Commit graph

15579 commits

Author SHA1 Message Date
Silvan Mosberger 9e6737710c Revert "Module-builtin assertions, disabling assertions and submodule assertions" 2020-12-18 16:44:37 +01:00
Silvan Mosberger 7698aa9776
Merge pull request #97023 from Infinisil/module-assertions
Module-builtin assertions, disabling assertions and submodule assertions
2020-12-18 14:17:52 +01:00
Lucas Savva e3120397a5 nixos/acme: Remove dependency on system version for hash
This means that all systems running from master will trigger
new certificate creation on next rebuild. Race conditions around
multiple account creation are fixed in #106857, not this commit.
2020-12-18 12:57:35 +00:00
github-actions[bot] a4876421e8
Merge master into staging-next 2020-12-18 12:22:44 +00:00
Eelco Dolstra a8c49a97a6
nix: 2.3.9 -> 2.3.10 2020-12-18 12:33:49 +01:00
Michele Guerini Rocco d7b52849f8
Merge pull request #97362 from martinetd/wakeonlan
wakeonlan service: use powerUpCommands
2020-12-18 08:39:02 +01:00
Linus Heckemann 834cc5d5fa nixos/initrd: docbookise "compressor" description 2020-12-17 23:01:08 +01:00
Silvan Mosberger 767d80099c
lib/modules: Introduce _module.checks.*.check
Previously the .enable option was used to encode the condition as well,
which lead to some oddness:
- In order to encode an assertion, one had to invert it
- To disable a check, one had to mkForce it

By introducing a separate .check option this is solved because:
- It can be used to encode assertions
- Disabling is done separately with .enable option, whose default can be
  overridden without a mkForce
2020-12-17 21:52:24 +01:00
rnhmjoj 9728907cd3
console: remove console.extraTTYs option
This closes issue #88085
2020-12-17 21:29:33 +01:00
github-actions[bot] 8c3e8bd4b9
Merge master into staging-next 2020-12-17 18:17:15 +00:00
Izorkin 299f93dfdc
nixos/samba-wsdd: fix starting 2020-12-17 20:52:30 +03:00
Andreas Rammhold fa0d499dbf
Merge pull request #106995 from andir/ml2pr/PATCH-nixos-users-groups-createHome-Ensure-HOME-permissions-fix-description
nixos/users-groups: createHome: Ensure HOME permissions, fix description
2020-12-17 17:23:46 +01:00
Dominik Xaver Hörl d4ef25db5d nixos/initrd: add compressorArgs, make compressor option public 2020-12-17 11:38:10 +01:00
Florian Klink d349582c07 nixos/network-interfaces-systemd: fix IPv6 privacy extensions
networkd seems to be buggy with IPv6PrivacyExtensions=kernel being set,
and the addresses don't appear anymore. In fact, the corresponding
sysctl seems to be set to -1 again.

Fixes https://github.com/NixOS/nixpkgs/issues/106858.
Upstream Issue: https://github.com/systemd/systemd/issues/18003
2020-12-17 07:29:25 +01:00
github-actions[bot] c40424f79b
Merge staging-next into staging 2020-12-17 00:42:56 +00:00
Doron Behar 749c9f1f19
Merge pull request #92582 from truh/plantuml-server-squash 2020-12-16 22:02:57 +02:00
Markus Kowalewski 5df0cf7461
nixos/slurm: fix dbdserver config file handling
Since slurm-20.11.0.1 the dbd server requires slurmdbd.conf to be
in mode 600 to protect the database password. This change creates
slurmdbd.conf on-the-fly at service startup and thus avoids that
the database password ends up in the nix store.
2020-12-16 20:34:14 +01:00
José Romildo Malaquias c5f07370f7 nixos/sddm: lxqt moved to libsForQt515 2020-12-16 10:43:21 -03:00
github-actions[bot] c9bbcb2fc1
Merge staging-next into staging 2020-12-16 12:21:20 +00:00
Alyssa Ross e17d4b05a1 nixos/tor: don't do privoxy stuff by default
It's very surprising that services.tor.client.enable would set
services.privoxy.enable.  This violates the principle of least
astonishment, because it's Privoxy that can integrate with Tor, rather
than the other way around.

So this patch moves the Privoxy Tor integration to the Privoxy module,
and it also disables it by default.  This change is documented in the
release notes.

