Commit graph

7294 commits

Author SHA1 Message Date
Eelco Dolstra b0d07aa894 Merge pull request #24533 from Zimmi48/patch-1
[doc] improve "getting the sources" chapter
2017-04-03 15:33:32 +02:00
Thomas Tuegel 03942659ca
nixos/fontconfig: remove renderMonoTTFAsBitmap 2017-04-03 08:24:32 -05:00
Thomas Tuegel 21c9190a5f
nixos/fontconfig: remove forceAutohint option 2017-04-03 08:23:32 -05:00
Thomas Tuegel 7a78892c47
nixos/fontconfig: disable autohint by default 2017-04-03 08:22:03 -05:00
Graham Christensen c7453084ef
docker: test for socket permissions 2017-04-03 09:05:41 -04:00
Alexey Shmalko fa4fe71105
docker: fix socket permissions
Docker socket is world writable. This means any user on the system is
able to invoke docker command. (Which is equal to having a root access
to the machine.)

This commit makes socket group-writable and owned by docker group.

Inspired by
https://github.com/docker/docker/blob/master/contrib/init/systemd/docker.socket
2017-04-03 09:05:37 -04:00
Shea Levy 3a26d09e15 initrd-ssh: Use initrd secrets for host keys 2017-04-02 16:33:37 -04:00
Shea Levy b09490a322 systemd-boot: Support initrd secrets 2017-04-02 16:33:37 -04:00
Shea Levy 59c0977300 Add facility to append secrets to the initrd 2017-04-02 16:33:37 -04:00
Tuomas Tynkkynen affce1e246 nixos hibernate test: Use waitForOpenPort
There was one confusing recent failure of this:

http://cache.nixos.org/log/myla8bc17j8spmifdxmrz9jswxwsf5w6-vm-test-run-hibernate.drv

I don't have any real ideas on what could cause the problem but there is
at least one theoretical one: the system starts hibernating before the
listener process manages to open the TCP port for listening, and it can't
open it after resuming because not enough pages from the netcat binary
have been paged in (and as the 9p filesystem holding it is now toast,
they can't be loaded anymore).
2017-04-02 02:33:21 +03:00
Théo Zimmermann 72070e6dfc doc: improve "getting the sources" chapter 2017-04-01 17:56:29 +02:00
Niklas Hambüchen ee0f3e7ad9 acme: Use chown -R for challenges directory. Fixes #24529.
Commit 75f131da02 added
`chown 'nginx:nginx' '/var/lib/acme'` to the pre-start script,
but since it doesn't use `chown -R`, it is possible that there
are older existing subdirs (like `acme-challenge`)
that are owned to `root` from before that commit went it.
2017-04-01 15:22:01 +02:00
Vasiliy Solovey 4fc2a86795 rl-notes 17.09: add note about idea -> jetbrains renaming 2017-04-01 12:46:27 +03:00
Eelco Dolstra 80b40fdf03
sshd.nix: Alternative fix for #19589
AFAICT, this issue only occurs when sshd is socket-activated. It turns
out that the preStart script's stdout and stderr are connected to the
socket, not just the main command's. So explicitly connect stderr to
the journal and redirect stdout to stderr.
2017-03-31 16:18:58 +02:00
Eelco Dolstra 4e79b0b075
Revert "sshd: separate key generation into another service"
This reverts commit 1a74eedd07. It
breaks NixOps, which expects that

  rm -f /etc/ssh/ssh_host_ed25519_key*
  systemctl restart sshd
  cat /etc/ssh/ssh_host_ed25519_key.pub

