Commit graph

342 commits

Author SHA1 Message Date
aszlig 5146f76095
nixos/taskserver: Add an option for organisations
We want to declaratively specify users and organisations, so let's add
another module option "organisations", which allows us to specify users,
groups and of course organisations.

The implementation of this is not yet done and this is just to feed the
boilerplate.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-04-05 18:53:31 +02:00
aszlig 274fe2a23b
nixos/taskserver: Fix generating server cert
We were generating a self-signed certificate for the server so far,
which we obviously don't want.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-04-05 18:53:31 +02:00
aszlig 77d7545fac
nixos/taskserver: Introduce a new fqdn option
Using just the host for the common name *and* for listening on the port
is quite a bad idea if you want to listen on something like :: or an
internal IP address which is proxied/tunneled to the outside.

Hence this separates host and fqdn.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-04-05 18:53:31 +02:00
aszlig d94ac7a454
nixos/taskserver: Use types.str instead of string
The "string" option type has been deprecated since a long time
(800f9c2), so let's not use it here.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-04-05 18:53:31 +02:00
aszlig 411c6f77a3
nixos/taskserver: Add trust option to config file
The server starts up without that option anyway, but it complains about
its value not being set. As we probably want to have access to that
configuration value anyway, let's expose this via the NixOS module as
well.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-04-05 18:53:31 +02:00
aszlig 1f410934f2
nixos/taskserver: Properly indent CA config lines
No change in functionality, but it's easier to read when properly
indented.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-04-05 18:53:31 +02:00
aszlig 3d820d5ba1
nixos/taskserver: Refactor module for CA creation
Now the service starts up if only the services.taskserver.enable option
is set to true.

We now also have three systemd services (started in this order):

 * taskserver-init: For creating the necessary data directory and also
                    includes a refecence to the configuration file in
                    the Nix store.
 * taskserver-ca:   Only enabled if none of the server.key, server.cert,
                    server.crl and caCert options are set, so we can
                    allow for certificates that are issued by another
                    CA.
                    This service creates a new CA key+certificate and a
                    server key+certificate and signs the latter using
                    the CA key.
                    The permissions of these keys/certs are set quite
                    strictly to allow only the root user to sign
                    certificates.
 * taskserver:      The main Taskserver service which just starts taskd.

We now also log to stdout and thus to the journal.

Of course, there are still a few problems left to solve, for instance:

 * The CA currently only signs the server certificates, so it's
   only usable for clients if the server doesn't validate client certs
   (which is kinda pointless).
 * Using "taskd <command>" is currently still a bit awkward to use, so
   we need to properly wrap it in environment.systemPackages to set the
   dataDir by default.
 * There are still a few configuration options left to include, for
   example the "trust" option.
 * We might want to introduce an extraConfig option.
 * It might be useful to allow for declarative configuration of
   organisations and users, especially when it comes to creating client
   certificates.
 * The right signal has to be sent for the taskserver service to reload
   properly.
 * Currently the CA and server certificates are created using
   server.host as the common name and doesn't set additional certificate
   information. This could be improved by adding options that explicitly
   set that information.

As for the config file, we might need to patch taskd to allow for
setting not only --data but also a --cfgfile, which then omits the
${dataDir}/config file. We can still use the "include" directive from
the file specified using --cfgfile in order to chainload
${dataDir}/config.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-04-05 18:53:31 +02:00
aszlig 6d38a59c2d
nixos/taskserver: Improve module options
The descriptions for the options previously seem to be from the
taskdrc(5) manual page. So in cases where they didn't make sense for us
I changed the wording a bit (for example for client.deny we don't have a
"comma-separated list".

Also, I've reordered things a bit for consistency (type, default,
example and then description) and add missing types, examples and
docbook tags.

Options that are not used by default now have a null value, so that we
can generate a configuration file out of all the options defined for the
module.

