Commit graph

18438 commits

Author SHA1 Message Date
Frederik Rietdijk af81d39b87 Merge staging-next into staging 2020-09-04 20:03:30 +02:00
Jan Tojnar 951efe41e1 fixup! nixos/doc/releases: update the docs as promised 2020-09-04 10:59:06 -07:00
worldofpeace f2e98e8b36 fixup! nixos/doc/releases: update the docs as promised 2020-09-04 10:59:06 -07:00
worldofpeace d9c33b2ea4 nixos/doc/releases: update the docs as promised
This goes through a recent example of 19.09 (because the workflow
should be everchanging, so our example needs to be recent).
Lots of changes, just read idk.
2020-09-04 10:59:06 -07:00
Florian Klink 176d5e090a
Merge pull request #97008 from andersk/cryptception-1
cryptsetup, lvm2, systemd: Break cyclic dependency at a different point
2020-09-04 19:12:53 +02:00
Jan Tojnar 7ecabdc22b
Merge pull request #96992 from jtojnar/fc-dtd-urn
treewide: use URN for fontconfig DTD
2020-09-04 17:12:29 +02:00
Peter Hoeg 6ef2152b5d nixos/cachefilesd: don't set up manually
Use our available infrastructure instead of manually handling setup.
2020-09-04 16:11:55 +08:00
Bruno Bigras 64ce52713c nixos/tests/sssd-ldap: init 2020-09-04 01:51:42 -04:00
Julien Moutinho b03c506178 nixos-install: add support for flakes 2020-09-04 06:56:09 +02:00
Julien Moutinho c6a3a0f4f5 nixos-rebuild: do not depend on nix.conf to activate flakes 2020-09-04 06:56:09 +02:00
Lucas Savva 1b6cfd9796
nixos/acme: Fix race condition, dont be smart with keys
Attempting to reuse keys on a basis different to the cert (AKA,
storing the key in a directory with a hashed name different to
the cert it is associated with) was ineffective since when
"lego run" is used it will ALWAYS generate a new key. This causes
issues when you revert changes since your "reused" key will not
be the one associated with the old cert. As such, I tore out the
whole keyDir implementation.

As for the race condition, checking the mtime of the cert file
was not sufficient to detect changes. In testing, selfsigned
and full certs could be generated/installed within 1 second of
each other. cmp is now used instead.

Also, I removed the nginx/httpd reload waiters in favour of
simple retry logic for the curl-based tests
2020-09-04 01:09:43 +01:00
Anders Kaseorg f4b2c9dfe7 cryptsetup, lvm2, systemd: Break cyclic dependency at a different point
The cyclic dependency of systemd → cryptsetup → lvm2 → udev=systemd
needs to be broken somewhere.  The previous strategy of building
cryptsetup with an lvm2 built without udev (#66856) caused the
installer.luksroot test to fail.  Instead, build lvm2 with a udev built
without cryptsetup.

Fixes #96479.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
2020-09-03 12:35:56 -07:00
Janne Heß 8cf4ec8b97
nixos/systemd: Don't use apply for $PATH
When not using apply, other modules can use $PATH as a list instead of
getting a colon-separated list to each /bin directory.
2020-09-03 20:27:55 +02:00
Philipp Bartsch c46dd4e221 nixos/doc: add opendkim changes to release notes 2020-09-03 18:03:28 +02:00
Philipp Bartsch 47928442a8 nixos/opendkim: add keyPath to ReadWritePaths 2020-09-03 17:54:16 +02:00
Philipp Bartsch 118f341723 nixos/opendkim: add systemd service sandbox 2020-09-03 17:54:15 +02:00
Daniël de Kok 7b73713a98 programs.zsh: remove unnecessary with 2020-09-03 08:42:24 +02:00
Jörg Thalheim 02a2649220
Merge pull request #89748 from heinic/krb5-lists 2020-09-03 07:31:22 +01:00
Jan Tojnar 6dd3b54ccc
treewide: use URN for fontconfig DTD
To match upstream change:

