 -07:00
FliegendeWurst b9e2b878c5 nixos/trilium-server: noBackup option 2021-05-24 09:55:49 +02:00
FliegendeWurst 7cb492fb13 nixos/trilium-server: add myself as maintainer 2021-05-24 09:55:49 +02:00
Elis Hirwing e9cca93bf9
Merge pull request #121778 from talyz/keycloak-security
nixos/keycloak: Security fixes + misc
2021-05-21 16:55:26 +02:00
Kerstin Humm 224df6940f nixos/mastodon: use rails command instead of rake
Co-Authored-By: Izorkin <izorkin@elven.pw>
2021-05-21 15:04:12 +02:00
talyz ba00b0946e
nixos/keycloak: Split certificatePrivateKeyBundle into two options
Instead of requiring the user to bundle the certificate and private
key into a single file, provide separate options for them. This is
more in line with most other modules.
2021-05-21 13:09:38 +02:00
talyz dbf91bc2f1
nixos/keycloak: keycloak.database* -> keycloak.database.*
Move all database options to their own group / attribute. This makes
the configuration clearer and brings it in line with most other modern
modules.
2021-05-21 13:09:32 +02:00
talyz 83e406e97a
nixos/keycloak: frontendUrl always needs to be suffixed with /
In some places, Keycloak expects the frontendUrl to end with `/`, so
let's make sure it always does.
2021-05-21 13:09:25 +02:00
talyz 58614f8416
nixos/keycloak: Add myself to maintainers 2021-05-21 13:09:19 +02:00
talyz d748c86389
nixos/keycloak: Improve readablility by putting executables in PATH 2021-05-21 13:09:14 +02:00
talyz 8309368e4c
nixos/keycloak: Set umask before copying sensitive files
`install` copies the files before setting their mode, so there could
be a breif window where the secrets are readable by other users
without a strict umask.
2021-05-21 13:09:09 +02:00
talyz c2bebf4ee2
nixos/keycloak: Improve bash error handling 2021-05-21 13:09:03 +02:00
talyz d6727d28e1
nixos/keycloak: Set the postgresql database password securely
Feeding `psql` the password on the command line leaks it through the
`psql` process' `/proc/<pid>/cmdline` file. Using `echo` to put the
command in a file and then feeding `psql` the file should work around
this, since `echo` is a bash builtin and thus shouldn't spawn a new
process.
2021-05-21 13:08:53 +02:00
talyz 380b52c737
nixos/keycloak: Use replace-secret to avoid leaking secrets
Using `replace-literal` to insert secrets leaks the secrets through
the `replace-literal` process' `/proc/<pid>/cmdline`
file. `replace-secret` solves this by reading the secret straight from
the file instead, which also simplifies the code a bit.
2021-05-19 09:32:28 +02:00
talyz 38398fade1
nixos/discourse: Use replace-secret to avoid leaking secrets
Using `replace-literal` to insert secrets leaks the secrets through
the `replace-literal` process' `/proc/<pid>/cmdline`
file. `replace-secret` solves this by reading the secret straight from
the file instead, which also simplifies the code a bit.
2021-05-19 09:32:06 +02:00
Izorkin feebe402f5
treewide: remove duplicates SystemCallFilters 2021-05-13 15:44:56 +03:00
talyz deb58f6486 nixos/keycloak: Document how to use a custom local database 2021-05-04 19:27:08 +02:00