The dataDir default value is now /var/lib/taskserver, because it doesn't
make sense to put just yet another empty subdirectory in it and "data"
doesn't quite make sense anyway, because it also contains the
configuration file as well.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-04-05 18:53:31 +02:00
aszlig 8081c791e9
nixos/taskserver: Remove options for log/pidFile
We're aiming for a proper integration into systemd/journald, so we
really don't want zillions of separate log files flying around in our
system.

Same as with the pidFile. The latter is only needed for taskdctl, which
is a SysV-style initscript and all of its functionality plus a lot more
is handled by systemd already.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-04-05 18:53:31 +02:00
aszlig 5060ee456c
nixos/taskserver: Unify taskd user and group
The service doesn't start with the "taskd" user being present, so we
really should add it. And while at it, it really makes sense to add a
default group as well.

I'm using a check for the user/group name as well, to allow the
taskserver to be run as an existing user.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-04-05 18:53:31 +02:00
Matthias Beyer e6ace2a76a
taskd service: Add initialization script 2016-04-05 18:53:31 +02:00
Matthias Beyer da53312f5c
Add services file for taskwarrior server service 2016-04-05 18:53:31 +02:00
Vladimír Čunát ab15a62c68 Merge branch 'master' into closure-size
Beware that stdenv doesn't build. It seems something more will be needed
than just resolution of merge conflicts.
2016-04-01 10:06:01 +02:00
Kevin Cox 26bd115c9c etcd: 2.1.2 -> 2.3.0 2016-03-26 22:47:15 -04:00
Domen Kožar 7a89a85622 nix.useChroot: allow 'relaxed' as a value 2016-03-25 12:50:39 +00:00
Franz Pletz 38579a1cc9 gitlab service: Remove emailFrom option
Not being used anymore. Use `services.gitlab.extraConfig.gitlab.email_from`
instead.
2016-03-17 04:16:25 +01:00
Robin Gloster 3f9b00c2d8 Merge pull request #13906 from Zer0-/gitlab_version_bump
Gitlab version bump
2016-03-14 13:29:13 +01:00
Nikolay Amiantov 7e57e2c0fb autofs service: clear lockfile before start
autofs uses a lock file in /tmp to check if it's running -- unclean
shutdown breaks the service until one manually removes it.
2016-03-14 01:02:40 +03:00
Philipp Volguine 10198b586e gitlab service startup fix
-gitlab-sidekiq was being started with a misspelled argument name
 which caused the mailer queue to never run and never send mail
2016-03-13 21:04:11 +00:00
Nikolay Amiantov 4a01f70f8f octoprint service: add extraConfig 2016-03-12 18:52:16 +03:00
Thomas Tuegel 5d36644f42 mantisbt: fix typo in documentation 2016-03-12 07:48:36 -06:00
Vladimír Čunát 61556b727a nixos/mantisbt: add a simple service
It doesn't really deserve a package, as it's just a bunch of PHP scripts
copied into a folder and we have to copy on reconfiguration anyway.
2016-03-11 15:59:26 +01:00
Vladimír Čunát 09af15654f Merge master into closure-size
The kde-5 stuff still didn't merge well.
I hand-fixed what I saw, but there may be more problems.
2016-03-08 09:58:19 +01:00
Al Zohali a227bd4e3b nix.requireSignedBinaryCaches: description fix 2016-03-07 23:24:35 +03:00
Adam Boseley 5b83791207 spice-vdagentd service : initial at 0.16.0 2016-03-05 07:56:47 +10:00
Eelco Dolstra b2197b84c2 Fix NixOS eval 2016-03-01 22:07:54 +01:00
Eelco Dolstra f3d94cfc23 Revert "Add the tool "nixos-typecheck" that can check an option declaration to:"
This reverts commit cad8957eab. It
breaks NixOps, but more importantly, such major changes to the module
system really need to be reviewed.
2016-03-01 20:52:06 +01:00
Thomas Strobel 2d6696fc0a nixos-modules: Fixes related to "literalExample" and "defaultText". 2016-02-29 01:47:12 +01:00
Thomas Strobel cad8957eab Add the tool "nixos-typecheck" that can check an option declaration to:
- Enforce that an option declaration has a "defaultText" if and only if the
   type of the option derives from "package", "packageSet" or "nixpkgsConfig"
   and if a "default" attribute is defined.

