diff --git a/.editorconfig b/.editorconfig
index e61db3abee3..75c34374130 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -66,14 +66,24 @@ insert_final_newline = unset
[nixos/modules/services/networking/ircd-hybrid/*.{conf,in}]
trim_trailing_whitespace = unset
+[nixos/tests/systemd-networkd-vrf.nix]
+trim_trailing_whitespace = unset
+
[pkgs/applications/editors/emacs-modes/recipes-archive-melpa.json]
indent_size = unset
-[pkgs/build-support/dotnetenv/Wrapper/**.*]
+[pkgs/build-support/dotnetenv/Wrapper/**]
end_of_line = unset
insert_final_newline = unset
trim_trailing_whitespace = unset
+[pkgs/build-support/upstream-updater/**]
+trim_trailing_whitespace = unset
+
+[pkgs/development/compilers/elm/registry.dat]
+end_of_line = unset
+insert_final_newline = unset
+
[pkgs/development/lisp-modules/quicklisp-to-nix.nix]
indent_size = unset
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 4be9ae506ea..d362d857838 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -202,3 +202,8 @@
# Blockchains
/pkgs/applications/blockchains @mmahut
+
+# Go
+/pkgs/development/compilers/go @kalbasit @Mic92 @zowoq
+/pkgs/development/go-modules @kalbasit @Mic92 @zowoq
+/pkgs/development/go-packages @kalbasit @Mic92 @zowoq
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 5ace4600a1f..00000000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-version: 2
-updates:
- - package-ecosystem: "github-actions"
- directory: "/"
- schedule:
- interval: "weekly"
diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
deleted file mode 100644
index 86b89a3f558..00000000000
--- a/.github/workflows/editorconfig.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: "Checking EditorConfig"
-
-on:
- pull_request:
- branches:
- - master
-
-jobs:
- tests:
- runs-on: ubuntu-latest
- steps:
- - uses: actions/checkout@v2
- with:
- fetch-depth: 0
- - uses: technote-space/get-diff-action@v2.0.3
- - name: Checking EditorConfig
- env:
- VERSION: "2.1.0"
- OS: "linux"
- ARCH: "amd64"
- run: |
- curl -sSf -O -L -C - https://github.com/editorconfig-checker/editorconfig-checker/releases/download/$VERSION/ec-$OS-$ARCH.tar.gz && \
- tar xzf ec-$OS-$ARCH.tar.gz && \
- ./bin/ec-$OS-$ARCH -disable-indentation ${{ env.GIT_DIFF }}
diff --git a/.github/workflows/wait-ofborg.yml b/.github/workflows/wait-ofborg.yml
deleted file mode 100644
index 35c58b2e912..00000000000
--- a/.github/workflows/wait-ofborg.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-name: "Wait for ofborg"
-on:
- pull_request:
-jobs:
- tests:
- runs-on: ubuntu-latest
- steps:
- - name: Wait for ofborg CI
- run: |
- # wait for ~30min...
- # ..in future a better fix would be to make ofborg mark CI as pending right away.
- for i in $(seq 360); do
- res=$(curl --silent \
- -H "Accept: application/vnd.github.antiope-preview+json" \
- -H "Authorization: token ${GITHUB_TOKEN}" \
- "https://api.github.com/repos/NixOS/nixpkgs/commits/${COMMIT}/check-runs" | \
- jq ".check_runs | map(.app) | map(.id) | contains([${OFBORG_APP_ID}])")
- if [[ "$res" == "true" ]]; then
- exit 0
- fi
- sleep 5
- echo "."
- done
- echo "Timeout!"
- exit 1
- # ofborg is not checking forks.
- if: github.repository_owner == 'NixOS'
- env:
- GITHUB_TOKEN: ${{ github.token }}
- COMMIT: ${{ github.event.pull_request.head.sha }}
- OFBORG_APP_ID: 20500
diff --git a/doc/languages-frameworks/go.xml b/doc/languages-frameworks/go.xml
index eee4706e551..26414f23c7d 100644
--- a/doc/languages-frameworks/go.xml
+++ b/doc/languages-frameworks/go.xml
@@ -40,7 +40,9 @@ pet = buildGoModule rec {
subPackages = [ "." ];
- runVend = true;
+ deleteVendor = true;
+
+ runVend = true;
meta = with lib; {
description = "Simple command-line snippet manager, written in Go";
@@ -67,6 +69,11 @@ pet = buildGoModule rec {
+
+ deleteVendor removes the pre-existing vendor directory and fetches the dependencies. This should only be used if the dependencies included in the vendor folder are broken or incomplete.
+
+
+ runVend runs the vend command to generate the vendor directory. This is useful if your code depends on c code and go mod tidy does not include the needed sources to build.
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index dc10483ce69..7bee48773c2 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -640,8 +640,8 @@ and in this case the `python38` interpreter is automatically used.
### Interpreters
-Versions 2.7, 3.5, 3.6, 3.7 and 3.8 of the CPython interpreter are available as
-respectively `python27`, `python35`, `python36`, `python37` and `python38`. The
+Versions 2.7, 3.6, 3.7 and 3.8 of the CPython interpreter are available as
+respectively `python27`, `python36`, `python37` and `python38`. The
aliases `python2` and `python3` correspond to respectively `python27` and
`python38`. The default interpreter, `python`, maps to `python2`. The PyPy
interpreters compatible with Python 2.7 and 3 are available as `pypy27` and
@@ -689,15 +689,16 @@ attribute set is created for each available Python interpreter. The available
sets are
* `pkgs.python27Packages`
-* `pkgs.python35Packages`
* `pkgs.python36Packages`
* `pkgs.python37Packages`
+* `pkgs.python38Packages`
+* `pkgs.python39Packages`
* `pkgs.pypyPackages`
and the aliases
* `pkgs.python2Packages` pointing to `pkgs.python27Packages`
-* `pkgs.python3Packages` pointing to `pkgs.python37Packages`
+* `pkgs.python3Packages` pointing to `pkgs.python38Packages`
* `pkgs.pythonPackages` pointing to `pkgs.python2Packages`
#### `buildPythonPackage` function
diff --git a/doc/using/overlays.xml b/doc/using/overlays.xml
index 3fa68e32a3c..7f6ee040c7c 100644
--- a/doc/using/overlays.xml
+++ b/doc/using/overlays.xml
@@ -178,26 +178,40 @@ self: super:
Intel
- MKL (only works on x86 architecture, unfree)
+ MKL (only works on the x86_64 architecture, unfree)
The Nixpkgs attribute is mkl.
+
+
+ AMD
+ BLIS/LIBFLAME (optimized for modern AMD x86_64 CPUs)
+
+
+ The AMD BLIS library, with attribute amd-blis,
+ provides a BLAS implementation. The complementary AMD LIBFLAME
+ library, with attribute amd-libflame, provides
+ a LAPACK implementation.
+
+
Introduced in PR
- #83888, we are able to override the ‘blas’ and ‘lapack’
- packages to use different implementations, through the
- ‘blasProvider’ and ‘lapackProvider’ argument. This can be used
+ #83888, we are able to override the blas
+ and lapack packages to use different implementations,
+ through the blasProvider and
+ lapackProvider argument. This can be used
to select a different provider. BLAS providers will have
symlinks in $out/lib/libblas.so.3 and
$out/lib/libcblas.so.3 to their respective
BLAS libraries. Likewise, LAPACK providers will have symlinks
in $out/lib/liblapack.so.3 and
$out/lib/liblapacke.so.3 to their respective
- LAPCK libraries. For example, Intel MKL is both a BLAS and
+ LAPACK libraries. For example, Intel MKL is both a BLAS and
LAPACK provider. An overlay can be created to use Intel MKL
that looks like:
@@ -216,8 +230,9 @@ self: super:
This overlay uses Intel’s MKL library for both BLAS and LAPACK
interfaces. Note that the same can be accomplished at runtime
- using LD_LIBRARY_PATH of libblas.so.3 and
- liblapack.so.3. For instance:
+ using LD_LIBRARY_PATH of
+ libblas.so.3 and
+ liblapack.so.3. For instance:
$ LD_LIBRARY_PATH=$(nix-build -A mkl)/lib:$LD_LIBRARY_PATH nix-shell -p octave --run octave
diff --git a/lib/licenses.nix b/lib/licenses.nix
index 2c6da3a865f..2f9fc04cb7c 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -110,6 +110,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
fullName = ''BSD 4-clause "Original" or "Old" License'';
};
+ bsdProtection = spdx {
+ spdxId = "BSD-Protection";
+ fullName = "BSD Protection License";
+ };
+
bsl11 = {
fullName = "Business Source License 1.1";
url = "https://mariadb.com/bsl11";
diff --git a/lib/systems/doubles.nix b/lib/systems/doubles.nix
index c0e78595d85..fb7d722e737 100644
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@@ -38,7 +38,7 @@ let
"js-ghcjs"
- "aarch64-genode" "x86_64-genode"
+ "aarch64-genode" "i686-genode" "x86_64-genode"
];
allParsed = map parse.mkSystemFromString all;
diff --git a/lib/tests/systems.nix b/lib/tests/systems.nix
index ea8ceedd43f..f691b2da316 100644
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@@ -15,14 +15,14 @@ in with lib.systems.doubles; lib.runTests {
testall = mseteq all (linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos ++ wasi ++ windows ++ embedded ++ js ++ genode ++ redox);
testarm = mseteq arm [ "armv5tel-linux" "armv6l-linux" "armv6l-none" "armv7a-linux" "armv7l-linux" "arm-none" "armv7a-darwin" ];
- testi686 = mseteq i686 [ "i686-linux" "i686-freebsd" "i686-netbsd" "i686-openbsd" "i686-cygwin" "i686-windows" "i686-none" "i686-darwin" ];
+ testi686 = mseteq i686 [ "i686-linux" "i686-freebsd" "i686-genode" "i686-netbsd" "i686-openbsd" "i686-cygwin" "i686-windows" "i686-none" "i686-darwin" ];
testmips = mseteq mips [ "mipsel-linux" ];
testx86_64 = mseteq x86_64 [ "x86_64-linux" "x86_64-darwin" "x86_64-freebsd" "x86_64-genode" "x86_64-redox" "x86_64-openbsd" "x86_64-netbsd" "x86_64-cygwin" "x86_64-solaris" "x86_64-windows" "x86_64-none" ];
testcygwin = mseteq cygwin [ "i686-cygwin" "x86_64-cygwin" ];
testdarwin = mseteq darwin [ "x86_64-darwin" "i686-darwin" "aarch64-darwin" "armv7a-darwin" ];
testfreebsd = mseteq freebsd [ "i686-freebsd" "x86_64-freebsd" ];
- testgenode = mseteq genode [ "aarch64-genode" "x86_64-genode" ];
+ testgenode = mseteq genode [ "aarch64-genode" "i686-genode" "x86_64-genode" ];
testredox = mseteq redox [ "x86_64-redox" ];
testgnu = mseteq gnu (linux /* ++ kfreebsd ++ ... */);
testillumos = mseteq illumos [ "x86_64-solaris" ];
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index acce135aa2e..23bd8026d01 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -42,7 +42,7 @@
*/
{
"0x4A6F" = {
- email = "0x4A6F@shackspace.de";
+ email = "mail-maintainer@0x4A6F.dev";
name = "Joachim Ernst";
github = "0x4A6F";
githubId = 9675338;
@@ -1446,6 +1446,12 @@
fingerprint = "099E 3F97 FA08 3D47 8C75 EBEC E0EB AD78 F019 0BD9";
}];
};
+ chiroptical = {
+ email = "chiroptical@gmail.com";
+ github = "chiroptical";
+ githubId = 3086255;
+ name = "Barry Moore II";
+ };
chkno = {
email = "chuck@intelligence.org";
github = "chkno";
@@ -1760,6 +1766,16 @@
githubId = 490965;
name = "Craig Swank";
};
+ cust0dian = {
+ email = "serg@effectful.software";
+ github = "cust0dian";
+ githubId = 389387;
+ name = "Serg Nesterov";
+ keys = [{
+ longkeyid = "rsa4096/0x1512F6EB84AECC8C";
+ fingerprint = "6E7D BA30 DB5D BA60 693C 3BE3 1512 F6EB 84AE CC8C";
+ }];
+ };
cwoac = {
email = "oliver@codersoffortune.net";
github = "cwoac";
@@ -2170,6 +2186,16 @@
githubId = 974130;
name = "David Pätzel";
};
+ dpausp = {
+ email = "dpausp@posteo.de";
+ github = "dpausp";
+ githubId = 1965950;
+ name = "Tobias Stenzel";
+ keys = [{
+ longkeyid = "rsa2048/0x78C7DD40DF23FB16";
+ fingerprint = "4749 0887 CF3B 85A1 6355 C671 78C7 DD40 DF23 FB16";
+ }];
+ };
dpflug = {
email = "david@pflug.email";
github = "dpflug";
@@ -2404,6 +2430,12 @@
githubId = 1753498;
name = "Dejan Lukan";
};
+ elliottvillars = {
+ email = "elliottvillars@gmail.com";
+ github = "elliottvillars";
+ githubId = 48104179;