9c46ef4aac
2020-09-03 06:39:00 +02:00
WORLDofPEACE 8739e4235e
Merge pull request #96925 from jtojnar/gpaste-session-path
nixos/gpaste: return sessionPath
2020-09-02 15:43:53 -04:00
Lucas Savva 61dbf4bf89
nixos/acme: Add proper nginx/httpd config reload checks
Testing of certs failed randomly when the web server was still
returning old certs even after the reload was "complete". This was
because the reload commands send process signals and do not wait
for the worker processes to restart. This commit adds log watchers
which wait for the worker processes to be restarted.
2020-09-02 19:25:30 +01:00
Lucas Savva 982c5a1f0e
nixos/acme: Restructure module
- Use an acme user and group, allow group override only
- Use hashes to determine when certs actually need to regenerate
- Avoid running lego more than necessary
- Harden permissions
- Support "systemctl clean" for cert regeneration
- Support reuse of keys between some configuration changes
- Permissions fix services solves for previously root owned certs
- Add a note about multiple account creation and emails
- Migrate extraDomains to a list
- Deprecate user option
- Use minica for self-signed certs
- Rewrite all tests

I thought of a few more cases where things may go wrong,
and added tests to cover them. In particular, the web server
reload services were depending on the target - which stays alive,
meaning that the renewal timer wouldn't be triggering a reload
and old certs would stay on the web servers.

I encountered some problems ensuring that the reload took place
without accidently triggering it as part of the test. The sync
commands I added ended up being essential and I'm not sure why,
it seems like either node.succeed ends too early or there's an
oddity of the vm's filesystem I'm not aware of.

- Fix duplicate systemd rules on reload services

Since useACMEHost is not unique to every vhost, if one cert
was reused many times it would create duplicate entries in
${server}-config-reload.service for wants, before and
ConditionPathExists
2020-09-02 19:22:43 +01:00
Félix Baylac-Jacqué 09c383c17a
Merge pull request #94917 from ju1m/biboumi
nixos/biboumi: init
2020-09-02 17:43:27 +02:00
Serval 4ac99e76bc
nixos/tests/v2ray: init 2020-09-02 22:18:52 +08:00
WORLDofPEACE 31008a8f15
Merge pull request #96937 from jtojnar/drop-strigi
strigi: drop
2020-09-02 08:53:24 -04:00
WORLDofPEACE 18348c7829
Merge pull request #96042 from rnhmjoj/loaOf
treewide: completely remove types.loaOf
2020-09-02 08:45:37 -04:00
Sascha Grunert 27b0c4b151 nixos/containers: add oci-seccomp-bpf-hook
Signed-off-by: Sascha Grunert <sgrunert@suse.com>
2020-09-02 21:53:37 +10:00
Julien Moutinho f333296776 nixos/biboumi: init 2020-09-02 08:31:53 +02:00
WORLDofPEACE 765d0371a8
Merge pull request #96879 from romildo/rm.deepin.doc
deepin: register removal in release notes, aliases and module list
2020-09-02 02:25:43 -04:00
Orivej Desh 1a68e21d47
nixos/systemd: support adding and overriding tmpfiles.d via environment.etc (#96766)
This allows the user to configure systemd tmpfiles.d via
`environment.etc."tmpfiles.d/X.conf".text = "..."`, which after #93073
causes permission denied (with new X.conf):

```
ln: failed to create symbolic link '/nix/store/...-etc/etc/tmpfiles.d/X.conf': Permission denied
builder for '/nix/store/...-etc.drv' failed with exit code 1
```

or collision between environment.etc and systemd-default-tmpfiles
packages (with existing X.conf, such as tmp.conf):

```
duplicate entry tmpfiles.d/tmp.conf -> /nix/store/...-etc-tmp.conf
mismatched duplicate entry /nix/store/...-systemd-246/example/tmpfiles.d/tmp.conf <-> /nix/store/...-etc-tmp.conf
builder for '/nix/store/...-etc.drv' failed with exit code 1
```