Reported-by: V <v@anomalous.eu>
2020-12-16 12:20:03 +00:00
Klemens Nanni 8833983f26 nixos/users-groups: createHome: Ensure HOME permissions, fix description
configuration.nix(1) states

    users.extraUsers.<name>.createHome
        [...] If [...] the home directory already exists but is not
        owned by the user, directory owner and group will be changed to
        match the user.

i.e. ownership would change only if the user mismatched;  the code
however ignores the owner, it is sufficient to enable `createHome`:

    if ($u->{createHome}) {
        make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home};
        chown $u->{uid}, $u->{gid}, $u->{home};
    }

Furthermore, permissions are ignored on already existing directories and
therefore may allow others to read private data eventually.

Given that createHome already acts as switch to not only create but
effectively own the home directory, manage permissions in the same
manner to ensure the intended default and cover all primary attributes.

Avoid yet another configuration option to have administrators make a
clear and simple choice between securely managing home directories
and optionally defering management to own code (taking care of custom
location, ownership, mode, extended attributes, etc.).

While here, simplify and thereby fix misleading documentation.
2020-12-16 03:40:29 +01:00
github-actions[bot] bc3c95481e
Merge staging-next into staging 2020-12-16 00:41:26 +00:00
Guillaume Girol 824d2c92bd
Merge pull request #82584 from Atemu/dnscrypt-default-config
dnscrypt-proxy2: base settings on example config
2020-12-15 19:47:43 +00:00
github-actions[bot] 77b786a5d9
Merge staging-next into staging 2020-12-15 12:20:58 +00:00
Michele Guerini Rocco 12f367b51c
Merge pull request #104722 from rnhmjoj/wpa-fix
nixos/wireless: fix failure with no interfaces
2020-12-15 08:37:33 +01:00
github-actions[bot] f8d9426a1b
Merge staging-next into staging 2020-12-15 00:39:51 +00:00
Linus Heckemann c40f06022a
Merge pull request #106073 from minijackson/tinc-rfc42-and-tests
nixos/tinc: rfc42 and tests
2020-12-14 21:52:57 +01:00
github-actions[bot] ec2fa1cee8
Merge staging-next into staging 2020-12-14 12:21:13 +00:00
Linus Heckemann cc786acdce
Merge pull request #105397 from kisik21/mailman-other-mta-support
nixos/mailman: make Postfix support optional (provided you configure the MTA yourself)
2020-12-14 09:46:05 +01:00
Vika ad023b0c88
nixos/mailman: make Postfix support optional (provided you configure the MTA yourself)
Mailman can now work with MTAs other than Postfix. You'll have to configure
it yourself using the options in `services.mailman.settings.mta`.

This addition is reflected in the release notes for 21.03.
2020-12-14 02:41:30 +03:00
Minijackson 499e366d7b
nixos/tinc: add settings and hostSettings for RFC42-style options 2020-12-13 21:33:38 +01:00
Thomas Tuegel 39b76030be
Merge pull request #104810 from Thra11/plasma-5-20
Plasma 5.20.4
2020-12-13 13:50:53 -06:00
Timo Kaufmann d6dba0d7c1
Merge pull request #100774 from Atemu/startx-improvements
Startx improvements
2020-12-13 18:28:21 +01:00
Atemu d3113a62b8 nixos/startx: send Xorg log to the default location
This partially reverts bf3d3dd19b.