works.
2017-03-31 16:18:58 +02:00
Robin Gloster cbd6fb1b3a
Release Notes: tracking UIDs/GIDs is in 17.09 2017-03-31 15:51:37 +02:00
Eelco Dolstra e241fb87a1
Update 17.03 release notes 2017-03-31 15:00:30 +02:00
Jörg Thalheim 50f7a7ca2e
rtl8192su-firmware: init at unstable-2016-10-05 2017-03-31 10:49:38 +02:00
Robin Gloster 163668f6c4
Release Notes 17.03: update on master 2017-03-30 22:52:08 +02:00
sternenseemann fd3a99633b 2bwm: init at 0.2 2017-03-30 19:21:27 +02:00
Robin Gloster 8a18e1f7f1
quagga service: disable 2017-03-30 16:23:33 +02:00
Robin Gloster ce953d0bc9
panomatic: remove 2017-03-30 16:23:33 +02:00
Joachim Fasting c504e14c87
rl-notes 17.03: add notes about changes to the dnscrypt-proxy interface
(cherry picked from commit 961367717662ca84daf01a1f9ee3f9404ae659d0)
2017-03-30 13:36:08 +02:00
Joachim Fasting 543f5263d2
nixos/dnscrypt-proxy test: exercise plugin loading 2017-03-30 13:36:06 +02:00
Robin Gloster a79891f6b2
sitecopy: remove 2017-03-30 12:06:09 +02:00
Eelco Dolstra a57bcd38b4
update-users-groups.pl: Keep track of deallocated UIDs/GIDs
When a user or group is revived, this allows it to be allocated the
UID/GID it had before.

A consequence is that UIDs and GIDs are no longer reused.

Fixes #24010.
2017-03-29 18:13:18 +02:00
Bas van Dijk 1d52c677be ssmtp: use the authPassFile option instead of authPass
This gives users the option of storing the authPass outside the
world-readable Nix store.
2017-03-29 00:34:23 +02:00
Tim Steinbach eb70ae34b1 Merge pull request #24254 from bachp/gitlab-runner-9
Upgrade Gitlab Runner
2017-03-28 18:21:35 -04:00
Joachim Fasting 8427222eca
rl-notes 17.03: add note about pre-NSS dnscrypt-proxy
(cherry picked from commit de5d4dc14788bcf0c8e6ef8dd5d8f3500a568422)
2017-03-29 00:05:48 +02:00
Jörg Thalheim 36fca93290
rename iana_etc to iana-etc
fixes #23621
2017-03-28 22:35:15 +02:00
Pascal Bach 8373124202 gitlab-runner: make v1 runner available
gitlab-runner 9.0.0 is only compatible with gitlab >= 9.0
gitlab-runner1 1.11.1 is only compatible with gitlab < 9.4
2017-03-28 21:02:43 +02:00
Bas van Dijk 6f2eca1744 wordpress: replace the dbPassword option with dbPasswordFile (#24146)
We shouldn't force users to store passwords in the world-readable Nix store.
2017-03-28 17:38:16 +02:00
Clemens Fruhwirth 72ec884cc6 Make GCE image as small as possible and incorporate partition growing
when users of nixops specified a larger root disk via
deployment.gce.rootDiskSize

1GB is the smallest possible size as GCP doesn't support
fractions of GB for RAW images, see
https://cloud.google.com/compute/docs/images/import-existing-image#requirements
2017-03-27 17:41:42 +02:00
Robin Gloster d1228f95e9
Revert "Revert "gdm module: only make xserver args overrideable""
This reverts commit 4e57e7f7c6.

This actually broke gnome3 and didn't fix anything, I failed bisecting.
2017-03-27 17:20:56 +02:00
Franz Pletz 1b95985b71 Merge pull request #24148 from volth/libvirt-3.1.0
libvirt: 3.0.0 -> 3.1.0
2017-03-27 10:02:06 +02:00
aszlig ee39d4b98a
nixos/tests/virtualbox: Fix @shell@ expansion
This has surfaced since f803270b7e.

The commit bumped bash to version 4.4, which caused to change the order
of --subst-var flags in substituteAll, which this test was relying on,
because it added a @shell@ to boot.initrd.postMountCommands.

Our substituter is currently working a bit like this:

original.replace('@var1@', 'val1').replace('@var2@', 'val2')...

Unfortunately, this means that if @var2@ occurs within @var1@ it is
replaced by the new value, so the order of the substvars actually
matter. I highly doubt that we want a behaviour like this and I'm
wondering why it didn't occur to me as a problem while writing the
initial implementation of the VirtualBox tests.

Whether to get rid of this and disallowing substitution of substvars
within substvars is another topic which I think needs discussion in a
different place.

As for now, I'm using stdenv.shell, because the closure size of this
should fit within the initrd, so it's fine especially because it's just
a test.

