Commit graph

17165 commits

Author SHA1 Message Date
talyz 88b76d5ef9
nixos/mpd: Use replace-secret to avoid leaking secrets
Using `replace-literal` to insert secrets leaks the secrets through
the `replace-literal` process' `/proc/<pid>/cmdline`
file. `replace-secret` solves this by reading the secret straight from
the file instead.
2021-05-19 09:32:22 +02:00
talyz 3a29b7bf5b
nixos/mpdscribble: Use replace-secret to avoid leaking secrets
Using `replace-literal` to insert secrets leaks the secrets through
the `replace-literal` process' `/proc/<pid>/cmdline`
file. `replace-secret` solves this by reading the secret straight from
the file instead, which also simplifies the code a bit.
2021-05-19 09:32:17 +02:00
talyz 7842e89bfc
nixos/gitlab: Use replace-secret to avoid leaking secrets
Using `replace-literal` to insert secrets leaks the secrets through
the `replace-literal` process' `/proc/<pid>/cmdline`
file. `replace-secret` solves this by reading the secret straight from
the file instead, which also simplifies the code a bit.
2021-05-19 09:32:12 +02:00
talyz 38398fade1
nixos/discourse: Use replace-secret to avoid leaking secrets
Using `replace-literal` to insert secrets leaks the secrets through
the `replace-literal` process' `/proc/<pid>/cmdline`
file. `replace-secret` solves this by reading the secret straight from
the file instead, which also simplifies the code a bit.
2021-05-19 09:32:06 +02:00
Jörg Thalheim 5b4915fb7a
Merge pull request #110927 from Izorkin/fix-qemu-ga
nixos/qemu-guest-agent: fix start service
2021-05-19 05:42:06 +01:00
Aaron Andersen 58ddbfa71d
Merge pull request #118395 from jwygoda/grafana-google-oauth2
grafana: add google oauth2 config
2021-05-18 23:11:24 -04:00
Martin Weinelt a8f71f069f
Merge pull request #123006 from mweinelt/postgresqlbackup-startat
nixos/postgresqlBackup: allow defining multiple times to start at
2021-05-19 01:54:38 +02:00
Martin Weinelt 4c798857e2
Merge pull request #100274 from hax404/prometheus-xmpp-alerts 2021-05-19 01:36:28 +02:00
Georg Haas 03c092579a
prometheus-xmpp-alerts: apply RFC 42 2021-05-19 01:08:38 +02:00
Pamplemousse 037e51702e
nixos/services/foldingathome: Add an option to set the "nice level" (#122864)
Signed-off-by: Pamplemousse <xav.maso@gmail.com>
2021-05-18 18:44:52 +02:00
Maciej Krüger 7458dcd956
Merge pull request #75242 from mkg20001/cjdns-fix
services.cjdns: add missing, optional login & peerName attribute
2021-05-18 18:22:29 +02:00
Robert Schütz d189df235a
Merge pull request #122241 from dotlambda/znc-harden
nixos/znc: harden systemd unit
2021-05-18 17:44:14 +02:00
Maciej Krüger 7409f9bab3
services.cjdns: add missing, optional login & peerName attribute 2021-05-18 17:39:04 +02:00
Ashlynn Anderson 903665f31c
nixos/self-deploy: init (#120940)
Add `self-deploy` service to facilitate continuous deployment of NixOS
configuration from a git repository.
2021-05-18 08:29:37 -07:00
Maciej Krüger 362ca08510
Merge pull request #123448 from mweinelt/phosh-pam
nixos/phosh: Fix PAM configuration
2021-05-18 17:26:21 +02:00
Martin Weinelt ec9cfba2d3
nixos/phosh: Fix unrestricted login because of insecure PAM config
The PAM config deployed would not check anything meaningful. Remove it
and rely on the defaults in the security.pam module to fix login with
arbitrary credentials.

Resolves: #123435
2021-05-18 16:39:03 +02:00
Jan Tojnar 1b1faeb2db
Merge pull request #86288 from worldofpeace/gnome-doc
nixos/gnome3: add docs
2021-05-18 14:19:33 +02:00
Michael Raskin 02ba3238d2
Merge pull request #123053 from pschyska/master
atop, netatop, nixos/atop: improve packaging and options
2021-05-18 10:54:13 +00:00
Vincent Haupert faeb9e3233
nixos/networkd: add missing [DHCPServer] options
`systemd.network.networks.*.dhcpServerConfig` did not accept all of
the options which are valid for networkd's [DHCPServer] section. See
systemd.network(5) of systemd 247 for details.
2021-05-17 18:30:37 +02:00
ajs124 e2cf342ba9 nixos/security/apparmor: utillinux -> util-linux 2021-05-17 17:14:08 +02:00
Robert Schütz a22ebb6d6d
Merge pull request #123017 from DavHau/davhau-scikitlearn
python3Packages.scikitlearn: rename to scikit-learn
2021-05-17 15:13:33 +02:00
ajs124 8e78793029 nixos/tasks/filesystems: utillinux -> util-linux 2021-05-17 14:47:57 +02:00
Jörg Thalheim b900661f6e
Merge pull request #122825 from Izorkin/update-duplicates-systemcallfilters
treewide: remove duplicates SystemCallFilters
2021-05-17 12:06:06 +01:00
DavHau cd8f3e6c44 python3Packages.scikitlearn: rename to scikit-learn 2021-05-17 17:41:36 +07:00
Eelco Dolstra c3b27282d7
Merge pull request #123272 from kini/nixos/security.pki/pems-without-final-newline
nixos/security.pki: handle PEMs w/o a final newline
2021-05-17 11:14:03 +02:00
Richard Marko 16b0f07890 nixos/nginx: fix comment about acme postRun not running as root
As of 67a5d66 this is no longer true, since acme postRun runs as root.
The idea of the service is good so reword a comment a bit.
2021-05-17 18:03:04 +09:00
Richard Marko 7423afb5e4 nixos/molly-brown: fix description of certPath
`allowKeysForGroup` is no longer available so this drops

```
security.acme.certs."example.com".allowKeysForGroup = true;
```

