nixos/doc: convert loaOf options refs to attrsOf
This commit is contained in:
parent
20d491a317
commit
bc62423a87
|
@ -58,9 +58,9 @@
|
||||||
Like <literal>boot.debug1</literal> or
|
Like <literal>boot.debug1</literal> or
|
||||||
<literal>boot.debug1devices</literal>, but runs stage1 until all
|
<literal>boot.debug1devices</literal>, but runs stage1 until all
|
||||||
filesystems that are mounted during initrd are mounted (see
|
filesystems that are mounted during initrd are mounted (see
|
||||||
<option><link linkend="opt-fileSystems._name__.neededForBoot">neededForBoot</link></option>
|
<option><link linkend="opt-fileSystems._name_.neededForBoot">neededForBoot</link></option>
|
||||||
). As a motivating example, this could be useful if you've forgotten to set
|
). As a motivating example, this could be useful if you've forgotten to set
|
||||||
<option><link linkend="opt-fileSystems._name__.neededForBoot">neededForBoot</link></option>
|
<option><link linkend="opt-fileSystems._name_.neededForBoot">neededForBoot</link></option>
|
||||||
on a file system.
|
on a file system.
|
||||||
</para>
|
</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
|
@ -27,7 +27,7 @@
|
||||||
<screen>
|
<screen>
|
||||||
# nixos-container create foo --config '
|
# nixos-container create foo --config '
|
||||||
<xref linkend="opt-services.openssh.enable"/> = true;
|
<xref linkend="opt-services.openssh.enable"/> = true;
|
||||||
<link linkend="opt-users.users._name__.openssh.authorizedKeys.keys">users.users.root.openssh.authorizedKeys.keys</link> = ["ssh-dss AAAAB3N…"];
|
<link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">users.users.root.openssh.authorizedKeys.keys</link> = ["ssh-dss AAAAB3N…"];
|
||||||
'
|
'
|
||||||
</screen>
|
</screen>
|
||||||
By default the next free address in the <literal>10.233.0.0/16</literal> subnet will be chosen
|
By default the next free address in the <literal>10.233.0.0/16</literal> subnet will be chosen
|
||||||
|
|
|
@ -23,12 +23,12 @@
|
||||||
<link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd-fstab-generator.html">systemd-fstab-generator</link>.
|
<link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd-fstab-generator.html">systemd-fstab-generator</link>.
|
||||||
The filesystem will be mounted automatically unless
|
The filesystem will be mounted automatically unless
|
||||||
<literal>"noauto"</literal> is present in <link
|
<literal>"noauto"</literal> is present in <link
|
||||||
linkend="opt-fileSystems._name__.options">options</link>.
|
linkend="opt-fileSystems._name_.options">options</link>.
|
||||||
<literal>"noauto"</literal> filesystems can be mounted explicitly using
|
<literal>"noauto"</literal> filesystems can be mounted explicitly using
|
||||||
<command>systemctl</command> e.g. <command>systemctl start
|
<command>systemctl</command> e.g. <command>systemctl start
|
||||||
data.mount</command>.
|
data.mount</command>.
|
||||||
Mount points are created automatically if they don’t already exist. For
|
Mount points are created automatically if they don’t already exist. For
|
||||||
<option><link linkend="opt-fileSystems._name__.device">device</link></option>,
|
<option><link linkend="opt-fileSystems._name_.device">device</link></option>,
|
||||||
it’s best to use the topology-independent device aliases in
|
it’s best to use the topology-independent device aliases in
|
||||||
<filename>/dev/disk/by-label</filename> and
|
<filename>/dev/disk/by-label</filename> and
|
||||||
<filename>/dev/disk/by-uuid</filename>, as these don’t change if the
|
<filename>/dev/disk/by-uuid</filename>, as these don’t change if the
|
||||||
|
@ -36,7 +36,7 @@
|
||||||
</para>
|
</para>
|
||||||
<para>
|
<para>
|
||||||
You can usually omit the file system type
|
You can usually omit the file system type
|
||||||
(<option><link linkend="opt-fileSystems._name__.fsType">fsType</link></option>),
|
(<option><link linkend="opt-fileSystems._name_.fsType">fsType</link></option>),
|
||||||
since <command>mount</command> can usually detect the type and load the
|
since <command>mount</command> can usually detect the type and load the
|
||||||
necessary kernel module automatically. However, if the file system is needed
|
necessary kernel module automatically. However, if the file system is needed
|
||||||
at early boot (in the initial ramdisk) and is not <literal>ext2</literal>,
|
at early boot (in the initial ramdisk) and is not <literal>ext2</literal>,
|
||||||
|
@ -49,7 +49,7 @@
|
||||||
System startup will fail if any of the filesystems fails to mount, dropping
|
System startup will fail if any of the filesystems fails to mount, dropping
|
||||||
you to the emergency shell. You can make a mount asynchronous and
|
you to the emergency shell. You can make a mount asynchronous and
|
||||||
non-critical by adding
|
non-critical by adding
|
||||||
<literal><link linkend="opt-fileSystems._name__.options">options</link> = [
|
<literal><link linkend="opt-fileSystems._name_.options">options</link> = [
|
||||||
"nofail" ];</literal>.
