Commit graph

493 commits

Author SHA1 Message Date
Jörg Thalheim 1ddb140d95
Merge pull request #53033 from netixx/openvswitch-improved-systemd
openvswitch: better integration with systemd
2020-02-21 08:24:49 +00:00
Michele Guerini Rocco d4c0e72071
Merge pull request #80504 from ben0x539/encrypted-devices-loa-warning
silence warning from #63103 in encrypted-devices.nix
2020-02-19 12:15:19 +01:00
Benjamin Herr 0f5acc5ebe silence warning from #63103 in encrypted-devices.nix 2020-02-18 20:58:40 -08:00
Florian Klink 4c8bdd1c4f nixos/filesystems: don't chown /run/keys recursively
3c74e48d9c was a bit too much, it updated
permissions of all files recursively, causing files to be readable by
the group.

This isn't a problem immediately after bootup, but on a new activation,
as tmpfiles.d get restarted then, updating the permission bits of
now-existing files.

This updates the `Z` to be a `z` (the non-recursive variant), and adds a
`d` to ensure a directory is created (which should be covered by the
initrd shell script anyway)
2020-02-11 21:52:27 +01:00
Florian Klink 3c74e48d9c nixos/filesystems: ensure keys gid on /run/keys mountpoint
boot.specialFileSystems is used to describe mount points to be set up in
stage 1 and 2.

We use it to create /run/keys already there, so sshd-in-initrd scenarios
can consume keys sent over through nixops send-keys.

However, it seems the kernel only supports the gid=… option for tmpfs,
not ramfs, causing /run/keys to be owned by the root group, not keys
group.

This was/is worked around in nixops by running a chown root:keys
/run/keys whenever pushing keys [1], and as machines had to have pushed keys
to be usable, this was pretty much always the case.

This is causing regressions in setups not provisioned via nixops, that
still use /run/keys for secrets (through cloud provider startup scripts
for example), as suddenly being an owner of the "keys" group isn't
enough to access the folder.

This PR removes the defunct gid=… option in the mount script called in
stage 1 and 2, and introduces a tmpfiles rule which takes care of fixing
up permissions as part of sysinit.target (very early in systemd bootup,
so before regular services are started).

In case of nixops deployments, this doesn't change anything.
nixops-based deployments receiving secrets from nixops send-keys in
initrd will simply have the permissions already set once tmpfiles is
started.

Fixes #42344

[1]: 884d6c3994/nixops/backends/__init__.py (L267-L269)
2020-02-05 01:53:26 +01:00
rnhmjoj 2485e6399e
nixos/networking-interfaces: change preferTempAddress to allow disabling temp addresses 2020-02-01 11:38:40 +01:00
Denys Pavlov 90b6823373 nixos/powertop: wait for hardware to initialize
We should wait until after `multi-user.target` is triggered to allow
hardware to finish initializing, such as network devices and USB drives.
This ensures `powertop --auto-tune` sets more tunables to "Good".

Fixes #66820
2020-01-09 19:45:41 +08:00
rnhmjoj c9276c1b52
nixos: unify virtual console options
This commit moves all the virtual console related options
to a dedicated config/console.nix NixOS module.

Currently most of these are defined in config/i18n.nix
with a "console" prefix like `i18n.consoleFont`,
`i18n.consoleColors` or under `boot` and are implemented
in tasks/kbd.nix.
Since they have little to do with actual internationalisation
and are (informally) in an attrset already, it makes sense to
move them to a specific module.
2019-12-20 00:27:34 +01:00
Frederik Rietdijk 7aedd744d8 Merge master into staging-next 2019-12-16 20:28:10 +01:00
Franz Pletz 0f783bc7ca
Merge pull request #75193 from Ma27/optional-networkd-gateway
nixos/networkd: only set gateway if it's explicitly specified in the module system
2019-12-15 22:15:32 +00:00
Netix (Espinet François) cd3597b486
openvswitch: better integration with systemd
Systemd dependencies for scripted mode
were refactored according to analysis in #34586.

networking.vswitches can now be used with systemd-networkd,
although they are not supported by the daemon, a nixos receipe
creates the switch and attached required interfaces (just like
the scripted version).