line. `SupplementaryGroups` should be enough for
allowing access to certificates.
2021-05-17 18:03:04 +09:00
Richard Marko 29158fc0ac nixos/postgresql: fix description of ensureUsers.ensurePermissions
`attrName` and `attrValue` are now in correct order.
2021-05-17 18:03:04 +09:00
Jan Tojnar 354e005d6c nixos/dconf: fix d-bus activation
dconf now supports autostarting the d-bus service using systemd's d-bus activation.

2781a86848

On NixOS, that requires making systemd aware of the package.

Fixes: https://github.com/NixOS/nixpkgs/issues/123265
2021-05-17 09:46:07 +02:00
Evils 7641769055 nixos/fancontrol: back to running as root
regular users don't have write access to /sys/devices
  which is where the kernel endpoints are to control fan speed
2021-05-17 00:00:01 -07:00
Sandro ec1dd62608
Merge pull request #118521 from SuperSandro2000/nginx-proxy-timeout
nixos/nginx: add option to change proxy timeouts
2021-05-17 03:15:54 +02:00
Sandro 700942d2a5
Merge pull request #121119 from SuperSandro2000/remove-gnidorah
treewide: remove gnidorah
2021-05-17 02:42:24 +02:00
Sandro Jäckel 51166f90c6
nixos/nginx: add option to change proxy timeouts 2021-05-17 02:37:44 +02:00
Keshav Kini 348858f297 nixos/security.pki: handle PEMs w/o a final newline
According to the ABNF grammar for PEM files described in [RFC
7468][1], an eol character (i.e. a newline) is not mandatory after the
posteb line (i.e. "-----END CERTIFICATE-----" in the case of
certificates).

This commit makes our CA certificate bundler expression account for
the possibility that files in config.security.pki.certificateFiles
might not have final newlines, by using `awk` instead of `cat` to
concatenate them. (`awk` prints a final newline from each input file
even if the file doesn't end with a newline.)

[1]: https://datatracker.ietf.org/doc/html/rfc7468#section-3
2021-05-16 17:23:11 -07:00
Martin Weinelt 7bd65d54f7 treewide: remove nand0p as maintainer
While looking at the sphinx package I noticed it was heavily
undermaintained, which is when we noticed nand0p has been inactive for
roughly 18 months. It is therefore prudent to assume they will not be
maintaining their packages, modules and tests.

- Their last contribution to nixpkgs was in 2019/12
- On 2021/05/08 I wrote them an email to the address listed in the
  maintainer-list, which they didn't reply to.
2021-05-17 01:50:49 +02:00
Florian Klink 6c0058f47f
Merge pull request #85073 from hyperfekt/systemd-pstore
nixos/systemd|filesystems: mount and evacuate /sys/fs/pstore using systemd-pstore
2021-05-17 00:00:52 +02:00
Aaron Andersen 21f5dd5c6e
Merge pull request #122647 from onny/caddy
nixos/caddy: support user and group options
2021-05-16 17:23:57 -04:00
Johan Thomsen 7e310dd8e8 nixos/containerd: StartLimit* options must be in the unit-section
also, raise limits to ensure reasonable startup time, now that StartLimits are actually enforced
2021-05-17 06:17:18 +10:00
Johan Thomsen 2142f88526 nixos/containerd: sanitize StateDirectory and RuntimeDirectory 2021-05-17 06:17:18 +10:00
Paul Schyska 563ba07543
nixos/atop: Split up restart triggers between atop and netatop 2021-05-16 22:00:24 +02:00
Paul Schyska 526bc6a4d5
nixos/atop: Add a note about netatop tainting the kernel 2021-05-16 21:43:20 +02:00
Paul Schyska b87c366046
nixos/atop: Never enable setuidWrapper by default, rename service/timer enabling options 2021-05-16 18:22:03 +02:00
Paul Schyska 8f3d2e5c3b
nixos/atop: Add configuration for atop services, allow to enable netatop, gpuatop, allow setuid wrapper 2021-05-16 18:22:03 +02:00
github-actions[bot] b484cef365
Merge master into staging-next 2021-05-16 01:00:58 +00:00
Michael Weiss a542827c9b
nixos/sway: Update the module documentation
Most programs already run natively under Wayland so extraSessionCommands
isn't as important anymore. XWayland is already covered by
"programs.xwayland.enable = mkDefault true;" in the module.
2021-05-15 20:30:53 +02:00
github-actions[bot] f1b78f8618
Merge master into staging-next 2021-05-15 18:30:28 +00:00
Michael Weiss 73e0dd4b29
Merge pull request #123034 from primeos/sway-simplify-screen-sharing
sway: Simplify screen sharing
2021-05-15 18:38:52 +02:00
Jonathan Ringer 5a6540c49c nixos/factorio: update admin setting 2021-05-15 09:04:35 -07:00
Jonas Heinrich fff9cf00fd caddy: support user and group options 2021-05-15 10:32:49 +02:00
github-actions[bot] c48794dcef
Merge master into staging-next 2021-05-15 06:22:22 +00:00