Fixes #96755
2020-09-02 02:54:11 +00:00
John Ericson 1965a241fc
Merge pull request #61019 from volth/gcc.arch-amd
platform.gcc.arch: support for AMD CPUs
2020-09-01 22:31:16 -04:00
Jan Tojnar 77293baff0
strigi: drop
It has not been used by KDE for many years and depends on umaintained libraries we want to drop (Qt4 and Gamin).
2020-09-02 02:05:40 +02:00
José Romildo Malaquias 3b92996c0b nixos/doc: document removal of deepin in the release notes 2020-09-01 19:46:34 -03:00
rnhmjoj 3f8a3246f4
nixos/lib/make-options-doc: remove loaOf subs
Remove the substitution for the <name?> placeholder used by loaOf,
now that the type has been deprecated.
2020-09-02 00:42:51 +02:00
rnhmjoj bc62423a87
nixos/doc: convert loaOf options refs to attrsOf 2020-09-02 00:42:51 +02:00
rnhmjoj 20d491a317
treewide: completely remove types.loaOf 2020-09-02 00:42:50 +02:00
José Romildo Malaquias b5c9c03fac nixos/deepin: register as a removed module 2020-09-01 19:42:08 -03:00
Jan Tojnar 3b68a757ff
nixos/gpaste: return sessionPath
GPaste ships keybindings for gnome-control-center. Those depend on GSettings schemas
but there is currently no mechanism for loading schemas other than using global ones
from $XDG_DATA_DIRS. Eventually, I want to add such mechanism but until then,
let's return the impure sessionPath option that was removed in
f63d94eba3
2020-09-01 22:21:09 +02:00
Aaron Andersen c51e7b7874 nixos/beanstalkd: add openFirewall option 2020-09-01 10:07:28 -04:00
Robert Hensing c914fffeba
Merge pull request #95894 from alexarice/agda-release-notes
Agda: add release notes
2020-09-01 12:26:14 +02:00
Sascha Grunert 46a0aa4176 nixos/cri-o: unset hooks dir to avoid dir creation on startup
Signed-off-by: Sascha Grunert <sgrunert@suse.com>
2020-09-01 18:04:54 +10:00
Lassulus a081e99e41
Merge pull request #83780 from hax404/robustirc-bridge
robustirc-bridge: init at 1.8
2020-08-31 18:14:45 +02:00
Frederik Rietdijk 303e0bca3b
Merge pull request #96610 from romildo/rm.deepin
deepin: remove from nixpkgs
2020-08-31 17:58:11 +02:00
Georg Haas 2bd6f0744f
nixos/tests/robustirc-bridge: init 2020-08-31 15:22:50 +02:00
Peter Hoeg 07408cac94 nixos/phpfpm: always restart service on failure 2020-08-31 21:19:54 +08:00
Arian van Putten 882ed6759a
Merge pull request #96149 from JJJollyjim/acme-test-go-15
nixos/acme: fix subjectAltName in test snakeoil certs
2020-08-31 13:54:19 +02:00
WORLDofPEACE bd5a11f925
Merge pull request #96712 from andersk/disable-macvlan
nixosTests: Disable networking.networkd.macvlan
2020-08-30 21:49:19 -04:00
Anders Kaseorg a05b9042b8 nixosTests: Disable networking.networkd.macvlan
This test is failing nondeterministically.  Fixes #96709.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
2020-08-30 17:43:34 -07:00
WORLDofPEACE 5c67236602
Merge pull request #96703 from andersk/revert-test-logging
Revert “nixos/test-driver: use pythons logging module” (#96254)
2020-08-30 19:08:06 -04:00
Anders Kaseorg 59b6664f15 Revert "Merge pull request #96254 from Mic92/logging"
This reverts commit 4fc708567f, reversing
changes made to 0e54f3a6d8.

Fixes #96699.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
2020-08-30 15:46:39 -07:00
Anders Kaseorg a0a421bf5e Revert "Merge pull request #96152 from JJJollyjim/colour-test-machines-staging"
This reverts commit 1bff6fe17c, reversing
changes made to 2995fa48cb.