 - Enforce that the value of the "example" attribute is wrapped with "literalExample"
   if the type of the option derives from "package", "packageSet" or "nixpkgsConfig".

 - Warn if a "defaultText" is defined in an option declaration if the type of
   the option does not derive from "package", "packageSet" or "nixpkgsConfig".

 - Warn if no "type" is defined in an option declaration.
2016-02-29 01:09:00 +01:00
makefu 3f7c600666 services.bepasty: buildEnv for creating PYTHONPATH
Fixes 'You need gevent installed to use this worker.' as well as missing Flask deps.
2016-02-28 01:35:56 +01:00
Vladimír Čunát 3cf9cd8bc3 Merge #12796: nixos docs: show references to packages
(version 2) A better implementation of #10039, after #12357.
This time I did more thorough checking.

See commit messages for details.
2016-02-27 10:48:12 +01:00
zimbatm 8d4c2340d3 Merge pull request #13396 from mayflower/pkg/gitlab
gitlab: 8.0.5 -> 8.5.1, service improvements
2016-02-26 11:19:28 +00:00
Franz Pletz cd0f14f23e gitlab: Add documentation
Fixes #13303.
2016-02-26 08:56:39 +01:00
Franz Pletz e9393bd426 fixup! gitlab: 8.0.5 -> 8.5.0, service improvements
Make the gitlab packages and components overrideable.
2016-02-26 08:56:08 +01:00
Franz Pletz 44a4592a1c fixup! gitlab: 8.0.5 -> 8.5.0, service improvements
gitlab-shell is now talking over the unix socket to gitlab, so the TCP
port isn't needed anymore.
2016-02-26 08:31:20 +01:00
Franz Pletz 3fd51a9ab2 fixup! gitlab: 8.0.5 -> 8.5.0, service improvements
Some debugging and development leftovers.
2016-02-26 07:08:31 +01:00
Franz Pletz bcfa59bf82 gitlab: 8.0.5 -> 8.5.0, service improvements
Updates gitlab to the current stable version and fixes a lot of features that
were broken, at least with the current version and our configuration.

Quite a lot of sweat and tears has gone into testing nearly all features and
reading/patching the Gitlab source as we're about to deploy gitlab for our
whole company.

Things to note:

 * The gitlab config is now written as a nix attribute set and will be
   converted to JSON. Gitlab uses YAML but JSON is a subset of YAML.
   The `extraConfig` opition is also an attribute set that will be merged
   with the default config. This way *all* Gitlab options are supported.

 * Some paths like uploads and configs are hardcoded in rails  (at least
   after my study of the Gitlab source). This is why they are linked from
   the Gitlab root to /run/gitlab and then linked to the  configurable
   `statePath`.

 * Backup & restore should work out of the box from another Gitlab instance.

 * gitlab-git-http-server has been replaced by gitlab-workhorse upstream.
   Push & pull over HTTPS works perfectly. Communication to gitlab is done
   over unix sockets. An HTTP server is required to proxy requests to
   gitlab-workhorse over another unix socket at
   `/run/gitlab/gitlab-workhorse.socket`.

 * The user & group running gitlab are now configurable. These can even be
   changed for live instances.

 * The initial email address & password of the root user can be configured.

Fixes #8598.
2016-02-26 07:08:31 +01:00
zimbatm b73c5ae291 Merge pull request #10546 from aszlig/nixops-issue-350
Fixes for NixOps issue #350
2016-02-26 00:33:49 +00:00
Franz Pletz 2d5e6a27fc Merge pull request #13355 from grahamc/ttyNumberString-issue3608
nixos-manual: Accept numbers for ttyNumber, closes #3608
2016-02-22 19:34:16 +01:00
Graham Christensen f57c049e0b nixos-manual: Accept numbers for ttyNumber, closes #3608 2016-02-22 11:25:16 -06:00
Nikolay Amiantov b457b7a7ea Merge pull request #13069 from abbradar/m3d
OctoPrint and plugins and support for M3D Micro 3D-printer
2016-02-19 14:27:32 +03:00
aszlig 7bdcfb33f4
nixos: Provide a defaultText for type = package
We don't want to build all those things along with the manual, so that's
what the defaultText attribute is for.

