Commit graph

762 commits

Author SHA1 Message Date
Symphorien Gibol b8a85fccd9 luksroot.nix: rename fallback to fallbackToPassword 2017-12-14 13:43:14 +01:00
Symphorien Gibol 601fc20248 nixos/luksroot.nix: add option boot.initrd.luks.devices.<name?>.fallback
This option, if set to true, enables fallbacking to an interactive
passphrase prompt when the specified keyFile is not found.

The default is false, which is compatible with previous behavior and
doesn't prevent unattended boot.
2017-10-23 22:22:26 +02:00
Symphorien Gibol 8158cd6d5e nixos/luksroot.nix: fallback to interactive password entry when no keyfile found 2017-10-14 18:36:03 +02:00
Joerg Thalheim 23f398012b nixos: skip restarting systemd-logind to not break x11 2017-09-27 22:28:27 +01:00
Robin Gloster 43404d9acf
systemd-tmpfiles: fix docs
We have been doing this since 4e4161c212
2017-09-24 13:17:46 +02:00
Jörg Thalheim 42be8dbe15 Merge pull request #29344 from Moredread/fix/fileystem-encrypted-keyfile-missing-initrd-support
nixos/fileystems: Fix boot fails with encrypted fs
2017-09-22 12:46:17 +01:00
Matt McHenry cfbac1beb4 systemd: better document enabled, wantedBy, and requiredBy (#29453)
the systemd.unit(5) discussion of wantedBy and requiredBy is in the
[Install] section, and thus focused on stateful 'systemctl enable'.
so, clarify that in NixOS, wantedBy & requiredBy are still what most
users want, and not to be confused with enabled.
2017-09-16 12:48:16 +02:00
André-Patrick Bubel 2000fba561
nixos/fileystems: Fix boot fails with encrypted fs
Boot fails when a keyfile is configured for all encrypted filesystems
and no other luks devices are configured. This is because luks support is only
enabled in the initrd, when boot.initrd.luks.devices has entries. When a
fileystem has a keyfile configured though, it is setup by a custom
command, not by boot.initrd.luks.

This commit adds an internal config flag to enable luks support in the
initrd file, even if there are no luks devices configured.
2017-09-14 05:27:41 +02:00
Graham Christensen 62652be111
Include date and NixOS version in systemd-boot entries
Grub configs include the NixOS version and date they were built, now
systemd can have fun too:

    version Generation 99 NixOS 17.03.1700.51a83266d1, Linux Kernel 4.9.43, Built on 2017-08-30
    version Generation 100 NixOS 17.03.1700.51a83266d1, Linux Kernel 4.9.43, Built on 2017-08-30
    version Generation 101 NixOS 17.03.1700.51a83266d1, Linux Kernel 4.9.43, Built on 2017-08-31
    version Generation 102 NixOS 17.03.1700.51a83266d1, Linux Kernel 4.9.43, Built on 2017-09-01
    version Generation 103 NixOS 17.03.1700.51a83266d1, Linux Kernel 4.9.43, Built on 2017-09-02
    version Generation 104 NixOS 17.09beta41.1b8c7786ee, Linux Kernel 4.9.46, Built on 2017-09-02
    version Generation 105 NixOS 17.09.git.1b8c778, Linux Kernel 4.9.46, Built on 2017-09-02
2017-09-02 14:28:34 -04:00
davidak 8f389f3316 nixos/bcachefs: init module 2017-08-31 05:39:31 -05:00
Symphorien Gibol 90ef2183f7 grub module: assume /nix/store is a bind mount even if it is not read only
Fixes #14999
2017-08-31 10:56:34 +02:00
danbst 65ff0d5f9d switch-to-configuration: fix detection of changes between rebuilds for template instances
This makes declarative containers truly reloadable. Current code already declares it:

56904d7c42/nixos/modules/virtualisation/containers.nix (L488)

```
  restartIfChanged = false;
```

56904d7c42/nixos/modules/virtualisation/containers.nix (L540)

```
  reloadIfChanged = true;
```