+ name = "Elliott Villars";
+ };
eliasp = {
email = "mail@eliasprobst.eu";
github = "eliasp";
@@ -3198,6 +3230,12 @@
githubId = 6768842;
name = "Joris Guyonvarch";
};
+ gvolpe = {
+ email = "volpegabriel@gmail.com";
+ github = "gvolpe";
+ githubId = 443978;
+ name = "Gabriel Volpe";
+ };
hakuch = {
email = "hakuch@gmail.com";
github = "hakuch";
@@ -3916,6 +3954,12 @@
githubId = 8735102;
name = "John Ramsden";
};
+ johntitor = {
+ email = "huyuumi.dev@gmail.com";
+ github = "JohnTitor";
+ githubId = 25030997;
+ name = "Yuki Okushi";
+ };
jojosch = {
name = "Johannes Schleifenbaum";
email = "johannes@js-webcoding.de";
@@ -4623,6 +4667,12 @@
fingerprint = "7FE2 113A A08B 695A C8B8 DDE6 AE53 B4C2 E58E DD45";
}];
};
+ lf- = {
+ email = "nix-maint@lfcode.ca";
+ github = "lf-";
+ githubId = 6652840;
+ name = "Jade";
+ };
lheckemann = {
email = "git@sphalerite.org";
github = "lheckemann";
@@ -7180,6 +7230,16 @@
githubId = 132835;
name = "Samuel Dionne-Riel";
};
+ samuelgrf = {
+ email = "git@samuelgrf.com";
+ github = "samuelgrf";
+ githubId = 67663538;
+ name = "Samuel Gräfenstein";
+ keys = [{
+ longkeyid = "rsa4096/0xEF76A063F15C63C8";
+ fingerprint = "FF24 5832 8FAF 4660 18C6 186E EF76 A063 F15C 63C8";
+ }];
+ };
samuelrivas = {
email = "samuelrivas@gmail.com";
github = "samuelrivas";
@@ -9065,6 +9125,16 @@
email = "zef@zef.me";
name = "Zef Hemel";
};
+ zeratax = {
+ email = "mail@zera.tax";
+ github = "ZerataX";
+ githubId = 5024958;
+ name = "Jona Abdinghoff";
+ keys = [{
+ longkeyid = "rsa4096/0x8333735E784DF9D4";
+ fingerprint = "44F7 B797 9D3A 27B1 89E0 841E 8333 735E 784D F9D4";
+ }];
+ };
zfnmxt = {
name = "zfnmxt";
email = "zfnmxt@zfnmxt.com";
@@ -9257,4 +9327,10 @@
github = "deifactor";
githubId = 30192992;
};
+ fzakaria = {
+ name = "Farid Zakaria";
+ email = "farid.m.zakaria@gmail.com";
+ github = "fzakaria";
+ githubId = 605070;
+ };
}
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index c1eeed4afd5..4ccb8483430 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -79,5 +79,4 @@ say,,,,,
std__debug,std._debug,,,,
std_normalize,std.normalize,,,,
stdlib,,,,,vyp
-pulseaudio,,,,,doronbehar
vstruct,,,,,
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 750e76a1846..d07f602f0da 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -59,6 +59,16 @@ with lib.maintainers; {
scope = "Maintain GNOME desktop environment and platform.";
};
+ jitsi = {
+ members = [
+ mmilata
+ petabyteboy
+ prusnak
+ ryantm
+ ];
+ scope = "Maintain Jitsi.";
+ };
+
matrix = {
members = [
ma27
diff --git a/nixos/doc/manual/configuration/gpu-accel.xml b/nixos/doc/manual/configuration/gpu-accel.xml
index 0aa629cce98..9928121a56e 100644
--- a/nixos/doc/manual/configuration/gpu-accel.xml
+++ b/nixos/doc/manual/configuration/gpu-accel.xml
@@ -100,6 +100,35 @@ ROCR_EXT_DIR=`nix-build '<nixpkgs>' --no-out-link -A rocm-runtime-ext`/lib
Image support Yes
+
+
+ Intel
+
+
+ Intel
+ Gen8 and later GPUs are supported by the Intel NEO OpenCL
+ runtime that is provided by the
+ intel-compute-runtime package. For Gen7 GPUs,
+ the deprecated Beignet runtime can be used, which is provided
+ by the beignet package. The proprietary Intel
+ OpenCL runtime, in the intel-ocl package, is
+ an alternative for Gen7 GPUs.
+
+
+
+ The intel-compute-runtime, beignet,
+ or intel-ocl package can be added to
+ to enable OpenCL
+ support. For example, for Gen8 and later GPUs, the following
+ configuration can be used:
+
+ = [
+ intel-compute-runtime
+];
+
+
+
@@ -190,4 +219,63 @@ GPU1:
+
+
+ Common issues
+
+
+ User permissions
+
+
+ Except where noted explicitly, it should not be necessary to
+ adjust user permissions to use these acceleration APIs. In the default
+ configuration, GPU devices have world-read/write permissions
+ (/dev/dri/renderD*) or are tagged as
+ uaccess (/dev/dri/card*). The
+ access control lists of devices with the uaccess
+ tag will be updated automatically when a user logs in through
+ systemd-logind. For example, if the user
+ jane is logged in, the access control list
+ should look as follows:
+
+ $ getfacl /dev/dri/card0
+# file: dev/dri/card0
+# owner: root
+# group: video
+user::rw-
+user:jane:rw-
+group::rw-
+mask::rw-
+other::---
+
+ If you disabled (this functionality of) systemd-logind,
+ you may need to add the user to the video group and
+ log in again.
+
+
+
+
+ Mixing different versions of nixpkgs
+
+
+ The Installable Client Driver (ICD)
+ mechanism used by OpenCL and Vulkan loads runtimes into its address
+ space using dlopen. Mixing an ICD loader mechanism and
+ runtimes from different version of nixpkgs may not work. For example,
+ if the ICD loader uses an older version of glibc
+ than the runtime, the runtime may not be loadable due to
+ missing symbols. Unfortunately, the loader will generally be quiet
+ about such issues.
+
+
+
+ If you suspect that you are running into library version mismatches
+ between an ICL loader and a runtime, you could run an application with
+ the LD_DEBUG variable set to get more diagnostic
+ information. For example, OpenCL can be tested with
+ LD_DEBUG=files clinfo, which should report missing
+ symbols.
+
+
+
diff --git a/nixos/doc/manual/development/writing-nixos-tests.xml b/nixos/doc/manual/development/writing-nixos-tests.xml
index d9dc3cd5e2a..74ab23605b3 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.xml
+++ b/nixos/doc/manual/development/writing-nixos-tests.xml
@@ -216,12 +216,12 @@ start_all()
- send_keys
+ send_key
Simulate pressing keys on the virtual keyboard, e.g.,
- send_keys("ctrl-alt-delete").
+ send_key("ctrl-alt-delete").
@@ -232,7 +232,7 @@ start_all()
Simulate typing a sequence of characters on the virtual keyboard, e.g.,
- send_keys("foobar\n") will type the string
+ send_chars("foobar\n") will type the string
foobar followed by the Enter key.
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index e03a5f5ce5c..7a06c06fed1 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -42,6 +42,11 @@
PHP now defaults to PHP 7.4, updated from 7.3.
+
+
+ PHP 7.2 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 20.09 release.
+
+
Python 3 now defaults to Python 3.8 instead of 3.7.
@@ -109,6 +114,17 @@ systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce "read-only";
systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
+
+ The MySQL service no longer runs its systemd service startup script as root anymore. A dedicated non root
+ super user account is required for operation. This means users with an existing MySQL or MariaDB database server are required to run the following SQL statements
+ as a super admin user before upgrading:
+
+CREATE USER IF NOT EXISTS 'mysql'@'localhost' identified with unix_socket;
+GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' WITH GRANT OPTION;
+
+ If you use MySQL instead of MariaDB please replace unix_socket with auth_socket. If you have changed the value of
+ from the default of mysql to a different user please change 'mysql'@'localhost' to the corresponding user instead.
+
@@ -135,6 +151,11 @@ systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
The various documented workarounds to use steam have been converted to a module. programs.steam.enable enables steam, controller support and the workarounds.
+
+
+ Support for built-in LCDs in various pieces of Logitech hardware (keyboards and USB speakers). hardware.logitech.lcd.enable enables support for all hardware supported by the g15daemon project.
+
+
@@ -518,6 +539,46 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
In the resilio module, has been changed to listen to [::1] instead of 0.0.0.0.
+
+
+
+
+ Users of OpenAFS 1.6 must
+ upgrade their services to OpenAFS 1.8! In this release, the OpenAFS package
+ version 1.6.24 is marked broken but can be used during transition to
+ OpenAFS 1.8.x. Use the options
+ ,
+ and
+ to select a different
+ OpenAFS package. OpenAFS 1.6 will be removed in the next release. The
+ package openafs and the service options will then
+ silently point to the OpenAFS 1.8 release.
+
+
+ See also the OpenAFS Administrator
+ Guide for instructions. Beware of the following when updating
+ servers:
+
+
+
+ The storage format of the server key has changed and the key must be converted before running the new release.
+
+
+
+
+ When updating multiple database servers, turn off the database servers
+ from the highest IP down to the lowest with resting periods in
+ between. Start up in reverse order. Do not concurrently run database
+ servers working with different OpenAFS releases!
+
+
+
+
+ Update servers first, then clients.
+
+
+
@@ -544,21 +605,42 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
to be used for every display-manager in NixOS.
-
+
The bitcoind module has changed to multi-instance, using submodules.
- Therefore, it is now mandatory to name each instance, e.g.:
+ Therefore, it is now mandatory to name each instance.
+ To use this new multi-instance config with an existing bitcoind data directory and user,
+ you have to adjust the original config, e.g.:
-services.bitcoind = {
- enable = true;
-};
+ services.bitcoind = {
+ enable = true;
+ extraConfig = "...";
+ ...
+ };
- requires a name now:
+ To something similar:
-services.bitcoind."example-mainnet" = {
- enable = true;
-};
+ services.bitcoind.mainnet = {
+ enable = true;
+ dataDir = "/var/lib/bitcoind";
+ user = "bitcoin";
+ extraConfig = "...";
+ ...
+ };
+ The key settings are:
+
+
+
+ dataDir - to continue using the same data directory.
+
+
+
+
+ user - to continue using the same user so that bitcoind maintains access to its files.
+
+
+
@@ -567,6 +649,48 @@ services.bitcoind."example-mainnet" = {
When updating Graylog from a version before 3.3.3 make sure to check the Graylog release info for information on how to avoid the issue.
+
+
+ The dokuwiki module has changed to multi-instance, using submodules.
+ Therefore, it is now mandatory to name each instance. Moreover, forcing SSL by default has been dropped, so
+ nginx.forceSSL and nginx.enableACME are no longer set to true.
+ To continue using your service with the original SSL settings, you have to adjust the original config, e.g.:
+
+services.dokuwiki = {
+ enable = true;
+ ...
+};
+
+ To something similar:
+
+services.dokuwiki."mywiki" = {
+ enable = true;
+ nginx = {
+ forceSSL = true;
+ enableACME = true;
+ };
+ ...
+};
+
+ The base package has also been upgraded to the 2020-07-29 "Hogfather" release. Plugins might be incompatible or require upgrading.
+
+
+
+
+ The option is now set to "/var/lib/postgresql/${cfg.package.psqlSchema}" regardless of your
+ . Users with an existing postgresql install that have a of 17.09 or below
+ should double check what the value of their option is (/var/db/postgresql) and then explicitly
+ set this value to maintain compatibility:
+
+services.postgresql.dataDir = "/var/db/postgresql";
+
+
+
+
+
+ The USBGuard module now removes options and instead hardcodes values for IPCAccessControlFiles, ruleFiles, and auditFilePath. Audit logs can be found in the journal.
+
+
@@ -602,6 +726,11 @@ services.bitcoind."example-mainnet" = {
The default output of buildGoPackage is now $out instead of $bin.
+
+
+ buildGoModuledoCheck now defaults to true.
