Commit graph

1203 commits

Author SHA1 Message Date
Rouven Czerwinski d22373b2b1 nixos/systemd: remove one DefaultBlockIOAccounting
DefaultBlockIOAccounting=yes is set twice in the same file, remove one
copy.
2020-03-29 10:56:34 +02:00
Emily d930466b77 nixos/initrd-ssh: switch from Dropbear to OpenSSH
Dropbear lags behind OpenSSH significantly in both support for modern
key formats like `ssh-ed25519`, let alone the recently-introduced
U2F/FIDO2-based `sk-ssh-ed25519@openssh.com` (as I found when I switched
my `authorizedKeys` over to it and promptly locked myself out of my
server's initrd SSH, breaking reboots), as well as security features
like multiprocess isolation. Using the same SSH daemon for stage-1 and
the main system ensures key formats will always remain compatible, as
well as more conveniently allowing the sharing of configuration and
host keys.

The main reason to use Dropbear over OpenSSH would be initrd space
concerns, but NixOS initrds are already large (17 MiB currently on my
server), and the size difference between the two isn't huge (the test's
initrd goes from 9.7 MiB to 12 MiB with this change). If the size is
still a problem, then it would be easy to shrink sshd down to a few
hundred kilobytes by using an initrd-specific build that uses musl and
disables things like Kerberos support.

This passes the test and works on my server, but more rigorous testing
and review from people who use initrd SSH would be appreciated!
2020-03-25 08:26:50 +00:00
volth 4d57e56b71
$toplevel/system: use kernel's architecture
`$toplevel/system` of a system closure with `x86_64` kernel and `i686` userland should contain "x86_64-linux".

If `$toplevel/system` contains "i686-linux", the closure will be run using `qemu-system-i386`, which is able to run `x86_64` kernel on most Intel CPU, but fails on AMD.

So this fix is for a rare case of `x86_64` kernel + `i686` userland + AMD CPU
2020-03-20 16:55:44 +00:00
Florian Klink 355c58e485 nixos/networkd: respect systemd.network.links also with disabled systemd-networkd
This mirrors the behaviour of systemd - It's udev that parses `.link`
files, not `systemd-networkd`.

This was originally applied in 36ef112a47,
but was reverted due to 1115959a8d causing
evaluation errors on hydra.
2020-03-19 14:15:32 +01:00
Danylo Hlynskyi fab05f17d1
Merge pull request #80114 from rnhmjoj/initrd
nixos/boot: add option to disable initrd
2020-03-16 20:04:24 +02:00
Vladimír Čunát 0729b8c55e
Revert Merge #82310: nixos/systemd: apply .link
...even when networkd is disabled

This reverts commit ce78f3ac70, reversing
changes made to dc34da0755.

I'm sorry; Hydra has been unable to evaluate, always returning
> error: unexpected EOF reading a line
and I've been unable to reproduce the problem locally.  Bisecting
pointed to this merge, but I still can't see what exactly was wrong.
2020-03-13 22:05:33 +01:00
Michele Guerini Rocco 7b15d6cee4
Merge pull request #81241 from thefloweringash/nesting-system
nixos/activation: propagate system to nested configurations
2020-03-13 09:58:10 +01:00
Florian Klink 36ef112a47 nixos/networkd: respect systemd.network.links also with disabled systemd-networkd
This mirrors the behaviour of systemd - It's udev that parses `.link`
files, not `systemd-networkd`.
2020-03-11 10:21:37 +01:00
adisbladis 6fcce60fd5
Merge pull request #82139 from adisbladis/switch-to-configuration-manual
switch-to-configuration: Add new option X-OnlyManualStart
2020-03-10 11:17:33 +00:00
adisbladis db6c94304f
switch-to-configuration: Add new option X-OnlyManualStart
This is to facilitate units that should _only_ be manually started and
not activated when a configuration is switched to.