Tested with the net-hostonlyif and systemd-detect-virt tests and they
both succeed with this change.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Reported-by: @globin on IRC
2017-03-27 04:53:17 +02:00
c74d a4ac5506f5 google-compute-image: fix Yama LSM option conflict
Having fixed the Google Compute Engine image build process's copying
of store paths in PR #24264, I ran `nixos-rebuild --upgrade switch`...
and the GCE image broke again, because it sets the NixOS configuration
option for the sysctl variable `kernel.yama.ptrace_scope` to
`mkDefault "1"`, i.e., with override priority 1000, and now the
`sysctl` module sets the same option to `mkDefault "0"` (this was
changed in commit 86721a5f78).

This patch raises the override priority of the Google Compute Engine
image configuration's definition of the Yama sysctl option to 500
(still lower than the priority of an unmodified option definition).

I have tested that this patch allows the Google Compute Engine image
to again build successfully for me.
2017-03-26 21:09:58 +02:00
Arnold Krille 68729958e8
network-interfaces: reload bridges on conf changes
And adopt the tests to add an interface and remove it again.

It should work when deactivating rstp, it will not work when activating
rstp for the first bridge as then the userspace daemon is not yet
available. But once one bridge is active with stp, it should work with
the reload for any further bridge.

Fixes #21745. Also see #22547.
2017-03-26 18:47:43 +02:00
Jörg Thalheim e0fd894d88 Merge pull request #24334 from cko/update_docu
NixOS Manual: Update version numbers
2017-03-26 11:23:32 +02:00
Edward Tjörnhammar b35d22b30c
radarr: init at 0.2.0.553 + nixos module 2017-03-25 21:19:55 +01:00
Edward Tjörnhammar 2db5c5cfe2
jackett: init at 0.7.1197 + nixos module 2017-03-25 21:19:44 +01:00
Edward Tjörnhammar 958668ab80
nixos, openafs-client: correct serviceConfig 2017-03-25 21:19:34 +01:00
Christine Koppelt e5c927cb8d NixOS Manual: Update version numbers 2017-03-25 20:14:04 +01:00
Richard Zetterberg dc10688edb nftables: adds information regarding nftables and Docker (#24326) 2017-03-25 16:34:02 +01:00
Franz Pletz d545772640
libvirt: make guest suspend work, use upstream units 2017-03-25 14:59:01 +01:00
Nikolay Amiantov 417844b596 phpfpm service: don't use private /tmp
This breaks local PostgreSQL connections.
2017-03-25 14:52:44 +01:00
Robin Gloster 6b8ad8b581
networkd: fix setting both defaultGateway{,6} 2017-03-25 14:30:05 +01:00
goibhniu 170b8da281 Merge pull request #24304 from matklad/uefi-install-docs
docs: clarify UEFI bootloader setup
2017-03-25 13:08:06 +01:00
Tuomas Tynkkynen 60788745c9 channel.nix: Use filterSource to exclude unnecessary files from nixpkgs
Currently, if you try to build a NixOS config including channel.nix, e.g.:

nix-build -I nixpkgs=. -I nixos-config=nixos/modules/installer/cd-dvd/installation-cd-minimal.nix nixos -A config.system.build.isoImage

twice in a row, you end up with two different build results. This is
caused by the 'result' symlink of the first build affecting the channel
contents of the second build.

If we use filterSource with a predicate that ignores the 'result'
symlinks, the problem is gone. Do the same thing for VIM/Emacs
swap/backup files to avoid even more 'spurious' rebuilds.

Additionally, filter out the '.git' directory at the same time, as we
'rm -rf' it from the result anyway. This avoids a considerable amount of
unnecessary file I/O copying and deleting the .git directory.
2017-03-25 01:42:28 +02:00
Leon Isenberg db30cff500 earlyoom service: init 2017-03-24 23:16:16 +01:00
Aleksey Kladov edac1d3e7a docs: clarify UEFI bootloader setup 2017-03-25 00:48:27 +03:00
Vladimír Čunát 455ce3528c
Merge branch 'staging' 2017-03-24 21:07:55 +01:00
Thomas Tuegel 352e335f3d
nixos/sddm: test automatic and manual login 2017-03-24 10:39:13 -05:00
Thomas Tuegel 5dbbb60d4f
nixos/plasma5: re-enable test
Fixes #24240.

I do not know the cause of the test failures, but the tests pass now.
2017-03-24 10:38:59 -05:00
Thomas Tuegel 27ba56f1e0
nixos/plasma5: also test SDDM theme 2017-03-24 09:45:57 -05:00
Joachim Fasting f815a7697e
dnscrypt-proxy service: systemd notification under apparmor 2017-03-24 14:37:44 +01:00
Robin Gloster 4e57e7f7c6
Revert "gdm module: only make xserver args overrideable"
This reverts commit a5aa926902.