+
+
Packages built using buildRustPackage now use release
@@ -659,6 +788,37 @@ services.bitcoind."example-mainnet" = {
was removed, as udev gained native support to handle FIDO security tokens.
+
+
+ The services.transmission module
+ was enhanced with the new options:
+ ,
+ ,
+ and .
+
+
+ transmission-daemon is now started with additional systemd sandbox/hardening options for better security.
+ Please report
+ any use case where this is not working well.
+ In particular, the RootDirectory option newly set
+ forbids uploading or downloading a torrent outside of the default directory
+ configured at settings.download-dir.
+ If you really need Transmission to access other directories,
+ you must include those directories into the BindPaths of the service:
+
+systemd.services.transmission.serviceConfig.BindPaths = [ "/path/to/alternative/download-dir" ];
+
+
+
+ Also, connection to the RPC (Remote Procedure Call) of transmission-daemon
+ is now only available on the local network interface by default.
+ Use:
+
+services.transmission.settings.rpc-bind-address = "0.0.0.0";
+
+ to get the previous behavior of listening on all network interfaces.
+
+
With this release systemd-networkd (when enabled through )
@@ -741,6 +901,12 @@ services.bitcoind."example-mainnet" = {
There are no functional changes, however this may require updating some configurations to use correct types for all attributes.
+
+
+ The fontconfig module stopped generating fontconfig 2.10.x config and cache.
+ Fontconfig 2.10.x was removed from Nixpkgs - it hasn't been used in any nixpkgs package anymore.
+
+
diff --git a/nixos/lib/make-ext4-fs.nix b/nixos/lib/make-ext4-fs.nix
index 74a6c134e64..33dbc8f5ec4 100644
--- a/nixos/lib/make-ext4-fs.nix
+++ b/nixos/lib/make-ext4-fs.nix
@@ -46,7 +46,10 @@ pkgs.stdenv.mkDerivation {
(
GLOBIGNORE=".:.."
shopt -u dotglob
- cp -a --reflink=auto ./files/* -t ./rootImage/
+
+ for f in ./files/*; do
+ cp -a --reflink=auto -t ./rootImage/ "$f"
+ done
)
# Also include a manifest of the closures in a format suitable for nix-store --load-db
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 772b7d3add9..a1161621f0d 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -36,7 +36,7 @@ let
// lib.optionalAttrs (opt ? example) { example = substFunction opt.example; }
// lib.optionalAttrs (opt ? default) { default = substFunction opt.default; }
// lib.optionalAttrs (opt ? type) { type = substFunction opt.type; }
- // lib.optionalAttrs (opt ? relatedPackages && opt.relatedPackages != []) { relatedPackages = genRelatedPackages opt.relatedPackages; }
+ // lib.optionalAttrs (opt ? relatedPackages && opt.relatedPackages != []) { relatedPackages = genRelatedPackages opt.relatedPackages opt.name; }
);
# Generate DocBook documentation for a list of packages. This is
@@ -48,7 +48,7 @@ let
# - a list: that will be interpreted as an attribute path from `pkgs`,
# - an attrset: that can specify `name`, `path`, `package`, `comment`
# (either of `name`, `path` is required, the rest are optional).
- genRelatedPackages = packages:
+ genRelatedPackages = packages: optName:
let
unpack = p: if lib.isString p then { name = p; }
else if lib.isList p then { path = p; }
@@ -58,7 +58,7 @@ let
title = args.title or null;
name = args.name or (lib.concatStringsSep "." args.path);
path = args.path or [ args.name ];
- package = args.package or (lib.attrByPath path (throw "Invalid package attribute path `${toString path}'") pkgs);
+ package = args.package or (lib.attrByPath path (throw "Invalid package attribute path `${toString path}' found while evaluating `relatedPackages' of option `${optName}'") pkgs);
in ""
+ "${lib.optionalString (title != null) "${title} aka "}pkgs.${name} (${package.meta.name})"
+ lib.optionalString (!package.meta.available) " [UNAVAILABLE]"
diff --git a/nixos/lib/test-driver/Logger.pm b/nixos/lib/test-driver/Logger.pm
index 080310ea34e..a3384084a0e 100644
--- a/nixos/lib/test-driver/Logger.pm
+++ b/nixos/lib/test-driver/Logger.pm
@@ -8,17 +8,17 @@ use Time::HiRes qw(clock_gettime CLOCK_MONOTONIC);
sub new {
my ($class) = @_;
-
+
my $logFile = defined $ENV{LOGFILE} ? "$ENV{LOGFILE}" : "/dev/null";
my $log = new XML::Writer(OUTPUT => new IO::File(">$logFile"));
-
+
my $self = {
log => $log,
logQueue => Thread::Queue->new()
};
-
+
$self->{log}->startTag("logfile");
-
+
bless $self, $class;
return $self;
}
diff --git a/nixos/maintainers/scripts/azure-new/.gitignore b/nixos/maintainers/scripts/azure-new/.gitignore
index 26905a86234..9271abf14a0 100644
--- a/nixos/maintainers/scripts/azure-new/.gitignore
+++ b/nixos/maintainers/scripts/azure-new/.gitignore
@@ -1 +1 @@
-azure
\ No newline at end of file
+azure
diff --git a/nixos/maintainers/scripts/azure-new/README.md b/nixos/maintainers/scripts/azure-new/README.md
index 20e81c44ce5..e5b69dacec0 100644
--- a/nixos/maintainers/scripts/azure-new/README.md
+++ b/nixos/maintainers/scripts/azure-new/README.md
@@ -20,7 +20,7 @@ $ ./upload-image.sh ./examples/basic/image.nix
+ nix-build ./examples/basic/image.nix --out-link azure
/nix/store/qdpzknpskzw30vba92mb24xzll1dqsmd-azure-image
...
-95.5 %, 0 Done, 0 Failed, 1 Pending, 0 Skipped, 1 Total, 2-sec Throughput (Mb/s): 932.9565
+95.5 %, 0 Done, 0 Failed, 1 Pending, 0 Skipped, 1 Total, 2-sec Throughput (Mb/s): 932.9565
...
/subscriptions/aff271ee-e9be-4441-b9bb-42f5af4cbaeb/resourceGroups/nixos-images/providers/Microsoft.Compute/images/azure-image-todo-makethisbetter
```
diff --git a/nixos/maintainers/scripts/azure-new/upload-image.sh b/nixos/maintainers/scripts/azure-new/upload-image.sh
index 1466dcd1f0a..143afbd7f96 100755
--- a/nixos/maintainers/scripts/azure-new/upload-image.sh
+++ b/nixos/maintainers/scripts/azure-new/upload-image.sh
@@ -37,8 +37,8 @@ if ! az disk show -g "${group}" -n "${img_name}" &>/dev/null; then
)"
azcopy copy "${img_file}" "${sasurl}" \
- --blob-type PageBlob
-
+ --blob-type PageBlob
+
az disk revoke-access \
--resource-group "${group}" \
--name "${img_name}"
diff --git a/nixos/modules/config/appstream.nix b/nixos/modules/config/appstream.nix
index 483ac9c3cd7..a72215c2f56 100644
--- a/nixos/modules/config/appstream.nix
+++ b/nixos/modules/config/appstream.nix
@@ -7,18 +7,18 @@ with lib;
type = types.bool;
default = true;
description = ''
- Whether to install files to support the
+ Whether to install files to support the
AppStream metadata specification.
'';
};
};
config = mkIf config.appstream.enable {
- environment.pathsToLink = [
+ environment.pathsToLink = [
# per component metadata
- "/share/metainfo"
+ "/share/metainfo"
# legacy path for above
- "/share/appdata"
+ "/share/appdata"
];
};
diff --git a/nixos/modules/config/fonts/fontconfig.nix b/nixos/modules/config/fonts/fontconfig.nix
index 52d284f739b..84643019471 100644
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@@ -1,11 +1,6 @@
/*
-NixOS support 2 fontconfig versions, "support" and "latest".
-
-- "latest" refers to default fontconfig package (pkgs.fontconfig).
- configuration files are linked to /etc/fonts/VERSION/conf.d/
-- "support" refers to supportPkg (pkgs."fontconfig_${supportVersion}").
- configuration files are linked to /etc/fonts/conf.d/
+Configuration files are linked to /etc/fonts/${pkgs.fontconfig.configVersion}/conf.d/
This module generates a package containing configuration files and link it in /etc/fonts.
@@ -22,40 +17,21 @@ let
cfg = config.fonts.fontconfig;
fcBool = x: "" + (boolToString x) + "";
-
- # back-supported fontconfig version and package
- # version is used for font cache generation
- supportVersion = "210";
- supportPkg = pkgs."fontconfig_${supportVersion}";
-
- # latest fontconfig version and package
- # version is used for configuration folder name, /etc/fonts/VERSION/
- # note: format differs from supportVersion and can not be used with makeCacheConf
- latestVersion = pkgs.fontconfig.configVersion;
- latestPkg = pkgs.fontconfig;
-
- # supported version fonts.conf
- supportFontsConf = pkgs.makeFontsConf { fontconfig = supportPkg; fontDirectories = config.fonts.fonts; };
+ pkg = pkgs.fontconfig;
# configuration file to read fontconfig cache
- # version dependent
# priority 0
- cacheConfSupport = makeCacheConf { version = supportVersion; };
- cacheConfLatest = makeCacheConf {};
+ cacheConf = makeCacheConf {};
- # generate the font cache setting file for a fontconfig version
- # use latest when no version is passed
+ # generate the font cache setting file
# When cross-compiling, we can’t generate the cache, so we skip the
# part. fontconfig still works but is a little slower in
# looking things up.
- makeCacheConf = { version ? null }:
+ makeCacheConf = { }:
let
- fcPackage = if version == null
- then "fontconfig"
- else "fontconfig_${version}";
makeCache = fontconfig: pkgs.makeFontsCache { inherit fontconfig; fontDirectories = config.fonts.fonts; };
- cache = makeCache pkgs.${fcPackage};
- cache32 = makeCache pkgs.pkgsi686Linux.${fcPackage};
+ cache = makeCache pkgs.fontconfig;
+ cache32 = makeCache pkgs.pkgsi686Linux.fontconfig;
in
pkgs.writeText "fc-00-nixos-cache.conf" ''
@@ -200,59 +176,52 @@ let
confPkg = pkgs.runCommand "fontconfig-conf" {
preferLocalBuild = true;
} ''
- support_folder=$out/etc/fonts/conf.d
- latest_folder=$out/etc/fonts/${latestVersion}/conf.d
-
- mkdir -p $support_folder
- mkdir -p $latest_folder
+ dst=$out/etc/fonts/${pkg.configVersion}/conf.d
+ mkdir -p $dst
# fonts.conf
- ln -s ${supportFontsConf} $support_folder/../fonts.conf
- ln -s ${latestPkg.out}/etc/fonts/fonts.conf \
- $latest_folder/../fonts.conf
+ ln -s ${pkg.out}/etc/fonts/fonts.conf \
+ $dst/../fonts.conf
+ # TODO: remove this legacy symlink once people stop using packages built before #95358 was merged
+ ln -s /etc/fonts/${pkg.configVersion}/fonts.conf \
+ $out/etc/fonts/fonts.conf
# fontconfig default config files
- ln -s ${supportPkg.out}/etc/fonts/conf.d/*.conf \
- $support_folder/
- # Latest fontconfig is configured to look for the upstream defaults inside the package.
+ ln -s ${pkg.out}/etc/fonts/conf.d/*.conf \
+ $dst/
+
+ # update 51-local.conf path to look at local.conf
+ rm $dst/51-local.conf
+
+ substitute ${pkg.out}/etc/fonts/conf.d/51-local.conf \
+ $dst/51-local.conf \
+ --replace local.conf /etc/fonts/${pkg.configVersion}/local.conf
# 00-nixos-cache.conf
- ln -s ${cacheConfSupport} \
- $support_folder/00-nixos-cache.conf
- ln -s ${cacheConfLatest} $latest_folder/00-nixos-cache.conf
+ ln -s ${cacheConf} $dst/00-nixos-cache.conf
# 10-nixos-rendering.conf
- ln -s ${renderConf} $support_folder/10-nixos-rendering.conf
- ln -s ${renderConf} $latest_folder/10-nixos-rendering.conf
+ ln -s ${renderConf} $dst/10-nixos-rendering.conf
# 50-user.conf
${optionalString (!cfg.includeUserConf) ''
- rm $support_folder/50-user.conf
- ''}
- # Since latest fontconfig looks for default files inside the package,
- # we had to move this one elsewhere to be able to exclude it here.