More specifically this is to be used by the new Nixops deploy-*
targets created in https://github.com/NixOS/nixops/pull/1245 that are
triggered by Nixops before/after switch-to-configuration is called.
2020-03-09 11:28:07 +00:00
zimbatm cc90ececa7
environment.etc: fix typo 2020-03-09 12:01:41 +01:00
Andrew Childs ce416779bb nixos/activation: use eval-config's system argument for nesting
This avoids a possible surprise if the user is using `nixpkgs.system`
and `nesting.children`. `nesting.children` is expected to ignore all
parent configuration so we shouldn't propagate the user-facing option
`nixpkgs.system`. To avoid doing so, we introduce a new internal
option for holding the value passed to eval-config.nix, and use that
when recursing for nesting.
2020-03-05 20:28:31 +09:00
Maximilian Bosch 7f9131f260
Merge pull request #81405 from NinjaTrappeur/nin-networkd-policy-rules
nixos/networkd: add RoutingPolicyRules-related options
2020-03-04 12:29:29 +01:00
Maximilian Bosch 70325e63d8
Merge pull request #79532 from NixOS/fix-predictable-ifnames-in-initrd
nixos/stage-1: fix predictable interface names in initrd
2020-03-02 17:14:06 +01:00
Félix Baylac-Jacqué 9897d83f58 nixos/networkd: test routingPolicyRules with a nixos vm test 2020-03-02 15:37:40 +01:00
Félix Baylac-Jacqué 611d765b76 nixos/networkd: Add the RoutingPolicyRule-related options 2020-03-01 14:52:36 -08:00
Andrew Childs b83164a049 nixos/activation: propagate system to nested configurations
The current behavior lets `system` default to
`builtins.currentSystem`. The system value specified to
`eval-config.nix` has very low precedence, so this should compose
properly.

Fixes #80806
2020-02-27 23:57:44 +09:00
Benjamin Staffin 4c5ea02dc5
grub: Update extraConfig example text (#79406)
This expands the example to something one might actually want to use
to set up a serial console.
2020-02-15 16:45:47 -05:00
rnhmjoj dea79b56f7
nixos/boot: add option to disable initrd 2020-02-15 12:13:33 +01:00
Marek Mahut 4011c2a2aa
Merge pull request #76481 from fare-patches/vesa
Deprecate the boot.vesa option
2020-02-13 09:47:54 +01:00
worldofpeace d12524fd51 Merge pull request #78453 from wedens/memtest-efi-grub
nixos/grub: make memtest work with EFI
2020-02-09 16:09:58 -05:00
Franz Pletz 589789997f
nixos/initrd-network: always run postCommands
As outlined in #71447, postCommands should always be run if networking
in initrd is enabled. regardless if the configuration actually
succeeded.
2020-02-08 14:57:49 +01:00
Franz Pletz d25c1a8fdc
nixos/initrd-network: use ipconfig from klibc
This apparently has features that the version from Arch's
mkinitcpio-nfs-utils does not have. Fixes #75314.
2020-02-08 14:57:49 +01:00
Franz Pletz ea7d02406b
nixos/initrd-network: flush interfaces before stage 2
Depending on the network management backend being used, if the interface
configuration in stage 1 is not cleared, there might still be some old
addresses or routes from stage 1 present in stage 2 after network
configuration has finished.
2020-02-08 14:04:02 +01:00
Franz Pletz 44e289f93b
nixos/stage-1: fix predictable interfaces names
This makes predictable interfaces names available as soon as possible
with udev by adding the default network link units to initrd which are read
by udev. Also adds some udev rules that are needed but which would normally
loaded from the udev store path which is not included in the initrd.
2020-02-08 14:04:02 +01:00
Silvan Mosberger 5acd168425
Merge pull request #59827 from oxij/nixos/suppress-systemd-units
nixos/systemd: add an option to suppress system units
2020-02-06 18:11:01 +01:00
Frederik Rietdijk 419bc0a4cd Revert "Revert "Merge master into staging-next""
In 87a19e9048 I merged staging-next into master using the GitHub gui as intended.
In ac241fb7a5 I merged master into staging-next for the next staging cycle, however, I accidentally pushed it to master.
Thinking this may cause trouble, I reverted it in 0be87c7979. This was however wrong, as it "removed" master.

This reverts commit 0be87c7979.
2020-02-05 19:41:25 +01:00
Frederik Rietdijk 0be87c7979 Revert "Merge master into staging-next"
I merged master into staging-next but accidentally pushed it to master.
This should get us back to 87a19e9048.