I don't know why we weren't getting a default logfile back then but Xorg
definitely provides one now ($XDG_DATA_HOME for regular users and /var/log for
root, see `man Xorg`)
2020-12-13 06:15:33 +01:00
Atemu 693a31ab7b nixos/xserver: make logFile configurable
It makes sense for it to be /dev/null for all the displayManagers but startx,
it needs a different logFile configuration.
2020-12-13 06:15:33 +01:00
Atemu c72c02ab26 nixos/startx: provide xserverArgs via xserverrc
Fixes #80198
2020-12-13 06:15:32 +01:00
Thomas Tuegel 58fd813daf
nixos/plasma5: install kirigami2 for SDDM theme 2020-12-12 16:07:19 -06:00
WilliButz 8727a0178f
Merge pull request #106788 from urbas/py-air-control-exporter-cli
nixos/prometheus-exporters/py-air-control: invoke exporter command
2020-12-12 21:48:01 +01:00
Matej Urbas 4970fbedbc nixos/prometheus-exporters/py-air-control: invoke exporter command
Package `py-air-control exporter` v0.1.5 comes with a new CLI. This change uses the new CLI (which simplifies the exporter's systemd service setup).
2020-12-12 20:19:54 +00:00
Florian Klink ce0fdd4dc0
Merge pull request #106697 from aanderse/mpd
nixos/mpd: conditionally provision required directories with StateDirectory
2020-12-12 20:48:54 +01:00
Jörg Thalheim 95042a58fb
Merge pull request #106751 from urbas/sd-image-first-boot-awk-missing
nixos/sd-image: explicit reference to the gawk package
2020-12-12 16:37:54 +00:00
Jörg Thalheim 5f0d38f05b
Merge pull request #106715 from Mic92/tinc 2020-12-12 16:35:59 +00:00
Matej Urbas aa38540423 nixos/sd-image: explicit reference to the gawk package
The `awk` command is not installed in the standard env. So this command fails if the `awk` command is not installed by some external module.
2020-12-12 15:43:09 +00:00
Linus Heckemann f448ec3365
Merge pull request #98731 from mayflower/ldap-nss-optional
config.users.ldap: do not include nss module if turned off
2020-12-12 10:53:39 +01:00
Linus Heckemann 54e9ee81a4
Merge pull request #106672 from alyssais/mailman
mailman: run non-minutely jobs
2020-12-12 10:12:39 +01:00
Atemu e4c49db668 nixos/dnscrypt-proxy2: base settings on example config
Dnscrypt-proxy needs some options to be set before it can do anything useful.

Currently, we only apply what the user configured which, by default, is nothing.

This leads to the dnscrypt-proxy2 service failing to start when you only set
`enable = true;` which is not a great user experience.

This patch makes the module take the example config from the upstream repo as a
base on top of which the user-specified settings are applied (it contains sane
defaults).

An option has been added to restore the old behaviour.
2020-12-12 09:15:11 +01:00
Jörg Thalheim 2cdec00dd2
nixos/tinc: add reload command 2020-12-12 07:37:16 +01:00
Aaron Andersen 77a8496907 nixos/mpd: conditionally provision required directories with StateDirectory 2020-12-11 19:35:43 -05:00
Aaron Andersen 9826371e44
Merge pull request #101224 from aanderse/ldap
nixos/ldap: restart nslcd when configuration changes
2020-12-11 17:18:12 -05:00
Guillaume Girol a7b60e6bdf
Merge pull request #104727 from chkno/fuse-dot-sshfs
nixos/locate: Fix sshfs exclusion
2020-12-11 20:32:28 +00:00
Alyssa Ross a2460414cb
nixos/mailman: run non-minutely jobs
Fixes: b478e0043c
 ("nixos/mailman: refactor")
2020-12-11 17:23:50 +00:00
Peter Hoeg aa995fb0b7 nixos/sshguard: do not do IPv6 setup/teardown unconditionally 2020-12-11 16:19:45 +08:00
Peter Simons 21b8fe302f
Merge pull request #106580 from rissson/nixos-postfix-fix-mastercf-type
nixos/postfix: fix masterCf type
2020-12-11 09:14:47 +01:00
Jörg Thalheim d22d9227f1
Merge pull request #106601 from Mic92/frab
frab: remove package
2020-12-11 05:27:55 +00:00
Jörg Thalheim 6fa3728805
frab: remove package
broken since 2018
2020-12-10 22:24:11 +01:00
Scott Worley 86f0dc221f nixos/locate: Exclude fuse.sshfs
The "fuse" and "sshfs" entries already present are not keeping this find
invocation out of sshfs mounts, which present as fstype "fuse.sshfs"
2020-12-10 12:59:13 -08:00
Maximilian Bosch 07aff199ad
Merge pull request #106080 from Ma27/nginx-config-doc
nixos/nginx: improve documentation for `config`
2020-12-10 21:54:01 +01:00
WilliButz df8ee3669f
Merge pull request #106067 from urbas/prometheus-exporter-py-air-control
nixos/prometheus-exporters/py-air-control: init
2020-12-10 20:51:56 +01:00
Matej Urbas 4948743705 nixos/prometheus-exporters/py-air-control: init 2020-12-10 19:02:30 +00:00
Marc 'risson' Schmitt 27dacb8b4b
nixos/postfix: fix masterCf type
Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
2020-12-10 18:49:05 +01:00
Maximilian Bosch 21be5b00da
Merge pull request #106473 from Ma27/improve-nextcloud-error
nixos/nextcloud: improve error message for invalid `dbpassFile`
2020-12-10 18:28:50 +01:00
Maximilian Bosch 81662d4798
nixos/nextcloud: improve error message for invalid dbpassFile
`file_exists` also returns `FALSE` if the file is in a directory that
can't be read by the user. This e.g. happens if permissions for
`nixops(1)`-deployment keys aren't configured correctly.

