Commit graph

21840 commits

Author SHA1 Message Date
Maximilian Bosch cc88797ce0 plausible: minor polishing 2021-06-02 19:21:31 +09:00
Maximilian Bosch 6bc72cdd4a plausiblew: cleanup build & update script 2021-06-02 19:21:31 +09:00
Maximilian Bosch 02b15d0f5b plausible: first review fix iteration
* Most significant is probably the patching necessary to run plausible
  with postgres without superuser privilege. This change includes:
  * updating ecto_sql to 3.6 where `CREATE DATABASE` is only executed if
    it doesn't exist[1].
  * patching a migration to only modify the `users.email` column (to use
    `citext` rather than creating the extension. `plausible-postgres`
    takes care of that).
* Correctly declare dependencies in systemd.
* A few minor fixes.

[1] 051baf669e
2021-06-02 19:21:31 +09:00
Maximilian Bosch b06ea1146c plausible: init at 1.3.0 2021-06-02 19:21:31 +09:00
Edward Tjörnhammar 7a4de9a983 nixos/containers: add storage.conf 2021-06-02 19:03:53 +10:00
Robert Hensing d9e4512443
Merge pull request #124589 from hercules-ci/containers-dnsname
nixos/podman-dnsname: init
2021-06-02 08:18:48 +02:00
Jörg Thalheim 79ef19e02b
Merge pull request #125169 from Mic92/containerd-zfs
nixos/containerd: improve zfs support
2021-06-01 20:43:11 +02:00
Jörg Thalheim f2e4cb7f20
nixos/containerd: improve zfs support 2021-06-01 20:41:42 +02:00
Jan Tojnar ab0d28758e
Merge pull request #125180 from chpatrick/gnome-flashback-panel-modules
gnome-flashback: add module support to gnome-panel for installing applets
2021-06-01 19:34:36 +02:00
Sandro 8217ea5000
changelog: fix typo 2021-06-01 15:45:47 +02:00
Sandro 44327ab7dc
Merge pull request #124991 from ju1m/apparmor 2021-06-01 15:26:30 +02:00
Patrick Chilton 6bcd4fe4ef gnome-flashback: add module support to gnome-panel for installing applets
Co-authored-by: Jan Tojnar <jtojnar@gmail.com>
2021-06-01 14:04:30 +02:00
Jörg Thalheim 846f44e880
Merge pull request #121667 from Mic92/buildkite
nixos/buildkite-agents: fix race-condition when installing secrets
2021-06-01 09:31:23 +02:00
Jörg Thalheim 049dc4c452
Merge pull request #125121 from ztzg/x-16304-sd-image-slack
nixos/lib/make-ext4-fs: Fix: `resize2fs -M' can leave insufficient slack
2021-06-01 06:54:22 +02:00
Jonathan Ringer 40b2ca3570 nixos/doc/releases: update stable release info to 21.05 2021-05-31 19:42:40 -07:00
Jonathan Ringer 8815e601dd nixos/release-notes: move non-highlights to other mentions 2021-05-31 19:22:35 -07:00
Jonathan Ringer d823c24094 nixos/release-notes: Initial grooming of release notes 2021-05-31 19:22:35 -07:00
Martin Weinelt e09bfc5d1c
Merge pull request #124950 from vincentbernat/fix/acme-no-reuse-key
nixos/acme: don't use --reuse-key
2021-06-01 00:59:09 +02:00
Vincent Bernat 632c8e1d54
nixos/acme: don't use --reuse-key
Reusing the same private/public key on renewal has two issues:

 - some providers don't accept to sign the same public key
   again (Buypass Go SSL)

 - keeping the same private key forever partly defeats the purpose of
   renewing the certificate often

Therefore, let's remove this option. People wanting to keep the same
key can set extraLegoRenewFlags to `[ --reuse-key ]` to keep the
previous behavior. Alternatively, we could put this as an option whose
default value is true.
2021-06-01 00:43:45 +02:00
Damien Diederen 7c2adb1d5c nixos/lib/make-ext4-fs: Fix: `resize2fs -M' can leave insufficient slack
The root filesystem resizing step, `resize2fs -M', does not provide any
control over the amount of slack left in the result.  It can produce an
arbitrarily tight fit, depending on how well the payload aligns with
ext4 data structures.

This is problematic, as NixOS must create a few files and directories
during its first boot, before the root is enlarged to match the size of
the containing SD card.