|
"nofail" ];</literal>.
|
||||||
</para>
|
</para>
|
||||||
</note>
|
</note>
|
||||||
|
|
|
@ -10,7 +10,7 @@
|
||||||
automatically configure network interfaces. However, you can configure an
|
automatically configure network interfaces. However, you can configure an
|
||||||
interface manually as follows:
|
interface manually as follows:
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link linkend="opt-networking.interfaces._name__.ipv4.addresses">networking.interfaces.eth0.ipv4.addresses</link> = [ {
|
<link linkend="opt-networking.interfaces._name_.ipv4.addresses">networking.interfaces.eth0.ipv4.addresses</link> = [ {
|
||||||
address = "192.168.1.2";
|
address = "192.168.1.2";
|
||||||
prefixLength = 24;
|
prefixLength = 24;
|
||||||
} ];
|
} ];
|
||||||
|
|
|
@ -26,7 +26,7 @@
|
||||||
As with IPv4 networking interfaces are automatically configured via DHCPv6.
|
As with IPv4 networking interfaces are automatically configured via DHCPv6.
|
||||||
You can configure an interface manually:
|
You can configure an interface manually:
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link linkend="opt-networking.interfaces._name__.ipv6.addresses">networking.interfaces.eth0.ipv6.addresses</link> = [ {
|
<link linkend="opt-networking.interfaces._name_.ipv6.addresses">networking.interfaces.eth0.ipv6.addresses</link> = [ {
|
||||||
address = "fe00:aa:bb:cc::2";
|
address = "fe00:aa:bb:cc::2";
|
||||||
prefixLength = 64;
|
prefixLength = 64;
|
||||||
} ];
|
} ];
|
||||||
|
|
|
@ -30,7 +30,7 @@ Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***
|
||||||
<filename>/</filename>, add the following to
|
<filename>/</filename>, add the following to
|
||||||
<filename>configuration.nix</filename>:
|
<filename>configuration.nix</filename>:
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link linkend="opt-boot.initrd.luks.devices._name__.device">boot.initrd.luks.devices.crypted.device</link> = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d";
|
<link linkend="opt-boot.initrd.luks.devices._name_.device">boot.initrd.luks.devices.crypted.device</link> = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d";
|
||||||
<xref linkend="opt-fileSystems"/>."/".device = "/dev/mapper/crypted";
|
<xref linkend="opt-fileSystems"/>."/".device = "/dev/mapper/crypted";
|
||||||
</programlisting>
|
</programlisting>
|
||||||
Should grub be used as bootloader, and <filename>/boot</filename> is located
|
Should grub be used as bootloader, and <filename>/boot</filename> is located
|
||||||
|
@ -60,13 +60,13 @@ Added to key to device /dev/sda2, slot: 2
|
||||||
To ensure that this file system is decrypted using the FIDO2 compatible key, add the following to <filename>configuration.nix</filename>:
|
To ensure that this file system is decrypted using the FIDO2 compatible key, add the following to <filename>configuration.nix</filename>:
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link linkend="opt-boot.initrd.luks.fido2Support">boot.initrd.luks.fido2Support</link> = true;
|
<link linkend="opt-boot.initrd.luks.fido2Support">boot.initrd.luks.fido2Support</link> = true;
|
||||||
<link linkend="opt-boot.initrd.luks.devices._name__.fido2.credential">boot.initrd.luks.devices."/dev/sda2".fido2.credential</link> = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7";
|
<link linkend="opt-boot.initrd.luks.devices._name_.fido2.credential">boot.initrd.luks.devices."/dev/sda2".fido2.credential</link> = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7";
|
||||||
</programlisting>
|
</programlisting>
|
||||||
|
|
||||||
You can also use the FIDO2 passwordless setup, but for security reasons, you might want to enable it only when your device is PIN protected, such as <link xlink:href="https://trezor.io/">Trezor</link>.