Vlans and internal interfaces are implemented following the
  template format i.e. each interface is
described using an attributeSet (vlan and type at the moment).
If vlan is present, then interface is added to the vswitch with
given tag (access mode). Type internal enabled vswitch to create
interfaces (see openvswitch docs).

Added configuration for configuring supported openFlow version on
the vswitch

This commit is a split from the original PR #35127.
2019-12-15 21:16:26 +01:00
Kai Wohlfahrt b1c10bc8b2 nfs: set up request-key for id mapping
A patch is necessary upstream to support multiple configs via symlinks
in /etc/request-key.d

Once that is done, we can add support for CIFS as well
2019-12-12 15:42:44 +00:00
Silvan Mosberger 4ee3e8b21d
nixos/treewide: Move rename.nix imports to their respective modules
A centralized list for these renames is not good because:
- It breaks disabledModules for modules that have a rename defined
- Adding/removing renames for a module means having to find them in the
central file
- Merge conflicts due to multiple people editing the central file
2019-12-10 02:51:19 +01:00
Maximilian Bosch ff65638bfc
nixos/networkd: only set gateway if it's explicitly specified in the module system 2019-12-08 03:30:04 +01:00
nyanloutre c082e13ecb
nixos/zfs: Adding ZED configuration options
Co-authored-by: sjau <github.com@sjau.ch>
2019-12-04 20:29:19 +01:00
Elias Probst 8d8c3cadd6 Fix typo in message (vswichtesvswitches) 2019-10-26 13:26:01 +02:00
Florian Klink c3098d182d nixos/network: remove 99-main.network
Just maching all network interfaces caused many breakages, see #18962
and #71106.

We already don't support the global networking.useDHCP,
networking.defaultGateway(6) options if networking.useNetworkd is
enabled, but direct users to configure the per-device
networking.interfaces.<name?>.… options.
2019-10-23 11:39:27 +02:00
Jörg Thalheim faa7ce3ee5
Merge pull request #70240 from woffs/pr-etc-zpool.d
nixos module zfs: provide /etc/zfs/zpool.d
2019-10-15 11:45:52 +01:00
Jörg Thalheim 9a89467606
nixos/zfs: simplify logic for scrub/autosnapshot service
This makes them consistent with the way zfs.trim is enabled
and allow to enable them by default in future.
2019-10-14 10:30:57 +01:00
Jörg Thalheim 692656daf8
nixos/zfs: avoid script derivation for trim service
Since we only have a single pipe we can save the overhead of building a derivation
when creating the zfs trim service file when building the system.
2019-10-08 11:11:06 +01:00
Jörg Thalheim a412d90e10
nixos/zfs: only enable trim if zfs is enabled
Also don't fail the service if there are no pools yet.
This might happen on installation ISOs.
2019-10-07 10:44:56 +01:00
Linus Heckemann 0b754fbe54
Merge pull request #69302 from mayflower/networkd-disallow-dhcp
networkd: disallow useDHCP
2019-10-07 11:29:04 +02:00
Frank Doepper 3065d00d74 nixos module zfs: provide /etc/zfs/zpool.d
The scripts for zpool iostat -c and zpool status -c are located in
/etc/zfs/zpool.d
2019-10-02 12:34:09 +02:00
Silvan Mosberger c75a18fea6
mkRemovedOptionModule: assert on removed options (#69419)
mkRemovedOptionModule: assert on removed options
2019-09-30 16:39:40 +02:00
Robin Gloster b08b0bcbbe mkRemovedOptionModule: assert on removed options
We don't want to ignore config that can mess up machines. In general
this should always fail evaluation, as you think you are changing
behaviour and don't, which can easily create run-time errors we can
catch early.
2019-09-30 12:07:13 +02:00
Vladimír Čunát 4c07c0fdf0
nixos network-interfaces.nix: fixup after the last change
TL;DR: ipv6 tests were broken (probably the privacy-extension stuff)
https://github.com/NixOS/nixpkgs/pull/68227#issuecomment-536159177
2019-09-28 19:33:44 +02:00
Jörg Thalheim 5a73cd4f68
nixos/zfs: Enable trim by default (#69672)
nixos/zfs: Enable trim by default
2019-09-28 10:07:12 +01:00
Svein Ove Aas e4f975765f
nixos/zfs: Enable trim by default 2019-09-27 18:35:03 +01:00
Linus Heckemann f0f3bd8d96
Merge pull request #68227 from volth/patch-362
network-interfaces.nix: escape '.' in interface names passed to sysctl
2019-09-26 12:16:24 +02:00
Robin Gloster 68b42a84fd
Merge branch 'master' into networkd-disallow-dhcp 2019-09-25 11:28:20 +02:00
Roman Volosatovs a0a3675bdf
nixos/network: replace deprecated DHCP=both by DHCP=yes 2019-09-24 11:33:36 +02:00
Robin Gloster e862dd6373
networking.useDHCP: add release notes and docs 2019-09-24 10:20:17 +02:00
Robin Gloster c26c6241ea
networking.useDHCP: disallow for networkd
This setting will be removed with the switch to systemd-networkd. The
use of per interface config is encouraged instead.
2019-09-24 10:20:16 +02:00
Mikhail Klementev d4e8f7908d NixOS/auto-upgrade: add gzip to service path
Resolves #28527
2019-09-15 16:13:29 +02:00
Andreas Rammhold 2b605e96c2
nixos/networkd: continue supporting 99-main with wildcard interface match
With systemd version 243 network units with empty match block will
generate warnigs. The reasoning seems to be that the intended behaviour
is hard to infere. Being explicit about really meaning any interface is
the reasonable thing here.