- ${optionalString cfg.includeUserConf ''
- ln -s ${latestPkg.out}/etc/fonts/conf.d.bak/50-user.conf $latest_folder/50-user.conf
+ rm $dst/50-user.conf
''}
# local.conf (indirect priority 51)
${optionalString (cfg.localConf != "") ''
- ln -s ${localConf} $support_folder/../local.conf
- ln -s ${localConf} $latest_folder/../local.conf
+ ln -s ${localConf} $dst/../local.conf
''}
# 52-nixos-default-fonts.conf
- ln -s ${defaultFontsConf} $support_folder/52-nixos-default-fonts.conf
- ln -s ${defaultFontsConf} $latest_folder/52-nixos-default-fonts.conf
+ ln -s ${defaultFontsConf} $dst/52-nixos-default-fonts.conf
# 53-no-bitmaps.conf
- ln -s ${rejectBitmaps} $support_folder/53-no-bitmaps.conf
- ln -s ${rejectBitmaps} $latest_folder/53-no-bitmaps.conf
+ ln -s ${rejectBitmaps} $dst/53-no-bitmaps.conf
${optionalString (!cfg.allowType1) ''
# 53-nixos-reject-type1.conf
- ln -s ${rejectType1} $support_folder/53-nixos-reject-type1.conf
- ln -s ${rejectType1} $latest_folder/53-nixos-reject-type1.conf
+ ln -s ${rejectType1} $dst/53-nixos-reject-type1.conf
''}
'';
diff --git a/nixos/modules/hardware/bladeRF.nix b/nixos/modules/hardware/bladeRF.nix
index 92544347714..35b74b8382e 100644
--- a/nixos/modules/hardware/bladeRF.nix
+++ b/nixos/modules/hardware/bladeRF.nix
@@ -25,4 +25,4 @@ in
services.udev.packages = [ pkgs.libbladeRF ];
users.groups.bladerf = {};
};
-}
\ No newline at end of file
+}
diff --git a/nixos/modules/hardware/ckb-next.nix b/nixos/modules/hardware/ckb-next.nix
index fe0ca9f26d5..6932be1c54c 100644
--- a/nixos/modules/hardware/ckb-next.nix
+++ b/nixos/modules/hardware/ckb-next.nix
@@ -43,7 +43,6 @@ in
serviceConfig = {
ExecStart = "${cfg.package}/bin/ckb-next-daemon ${optionalString (cfg.gid != null) "--gid=${builtins.toString cfg.gid}"}";
Restart = "on-failure";
- StandardOutput = "syslog";
};
};
};
diff --git a/nixos/modules/hardware/logitech.nix b/nixos/modules/hardware/logitech.nix
index d6f43bdddcc..3ebe6aacf5d 100644
--- a/nixos/modules/hardware/logitech.nix
+++ b/nixos/modules/hardware/logitech.nix
@@ -5,24 +5,92 @@ with lib;
let
cfg = config.hardware.logitech;
-in {
- options.hardware.logitech = {
- enable = mkEnableOption "Logitech Devices";
+ vendor = "046d";
- enableGraphical = mkOption {
- type = types.bool;
- default = false;
- description = "Enable graphical support applications.";
+ daemon = "g15daemon";
+
+in
+{
+ imports = [
+ (mkRenamedOptionModule [ "hardware" "logitech" "enable" ] [ "hardware" "logitech" "wireless" "enable" ])
+ (mkRenamedOptionModule [ "hardware" "logitech" "enableGraphical" ] [ "hardware" "logitech" "wireless" "enableGraphical" ])
+ ];
+
+ options.hardware.logitech = {
+
+ lcd = {
+ enable = mkEnableOption "Logitech LCD Devices";
+
+ startWhenNeeded = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Only run the service when an actual supported device is plugged.
+ '';
+ };
+
+ devices = mkOption {
+ type = types.listOf types.str;
+ default = [ "0a07" "c222" "c225" "c227" "c251" ];
+ description = ''
+ List of USB device ids supported by g15daemon.
+
+
+ You most likely do not need to change this.
+ '';
+ };
+ };
+
+ wireless = {
+ enable = mkEnableOption "Logitech Wireless Devices";
+
+ enableGraphical = mkOption {
+ type = types.bool;
+ default = false;
+ description = "Enable graphical support applications.";
+ };
};
};
- config = lib.mkIf cfg.enable {
- environment.systemPackages = [
- pkgs.ltunify
- ] ++ lib.optional cfg.enableGraphical pkgs.solaar;
+ config = lib.mkIf (cfg.wireless.enable || cfg.lcd.enable) {
+ environment.systemPackages = []
+ ++ lib.optional cfg.wireless.enable pkgs.ltunify
+ ++ lib.optional cfg.wireless.enableGraphical pkgs.solaar;
- # ltunifi and solaar both provide udev rules but the most up-to-date have been split
- # out into a dedicated derivation
- services.udev.packages = with pkgs; [ logitech-udev-rules ];
+ services.udev = {
+ # ltunifi and solaar both provide udev rules but the most up-to-date have been split
+ # out into a dedicated derivation
+
+ packages = []
+ ++ lib.optional cfg.wireless.enable pkgs.logitech-udev-rules
+ ++ lib.optional cfg.lcd.enable pkgs.g15daemon;
+
+ extraRules = ''
+ # nixos: hardware.logitech.lcd
+ '' + lib.concatMapStringsSep "\n" (
+ dev:
+ ''ACTION=="add", SUBSYSTEMS=="usb", ATTRS{idVendor}=="${vendor}", ATTRS{idProduct}=="${dev}", TAG+="systemd", ENV{SYSTEMD_WANTS}+="${daemon}.service"''
+ ) cfg.lcd.devices;
+ };
+
+ systemd.services."${daemon}" = lib.mkIf cfg.lcd.enable {
+ description = "Logitech LCD Support Daemon";
+ documentation = [ "man:g15daemon(1)" ];
+ wantedBy = lib.mkIf (! cfg.lcd.startWhenNeeded) "multi-user.target";
+
+ serviceConfig = {
+ Type = "forking";
+ ExecStart = "${pkgs.g15daemon}/bin/g15daemon";
+ # we patch it to write to /run/g15daemon/g15daemon.pid instead of
+ # /run/g15daemon.pid so systemd will do the cleanup for us.
+ PIDFile = "/run/${daemon}/g15daemon.pid";
+ PrivateTmp = true;
+ PrivateNetwork = true;
+ ProtectHome = "tmpfs";
+ ProtectSystem = "full"; # strict doesn't work
+ RuntimeDirectory = daemon;
+ Restart = "on-failure";
+ };
+ };
};
}
diff --git a/nixos/modules/hardware/tuxedo-keyboard.nix b/nixos/modules/hardware/tuxedo-keyboard.nix
index 898eed24493..97af7c61f3c 100644
--- a/nixos/modules/hardware/tuxedo-keyboard.nix
+++ b/nixos/modules/hardware/tuxedo-keyboard.nix
@@ -2,7 +2,7 @@
with lib;
-let
+let
cfg = config.hardware.tuxedo-keyboard;
tuxedo-keyboard = config.boot.kernelPackages.tuxedo-keyboard;
in
@@ -27,7 +27,7 @@ in
'';
};
- config = mkIf cfg.enable
+ config = mkIf cfg.enable
{
boot.kernelModules = ["tuxedo_keyboard"];
boot.extraModulePackages = [ tuxedo-keyboard ];
diff --git a/nixos/modules/i18n/input-method/uim.nix b/nixos/modules/i18n/input-method/uim.nix
index 7ad68bf851f..459294657e0 100644
--- a/nixos/modules/i18n/input-method/uim.nix
+++ b/nixos/modules/i18n/input-method/uim.nix
@@ -2,7 +2,7 @@
with lib;
-let
+let
cfg = config.i18n.inputMethod.uim;
in
{
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 1cd2252ecf2..405fbfa10db 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -417,6 +417,14 @@ in
'';
};
+ isoImage.squashfsCompression = mkOption {
+ default = "xz -Xdict-size 100%";
+ description = ''
+ Compression settings to use for the squashfs nix store.
+ '';
+ example = "zstd -Xcompression-level 6";
+ };
+
isoImage.edition = mkOption {
default = "";
description = ''
@@ -614,6 +622,7 @@ in
# Create the squashfs image that contains the Nix store.
system.build.squashfsStore = pkgs.callPackage ../../../lib/make-squashfs.nix {
storeContents = config.isoImage.storeContents;
+ comp = config.isoImage.squashfsCompression;
};
# Individual files to be included on the CD, outside of the Nix
diff --git a/nixos/modules/installer/cd-dvd/system-tarball-pc-readme.txt b/nixos/modules/installer/cd-dvd/system-tarball-pc-readme.txt
index 84252f292c5..887bf60d0fb 100644
--- a/nixos/modules/installer/cd-dvd/system-tarball-pc-readme.txt
+++ b/nixos/modules/installer/cd-dvd/system-tarball-pc-readme.txt
@@ -63,7 +63,7 @@ Activate the system: look for a directory in nix/store similar to:
Having found it, activate that nixos system *twice*:
chroot . /nix/store/SOMETHING-nixos-SOMETHING/activate
chroot . /nix/store/SOMETHING-nixos-SOMETHING/activate
-
+
This runs a 'hostname' command. Restore your old hostname with:
hostname OLDHOSTNAME
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 08a5f32c4c9..2cc36078223 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -331,6 +331,7 @@
./services/development/bloop.nix
./services/development/hoogle.nix
./services/development/jupyter/default.nix
+ ./services/development/jupyterhub/default.nix
./services/development/lorri.nix
./services/editors/emacs.nix
./services/editors/infinoted.nix
@@ -488,6 +489,7 @@
./services/misc/parsoid.nix
./services/misc/plex.nix
./services/misc/tautulli.nix
+ ./services/misc/pinnwand.nix
./services/misc/pykms.nix
./services/misc/radarr.nix
./services/misc/redmine.nix
@@ -646,6 +648,8 @@
./services/networking/iperf3.nix
./services/networking/ircd-hybrid/default.nix
./services/networking/iwd.nix
+ ./services/networking/jicofo.nix
+ ./services/networking/jitsi-videobridge.nix
./services/networking/keepalived/default.nix
./services/networking/keybase.nix
./services/networking/kippo.nix
@@ -674,6 +678,7 @@
./services/networking/nat.nix
./services/networking/ndppd.nix
./services/networking/networkmanager.nix
+ ./services/networking/nextdns.nix
./services/networking/nftables.nix
./services/networking/ngircd.nix
./services/networking/nghttpx/default.nix
@@ -835,6 +840,7 @@
./services/ttys/gpm.nix
./services/ttys/kmscon.nix
./services/wayland/cage.nix
+ ./services/video/mirakurun.nix
./services/web-apps/atlassian/confluence.nix
./services/web-apps/atlassian/crowd.nix
./services/web-apps/atlassian/jira.nix
@@ -852,6 +858,7 @@
./services/web-apps/icingaweb2/module-monitoring.nix
./services/web-apps/ihatemoney
./services/web-apps/jirafeau.nix
+ ./services/web-apps/jitsi-meet.nix
./services/web-apps/limesurvey.nix
./services/web-apps/mattermost.nix
./services/web-apps/mediawiki.nix
@@ -922,6 +929,7 @@
./services/x11/gdk-pixbuf.nix
./services/x11/imwheel.nix
./services/x11/redshift.nix
+ ./services/x11/urserver.nix
./services/x11/urxvtd.nix
./services/x11/window-managers/awesome.nix
./services/x11/window-managers/default.nix
diff --git a/nixos/modules/programs/autojump.nix b/nixos/modules/programs/autojump.nix
index 3a8feec4bb4..ecfc2f65807 100644
--- a/nixos/modules/programs/autojump.nix
+++ b/nixos/modules/programs/autojump.nix
@@ -18,7 +18,7 @@ in
'';
};
};
- };
+ };
###### implementation
@@ -26,7 +26,7 @@ in
environment.pathsToLink = [ "/share/autojump" ];
environment.systemPackages = [ pkgs.autojump ];
- programs.bash.interactiveShellInit = "source ${pkgs.autojump}/share/autojump/autojump.bash";
+ programs.bash.interactiveShellInit = "source ${pkgs.autojump}/share/autojump/autojump.bash";
programs.zsh.interactiveShellInit = mkIf prg.zsh.enable "source ${pkgs.autojump}/share/autojump/autojump.zsh";
programs.fish.interactiveShellInit = mkIf prg.fish.enable "source ${pkgs.autojump}/share/autojump/autojump.fish";
};
diff --git a/nixos/modules/programs/ccache.nix b/nixos/modules/programs/ccache.nix
index 874774c72b4..3c9e64932f1 100644
--- a/nixos/modules/programs/ccache.nix
+++ b/nixos/modules/programs/ccache.nix
@@ -80,4 +80,4 @@ in {
];
})
];
-}
\ No newline at end of file
+}
diff --git a/nixos/modules/programs/freetds.nix b/nixos/modules/programs/freetds.nix
index e0860a242b7..b4b657e391b 100644
--- a/nixos/modules/programs/freetds.nix
+++ b/nixos/modules/programs/freetds.nix
@@ -25,7 +25,7 @@ in
''';
}
'';
- description =
+ description =
''
Configure freetds database entries. Each attribute denotes
a section within freetds.conf, and the value (a string) is the config
@@ -47,7 +47,7 @@ in
environment.variables.FREETDS = "/etc/freetds.conf";
environment.variables.SYBASE = "${pkgs.freetds}";
- environment.etc."freetds.conf" = { text =
+ environment.etc."freetds.conf" = { text =
(concatStrings (mapAttrsToList (name: value:
''
[${name}]
diff --git a/nixos/modules/security/tpm2.nix b/nixos/modules/security/tpm2.nix
index 13804fb82cb..27f9b58c975 100644
--- a/nixos/modules/security/tpm2.nix
+++ b/nixos/modules/security/tpm2.nix
@@ -170,7 +170,6 @@ in {
Restart = "always";
RestartSec = 30;
BusName = "com.intel.tss2.Tabrmd";
- StandardOutput = "syslog";
ExecStart = "${cfg.abrmd.package}/bin/tpm2-abrmd";
User = "tss";
Group = "nogroup";
diff --git a/nixos/modules/services/audio/icecast.nix b/nixos/modules/services/audio/icecast.nix
index 6a8a0f9975b..f40ea6be29d 100644
--- a/nixos/modules/services/audio/icecast.nix
+++ b/nixos/modules/services/audio/icecast.nix
@@ -23,7 +23,7 @@ let
${toString cfg.listen.port}${cfg.listen.address}
-
+
0
@@ -70,7 +70,7 @@ in {
description = "Base directory used for logging.";
default = "/var/log/icecast";
};
-
+
listen = {
port = mkOption {
type = types.int;
diff --git a/nixos/modules/services/backup/bacula.nix b/nixos/modules/services/backup/bacula.nix
index cef304734ae..3d69a69038a 100644
--- a/nixos/modules/services/backup/bacula.nix
+++ b/nixos/modules/services/backup/bacula.nix
@@ -18,7 +18,7 @@ let
Pid Directory = "/run";
${fd_cfg.extraClientConfig}
}
-
+
${concatStringsSep "\n" (mapAttrsToList (name: value: ''
Director {
Name = "${name}";
@@ -26,7 +26,7 @@ let
Monitor = "${value.monitor}";
}
'') fd_cfg.director)}
-
+
Messages {
Name = Standard;
syslog = all, !skipped, !restored
@@ -35,7 +35,7 @@ let
'';
sd_cfg = config.services.bacula-sd;
- sd_conf = pkgs.writeText "bacula-sd.conf"
+ sd_conf = pkgs.writeText "bacula-sd.conf"
''
Storage {
Name = "${sd_cfg.name}";
@@ -80,7 +80,7 @@ let
'';
dir_cfg = config.services.bacula-dir;
- dir_conf = pkgs.writeText "bacula-dir.conf"
+ dir_conf = pkgs.writeText "bacula-dir.conf"
''
Director {
Name = "${dir_cfg.name}";
@@ -125,10 +125,10 @@ let
The password is plain text. It is not generated through any special
process but as noted above, it is better to use random text for
- security reasons.
