Commit graph

12628 commits

Author SHA1 Message Date
Bas van Dijk cd4486ecc3 nixos/prometheus/alertmanager: use DynamicUser instead of nobody
See issue #55370
2019-04-10 20:38:40 +02:00
Bas van Dijk 739bdff4a4 nixos/prometheus/alertmanager: use ExecStart instead of script
This results in a simpler service unit which doesn't first have to
start a shell:

  > cat /nix/store/s95nsr8zbkblklanqpkiap49mkwbaq45-unit-alertmanager.service/alertmanager.service
  ...
  ExecStart=/nix/store/4g784lwcy7kp69hg0z2hfwkhjp2914lr-alertmanager-0.16.2-bin/bin/alertmanager \
    --config.file /nix/store/p2c7fyi2jkkwq04z2flk84q4wyj2ggry-checked-config \
    --web.listen-address [::1]:9093 \
    --log.level warn
  ...
2019-04-10 15:03:09 +02:00
Linus Heckemann 4557373d68
Merge pull request #58858 from worldofpeace/pantheon/lightdm-gtk-greeter
nixos/pantheon: enable lightdm gtk greeter
2019-04-10 09:36:20 +02:00
Robin Gloster f370553f8f
Merge pull request #58804 from Ma27/roundcube-fixes
roundcube: minor fixes
2019-04-09 18:30:00 +00:00
aszlig f98b4b0fda
nixos: Fix build of manual
Commit 29d7d8f44d has introduced another
section with the ID "sec-release-19.09-incompatibilities", which
subsequently causes the build to fail.

I just merged both sections and the manual is now building again.

Signed-off-by: aszlig <aszlig@nix.build>
2019-04-09 17:18:43 +02:00
Bas van Dijk 2f2e2971d6
Merge pull request #58255 from jbgi/prometheus2
Add Prometheus 2 service in parallel with 1.x version (continuation)
2019-04-09 14:14:18 +02:00
Bas van Dijk b423b73adc nixos/doc: add Prometheus stateDir handling to rl-1909.xml 2019-04-09 13:13:44 +02:00
Bas van Dijk c95179b52f nixos/prometheus: add back the option services.prometheus.dataDir
This is to ensure more backwards compatibility. Note this is not 100%
backwards compatible because we now require dataDir to begin with /var/lib/.
2019-04-09 13:13:34 +02:00
Bas van Dijk 7062a073e8 elk: 6.5.1 -> 6.7.1 2019-04-09 12:34:01 +02:00
Robin Gloster a58ab8fc05
Merge pull request #58398 from Ma27/package-documize
documize-community: init at 2.2.1
2019-04-08 22:34:11 +00:00
Maximilian Bosch acbb74ed18
documize-community: init at 2.2.1
Documize is an open-source alternative for wiki software like Confluence
based on Go and EmberJS. This patch adds the sources for the community
edition[1], for commercial their paid-plan[2] needs to be used.

For commercial use a derivation that bundles the commercial package and
contains a `$out/bin/documize` can be passed to
`services.documize.enable`.

The package compiles the Go sources, the build process also bundles the
pre-built frontend from `gui/public` into the binary.

The NixOS module generates a simple `systemd` unit which starts the
service as a dynamic user, database and a reverse proxy won't be
configured.

[1] https://www.documize.com/get-started/
[2] https://www.documize.com/pricing/
2019-04-08 23:54:57 +02:00
Linus Heckemann 0ce382d868 rl-1903: pantheon notes phrasing/organisation 2019-04-08 16:22:58 -04:00
Ingo Blechschmidt efff2e1aa6 iodine: improve password handling (#58806)
Before this change, only passwords not containing shell metacharacters could be
used, and because the password was passed as a command-line argument, local
users could (in a very small window of time) record the password and (in an
indefinity window of time) record the length of the password.