An overly tight fit can cause failures in the first stage:

    mkdir: can't create directory '/mnt-root/proc': No space left on device

or in the second stage:

    install: cannot create directory '/var': No space left on device

A previous version of `make-ext4-fs' (before PR #79368) was explicitly
"reserving" 16 MiB of free space in the final filesystem.  Manually
calculating the size of an ext4 filesystem is a perilous endeavor,
however, and the method it employed was apparently unreliable.

Reverting is consequently not a good option.

A solution would be to create some sort of "balloon" occupying inodes
and blocks in the image prior to invoking `resize2fs -M', and to remove
these temporary files/directories before the compression step.

This changeset takes the simpler approach of simply dropping the
resizing step.

Note that this does *not* result in a larger image in general, as the
current procedure does not truncate the `.img' file anyway.  In fact, it
has been observed to yield *smaller* compressed images---probably
because of some "noise" left after resizing.  E.g., before-vs-after:

    -r--r--r-- 2 root root 607M  1. Jan 1970  nixos-sd-image-21.11pre-git-x86_64-linux.img.zst

    -r--r--r-- 2 root root 606M  1. Jan 1970  nixos-sd-image-21.11pre-git-x86_64-linux.img.zst
2021-05-31 21:35:51 +02:00
Maciej Krüger ef555f6a0b
Merge pull request #123426 from mattchrist/brscan5 2021-05-31 17:52:16 +02:00
zowoq 72f54c32a6 nixos/podman-network-socket-ghostunnel: move condition to include socket 2021-05-31 23:38:31 +10:00
Robert Hensing 54f2f1e5f1 nixos/podman-dnsname: init 2021-05-31 14:31:09 +02:00
Robert Hensing d81631fb98 nixos/podman: Add defaultNetwork.extraPlugins 2021-05-31 14:31:09 +02:00
Robert Hensing efba949352 nixos/containers: Add virtualisation.containers.containersConf.cniPlugins 2021-05-31 14:29:57 +02:00
Robert Hensing 3600a82711
Merge pull request #124921 from zowoq/podman-cni-conf
podman: install cni config
2021-05-31 14:27:10 +02:00
Julien Moutinho 61654ca131 nixos/pam: use new plasma5Packages, fixes #124973 2021-05-30 21:44:25 +02:00
Andreas Rammhold 614c0b2bf3
Merge pull request #124979 from jojosch/trilium-bool
nixos/trilium: use boolToString for noBackup
2021-05-30 18:40:54 +02:00
Andreas Rammhold fcbfb5037b
Merge pull request #124972 from andir/nixos-test-driver-timeout-error
nixos/test-driver: mention the elapsed time when it times out
2021-05-30 18:30:12 +02:00
Johannes Schleifenbaum 878103ce55
nixos/trilium: use boolToString for noBackup 2021-05-30 18:16:13 +02:00
Andreas Rammhold d07f52bf81
nixos/test-driver: mention the elapsed time when it times out
For now you had to know that the actions are retried for 900s when
seeing an error like

> Traceback (most recent call last):
>   File "/nix/store/dbvmxk60sv87xsxm7kwzzjm7a4fhgy6y-nixos-test-driver/bin/.nixos-test-driver-wrapped", line 927, in run_tests
>     exec(tests, globals())
>   File "<string>", line 1, in <module>
>   File "<string>", line 31, in <module>
>   File "/nix/store/dbvmxk60sv87xsxm7kwzzjm7a4fhgy6y-nixos-test-driver/bin/.nixos-test-driver-wrapped", line 565, in wait_for_file
>     retry(check_file)
>   File "/nix/store/dbvmxk60sv87xsxm7kwzzjm7a4fhgy6y-nixos-test-driver/bin/.nixos-test-driver-wrapped", line 142, in retry
>     raise Exception("action timed out")
> Exception: action timed out

in your (hydra) build failure. Due to the absence of timestamps you were
left guessing if the machine was just slow, someone passed a low timeout
value (which they couldn't until now) or whatever might have happened.