|
You can also use the FIDO2 passwordless setup, but for security reasons, you might want to enable it only when your device is PIN protected, such as <link xlink:href="https://trezor.io/">Trezor</link>.
|
||||||
|
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link linkend="opt-boot.initrd.luks.devices._name__.fido2.passwordLess">boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess</link> = true;
|
<link linkend="opt-boot.initrd.luks.devices._name_.fido2.passwordLess">boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess</link> = true;
|
||||||
</programlisting>
|
</programlisting>
|
||||||
</para>
|
</para>
|
||||||
</section>
|
</section>
|
||||||
|
|
|
@ -19,7 +19,7 @@
|
||||||
All users that should have permission to change network settings must belong
|
All users that should have permission to change network settings must belong
|
||||||
to the <code>networkmanager</code> group:
|
to the <code>networkmanager</code> group:
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link linkend="opt-users.users._name__.extraGroups">users.users.alice.extraGroups</link> = [ "networkmanager" ];
|
<link linkend="opt-users.users._name_.extraGroups">users.users.alice.extraGroups</link> = [ "networkmanager" ];
|
||||||
</programlisting>
|
</programlisting>
|
||||||
</para>
|
</para>
|
||||||
|
|
||||||
|
|
|
@ -20,7 +20,7 @@
|
||||||
follows:
|
follows:
|
||||||
<!-- FIXME: this might not work if the user is unmanaged. -->
|
<!-- FIXME: this might not work if the user is unmanaged. -->
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link linkend="opt-users.users._name__.openssh.authorizedKeys.keys">users.users.alice.openssh.authorizedKeys.keys</link> =
|
<link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">users.users.alice.openssh.authorizedKeys.keys</link> =
|
||||||
[ "ssh-dss AAAAB3NzaC1kc3MAAACBAPIkGWVEt4..." ];
|
[ "ssh-dss AAAAB3NzaC1kc3MAAACBAPIkGWVEt4..." ];
|
||||||
</programlisting>
|
</programlisting>
|
||||||
</para>
|
</para>
|
||||||
|
|
|
@ -11,11 +11,11 @@
|
||||||
that a user account named <literal>alice</literal> shall exist:
|
that a user account named <literal>alice</literal> shall exist:
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<xref linkend="opt-users.users"/>.alice = {
|
<xref linkend="opt-users.users"/>.alice = {
|
||||||
<link linkend="opt-users.users._name__.isNormalUser">isNormalUser</link> = true;
|
<link linkend="opt-users.users._name_.isNormalUser">isNormalUser</link> = true;
|
||||||
<link linkend="opt-users.users._name__.home">home</link> = "/home/alice";
|
<link linkend="opt-users.users._name_.home">home</link> = "/home/alice";
|
||||||
<link linkend="opt-users.users._name__.description">description</link> = "Alice Foobar";
|
<link linkend="opt-users.users._name_.description">description</link> = "Alice Foobar";
|
||||||
<link linkend="opt-users.users._name__.extraGroups">extraGroups</link> = [ "wheel" "networkmanager" ];
|
<link linkend="opt-users.users._name_.extraGroups">extraGroups</link> = [ "wheel" "networkmanager" ];
|
||||||
<link linkend="opt-users.users._name__.openssh.authorizedKeys.keys">openssh.authorizedKeys.keys</link> = [ "ssh-dss AAAAB3Nza... alice@foobar" ];
|
<link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">openssh.authorizedKeys.keys</link> = [ "ssh-dss AAAAB3Nza... alice@foobar" ];
|
||||||
};
|
};
|
||||||
</programlisting>
|
</programlisting>
|
||||||
Note that <literal>alice</literal> is a member of the
|
Note that <literal>alice</literal> is a member of the
|
||||||
|
@ -36,7 +36,7 @@
|
||||||
account will cease to exist. Also, imperative commands for managing users and
|
account will cease to exist. Also, imperative commands for managing users and
|
||||||
groups, such as useradd, are no longer available. Passwords may still be
|
groups, such as useradd, are no longer available. Passwords may still be
|
||||||
assigned by setting the user's
|
assigned by setting the user's
|
||||||
<link linkend="opt-users.users._name__.hashedPassword">hashedPassword</link>
|
<link linkend="opt-users.users._name_.hashedPassword">hashedPassword</link>
|
||||||
option. A hashed password can be generated using <command>mkpasswd -m
|
option. A hashed password can be generated using <command>mkpasswd -m
|
||||||
sha-512</command> after installing the <literal>mkpasswd</literal> package.