This reverts commit ac241fb7a5, reversing
changes made to 76a439239e.
2020-02-05 19:18:35 +01:00
Silvan Mosberger 3ab846e34a
Merge pull request #35188 from sorki/overlayfs
use overlayfs by default for netboot and iso
2020-02-05 13:46:04 +01:00
Richard Marko 0c20feb231 use overlayfs by default for netboot and iso 2020-02-05 10:35:59 +01:00
wedens 7b5550a3fc nixos/grub: make memtest work with EFI
Memtest86+ doesn't support EFI, so unfree Memtest86 is used when EFI
support is enabled (systemd-boot currently also uses Memtest86 when
memtest is enabled).
2020-02-05 11:12:55 +07:00
Silvan Mosberger b4cc413928
Merge pull request #77594 from Frostman/fix-grub-extrafiles-mirroredboots
Fix boot.loader.grub.extraFiles when used with mirroredBoots
2020-02-05 00:22:35 +01:00
Sergey Lukjanov 7144b9ac54 Fix boot.loader.grub.extraFiles when used with mirroredBoots
Substitute @bootPath@ in boot.loader.grub.extraPrepareConfig script
same way as it's done for boot.loader.grub.extraEntries option.
2020-02-03 15:37:00 -08:00
misuzu f93a9074e4 nixos/systemd: add systemd.sleep.extraConfig config option 2020-02-03 18:33:15 +02:00
Eelco Dolstra 26aba55951
Revert "add config.environment.ld-linux"
This reverts commit af665d822a, see
https://github.com/NixOS/nixpkgs/pull/78798#issuecomment-580059834 for
the reasons in a similar PR.
2020-02-02 15:29:49 +01:00
Eelco Dolstra 5495cb91eb
Revert "rmdir: avoid failing when directory did not exist"
This reverts commit 45db499d2d.
2020-02-02 15:29:40 +01:00
Maximilian Bosch 0f10495eb9
Merge pull request #74624 from Ma27/networkd-units-internal
nixos/networkd: mark `units` option as internal
2020-02-02 07:59:57 +01:00
Andreas Rammhold 355b31c98e
Merge pull request #78476 from Ma27/networkd-vrf-options
nixos/networkd: add vrfConfig option for netdevs, add simple test
2020-01-31 13:28:22 +01:00
Matthew Bauer 3a7fe07e3c
Merge pull request #69057 from volth/ld-linux
add config.environment.ld-linux
2020-01-27 20:08:12 -05:00
Jörg Thalheim 43f117537f
Merge pull request #78426 from Mic92/tmpfiles
nixos/systemd: add all systemd tmpfiles files
2020-01-27 09:55:50 +00:00
Maximilian Bosch bc130855a7
nixos/networkd: add vrfConfig option to netdevs 2020-01-25 17:38:15 +01:00
Jörg Thalheim 3ef5115963
nixos/systemd: add all systemd tmpfiles files
Especially tmp.conf is important to create /tmp and /var/tmp with the correct
permissions.
2020-01-24 17:20:54 +00:00
Marek Mahut c4d75cbb0c boot.initrd.luks: adding a warning when using FIDO2 with kernel ≤ 5.4 2020-01-22 16:00:40 +01:00
Marek Mahut dea2fe9f39 boot.initrd.luks: Adding FIDO2 support 2020-01-22 08:38:16 +01:00
Florian Klink a3d67f417e
Merge pull request #77665 from zaninime/ifxfrm
systemd-networkd: add configuration for XFRM interfaces
2020-01-21 22:14:53 +01:00
Francesco Zanini 9974bb16b0 systemd-networkd: add configuration for XFRM interfaces 2020-01-14 11:33:18 +01:00
worldofpeace 1c2e27e4d5 nixos/systemd-lib: don't fail on systemd.packages duplicates
In some cases like we've noticed in https://github.com/NixOS/nixpkgs/issues/76169,
having duplicate packages in systemd.packages like
```
systemd.packages = [ gnome-shell gnome-shell gnome-session ];
```
breaks.

Here we use an associative array to ensure no
duplicate paths when we symlink all the units listed
in systemd.packages.
2020-01-07 21:42:14 -05:00
Silvan Mosberger ff16d17b42
nixos/systemd: Explicitly put default path packages after othe… (#77088)
nixos/systemd: Explicitly put default path packages after others
2020-01-06 21:51:04 +01:00
rnhmjoj 1d61efb7f1 treewide: use attrs instead of list for types.loaOf options 2020-01-06 10:39:18 -05:00
Silvan Mosberger 9327e1c6ba
nixos/systemd: Explicitly put default path packages after others
This fixes the dhcpcd issue in https://github.com/NixOS/nixpkgs/issues/76969,
which was exposed by https://github.com/NixOS/nixpkgs/pull/75031
introducing changes in the module ordering and therefore option ordering
too.

The dhcpcd issue would also be fixable by explicitly putting
dhcpcd's paths before others, however it makes more sense for systemd's
default paths to be after all others by default, since they should only
be a fallback, which is how binary finding will work if they come after.
2020-01-06 15:58:06 +01:00