+ security reasons.
'';
};
-
+
monitor = mkOption {
default = "no";
example = "yes";
@@ -140,7 +140,7 @@ let
Please note that if this director is being used by a Monitor, we
highly recommend to set this directive to yes to avoid serious
- security problems.
+ security problems.
'';
};
};
@@ -163,7 +163,7 @@ let
type of autochanger, what you specify here can vary. This directive
is optional. See the Using AutochangersAutochangersChapter chapter of
this manual for more details of using this and the following
- autochanger directives.
+ autochanger directives.
'';
};
@@ -200,7 +200,7 @@ let
Extra configuration to be passed in Autochanger directive.
'';
example = ''
-
+
'';
};
};
@@ -222,7 +222,7 @@ let
if you are archiving to disk storage. In this case, you must supply
the full absolute path to the directory. When specifying a tape
device, it is preferable that the "non-rewind" variant of the device
- file name be given.
+ file name be given.
'';
};
@@ -290,7 +290,7 @@ in {
Whether to enable the Bacula File Daemon.
'';
};
-
+
name = mkOption {
default = "${config.networking.hostName}-fd";
description = ''
@@ -300,7 +300,7 @@ in {
Clients. This directive is required.
'';
};
-
+
port = mkOption {
default = 9102;
type = types.int;
@@ -310,7 +310,7 @@ in {
the Client resource of the Director's configuration file.
'';
};
-
+
director = mkOption {
default = {};
description = ''
@@ -349,14 +349,14 @@ in {
Whether to enable Bacula Storage Daemon.
'';
};
-
+
name = mkOption {
default = "${config.networking.hostName}-sd";
description = ''
Specifies the Name of the Storage daemon.
'';
};
-
+
port = mkOption {
default = 9103;
type = types.int;
@@ -410,7 +410,7 @@ in {
console = all
'';
};
-
+
};
services.bacula-dir = {
@@ -429,7 +429,7 @@ in {
required.
'';
};
-
+
port = mkOption {
default = 9101;
type = types.int;
@@ -442,7 +442,7 @@ in {
specify DirAddresses (N.B plural) directive.
'';
};
-
+
password = mkOption {
# TODO: required?
description = ''
diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix
index c38fd361d35..d869835bf07 100644
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@@ -55,7 +55,7 @@ in
Configuration for the rclone remote being used for backup.
See the remote's specific options under rclone's docs at
. When specifying
- option names, use the "config" name specified in the docs.
+ option names, use the "config" name specified in the docs.
For example, to set --b2-hard-delete for a B2
remote, use hard_delete = true in the
attribute set.
diff --git a/nixos/modules/services/backup/zfs-replication.nix b/nixos/modules/services/backup/zfs-replication.nix
index 5a64304275d..6d75774c78f 100644
--- a/nixos/modules/services/backup/zfs-replication.nix
+++ b/nixos/modules/services/backup/zfs-replication.nix
@@ -18,7 +18,7 @@ in {
};
host = mkOption {
- description = "Remote host where snapshots should be sent.";
+ description = "Remote host where snapshots should be sent. lz4 is expected to be installed on this host.";
example = "example.com";
type = types.str;
};
diff --git a/nixos/modules/services/computing/torque/mom.nix b/nixos/modules/services/computing/torque/mom.nix
index 83772539a7a..0c5f43cf3e6 100644
--- a/nixos/modules/services/computing/torque/mom.nix
+++ b/nixos/modules/services/computing/torque/mom.nix
@@ -60,4 +60,4 @@ in
};
};
-}
+}
diff --git a/nixos/modules/services/computing/torque/server.nix b/nixos/modules/services/computing/torque/server.nix
index 655d1500497..21c5a4f4672 100644
--- a/nixos/modules/services/computing/torque/server.nix
+++ b/nixos/modules/services/computing/torque/server.nix
@@ -93,4 +93,4 @@ in
};
};
-}
+}
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index 2e8c5b7640b..7d0a3f9afc4 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -6,12 +6,10 @@ let
cfg = config.services.mysql;
- mysql = cfg.package;
-
- isMariaDB = lib.getName mysql == lib.getName pkgs.mariadb;
+ isMariaDB = lib.getName cfg.package == lib.getName pkgs.mariadb;
mysqldOptions =
- "--user=${cfg.user} --datadir=${cfg.dataDir} --basedir=${mysql}";
+ "--user=${cfg.user} --datadir=${cfg.dataDir} --basedir=${cfg.package}";
settingsFile = pkgs.writeText "my.cnf" (
generators.toINI { listsAsDuplicateKeys = true; } cfg.settings +
@@ -22,7 +20,7 @@ in
{
imports = [
- (mkRemovedOptionModule [ "services" "mysql" "pidDir" ] "Don't wait for pidfiles, describe dependencies through systemd")
+ (mkRemovedOptionModule [ "services" "mysql" "pidDir" ] "Don't wait for pidfiles, describe dependencies through systemd.")
(mkRemovedOptionModule [ "services" "mysql" "rootPassword" ] "Use socket authentication or set the password outside of the nix store.")
];
@@ -46,25 +44,31 @@ in
type = types.nullOr types.str;
default = null;
example = literalExample "0.0.0.0";
- description = "Address to bind to. The default is to bind to all addresses";
+ description = "Address to bind to. The default is to bind to all addresses.";
};
port = mkOption {
type = types.int;
default = 3306;
- description = "Port of MySQL";
+ description = "Port of MySQL.";
};
user = mkOption {
type = types.str;
default = "mysql";
- description = "User account under which MySQL runs";
+ description = "User account under which MySQL runs.";
+ };
+
+ group = mkOption {
+ type = types.str;
+ default = "mysql";
+ description = "Group under which MySQL runs.";
};
dataDir = mkOption {
type = types.path;
example = "/var/lib/mysql";
- description = "Location where MySQL stores its table files";
+ description = "Location where MySQL stores its table files.";
};
configFile = mkOption {
@@ -171,7 +175,7 @@ in
initialScript = mkOption {
type = types.nullOr types.path;
default = null;
- description = "A file containing SQL statements to be executed on the first startup. Can be used for granting certain permissions on the database";
+ description = "A file containing SQL statements to be executed on the first startup. Can be used for granting certain permissions on the database.";
};
ensureDatabases = mkOption {
@@ -259,33 +263,33 @@ in
serverId = mkOption {
type = types.int;
default = 1;
- description = "Id of the MySQL server instance. This number must be unique for each instance";
+ description = "Id of the MySQL server instance. This number must be unique for each instance.";
};
masterHost = mkOption {
type = types.str;
- description = "Hostname of the MySQL master server";
+ description = "Hostname of the MySQL master server.";
};
slaveHost = mkOption {
type = types.str;
- description = "Hostname of the MySQL slave server";
+ description = "Hostname of the MySQL slave server.";
};
masterUser = mkOption {
type = types.str;
- description = "Username of the MySQL replication user";
+ description = "Username of the MySQL replication user.";
};
masterPassword = mkOption {
type = types.str;
- description = "Password of the MySQL replication user";
+ description = "Password of the MySQL replication user.";
};
masterPort = mkOption {
type = types.int;
default = 3306;
- description = "Port number on which the MySQL master server runs";
+ description = "Port number on which the MySQL master server runs.";
};
};
};
@@ -317,29 +321,33 @@ in
binlog-ignore-db = [ "information_schema" "performance_schema" "mysql" ];
})
(mkIf (!isMariaDB) {
- plugin-load-add = optional (cfg.ensureUsers != []) "auth_socket.so";
+ plugin-load-add = "auth_socket.so";
})
];
- users.users.mysql = {
- description = "MySQL server user";
- group = "mysql";
- uid = config.ids.uids.mysql;
+ users.users = optionalAttrs (cfg.user == "mysql") {
+ mysql = {
+ description = "MySQL server user";
+ group = cfg.group;
+ uid = config.ids.uids.mysql;
+ };
};
- users.groups.mysql.gid = config.ids.gids.mysql;
+ users.groups = optionalAttrs (cfg.group == "mysql") {
+ mysql.gid = config.ids.gids.mysql;
+ };
- environment.systemPackages = [mysql];
+ environment.systemPackages = [ cfg.package ];
environment.etc."my.cnf".source = cfg.configFile;
systemd.tmpfiles.rules = [
- "d '${cfg.dataDir}' 0700 ${cfg.user} mysql - -"
- "z '${cfg.dataDir}' 0700 ${cfg.user} mysql - -"
+ "d '${cfg.dataDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
+ "z '${cfg.dataDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
];
systemd.services.mysql = let
- hasNotify = (cfg.package == pkgs.mariadb);
+ hasNotify = isMariaDB;
in {
description = "MySQL Server";
@@ -357,125 +365,127 @@ in
preStart = if isMariaDB then ''
if ! test -e ${cfg.dataDir}/mysql; then
- ${mysql}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${mysqldOptions}
+ ${cfg.package}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${mysqldOptions}
touch ${cfg.dataDir}/mysql_init
fi
'' else ''
if ! test -e ${cfg.dataDir}/mysql; then
- ${mysql}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} --initialize-insecure
+ ${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} --initialize-insecure
touch ${cfg.dataDir}/mysql_init
fi
'';
+ postStart = let
+ # The super user account to use on *first* run of MySQL server
+ superUser = if isMariaDB then cfg.user else "root";
+ in ''
+ ${optionalString (!hasNotify) ''
+ # Wait until the MySQL server is available for use
+ count=0
+ while [ ! -e /run/mysqld/mysqld.sock ]
+ do
+ if [ $count -eq 30 ]
+ then
+ echo "Tried 30 times, giving up..."