This allows gdm to run again, the test is still failing.
2017-03-24 10:35:20 +01:00
c74d e0e520a519 google-compute-image: copy store paths with rsync
In `nixos/modules/virtualisation/google-compute-image.nix`, copy store
paths with `rsync -a` rather than `cp -prd`, because `rsync` seems
better able to handle the hard-links that may be present in the store,
whereas `cp` may fail to copy them.

I have tested that the Google Compute Engine image builds successfully
for me with this patch, whereas it did not without this patch.

This is the same fix applied for Azure images in commit
097ef6e435d5b3fcde92e67abbaaaaaf05c0723d.

Fixes #23973.
2017-03-24 02:14:10 +01:00
Jan Malakhovski 2822bacd60
nixos: xen: condition default packages on enable
Closes #23690.
2017-03-24 01:54:04 +01:00
Thomas Tuegel ae1034ea96
nixos/sddm: improve test
Disable SDDM auto-login to improve testing for SDDM themes. See #24246.
2017-03-23 19:20:27 -05:00
Robin Gloster c2b9b8031f Merge pull request #24026 from benley/use-xkbDir
nixos: Use xkbDir consistently so it has an effect
2017-03-23 18:02:26 +01:00
Vladimír Čunát c71f8f6ead
release-combined: disable plasma tests temporarily
... to get a channel bump after a long time; see #24240.
2017-03-23 16:10:04 +01:00
Robin Gloster e82baf043e
security-wrapper: link old wrapper dir to new one
This makes setuid wrappers not fail after upgrading.

references #23641, #22914, #19862, #16654
2017-03-23 15:57:30 +01:00
Robin Gloster 45f486f096
Revert "security-wrapper: Don't remove the old paths yet as that can create migration pain"
This reverts commit 4c751ced37.

This does not fix the issue as /run is now mounted with nosuid.
2017-03-23 15:57:23 +01:00
Vladimír Čunát c1a9dc3d37
Merge branch 'master' into staging 2017-03-23 13:31:28 +01:00
Symphorien Gibol a6665adde8 grub module: fix useOSProber when installing grub as EFI 2017-03-23 12:53:44 +01:00
Jörg Thalheim b2ba188656 Merge pull request #24182 from ndowens/munin
munin: 2.0.30 -> 2.0.33; for CVE-2017-6188
2017-03-22 19:21:02 +01:00
Piotr Bogdan a4b4cd0710 lightdm-greeters service: add extraConfig option (#24135) 2017-03-22 15:33:22 +01:00
Thomas Tuegel a96e047b31
nixos/sddm: replace themes option with package option 2017-03-22 07:44:55 -05:00
Thomas Tuegel 7ca62935bb
nixos/plasma5: do not include extra-cmake-modules in sddm
Fixes #24126.
2017-03-22 07:44:55 -05:00
Joachim Fasting 95eaa3aec3
nixos/tor: add missing option type 2017-03-22 02:27:23 +01:00
Jörg Thalheim b4169bb8dd
munin: fix tests by replacing cron with systemd timer 2017-03-22 00:16:36 +01:00
Eelco Dolstra 86721a5f78
Allow attaching to non-child processes by default
The inability to run strace or gdb is the kind of
developer-unfriendliness that we're used to from OS X, let's not do it
on NixOS.

This restriction can be re-enabled by setting

  boot.kernel.sysctl."kernel.yama.ptrace_scope" = 1;

It might be nice to have a NixOS module for enabling hardened defaults.

Xref #14392.