We also use the opportunity to add a call to `exec` in the systemd start
script, so that no shell needs to hang around waiting for iodine to stop.
2019-04-08 21:20:26 +02:00
Bas van Dijk 29d7d8f44d nixos/doc: added the Prometheus changes to the 19.09 release notes 2019-04-08 19:39:22 +02:00
Bas van Dijk eed84d1f8d nixos/prometheus: fix indentation and unnecessary parenthesis 2019-04-08 19:14:42 +02:00
Samuel Dionne-Riel ef0ca61215
Merge pull request #58027 from DanielFabian/gfxpayload
grub: Add gfxpayload
2019-04-08 10:06:59 -04:00
Bas van Dijk 394970047e nixos/tests: register the prometheus2 test 2019-04-08 15:24:23 +02:00
Bas van Dijk 7cf27feb2f
nixos/prometheus: get rid of empty arguments
Previously the prometheus.service file looked like:

  ExecStart=/nix/store/wjkhfw3xgkmavz1akkqir99w4lbqhak7-prometheus-1.8.2-bin/bin/prometheus -storage.local.path=/var/lib/prometheus/metrics \
    -config.file=/nix/store/zsnvzw51mk3n1cxjd0351bj39k1j6j27-prometheus.yml-check-config-checked \
    -web.listen-address=0.0.0.0:9090 \
    -alertmanager.notification-queue-capacity=10000 \
    -alertmanager.timeout=10s \
     \

  Restart=always

Now it's:

  ExecStart=/nix/store/wjkhfw3xgkmavz1akkqir99w4lbqhak7-prometheus-1.8.2-bin/bin/prometheus \
    -storage.local.path=/var/lib/prometheus/metrics \
    -config.file=/nix/store/zsnvzw51mk3n1cxjd0351bj39k1j6j27-prometheus.yml-check-config-checked \
    -web.listen-address=0.0.0.0:9090 \
    -alertmanager.notification-queue-capacity=10000 \
    -alertmanager.timeout=10s
  Restart=always
2019-04-08 14:59:12 +02:00
Bas van Dijk a59c92903e
nixos/prometheus: use ExecStart instead of a shell script
This uses fewer lines of code and one less process.
2019-04-08 14:59:12 +02:00
Daniel Fabian 84ff0956a8 grub: Add support for gfxpayload in grub. Needed for NVIDIA drivers before KMS, afaik 2019-04-08 11:34:39 +01:00
Aneesh Agrawal 24ae4ae604 nixos/sshd: Remove obsolete Protocol options (#59136)
OpenSSH removed server side support for the v.1 Protocol
in version 7.4: https://www.openssh.com/txt/release-7.4,
making this option a no-op.
2019-04-08 09:49:31 +02:00
Samuel Dionne-Riel 40d59c6e8e
Merge pull request #58976 from gilligan/remove-nodejs6
Remove nodejs-6_x which is about to enter EOL
2019-04-07 19:49:24 -04:00
worldofpeace 8f93650fe4 nixos/pantheon: add warning when not using LightDM 2019-04-07 17:51:41 -04:00
worldofpeace d3d5c674ba nixos/lightdm-greeters/pantheon: add warning 2019-04-07 17:51:19 -04:00
Florian Klink 2457510db4
Merge pull request #51918 from bobvanderlinden/var-run
tree-wide: nixos: /var/run -> /run
2019-04-07 20:09:46 +02:00
Robin Gloster 0498ba6e06
Merge pull request #59078 from dtzWill/fix-and-update/nextcloud
nextcloud: fix use of mismatched php versions, updates
2019-04-07 09:55:39 +00:00
Léo Gaspard 07fdcb348f
Merge pull request #59056 from aanderse/mod_php-sendmail
nixos/httpd: replace ssmtp with system-sendmail
2019-04-06 20:57:58 +02:00
Will Dietz 27d78f4c6c nextcloud: use same php package throughout!
`phpPackage` is 7.3 by default, but `pkgs.php` is 7.2,
so this saves the need for an extra copy of php
for the purpose of running nextcloud's cron;
more importantly this fixes problems with extensions
not loading since they are built against a different php.
2019-04-06 10:34:14 -05:00
aszlig 6fe989eaed
nixos/tests/acme: Use exact match in TOS location
Since the switch to check the nginx config with gixy in
59fac1a6d7, the ACME test doesn't build
anymore, because gixy reports the following false-positive (reindented):

  >> Problem: [alias_traversal] Path traversal via misconfigured alias.
  Severity: MEDIUM
  Description: Using alias in a prefixed location that doesn't ends with
               directory separator could lead to path traversal
               vulnerability.
  Additional info: https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md
  Pseudo config:

  server {
    server_name letsencrypt.org;

    location /documents/2017.11.15-LE-SA-v1.2.pdf {
      alias /nix/store/y4h5ryvnvxkajkmqxyxsk7qpv7bl3vq7-2017.11.15-LE-SA-v1.2.pdf;
    }
  }

The reason this is a false-positive is because the destination is not a
directory, so something like "/foo.pdf../other.txt" won't work here,
because the resulting path would be ".../destfile.pdf../other.txt".