Unfortunately a few of them were missing, so let's add them.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-02-17 21:12:24 +01:00
Nikolay Amiantov 53269f1455 octoprint service: init 2016-02-17 17:05:59 +03:00
Nikolay Amiantov 39e9b43082 Merge branch 'gammu-smsd' of https://github.com/zohl/nixpkgs into zohl-gammu-smsd
Closes #12998
2016-02-16 19:40:00 +03:00
Cole Mickens c7571611dc cfdyndns: init at 0.0.1 2016-02-15 12:54:04 -08:00
Al Zohali 7b7cf281d3 gammu-smsd service: init 2016-02-15 00:26:41 +03:00
Vladimír Čunát d039c87984 Merge branch 'master' into closure-size 2016-02-14 08:33:51 +01:00
Edward Tjörnhammar 81b5223c97 nixos: gitit, wrong type restriction redacted 2016-02-12 07:00:37 +01:00
Vladimír Čunát ae74c356d9 Merge recent 'staging' into closure-size
Let's get rid of those merge conflicts.
2016-02-03 16:57:19 +01:00
Vladimír Čunát 4fede53c09 nixos manuals: bring back package references
This reverts most of 89e983786a, as those references are sanitized now.
Fixes #10039, at least most of it.

The `sane` case wasn't fixed, as it calls a *function* in pkgs to get
the default value.
2016-02-03 14:47:14 +01:00
Vladimír Čunát e0feace5cd nixos docs: allow displaying package references
This is an improved version of original #12357.
For the purpose of generating docs, evaluate options with each derivation
in `pkgs` (recursively) replaced by a fake with path "\${pkgs.attribute.path}".
It isn't perfect, but it seems to cover a vast majority of use cases.
Caveat: even if the package is reached by a different means,
the path above will be shown and not e.g. `${config.services.foo.package}`.

As before, defaults created by `mkDefault` aren't displayed,
but documentation shouldn't (mostly) be a reason to use that anymore.

Note: t wouldn't be enough to just use `lib.mapAttrsRecursive`,
because derivations are also (special) attribute sets.
2016-02-03 14:47:14 +01:00
Vladimír Čunát 889351af8b Revert "Merge #12357: nixos docs: show references to packages"
The PR wasn't good enough yet.
This reverts commit b2a37ceeea, reversing
changes made to 7fa9a1abce.
2016-02-03 12:16:33 +01:00
Vladimír Čunát b2a37ceeea Merge #12357: nixos docs: show references to packages 2016-02-03 10:07:27 +01:00
Franz Pletz dbb01a863b Merge pull request #12699 from simonvandel/sundtek
sundtek: 2015-12-12 -> 2016-01-26 + service change
2016-01-30 20:41:04 +01:00
Simon Vandel Sillesen 81e99998f7 sundtek: 2015-12-12 -> 2016-01-26 + service change
* There is no need for hydra to build this, hence preferLocal
* service change: do not hardcode a wait time of 5 seconds
2016-01-30 20:08:52 +01:00
Eelco Dolstra bfebc7342e Fix some references to deprecated /etc/ssl/certs/ca-bundle.crt 2016-01-29 02:32:05 +01:00
Thomas Bereknyei eda3e938d7 IHaskell: remove un-needed inherit 2016-01-21 17:21:00 -05:00
Edward Tjörnhammar 4948bdadd6 nixos: ihaskell, wrong type restriction redacted 2016-01-21 10:02:39 +01:00
Vladimír Čunát 716aac2519 Merge branch 'staging' into closure-size 2016-01-19 09:55:31 +01:00
Thomas Strobel a04a7272aa Add missing 'type', 'defaultText' and 'literalExample' in module definitions
- add missing types in module definitions
- add missing 'defaultText' in module definitions
- wrap example with 'literalExample' where necessary in module definitions
2016-01-17 19:41:23 +01:00
Pascal Wittmann a3e7adf509 nixos/plex: fix service startup, see #12422 2016-01-17 13:01:42 +01:00
Sander van der Burg 4fafd77f7e disnix: propagate ejabberd username to the activation module 2016-01-16 18:08:07 +00:00
roblabla 7e10bf4327 matrix-synapse: init at 0.12.0 2016-01-15 15:17:14 +01:00
Vladimír Čunát 3bcf8ae879 nixos manuals: bring back package references
This reverts most of 89e983786a, as those references are sanitized now.
Fixes #10039, at least most of it.