Thanks @abbradar.
2017-03-21 18:48:35 +01:00
Eelco Dolstra 78bb734452
nix-daemon.nix: Make the 1.12 check less strict 2017-03-21 18:48:35 +01:00
Nikolay Amiantov 6555ec03c3 udev module: filter duplicate udev paths
Fixes #24174
2017-03-21 20:22:27 +03:00
Nikolay Amiantov d3e2957c90 octoprint: 1.3.1 -> 1.3.2
Fix startup wizard and cleanup dependencies.
2017-03-21 20:22:27 +03:00
Carlos D e6a02918ce Expand on creating USB bootable for OS X 2017-03-21 17:31:10 +01:00
Domen Kožar 02129a8788 Merge pull request #23672 from edanaher/nginx-alias
Nginx alias directive
2017-03-21 15:04:02 +01:00
Eelco Dolstra 2cb25f8b59
nix: 1.11.7 -> 1.11.8 2017-03-21 14:49:23 +01:00
Robin Gloster f2ff646e59 Merge pull request #23641 from awakenetworks/parnell/fix-wrapper-migration
security-wrapper: Don't remove the old paths yet as that can create migration pain
2017-03-21 13:40:15 +01:00
Robin Gloster c93eb74e6a Merge pull request #23838 from mayflower/remove-md5
fetch-*: remove md5 support
2017-03-21 13:27:51 +01:00
Franz Pletz 4bd12fa7b2
gitlab module: explicitely create pages shared path
Fixes creation of backups.
2017-03-21 13:16:51 +01:00
Frederik Rietdijk 94eb74eaad Merge remote-tracking branch 'upstream/master' into HEAD 2017-03-21 13:04:37 +01:00
Frederik Rietdijk 4263c53f66 Python changelog 2017-03-21 11:05:03 +01:00
Franz Pletz fb50cde71e
nixos/treewide: systemd.time is in manvolume 7
cc #23396
2017-03-21 08:28:53 +01:00
Robin Gloster c808801937
nix-daemon: fix autoOptimiseStore option 2017-03-21 02:17:09 +01:00
Robin Gloster 5e0f932de0
rl-notes 17.03: info on python module location
closes #11567
2017-03-20 23:28:51 +01:00
Robin Gloster c066dc8416
fetch-*: add md5 support removal to rl-notes 2017-03-20 22:26:02 +01:00
Franz Pletz 295a824abc Merge pull request #21866 from pjones/pjones/rmilter
rmilter: Fix a couple of bugs
2017-03-20 20:50:56 +01:00
Franz Pletz c13922f012
nginx: explicitly use stable version
Also updates the documention of the NixOS option `services.nginx.package`
that upstream recommends using the mainline version instead.

Fixes #21665.
2017-03-20 20:04:09 +01:00
Eelco Dolstra 337f731c2b Merge pull request #24134 from pstn/nix-auto-optimise
Added option and description for nix store auto-optimisation.
2017-03-20 20:01:48 +01:00
Philipp Steinpass 68c6d90417 Added option and description for nix store auto-optimisation. 2017-03-20 19:09:19 +01:00
Franz Pletz 7151e74883
nixos: enable nginx test
cc #23279
2017-03-20 19:05:59 +01:00
Franz Pletz fff8cc79df Merge pull request #23279 from mbbx6spp/make-nginx-module-less-gross
nginx service: add commonHttpConfig option
2017-03-20 19:03:20 +01:00
Thomas Tuegel 1b0d9e9ae6 Merge pull request #23819 from ttuegel/freetype
FreeType 2.7.1 and Fontconfig defaults
2017-03-20 11:43:50 -05:00
Thomas Tuegel d458b5401a
nixos/fontconfig: add Changelog message about FreeType update 2017-03-20 10:39:48 -05:00
Thomas Tuegel 020791f7e1 Merge pull request #24125 from ttuegel/disable-kimpanel
nixos/plasma5: do not set kimpanel as default IBus panel
2017-03-20 10:23:09 -05:00
Nikolay Amiantov 179fe96a03 Merge pull request #24112 from abbradar/odroid
Add ODROID-XU{3,4} support
2017-03-20 17:44:09 +03:00
Thomas Tuegel d709cdd829
nixos/plasma5: do not set kimpanel as default IBus panel
kimpanel does not show installed IBus engines or allow switching input
methods. kimpanel does show configured keyboard layouts through kxkb, so I
believe there is some problem communicating with IBus. No error messages are
produced in the log and I have been unable to discover the cause. I have no
intention of continuing to work on kimpanel at this time, so it should be
disabled. The GTK+ 3-based panel provided by IBus is perfectly serviceable in
the interim.
2017-03-20 09:31:05 -05:00
Thomas Tuegel 4837aba1ee Merge pull request #24101 from romildo/fix.lumina
lumina: fix kwindowsystem and oxygen-icons5 attributes
2017-03-20 09:00:25 -05:00