There’s presumably nothing wrong with this PR, except that it
conflicts with reverting #96254 which broke several tests (#96699).

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
2020-08-30 15:45:44 -07:00
Silvan Mosberger 6716867eb3
Merge pull request #96686 from nixy/add/tor-package-option
tor: Add option to tor service for package
2020-08-30 23:02:37 +02:00
Félix Baylac-Jacqué f63c842f1e
nixosTests.systemd-networkd: fix test flakiness
The original idea for this test was, on top of providing a networkd
test, to provide newcomers with a sample configuration they could use
to get started with networkd.

That's precisely why we were doing this systemd tmpfile dance in the
first place. It was a convenient way to create a runtime file with a
specific mode and owner.

Sadly, this tmpfile rule made the test flaky. There's a race condition
between the wireguard interface configured by systemd-networkd and
systemd-tmpfiles-setup.

Sometimes, networkd is going to try loading the wireguard private key
file *before* the said file gets created by systemd-tmpfiles.

A perfect solution here would be to create a "After" dependency
between wg0.netdev and systemd-tmpfiles-setup.service. Sadly, it is
currently impossible to create such a dependency between a
networkd-specific unit and a service.

We're removing this tmp file in favor of pointing networkd directly to
the Nix store. This is clearly something that shouldn't be done in the
real world for a private file: the store is world-readable. However,
this is the only way I found to fix this test flakiness for now.
2020-08-30 21:03:27 +02:00
Andrew R. M 168a9c8d38 Add option to tor service for package 2020-08-30 14:35:36 -04:00
José Romildo Malaquias b768afb2e9 deepin: remove from nixpkgs
The Deepin Desktop Environment (DDE) is not yet fully packaged in
nixpkgs and it has shown a very difficult task to complete, as
discussed in https://github.com/NixOS/nixpkgs/issues/94870. The
conclusion is that it is better to completely remove it.
2020-08-30 15:27:42 -03:00
Georg Haas 9376dd8516
nixos/modules/robustirc-bridge: init 2020-08-30 18:34:22 +02:00
Doron Behar 5789ffc509 nixos/syncthing: add ignoreDelete folder option 2020-08-30 10:55:03 +03:00
Matthew Bauer fc726e3494 Revert "nixos/nix-daemon.nix: assert distributedBuilds and buildMachines!=[]"
This reverts commit 67b6e56391.
This reverts commit 250885d0ca.

Causes issues for some configs, see 67b6e56391
2020-08-29 22:39:24 -05:00
Maximilian Bosch d416facd39
nixos/tests/systemd-networkd: fix eval
In `systemd-243` the option `FwMark` in the `[WireGuard]` section of
a `.netdev`-unit has been renamed to `FirewallMark`[1]. Due to the
removal of deprecated options in our `networkd` module[2] the evaluation
of this test doesn't work.

Renaming the option to its new name fixes the issue.

