Commit graph

2395 commits

Author SHA1 Message Date
Florian Klink 013e089000
Merge pull request #130503 from flokli/nss-fix-ordering
nixos/systemd: fix NSS database ordering
2021-07-23 02:28:32 +02:00
Martin Weinelt 70774da509
Merge pull request #130853 from mweinelt/pppd 2021-07-22 20:00:00 +02:00
Pavol Rusnak f4860dc785
Merge pull request #130945 from mdlayher/mdl-corerad-docs
nixos/corerad: update link to reference configuration file
2021-07-21 23:12:47 +02:00
Andreas Rammhold ef9be9288b
Merge pull request #124799 from rissson/nixos-unbound-fix-124780
nixos/unbound: fix define-tag option
2021-07-21 22:08:44 +02:00
Martin Weinelt ee26807e35
nixos/pppd: allow AF_NETLINK
The pppd daemon starting with version 2.4.9 uses rtnetlink to configure
the ipv6 peer address on the ppp interface. It therefore requires
allowing AF_NETLINK sockets.
2021-07-21 16:38:51 +02:00
Matt Layher 5c17e35a31
nixos/corerad: update link to reference configuration file
Signed-off-by: Matt Layher <mdlayher@gmail.com>
2021-07-21 10:35:48 -04:00
Martin Weinelt 8abcc6ba09
nixos/pppd: replace CAP_SYS_ADMIN with CAP_BPF
The kernel before version 5.7 required CAP_SYS_ADMIN to conduct BPF
operations. After that a separate capability CAP_BPF was created, which
should be sufficient in this scenario and will further tighten the
sandbox around our pppd service.

Tested on my personal DSL line.
2021-07-21 15:20:47 +02:00
Jörg Thalheim 0839cf1d45
Merge pull request #106721 from Mic92/nix-serve
nixos/nix-serve: don't run as nogroup
2021-07-18 07:53:32 +01:00
Jörg Thalheim ac7b8724b5 nixos/nix-serve: don't run as nogroup
nogroup is insecure if shared
2021-07-18 08:51:17 +02:00
Martin Weinelt d9a3a54b73
Merge pull request #129980 from mweinelt/nixos/kea 2021-07-18 00:26:35 +02:00
Florian Klink c1536f5c78 nixos/systemd: fix NSS database ordering
- The order of NSS (host) modules has been brought in line with upstream
  recommendations:

  - The `myhostname` module is placed before the `resolve` (optional) and `dns`
    entries, but after `file` (to allow overriding via `/etc/hosts` /
    `networking.extraHosts`, and prevent ISPs with catchall-DNS resolvers from
    hijacking `.localhost` domains)
  - The `mymachines` module, which provides hostname resolution for local
    containers (registered with `systemd-machined`) is placed to the front, to
    make sure its mappings are preferred over other resolvers.
  - If systemd-networkd is enabled, the `resolve` module is placed before
    `files` and `myhostname`, as it provides the same logic internally, with
    caching.
  - The `mdns(_minimal)` module has been updated to the new priorities.

  If you use your own NSS host modules, make sure to update your priorities
  according to these rules:

  - NSS modules which should be queried before `resolved` DNS resolution should
    use mkBefore.
  - NSS modules which should be queried after `resolved`, `files` and
    `myhostname`, but before `dns` should use the default priority
  - NSS modules which should come after `dns` should use mkAfter.
2021-07-17 23:55:35 +02:00
Leo bb568917b2
nixos/bind: add directory config option (#129188) 2021-07-17 08:03:20 +02:00
Martin Weinelt caf70ceed4
nixos/kea: init 2021-07-14 01:36:04 +02:00
Sandro 70e2fceb6a
Merge pull request #119713 from uonr/master 2021-07-13 22:03:12 +02:00
Tachibana Kiyomi 21f41d8b33
nixos/ddclient: add support for IPv6 2021-07-14 02:09:29 +09:00
Matt Christ 0ce72580be nixos/bind: allow specifying BIND package
This allows users of the bind module to specify an alternate BIND
package. For example, by overriding the source attribute to use a
different version of BIND.

Since the default value for `services.bind.package` is `pkgs.bind`,
this change is completely backwards compatible with the current
module.
2021-07-11 08:11:33 -05:00
Peng Mei Yu b68547486e nixos/smartdns: Restart service when config changes 2021-07-09 13:36:26 +08:00
slotThe 2c529c3cb8 Link to Libera, Matrix instead of Freenode
The project has moved away from Freenode as an IRC network[1], and there
is now a quite large channel on Libera.  As such, we should point users
towards that instead.

This also changes all examples to refer to libera instead of freenode
as, with the recent deletion of all freenode channels, it is perhaps
where most communities are to be found nowadays.

Finally, also link to the official Matrix room[2] as an alternative to
IRC.

