Commit graph

1541 commits

Author SHA1 Message Date
mornfall fe995cdedc Merge pull request #1775 from thoughtpolice/duo_unix
Duo Security module and uid/gid support for /etc files
2014-03-16 23:06:01 +01:00
Austin Seipp 29d46452dd nixos: add Duo Security module
This module adds the security.duosec attributes, which you can use to
enable simple two-factor authentication for NixOS logins.

The module currently provides PAM and SSH support, although the PAM unix
system configuration isn't automatically dealt with (although the
configuration is automatically built).

Enabling it is as easy as saying:

  security.duosec.ssh.enable = true;
  security.duosec.ikey       = "XXXXXXXX...";
  security.duosec.skey       = "XXXXXXXX...";
  security.duosec.host       = "api-XXXXXXX.duosecurity.com";
  security.duosec.group      = "duosec";

which will enforce two-factor authentication for SSH logins for users in
the 'duosec' group.

This requires uid/gid support in the environment.etc module.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-16 07:11:50 -05:00
William A. Kennington III a42e1d5494 notbit: Add systemd service for a system daemon 2014-03-15 04:36:15 -05:00
Corey O'Connor 40de28afca remove users.jenkins config start on slave config.
Uses standard NixOS user config merging.
Work in progress: The slave config does not actually start the slave agent. This just configures a
jenkins user if required. Bare minimum to enable a nice jenkins SSH slave.
2014-03-13 13:01:50 -07:00
Corey O'Connor 9b79d5b298 Add jenkins continuous integration server and user.
By default the jenkins server is executed under the user "jenkins". Which can be configured using
users.jenkins.* options. If a different user is requested by changing services.jenkins.user then
none of the users.jenkins options apply.

This patch does not include jenkins slave configuration. Some config options will probably change
when this is implemented.

Aspects like the user and environment are typically identical between slave and master. The service
configs are different. The design is for users.jenkins to cover the shared aspects while
services.jenkins and services.jenkins-slave cover the master and slave specific aspects,
respectively.

Another option would be to place everything under services.jenkins and have a config that selects
master vs slave.
2014-03-13 13:01:49 -07:00
Rickard Nilsson 3ed3c60d0f New NixOS module: services.solr, for running a solr server 2014-03-13 00:32:59 +01:00
Rickard Nilsson f24940330b New NixOS module: services.winstone, for running instances of the Winstone Java Servlet container 2014-03-12 23:14:09 +01:00
Rickard Nilsson 562a8ca4a2 Add phpfpm NixOS service module 2014-03-12 11:38:50 +01:00
Matej Cotman 7e932ca4e2 searx: add module 2014-03-09 17:33:56 +01:00
Austin Seipp 24cf6afa05 nixos: add Tarsnap backup service module
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-07 15:37:09 +01:00
Rok Garbas 62438c09f7 update couchdb to 1.5.0(current latest) and add service for it 2014-02-27 13:34:11 +01:00
Shea Levy efb18d9aa5 D'oh 2014-02-26 08:49:21 -05:00
Shea Levy fefc0d9917 Add module to enable the server for the ssh substituter 2014-02-20 13:40:51 -05:00
Tomasz Kontusz fe38031168 Upgrade bumblebee and add nixos module
* Bump bumblebee to 3.2.1
 * Remove config.patch - options it added can be passed to ./configure now
 * Remove the provided xorg.conf
   Provided xorg.conf was causing problems for some users,
   and Bumblebee provides its own default configuration anyway.
 * Make secondary X11 log to /var/log/X.bumblebee.log
 * Add a module for bumblebee
2014-02-09 15:09:41 +01:00
Shea Levy dea562b6b9 services.mesa -> hardware.opengl
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-08 14:45:37 -05:00
Petr Rockai 66db1b3a64 nixos: Add a dictd service. 2014-01-25 16:35:02 +01:00
Alexei Robyn 6d80803e66 Adds a service for haveged, the entropy daemon
Includes configuration option for the threshold beneath which to refill
the entropy pool - defaults to 1024 bits as this is the number used in
other distro's existing service files I looked at.
2014-01-17 22:10:52 +11:00
Shea Levy 852c270035 nixos: Split mesa setup from xserver.nix
With kmscon, it is now possible to have a system without X that still
needs the mesa setup in /run/opengl-driver

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:17:19 -05:00
Shea Levy 48daf624c5 Add module to use kmscon instead of linux-console for VTs
This required some changes to systemd unit handling:

* Add an option to specify that a unit is just a symlink
* Allow specified units to overwrite systemd-provided ones
* Have gettys.target require autovt@1.service instead of getty@1.service

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:17:19 -05:00
Thomas Bereknyei 57e3feda74 Adds kippo SSH honeypot 2014-01-14 10:32:26 +00:00
Matej Cotman 7d4d3536f7 connman: new packages ConnMan v1.20 and connman-ui 2014-01-11 20:22:53 +01:00
Bjørn Forsman 9474fbae65 nixos: add ntopng service
ntopng is a high-speed web-based traffic analysis and flow collection
tool. Enable it by adding this to configuration.nix:

  services.ntopng.enable = true;

Open a browser at http://localhost:3000 and login with the default
username/password: admin/admin.
2013-12-09 21:35:01 +01:00
Eelco Dolstra 9ee30cd9b5 Add support for lightweight NixOS containers
You can now say:

  systemd.containers.foo.config =
    { services.openssh.enable = true;
      services.openssh.ports = [ 2022 ];
      users.extraUsers.root.openssh.authorizedKeys.keys = [ "ssh-dss ..." ];
    };

which defines a NixOS instance with the given configuration running
inside a lightweight container.