[1] 1c30b174ed
[2] e9d13d3751
2020-08-29 22:51:30 +02:00
edef fcdfa881c8
Merge pull request #96589 from deviant/nre-improvements
`nixos-rebuild edit` improvements
2020-08-29 17:26:09 +00:00
Jan Tojnar b49a769970
fontconfig: get rid of rest of versioned configs
The incompatibility does not seem to exist any more: programs linked against fc 2.12
on fc 2.14 system seem to at least display text, even while printing tons of errors
(as long as you generate fc cache manually), and same thing the other way around.
Hopefully it will not be an issue in the future.
2020-08-29 19:16:22 +02:00
Florian Klink c376f3ec11
Merge pull request #96571 from aszlig/nixos-tests-sleep-guest-time
nixos/test-driver: Use guest time when using sleep
2020-08-29 17:09:35 +02:00
Lassulus a55bb108fc
Merge pull request #85328 from langston-barrett/lb/restart-dispatcher
nixos/networkmanager: restart dispatcher when nameservers change
2020-08-29 16:24:28 +02:00
Aaron Andersen af25b37814
Merge pull request #96316 from aanderse/redmine
nixos/redmine: replace extraConfig option with settings option
2020-08-29 09:13:13 -04:00
Aaron Andersen bcdcd5d9fc
Merge pull request #95880 from aanderse/postgresql-settings
nixos/postgresql: replace extraConfig option with settings option
2020-08-29 09:12:54 -04:00
Frederik Rietdijk 7b56d26ae3 Merge master into staging-next 2020-08-29 13:30:25 +02:00
Robert Hensing 4841b30784
Merge pull request #94804 from hercules-ci/init-nixos-hercules-ci-agent
nixos/hercules-ci-agent: init
2020-08-29 10:20:14 +02:00
V e08bcdbec3 nixos-rebuild: don't quote $EDITOR
$EDITOR is allowed to contain flags, so it is important to allow the
shell to split this normally. For example, Sublime Text needs to be
passed --wait, since otherwise it will daemonise.
2020-08-29 09:54:14 +02:00
V be193a2057 nixos-rebuild: make 'edit' work with directories
$NIXOS_CONFIG can be set to a directory, in which case the file used
is $NIXOS_CONFIG/default.nix. This updates 'nixos-rebuild edit' to
handle that case correctly.
2020-08-29 09:54:02 +02:00
aszlig b0ac24ae41
nixos/test-driver: Use guest time when using sleep
With the Perl driver, machine.sleep(N) was doing a sleep on the guest
machine instead of the host machine. The new Python test driver however
uses time.sleep(), which instead sleeps on the host.

While this shouldn't make a difference most of the time, it *does*
however make a huge difference if the test machine is loaded and you're
sleeping for a minimum duration of eg. an animation.

I stumbled on this while porting most of all my tests to the new Python
test driver and particularily my video game tests failed on a fairly
loaded machine, whereas they don't with the Perl test driver.

Switching the sleep() method to sleep on the guest instead of the host
fixes this.

Signed-off-by: aszlig <aszlig@nix.build>
2020-08-29 00:55:01 +02:00
worldofpeace f2d0a68c21
Merge pull request #96396 from flokli/remove-perl-test-driver
nixos/lib/test*: remove perl test driver
2020-08-28 11:30:18 -04:00
Daniël de Kok 192ed0a00e
Merge pull request #95888 from bzizou/charliecloud18
charliecloud: 0.12 -> 0.18
2020-08-28 16:34:57 +02:00
Bruno Bzeznik 1601ff7dd4 charliecloud: 0.12 -> 0.18 (docker + ch-grow support) 2020-08-28 14:39:21 +02:00
Maximilian Bosch 612a012c1c
Merge pull request #86486 from flokli/networking-tests-add
nixosTests: re-enable networking tests
2020-08-28 13:56:12 +02:00
Daniël de Kok db77fb705e
Merge pull request #96497 from NickHackman/emacs-documentation-typo-fix
Fix typo in services/editors/emacs documentation
2020-08-28 10:43:50 +02:00
Joachim F 18c52dadfe
Merge pull request #96034 from saschagrunert/apparmor
apparmor: add apparmor_parser config file
2020-08-28 08:08:25 +00:00
Frederik Rietdijk efb45f7638 Merge master into staging-next 2020-08-28 09:54:31 +02:00
Nick Hackman 626bd1f111 Fix typo in services/editors/emacs documentation
In section `sec-modify-via-packageOverrides`: is -> if
2020-08-27 16:58:52 -04:00
Lassulus 7c509270d6
Merge pull request #96460 from sorki/sdImage_post_build
nixos/sdImage: add postBuildCommands
2020-08-27 21:02:20 +02:00
Richard Marko 170e1afd84 nixos/sdImage: add postBuildCommands
This allows to perform `dd if= of=$img` after the image is built
which is handy to add e.g. uBoot SPL to the built image.