Nevertheless it's a good idea to use the exact match operator (=), to
not only shut up gixy but also gain a bit of performance in lookup (not
that it would matter in our test).

Signed-off-by: aszlig <aszlig@nix.build>
2019-04-06 12:51:56 +02:00
Aaron Andersen 9c9a6f380e nixos/httpd: replace ssmtp with system-sendmail 2019-04-06 06:34:46 -04:00
Pierre Bourdon f8eec8dc34 environment.noXlibs: disable gnome3 support for pinentry (#59051) 2019-04-06 10:06:55 +00:00
Silvan Mosberger 82b8ff405b
Merge pull request #58778 from aanderse/davmail
nixos/davmail: set logging default to warn, instead of debug
2019-04-06 06:23:48 +02:00
Silvan Mosberger cddafbcc60
Merge pull request #57782 from bkchr/gnupg_program
programs.gnupg: Support setting the gnupg program
2019-04-05 15:43:18 +02:00
Bastian Köcher c0deb007fc programs.gnupg: Support setting the gnupg package 2019-04-05 08:49:53 +02:00
Jörg Thalheim 4aeafc6b63
tests/pdns-recursor: use waitForOpenPort as port check
This should be safer w.r.t. race conditions.
2019-04-05 02:30:28 +01:00
Jörg Thalheim e49a143ac7
Merge pull request #58982 from Mic92/pdns
pdns-recursor: 4.1.11 -> 4.1.12
2019-04-05 02:23:48 +01:00
Jörg Thalheim 6dd7483ce1
Merge pull request #57979 from 4z3/writeNginxConfig
nixos/nginx: use nginxfmt and gixy
2019-04-04 20:23:58 +01:00
Silvan Mosberger fab50f0e91
Merge pull request #57716 from dasJ/redo-icingaweb2
nixos/icingaweb2: Replace most options with toINI
2019-04-04 21:20:01 +02:00
Jörg Thalheim d8445c9925
tests/pdns-recursor: add 2019-04-04 19:42:49 +01:00
tobias pflug 0e296d5fcd
Remove nodejs-6_x which is about to enter EOL
- Remove nodejs-6_x
- Set nodejs / nodejs-slim to nodejs-8_x / nodejs-slim-8_x
- Re-generate node2nix generated files using nodejs-8_x instead
2019-04-04 18:43:06 +01:00
Peter Hoeg 61613a2512
Merge pull request #57337 from peterhoeg/m/logitech
nixos: better support for logitech devices and update relevant packages
2019-04-03 21:19:56 +08:00
Silvan Mosberger c978593908
Merge pull request #58509 from symphorien/all-fw
nixos: make hardware.enableAllFirmware enable *all* firmware
2019-04-03 06:32:16 +02:00
Maximilian Bosch 6b6348eaba
nixos/roundcube: only configure postgres config if localhost is used as database
When using a different database, the evaluation fails as
`config.services.postgresql.package` is only set if `services.postgresql` is enabled.

Also, the systemd service shouldn't have a relation to postgres if a
remote database is used.
2019-04-02 16:02:53 +02:00
Aaron Andersen 01cec5155f nixos/davmail: set logging default to warn, instead of debug 2019-04-02 09:52:32 -04:00
Franz Pletz ff36d95878
nixos/quicktun: init 2019-04-02 12:16:48 +02:00
Franz Pletz ab574424a0
Merge pull request #57789 from Ma27/wireguard-test
nixos/wireguard: add test
2019-04-02 08:11:52 +00:00
Léo Gaspard e3b87b04b7 Revert "Merge pull request #57559 from Ekleog/iso-image-reproducibilization"
This reverts commit bb32e322a5, reversing
changes made to e0b4356c0d.
2019-04-01 18:17:42 +02:00
Silvan Mosberger 86956b98e6
Merge pull request #58639 from Infinisil/update/browserpass
browserpass: 2.0.22 -> 3.0.1
2019-04-01 17:31:41 +02:00
Simon Lackerbauer 88c31ae57c
nixos/openldap: add new options 2019-04-01 17:24:33 +02:00
Florian Klink 8313a5dcd3
Merge pull request #58588 from shazow/fix/vlc
vlc: Add chromecast support; libmicrodns: Init at 0.0.10
2019-04-01 17:16:42 +02:00