+ exit 1
+ fi
+
+ echo "MySQL daemon not yet started. Waiting for 1 second..."
+ count=$((count++))
+ sleep 1
+ done
+ ''}
+
+ if [ -f ${cfg.dataDir}/mysql_init ]
+ then
+ # While MariaDB comes with a 'mysql' super user account since 10.4.x, MySQL does not
+ # Since we don't want to run this service as 'root' we need to ensure the account exists on first run
+ ( echo "CREATE USER IF NOT EXISTS '${cfg.user}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
+ echo "GRANT ALL PRIVILEGES ON *.* TO '${cfg.user}'@'localhost' WITH GRANT OPTION;"
+ ) | ${cfg.package}/bin/mysql -u ${superUser} -N
+
+ ${concatMapStrings (database: ''
+ # Create initial databases
+ if ! test -e "${cfg.dataDir}/${database.name}"; then
+ echo "Creating initial database: ${database.name}"
+ ( echo 'create database `${database.name}`;'
+
+ ${optionalString (database.schema != null) ''
+ echo 'use `${database.name}`;'
+
+ # TODO: this silently falls through if database.schema does not exist,
+ # we should catch this somehow and exit, but can't do it here because we're in a subshell.
+ if [ -f "${database.schema}" ]
+ then
+ cat ${database.schema}
+ elif [ -d "${database.schema}" ]
+ then
+ cat ${database.schema}/mysql-databases/*.sql
+ fi
+ ''}
+ ) | ${cfg.package}/bin/mysql -u ${superUser} -N
+ fi
+ '') cfg.initialDatabases}
+
+ ${optionalString (cfg.replication.role == "master")
+ ''
+ # Set up the replication master
+
+ ( echo "use mysql;"
+ echo "CREATE USER '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}' IDENTIFIED WITH mysql_native_password;"
+ echo "SET PASSWORD FOR '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}' = PASSWORD('${cfg.replication.masterPassword}');"
+ echo "GRANT REPLICATION SLAVE ON *.* TO '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}';"
+ ) | ${cfg.package}/bin/mysql -u ${superUser} -N
+ ''}
+
+ ${optionalString (cfg.replication.role == "slave")
+ ''
+ # Set up the replication slave
+
+ ( echo "stop slave;"
+ echo "change master to master_host='${cfg.replication.masterHost}', master_user='${cfg.replication.masterUser}', master_password='${cfg.replication.masterPassword}';"
+ echo "start slave;"
+ ) | ${cfg.package}/bin/mysql -u ${superUser} -N
+ ''}
+
+ ${optionalString (cfg.initialScript != null)
+ ''
+ # Execute initial script
+ # using toString to avoid copying the file to nix store if given as path instead of string,
+ # as it might contain credentials
+ cat ${toString cfg.initialScript} | ${cfg.package}/bin/mysql -u ${superUser} -N
+ ''}
+
+ rm ${cfg.dataDir}/mysql_init
+ fi
+
+ ${optionalString (cfg.ensureDatabases != []) ''
+ (
+ ${concatMapStrings (database: ''
+ echo "CREATE DATABASE IF NOT EXISTS \`${database}\`;"
+ '') cfg.ensureDatabases}
+ ) | ${cfg.package}/bin/mysql -N
+ ''}
+
+ ${concatMapStrings (user:
+ ''
+ ( echo "CREATE USER IF NOT EXISTS '${user.name}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
+ ${concatStringsSep "\n" (mapAttrsToList (database: permission: ''
+ echo "GRANT ${permission} ON ${database} TO '${user.name}'@'localhost';"
+ '') user.ensurePermissions)}
+ ) | ${cfg.package}/bin/mysql -N
+ '') cfg.ensureUsers}
+ '';
+
serviceConfig = {
Type = if hasNotify then "notify" else "simple";
Restart = "on-abort";
RestartSec = "5s";
# The last two environment variables are used for starting Galera clusters
- ExecStart = "${mysql}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION";
- ExecStartPost =
- let
- setupScript = pkgs.writeScript "mysql-setup" ''
- #!${pkgs.runtimeShell} -e
-
- ${optionalString (!hasNotify) ''
- # Wait until the MySQL server is available for use
- count=0
- while [ ! -e /run/mysqld/mysqld.sock ]
- do
- if [ $count -eq 30 ]
- then
- echo "Tried 30 times, giving up..."
- exit 1
- fi
-
- echo "MySQL daemon not yet started. Waiting for 1 second..."
- count=$((count++))
- sleep 1
- done
- ''}
-
- if [ -f ${cfg.dataDir}/mysql_init ]
- then
- ${concatMapStrings (database: ''
- # Create initial databases
- if ! test -e "${cfg.dataDir}/${database.name}"; then
- echo "Creating initial database: ${database.name}"
- ( echo 'create database `${database.name}`;'
-
- ${optionalString (database.schema != null) ''
- echo 'use `${database.name}`;'
-
- # TODO: this silently falls through if database.schema does not exist,
- # we should catch this somehow and exit, but can't do it here because we're in a subshell.
- if [ -f "${database.schema}" ]
- then
- cat ${database.schema}
- elif [ -d "${database.schema}" ]
- then
- cat ${database.schema}/mysql-databases/*.sql
- fi
- ''}
- ) | ${mysql}/bin/mysql -u root -N
- fi
- '') cfg.initialDatabases}
-
- ${optionalString (cfg.replication.role == "master")
- ''
- # Set up the replication master
-
- ( echo "use mysql;"
- echo "CREATE USER '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}' IDENTIFIED WITH mysql_native_password;"
- echo "SET PASSWORD FOR '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}' = PASSWORD('${cfg.replication.masterPassword}');"
- echo "GRANT REPLICATION SLAVE ON *.* TO '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}';"
- ) | ${mysql}/bin/mysql -u root -N
- ''}
-
- ${optionalString (cfg.replication.role == "slave")
- ''
- # Set up the replication slave
-
- ( echo "stop slave;"
- echo "change master to master_host='${cfg.replication.masterHost}', master_user='${cfg.replication.masterUser}', master_password='${cfg.replication.masterPassword}';"
- echo "start slave;"
- ) | ${mysql}/bin/mysql -u root -N
- ''}
-
- ${optionalString (cfg.initialScript != null)
- ''
- # Execute initial script
- # using toString to avoid copying the file to nix store if given as path instead of string,
- # as it might contain credentials
- cat ${toString cfg.initialScript} | ${mysql}/bin/mysql -u root -N
- ''}
-
- rm ${cfg.dataDir}/mysql_init
- fi
-
- ${optionalString (cfg.ensureDatabases != []) ''
- (
- ${concatMapStrings (database: ''
- echo "CREATE DATABASE IF NOT EXISTS \`${database}\`;"
- '') cfg.ensureDatabases}
- ) | ${mysql}/bin/mysql -u root -N
- ''}
-
- ${concatMapStrings (user:
- ''
- ( echo "CREATE USER IF NOT EXISTS '${user.name}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
- ${concatStringsSep "\n" (mapAttrsToList (database: permission: ''
- echo "GRANT ${permission} ON ${database} TO '${user.name}'@'localhost';"
- '') user.ensurePermissions)}
- ) | ${mysql}/bin/mysql -u root -N
- '') cfg.ensureUsers}
- '';
- in
- # ensureDatbases & ensureUsers depends on this script being run as root
- # when the user has secured their mysql install
- "+${setupScript}";
+ ExecStart = "${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION";
# User and group
User = cfg.user;
- Group = "mysql";
+ Group = cfg.group;
# Runtime directory and mode
RuntimeDirectory = "mysqld";
RuntimeDirectoryMode = "0755";
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index 579b6a4d9c6..3e16b5907dd 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -21,7 +21,7 @@ let
listen_addresses = '${if cfg.enableTCPIP then "*" else "localhost"}'
port = ${toString cfg.port}
${cfg.extraConfig}
- '';
+ '';
groupAccessAvailable = versionAtLeast postgresql.version "11.0";
@@ -55,9 +55,13 @@ in
dataDir = mkOption {
type = types.path;
+ defaultText = "/var/lib/postgresql/\${config.services.postgresql.package.psqlSchema}";
example = "/var/lib/postgresql/11";
description = ''
- Data directory for PostgreSQL.
+ The data directory for PostgreSQL. If left as the default value
+ this directory will automatically be created before the PostgreSQL server starts, otherwise
+ the sysadmin is responsible for ensuring the directory exists with appropriate ownership
+ and permissions.
'';
};
@@ -249,10 +253,7 @@ in
else if versionAtLeast config.system.stateVersion "16.03" then pkgs.postgresql_9_5
else throw "postgresql_9_4 was removed, please upgrade your postgresql version.");
- services.postgresql.dataDir =
- mkDefault (if versionAtLeast config.system.stateVersion "17.09"
- then "/var/lib/postgresql/${cfg.package.psqlSchema}"
- else "/var/db/postgresql");
+ services.postgresql.dataDir = mkDefault "/var/lib/postgresql/${cfg.package.psqlSchema}";
services.postgresql.authentication = mkAfter
''
@@ -291,40 +292,28 @@ in
preStart =
''
- # Create data directory.
if ! test -e ${cfg.dataDir}/PG_VERSION; then
- mkdir -m 0700 -p ${cfg.dataDir}
+ # Cleanup the data directory.
rm -f ${cfg.dataDir}/*.conf
- chown -R postgres:postgres ${cfg.dataDir}
- fi
- ''; # */
- script =
- ''
- # Initialise the database.
- if ! test -e ${cfg.dataDir}/PG_VERSION; then
+ # Initialise the database.
initdb -U ${cfg.superUser} ${concatStringsSep " " cfg.initdbArgs}
+
# See postStart!
touch "${cfg.dataDir}/.first_startup"
fi
+
ln -sfn "${configFile}" "${cfg.dataDir}/postgresql.conf"
${optionalString (cfg.recoveryConfig != null) ''
ln -sfn "${pkgs.writeText "recovery.conf" cfg.recoveryConfig}" \
"${cfg.dataDir}/recovery.conf"
''}
- ${optionalString (!groupAccessAvailable) ''
- # postgresql pre 11.0 doesn't start if state directory mode is group accessible
- chmod 0700 "${cfg.dataDir}"
- ''}
-
- exec postgres
'';
- serviceConfig =
+ serviceConfig = mkMerge [
{ ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
User = "postgres";
Group = "postgres";
- PermissionsStartOnly = true;
RuntimeDirectory = "postgresql";
Type = if versionAtLeast cfg.package.version "9.6"
then "notify"
@@ -338,36 +327,48 @@ in
# Give Postgres a decent amount of time to clean up after
# receiving systemd's SIGINT.
TimeoutSec = 120;
- };
- # Wait for PostgreSQL to be ready to accept connections.
- postStart =
- ''
- PSQL="${pkgs.utillinux}/bin/runuser -u ${cfg.superUser} -- psql --port=${toString cfg.port}"
+ ExecStart = "${postgresql}/bin/postgres";
- while ! $PSQL -d postgres -c "" 2> /dev/null; do
- if ! kill -0 "$MAINPID"; then exit 1; fi
- sleep 0.1
- done
+ # Wait for PostgreSQL to be ready to accept connections.