Instructions for some ARM boards sometimes contain this step
that needs to be performed manually, with this patch it can be
part of the nix file used to built the image.
2020-08-27 20:18:18 +02:00
Florian Klink 0620184f3f nixos/lib/test*: remove perl test driver
This has been deprecated in 20.03, and all tests have been migrated to
the python framework, effectively making this dead code.
2020-08-27 19:45:38 +02:00
Matthew Bauer 3814422afa
Merge pull request #96218 from matthewbauer/cage-supply-pam-environment
nixos/cage: supply pamEnvironment
2020-08-27 10:15:29 -05:00
Matthew Bauer fe8d0c2e0b nixos/cage: supply pamEnvironment
Without this, you don’t get any of the sessionVariables in the cage
application. Things like XDG_DATA_DIRS, XCURSOR_PATH, etc. are
missing.
2020-08-27 10:11:45 -05:00
Jamie McClymont d7875caf76 nixos/test: colour machine names 2020-08-27 23:29:55 +12:00
Florian Klink 656f88a59c nixosTests: re-enable networking tests
5150378c2f fixed the long-broken
nixosTests.networking.virtual.

With all tests failures fixed, and #79328 making debugging much easier,
let's re-add it to the tested jobset.
2020-08-27 12:17:03 +02:00
Lassulus c265ca02ca
Merge pull request #85963 from seqizz/g_physlock_message
physlock: add optional lock message
2020-08-27 10:18:34 +02:00
Matthew Bauer 25ac498482
Merge pull request #96404 from matthewbauer/gcc-cross
Fix cycle detected in Darwin->Linux cross GCC
2020-08-26 16:17:14 -05:00
Aaron Andersen 2a44265608 nixos/postgresql: replace extraConfig option with settings option 2020-08-26 17:06:48 -04:00
Florian Klink 36e4ec8568
Merge pull request #96349 from helsinki-systems/feat/postgresql-wal-python
tests/postgresql-wal-receiver: Port to Python
2020-08-26 21:08:15 +02:00
Jörg Thalheim 4fc708567f
Merge pull request #96254 from Mic92/logging 2020-08-26 19:45:24 +01:00
Matthew Bauer ca3fa9c32a
Merge pull request #95956 from matthewbauer/qemu-cpu-max
runInLinuxVM, test-driver: use -cpu max instead of -cpu host
2020-08-26 12:59:57 -05:00
Lassulus e453860b8f
Merge pull request #86236 from ThibautMarty/fix-nullOr-types
treewide: fix modules options types where the default is null
2020-08-26 18:21:29 +02:00
Vladimír Čunát e02793de2f
nixos installer tests: add a missing package
Tested it locally fixes #96361
nix-build nixos/release-combined.nix -A nixos.tests.installer.lvm.x86_64-linux -Q
2020-08-26 18:14:34 +02:00
Lassulus 12baef56e4
Merge pull request #96127 from hmenke/shadowsocks
shadowsocks service: support plugins
2020-08-26 16:49:55 +02:00
Janne Heß ead6de5d3d
tests/postgresql-wal-receiver: Port to Python
... and remove some weirdnesses.

- Port to Python
- Drop the extra pkgs, config, system args
- Drop all `with`
- Don't override the standard PostgreSQL directory
- Use pkgs and lib from the test runner

Tested with:
- postgresql_12
- postgresql_11
- postgresql_10
- postgresql_9_6
- postgresql_9_5

Closes #96347
cc @flokli
2020-08-26 16:37:24 +02:00
Joachim F 1ad014b3d0
Merge pull request #96080 from Izorkin/unprivileged-userns-clone
nixos/security/misc: add option unprivilegedUsernsClone
2020-08-26 14:20:51 +00:00
Robert Hensing 4d43de37b2 nixos/nixpkgs.nix: Correct crossSystem default literal
The default is null and the documentation should reflect that.
2020-08-26 13:35:35 +02:00
Aaron Andersen a7c69047df nixos/redmine: remove database.password option 2020-08-26 07:08:07 -04:00
Aaron Andersen 6cf743e52d nixos/redmine: allow user to override contents of additional_environment.rb 2020-08-26 07:08:07 -04:00
Aaron Andersen dee97b8b44 nixos/redmine: replace extraConfig option with settings option 2020-08-26 07:08:07 -04:00