By making this error a bit more descriptive (by including the elapsed
time) these hopefully become more useful.
2021-05-30 17:26:13 +02:00
Martin Weinelt 219d8381bd
Merge pull request #124947 from helsinki-systems/fix/libvirtd-ethertypes 2021-05-30 16:52:46 +02:00
Janne Heß 964fc7cfef
Update nixos/modules/virtualisation/libvirtd.nix
Co-authored-by: Martin Weinelt <mweinelt@users.noreply.github.com>
2021-05-30 16:00:50 +02:00
Janne Heß 2eeecef3fc
nixos/libvirtd: Take ethertypes from iptables-nftables-compat
iptables is currently defined in `all-packages.nix` to be
iptables-compat. That package does however not contain `ethertypes`.
Only `iptables-nftables-compat` contains this file so the symlink
dangles.
2021-05-30 11:55:19 +02:00
Robert Hensing db31d8354d podman: Add iproute2, fixing docker network rm 2021-05-30 11:23:25 +02:00
Robert Hensing b6570e7238 nixos/podman-network-socket-ghostunnel: init 2021-05-30 11:23:24 +02:00
Robert Hensing 52844efcd6 nixos/podman: Add generic networkSocket interface 2021-05-30 11:21:05 +02:00
Robert Hensing ff4d83a667 nixos/podman: Add dockerSocket.enable 2021-05-30 11:21:05 +02:00
Robert Hensing fb8b0a3843 nixos/podman: Change podman socket to new podman group 2021-05-30 11:21:05 +02:00
zowoq 30ae7e4ba9 nixos/podman: install cni config from package 2021-05-30 11:40:36 +10:00
markuskowa f188138af3
Merge pull request #124181 from pmenke-de/sdrplay
sdrplay: init at 3.07.1
2021-05-29 22:21:10 +02:00
Martin Weinelt ee8cf6a664
Merge pull request #124839 from mweinelt/wordpress/secret-key-regen
nixos/wordpress: regenerate secret keys if misspelled key name is found
2021-05-29 22:13:03 +02:00
Martin Weinelt 724ed08df0
nixos/wordpress: regenerate secret keys if misspelled key name is found
A secret key generated by the nixos module was misspelled, which could
possibly impact the security of session cookies.

To recover from this situation we will wipe all security keys that were
previously generated by the NixOS module, when the misspelled one is
found. This will result in all session cookies being invalidated. This
is confirmed by the wordpress documentation:

> You can change these at any point in time to invalidate all existing
> cookies. This does mean that all users will have to login again.

https://wordpress.org/support/article/editing-wp-config-php/#security-keys

Meanwhile this issue shouldn't be too grave, since the salting function
of wordpress will rely on the concatenation of both the user-provided
and automatically generated values, that are stored in the database.

> Secret keys are located in two places: in the database and in the
> wp-config.php file. The secret key in the database is randomly
> generated and will be appended to the secret keys in wp-config.php.

https://developer.wordpress.org/reference/functions/wp_salt/

Fixes: 2adb03fdae ("nixos/wordpress:
generate secrets locally")

Reported-by: Moritz Hedtke <Moritz.Hedtke@t-online.de>
2021-05-29 04:24:42 +02:00
Matt Christ dd54ac5648 brscan5: simplify mkEnableOption 2021-05-28 20:55:55 -05:00
Dominik Xaver Hörl b7630d5591 rl-2105: mention linux_latest and potential zfs issues 2021-05-28 18:10:43 -07:00
Niklas Hambüchen d344dccf3d nixos/wireguard: Remove .path systemd unit for privkey. Fixes #123203
As per `man systemd.path`:

> When a service unit triggered by a path unit terminates
> (regardless whether it exited successfully or failed),
> monitored paths are checked immediately again,
> **and the service accordingly restarted instantly**.

Thus the existence of the path unit made it impossible to stop the
wireguard service using e.g.

    systemctl stop wireguard-wg0.service

Systemd path units are not intended for program inputs such
as private key files.
This commit simply removes this usage; the private key is still
generated by the `generateKeyServiceUnit`.
2021-05-28 17:44:19 -07:00
talyz cb80b67993 nixos/discourse: Assert deployed PostgreSQL version
Assert that the PostgreSQL version being deployed is the one used
upstream. Allow the user to override this assertion, since it's not
always possible or preferable to use the recommended one.
2021-05-28 17:43:02 -07:00
talyz 1f6b48be74 discourse: 2.6.5 -> 2.7.0 2021-05-28 17:43:02 -07:00
Antoine R. Dumont (@ardumont) 38cfb84ff0 mediatomb/gerbera: Add release note information for 21.03
Note that it made into 2 entries, one about new options in the first section.
Another in the breaking compatibility section due to the openFirewall option
which changes the behavior.

Co-authored-by: schmittlauch <t.schmittlauch+nixos@orlives.de>
2021-05-28 10:56:19 -07:00
pmenke 9e0ed182aa
sdrplay: init at 3.07.1
this adds support for software defined radio (SDR) devices by SDRplay.
SDRplay provides an unfree binary library and api-service as well
as a MIT licensed adapter library for SoapySDR for integration
with many popular SDR applications.
2021-05-28 15:40:04 +02:00