diff options
Diffstat (limited to 'nixos/modules')
329 files changed, 1440 insertions, 807 deletions
diff --git a/nixos/modules/config/ldap.nix b/nixos/modules/config/ldap.nix index 710dfdd01af5..0693e896f715 100644 --- a/nixos/modules/config/ldap.nix +++ b/nixos/modules/config/ldap.nix @@ -215,11 +215,11 @@ in ); users = mkIf cfg.daemon.enable { - extraGroups.nslcd = { + groups.nslcd = { gid = config.ids.gids.nslcd; }; - extraUsers.nslcd = { + users.nslcd = { uid = config.ids.uids.nslcd; description = "nslcd user."; group = "nslcd"; diff --git a/nixos/modules/config/pulseaudio.nix b/nixos/modules/config/pulseaudio.nix index 90cea47b70ae..3fd882789af2 100644 --- a/nixos/modules/config/pulseaudio.nix +++ b/nixos/modules/config/pulseaudio.nix @@ -264,7 +264,7 @@ in { }) (mkIf systemWide { - users.extraUsers.pulse = { + users.users.pulse = { # For some reason, PulseAudio wants UID == GID. uid = assert uid == gid; uid; group = "pulse"; @@ -274,7 +274,7 @@ in { createHome = true; }; - users.extraGroups.pulse.gid = gid; + users.groups.pulse.gid = gid; systemd.services.pulseaudio = { description = "PulseAudio System-Wide Server"; diff --git a/nixos/modules/hardware/nitrokey.nix b/nixos/modules/hardware/nitrokey.nix index bd440de69722..60fc95a75828 100644 --- a/nixos/modules/hardware/nitrokey.nix +++ b/nixos/modules/hardware/nitrokey.nix @@ -36,6 +36,6 @@ in { inherit (cfg) group; } )) ]; - users.extraGroups."${cfg.group}" = {}; + users.groups."${cfg.group}" = {}; }; } diff --git a/nixos/modules/i18n/input-method/default.xml b/nixos/modules/i18n/input-method/default.xml index 76ffa8cb7e37..eb75b7415c9c 100644 --- a/nixos/modules/i18n/input-method/default.xml +++ b/nixos/modules/i18n/input-method/default.xml @@ -68,6 +68,18 @@ ibus.engines = with pkgs.ibus-engines; [ table table-others ]; <para>To use any input method, the package must be added in the configuration, as shown above, and also (after running <literal>nixos-rebuild</literal>) the input method must be added from IBus' preference dialog.</para> + +<simplesect> + <title>Troubleshooting</title> + <para>If IBus works in some applications but not others, a likely cause of + this is that IBus is depending on a different version of + <literal>glib</literal> to what the applications are depending on. This can + be checked by running <literal>nix-store -q --requisites <path> | grep + glib</literal>, where <literal><path></literal> is the path of either + IBus or an application in the Nix store. The <literal>glib</literal> + packages must match exactly. If they do not, uninstalling and reinstalling + the application is a likely fix.</para> +</simplesect> </section> <section><title>Fcitx</title> diff --git a/nixos/modules/installer/cd-dvd/installation-cd-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-base.nix index 1ed56386e6e7..298b8d88bb59 100644 --- a/nixos/modules/installer/cd-dvd/installation-cd-base.nix +++ b/nixos/modules/installer/cd-dvd/installation-cd-base.nix @@ -30,7 +30,7 @@ with lib; boot.loader.grub.memtest86.enable = true; # Allow the user to log in as root without a password. - users.extraUsers.root.initialHashedPassword = ""; + users.users.root.initialHashedPassword = ""; system.nixos.stateVersion = mkDefault "18.03"; } diff --git a/nixos/modules/installer/cd-dvd/sd-image-aarch64.nix b/nixos/modules/installer/cd-dvd/sd-image-aarch64.nix index ddf91a5656c7..4eb28434e192 100644 --- a/nixos/modules/installer/cd-dvd/sd-image-aarch64.nix +++ b/nixos/modules/installer/cd-dvd/sd-image-aarch64.nix @@ -34,7 +34,7 @@ in boot.kernelParams = ["cma=32M" "console=ttyS0,115200n8" "console=ttyAMA0,115200n8" "console=tty0"]; # FIXME: this probably should be in installation-device.nix - users.extraUsers.root.initialHashedPassword = ""; + users.users.root.initialHashedPassword = ""; sdImage = { populateBootCommands = let diff --git a/nixos/modules/installer/cd-dvd/sd-image-armv7l-multiplatform.nix b/nixos/modules/installer/cd-dvd/sd-image-armv7l-multiplatform.nix index 891923234dda..0d595503f193 100644 --- a/nixos/modules/installer/cd-dvd/sd-image-armv7l-multiplatform.nix +++ b/nixos/modules/installer/cd-dvd/sd-image-armv7l-multiplatform.nix @@ -35,7 +35,7 @@ in boot.kernelParams = ["console=ttyS0,115200n8" "console=ttymxc0,115200n8" "console=ttyAMA0,115200n8" "console=ttyO0,115200n8" "console=ttySAC2,115200n8" "console=tty0"]; # FIXME: this probably should be in installation-device.nix - users.extraUsers.root.initialHashedPassword = ""; + users.users.root.initialHashedPassword = ""; sdImage = { populateBootCommands = let diff --git a/nixos/modules/installer/cd-dvd/sd-image-raspberrypi.nix b/nixos/modules/installer/cd-dvd/sd-image-raspberrypi.nix index fe6cc4161630..aa52844288ca 100644 --- a/nixos/modules/installer/cd-dvd/sd-image-raspberrypi.nix +++ b/nixos/modules/installer/cd-dvd/sd-image-raspberrypi.nix @@ -28,7 +28,7 @@ in boot.kernelPackages = pkgs.linuxPackages_rpi; # FIXME: this probably should be in installation-device.nix - users.extraUsers.root.initialHashedPassword = ""; + users.users.root.initialHashedPassword = ""; sdImage = { populateBootCommands = let diff --git a/nixos/modules/installer/netboot/netboot-base.nix b/nixos/modules/installer/netboot/netboot-base.nix index b12eaccf8707..5e8f7f93d92a 100644 --- a/nixos/modules/installer/netboot/netboot-base.nix +++ b/nixos/modules/installer/netboot/netboot-base.nix @@ -16,5 +16,5 @@ with lib; ]; # Allow the user to log in as root without a password. - users.extraUsers.root.initialHashedPassword = ""; + users.users.root.initialHashedPassword = ""; } diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl index a198c2d49b53..165566912401 100644 --- a/nixos/modules/installer/tools/nixos-generate-config.pl +++ b/nixos/modules/installer/tools/nixos-generate-config.pl @@ -619,7 +619,7 @@ $bootLoaderConfig # services.xserver.desktopManager.plasma5.enable = true; # Define a user account. Don't forget to set a password with ‘passwd’. - # users.extraUsers.guest = { + # users.users.guest = { # isNormalUser = true; # uid = 1000; # }; diff --git a/nixos/modules/installer/virtualbox-demo.nix b/nixos/modules/installer/virtualbox-demo.nix index c40e30354206..f58c36587801 100644 --- a/nixos/modules/installer/virtualbox-demo.nix +++ b/nixos/modules/installer/virtualbox-demo.nix @@ -14,7 +14,7 @@ with lib; boot.loader.grub.fsIdentifier = "provided"; # Allow mounting of shared folders. - users.extraUsers.demo.extraGroups = [ "vboxsf" ]; + users.users.demo.extraGroups = [ "vboxsf" ]; # Add some more video drivers to give X11 a shot at working in # VMware and QEMU. diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix index 73231edf077b..aac86087f9ec 100644 --- a/nixos/modules/misc/ids.nix +++ b/nixos/modules/misc/ids.nix @@ -317,6 +317,10 @@ restic = 291; openvpn = 292; meguca = 293; + yarn = 294; + hdfs = 295; + mapred = 296; + hadoop = 297; # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399! @@ -594,6 +598,10 @@ restic = 291; openvpn = 292; meguca = 293; + yarn = 294; + hdfs = 295; + mapred = 296; + hadoop = 297; # When adding a gid, make sure it doesn't match an existing # uid. Users and groups with the same name should have equal diff --git a/nixos/modules/misc/locate.nix b/nixos/modules/misc/locate.nix index ce5765cf1978..dd6a2f67b30d 100644 --- a/nixos/modules/misc/locate.nix +++ b/nixos/modules/misc/locate.nix @@ -101,7 +101,7 @@ in { }; config = mkIf cfg.enable { - users.extraGroups = mkIf isMLocate { mlocate = {}; }; + users.groups = mkIf isMLocate { mlocate = {}; }; security.wrappers = mkIf isMLocate { locate = { diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index c425f3c65075..f6628b8e9c51 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -178,6 +178,7 @@ ./services/backup/rsnapshot.nix ./services/backup/tarsnap.nix ./services/backup/znapzend.nix + ./services/cluster/hadoop/default.nix ./services/cluster/kubernetes/default.nix ./services/cluster/kubernetes/dns.nix ./services/cluster/kubernetes/dashboard.nix @@ -242,6 +243,7 @@ ./services/desktops/gnome3/tracker-miners.nix ./services/desktops/profile-sync-daemon.nix ./services/desktops/telepathy.nix + ./services/development/bloop.nix ./services/development/hoogle.nix ./services/editors/emacs.nix ./services/editors/infinoted.nix @@ -486,6 +488,7 @@ ./services/networking/flannel.nix ./services/networking/flashpolicyd.nix ./services/networking/freenet.nix + ./services/networking/freeradius.nix ./services/networking/gale.nix ./services/networking/gateone.nix ./services/networking/gdomap.nix @@ -624,6 +627,7 @@ ./services/security/hologram-agent.nix ./services/security/munge.nix ./services/security/oauth2_proxy.nix + ./services/security/oauth2_proxy_nginx.nix ./services/security/physlock.nix ./services/security/shibboleth-sp.nix ./services/security/sks.nix diff --git a/nixos/modules/profiles/demo.nix b/nixos/modules/profiles/demo.nix index c3ee6e98371e..7477795a94e9 100644 --- a/nixos/modules/profiles/demo.nix +++ b/nixos/modules/profiles/demo.nix @@ -3,7 +3,7 @@ { imports = [ ./graphical.nix ]; - users.extraUsers.demo = + users.users.demo = { isNormalUser = true; description = "Demo user account"; extraGroups = [ "wheel" ]; diff --git a/nixos/modules/programs/adb.nix b/nixos/modules/programs/adb.nix index f648d70bd9fa..942572cef9d5 100644 --- a/nixos/modules/programs/adb.nix +++ b/nixos/modules/programs/adb.nix @@ -14,7 +14,7 @@ with lib; description = '' Whether to configure system to use Android Debug Bridge (adb). To grant access to a user, it must be part of adbusers group: - <code>users.extraUsers.alice.extraGroups = ["adbusers"];</code> + <code>users.users.alice.extraGroups = ["adbusers"];</code> ''; relatedPackages = [ ["androidenv" "platformTools"] ]; }; @@ -25,6 +25,6 @@ with lib; config = mkIf config.programs.adb.enable { services.udev.packages = [ pkgs.android-udev-rules ]; environment.systemPackages = [ pkgs.androidenv.platformTools ]; - users.extraGroups.adbusers = {}; + users.groups.adbusers = {}; }; } diff --git a/nixos/modules/programs/gphoto2.nix b/nixos/modules/programs/gphoto2.nix index ca7c6fb28f52..93923ff3133c 100644 --- a/nixos/modules/programs/gphoto2.nix +++ b/nixos/modules/programs/gphoto2.nix @@ -15,7 +15,7 @@ with lib; Whether to configure system to use gphoto2. To grant digital camera access to a user, the user must be part of the camera group: - <code>users.extraUsers.alice.extraGroups = ["camera"];</code> + <code>users.users.alice.extraGroups = ["camera"];</code> ''; }; }; @@ -25,6 +25,6 @@ with lib; config = mkIf config.programs.gphoto2.enable { services.udev.packages = [ pkgs.libgphoto2 ]; environment.systemPackages = [ pkgs.gphoto2 ]; - users.extraGroups.camera = {}; + users.groups.camera = {}; }; } diff --git a/nixos/modules/programs/sway.nix b/nixos/modules/programs/sway.nix index d9503d6004ff..0eaaf6b85b99 100644 --- a/nixos/modules/programs/sway.nix +++ b/nixos/modules/programs/sway.nix @@ -73,7 +73,7 @@ in { permissions = "u+rx,g+rx"; }; - users.extraGroups.sway = {}; + users.groups.sway = {}; security.pam.services.swaylock = {}; hardware.opengl.enable = mkDefault true; diff --git a/nixos/modules/programs/wireshark.nix b/nixos/modules/programs/wireshark.nix index 710d223b6f59..819f15b98a05 100644 --- a/nixos/modules/programs/wireshark.nix +++ b/nixos/modules/programs/wireshark.nix @@ -29,7 +29,7 @@ in { config = mkIf cfg.enable { environment.systemPackages = [ wireshark ]; - users.extraGroups.wireshark = {}; + users.groups.wireshark = {}; security.wrappers.dumpcap = { source = "${wireshark}/bin/dumpcap"; diff --git a/nixos/modules/security/pam_mount.nix b/nixos/modules/security/pam_mount.nix index a5299728348d..8b131c54a2a5 100644 --- a/nixos/modules/security/pam_mount.nix +++ b/nixos/modules/security/pam_mount.nix @@ -40,7 +40,7 @@ in target = "security/pam_mount.conf.xml"; source = let - extraUserVolumes = filterAttrs (n: u: u.cryptHomeLuks != null) config.users.extraUsers; + extraUserVolumes = filterAttrs (n: u: u.cryptHomeLuks != null) config.users.users; userVolumeEntry = user: "<volume user=\"${user.name}\" path=\"${user.cryptHomeLuks}\" mountpoint=\"${user.home}\" />\n"; in pkgs.writeText "pam_mount.conf.xml" '' diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix index 7e59408a5b0b..04685f2c9ea1 100644 --- a/nixos/modules/security/polkit.nix +++ b/nixos/modules/security/polkit.nix @@ -94,7 +94,7 @@ in rm -rf /var/lib/{polkit-1,PolicyKit} ''; - users.extraUsers.polkituser = { + users.users.polkituser = { description = "PolKit daemon"; uid = config.ids.uids.polkituser; }; diff --git a/nixos/modules/security/rtkit.nix b/nixos/modules/security/rtkit.nix index afe93f24273d..f6dda21c6006 100644 --- a/nixos/modules/security/rtkit.nix +++ b/nixos/modules/security/rtkit.nix @@ -34,7 +34,7 @@ with lib; services.dbus.packages = [ pkgs.rtkit ]; - users.extraUsers = singleton + users.users = singleton { name = "rtkit"; uid = config.ids.uids.rtkit; description = "RealtimeKit daemon"; diff --git a/nixos/modules/security/sudo.nix b/nixos/modules/security/sudo.nix index 24283e1d6165..361a7e869602 100644 --- a/nixos/modules/security/sudo.nix +++ b/nixos/modules/security/sudo.nix @@ -66,6 +66,9 @@ in security.sudo.extraRules = mkOption { description = '' Define specific rules to be in the <filename>sudoers</filename> file. + More specific rules should come after more general ones in order to + yield the expected behavior. You can use mkBefore/mkAfter to ensure + this is the case when configuration options are merged. ''; default = []; example = [ diff --git a/nixos/modules/services/admin/oxidized.nix b/nixos/modules/services/admin/oxidized.nix index 891ca6323c3c..70f7dd9e3647 100644 --- a/nixos/modules/services/admin/oxidized.nix +++ b/nixos/modules/services/admin/oxidized.nix @@ -83,8 +83,8 @@ in }; config = mkIf cfg.enable { - users.extraGroups.