The `sane` case wasn't fixed, as it calls a *function* in pkgs to get
the default value.
2016-01-13 12:04:31 +01:00
Robin Gloster 88292fdf09 jobs -> systemd.services 2016-01-07 06:39:06 +00:00
Peter Simons d807b057ed Merge pull request #11920 from bjornfor/rename-host-to-listen-address
Rename NixOS option names: 'host' to 'listenAddress'
2016-01-05 12:54:15 +01:00
Benjamin Staffin fe8498f609 nixos/mathics: New service and test 2016-01-02 14:34:55 -08:00
Austin Seipp 59acfd4f16 nixos/plex: Add 'package' option to module
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2015-12-30 20:20:25 -06:00
Bjørn Forsman 6b10df7eaa nixos/subsonic: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:13:15 +01:00
Bjørn Forsman e0b0b9723c nixos/docker-registry: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:06:40 +01:00
Luca Bruno 5b0352a6a4 Merge branch 'master' into closure-size 2015-12-11 18:31:00 +01:00
Bjørn Forsman 2acf59efa4 nixos/redmine: improve assert message
Give the user more context.
2015-12-08 22:52:02 +01:00
Vladimír Čunát 263fd55d4b Merge recent staging built on Hydra
http://hydra.nixos.org/eval/1231884
Only Darwin jobs seem to be queued now,
but we can't afford to wait for that single build slave.
2015-12-05 11:11:51 +01:00
Arseniy Seroka 0c05f14d53 Merge pull request #10535 from roblabla/feature-updateGitlab8.0.5
gitlab: 7.4.2 -> 8.0.5
2015-12-04 16:30:09 +03:00
roblabla b7a4231aa2 gitlab: 7.4.2 -> 8.0.5 2015-12-04 01:14:24 +01:00
Luca Bruno 920b1d3591 Merge branch 'master' into closure-size 2015-11-29 16:50:26 +01:00
Sander van der Burg a744aa74aa disnix: add a target for services activated and deactivated by dysnomia 2015-11-26 17:21:19 +00:00
Jan Malakhovski 244fba351c nixos: use w3m-nox for the manual 2015-11-26 00:34:10 +00:00
Luca Bruno a412927924 Merge remote-tracking branch 'origin/master' into closure-size 2015-11-25 21:37:30 +01:00
makefu 0bdc5e269b services/misc/bepasty: init at 2015-10-21
This module implements a way to start one or more bepasty servers.
It supports configuring the listen address of gunicorn and how bepasty
behaves internally.

Configuring multiple bepasty servers provides a way to serve pastes externally
without authentication and provide creating,listing,deleting pastes interally.
nginx can be used to provide access via hostname + listen address.