Original author: @chrisfarms in 6e36619b27
Most of stuff from that commit has already been ported.
2017-08-22 15:04:18 +03:00
Robin Gloster 485a8fef73
modules: specify some types 2017-08-04 02:20:31 +02:00
Profpatsch 5d62d8775c modules/systemd: improve logind.extraConfig example
Since we have a .handleLidSwitch option now, give an other example.
2017-08-03 03:07:05 +02:00
Volth faac018630 environment.etc: add user/group option
fixes #27546
2017-07-29 23:56:46 +01:00
Florian Jacob 3e69c650ab nixos/systemd-networkd: allow [Link] section in .network files 2017-07-29 21:25:21 +02:00
Martin Wohlert c3d5cfdc3c swap: extend randomEncryption to plainOpen and ability to select cipher 2017-07-26 20:57:10 +03:00
Graham Christensen 8df6d351c4 Merge pull request #26912 from knedlsepp/fix-autoResize
nixos: Force check the filesystem before resizing
2017-07-16 16:54:54 -04:00
Jörg Thalheim b14bcd873a Merge pull request #27142 from florianjacob/resolved-multicastdns-support
networkd: Allow new MulticastDNS setting
2017-07-13 14:35:23 +01:00
Peter Hoeg 5cb11abc9e systemd: paths and slices are supported for user units too 2017-07-13 11:55:48 +08:00
Florian Jacob cd8a1a7ceb networkd: Allow new MulticastDNS setting
which gained an implementation in systemd v233
2017-07-05 13:48:18 +02:00
Vladimír Čunát d1a89ae9d7
Merge branch 'master' into staging 2017-07-03 09:48:58 +02:00
Silvan Mosberger cf07fc6b16 luksroot: fix typo 2017-07-02 04:37:51 +02:00
Josef Kemetmueller 899e2b5748 Force check the filesystem before resizing
The message buffer of the kernel lists
> Please run 'e2fsck -f /dev/disk/by-label/nixos' first.
as the output of the command `resize2fs "$device"`.
This fixes NixOS/nixpkgs#26910.
2017-06-27 22:13:51 +02:00
Christian Albrecht 3584707638
nixos/boot/stage-1: fix failing nixos-rebuild switch because of blkid output
old version of blkid used to output version information including libblkid version
when invoked with --help parameter

new version does not output libblkid version when invoked with --help parameter

fix is to invoke blkid with -V parameter to output version including libblkid in both cases
2017-06-26 09:15:44 +02:00
Kai 9929e83607 systemd-boot-builder.py: add support for profiles (#26318)
* systemd-boot-builder.py: add support for profiles

This will also list the generations of other profiles than `system` in
the boot menu. See the documentation of the `--profile-name` option of
nixos-rebuild for more information on profiles.

* Fix errors introduced by previous commit
2017-06-24 20:33:34 +01:00
Joachim F 631ec734eb Merge pull request #26460 from romildo/fix.nixos-artwork
nixos-artwork: add more wallpapers
2017-06-13 23:20:52 +01:00
Bjørn Forsman 581226cfb4 nixos/bcache: /bin/sh -> ${bash}/bin/sh
Or else `services.udev.packages = [ bcache-tools ]` cannot be used.

To not break bcache in the initrd I'm modifying this in stage-1.nix:

  -  --replace /bin/sh ${extraUtils}/bin/sh
  +  --replace ${bash}/bin/sh ${extraUtils}/bin/sh

Reasoning behind that change:

* If not modifying the /bin/sh pattern in any way, it will also match
  ${bash}/bin/sh, creating a broken path like
  /nix/store/HASH-bash/nix/store/HASH-bash/bin/sh in the udev rule file.

* The addition of /bin/sh was done in 775f381a9e
  ("stage-1: add bcache support"). It seems somewhat plausible that
  no new users have appeared since then and we can take this opportunity
  to back out of this change without much fear of regressions.

  If there _are_ regressions, they should be in the form of build time
  errors, not runtime (boot), due to how the udev rule output is checked
  for invalid path references. So low risk, IMHO.

* An alternative approach could be to copy the /bin/sh substitute rule
  over to the non-initrd udev rules implementation in NixOS, but I think
  this way is better:
  - The rules file comes with a working path out of the box.
  - We can use more precise pattern matching when modifying the udev
    rules for the initrd.
2017-06-10 17:10:49 +02:00
Benjamin Staffin 700e22f7bf nixos: Add support for scalable fonts in Grub menus (#26227)
The default font is unreadably small on some hidpi displays. This
makes it possible to specify a TrueType or OpenType font at any point
size, and it will automatically be converted to the format the Grub
uses.
2017-06-10 09:53:24 -04:00
romildo aa8018103c nixos-artwork: add more wallpapers
Restructure the nixos-artwork to make it easy to selectively
incorporate other components from upstream without needing to download
the full package.