|
sha-512</command> after installing the <literal>mkpasswd</literal> package.
|
||||||
</para>
|
</para>
|
||||||
|
|
|
@ -78,7 +78,7 @@
|
||||||
<literal>mutableUsers = false</literal>. Another way is to temporarily add
|
<literal>mutableUsers = false</literal>. Another way is to temporarily add
|
||||||
the following to your configuration:
|
the following to your configuration:
|
||||||
<screen>
|
<screen>
|
||||||
<link linkend="opt-users.users._name__.initialHashedPassword">users.users.your-user.initialHashedPassword</link> = "test";
|
<link linkend="opt-users.users._name_.initialHashedPassword">users.users.your-user.initialHashedPassword</link> = "test";
|
||||||
</screen>
|
</screen>
|
||||||
<emphasis>Important:</emphasis> delete the $hostname.qcow2 file if you have
|
<emphasis>Important:</emphasis> delete the $hostname.qcow2 file if you have
|
||||||
started the virtual machine at least once without the right users, otherwise
|
started the virtual machine at least once without the right users, otherwise
|
||||||
|
|
|
@ -211,7 +211,7 @@ nixpkgs https://nixos.org/channels/nixpkgs-unstable</screen>
|
||||||
use <literal>sudo</literal>)
|
use <literal>sudo</literal>)
|
||||||
</para>
|
</para>
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link linkend="opt-users.users._name__.initialHashedPassword">users.users.root.initialHashedPassword</link> = "";
|
<link linkend="opt-users.users._name_.initialHashedPassword">users.users.root.initialHashedPassword</link> = "";
|
||||||
</programlisting>
|
</programlisting>
|
||||||
</listitem>
|
</listitem>
|
||||||
<listitem>
|
<listitem>
|
||||||
|
|
|
@ -550,7 +550,7 @@ Retype new UNIX password: ***</screen>
|
||||||
# Note: setting fileSystems is generally not
|
# Note: setting fileSystems is generally not
|
||||||
# necessary, since nixos-generate-config figures them out
|
# necessary, since nixos-generate-config figures them out
|
||||||
# automatically in hardware-configuration.nix.
|
# automatically in hardware-configuration.nix.
|
||||||
#<link linkend="opt-fileSystems._name__.device">fileSystems."/".device</link> = "/dev/disk/by-label/nixos";
|
#<link linkend="opt-fileSystems._name_.device">fileSystems."/".device</link> = "/dev/disk/by-label/nixos";