${cfg.group} = { }; - users.extraUsers.${cfg.user} = { + users.groups.${cfg.group} = { }; + users.users.${cfg.user} = { description = "Oxidized service user"; group = cfg.group; home = cfg.dataDir; diff --git a/nixos/modules/services/amqp/activemq/default.nix b/nixos/modules/services/amqp/activemq/default.nix index 261f97617664..27bfd91cd2d5 100644 --- a/nixos/modules/services/amqp/activemq/default.nix +++ b/nixos/modules/services/amqp/activemq/default.nix @@ -93,13 +93,13 @@ in { }; config = mkIf cfg.enable { - users.extraUsers.activemq = { + users.users.activemq = { description = "ActiveMQ server user"; group = "activemq"; uid = config.ids.uids.activemq; }; - users.extraGroups.activemq.gid = config.ids.gids.activemq; + users.groups.activemq.gid = config.ids.gids.activemq; systemd.services.activemq_init = { wantedBy = [ "activemq.service" ]; diff --git a/nixos/modules/services/amqp/rabbitmq.nix b/nixos/modules/services/amqp/rabbitmq.nix index f536d56d7c63..bb6fc0a104df 100644 --- a/nixos/modules/services/amqp/rabbitmq.nix +++ b/nixos/modules/services/amqp/rabbitmq.nix @@ -83,7 +83,7 @@ in { environment.systemPackages = [ pkgs.rabbitmq_server ]; - users.extraUsers.rabbitmq = { + users.users.rabbitmq = { description = "RabbitMQ server user"; home = "${cfg.dataDir}"; createHome = true; @@ -91,7 +91,7 @@ in { uid = config.ids.uids.rabbitmq; }; - users.extraGroups.rabbitmq.gid = config.ids.gids.rabbitmq; + users.groups.rabbitmq.gid = config.ids.gids.rabbitmq; systemd.services.rabbitmq = { description = "RabbitMQ Server"; diff --git a/nixos/modules/services/audio/liquidsoap.nix b/nixos/modules/services/audio/liquidsoap.nix index 1c19ed36bdc7..66f84ef20762 100644 --- a/nixos/modules/services/audio/liquidsoap.nix +++ b/nixos/modules/services/audio/liquidsoap.nix @@ -57,7 +57,7 @@ in config = mkIf (builtins.length streams != 0) { - users.extraUsers.liquidsoap = { + users.users.liquidsoap = { uid = config.ids.uids.liquidsoap; group = "liquidsoap"; extraGroups = [ "audio" ]; @@ -66,7 +66,7 @@ in createHome = true; }; - users.extraGroups.liquidsoap.gid = config.ids.gids.liquidsoap; + users.groups.liquidsoap.gid = config.ids.gids.liquidsoap; systemd.services = builtins.listToAttrs ( map streamService streams ); }; diff --git a/nixos/modules/services/audio/mopidy.nix b/nixos/modules/services/audio/mopidy.nix index 52613d450b51..e2f4ec39f94c 100644 --- a/nixos/modules/services/audio/mopidy.nix +++ b/nixos/modules/services/audio/mopidy.nix @@ -93,7 +93,7 @@ in { }; }; - users.extraUsers.mopidy = { + users.users.mopidy = { inherit uid; group = "mopidy"; extraGroups = [ "audio" ]; @@ -101,7 +101,7 @@ in { home = "${cfg.dataDir}"; }; - users.extraGroups.mopidy.gid = gid; + users.groups.mopidy.gid = gid; }; diff --git a/nixos/modules/services/audio/mpd.nix b/nixos/modules/services/audio/mpd.nix index 94020ed05d67..3add6556d0df 100644 --- a/nixos/modules/services/audio/mpd.nix +++ b/nixos/modules/services/audio/mpd.nix @@ -184,7 +184,7 @@ in { }; }; - users.extraUsers = optionalAttrs (cfg.user == name) (singleton { + users.users = optionalAttrs (cfg.user == name) (singleton { inherit uid; inherit name; group = cfg.group; @@ -193,7 +193,7 @@ in { home = "${cfg.dataDir}"; }); - users.extraGroups = optionalAttrs (cfg.group == name) (singleton { + users.groups = optionalAttrs (cfg.group == name) (singleton { inherit name; gid = gid; }); diff --git a/nixos/modules/services/audio/squeezelite.nix b/nixos/modules/services/audio/squeezelite.nix index f1a60be992d8..57ae38559939 100644 --- a/nixos/modules/services/audio/squeezelite.nix +++ b/nixos/modules/services/audio/squeezelite.nix @@ -54,7 +54,7 @@ in { }; }; - users.extraUsers.squeezelite= { + users.users.squeezelite= { inherit uid; group = "nogroup"; extraGroups = [ "audio" ]; diff --git a/nixos/modules/services/backup/bacula.nix b/nixos/modules/services/backup/bacula.nix index 340b0cf07234..e2806a695398 100644 --- a/nixos/modules/services/backup/bacula.nix +++ b/nixos/modules/services/backup/bacula.nix @@ -397,7 +397,7 @@ in { environment.systemPackages = [ pkgs.bacula ]; - users.extraUsers.bacula = { + users.users.bacula = { group = "bacula"; uid = config.ids.uids.bacula; home = "${libDir}"; @@ -406,6 +406,6 @@ in { shell = "${pkgs.bash}/bin/bash"; }; - users.extraGroups.bacula.gid = config.ids.gids.bacula; + users.groups.bacula.gid = config.ids.gids.bacula; }; } diff --git a/nixos/modules/services/backup/duplicati.nix b/nixos/modules/services/backup/duplicati.nix index 379fde1fe038..80287f30b813 100644 --- a/nixos/modules/services/backup/duplicati.nix +++ b/nixos/modules/services/backup/duplicati.nix @@ -44,13 +44,13 @@ in }; }; - users.extraUsers.duplicati = { + users.users.duplicati = { uid = config.ids.uids.duplicati; home = "/var/lib/duplicati"; createHome = true; group = "duplicati"; }; - users.extraGroups.duplicati.gid = config.ids.gids.duplicati; + users.groups.duplicati.gid = config.ids.gids.duplicati; }; } diff --git a/nixos/modules/services/backup/mysql-backup.nix b/nixos/modules/services/backup/mysql-backup.nix index 3f533fa457dc..f0c273ffebf1 100644 --- a/nixos/modules/services/backup/mysql-backup.nix +++ b/nixos/modules/services/backup/mysql-backup.nix @@ -84,7 +84,7 @@ in }; config = mkIf cfg.enable { - users.extraUsers = optionalAttrs (cfg.user == defaultUser) (singleton + users.users = optionalAttrs (cfg.user == defaultUser) (singleton { name = defaultUser; isSystemUser = true; createHome = false; diff --git a/nixos/modules/services/backup/restic-rest-server.nix b/nixos/modules/services/backup/restic-rest-server.nix index d4b47a099410..d1b775f150dc 100644 --- a/nixos/modules/services/backup/restic-rest-server.nix +++ b/nixos/modules/services/backup/restic-rest-server.nix @@ -95,13 +95,13 @@ in }; }; - users.extraUsers.restic = { + users.users.restic = { group = "restic"; home = cfg.dataDir; createHome = true; uid = config.ids.uids.restic; }; - users.extraGroups.restic.gid = config.ids.uids.restic; + users.groups.restic.gid = config.ids.uids.restic; }; } diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix index 21d82469c605..2d14762e8685 100644 --- a/nixos/modules/services/backup/restic.nix +++ b/nixos/modules/services/backup/restic.nix @@ -14,7 +14,15 @@ with lib; Read the repository password from a file. ''; example = "/etc/nixos/restic-password"; + }; + s3CredentialsFile = mkOption { + type = with types; nullOr str; + description = '' + file containing the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY + for an S3-hosted repository, in the format of an EnvironmentFile + as described by systemd.exec(5) + ''; }; repository = mkOption { @@ -134,6 +142,8 @@ with lib; Type = "oneshot"; ExecStart = "${resticCmd} backup ${concatStringsSep " " backup.extraBackupArgs} ${concatStringsSep " " backup.paths}"; User = backup.user; + } // optionalAttrs (backup.s3CredentialsFile != null) { + EnvironmentFile = backup.s3CredentialsFile; }; } // optionalAttrs backup.initialize { preStart = '' diff --git a/nixos/modules/services/cluster/hadoop/conf.nix b/nixos/modules/services/cluster/hadoop/conf.nix new file mode 100644 index 000000000000..38db10406b9a --- /dev/null +++ b/nixos/modules/services/cluster/hadoop/conf.nix @@ -0,0 +1,31 @@ +{ hadoop, pkgs }: +let + propertyXml = name: value: '' + <property> + <name>${name}</name> + <value>${builtins.toString value}</value> + </property> + ''; + siteXml = fileName: properties: pkgs.writeTextDir fileName '' + <?xml version="1.0" encoding="UTF-8" standalone="no"?> + <!-- generated by NixOS --> + <configuration> + ${builtins.concatStringsSep "\n" (pkgs.lib.mapAttrsToList propertyXml properties)} + </configuration> + ''; + userFunctions = '' + hadoop_verify_logdir() { + echo Skipping verification of log directory + } + ''; +in +pkgs.buildEnv { + name = "hadoop-conf"; + paths = [ + (siteXml "core-site.xml" hadoop.coreSite) + (siteXml "hdfs-site.xml" hadoop.hdfsSite) + (siteXml "mapred-site.xml" hadoop.mapredSite) + (siteXml "yarn-site.xml" hadoop.yarnSite) + (pkgs.writeTextDir "hadoop-user-functions.sh" userFunctions) + ]; +} diff --git a/nixos/modules/services/cluster/hadoop/default.nix b/nixos/modules/services/cluster/hadoop/default.nix new file mode 100644 index 000000000000..240938f0d621 --- /dev/null +++ b/nixos/modules/services/cluster/hadoop/default.nix @@ -0,0 +1,63 @@ +{ config, lib, pkgs, ...}: +let + cfg = config.services.hadoop; + hadoopConf = import ./conf.nix { hadoop = cfg; pkgs = pkgs; }; +in +with lib; +{ + imports = [ ./yarn.nix ./hdfs.nix ]; + + options.services.hadoop = { + coreSite = mkOption { + default = {}; + example = { + "fs.defaultFS" = "hdfs://localhost"; + }; + description = "Hadoop core-site.xml definition"; + }; + + hdfsSite = mkOption { + default = {}; + example = { + "dfs.nameservices" = "namenode1"; + }; + description = "Hadoop hdfs-site.xml definition"; + }; + + mapredSite = mkOption { + default = {}; + example = { + "mapreduce.map.cpu.vcores" = "1"; + }; + description = "Hadoop mapred-site.xml definition"; + }; + + yarnSite = mkOption { + default = {}; + example = { + "yarn.resourcemanager.ha.id" = "resourcemanager1"; + }; + description = "Hadoop yarn-site.xml definition"; + }; + + package = mkOption { + type = types.package; + default = pkgs.hadoop; + defaultText = "pkgs.hadoop"; + example = literalExample "pkgs.hadoop"; + description = '' + ''; + }; + }; + + + config = mkMerge [ + (mkIf (builtins.hasAttr "yarn" config.users.users || + builtins.hasAttr "hdfs" config.users.users) { + users.groups.hadoop = { + gid = config.ids.gids.hadoop; + }; + }) + + ]; +} diff --git a/nixos/modules/services/cluster/hadoop/hdfs.nix b/nixos/modules/services/cluster/hadoop/hdfs.nix new file mode 100644 index 000000000000..a38b6a78d3a5 --- /dev/null +++ b/nixos/modules/services/cluster/hadoop/hdfs.nix @@ -0,0 +1,73 @@ +{ config, lib, pkgs, ...}: +let + cfg = config.services.hadoop; + hadoopConf = import ./conf.nix { hadoop = cfg; pkgs = pkgs; }; +in +with lib; +{ + options.services.hadoop.hdfs = { + namenode.enabled = mkOption { + type = types.bool; + default = false; + description = '' + Whether to run the Hadoop YARN NameNode + ''; + }; + datanode.enabled = mkOption { + type = types.bool; + default = false; + description = '' + Whether to run the Hadoop YARN DataNode + ''; + }; + }; + + config = mkMerge [ + (mkIf cfg.hdfs.namenode.enabled { + systemd.services."hdfs-namenode" = { + description = "Hadoop HDFS NameNode"; + wantedBy = [ "multi-user.target" ]; + + environment = { + HADOOP_HOME = "${cfg.package}"; + }; + + preStart = '' + ${cfg.package}/bin/hdfs --config ${hadoopConf} namenode -format -nonInteractive || true + ''; + + serviceConfig = { + User = "hdfs"; + SyslogIdentifier = "hdfs-namenode"; + ExecStart = "${cfg.package}/bin/hdfs --config ${hadoopConf} namenode"; + }; + }; + }) + (mkIf cfg.hdfs.datanode.enabled { + systemd.services."hdfs-datanode" = { + description = "Hadoop HDFS DataNode"; + wantedBy = [ "multi-user.target" ]; + + environment = { + HADOOP_HOME = "${cfg.package}"; + }; + + serviceConfig = { + User = "hdfs"; + SyslogIdentifier = "hdfs-datanode"; + ExecStart = "${cfg.package}/bin/hdfs --config ${hadoopConf} datanode"; + }; + }; + }) + (mkIf ( + cfg.hdfs.namenode.enabled || cfg.hdfs.datanode.enabled + ) { + users.users.hdfs = { + description = "Hadoop HDFS user"; + group = "hadoop"; + uid = config.ids.uids.hdfs; + }; + }) + + ]; +} diff --git a/nixos/modules/services/cluster/hadoop/yarn.nix b/nixos/modules/services/cluster/hadoop/yarn.nix new file mode 100644 index 000000000000..5345a2732d7e --- /dev/null +++ b/nixos/modules/services/cluster/hadoop/yarn.nix @@ -0,0 +1,74 @@ +{ config, lib, pkgs, ...