This patch improves the error message for invalid files to avoid
confusion[1].

[1] https://discourse.nixos.org/t/nixops-deploy-secrets-to-nextcloud/10414/4
2020-12-09 19:54:43 +01:00
Damien Diederen 98236860dc nixos/zookeeper: adapt to zookeeper 3.6.2
This patch:

  * Removes an invalid/useless classpath element;
  * Removes an unnecessary environment variable;
  * Creates the required '/version-2' data subdirectory;
  * Redirects audit logging to the "console" (systemd) by default.
2020-12-09 15:46:38 +01:00
Peng Mei Yu 3cd1a6706c unbound: Add AF_NETLINK to allowed address families.
Unbound throws the following error:

--8<---------------cut here---------------start------------->8---
error: failed to list interfaces: getifaddrs: Address family not supported by protocol
fatal error: could not open ports
--8<---------------cut here---------------end--------------->8---

The solution is pulled from upstream:
https://github.com/NLnetLabs/unbound/pull/351
2020-12-08 14:31:15 +08:00
Blaž Hrastnik 920c439915 thermald: Fix systemd service definition. 2020-12-08 08:26:36 +09:00
Maximilian Bosch 55ef9612a2
nixos/nginx: improve documentation for config
Unfortunately, I had a use-case where `services.nginx.config` was
necessary quite recently. While working on that config I had to look up
the module's code to understand which options can be used and which
don't.

To slightly improve the situation, I changed the documentation like
this:

* Added `types.str` as type since `config` is not mergeable on purpose.
  It must be a string as it's rendered verbatim into `nginx.conf` and if
  the type is `unspecified`, it can be confused with RFC42-like options.

* Mention which config options that don't generate config in
  `nginx.conf` are NOT mutually exclusive.
2020-12-06 17:26:13 +01:00
Francesco Zanini 93d74f6536 zigbee2mqtt: 1.16.1 -> 1.16.2 2020-12-05 17:42:07 +01:00
freezeboy 903b2aa9a6 nixos/n8n: init module and test 2020-12-05 11:02:40 +01:00
Linus Heckemann c14f14eeaf
Merge pull request #97505 from mayflower/grub-efi-mirroredboot
nixos/grub: allow multiple "nodev" devices for mirroredBoots
2020-12-04 18:37:50 +01:00
stigo 80e0a20892
Merge pull request #103813 from symphorien/firejail
nixos/firejail: allow to pass options to firejail
2020-12-04 09:00:15 +01:00
rnhmjoj 296c415030
nixos/fish: make generateCaches easier to override 2020-12-03 22:00:33 +01:00
rnhmjoj 87d614441d
nixos/documentation: silence man-db cache warnings
The output of the man-db command used to generate the caches is
irrelevant and can confuse users, let's hide it.
2020-12-03 21:57:09 +01:00
Gabriel Ebner 6e8007341e
Merge pull request #105362 from gebner/pipewire0137
pipewire: 0.3.16 -> 0.3.17
2020-12-03 17:15:05 +01:00
Sandro c1695ade0b
Merge pull request #105745 from archseer/thermald-2-4 2020-12-03 11:26:16 +01:00
Blaž Hrastnik 05bd810d5f thermald: Always enable adaptive mode.
There was some issues with the fallback to passive mode on 2.3, but on
2.4 adaptive mode is always enabled upstream and thermald will fallback
to passive if necessary.