|
||||||
|
|
||||||
# Enable the OpenSSH server.
|
# Enable the OpenSSH server.
|
||||||
services.sshd.enable = true;
|
services.sshd.enable = true;
|
||||||
|
|
|
@ -796,7 +796,7 @@ users.users.me =
|
||||||
or any other display manager in NixOS as they all support auto-login. If you used this module specifically
|
or any other display manager in NixOS as they all support auto-login. If you used this module specifically
|
||||||
because it permitted root auto-login you can override the lightdm-autologin pam module like:
|
because it permitted root auto-login you can override the lightdm-autologin pam module like:
|
||||||
<programlisting>
|
<programlisting>
|
||||||
<link xlink:href="#opt-security.pam.services._name__.text">security.pam.services.lightdm-autologin.text</link> = lib.mkForce ''
|
<link xlink:href="#opt-security.pam.services._name_.text">security.pam.services.lightdm-autologin.text</link> = lib.mkForce ''
|
||||||
auth requisite pam_nologin.so
|
auth requisite pam_nologin.so
|
||||||
auth required pam_succeed_if.so quiet
|
auth required pam_succeed_if.so quiet
|
||||||
auth required pam_permit.so
|
auth required pam_permit.so
|
||||||
|
|
|
@ -748,8 +748,6 @@ CREATE ROLE postgres LOGIN SUPERUSER;
|
||||||
For NixOS configuration options, the type <literal>loaOf</literal>, after
|
For NixOS configuration options, the type <literal>loaOf</literal>, after
|
||||||
its initial deprecation in release 20.03, has been removed. In NixOS and
|
its initial deprecation in release 20.03, has been removed. In NixOS and
|
||||||
Nixpkgs options using this type have been converted to <literal>attrsOf</literal>.
|
Nixpkgs options using this type have been converted to <literal>attrsOf</literal>.
|
||||||
</para>
|
|
||||||
<para>
|
|
||||||
For more information on this change have look at these links:
|
For more information on this change have look at these links:
|
||||||
<link xlink:href="https://github.com/NixOS/nixpkgs/issues/1800">issue #1800</link>,
|
<link xlink:href="https://github.com/NixOS/nixpkgs/issues/1800">issue #1800</link>,
|
||||||
<link xlink:href="https://github.com/NixOS/nixpkgs/pull/63103">PR #63103</link>.
|
<link xlink:href="https://github.com/NixOS/nixpkgs/pull/63103">PR #63103</link>.
|
||||||
|
|
|
@ -43,10 +43,10 @@ services.prosody = {
|
||||||
<link linkend="opt-services.prosody.ssl.cert">ssl.cert</link> = "/var/lib/acme/example.org/fullchain.pem";
|
<link linkend="opt-services.prosody.ssl.cert">ssl.cert</link> = "/var/lib/acme/example.org/fullchain.pem";
|
||||||
<link linkend="opt-services.prosody.ssl.key">ssl.key</link> = "/var/lib/acme/example.org/key.pem";
|
<link linkend="opt-services.prosody.ssl.key">ssl.key</link> = "/var/lib/acme/example.org/key.pem";
|
||||||
<link linkend="opt-services.prosody.virtualHosts">virtualHosts</link>."example.org" = {
|
<link linkend="opt-services.prosody.virtualHosts">virtualHosts</link>."example.org" = {
|
||||||
<link linkend="opt-services.prosody.virtualHosts._name__.enabled">enabled</link> = true;
|
<link linkend="opt-services.prosody.virtualHosts._name_.enabled">enabled</link> = true;
|
||||||
<link linkend="opt-services.prosody.virtualHosts._name__.domain">domain</link> = "example.org";
|
<link linkend="opt-services.prosody.virtualHosts._name_.domain">domain</link> = "example.org";
|
||||||
<link linkend="opt-services.prosody.virtualHosts._name__.ssl.cert">ssl.cert</link> = "/var/lib/acme/example.org/fullchain.pem";
|
<link linkend="opt-services.prosody.virtualHosts._name_.ssl.cert">ssl.cert</link> = "/var/lib/acme/example.org/fullchain.pem";
|
||||||
<link linkend="opt-services.prosody.virtualHosts._name__.ssl.key">ssl.key</link> = "/var/lib/acme/example.org/key.pem";
|
<link linkend="opt-services.prosody.virtualHosts._name_.ssl.key">ssl.key</link> = "/var/lib/acme/example.org/key.pem";
|
||||||
};
|
};
|
||||||
<link linkend="opt-services.prosody.muc">muc</link> = [ {
|
<link linkend="opt-services.prosody.muc">muc</link> = [ {
|
||||||
<link linkend="opt-services.prosody.muc">domain</link> = "conference.example.org";
|
<link linkend="opt-services.prosody.muc">domain</link> = "conference.example.org";
|
||||||
|
|
Loading…
Reference in New Issue