+ ExecStartPost =
+ let
+ setupScript = pkgs.writeScript "postgresql-setup" (''
+ #!${pkgs.runtimeShell} -e
- if test -e "${cfg.dataDir}/.first_startup"; then
- ${optionalString (cfg.initialScript != null) ''
- $PSQL -f "${cfg.initialScript}" -d postgres
- ''}
- rm -f "${cfg.dataDir}/.first_startup"
- fi
- '' + optionalString (cfg.ensureDatabases != []) ''
- ${concatMapStrings (database: ''
- $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${database}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${database}"'
- '') cfg.ensureDatabases}
- '' + ''
- ${concatMapStrings (user: ''
- $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"'
- ${concatStringsSep "\n" (mapAttrsToList (database: permission: ''
- $PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"'
- '') user.ensurePermissions)}
- '') cfg.ensureUsers}
- '';
+ PSQL="${pkgs.utillinux}/bin/runuser -u ${cfg.superUser} -- psql --port=${toString cfg.port}"
+
+ while ! $PSQL -d postgres -c "" 2> /dev/null; do
+ if ! kill -0 "$MAINPID"; then exit 1; fi
+ sleep 0.1
+ done
+
+ if test -e "${cfg.dataDir}/.first_startup"; then
+ ${optionalString (cfg.initialScript != null) ''
+ $PSQL -f "${cfg.initialScript}" -d postgres
+ ''}
+ rm -f "${cfg.dataDir}/.first_startup"
+ fi
+ '' + optionalString (cfg.ensureDatabases != []) ''
+ ${concatMapStrings (database: ''
+ $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${database}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${database}"'
+ '') cfg.ensureDatabases}
+ '' + ''
+ ${concatMapStrings (user: ''
+ $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"'
+ ${concatStringsSep "\n" (mapAttrsToList (database: permission: ''
+ $PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"'
+ '') user.ensurePermissions)}
+ '') cfg.ensureUsers}
+ '');
+ in
+ "+${setupScript}";
+ }
+ (mkIf (cfg.dataDir == "/var/lib/postgresql/${cfg.package.psqlSchema}") {
+ StateDirectory = "postgresql postgresql/${cfg.package.psqlSchema}";
+ StateDirectoryMode = if groupAccessAvailable then "0750" else "0700";
+ })
+ ];
unitConfig.RequiresMountsFor = "${cfg.dataDir}";
};
diff --git a/nixos/modules/services/databases/riak-cs.nix b/nixos/modules/services/databases/riak-cs.nix
index 2cb204f729a..fa6ac886331 100644
--- a/nixos/modules/services/databases/riak-cs.nix
+++ b/nixos/modules/services/databases/riak-cs.nix
@@ -35,7 +35,7 @@ in
Name of the Erlang node.
'';
};
-
+
anonymousUserCreation = mkOption {
type = types.bool;
default = false;
diff --git a/nixos/modules/services/development/jupyterhub/default.nix b/nixos/modules/services/development/jupyterhub/default.nix
new file mode 100644
index 00000000000..be6aaed93ac
--- /dev/null
+++ b/nixos/modules/services/development/jupyterhub/default.nix
@@ -0,0 +1,190 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+ cfg = config.services.jupyterhub;
+
+ kernels = (pkgs.jupyter-kernel.create {
+ definitions = if cfg.kernels != null
+ then cfg.kernels
+ else pkgs.jupyter-kernel.default;
+ });
+
+ jupyterhubConfig = pkgs.writeText "jupyterhub_config.py" ''
+ c.JupyterHub.bind_url = "http://${cfg.host}:${toString cfg.port}"
+
+ c.JupyterHub.authentication_class = "${cfg.authentication}"
+ c.JupyterHub.spawner_class = "${cfg.spawner}"
+
+ c.SystemdSpawner.default_url = '/lab'
+ c.SystemdSpawner.cmd = "${cfg.jupyterlabEnv}/bin/jupyterhub-singleuser"
+ c.SystemdSpawner.environment = {
+ 'JUPYTER_PATH': '${kernels}'
+ }
+
+ ${cfg.extraConfig}
+ '';
+in {
+ meta.maintainers = with maintainers; [ costrouc ];
+
+ options.services.jupyterhub = {
+ enable = mkEnableOption "Jupyterhub development server";
+
+ authentication = mkOption {
+ type = types.str;
+ default = "jupyterhub.auth.PAMAuthenticator";
+ description = ''
+ Jupyterhub authentication to use
+
+ There are many authenticators available including: oauth, pam,
+ ldap, kerberos, etc.
+ '';
+ };
+
+ spawner = mkOption {
+ type = types.str;
+ default = "systemdspawner.SystemdSpawner";
+ description = ''
+ Jupyterhub spawner to use
+
+ There are many spawners available including: local process,
+ systemd, docker, kubernetes, yarn, batch, etc.
+ '';
+ };
+
+ extraConfig = mkOption {
+ type = types.lines;
+ default = "";
+ description = ''
+ Extra contents appended to the jupyterhub configuration
+
+ Jupyterhub configuration is a normal python file using
+ Traitlets. https://jupyterhub.readthedocs.io/en/stable/getting-started/config-basics.html. The
+ base configuration of this module was designed to have sane
+ defaults for configuration but you can override anything since
+ this is a python file.
+ '';
+ example = literalExample ''
+ c.SystemdSpawner.mem_limit = '8G'
+ c.SystemdSpawner.cpu_limit = 2.0
+ '';
+ };
+
+ jupyterhubEnv = mkOption {
+ type = types.package;
+ default = (pkgs.python3.withPackages (p: with p; [
+ jupyterhub
+ jupyterhub-systemdspawner
+ ]));
+ description = ''
+ Python environment to run jupyterhub
+
+ Customizing will affect the packages available in the hub and
+ proxy. This will allow packages to be available for the
+ extraConfig that you may need. This will not normally need to
+ be changed.
+ '';
+ };
+
+ jupyterlabEnv = mkOption {
+ type = types.package;
+ default = (pkgs.python3.withPackages (p: with p; [
+ jupyterhub
+ jupyterlab
+ ]));
+ description = ''
+ Python environment to run jupyterlab
+
+ Customizing will affect the packages available in the
+ jupyterlab server and the default kernel provided. This is the
+ way to customize the jupyterlab extensions and jupyter
+ notebook extensions. This will not normally need to
+ be changed.
+ '';
+ };
+
+ kernels = mkOption {
+ type = types.nullOr (types.attrsOf(types.submodule (import ../jupyter/kernel-options.nix {
+ inherit lib;
+ })));
+
+ default = null;
+ example = literalExample ''
+ {
+ python3 = let
+ env = (pkgs.python3.withPackages (pythonPackages: with pythonPackages; [
+ ipykernel
+ pandas
+ scikitlearn
+ ]));
+ in {
+ displayName = "Python 3 for machine learning";
+ argv = [
+ "''${env.interpreter}"
+ "-m"
+ "ipykernel_launcher"
+ "-f"
+ "{connection_file}"
+ ];
+ language = "python";
+ logo32 = "''${env}/''${env.sitePackages}/ipykernel/resources/logo-32x32.png";
+ logo64 = "''${env}/''${env.sitePackages}/ipykernel/resources/logo-64x64.png";
+ };
+ }
+ '';
+ description = ''
+ Declarative kernel config
+
+ Kernels can be declared in any language that supports and has
+ the required dependencies to communicate with a jupyter server.
+ In python's case, it means that ipykernel package must always be
+ included in the list of packages of the targeted environment.
+ '';
+ };
+
+ port = mkOption {
+ type = types.port;
+ default = 8000;
+ description = ''
+ Port number Jupyterhub will be listening on
+ '';
+ };
+
+ host = mkOption {
+ type = types.str;
+ default = "0.0.0.0";
+ description = ''
+ Bind IP JupyterHub will be listening on
+ '';
+ };
+
+ stateDirectory = mkOption {
+ type = types.str;
+ default = "jupyterhub";
+ description = ''
+ Directory for jupyterhub state (token + database)
+ '';
+ };
+ };
+
+ config = mkMerge [
+ (mkIf cfg.enable {
+ systemd.services.jupyterhub = {
+ description = "Jupyterhub development server";
+
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+
+ serviceConfig = {
+ Restart = "always";
+ ExecStart = "${cfg.jupyterhubEnv}/bin/jupyterhub --config ${jupyterhubConfig}";
+ User = "root";
+ StateDirectory = cfg.stateDirectory;
+ WorkingDirectory = "/var/lib/${cfg.stateDirectory}";
+ };
+ };
+ })
+ ];
+}
diff --git a/nixos/modules/services/games/minetest-server.nix b/nixos/modules/services/games/minetest-server.nix
index 98e69c6dc0e..f52079fc1ef 100644
--- a/nixos/modules/services/games/minetest-server.nix
+++ b/nixos/modules/services/games/minetest-server.nix
@@ -5,12 +5,12 @@ with lib;
let
cfg = config.services.minetest-server;
flag = val: name: if val != null then "--${name} ${val} " else "";
- flags = [
- (flag cfg.gameId "gameid")
- (flag cfg.world "world")
- (flag cfg.configPath "config")
- (flag cfg.logPath "logfile")
- (flag cfg.port "port")
+ flags = [
+ (flag cfg.gameId "gameid")
+ (flag cfg.world "world")
+ (flag cfg.configPath "config")
+ (flag cfg.logPath "logfile")
+ (flag cfg.port "port")
];
in
{
@@ -26,7 +26,7 @@ in
type = types.nullOr types.str;
default = null;
description = ''
- Id of the game to use. To list available games run
+ Id of the game to use. To list available games run
`minetestserver --gameid list`.
If only one game exists, this option can be null.
@@ -59,7 +59,7 @@ in
type = types.nullOr types.path;
default = null;
description = ''
- Path to logfile for logging.
+ Path to logfile for logging.
If set to null, logging will be output to stdout which means
all output will be catched by systemd.
diff --git a/nixos/modules/services/games/terraria.nix b/nixos/modules/services/games/terraria.nix
index a59b74c0b4c..413660321ec 100644
--- a/nixos/modules/services/games/terraria.nix
+++ b/nixos/modules/services/games/terraria.nix
@@ -7,7 +7,7 @@ let
worldSizeMap = { small = 1; medium = 2; large = 3; };
valFlag = name: val: optionalString (val != null) "-${name} \"${escape ["\\" "\""] (toString val)}\"";
boolFlag = name: val: optionalString val "-${name}";
- flags = [
+ flags = [
(valFlag "port" cfg.port)
(valFlag "maxPlayers" cfg.maxPlayers)
(valFlag "password" cfg.password)
diff --git a/nixos/modules/services/hardware/thinkfan.nix b/nixos/modules/services/hardware/thinkfan.nix
index 7c105e99ca5..3bda61ed1a9 100644
--- a/nixos/modules/services/hardware/thinkfan.nix
+++ b/nixos/modules/services/hardware/thinkfan.nix
@@ -67,7 +67,7 @@ in {
type = types.bool;
default = false;
description = ''
- Whether to build thinkfan with SMART support to read temperatures
+ Whether to build thinkfan with SMART support to read temperatures
directly from hard disks.
'';
};
diff --git a/nixos/modules/services/hardware/trezord.nix b/nixos/modules/services/hardware/trezord.nix
index c517e9fbb2b..2594ac74371 100644
--- a/nixos/modules/services/hardware/trezord.nix
+++ b/nixos/modules/services/hardware/trezord.nix
@@ -10,7 +10,7 @@ in {
meta = {
doc = ./trezord.xml;
};
-
+
### interface
options = {
@@ -40,7 +40,7 @@ in {
};
};
};
-
+
### implementation
config = mkIf cfg.enable {
diff --git a/nixos/modules/services/mail/pfix-srsd.nix b/nixos/modules/services/mail/pfix-srsd.nix
index 38984f896d6..e3dbf2a014f 100644
--- a/nixos/modules/services/mail/pfix-srsd.nix
+++ b/nixos/modules/services/mail/pfix-srsd.nix
@@ -53,4 +53,4 @@ with lib;
};
};
};
-}
\ No newline at end of file
+}
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index ad10ba1d909..fd4d16cdc37 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -25,6 +25,8 @@ let
clientRestrictions = concatStringsSep ", " (clientAccess ++ dnsBl);
+ smtpTlsSecurityLevel = if cfg.useDane then "dane" else "may";
+
mainCf = let
escape = replaceStrings ["$"] ["$$"];
mkList = items: "\n " + concatStringsSep ",\n " items;
@@ -508,6 +510,14 @@ in
'';
};
+ useDane = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Sets smtp_tls_security_level to "dane" rather than "may". See postconf(5) for details.
+ '';
+ };
+
sslCert = mkOption {
type = types.str;
default = "";
@@ -809,13 +819,13 @@ in
// optionalAttrs cfg.enableHeaderChecks { header_checks = [ "regexp:/etc/postfix/header_checks" ]; }
// optionalAttrs (cfg.tlsTrustedAuthorities != "") {
smtp_tls_CAfile = cfg.tlsTrustedAuthorities;
- smtp_tls_security_level = "may";
+ smtp_tls_security_level = smtpTlsSecurityLevel;
}
// optionalAttrs (cfg.sslCert != "") {
smtp_tls_cert_file = cfg.sslCert;
smtp_tls_key_file = cfg.sslKey;
- smtp_tls_security_level = "may";
+ smtp_tls_security_level = smtpTlsSecurityLevel;
smtpd_tls_cert_file = cfg.sslCert;
smtpd_tls_key_file = cfg.sslKey;
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index f8bcedc94fe..af80e99746b 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -162,6 +162,45 @@ in
7.