Until now only the Gnome_Dark wallpaper was included. Add other
wallpapers available in the package repository.
2017-06-07 18:00:58 -03:00
Jörg Thalheim 08dd6779f4
systemd-nspawn: relax PrivateUsers check
this options allows two colon-separated number as value, for instances which
is quite difficult to check.
2017-05-27 08:27:47 +01:00
Jörg Thalheim 522c16bd86
systemd-nspawn: fixes evaluation error
fixes #25097
2017-05-27 08:27:39 +01:00
Maximilian Bosch 23d1c7f474
services.logind: add options for lid-switch behavior 2017-05-23 18:57:57 +02:00
Jörg Thalheim 6fae5631b2
systemd-nspawn: add NotifyRead fixup 2017-05-20 20:32:45 +01:00
Jörg Thalheim 4698012c52
systemd-nspawn: add NotifyRead option 2017-05-20 20:31:38 +01:00
Rickard Nilsson a92bdc54e3 nixos/luks: Silence killall complain about non-existing cryptsetup processes 2017-05-16 09:50:10 +02:00
Jörg Thalheim e33848568d
systemd-boot: document reasoning behind syncfs(2) 2017-05-10 10:32:26 +01:00
Jörg Thalheim e3beb07108
systemd-boot: sync efi filesystem after update
Since fat32 provides little recovery facilities after a crash,
it can leave the system in an unbootable state, when a crash/outage
happens shortly after an update. To decrease the likelihood of this
event sync the efi filesystem after each update.
2017-05-09 19:06:27 +01:00
Jörg Thalheim fa5196e47e Merge pull request #25005 from Lassulus/copytoram
nixos/stage1: add copytoram support
2017-04-30 11:22:45 +02:00
lassulus 87a4615e27 nixos/stage1: add copytoram support 2017-04-28 20:48:09 +02:00
aszlig 72f2b506c7
nixos/grub: Add another example for extraEntries
Someone on IRC wanted to boot Fedora from another disk. While I'm not
too familiar with UEFI booting in conjunction with GRUB2 it took some
time to get it to work.

So in order to safe others from frustration I'm adding this as another
example to the extraEntries option.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-04-25 08:50:43 +02:00
aszlig e662e035f9
nixos/systemd-boot-builder: Don't write .pyc files
This has surfaced since d990aa7163.

The "simpleUefiGummiboot" installer test fails since this commit,
because that commit introduced a small check to verify whether the store
was altered.

While installing NixOS for the first time, the store is usually in
/mnt/nix/store and without the read-only bind mount that's preventing
programs from altering the store.

So after nixos-install is done creating the system closure and setting
it as the active system profile, the bootloader is written from the
closure inside the chroot. The systemd-boot-builder is invoked during
this step, which adds .pyc files for various Python modules of the
Python 3 store path, which in turn invalidates the hash of the Python 3
store path itself.

At the time the system is booted up again, the nix-store is verified and
fails with something like this:

path /nix/store/zvm545rqc4d97caqq9h7344bnd06jhzb-python3-3.5.3 was
modified! expected hash
b2c975f4b8d197443fbb09690fb3f6545e165dd44c9309d7d6df2fce0579ebeb, got
bccca19f39c9d26d857ccf1fb72818b2b817967e6d497a25a1283e36ed0acf01

Running the interpreter with the -B argument prevents Python from
writing those byte code files:

https://docs.python.org/3/using/cmdline.html#cmdoption-B

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-04-20 00:37:02 +02:00
Vladimír Čunát 91ad6b3597
Revert "grub module: fix efiInstallAsRemovable description"
This reverts commit c2b56626f1.
It broke creating the manual.  I suspect the descriptions are
auto-wrapped by <para> and </para>.

We've been through this already in 3af715af90.
/cc #24978, @zraexy, @Mic92.
2017-04-18 14:26:36 +02:00
zraexy c2b56626f1 grub module: fix efiInstallAsRemovable description 2017-04-17 14:45:56 -08:00
Domen Kožar 635822da82
nixos: escape brackets in systemd units
One day we should just whitelist instead of blacklist chars.

Fixes https://github.com/NixOS/nixops/issues/614
2017-04-12 15:56:26 +02:00
Jörg Thalheim b4820d4948 Merge pull request #24645 from Mic92/stage-2
Stage-2 cleanup
2017-04-08 21:52:22 +02:00
Jörg Thalheim 62c79a1de8
stage-2: shellsheck recommendations 2017-04-05 21:40:57 +02:00
Jörg Thalheim e3f031b200
stage-2: reduce mkdir commands 2017-04-05 21:40:51 +02:00
Michael Weiss a6420e13a2 luksroot: Wait for the header (device) to appear
The LUKS header can be on another device (e.g. a USB stick). In my case
it can take up to two seconds until the partition on my USB stick is
available (i.e. the decryption fails without this patch). This will also
remove some redundancy by providing the shell function `wait_target` and
slightly improve the output (one "." per second and a success/failure
indication after 10 seconds instead of always printing "ok").
2017-04-05 20:39:03 +02:00
Jörg Thalheim a17344c2ad
stage-2: process options as first action
this way `set -x` is set early
2017-04-05 09:05:18 +02:00