}: +let + cfg = config.services.hadoop; + hadoopConf = import ./conf.nix { hadoop = cfg; pkgs = pkgs; }; +in +with lib; +{ + options.services.hadoop.yarn = { + resourcemanager.enabled = mkOption { + type = types.bool; + default = false; + description = '' + Whether to run the Hadoop YARN ResourceManager + ''; + }; + nodemanager.enabled = mkOption { + type = types.bool; + default = false; + description = '' + Whether to run the Hadoop YARN NodeManager + ''; + }; + }; + + config = mkMerge [ + (mkIf ( + cfg.yarn.resourcemanager.enabled || cfg.yarn.nodemanager.enabled + ) { + + users.users.yarn = { + description = "Hadoop YARN user"; + group = "hadoop"; + uid = config.ids.uids.yarn; + }; + }) + + (mkIf cfg.yarn.resourcemanager.enabled { + systemd.services."yarn-resourcemanager" = { + description = "Hadoop YARN ResourceManager"; + wantedBy = [ "multi-user.target" ]; + + environment = { + HADOOP_HOME = "${cfg.package}"; + }; + + serviceConfig = { + User = "yarn"; + SyslogIdentifier = "yarn-resourcemanager"; + ExecStart = "${cfg.package}/bin/yarn --config ${hadoopConf} " + + " resourcemanager"; + }; + }; + }) + + (mkIf cfg.yarn.nodemanager.enabled { + systemd.services."yarn-nodemanager" = { + description = "Hadoop YARN NodeManager"; + wantedBy = [ "multi-user.target" ]; + + environment = { + HADOOP_HOME = "${cfg.package}"; + }; + + serviceConfig = { + User = "yarn"; + SyslogIdentifier = "yarn-nodemanager"; + ExecStart = "${cfg.package}/bin/yarn --config ${hadoopConf} " + + " nodemanager"; + }; + }; + }) + + ]; +} diff --git a/nixos/modules/services/cluster/kubernetes/default.nix b/nixos/modules/services/cluster/kubernetes/default.nix index 5e87ae88f5a8..2707c176efd8 100644 --- a/nixos/modules/services/cluster/kubernetes/default.nix +++ b/nixos/modules/services/cluster/kubernetes/default.nix @@ -1145,7 +1145,7 @@ in { ]; environment.systemPackages = [ cfg.package ]; - users.extraUsers = singleton { + users.users = singleton { name = "kubernetes"; uid = config.ids.uids.kubernetes; description = "Kubernetes user"; @@ -1154,7 +1154,7 @@ in { home = cfg.dataDir; createHome = true; }; - users.extraGroups.kubernetes.gid = config.ids.gids.kubernetes; + users.groups.kubernetes.gid = config.ids.gids.kubernetes; # dns addon is enabled by default services.kubernetes.addons.dns.enable = mkDefault true; diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix index 846efc8b5b9a..8d767de37f00 100644 --- a/nixos/modules/services/continuous-integration/buildbot/master.nix +++ b/nixos/modules/services/continuous-integration/buildbot/master.nix @@ -191,11 +191,11 @@ in { }; config = mkIf cfg.enable { - users.extraGroups = optional (cfg.group == "buildbot") { + users.groups = optional (cfg.group == "buildbot") { name = "buildbot"; }; - users.extraUsers = optional (cfg.user == "buildbot") { + users.users = optional (cfg.user == "buildbot") { name = "buildbot"; description = "Buildbot User."; isNormalUser = true; diff --git a/nixos/modules/services/continuous-integration/buildbot/worker.nix b/nixos/modules/services/continuous-integration/buildbot/worker.nix index a97f571e89df..67c541570b97 100644 --- a/nixos/modules/services/continuous-integration/buildbot/worker.nix +++ b/nixos/modules/services/continuous-integration/buildbot/worker.nix @@ -84,11 +84,11 @@ in { }; config = mkIf cfg.enable { - users.extraGroups = optional (cfg.group == "bbworker") { + users.groups = optional (cfg.group == "bbworker") { name = "bbworker"; }; - users.extraUsers = optional (cfg.user == "bbworker") { + users.users = optional (cfg.user == "bbworker") { name = "bbworker"; description = "Buildbot Worker User."; isNormalUser = true; diff --git a/nixos/modules/services/continuous-integration/buildkite-agent.nix b/nixos/modules/services/continuous-integration/buildkite-agent.nix index d647b7b9fa49..9daf391c73c4 100644 --- a/nixos/modules/services/continuous-integration/buildkite-agent.nix +++ b/nixos/modules/services/continuous-integration/buildkite-agent.nix @@ -185,7 +185,7 @@ in }; config = mkIf config.services.buildkite-agent.enable { - users.extraUsers.buildkite-agent = + users.users.buildkite-agent = { name = "buildkite-agent"; home = cfg.dataDir; createHome = true; diff --git a/nixos/modules/services/continuous-integration/gitlab-runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner.nix index 6d5cea4f77a5..a0aff1b8b5b9 100644 --- a/nixos/modules/services/continuous-integration/gitlab-runner.nix +++ b/nixos/modules/services/continuous-integration/gitlab-runner.nix @@ -134,7 +134,7 @@ in # Make the gitlab-runner command availabe so users can query the runner environment.systemPackages = [ cfg.package ]; - users.extraUsers.gitlab-runner = { + users.users.gitlab-runner = { group = "gitlab-runner"; extraGroups = optional hasDocker "docker"; uid = config.ids.uids.gitlab-runner; @@ -142,6 +142,6 @@ in createHome = true; }; - users.extraGroups.gitlab-runner.gid = config.ids.gids.gitlab-runner; + users.groups.gitlab-runner.gid = config.ids.gids.gitlab-runner; }; } diff --git a/nixos/modules/services/continuous-integration/gocd-agent/default.nix b/nixos/modules/services/continuous-integration/gocd-agent/default.nix index 05adb18fbe91..8126f27c2b0c 100644 --- a/nixos/modules/services/continuous-integration/gocd-agent/default.nix +++ b/nixos/modules/services/continuous-integration/gocd-agent/default.nix @@ -135,12 +135,12 @@ in { }; config = mkIf cfg.enable { - users.extraGroups = optional (cfg.group == "gocd-agent") { + users.groups = optional (cfg.group == "gocd-agent") { name = "gocd-agent"; gid = config.ids.gids.gocd-agent; }; - users.extraUsers = optional (cfg.user == "gocd-agent") { + users.users = optional (cfg.user == "gocd-agent") { name = "gocd-agent"; description = "gocd-agent user"; createHome = true; diff --git a/nixos/modules/services/continuous-integration/gocd-server/default.nix b/nixos/modules/services/continuous-integration/gocd-server/default.nix index 07e00f17f1e8..8f177da129e5 100644 --- a/nixos/modules/services/continuous-integration/gocd-server/default.nix +++ b/nixos/modules/services/continuous-integration/gocd-server/default.nix @@ -113,8 +113,8 @@ in { extraOptions = mkOption { default = [ ]; - example = [ - "-X debug" + example = [ + "-X debug" "-Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5005" "-verbose:gc" "-Xloggc:go-server-gc.log" @@ -143,12 +143,12 @@ in { }; config = mkIf cfg.enable { - users.extraGroups = optional (cfg.group == "gocd-server") { + users.groups = optional (cfg.group == "gocd-server") { name = "gocd-server"; gid = config.ids.gids.gocd-server; }; - users.extraUsers = optional (cfg.user == "gocd-server") { + users.users = optional (cfg.user == "gocd-server") { name = "gocd-server"; description = "gocd-server user"; createHome = true; diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix index 2fa7c59a965d..c7fe4eeeab99 100644 --- a/nixos/modules/services/continuous-integration/hydra/default.nix +++ b/nixos/modules/services/continuous-integration/hydra/default.nix @@ -194,11 +194,11 @@ in config = mkIf cfg.enable { - users.extraGroups.hydra = { + users.groups.hydra = { gid = config.ids.gids.hydra; }; - users.extraUsers.hydra = + users.users.hydra = { description = "Hydra"; group = "hydra"; createHome = true; @@ -207,7 +207,7 @@ in uid = config.ids.uids.hydra; }; - users.extraUsers.hydra-queue-runner = + users.users.hydra-queue-runner = { description = "Hydra queue runner"; group = "hydra"; useDefaultShell = true; @@ -215,7 +215,7 @@ in uid = config.ids.uids.hydra-queue-runner; }; - users.extraUsers.hydra-www = + users.users.hydra-www = { description = "Hydra web server"; group = "hydra"; useDefaultShell = true; diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix index c2f4e9c0c5a7..1eca45fbd570 100644 --- a/nixos/modules/services/continuous-integration/jenkins/default.nix +++ b/nixos/modules/services/continuous-integration/jenkins/default.nix @@ -150,12 +150,12 @@ in { pkgs.dejavu_fonts ]; - users.extraGroups = optional (cfg.group == "jenkins") { + users.groups = optional (cfg.group == "jenkins") { name = "jenkins"; gid = config.ids.gids.jenkins; }; - users.extraUsers = optional (cfg.user == "jenkins") { + users.users = optional (cfg.user == "jenkins") { name = "jenkins"; description = "jenkins user"; createHome = true; diff --git a/nixos/modules/services/continuous-integration/jenkins/slave.nix b/nixos/modules/services/continuous-integration/jenkins/slave.nix index a0216caf2b5c..d8f55fb826f2 100644 --- a/nixos/modules/services/continuous-integration/jenkins/slave.nix +++ b/nixos/modules/services/continuous-integration/jenkins/slave.nix @@ -50,12 +50,12 @@ in { }; config = mkIf (cfg.enable && !masterCfg.enable) { - users.extraGroups = optional (cfg.group == "jenkins") { + users.groups = optional (cfg.group == "jenkins") { name = "jenkins"; gid = config.ids.gids.jenkins; }; - users.extraUsers = optional (cfg.user == "jenkins") { + users.users = optional (cfg.user == "jenkins") { name = "jenkins"; description = "jenkins user"; createHome = true; diff --git a/nixos/modules/services/databases/4store-endpoint.nix b/nixos/modules/services/databases/4store-endpoint.nix index d528355671f6..59ed0e5f0afd 100644 --- a/nixos/modules/services/databases/4store-endpoint.nix +++ b/nixos/modules/services/databases/4store-endpoint.nix @@ -52,7 +52,7 @@ with lib; message = "Must specify 4Store database name"; }; - users.extraUsers = singleton + users.users = singleton { name = endpointUser; uid = config.ids.uids.fourstorehttp; description = "4Store SPARQL endpoint user"; diff --git a/nixos/modules/services/databases/4store.nix b/nixos/modules/services/databases/4store.nix index abb62e1f2637..be4351c1c38f 100644 --- a/nixos/modules/services/databases/4store.nix +++ b/nixos/modules/services/databases/4store.nix @@ -43,7 +43,7 @@ with lib; message = "Must specify 4Store database name."; }; - users.extraUsers = singleton + users.users = singleton { name = fourStoreUser; uid = config.ids.uids.fourstore; description = "4Store database user"; diff --git a/nixos/modules/services/databases/cassandra.nix b/nixos/modules/services/databases/cassandra.nix index 1e5cd8f54130..09b3fbd8a62a 100644 --- a/nixos/modules/services/databases/cassandra.nix +++ b/nixos/modules/services/databases/cassandra.nix @@ -420,7 +420,7 @@ in { 9160 ]; - users.extraUsers.cassandra = + users.users.cassandra = if config.ids.uids ? "cassandra" then { uid = config.ids.uids.cassandra; } // cassandraUser else cassandraUser ; diff --git a/nixos/modules/services/databases/clickhouse.nix b/nixos/modules/services/databases/clickhouse.nix index 631d7f8cba79..1b8771cec391 100644 --- a/nixos/modules/services/databases/clickhouse.nix +++ b/nixos/modules/services/databases/clickhouse.nix @@ -27,14 +27,14 @@ with lib; config = mkIf cfg.enable { - users.extraUsers.clickhouse = { + users.users.clickhouse = { name = "clickhouse"; uid = config.ids.uids.clickhouse; group = "clickhouse"; description = "ClickHouse server user"; }; - users.extraGroups.clickhouse.gid = config.ids.gids.clickhouse; + users.groups.clickhouse.gid = config.ids.gids.clickhouse; systemd.services.clickhouse = { description = "ClickHouse server"; diff --git a/nixos/modules/services/databases/couchdb.nix b/nixos/modules/services/databases/couchdb.nix index 52247bfb983e..ca89b1198205 100644 --- a/nixos/modules/services/databases/couchdb.nix +++ b/nixos/modules/services/databases/couchdb.nix @@ -198,13 +198,13 @@ in { }; }; - users.extraUsers.couchdb = { + users.users.couchdb = { description = "CouchDB Server user"; group = "couchdb"; uid = config.ids.uids.couchdb; }; - users.extraGroups.couchdb.gid = config.ids.gids.couchdb; + users.groups.couchdb.gid = config.ids.gids.couchdb; }; } diff --git a/nixos/modules/services/databases/firebird.nix b/nixos/modules/services/databases/firebird.nix index b9f66612d4eb..cc81b440450b 100644 --- a/nixos/modules/services/databases/firebird.nix +++ b/nixos/modules/services/databases/firebird.nix @@ -154,13 +154,13 @@ in # there are some additional settings which should be reviewed ''; - users.extraUsers.firebird = { + users.users.firebird = { description = "Firebird server user"; group = "firebird"; uid = config.ids.uids.firebird; }; - users.extraGroups.firebird.gid = config.ids.gids.firebird; + users.groups.firebird.gid = config.ids.gids.firebird; }; } diff --git a/nixos/modules/services/databases/foundationdb.nix b/nixos/modules/services/databases/foundationdb.nix index 693d2fde9916..91337cf791dc 100644 --- a/nixos/modules/services/databases/foundationdb.nix +++ b/nixos/modules/services/databases/foundationdb.nix @@ -325,14 +325,14 @@ in environment.systemPackages = [ pkg ]; - users.extraUsers = optionalAttrs (cfg.user == "foundationdb") (singleton + users.users = optionalAttrs (cfg.user == "foundationdb") (singleton { name = "foundationdb"; description = "FoundationDB User"; uid = config.ids.uids.foundationdb; group = cfg.group; }); - users.extraGroups = optionalAttrs (cfg.group == "foundationdb") (singleton + users.groups = optionalAttrs (cfg.group == "foundationdb") (singleton { name = "foundationdb"; gid = config.ids.gids.foundationdb; }); diff --git a/nixos/modules/services/databases/hbase.nix b/nixos/modules/services/databases/hbase.nix index 629d02209a9c..4772e897efe2 100644 --- a/nixos/modules/services/databases/hbase.nix +++ b/nixos/modules/services/databases/hbase.nix @@ -122,13 +122,13 @@ in { }; }; - users.extraUsers.hbase = { + users.users.hbase = { description = "HBase Server user"; group = "hbase"; uid = config.ids.uids.hbase; }; - users.extraGroups.hbase.gid = config.ids.gids.hbase; + users.groups.hbase.gid = config.ids.gids.hbase; }; } diff --git a/nixos/modules/services/databases/influxdb.nix b/nixos/modules/services/databases/influxdb.nix index 15b711f57b13..d7a028b25d8d 100644 --- a/nixos/modules/services/databases/influxdb.nix +++ b/nixos/modules/services/databases/influxdb.nix @@ -182,13 +182,13 @@ in ''; }; - users.extraUsers = optional (cfg.user == "influxdb") { + users.users = optional (cfg.user == "influxdb") { name = "influxdb"; uid = config.ids.uids.influxdb; description = "Influxdb daemon user"; }; - users.extraGroups = optional (cfg.group == "influxdb") { + users.groups = optional (cfg.group == "influxdb") { name = "influxdb"; gid = config.ids.gids.influxdb; }; diff --git a/nixos/modules/services/databases/memcached.nix b/nixos/modules/services/databases/memcached.nix index 46bc6fc5c132..7af452e4dced 100644 --- a/nixos/modules/services/databases/memcached.nix +++ b/nixos/modules/services/databases/memcached.nix @@ -64,7 +64,7 @@ in config = mkIf config.services.memcached.enable { - users.extraUsers = optional (cfg.user == "memcached") { + users.users = optional (cfg.user == "memcached") { name = "memcached"; description = "Memcached server user"; }; diff --git a/nixos/modules/services/databases/mongodb.nix b/nixos/modules/services/databases/mongodb.nix index 78dbf0d784cf..4c46d9228e5f 100644 --- a/nixos/modules/services/databases/mongodb.nix +++ b/nixos/modules/services/databases/mongodb.nix @@ -93,7 +93,7 @@ in config = mkIf config.services.mongodb.enable { - users.extraUsers.mongodb = mkIf (cfg.user == "mongodb") + users.users.mongodb = mkIf (cfg.user == "mongodb") { name = "mongodb"; uid = config.ids.uids.mongodb; description = "MongoDB server user"; diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix index 15b9c788e872..3eb7879e2d9f 100644 --- a/nixos/modules/services/databases/mysql.nix +++ b/nixos/modules/services/databases/mysql.nix @@ -221,13 +221,13 @@ in mkDefault (if versionAtLeast config.system.nixos.stateVersion "17.09" then "/var/lib/mysql" else "/var/mysql"); - users.extraUsers.mysql = { + users.users.mysql = { description = "MySQL server user"; group = "mysql"; uid = config.ids.uids.mysql; }; - users.extraGroups.mysql.gid = config.ids.gids.mysql; + users.groups.mysql.gid = config.ids.gids.mysql; environment.systemPackages = [mysql]; diff --git a/nixos/modules/services/databases/neo4j.nix b/nixos/modules/services/databases/neo4j.nix index 424e08a6ee34..5015618c4247 100644 --- a/nixos/modules/services/databases/neo4j.nix +++ b/nixos/modules/services/databases/neo4j.nix @@ -139,7 +139,7 @@ in { environment.systemPackages = [ cfg.package ]; - users.extraUsers = singleton { + users.users = singleton { name = "neo4j"; uid = config.ids.uids.neo4j; description = "Neo4j daemon user"; diff --git a/nixos/modules/services/databases/openldap.nix b/nixos/modules/services/databases/openldap.nix index a67c61eb9949..9f2bf5ef8a9c 100644 --- a/nixos/modules/services/databases/openldap.nix +++ b/nixos/modules/services/databases/openldap.nix @@ -145,13 +145,13 @@ in "${configOpts}"; }; - users.extraUsers.openldap = + users.users.openldap = { name = cfg.user; group = cfg.group; uid = config.ids.uids.openldap; }; - users.extraGroups.openldap = + users.groups.openldap = { name = cfg.group; gid = config.ids.gids.openldap; }; diff --git a/nixos/modules/services/databases/opentsdb.nix b/nixos/modules/services/databases/opentsdb.nix index 489cdcffe658..b26fa9093ef4 100644 --- a/nixos/modules/services/databases/opentsdb.nix +++ b/nixos/modules/services/databases/opentsdb.nix @@ -97,13 +97,13 @@ in { }; }; - users.extraUsers.opentsdb = { + users.users.opentsdb = { description = "OpenTSDB Server user"; group = "opentsdb"; uid = config.ids.uids.opentsdb; }; - users.extraGroups.opentsdb.gid = config.ids.gids.opentsdb; + users.groups.opentsdb.gid = config.ids.gids.opentsdb; }; } diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix index 42d61fa1b368..e33bee9db6e9 100644 --- a/nixos/modules/services/databases/postgresql.nix +++ b/nixos/modules/services/databases/postgresql.nix @@ -183,14 +183,14 @@ in host all all ::1/128 md5 ''; - users.extraUsers.postgres = + users.users.postgres = { name = "postgres"; uid = config.ids.uids.postgres; group = "postgres"; description = "PostgreSQL server user"; }; - users.extraGroups.postgres.gid = config.ids.gids.postgres; + users.groups.postgres.gid = config.ids.gids.postgres; environment.systemPackages = [ postgresql ]; diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix index e4e38a4364a0..cc7b51982d1d 100644 --- a/nixos/modules/services/databases/redis.nix +++ b/nixos/modules/services/databases/redis.nix @@ -217,7 +217,7 @@ in allowedTCPPorts = [ cfg.port ]; }; - users.extraUsers.redis = + users.users.redis = { name = cfg.user; description = "Redis database user"; }; diff --git a/nixos/modules/services/databases/rethinkdb.nix b/nixos/modules/services/databases/rethinkdb.nix index cd8c386b08db..789d9c851d64 100644 --- a/nixos/modules/services/databases/rethinkdb.nix +++ b/nixos/modules/services/databases/rethinkdb.nix @@ -96,12 +96,12 @@ in ''; }; - users.extraUsers.rethinkdb = mkIf (cfg.user == "rethinkdb") + users.users.rethinkdb = mkIf (cfg.user == "rethinkdb") { name = "rethinkdb"; description = "RethinkDB server user"; }; - users.extraGroups = optionalAttrs (cfg.group == "rethinkdb") (singleton + users.groups = optionalAttrs (cfg.group == "rethinkdb") (singleton { name = "rethinkdb"; }); diff --git a/nixos/modules/services/databases/riak-cs.nix b/nixos/modules/services/databases/riak-cs.nix index 198efc29222a..2cb204f729a7 100644 --- a/nixos/modules/services/databases/riak-cs.nix +++ b/nixos/modules/services/databases/riak-cs.nix @@ -145,7 +145,7 @@ in ${cfg.extraAdvancedConfig} ''; - users.extraUsers.riak-cs = { + users.users.riak-cs = { name = "riak-cs"; uid = config.ids.uids.riak-cs; group = "riak"; diff --git a/nixos/modules/services/databases/riak.nix b/nixos/modules/services/databases/riak.nix index e0ebf164aef0..ac086cf55996 100644 --- a/nixos/modules/services/databases/riak.nix +++ b/nixos/modules/services/databases/riak.nix @@ -102,14 +102,14 @@ in ${cfg.extraAdvancedConfig} ''; - users.extraUsers.riak = { + users.users.riak = { name = "riak"; uid = config.ids.uids.riak; group = "riak"; description = "Riak server user"; }; - users.extraGroups.riak.gid = config.ids.gids.riak; + users.groups.riak.gid = config.ids.gids.riak; systemd.services.riak = { description = "Riak Server"; diff --git a/nixos/modules/services/databases/stanchion.nix b/nixos/modules/services/databases/stanchion.nix index a4597cac3cd6..9fe49f51edd2 100644 --- a/nixos/modules/services/databases/stanchion.nix +++ b/nixos/modules/services/databases/stanchion.nix @@ -143,14 +143,14 @@ in ${cfg.extraConfig} ''; - users.extraUsers.stanchion = { + users.users.stanchion = { name = "stanchion"; uid = config.ids.uids.stanchion; group = "stanchion"; description = "Stanchion server user"; }; - users.extraGroups.stanchion.gid = config.ids.gids.stanchion; + users.groups.stanchion.gid = config.ids.gids.stanchion; systemd.services.stanchion = { description = "Stanchion Server"; diff --git a/nixos/modules/services/databases/virtuoso.nix b/nixos/modules/services/databases/virtuoso.nix index 3231fede08fa..6ffc44a5274e 100644 --- a/nixos/modules/services/databases/virtuoso.nix +++ b/nixos/modules/services/databases/virtuoso.nix @@ -54,7 +54,7 @@ with lib; config = mkIf cfg.enable { - users.extraUsers = singleton + users.users = singleton { name = virtuosoUser; uid = config.ids.uids.virtuoso; description = "virtuoso user"; diff --git a/nixos/modules/services/development/bloop.nix b/nixos/modules/services/development/bloop.nix new file mode 100644 index 000000000000..56904b7c40e6 --- /dev/null +++ b/nixos/modules/services/development/bloop.nix @@ -0,0 +1,37 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + + cfg = config.services.bloop; + +in { + + options.services.bloop = { + install = mkOption { + type = types.bool; + default = false; + description = '' + Whether to install a user service for the Bloop server. + + The service must be manually started for each user with + "systemctl --user start bloop". + ''; + }; + }; + + config = mkIf (cfg.install) { + systemd.user.services.bloop = { + description = "Bloop Scala build server"; + + serviceConfig = { + Type = "simple"; + ExecStart = ''${pkgs.bloop}/bin/blp-server''; + Restart = "always"; + }; + }; + + environment.systemPackages = [ pkgs.bloop ]; + }; +} diff --git a/nixos/modules/services/editors/infinoted.nix b/nixos/modules/services/editors/infinoted.nix index 9074a4345eae..bba21caca85d 100644 --- a/nixos/modules/services/editors/infinoted.nix +++ b/nixos/modules/services/editors/infinoted.nix @@ -111,12 +111,12 @@ in { }; config = mkIf (cfg.enable) { - users.extraUsers = optional (cfg.user == "infinoted") + users.users = optional (cfg.user == "infinoted") { name = "infinoted"; description = "Infinoted user"; group = cfg.group; }; - users.extraGroups = optional (cfg.group == "infinoted") + users.groups = optional (cfg.group == "infinoted") { name = "infinoted"; }; diff --git a/nixos/modules/services/games/minecraft-server.nix b/nixos/modules/services/games/minecraft-server.nix index d2c8af6de0c5..f50d2897843a 100644 --- a/nixos/modules/services/games/minecraft-server.nix +++ b/nixos/modules/services/games/minecraft-server.nix @@ -45,7 +45,7 @@ in }; config = mkIf cfg.enable { - users.extraUsers.minecraft = { + users.users.minecraft = { description = "Minecraft Server Service user"; home = cfg.dataDir; createHome = true; diff --git a/nixos/modules/services/games/minetest-server.nix b/nixos/modules/services/games/minetest-server.nix index 58b73ac4f6bf..2de42f20f6cc 100644 --- a/nixos/modules/services/games/minetest-server.nix +++ b/nixos/modules/services/games/minetest-server.nix @@ -79,7 +79,7 @@ in }; config = mkIf cfg.enable { - users.extraUsers.minetest = { + users.users.minetest = { description = "Minetest Server Service user"; home = "/var/lib/minetest"; createHome = true; diff --git a/nixos/modules/services/games/terraria.nix b/nixos/modules/services/games/terraria.nix index 21aff780b672..ddf17599296a 100644 --- a/nixos/modules/services/games/terraria.nix +++ b/nixos/modules/services/games/terraria.nix @@ -105,14 +105,14 @@ in }; config = mkIf cfg.enable { - users.extraUsers.terraria = { + users.users.terraria = { description = "Terraria server service user"; home = "/var/lib/terraria"; createHome = true; uid = config.ids.uids.terraria; }; - users.extraGroups.terraria = { + users.groups.terraria = { gid = config.ids.gids.terraria; members = [ "terraria" ]; }; diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix index d8abde2a600a..d97d690920a6 100644 --- a/nixos/modules/services/hardware/fwupd.nix +++ b/nixos/modules/services/hardware/fwupd.nix @@ -85,6 +85,6 @@ in { }; meta = { - maintainers = pkgs.fwupd.maintainers; + maintainers = pkgs.fwupd.meta.maintainers; }; } diff --git a/nixos/modules/services/hardware/sane.nix b/nixos/modules/services/hardware/sane.nix index d651ccaa5776..fe05c5a5c06f 100644 --- a/nixos/modules/services/hardware/sane.nix +++ b/nixos/modules/services/hardware/sane.nix @@ -124,7 +124,7 @@ in environment.sessionVariables = env; services.udev.packages = backends; - users.extraGroups."scanner".gid = config.ids.gids.scanner; + users.groups."scanner".gid = config.ids.gids.scanner; }) (mkIf config.services.saned.enable { @@ -152,7 +152,7 @@ in }; }; - users.extraUsers."scanner" = { + users.users."scanner" = { uid = config.ids.uids.scanner; group = "scanner"; }; diff --git a/nixos/modules/services/hardware/tcsd.nix b/nixos/modules/services/hardware/tcsd.nix index d957b5063d38..d4b0a9495d75 100644 --- a/nixos/modules/services/hardware/tcsd.nix +++ b/nixos/modules/services/hardware/tcsd.nix @@ -137,13 +137,13 @@ in serviceConfig.ExecStart = "${pkgs.trousers}/sbin/tcsd -f -c ${tcsdConf}"; }; - users.extraUsers = optionalAttrs (cfg.user == "tss") (singleton + users.users = optionalAttrs (cfg.user == "tss") (singleton { name = "tss"; group = "tss"; uid = config.ids.uids.tss; }); - users.extraGroups = optionalAttrs (cfg.group == "tss") (singleton + users.groups = optionalAttrs (cfg.group == "tss") (singleton { name = "tss"; gid = config.ids.gids.tss; }); diff --git a/nixos/modules/services/hardware/usbmuxd.nix b/nixos/modules/services/hardware/usbmuxd.nix index 7ebd49fa01c2..6a3f7cfd210d 100644 --- a/nixos/modules/services/hardware/usbmuxd.nix +++ b/nixos/modules/services/hardware/usbmuxd.nix @@ -43,13 +43,13 @@ in config = mkIf cfg.enable { - users.extraUsers = optional (cfg.user == defaultUserGroup) { + users.users = optional (cfg.user == defaultUserGroup) { name = cfg.user; description = "usbmuxd user"; group = cfg.group; }; - users.extraGroups = optional (cfg.group == defaultUserGroup) { + users.groups = optional (cfg.group == defaultUserGroup) { name = cfg.group; }; diff --git a/nixos/modules/services/logging/graylog.nix b/nixos/modules/services/logging/graylog.nix index 95f31829882f..74a7b3c9b470 100644 --- a/nixos/modules/services/logging/graylog.nix +++ b/nixos/modules/services/logging/graylog.nix @@ -127,7 +127,7 @@ in config = mkIf cfg.enable { - users.extraUsers = mkIf (cfg.user == "graylog") { + users.users = mkIf (cfg.user == "graylog") { graylog = { uid = config.ids.uids.graylog; description = "Graylog server daemon user"; diff --git a/nixos/modules/services/logging/journalwatch.nix b/nixos/modules/services/logging/journalwatch.nix index d49795fe2b77..adabc6459148 100644 --- a/nixos/modules/services/logging/journalwatch.nix +++ b/nixos/modules/services/logging/journalwatch.nix @@ -197,7 +197,7 @@ in { config = mkIf cfg.enable { - users.extraUsers.${user} = { + users.users.${user} = { isSystemUser = true; createHome = true; home = dataDir; diff --git a/nixos/modules/services/logging/logcheck.nix b/nixos/modules/services/logging/logcheck.nix index a4cab0c94cdc..1477d273d5ee 100644 --- a/nixos/modules/services/logging/logcheck.nix +++ b/nixos/modules/services/logging/logcheck.nix @@ -213,7 +213,7 @@ in mapAttrsToList writeIgnoreRule cfg.ignore ++ mapAttrsToList writeIgnoreCronRule cfg.ignoreCron; - users.extraUsers = optionalAttrs (cfg.user == "logcheck") (singleton + users.users = optionalAttrs (cfg.user == "logcheck") (singleton { name = "logcheck"; uid = config.ids.uids.logcheck; shell = "/bin/sh"; diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix index 50477fdd25ba..a3eb1653df5b 100644 --- a/nixos/modules/services/mail/dovecot.nix +++ b/nixos/modules/services/mail/dovecot.nix @@ -309,7 +309,7 @@ in ++ optional cfg.enablePop3 "pop3" ++ optional cfg.enableLmtp "lmtp"; - users.extraUsers = [ + users.users = [ { name = "dovenull"; uid = config.ids.uids.dovenull2; description = "Dovecot user for untrusted logins"; @@ -328,7 +328,7 @@ in group = cfg.mailGroup; }); - users.extraGroups = optional (cfg.group == "dovecot2") + users.groups = optional (cfg.group == "dovecot2") { name = "dovecot2"; gid = config.ids.gids.dovecot2; } diff --git a/nixos/modules/services/mail/dspam.nix b/nixos/modules/services/mail/dspam.nix index 89076ff05462..167b5aeccc84 100644 --- a/nixos/modules/services/mail/dspam.nix +++ b/nixos/modules/services/mail/dspam.nix @@ -86,13 +86,13 @@ in { config = mkIf cfg.enable (mkMerge [ { - users.extraUsers = optionalAttrs (cfg.user == "dspam") (singleton + users.users = optionalAttrs (cfg.user == "dspam") (singleton { name = "dspam"; group = cfg.group; uid = config.ids.uids.dspam; }); - users.extraGroups = optionalAttrs (cfg.group == "dspam") (singleton + users.groups = optionalAttrs (cfg.group == "dspam") (singleton { name = "dspam"; gid = config.ids.gids.dspam; }); diff --git a/nixos/modules/services/mail/exim.nix b/nixos/modules/services/mail/exim.nix index f9ee3f909660..06c4b2811b3f 100644 --- a/nixos/modules/services/mail/exim.nix +++ b/nixos/modules/services/mail/exim.nix @@ -77,14 +77,14 @@ in systemPackages = [ exim ]; }; - users.extraUsers = singleton { + users.users = singleton { name = cfg.user; description = "Exim mail transfer agent user"; uid = config.ids.uids.exim; group = cfg.group; }; - users.extraGroups = singleton { + users.groups = singleton { name = cfg.group; gid = config.ids.gids.exim; }; diff --git a/nixos/modules/services/mail/mailhog.nix b/nixos/modules/services/mail/mailhog.nix index 206fb50d31a2..b78f4c8e0e66 100644 --- a/nixos/modules/services/mail/mailhog.nix +++ b/nixos/modules/services/mail/mailhog.nix @@ -24,7 +24,7 @@ in { config = mkIf cfg.enable { - users.extraUsers.mailhog = { + users.users.mailhog = { name = cfg.user; description = "MailHog service user"; }; diff --git a/nixos/modules/services/mail/mlmmj.nix b/nixos/modules/services/mail/mlmmj.nix index b6439b44fb5f..11565bc02f89 100644 --- a/nixos/modules/services/mail/mlmmj.nix +++ b/nixos/modules/services/mail/mlmmj.nix @@ -94,7 +94,7 @@ in config = mkIf cfg.enable { - users.extraUsers = singleton { + users.users = singleton { name = cfg.user; description = "mlmmj user"; home = stateDir; @@ -104,7 +104,7 @@ in useDefaultShell = true; }; - users.extraGroups = singleton { + users.groups = singleton { name = cfg.group; gid = config.ids.gids.mlmmj; }; diff --git a/nixos/modules/services/mail/nullmailer.nix b/nixos/modules/services/mail/nullmailer.nix index 59cb512c115b..418c02af4b7f 100644 --- a/nixos/modules/services/mail/nullmailer.nix +++ b/nixos/modules/services/mail/nullmailer.nix @@ -201,13 +201,13 @@ with lib; }; users = { - extraUsers = singleton { + users = singleton { name = cfg.user; description = "Nullmailer relay-only mta user"; group = cfg.group; }; - extraGroups = singleton { + groups = singleton { name = cfg.group; }; }; diff --git a/nixos/modules/services/mail/opendkim.nix b/nixos/modules/services/mail/opendkim.nix index 59a8373843a1..7855efb46c73 100644 --- a/nixos/modules/services/mail/opendkim.nix +++ b/nixos/modules/services/mail/opendkim.nix @@ -88,13 +88,13 @@ in { config = mkIf cfg.enable { - users.extraUsers = optionalAttrs (cfg.user == "opendkim") (singleton + users.users = optionalAttrs (cfg.user == "opendkim") (singleton { name = "opendkim"; group = cfg.group; uid = config.ids.uids.opendkim; }); - users.extraGroups = optionalAttrs (cfg.group == "opendkim") (singleton + users.groups = optionalAttrs (cfg.group == "opendkim") (singleton { name = "opendkim"; gid = config.ids.gids.opendkim; }); diff --git a/nixos/modules/services/mail/opensmtpd.nix b/nixos/modules/services/mail/opensmtpd.nix index f9b890532ceb..4276552d4f03 100644 --- a/nixos/modules/services/mail/opensmtpd.nix +++ b/nixos/modules/services/mail/opensmtpd.nix @@ -83,12 +83,12 @@ in { ###### implementation config = mkIf cfg.enable { - users.extraGroups = { + users.groups = { smtpd.gid = config.ids.gids.smtpd; smtpq.gid = config.ids.gids.smtpq; }; - users.extraUsers = { + users.users = { smtpd = { description = "OpenSMTPD process user"; uid = config.ids.uids.smtpd; diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix index 5ab331ac067f..33249aa3e554 100644 --- a/nixos/modules/services/mail/postfix.nix +++ b/nixos/modules/services/mail/postfix.nix @@ -616,14 +616,14 @@ in setgid = true; }; - users.extraUsers = optional (user == "postfix") + users.users = optional (user == "postfix") { name = "postfix"; description = "Postfix mail server user"; uid = config.ids.uids.postfix; group = group; }; - users.extraGroups = + users.groups = optional (group == "postfix") { name = group; gid = config.ids.gids.postfix; diff --git a/nixos/modules/services/mail/postgrey.nix b/nixos/modules/services/mail/postgrey.nix index d4ae25c066ac..241f75eae279 100644 --- a/nixos/modules/services/mail/postgrey.nix +++ b/nixos/modules/services/mail/postgrey.nix @@ -136,14 +136,14 @@ in { environment.systemPackages = [ pkgs.postgrey ]; users = { - extraUsers = { + users = { postgrey = { description = "Postgrey Daemon"; uid = config.ids.uids.postgrey; group = "postgrey"; }; }; - extraGroups = { + groups = { postgrey = { gid = config.ids.gids.postgrey; }; diff --git a/nixos/modules/services/mail/postsrsd.nix b/nixos/modules/services/mail/postsrsd.nix index a1af16ec9ac1..8f12a16906c5 100644 --- a/nixos/modules/services/mail/postsrsd.nix +++ b/nixos/modules/services/mail/postsrsd.nix @@ -90,13 +90,13 @@ in { services.postsrsd.domain = mkDefault config.networking.hostName; - users.extraUsers = optionalAttrs (cfg.user == "postsrsd") (singleton + users.users = optionalAttrs (cfg.user == "postsrsd") (singleton { name = "postsrsd"; group = cfg.group; uid = config.ids.uids.postsrsd; }); - users.extraGroups = optionalAttrs (cfg.group == "postsrsd") (singleton + users.groups = optionalAttrs (cfg.group == "postsrsd") (singleton { name = "postsrsd"; gid = config.ids.gids.postsrsd; }); diff --git a/nixos/modules/services/mail/rmilter.nix b/nixos/modules/services/mail/rmilter.nix index e17b7516bfff..7f38d7570132 100644 --- a/nixos/modules/services/mail/rmilter.nix +++ b/nixos/modules/services/mail/rmilter.nix @@ -194,14 +194,14 @@ in (mkIf cfg.enable { - users.extraUsers = singleton { + users.users = singleton { name = cfg.user; description = "rmilter daemon"; uid = config.ids.uids.rmilter; group = cfg.group; }; - users.extraGroups = singleton { + users.groups = singleton { name = cfg.group; gid = config.ids.gids.rmilter; }; @@ -238,12 +238,12 @@ in }) (mkIf (cfg.enable && cfg.rspamd.enable && rspamdCfg.enable) { - users.extraUsers.${cfg.user}.extraGroups = [ rspamdCfg.group ]; + users.users.${cfg.user}.extraGroups = [ rspamdCfg.group ]; }) (mkIf (cfg.enable && cfg.postfix.enable) { services.postfix.extraConfig = cfg.postfix.configFragment; - users.extraUsers.${postfixCfg.user}.extraGroups = [ cfg.group ]; + users.users.${postfixCfg.user}.extraGroups = [ cfg.group ]; }) ]; } diff --git a/nixos/modules/services/mail/rspamd.nix b/nixos/modules/services/mail/rspamd.nix index 09fb587e74b5..b3dae60c2c7e 100644 --- a/nixos/modules/services/mail/rspamd.nix +++ b/nixos/modules/services/mail/rspamd.nix @@ -282,14 +282,14 @@ in # Allow users to run 'rspamc' and 'rspamadm'. environment.systemPackages = [ pkgs.rspamd ]; - users.extraUsers = singleton { + users.users = singleton { name = cfg.user; description = "rspamd daemon"; uid = config.ids.uids.rspamd; group = cfg.group; }; - users.extraGroups = singleton { + users.groups = singleton { name = cfg.group; gid = config.ids.gids.rspamd; }; diff --git a/nixos/modules/services/mail/spamassassin.nix b/nixos/modules/services/mail/spamassassin.nix index d483a8c3d67d..0c11ea431368 100644 --- a/nixos/modules/services/mail/spamassassin.nix +++ b/nixos/modules/services/mail/spamassassin.nix @@ -128,14 +128,14 @@ in systemPackages = [ pkgs.spamassassin ]; }; - users.extraUsers = singleton { + users.users = singleton { name = "spamd"; description = "Spam Assassin Daemon"; uid = config.ids.uids.spamd; group = "spamd"; }; - users.extraGroups = singleton { + users.groups = singleton { name = "spamd"; gid = config.ids.gids.spamd; }; diff --git a/nixos/modules/services/misc/airsonic.nix b/nixos/modules/services/misc/airsonic.nix index b92104787a56..083587b8ebb1 100644 --- a/nixos/modules/services/misc/airsonic.nix +++ b/nixos/modules/services/misc/airsonic.nix @@ -107,7 +107,7 @@ in { }; }; - users.extraUsers.airsonic = { + users.users.airsonic = { description = "Airsonic service user"; name = cfg.user; home = cfg.home; diff --git a/nixos/modules/services/misc/apache-kafka.nix b/nixos/modules/services/misc/apache-kafka.nix index 82fa1cc2e7e5..363ac4411e11 100644 --- a/nixos/modules/services/misc/apache-kafka.nix +++ b/nixos/modules/services/misc/apache-kafka.nix @@ -124,7 +124,7 @@ in { environment.systemPackages = [cfg.package]; - users.extraUsers = singleton { + users.users = singleton { name = "apache-kafka"; uid = config.ids.uids.apache-kafka; description = "Apache Kafka daemon user"; diff --git a/nixos/modules/services/misc/autorandr.nix b/nixos/modules/services/misc/autorandr.nix index 3020130ad1f6..4708e16e2a6c 100644 --- a/nixos/modules/services/misc/autorandr.nix +++ b/nixos/modules/services/misc/autorandr.nix @@ -12,6 +12,16 @@ in { services.autorandr = { enable = mkEnableOption "handling of hotplug and sleep events by autorandr"; + + defaultTarget = mkOption { + default = "default"; + type = types.str; + description = '' + Fallback if no monitor layout can be detected. See the docs + (https://github.com/phillipberndt/autorandr/blob/v1.0/README.md#how-to-use) + for further reference. + ''; + }; }; }; @@ -22,13 +32,21 @@ in { environment.systemPackages = [ pkgs.autorandr ]; - systemd.packages = [ pkgs.autorandr ]; - systemd.services.autorandr = { wantedBy = [ "sleep.target" ]; + description = "Autorandr execution hook"; + after = [ "sleep.target" ]; + + serviceConfig = { + StartLimitInterval = 5; + StartLimitBurst = 1; + ExecStart = "${pkgs.autorandr}/bin/autorandr --batch --change --default ${cfg.defaultTarget}"; + Type = "oneshot"; + RemainAfterExit = false; + }; }; }; - meta.maintainers = with maintainers; [ gnidorah ]; + meta.maintainers = with maintainers; [ gnidorah ma27 ]; } diff --git a/nixos/modules/services/misc/bepasty.nix b/nixos/modules/services/misc/bepasty.nix index c499e428af35..62835c194e42 100644 --- a/nixos/modules/services/misc/bepasty.nix +++ b/nixos/modules/services/misc/bepasty.nix @@ -168,14 +168,14 @@ in }) ) cfg.servers; - users.extraUsers = [{ + users.users = [{ uid = config.ids.uids.bepasty; name = user; group = group; home = default_home; }]; - users.extraGroups = [{ + users.groups = [{ name = group; gid = config.ids.gids.bepasty; }]; diff --git a/nixos/modules/services/misc/calibre-server.nix b/nixos/modules/services/misc/calibre-server.nix index 6b19f780ec0c..84c04f403d3a 100644 --- a/nixos/modules/services/misc/calibre-server.nix +++ b/nixos/modules/services/misc/calibre-server.nix @@ -49,12 +49,12 @@ in environment.systemPackages = [ pkgs.calibre ]; - users.extraUsers.calibre-server = { + users.users.calibre-server = { uid = config.ids.uids.calibre-server; group = "calibre-server"; }; - users.extraGroups.calibre-server = { + users.groups.calibre-server = { gid = config.ids.gids.calibre-server; }; diff --git a/nixos/modules/services/misc/cfdyndns.nix b/nixos/modules/services/misc/cfdyndns.nix index 69a33d0b8c1b..dcf416022734 100644 --- a/nixos/modules/services/misc/cfdyndns.nix +++ b/nixos/modules/services/misc/cfdyndns.nix @@ -54,14 +54,14 @@ in }; }; - users.extraUsers = { + users.users = { cfdyndns = { group = "cfdyndns"; uid = config.ids.uids.cfdyndns; }; }; - users.extraGroups = { + users.groups = { cfdyndns = { gid = config.ids.gids.cfdyndns; }; diff --git a/nixos/modules/services/misc/cgminer.nix b/nixos/modules/services/misc/cgminer.nix index d5071d8ff767..b1cf5a7d1104 100644 --- a/nixos/modules/services/misc/cgminer.nix +++ b/nixos/modules/services/misc/cgminer.nix @@ -110,7 +110,7 @@ in config = mkIf config.services.cgminer.enable { - users.extraUsers = optionalAttrs (cfg.user == "cgminer") (singleton + users.users = optionalAttrs (cfg.user == "cgminer") (singleton { name = "cgminer"; uid = config.ids.uids.cgminer; description = "Cgminer user"; diff --git a/nixos/modules/services/misc/couchpotato.nix b/nixos/modules/services/misc/couchpotato.nix index 496487622351..70aa895f76d8 100644 --- a/nixos/modules/services/misc/couchpotato.nix +++ b/nixos/modules/services/misc/couchpotato.nix @@ -34,7 +34,7 @@ in }; }; - users.extraUsers = singleton + users.users = singleton { name = "couchpotato"; group = "couchpotato"; home = "/var/lib/couchpotato/"; @@ -42,7 +42,7 @@ in uid = config.ids.uids.couchpotato; }; - users.extraGroups = singleton + users.groups = singleton { name = "couchpotato"; gid = config.ids.gids.couchpotato; }; diff --git a/nixos/modules/services/misc/dictd.nix b/nixos/modules/services/misc/dictd.nix index 7e3b6431a133..8d3e294622d1 100644 --- a/nixos/modules/services/misc/dictd.nix +++ b/nixos/modules/services/misc/dictd.nix @@ -45,7 +45,7 @@ in # get the command line client on system path to make some use of the service environment.systemPackages = [ pkgs.dict ]; - users.extraUsers = singleton + users.users = singleton { name = "dictd"; group = "dictd"; description = "DICT.org dictd server"; @@ -53,7 +53,7 @@ in uid = config.ids.uids.dictd; }; - users.extraGroups = singleton + users.groups = singleton { name = "dictd"; gid = config.ids.gids.dictd; }; diff --git a/nixos/modules/services/misc/disnix.nix b/nixos/modules/services/misc/disnix.nix index e4517c636e88..b28995a09115 100644 --- a/nixos/modules/services/misc/disnix.nix +++ b/nixos/modules/services/misc/disnix.nix @@ -71,7 +71,7 @@ in ++ optional cfg.useWebServiceInterface "${pkgs.dbus_java}/share/java/dbus.jar"; services.tomcat.webapps = optional cfg.useWebServiceInterface pkgs.DisnixWebService; - users.extraGroups = singleton + users.groups = singleton { name = "disnix"; gid = config.ids.gids.disnix; }; diff --git a/nixos/modules/services/misc/docker-registry.nix b/nixos/modules/services/misc/docker-registry.nix index f628da4ac4c0..9a3966ab30aa 100644 --- a/nixos/modules/services/misc/docker-registry.nix +++ b/nixos/modules/services/misc/docker-registry.nix @@ -140,7 +140,7 @@ in { startAt = optional cfg.enableGarbageCollect cfg.garbageCollectDates; }; - users.extraUsers.docker-registry = { + users.users.docker-registry = { createHome = true; home = cfg.storagePath; }; diff --git a/nixos/modules/services/misc/emby.nix b/nixos/modules/services/misc/emby.nix index e295f0f930e1..b1968784af0f 100644 --- a/nixos/modules/services/misc/emby.nix +++ b/nixos/modules/services/misc/emby.nix @@ -54,14 +54,14 @@ in }; }; - users.extraUsers = mkIf (cfg.user == "emby") { + users.users = mkIf (cfg.user == "emby") { emby = { group = cfg.group; uid = config.ids.uids.emby; }; }; - users.extraGroups = mkIf (cfg.group == "emby") { + users.groups = mkIf (cfg.group == "emby") { emby = { gid = config.ids.gids.emby; }; diff --git a/nixos/modules/services/misc/errbot.nix b/nixos/modules/services/misc/errbot.nix index cb2fa6776240..ac6ba2181de2 100644 --- a/nixos/modules/services/misc/errbot.nix +++ b/nixos/modules/services/misc/errbot.nix @@ -76,8 +76,8 @@ in { }; config = mkIf (cfg.instances != {}) { - users.extraUsers.errbot.group = "errbot"; - users.extraGroups.errbot = {}; + users.users.errbot.group = "errbot"; + users.groups.errbot = {}; systemd.services = mapAttrs' (name: instanceCfg: nameValuePair "errbot-${name}" ( let diff --git a/nixos/modules/services/misc/etcd.nix b/nixos/modules/services/misc/etcd.nix index 7c91462883f1..2d1893dae64b 100644 --- a/nixos/modules/services/misc/etcd.nix +++ b/nixos/modules/services/misc/etcd.nix @@ -188,7 +188,7 @@ in { environment.systemPackages = [ pkgs.etcdctl ]; - users.extraUsers = singleton { + users.users = singleton { name = "etcd"; uid = config.ids.uids.etcd; description = "Etcd daemon user"; diff --git a/nixos/modules/services/misc/exhibitor.nix b/nixos/modules/services/misc/exhibitor.nix index 600bd780e7b0..685e652c0ba0 100644 --- a/nixos/modules/services/misc/exhibitor.nix +++ b/nixos/modules/services/misc/exhibitor.nix @@ -408,7 +408,7 @@ in chmod -R u+w ${cfg.baseDir}/zookeeper/conf ''; }; - users.extraUsers = singleton { + users.users = singleton { name = "zookeeper"; uid = config.ids.uids.zookeeper; description = "Zookeeper daemon user"; diff --git a/nixos/modules/services/misc/felix.nix b/nixos/modules/services/misc/felix.nix index d6ad9dcaebc2..1c5ece868258 100644 --- a/nixos/modules/services/misc/felix.nix +++ b/nixos/modules/services/misc/felix.nix @@ -47,12 +47,12 @@ in ###### implementation config = mkIf cfg.enable { - users.extraGroups = singleton + users.groups = singleton { name = "osgi"; gid = config.ids.gids.osgi; }; - users.extraUsers = singleton + users.users = singleton { name = "osgi"; uid = config.ids.uids.osgi; description = "OSGi user"; diff --git a/nixos/modules/services/misc/folding-at-home.nix b/nixos/modules/services/misc/folding-at-home.nix index 164221cbab7f..122c89ce0680 100644 --- a/nixos/modules/services/misc/folding-at-home.nix +++ b/nixos/modules/services/misc/folding-at-home.nix @@ -42,7 +42,7 @@ in { config = mkIf cfg.enable { - users.extraUsers = singleton + users.users = singleton { name = fahUser; uid = config.ids.uids.foldingathome; description = "Folding@Home user"; diff --git a/nixos/modules/services/misc/gammu-smsd.nix b/nixos/modules/services/misc/gammu-smsd.nix index 2d406b634437..3057d7fd1a09 100644 --- a/nixos/modules/services/misc/gammu-smsd.nix +++ b/nixos/modules/services/misc/gammu-smsd.nix @@ -200,7 +200,7 @@ in { }; config = mkIf cfg.enable { - users.extraUsers.${cfg.user} = { + users.users.${cfg.user} = { description = "gammu-smsd user"; uid = config.ids.uids.gammu-smsd; extraGroups = [ "${cfg.device.group}" ]; diff --git a/nixos/modules/services/misc/geoip-updater.nix b/nixos/modules/services/misc/geoip-updater.nix index e0b9df96f8e8..baf0a8d73d19 100644 --- a/nixos/modules/services/misc/geoip-updater.nix +++ b/nixos/modules/services/misc/geoip-updater.nix @@ -251,7 +251,7 @@ in } ]; - users.extraUsers.geoip = { + users.users.geoip = { group = "root"; description = "GeoIP database updater"; uid = config.ids.uids.geoip; diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix index 46efc1df12eb..5d664728e0b5 100644 --- a/nixos/modules/services/misc/gitea.nix +++ b/nixos/modules/services/misc/gitea.nix @@ -337,7 +337,7 @@ in }; users = mkIf (cfg.user == "gitea") { - extraUsers.gitea = { + users.gitea = { description = "Gitea Service"; home = cfg.stateDir; createHome = true; diff --git a/nixos/modules/services/misc/gitit.nix b/nixos/modules/services/misc/gitit.nix index 94a98e0335df..0025d96bd37b 100644 --- a/nixos/modules/services/misc/gitit.nix +++ b/nixos/modules/services/misc/gitit.nix @@ -645,15 +645,15 @@ in config = mkIf cfg.enable { - users.extraUsers.gitit = { - group = config.users.extraGroups.gitit.name; + users.users.gitit = { + group = config.users.groups.gitit.name; description = "Gitit user"; home = homeDir; createHome = true; uid = config.ids.uids.gitit; }; - users.extraGroups.gitit.gid = config.ids.gids.gitit; + users.groups.gitit.gid = config.ids.gids.gitit; systemd.services.gitit = let uid = toString config.ids.uids.gitit; @@ -715,8 +715,8 @@ NAMED ''; serviceConfig = { - User = config.users.extraUsers.gitit.name; - Group = config.users.extraGroups.gitit.name; + User = config.users.users.gitit.name; + Group = config.users.groups.gitit.name; ExecStart = with cfg; gititSh haskellPackages extraPackages; }; }; diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix index e80abf96da48..b09f0408e102 100644 --- a/nixos/modules/services/misc/gitlab.nix +++ b/nixos/modules/services/misc/gitlab.nix @@ -444,7 +444,7 @@ in { # Use postfix to send out mails. services.postfix.enable = mkDefault true; - users.extraUsers = [ + users.users = [ { name = cfg.user; group = cfg.group; home = "${cfg.statePath}/home"; @@ -453,7 +453,7 @@ in { } ]; - users.extraGroups = [ + users.groups = [ { name = cfg.group; gid = config.ids.gids.gitlab; } diff --git a/nixos/modules/services/misc/gitolite.nix b/nixos/modules/services/misc/gitolite.nix index 6e60316d000c..b9c2a966e6f5 100644 --- a/nixos/modules/services/misc/gitolite.nix +++ b/nixos/modules/services/misc/gitolite.nix @@ -140,7 +140,7 @@ in push( @{$RC{ENABLE}}, 'git-annex-shell ua'); ''; - users.extraUsers.${cfg.user} = { + users.users.${cfg.user} = { description = "Gitolite user"; home = cfg.dataDir; createHome = true; @@ -148,7 +148,7 @@ in group = cfg.group; useDefaultShell = true; }; - users.extraGroups."${cfg.group}".gid = config.ids.gids.gitolite; + users.groups."