'';
};
+
+ backupDir = mkOption {
+ type = types.str;
+ default = "${cfg.stateDir}/dump";
+ description = "Path to the dump files.";
+ };
+ };
+
+ ssh = {
+ enable = mkOption {
+ type = types.bool;
+ default = true;
+ description = "Enable external SSH feature.";
+ };
+
+ clonePort = mkOption {
+ type = types.int;
+ default = 22;
+ example = 2222;
+ description = ''
+ SSH port displayed in clone URL.
+ The option is required to configure a service when the external visible port
+ differs from the local listening port i.e. if port forwarding is used.
+ '';
+ };
+ };
+
+ lfs = {
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = "Enables git-lfs support.";
+ };
+
+ contentDir = mkOption {
+ type = types.str;
+ default = "${cfg.stateDir}/data/lfs";
+ description = "Where to store LFS files.";
+ };
};
appName = mkOption {
@@ -200,6 +239,12 @@ in
description = "HTTP listen port.";
};
+ enableUnixSocket = mkOption {
+ type = types.bool;
+ default = false;
+ description = "Configure Gitea to listen on a unix socket instead of the default TCP port.";
+ };
+
cookieSecure = mkOption {
type = types.bool;
default = false;
@@ -300,14 +345,34 @@ in
ROOT = cfg.repositoryRoot;
};
- server = {
- DOMAIN = cfg.domain;
- HTTP_ADDR = cfg.httpAddress;
- HTTP_PORT = cfg.httpPort;
- ROOT_URL = cfg.rootUrl;
- STATIC_ROOT_PATH = cfg.staticRootPath;
- LFS_JWT_SECRET = "#jwtsecret#";
- };
+ server = mkMerge [
+ {
+ DOMAIN = cfg.domain;
+ STATIC_ROOT_PATH = cfg.staticRootPath;
+ LFS_JWT_SECRET = "#jwtsecret#";
+ ROOT_URL = cfg.rootUrl;
+ }
+ (mkIf cfg.enableUnixSocket {
+ PROTOCOL = "unix";
+ HTTP_ADDR = "/run/gitea/gitea.sock";
+ })
+ (mkIf (!cfg.enableUnixSocket) {
+ HTTP_ADDR = cfg.httpAddress;
+ HTTP_PORT = cfg.httpPort;
+ })
+ (mkIf cfg.ssh.enable {
+ DISABLE_SSH = false;
+ SSH_PORT = cfg.ssh.clonePort;
+ })
+ (mkIf (!cfg.ssh.enable) {
+ DISABLE_SSH = true;
+ })
+ (mkIf cfg.lfs.enable {
+ LFS_START_SERVER = true;
+ LFS_CONTENT_PATH = cfg.lfs.contentDir;
+ })
+
+ ];
session = {
COOKIE_NAME = "session";
@@ -357,12 +422,26 @@ in
};
systemd.tmpfiles.rules = [
- "d '${cfg.stateDir}' - ${cfg.user} gitea - -"
- "d '${cfg.stateDir}/conf' - ${cfg.user} gitea - -"
- "d '${cfg.stateDir}/custom' - ${cfg.user} gitea - -"
- "d '${cfg.stateDir}/custom/conf' - ${cfg.user} gitea - -"
- "d '${cfg.stateDir}/log' - ${cfg.user} gitea - -"
- "d '${cfg.repositoryRoot}' - ${cfg.user} gitea - -"
+ "d '${cfg.dump.backupDir}' 0750 ${cfg.user} gitea - -"
+ "z '${cfg.dump.backupDir}' 0750 ${cfg.user} gitea - -"
+ "Z '${cfg.dump.backupDir}' - ${cfg.user} gitea - -"
+ "d '${cfg.lfs.contentDir}' 0750 ${cfg.user} gitea - -"
+ "z '${cfg.lfs.contentDir}' 0750 ${cfg.user} gitea - -"
+ "Z '${cfg.lfs.contentDir}' - ${cfg.user} gitea - -"
+ "d '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
+ "z '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
+ "Z '${cfg.repositoryRoot}' - ${cfg.user} gitea - -"
+ "d '${cfg.stateDir}' 0750 ${cfg.user} gitea - -"
+ "d '${cfg.stateDir}/conf' 0750 ${cfg.user} gitea - -"
+ "d '${cfg.stateDir}/custom' 0750 ${cfg.user} gitea - -"
+ "d '${cfg.stateDir}/custom/conf' 0750 ${cfg.user} gitea - -"
+ "d '${cfg.stateDir}/log' 0750 ${cfg.user} gitea - -"
+ "z '${cfg.stateDir}' 0750 ${cfg.user} gitea - -"
+ "z '${cfg.stateDir}/.ssh' 0700 ${cfg.user} gitea - -"
+ "z '${cfg.stateDir}/conf' 0750 ${cfg.user} gitea - -"
+ "z '${cfg.stateDir}/custom' 0750 ${cfg.user} gitea - -"
+ "z '${cfg.stateDir}/custom/conf' 0750 ${cfg.user} gitea - -"
+ "z '${cfg.stateDir}/log' 0750 ${cfg.user} gitea - -"
"Z '${cfg.stateDir}' - ${cfg.user} gitea - -"
# If we have a folder or symlink with gitea locales, remove it
@@ -431,28 +510,39 @@ in
User = cfg.user;
Group = "gitea";
WorkingDirectory = cfg.stateDir;
- ExecStart = "${gitea}/bin/gitea web";
+ ExecStart = "${gitea}/bin/gitea web --pid /run/gitea/gitea.pid";
Restart = "always";
-
- # Filesystem
+ # Runtime directory and mode
+ RuntimeDirectory = "gitea";
+ RuntimeDirectoryMode = "0755";
+ # Access write directories
+ ReadWritePaths = [ cfg.dump.backupDir cfg.repositoryRoot cfg.stateDir cfg.lfs.contentDir ];
+ UMask = "0027";
+ # Capabilities
+ CapabilityBoundingSet = "";
+ # Security
+ NoNewPrivileges = true;
+ # Sandboxing
+ ProtectSystem = "strict";
ProtectHome = true;
+ PrivateTmp = true;
PrivateDevices = true;
+ PrivateUsers = true;
+ ProtectHostname = true;
+ ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
+ ProtectKernelLogs = true;
ProtectControlGroups = true;
- ReadWritePaths = cfg.stateDir;
- # Caps
- CapabilityBoundingSet = "";
- NoNewPrivileges = true;
- # Misc.
+ RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
LockPersonality = true;
- RestrictRealtime = true;
- PrivateMounts = true;
- PrivateUsers = true;
MemoryDenyWriteExecute = true;
- SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @reboot @resources @setuid @swap";
+ RestrictRealtime = true;
+ RestrictSUIDSGID = true;
+ PrivateMounts = true;
+ # System Call Filtering
SystemCallArchitectures = "native";
- RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
+ SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @reboot @resources @setuid @swap";
};
environment = {
@@ -504,7 +594,7 @@ in
Type = "oneshot";
User = cfg.user;
ExecStart = "${gitea}/bin/gitea dump";
- WorkingDirectory = cfg.stateDir;
+ WorkingDirectory = cfg.dump.backupDir;
};
};
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index be59b53e5ce..fa393de3219 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -618,26 +618,38 @@ in {
enable = true;
ensureUsers = singleton { name = cfg.databaseUsername; };
};
+
# The postgresql module doesn't currently support concepts like
# objects owners and extensions; for now we tack on what's needed
# here.
- systemd.services.postgresql.postStart = mkAfter (optionalString databaseActuallyCreateLocally ''
- set -eu
+ systemd.services.gitlab-postgresql = let pgsql = config.services.postgresql; in mkIf databaseActuallyCreateLocally {
+ after = [ "postgresql.service" ];
+ wantedBy = [ "multi-user.target" ];
+ path = [ pgsql.package ];
+ script = ''
+ set -eu
- $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
- current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
- if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
- $PSQL -tAc 'ALTER DATABASE "${cfg.databaseName}" OWNER TO "${cfg.databaseUsername}"'
- if [[ -e "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}" ]]; then
- echo "Reassigning ownership of database ${cfg.databaseName} to user ${cfg.databaseUsername} failed on last boot. Failing..."
- exit 1
- fi
- touch "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
- $PSQL "${cfg.databaseName}" -tAc "REASSIGN OWNED BY \"$current_owner\" TO \"${cfg.databaseUsername}\""
- rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
- fi
- $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
- '');
+ PSQL="${pkgs.utillinux}/bin/runuser -u ${pgsql.superUser} -- psql --port=${toString pgsql.port}"
+
+ $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
+ current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
+ if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
+ $PSQL -tAc 'ALTER DATABASE "${cfg.databaseName}" OWNER TO "${cfg.databaseUsername}"'
+ if [[ -e "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}" ]]; then
+ echo "Reassigning ownership of database ${cfg.databaseName} to user ${cfg.databaseUsername} failed on last boot. Failing..."
+ exit 1
+ fi
+ touch "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
+ $PSQL "${cfg.databaseName}" -tAc "REASSIGN OWNED BY \"$current_owner\" TO \"${cfg.databaseUsername}\""
+ rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
+ fi
+ $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+ '';
+
+ serviceConfig = {
+ Type = "oneshot";
+ };
+ };
# Use postfix to send out mails.
services.postfix.enable = mkDefault true;
@@ -767,7 +779,7 @@ in {
};
systemd.services.gitlab = {
- after = [ "gitlab-workhorse.service" "gitaly.service" "network.target" "postgresql.service" "redis.service" ];
+ after = [ "gitlab-workhorse.service" "gitaly.service" "network.target" "gitlab-postgresql.service" "redis.service" ];
requires = [ "gitlab-sidekiq.service" ];
wantedBy = [ "multi-user.target" ];
environment = gitlabEnv;
diff --git a/nixos/modules/services/misc/gollum.nix b/nixos/modules/services/misc/gollum.nix
index f4a9c72b154..8842e1e4d90 100644
--- a/nixos/modules/services/misc/gollum.nix
+++ b/nixos/modules/services/misc/gollum.nix
@@ -98,7 +98,7 @@ in
${pkgs.gollum}/bin/gollum \
--port ${toString cfg.port} \
--host ${cfg.address} \
- --config ${builtins.toFile "gollum-config.rb" cfg.extraConfig} \
+ --config ${pkgs.writeText "gollum-config.rb" cfg.extraConfig} \
--ref ${cfg.branch} \
${optionalString cfg.mathjax "--mathjax"} \
${optionalString cfg.emoji "--emoji"} \
diff --git a/nixos/modules/services/misc/matrix-synapse.nix b/nixos/modules/services/misc/matrix-synapse.nix
index e982eb16fa7..3eb1073387f 100644
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@@ -675,7 +675,7 @@ in {
}
];
- users.users.matrix-synapse = {
+ users.users.matrix-synapse = {
group = "matrix-synapse";
home = cfg.dataDir;
createHome = true;
diff --git a/nixos/modules/services/misc/pinnwand.nix b/nixos/modules/services/misc/pinnwand.nix
new file mode 100644
index 00000000000..aa1ee5cfaa7
--- /dev/null
+++ b/nixos/modules/services/misc/pinnwand.nix
@@ -0,0 +1,78 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.pinnwand;
+
+ format = pkgs.formats.toml {};
+ configFile = format.generate "pinnwand.toml" cfg.settings;
+in
+{
+ options.services.pinnwand = {
+ enable = mkEnableOption "Pinnwand";
+
+ port = mkOption {
+ type = types.port;
+ description = "The port to listen on.";
+ default = 8000;
+ };
+
+ settings = mkOption {
+ type = format.type;
+ description = ''
+ Your pinnwand.toml as a Nix attribute set. Look up
+ possible options in the pinnwand.toml-example.
+ '';
+ default = {
+ # https://github.com/supakeen/pinnwand/blob/master/pinnwand.toml-example
+ database_uri = "sqlite:///var/lib/pinnwand/pinnwand.db";
+ preferred_lexeres = [];
+ paste_size = 262144;
+ paste_help = ''
+
Welcome to pinnwand, this site is a pastebin. It allows you to share code with others. If you write code in the text area below and press the paste button you will be given a link you can share with others so they can view your code as well.
People with the link can view your pasted code, only you can remove your paste and it expires automatically. Note that anyone could guess the URI to your paste so don't rely on it being private.