a6e68a65b5/data/thermald.service.in (L9)
2020-12-03 12:45:58 +09:00
Gabriel Ebner 906d68cf13 nixos/pipewire: enable volume control via alsa 2020-12-02 22:11:09 +01:00
Gabriel Ebner b28f2f7386 nixos/pipewire: generate configuration file 2020-12-02 22:11:09 +01:00
Jörg Thalheim 11ee543052
sd-image: fix resizing if root is not the second partition. 2020-12-02 21:52:38 +01:00
Silvan Mosberger 2526f22723
Merge pull request #102076 from Taneb/hoogle-dynamic-user
Set DynamicUser=true for hoogle
2020-12-02 12:58:10 +01:00
Austin Seipp 652ac69373
Merge pull request #103393 from happysalada/add_vector
nixos/vector: add module
2020-12-02 03:30:11 -06:00
Andreas Rammhold 26cc536edf
Merge pull request #104203 from andir/saned-max-connections
nixos/sane: bump the MaxConnections to a reasonable amount
2020-12-01 19:45:13 +01:00
Jörg Thalheim b1ed5ffeab
Merge pull request #93293 from tnias/nixos_rspamd_20200716 2020-12-01 13:10:43 +00:00
Christine Dodrill 3d55480bf8
nixos/tailscale: add package as an option
This simplifies testing changes to the tailscale service on a local
machine. You can use this as such:

```nix
let
  tailscale_patched = magic {};
in {
  services.tailscale = {
    enable = true;
    package = tailscale_patched;
  };
};
```

Signed-off-by: Christine Dodrill <me@christine.website>
2020-12-01 12:30:31 +01:00
Silvan Mosberger a87ab948d2
Merge pull request #104836 from ncfavier/master
nixos/nat: support IPv6 NAT
2020-12-01 04:40:09 +01:00
Valérian Galliat b93a5a1746
nixos/nat: support IPv6 NAT 2020-12-01 00:51:58 +01:00
Silvan Mosberger 8dea4df903
lib/modules: Remove _module.checks.*.triggerPath as it's not necessary
Previously this option was thought to be necessary to avoid infinite
recursion, but it actually isn't, since the check evaluation isn't fed
back into the module fixed-point.
2020-11-30 23:51:42 +01:00
Silvan Mosberger c9cc8969b4
lib/modules: Rename _module.assertions to _module.checks 2020-11-30 23:51:41 +01:00
Silvan Mosberger 9523df7eb6
nixos/assertions: Use module-builtin assertion implementation 2020-11-30 23:51:22 +01:00
Silvan Mosberger 6df56e1cb8
Merge pull request #103866 from cole-h/doas
doas: 6.6.1 -> 6.8
2020-11-30 19:02:55 +01:00
Frederik Rietdijk 9a63b3d3d6
Merge pull request #104781 from NixOS/staging-next
Staging next
2020-11-30 18:27:29 +01:00
Nathan van Doorn 12c3e0a465 nixos/services/hoogle use DynamicUser instead of nobody
I've also removed PrivateTmp = true because this is implied by dynamic user.

I've left ProtectHome = true because I believe this is stronger than
ProtectHome = "read-only" which DynamicUser implies.
2020-11-30 13:36:19 +00:00
happysalada 627dfecadd nixos/vector: add module 2020-11-30 16:22:08 +09:00
Jörg Thalheim 3b6ef967f3
nixos/rspamd: fix postfix integration 2020-11-30 07:29:32 +01:00
Florian Klink a623bc0ba4
Merge pull request #104689 from petabyteboy/feature/gitlab-13-6-1
gitlab: 13.6.0 -> 13.6.1
2020-11-29 22:37:42 +01:00
Maximilian Bosch 752b6a95db
nixos/mautrix-telegram: update defaults
These three defaults must exist in the config now, otherwise
`mautrix-telegram` will refuse to start.
2020-11-29 21:28:07 +01:00
Gabriel Ebner 0155830275 nixos/pipewire: allow overriding the pipewire derivation 2020-11-29 17:43:07 +01:00
Gabriel Ebner ce28fd3d22 nixos/pipewire: add media-session.d files 2020-11-29 17:43:07 +01:00
Gabriel Ebner 53029a15cc nixos/pipewire: enable sound on alsa support
Otherwise sound.extraConfig has no effect.
2020-11-29 15:08:38 +01:00
Frederik Rietdijk 0d8491cb2b Merge master into staging-next 2020-11-29 13:51:10 +01:00
Sarah Brofeldt a7a5f7904c
Merge pull request #99173 from johanot/fix-initrd-ssh-commands-test
nixos/initrd-ssh: set more defensive pemissions on sshd test key
2020-11-29 11:27:03 +01:00