`configuration.nix`:

    services.bepasty = {
      enable = true;
      servers = {

        internal = {
          defaultPermissions = "admin,list,create,read,delete";
          secretKey = "secret";
          bind = "127.0.0.1:8000";
        };

        external = {
          defaultPermissions = "read";
          bind = "127.0.0.1:8001";
          secretKey = "another-secret";
        };
      };
    };
2015-11-23 22:10:14 +01:00
Vladimír Čunát 333d69a5f0 Merge staging into closure-size
The most complex problems were from dealing with switches reverted in
the meantime (gcc5, gmp6, ncurses6).
It's likely that darwin is (still) broken nontrivially.
2015-11-20 14:32:58 +01:00
Ollie Charles 013b848346 devmon: Non-root user, set PATH, require udisks2
devmon refuses to run as root. Instead, we now run it as a user service,
and enable udisks2 in order to perform the mounts.
2015-11-18 11:30:08 +00:00
Lengyel Balázs 162542bf8f fix: ihaskell's and xmonad's dependence on haskell-ng 2015-11-13 19:14:40 +01:00
Nikolay Amiantov 9800862397 nixos/autofs: revive and update to systemd 2015-11-11 16:18:57 +03:00
Domen Kožar 581ae33e96 Merge pull request #10107 from ryantm/calibre-server
calibre-server service: init
2015-11-01 09:19:03 +01:00
Ryan Mulligan 922bf3986b calibre-server service: add type to libraryDir option 2015-10-31 14:21:56 -07:00
Eelco Dolstra c20403631d Factor out "man" into a separate module and add "man" outputs to system.path
Fixes #10270.
2015-10-30 15:21:12 +01:00
Vladimír Čunát c5579c9184 subversion: fixup some referrers after splitting 2015-10-28 10:22:59 +01:00
aszlig 80fb17b251
nixos/nix-daemon: Require .mount for /nix/store.
Also related to NixOS/nixops#350, because while switching to the new
configuration, depending on /nix/store also propagates to the mount
points for /nix/.ro-store and /nix/.rw-store and we don't get an error
while trying to unmount them (because nix-daemon needs to be stopped for
unmounting these paths).

While Nix does have the option to set a different store path, I've found
only hardcoded references in nix-daemon.nix, so I'm using a hardcoded
reference here as well, because after all customizing the store path
will probably only make sense on non-NixOS systems.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-10-22 19:50:12 +02:00
Nikolay Amiantov 763ad3372a nixos/parsoid: use nodejs 0.10 2015-10-22 14:34:02 +03:00
Vladimír Čunát 4a571ba0dd ffmpeg: split into multiple outputs
Also fix some referrers.
2015-10-13 20:18:57 +02:00
Vladimír Čunát 99e4371526 curl: split into multiple outputs
Also use pkgconfig to be safer and fix (some) referrers.
2015-10-13 20:18:48 +02:00
aszlig e4caf0fde0
nixos/synergy: Restart services on failure.
Synergy seems to get more and more unstable in recent versions, so we
might want to debug this properly. However, it makes sense to restart
the service nevertheless, because synergy is about keyboard and mouse
sharing and it's quite annoying to either SSH in to restart the service
or even needing to unplug the keyboard and plug in into the machine with
the failing service.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-10-13 04:42:39 +02:00
Ryan Mulligan a41d07074d calibre-server service: configuration improvements
based on @eldostra feedback:
* remove user and group configuration, because it is probably
  unnecessary
* remove libraryDir default
* capitalize and shorten service description
2015-10-03 05:48:46 -07:00
Tuomas Tynkkynen c856b13067 nixos/nix-daemon: Reference correct output of openssl 2015-10-03 14:08:53 +02:00
Ryan Mulligan 9c22cd380c calibre-server service: init 2015-09-27 20:31:17 -07:00
Jan Malakhovski 9cc7859b2e nixos: show the manual in system's /share/doc (close #9928) 2015-09-24 12:29:57 +02:00
Eelco Dolstra 89e983786a Manual: Remove store path references 2015-09-24 11:50:58 +02:00
Edward Tjörnhammar aeba3eabcd Revert "Don't evaluate haskellPackages when gitit is disabled"
This reverts commit 99750d89dd.
2015-09-20 21:40:17 +02:00
Paul Wilson d2ca8b4079 gitit service: check null github auth options 2015-09-10 17:32:30 +00:00