We want to get rid of this mechanism in the long run but as long as we
do not have a replacement we should stick with it and keep it in
reasonable good shape.
2019-09-08 17:14:13 +02:00
volth 8b93e5c8a4
'udev' needs absolute path to 'echo' 2019-09-06 21:27:10 +00:00
volth efccc442d9
network-interfaces.nix: escape '.' in interface names passed to sysctl 2019-09-06 21:13:28 +00:00
Vladimír Čunát f21211ebfe
Merge branch 'master' into staging 2019-09-02 23:25:24 +02:00
Silvan Mosberger 478e7184f8
nixos/modules: Remove all usages of types.string
And replace them with a more appropriate type

Also fix up some minor module problems along the way
2019-08-31 18:19:00 +02:00
Frederik Rietdijk 5061fe0c2c Merge staging-next into staging 2019-08-28 08:26:42 +02:00
volth 35d68ef143 treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
danbst d80cd26ff9 Merge branch 'master' into flip-map-foreach 2019-08-18 18:00:25 +03:00
Danylo Hlynskyi 7585496eff
Merge branch 'master' into flip-map-foreach 2019-08-05 14:09:28 +03:00
danbst 0f8596ab3f mass replace "flip map -> forEach"
See `forEach`-introduction commit.
```
rg 'flip map ' --files-with-matches | xargs sed -i 's/flip map /forEach /g'
```
2019-08-05 14:03:38 +03:00
danbst 91bb646e98 Revert "mass replace "flip map -> foreach""
This reverts commit 3b0534310c.
2019-08-05 14:01:45 +03:00
Frederik Rietdijk 7560e2d64f
Merge pull request #65376 from abbradar/mdadm-upstream
Use upstream units for mdadm
2019-08-03 08:06:07 +02:00
Nikolay Amiantov 717b8b3219 systemd service: remove generator-packages option
Use systemd.packages instead, it's less error prone and more in line with
what's expected.
2019-08-01 00:55:35 +03:00
Nikolay Amiantov ca780f4a18 swraid service: use upstream units
This fixes a serious bug on NixOS with swraid where mdadm arrays weren't
properly stopped on shutdown. Rather than fixing the unit by adding
`Before=final.target` we completely move to upstream units, which uses
systemd shutdown hooks instead. This also drives down maintenance costs
for us.
2019-08-01 00:55:35 +03:00
Nikolay Amiantov fd405dab3e systemd service: rename generator-packages 2019-08-01 00:55:35 +03:00
Janne Heß ae608faa85 nixos/xfs: Add xfs_repair to the initrd
Closes #8820
2019-07-30 09:28:34 +02:00