Related: https://github.com/NixOS/nixpkgs/pull/129384

[1]: https://discourse.nixos.org/t/join-us-on-matrix-at-nix-nixos-org-migrating-from-freenode
[2]: https://github.com/NixOS/rfcs/pull/94
2021-07-06 16:35:37 +02:00
github-actions[bot] 6cead635ad
Merge master into staging-next 2021-07-03 12:01:23 +00:00
Christian Kampka 3aa9692beb coturn: Support secrets file for configuring the static-auth-secret 2021-07-03 08:29:59 +01:00
github-actions[bot] 7350c52b9b
Merge master into staging-next 2021-07-01 00:01:35 +00:00
gwitmond bbe66636f4
nixos/sshd: add -D flag to prevent forking into a separate process (#122844)
It makes it easier for init-processes to monitor correct startup and liveness.
2021-07-01 00:43:54 +02:00
Luke Granger-Brown ef4e133b1c
Merge branch 'master' into Xe/tailscale-sysctl-not-found 2021-06-30 23:10:54 +01:00
github-actions[bot] ac92955702
Merge master into staging-next 2021-06-28 06:04:15 +00:00
Maciej Krüger bb62664a1a
Merge pull request #128473 from jerith666/globalprotect-vpn 2021-06-28 05:51:26 +02:00
Matt McHenry 74281b9faa globalprotect-vpn: add missing 'mkIf cfg.enable'
spotted by @lopsided98
2021-06-27 21:55:14 -04:00
github-actions[bot] de0cfc5563
Merge staging-next into staging 2021-06-26 12:06:28 +00:00
github-actions[bot] 45003ba5f9
Merge master into staging-next 2021-06-26 12:06:25 +00:00
Martin Weinelt ef2ce48d8b
Merge pull request #127767 from Mic92/go-neb 2021-06-26 12:23:16 +02:00
Jörg Thalheim 34d1c55580
nixos/go-neb: secret support 2021-06-26 11:59:50 +02:00
github-actions[bot] 1f528e6ac6
Merge staging-next into staging 2021-06-24 00:06:31 +00:00
github-actions[bot] d437a6cac2
Merge master into staging-next 2021-06-24 00:06:27 +00:00
Martin Weinelt 9cc60287dc
Merge pull request #127554 from mweinelt/babel
nixos/babeld: update hardening
2021-06-23 21:53:20 +02:00
github-actions[bot] 64eb8c173d
Merge staging-next into staging 2021-06-23 00:09:37 +00:00
github-actions[bot] e8122c3628
Merge master into staging-next 2021-06-23 00:09:33 +00:00
Niklas Hambüchen a48fea4c5e sshd service: Default to INFO logLevel (upstream default).
The previous justification for using "VERBOSE" is incorrect,
because OpenSSH does use level INFO to log "which key was used
to log in" for sccessful logins, see:
6247812c76/auth.c (L323-L328)

Also update description to the wording of the sshd_config man page.

`fail2ban` needs, sshd to be "VERBOSE" to work well, thus
the `fail2ban` module sets it to "VERBOSE" if enabled.

The docs are updated accordingly.
2021-06-23 01:49:11 +02:00
Martin Weinelt 8739f8cd7b
nixos/babeld: update hardening 2021-06-20 13:52:49 +02:00
Daniel Nagy 06962df4d2
nixos/murmur: use port type 2021-06-18 17:30:33 +02:00
Daniel Nagy 7d1363d0cb
nixos/nar-serve: use port type 2021-06-18 17:28:54 +02:00
Daniel Nagy 73896b0634
nixos/nix-serve: use port type 2021-06-18 17:28:35 +02:00
Daniel Nagy d566bd2ddc
nixos/namecoind: use port type 2021-06-18 17:27:42 +02:00
Jan Tojnar e3dfa79441
Merge branch 'staging-next' into staging
Regenerated pkgs/servers/x11/xorg/default.nix to resolve the conflict.
2021-06-16 19:59:05 +02:00
markuskowa 5ad54b5bc9
Merge pull request #126785 from oxzi/ucarp-1.5.2
ucarp: init at 1.5.2 / nixos/ucarp: init / nixos/test/ucarp: init
2021-06-16 10:54:23 +02:00
Martin Weinelt 60c62214f5
nixos/solanum: implement reload and allow config changes
Reload only works with a static configuration path as there is no way to
pass the dynamically generated config path to a running solanum
instance, therefore we symlink the configuration to
/etc/solanum/ircd.conf.

But that will prevent reloads of the ircd, because the systemd unit
wouldn't change when the configuration changes. That is why we add the
actual location of the config file to restartTriggers and enable
reloadIfChanged, so changes will not restart, but reload on changes.
2021-06-16 00:19:35 +02:00
Alvar Penning 8673a40eda nixos/ucarp: init 2021-06-15 18:13:31 +02:00
Robert Hensing dab747106e nixos/ssh: Document authorizedKeysFiles properly 2021-06-15 12:23:09 +02:00
Robert Hensing 8352cc9a23 nixos/ssh: Add an example of verbatim keys
This confused someone on SO.
2021-06-15 11:51:41 +02:00
github-actions[bot] dbed958bf2
Merge staging-next into staging 2021-06-14 12:04:44 +00:00
Profpatsch 799cdbd834 tailscale: add interfaceName option
tailscale allows to specify the interface name.
The upstream systemd unit does not expose it directly however, only
via the `FLAGS` environment variable.

I can’t be 100% sure that the escaping is correct, but this is as good
as we can do for now, unless upstream changes their unit file.
2021-06-14 11:25:08 +02:00
github-actions[bot] 8e50248719
Merge staging-next into staging 2021-06-11 12:04:41 +00:00