You can also manage the configuration of the container independently
from the host:

  systemd.containers.foo.path = "/nix/var/nix/profiles/containers/foo";

where "path" is a NixOS system profile.  It can be created/updated by
doing:

  $ nix-env --set -p /nix/var/nix/profiles/containers/foo \
      -f '<nixos>' -A system -I nixos-config=foo.nix

The container configuration (foo.nix) should define

  boot.isContainer = true;

to optimise away the building of a kernel and initrd.  This is done
automatically when using the "config" route.

On the host, a lightweight container appears as the service
"container-<name>.service".  The container is like a regular NixOS
(virtual) machine, except that it doesn't have its own kernel.  It has
its own root file system (by default /var/lib/containers/<name>), but
shares the Nix store of the host (as a read-only bind mount).  It also
has access to the network devices of the host.

Currently, if the configuration of the container changes, running
"nixos-rebuild switch" on the host will cause the container to be
rebooted.  In the future we may want to send some message to the
container so that it can activate the new container configuration
without rebooting.

Containers are not perfectly isolated yet.  In particular, the host's
/sys/fs/cgroup is mounted (writable!) in the guest.
2013-11-27 17:14:10 +01:00
William A. Kennington III f48af13c5a Add a nix module for AMD Hybrid Graphics 2013-11-20 11:27:28 -06:00
Eelco Dolstra 2b0aea1793 Allow running NixOS services outside of systemd
The attribute ‘config.systemd.services.<service-name>.runner’
generates a script that runs the service outside of systemd.  This is
useful for testing, and also allows NixOS services to be used outside
of NixOS.  For instance, given a configuration file foo.nix:

  { config, pkgs, ... }:

  { services.postgresql.enable = true;
    services.postgresql.package = pkgs.postgresql92;
    services.postgresql.dataDir = "/tmp/postgres";
  }

you can build and run PostgreSQL as follows:

  $ nix-build -A config.systemd.services.postgresql.runner -I nixos-config=./foo.nix
  $ ./result

This will run the service's ExecStartPre, ExecStart, ExecStartPost and
ExecStopPost commands in an appropriate environment.  It doesn't work
well yet for "forking" services, since it can't track the main
process.  It also doesn't work for services that assume they're always
executed by root.
2013-11-18 18:04:17 +01:00
Eelco Dolstra d9c13a73c2 gurobi: Remove
It's proprietary, non-redistributable software.
2013-11-05 00:07:24 +01:00
Eelco Dolstra 754704ea18 Allow packages to be marked as "broken" by setting meta.broken
The effect is that they won't show up in "nix-env -qa" anymore.
2013-11-04 21:11:00 +01:00
Peter Simons 87c3907c14 Merge pull request #1168 from grwlf/nixos-gnu-screen
Add GNU Screen program module
2013-11-04 08:06:59 -08:00
Sergey Mironov 8c1e14e6cc Add GNU Screen program module 2013-11-04 19:07:51 +04:00
Eelco Dolstra 1d104c792b Remove the dhclient module
It's no longer used by NixOS (replaced by dhcpcd).
2013-10-29 17:39:32 +01:00
Rok Garbas 562b453b93 nixos: haproxy module 2013-10-29 15:55:25 +01:00
Eelco Dolstra 621f4c42f5 Disable the OpenStack (Nova) module
This hasn't been worked on in over two years, so we shouldn't give the
impression that it works.
2013-10-28 22:45:58 +01:00
Oliver Charles d792544802 services.redshift: New service 2013-10-22 09:03:06 +01:00
Domen Kožar c1b9775821 Merge pull request #1090 from NixOS/munin-rework
munin: refactor package and add nixos service
2013-10-20 08:10:28 -07:00
Domen Kožar 9230ae6522 munin: refactor package and add nixos service 2013-10-20 15:08:07 +02:00
Shea Levy 418fa3bb33 D'oh
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-16 16:01:27 -04:00
Shea Levy 715bee3a0a Add gurobi client module
Not yet tested, no license yet

Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-16 11:23:58 -04:00
Shea Levy a5a13c4e43 Add gurobi token server service
Not yet tested, I don't have a license yet

Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-16 11:02:05 -04:00
Domen Kožar 30933abb97 add prey: Proven tracking software that helps you find, lock and recover your devices when stolen or missing 2013-10-14 11:57:48 +02:00
Shea Levy a63b4dc555 Remove old efi boot stub bootloader
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-10 10:54:35 -04:00
Eelco Dolstra 5c1f8cbc70 Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00
Renamed from modules/module-list.nix (Browse further)