${cfg.group}".gid = config.ids.gids.gitolite; systemd.services."gitolite-init" = { description = "Gitolite initialization"; diff --git a/nixos/modules/services/misc/gogs.nix b/nixos/modules/services/misc/gogs.nix index ba744d37e71c..ee99967c261b 100644 --- a/nixos/modules/services/misc/gogs.nix +++ b/nixos/modules/services/misc/gogs.nix @@ -254,7 +254,7 @@ in }; users = mkIf (cfg.user == "gogs") { - extraUsers.gogs = { + users.gogs = { description = "Go Git Service"; uid = config.ids.uids.gogs; group = "gogs"; @@ -262,7 +262,7 @@ in createHome = true; shell = pkgs.bash; }; - extraGroups.gogs.gid = config.ids.gids.gogs; + groups.gogs.gid = config.ids.gids.gogs; }; warnings = optional (cfg.database.password != "") diff --git a/nixos/modules/services/misc/gollum.nix b/nixos/modules/services/misc/gollum.nix index 0888221ab62f..d1823bc6d4df 100644 --- a/nixos/modules/services/misc/gollum.nix +++ b/nixos/modules/services/misc/gollum.nix @@ -93,8 +93,8 @@ in ''; serviceConfig = { - User = config.users.extraUsers.gollum.name; - Group = config.users.extraGroups.gollum.name; + User = config.users.users.gollum.name; + Group = config.users.groups.gollum.name; PermissionsStartOnly = true; ExecStart = '' ${pkgs.gollum}/bin/gollum \ diff --git a/nixos/modules/services/misc/gpsd.nix b/nixos/modules/services/misc/gpsd.nix index a4a4c7b5d937..3bfcb636a3c6 100644 --- a/nixos/modules/services/misc/gpsd.nix +++ b/nixos/modules/services/misc/gpsd.nix @@ -53,6 +53,14 @@ in ''; }; + nowait = mkOption { + type = types.bool; + default = false; + description = '' + don't wait for client connects to poll GPS + ''; + }; + port = mkOption { type = types.int; default = 2947; @@ -78,14 +86,14 @@ in config = mkIf cfg.enable { - users.extraUsers = singleton + users.users = singleton { name = "gpsd"; inherit uid; description = "gpsd daemon user"; home = "/var/empty"; }; - users.extraGroups = singleton + users.groups = singleton { name = "gpsd"; inherit gid; }; @@ -99,7 +107,8 @@ in ExecStart = '' ${pkgs.gpsd}/sbin/gpsd -D "${toString cfg.debugLevel}" \ -S "${toString cfg.port}" \ - ${if cfg.readonly then "-b" else ""} \ + ${optionalString cfg.readonly "-b"} \ + ${optionalString cfg.nowait "-n"} \ "${cfg.device}" ''; }; diff --git a/nixos/modules/services/misc/home-assistant.nix b/nixos/modules/services/misc/home-assistant.nix index 05555353f207..fdcfe6bc2b8e 100644 --- a/nixos/modules/services/misc/home-assistant.nix +++ b/nixos/modules/services/misc/home-assistant.nix @@ -170,13 +170,13 @@ in { after = wants; }; - users.extraUsers.hass = { + users.users.hass = { home = cfg.configDir; createHome = true; group = "hass"; uid = config.ids.uids.hass; }; - users.extraGroups.hass.gid = config.ids.gids.hass; + users.groups.hass.gid = config.ids.gids.hass; }; } diff --git a/nixos/modules/services/misc/ihaskell.nix b/nixos/modules/services/misc/ihaskell.nix index 6da9cc8c47e6..11597706d0d1 100644 --- a/nixos/modules/services/misc/ihaskell.nix +++ b/nixos/modules/services/misc/ihaskell.nix @@ -38,23 +38,23 @@ in config = mkIf cfg.enable { - users.extraUsers.ihaskell = { - group = config.users.extraGroups.ihaskell.name; + users.users.ihaskell = { + group = config.users.groups.ihaskell.name; description = "IHaskell user"; home = "/var/lib/ihaskell"; createHome = true; uid = config.ids.uids.ihaskell; }; - users.extraGroups.ihaskell.gid = config.ids.gids.ihaskell; + users.groups.ihaskell.gid = config.ids.gids.ihaskell; systemd.services.ihaskell = { description = "IHaskell notebook instance"; wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; serviceConfig = { - User = config.users.extraUsers.ihaskell.name; - Group = config.users.extraGroups.ihaskell.name; + User = config.users.users.ihaskell.name; + Group = config.users.groups.ihaskell.name; ExecStart = "${pkgs.runtimeShell} -c \"cd $HOME;${ihaskell}/bin/ihaskell-notebook\""; }; }; diff --git a/nixos/modules/services/misc/jackett.nix b/nixos/modules/services/misc/jackett.nix index 87a41ee70b54..db72d36f2ac7 100644 --- a/nixos/modules/services/misc/jackett.nix +++ b/nixos/modules/services/misc/jackett.nix @@ -36,12 +36,12 @@ in }; }; - users.extraUsers.jackett = { + users.users.jackett = { uid = config.ids.uids.jackett; home = "/var/lib/jackett"; group = "jackett"; }; - users.extraGroups.jackett.gid = config.ids.gids.jackett; + users.groups.jackett.gid = config.ids.gids.jackett; }; } diff --git a/nixos/modules/services/misc/mathics.nix b/nixos/modules/services/misc/mathics.nix index 50715858881a..c588a30d76cd 100644 --- a/nixos/modules/services/misc/mathics.nix +++ b/nixos/modules/services/misc/mathics.nix @@ -26,23 +26,23 @@ in { config = mkIf cfg.enable { - users.extraUsers.mathics = { - group = config.users.extraGroups.mathics.name; + users.users.mathics = { + group = config.users.groups.mathics.name; description = "Mathics user"; home = "/var/lib/mathics"; createHome = true; uid = config.ids.uids.mathics; }; - users.extraGroups.mathics.gid = config.ids.gids.mathics; + users.groups.mathics.gid = config.ids.gids.mathics; systemd.services.mathics = { description = "Mathics notebook server"; wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; serviceConfig = { - User = config.users.extraUsers.mathics.name; - Group = config.users.extraGroups.mathics.name; + User = config.users.users.mathics.name; + Group = config.users.groups.mathics.name; ExecStart = concatStringsSep " " [ "${pkgs.mathics}/bin/mathicsserver" "--port" (toString cfg.port) diff --git a/nixos/modules/services/misc/matrix-synapse.nix b/nixos/modules/services/misc/matrix-synapse.nix index f7441988b272..3e3de9114708 100644 --- a/nixos/modules/services/misc/matrix-synapse.nix +++ b/nixos/modules/services/misc/matrix-synapse.nix @@ -635,7 +635,7 @@ in { }; config = mkIf cfg.enable { - users.extraUsers = [ + users.users = [ { name = "matrix-synapse"; group = "matrix-synapse"; home = cfg.dataDir; @@ -644,7 +644,7 @@ in { uid = config.ids.uids.matrix-synapse; } ]; - users.extraGroups = [ + users.groups = [ { name = "matrix-synapse"; gid = config.ids.gids.matrix-synapse; } ]; diff --git a/nixos/modules/services/misc/mediatomb.nix b/nixos/modules/services/misc/mediatomb.nix index 40ec2831ff09..5c1977d28deb 100644 --- a/nixos/modules/services/misc/mediatomb.nix +++ b/nixos/modules/services/misc/mediatomb.nix @@ -267,12 +267,12 @@ in { serviceConfig.User = "${cfg.user}"; }; - users.extraGroups = optionalAttrs (cfg.group == "mediatomb") (singleton { + users.groups = optionalAttrs (cfg.group == "mediatomb") (singleton { name = "mediatomb"; gid = gid; }); - users.extraUsers = optionalAttrs (cfg.user == "mediatomb") (singleton { + users.users = optionalAttrs (cfg.user == "mediatomb") (singleton { name = "mediatomb"; isSystemUser = true; group = cfg.group; diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix index 0ee105e4c6f1..e64df8dc7d2d 100644 --- a/nixos/modules/services/misc/nix-daemon.nix +++ b/nixos/modules/services/misc/nix-daemon.nix @@ -131,10 +131,10 @@ in description = " If set, Nix will perform builds in a sandboxed environment that it will set up automatically for each build. This prevents impurities - in builds by disallowing access to dependencies outside of the Nix - store by using network and mount namespaces in a chroot environment. - This isn't enabled by default for possible performance impacts due to - the initial setup time of a sandbox for each build. It doesn't affect + in builds by disallowing access to dependencies outside of the Nix + store by using network and mount namespaces in a chroot environment. + This isn't enabled by default for possible performance impacts due to + the initial setup time of a sandbox for each build. It doesn't affect derivation hashes, so changing this option will not trigger a rebuild of packages. "; @@ -450,7 +450,7 @@ in nix.nrBuildUsers = mkDefault (lib.max 32 cfg.maxJobs); - users.extraUsers = nixbldUsers; + users.users = nixbldUsers; services.xserver.displayManager.hiddenUsers = map ({ name, ... }: name) nixbldUsers; diff --git a/nixos/modules/services/misc/nix-ssh-serve.nix b/nixos/modules/services/misc/nix-ssh-serve.nix index 5bd9cf9086f1..87ed7f0a61b9 100644 --- a/nixos/modules/services/misc/nix-ssh-serve.nix +++ b/nixos/modules/services/misc/nix-ssh-serve.nix @@ -36,7 +36,7 @@ in { config = mkIf cfg.enable { - users.extraUsers.nix-ssh = { + users.users.nix-ssh = { description = "Nix SSH store user"; uid = config.ids.uids.nix-ssh; useDefaultShell = true; @@ -55,7 +55,7 @@ in { Match All ''; - users.extraUsers.nix-ssh.openssh.authorizedKeys.keys = cfg.keys; + users.users.nix-ssh.openssh.authorizedKeys.keys = cfg.keys; }; } diff --git a/nixos/modules/services/misc/nzbget.nix b/nixos/modules/services/misc/nzbget.nix index a186d57ceba2..f79a04a1d748 100644 --- a/nixos/modules/services/misc/nzbget.nix +++ b/nixos/modules/services/misc/nzbget.nix @@ -86,14 +86,14 @@ let }; }; - users.extraUsers = mkIf (cfg.user == "nzbget") { + users.users = mkIf (cfg.user == "nzbget") { nzbget = { group = cfg.group; uid = config.ids.uids.nzbget; }; }; - users.extraGroups = mkIf (cfg.group == "nzbget") { + users.groups = mkIf (cfg.group == "nzbget") { nzbget = { gid = config.ids.gids.nzbget; }; diff --git a/nixos/modules/services/misc/octoprint.nix b/nixos/modules/services/misc/octoprint.nix index 6883993a893b..baa7c3ade52e 100644 --- a/nixos/modules/services/misc/octoprint.nix +++ b/nixos/modules/services/misc/octoprint.nix @@ -86,13 +86,13 @@ in config = mkIf cfg.enable { - users.extraUsers = optionalAttrs (cfg.user == "octoprint") (singleton + users.users = optionalAttrs (cfg.user == "octoprint") (singleton { name = "octoprint"; group = cfg.group; uid = config.ids.uids.octoprint; }); - users.extraGroups = optionalAttrs (cfg.group == "octoprint") (singleton + users.groups = optionalAttrs (cfg.group == "octoprint") (singleton { name = "octoprint"; gid = config.ids.gids.octoprint; }); diff --git a/nixos/modules/services/misc/osrm.nix b/nixos/modules/services/misc/osrm.nix index 7ec8b15906fc..f89f37ccd9df 100644 --- a/nixos/modules/services/misc/osrm.nix +++ b/nixos/modules/services/misc/osrm.nix @@ -69,7 +69,7 @@ in wantedBy = [ "multi-user.target" ]; serviceConfig = { - User = config.users.extraUsers.osrm.name; + User = config.users.users.osrm.name; ExecStart = '' ${pkgs.osrm-backend}/bin/osrm-routed \ --ip ${cfg.address} \ diff --git a/nixos/modules/services/misc/plex.nix b/nixos/modules/services/misc/plex.nix index 46221ace3084..85f1d4a85562 100644 --- a/nixos/modules/services/misc/plex.nix +++ b/nixos/modules/services/misc/plex.nix @@ -157,14 +157,14 @@ in allowedUDPPorts = [ 1900 5353 32410 32412 32413 32414 ]; }; - users.extraUsers = mkIf (cfg.user == "plex") { + users.users = mkIf (cfg.user == "plex") { plex = { group = cfg.group; uid = config.ids.uids.plex; }; }; - users.extraGroups = mkIf (cfg.group == "plex") { + users.groups = mkIf (cfg.group == "plex") { plex = { gid = config.ids.gids.plex; }; diff --git a/nixos/modules/services/misc/plexpy.nix b/nixos/modules/services/misc/plexpy.nix index df9f12581247..2a589fdfb27f 100644 --- a/nixos/modules/services/misc/plexpy.nix +++ b/nixos/modules/services/misc/plexpy.nix @@ -74,7 +74,7 @@ in }; }; - users.extraUsers = mkIf (cfg.user == "plexpy") { + users.users = mkIf (cfg.user == "plexpy") { plexpy = { group = cfg.group; uid = config.ids.uids.plexpy; }; }; }; diff --git a/nixos/modules/services/misc/pykms.nix b/nixos/modules/services/misc/pykms.nix index 897e856e2a2d..a11296e1bd02 100644 --- a/nixos/modules/services/misc/pykms.nix +++ b/nixos/modules/services/misc/pykms.nix @@ -73,7 +73,7 @@ in { }; users = { - extraUsers.pykms = { + users.pykms = { name = "pykms"; group = "pykms"; home = home; @@ -82,7 +82,7 @@ in { description = "PyKMS daemon user"; }; - extraGroups.pykms = { + groups.pykms = { gid = config.ids.gids.pykms; }; }; diff --git a/nixos/modules/services/misc/radarr.nix b/nixos/modules/services/misc/radarr.nix index 245ad9f9a6df..7738eacc6ae9 100644 --- a/nixos/modules/services/misc/radarr.nix +++ b/nixos/modules/services/misc/radarr.nix @@ -36,12 +36,12 @@ in }; }; - users.extraUsers.radarr = { + users.users.radarr = { uid = config.ids.uids.radarr; home = "/var/lib/radarr"; group = "radarr"; }; - users.extraGroups.radarr.gid = config.ids.gids.radarr; + users.groups.radarr.gid = config.ids.gids.radarr; }; } diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix index 3997b3f0dca0..9a9424449f80 100644 --- a/nixos/modules/services/misc/redmine.nix +++ b/nixos/modules/services/misc/redmine.nix @@ -128,13 +128,13 @@ in { } ]; - users.extraUsers = [ + users.users = [ { name = "redmine"; group = "redmine"; uid = config.ids.uids.redmine; } ]; - users.extraGroups = [ + users.groups = [ { name = "redmine"; gid = config.ids.gids.redmine; } ]; diff --git a/nixos/modules/services/misc/ripple-data-api.nix b/nixos/modules/services/misc/ripple-data-api.nix index dbca56b13335..042b496d35ee 100644 --- a/nixos/modules/services/misc/ripple-data-api.nix +++ b/nixos/modules/services/misc/ripple-data-api.nix @@ -185,7 +185,7 @@ in { ]; }; - users.extraUsers = singleton + users.users = singleton { name = "ripple-data-api"; description = "Ripple data api user"; uid = config.ids.uids.ripple-data-api; diff --git a/nixos/modules/services/misc/rippled.nix b/nixos/modules/services/misc/rippled.nix index 8bcf35a8ad38..9d9a0ba44da5 100644 --- a/nixos/modules/services/misc/rippled.nix +++ b/nixos/modules/services/misc/rippled.nix @@ -406,7 +406,7 @@ in config = mkIf cfg.enable { - users.extraUsers = singleton + users.users = singleton { name = "rippled"; description = "Ripple server user"; uid = config.ids.uids.rippled; diff --git a/nixos/modules/services/misc/serviio.nix b/nixos/modules/services/misc/serviio.nix index a6612e9c6adb..8808f2d21931 100644 --- a/nixos/modules/services/misc/serviio.nix +++ b/nixos/modules/services/misc/serviio.nix @@ -63,7 +63,7 @@ in { }; }; - users.extraUsers = [ + users.users = [ { name = "serviio"; group = "serviio"; @@ -74,7 +74,7 @@ in { } ]; - users.extraGroups = [ + users.groups = [ { name = "serviio";} ]; diff --git a/nixos/modules/services/misc/siproxd.nix b/nixos/modules/services/misc/siproxd.nix index 9e8fb6c228f2..dcaf73aca448 100644 --- a/nixos/modules/services/misc/siproxd.nix +++ b/nixos/modules/services/misc/siproxd.nix @@ -161,7 +161,7 @@ in config = mkIf cfg.enable { - users.extraUsers = singleton { + users.users = singleton { name = "siproxyd"; uid = config.ids.uids.siproxd; }; diff --git a/nixos/modules/services/misc/sonarr.nix b/nixos/modules/services/misc/sonarr.nix index ecde2c33bfa9..edba4e6c23eb 100644 --- a/nixos/modules/services/misc/sonarr.nix +++ b/nixos/modules/services/misc/sonarr.nix @@ -36,12 +36,12 @@ in }; }; - users.extraUsers.sonarr = { + users.users.sonarr = { uid = config.ids.uids.sonarr; home = "/var/lib/sonarr"; group = "sonarr"; }; - users.extraGroups.sonarr.gid = config.ids.gids.sonarr; + users.groups.sonarr.gid = config.ids.gids.sonarr; }; } diff --git a/nixos/modules/services/misc/subsonic.nix b/nixos/modules/services/misc/subsonic.nix index c2efd53d413a..1612b197f35f 100644 --- a/nixos/modules/services/misc/subsonic.nix +++ b/nixos/modules/services/misc/subsonic.nix @@ -130,7 +130,7 @@ let cfg = config.services.subsonic; in { ! [ -e "${cfg.home}" ] && [ -d "$oldHome" ] && [ $(${pkgs.coreutils}/bin/stat -c %u "$oldHome") -eq \ - ${toString config.users.extraUsers.subsonic.uid} ]; then + ${toString config.users.users.subsonic.uid} ]; then logger Moving "$oldHome" to "${cfg.home}" ${pkgs.coreutils}/bin/mv -T "$oldHome" "${cfg.home}" fi @@ -152,7 +152,7 @@ let cfg = config.services.subsonic; in { }; }; - users.extraUsers.subsonic = { + users.users.subsonic = { description = "Subsonic daemon user"; home = cfg.home; createHome = true; @@ -160,6 +160,6 @@ let cfg = config.services.subsonic; in { uid = config.ids.uids.subsonic; }; - users.extraGroups.subsonic.gid = config.ids.gids.subsonic; + users.groups.subsonic.gid = config.ids.gids.subsonic; }; } diff --git a/nixos/modules/services/misc/uhub.nix b/nixos/modules/services/misc/uhub.nix index 15071202b9c2..005951b9231e 100644 --- a/nixos/modules/services/misc/uhub.nix +++ b/nixos/modules/services/misc/uhub.nix @@ -161,11 +161,11 @@ in config = mkIf cfg.enable { users = { - extraUsers = singleton { + users = singleton { name = "uhub"; uid = config.ids.uids.uhub; }; - extraGroups = singleton { + groups = singleton { name = "uhub"; gid = config.ids.gids.uhub; }; diff --git a/nixos/modules/services/misc/zookeeper.nix b/nixos/modules/services/misc/zookeeper.nix index 91539592511c..cb7cc97d5a5c 100644 --- a/nixos/modules/services/misc/zookeeper.nix +++ b/nixos/modules/services/misc/zookeeper.nix @@ -144,7 +144,7 @@ in { ''; }; - users.extraUsers = singleton { + users.users = singleton { name = "zookeeper"; uid = config.ids.uids.zookeeper; description = "Zookeeper daemon user"; diff --git a/nixos/modules/services/monitoring/bosun.nix b/nixos/modules/services/monitoring/bosun.nix index 496838a131ba..8bf741adb6e3 100644 --- a/nixos/modules/services/monitoring/bosun.nix +++ b/nixos/modules/services/monitoring/bosun.nix @@ -153,13 +153,13 @@ in { }; }; - users.extraUsers.bosun = { + users.users.bosun = { description = "bosun user"; group = "bosun"; uid = config.ids.uids.bosun; }; - users.extraGroups.bosun.gid = config.ids.gids.bosun; + users.groups.bosun.gid = config.ids.gids.bosun; }; diff --git a/nixos/modules/services/monitoring/collectd.nix b/nixos/modules/services/monitoring/collectd.nix index dfbac3446e03..6606980cdad8 100644 --- a/nixos/modules/services/monitoring/collectd.nix +++ b/nixos/modules/services/monitoring/collectd.nix @@ -97,7 +97,7 @@ in { ''; }; - users.extraUsers = optional (cfg.user == "collectd") { + users.users = optional (cfg.user == "collectd") { name = "collectd"; }; }; diff --git a/nixos/modules/services/monitoring/dd-agent/dd-agent.nix b/nixos/modules/services/monitoring/dd-agent/dd-agent.nix index 6367c8245f71..cf65b6c28cf2 100644 --- a/nixos/modules/services/monitoring/dd-agent/dd-agent.nix +++ b/nixos/modules/services/monitoring/dd-agent/dd-agent.nix @@ -178,7 +178,7 @@ in { config = mkIf cfg.enable { environment.systemPackages = [ pkgs."dd-agent" pkgs.sysstat pkgs.procps ]; - users.extraUsers.datadog = { + users.users.datadog = { description = "Datadog Agent User"; uid = config.ids.uids.datadog; group = "datadog"; @@ -186,7 +186,7 @@ in { createHome = true; }; - users.extraGroups.datadog.gid = config.ids.gids.datadog; + users.groups.datadog.gid = config.ids.gids.datadog; systemd.services.dd-agent = { description = "Datadog agent monitor"; diff --git a/nixos/modules/services/monitoring/fusion-inventory.nix b/nixos/modules/services/monitoring/fusion-inventory.nix index c3b869e00880..9c976c65ea49 100644 --- a/nixos/modules/services/monitoring/fusion-inventory.nix +++ b/nixos/modules/services/monitoring/fusion-inventory.nix @@ -46,7 +46,7 @@ in { config = mkIf cfg.enable { - users.extraUsers = singleton { + users.users = singleton { name = "fusion-inventory"; description = "FusionInventory user"; }; diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix index eceb91525db4..3e801f9b838d 100644 --- a/nixos/modules/services/monitoring/grafana.nix +++ b/nixos/modules/services/monitoring/grafana.nix @@ -265,7 +265,7 @@ in { ''; }; - users.extraUsers.grafana = { + users.users.grafana = { uid = config.ids.uids.grafana; description = "Grafana user"; home = cfg.dataDir; diff --git a/nixos/modules/services/monitoring/graphite.nix b/nixos/modules/services/monitoring/graphite.nix index 4b1ad34b3a4e..7ad26c137e51 100644 --- a/nixos/modules/services/monitoring/graphite.nix +++ b/nixos/modules/services/monitoring/graphite.nix @@ -638,13 +638,13 @@ in { cfg.web.enable || cfg.api.enable || cfg.seyren.enable || cfg.pager.enable || cfg.beacon.enable ) { - users.extraUsers = singleton { + users.users = singleton { name = "graphite"; uid = config.ids.uids.graphite; description = "Graphite daemon user"; home = dataDir; }; - users.extraGroups.graphite.gid = config.ids.gids.graphite; + users.groups.graphite.gid = config.ids.gids.graphite; }) ]; } diff --git a/nixos/modules/services/monitoring/heapster.nix b/nixos/modules/services/monitoring/heapster.nix index deee64aa41ea..fbdff2eb5dbe 100644 --- a/nixos/modules/services/monitoring/heapster.nix +++ b/nixos/modules/services/monitoring/heapster.nix @@ -49,7 +49,7 @@ in { }; }; - users.extraUsers = singleton { + users.users = singleton { name = "heapster"; uid = config.ids.uids.heapster; description = "Heapster user"; diff --git a/nixos/modules/services/monitoring/munin.nix b/nixos/modules/services/monitoring/munin.nix index 358ffd431dd4..ff9604c7dbcd 100644 --- a/nixos/modules/services/monitoring/munin.nix +++ b/nixos/modules/services/monitoring/munin.nix @@ -150,14 +150,14 @@ in environment.systemPackages = [ pkgs.munin ]; - users.extraUsers = [{ + users.users = [{ name = "munin"; description = "Munin monitoring user"; group = "munin"; uid = config.ids.uids.munin; }]; - users.extraGroups = [{ + users.groups = [{ name = "munin"; gid = config.ids.gids.munin; }]; diff --git a/nixos/modules/services/monitoring/nagios.nix b/nixos/modules/services/monitoring/nagios.nix index 4914c5db97d2..3e1d727b416e 100644 --- a/nixos/modules/services/monitoring/nagios.nix +++ b/nixos/modules/services/monitoring/nagios.nix @@ -143,7 +143,7 @@ in config = mkIf cfg.enable { - users.extraUsers.nagios = { + users.users.nagios = { description = "Nagios user "; uid = config.ids.uids.nagios; home = nagiosState; diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix index d23b329eeb25..eefddf5a206b 100644 --- a/nixos/modules/services/monitoring/netdata.nix +++ b/nixos/modules/services/monitoring/netdata.nix @@ -100,11 +100,11 @@ in { }; - users.extraUsers = optional (cfg.user == defaultUser) { + users.users = optional (cfg.user == defaultUser) { name = defaultUser; }; - users.extraGroups = optional (cfg.group == defaultUser) { + users.groups = optional (cfg.group == defaultUser) { name = defaultUser; }; diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix index 80122e69d167..5dda763bd56b 100644 --- a/nixos/modules/services/monitoring/prometheus/default.nix +++ b/nixos/modules/services/monitoring/prometheus/default.nix @@ -471,8 +471,8 @@ in { }; config = mkIf cfg.enable { - users.extraGroups.${promGroup}.gid = config.ids.gids.prometheus; - users.extraUsers.${promUser} = { + users.groups.${promGroup}.gid = config.ids.gids.prometheus; + users.users.${promUser} = { description = "Prometheus daemon user"; uid = config.ids.uids.prometheus; group = promGroup; diff --git a/nixos/modules/services/monitoring/riemann-dash.nix b/nixos/modules/services/monitoring/riemann-dash.nix index 523f74cb72b9..7eb4d888b0cc 100644 --- a/nixos/modules/services/monitoring/riemann-dash.nix +++ b/nixos/modules/services/monitoring/riemann-dash.nix @@ -51,9 +51,9 @@ in { config = mkIf cfg.enable { - users.extraGroups.riemanndash.gid = config.ids.gids.riemanndash; + users.groups.riemanndash.gid = config.ids.gids.riemanndash; - users.extraUsers.riemanndash = { + users.users.riemanndash = { description = "riemann-dash daemon user"; uid = config.ids.uids.riemanndash; group = "riemanndash"; diff --git a/nixos/modules/services/monitoring/riemann-tools.nix b/nixos/modules/services/monitoring/riemann-tools.nix index de858813a762..4e8832dadc5e 100644 --- a/nixos/modules/services/monitoring/riemann-tools.nix +++ b/nixos/modules/services/monitoring/riemann-tools.nix @@ -40,9 +40,9 @@ in { config = mkIf cfg.enableHealth { - users.extraGroups.riemanntools.gid = config.ids.gids.riemanntools; + users.groups.riemanntools.gid = config.ids.gids.riemanntools; - users.extraUsers.riemanntools = { + users.users.riemanntools = { description = "riemann-tools daemon user"; uid = config.ids.uids.riemanntools; group = "riemanntools"; diff --git a/nixos/modules/services/monitoring/riemann.nix b/nixos/modules/services/monitoring/riemann.nix index ac5d0134a80d..237de53456f9 100644 --- a/nixos/modules/services/monitoring/riemann.nix +++ b/nixos/modules/services/monitoring/riemann.nix @@ -69,9 +69,9 @@ in { config = mkIf cfg.enable { - users.extraGroups.riemann.gid = config.ids.gids.riemann; + users.groups.riemann.gid = config.ids.gids.riemann; - users.extraUsers.riemann = { + users.users.riemann = { description = "riemann daemon user"; uid = config.ids.uids.riemann; group = "riemann"; diff --git a/nixos/modules/services/monitoring/scollector.nix b/nixos/modules/services/monitoring/scollector.nix index 2684482c6184..6ecb21d628de 100644 --- a/nixos/modules/services/monitoring/scollector.nix +++ b/nixos/modules/services/monitoring/scollector.nix @@ -123,13 +123,13 @@ in { }; }; - users.extraUsers.scollector = { + users.users.scollector = { description = "scollector user"; group = "scollector"; uid = config.ids.uids.scollector; }; - users.extraGroups.scollector.gid = config.ids.gids.scollector; + users.groups.scollector.gid = config.ids.gids.scollector; }; diff --git a/nixos/modules/services/monitoring/statsd.nix b/nixos/modules/services/monitoring/statsd.nix index 7b0e9981cbb1..ea155821ecc9 100644 --- a/nixos/modules/services/monitoring/statsd.nix +++ b/nixos/modules/services/monitoring/statsd.nix @@ -125,7 +125,7 @@ in message = "Only builtin backends (graphite, console, repeater) or backends enumerated in `pkgs.nodePackages` are allowed!"; }) cfg.backends; - users.extraUsers = singleton { + users.users = singleton { name = "statsd"; uid = config.ids.uids.statsd; description = "Statsd daemon user"; diff --git a/nixos/modules/services/monitoring/telegraf.nix b/nixos/modules/services/monitoring/telegraf.nix index 49dc9d8143e6..6bfcd7143e1c 100644 --- a/nixos/modules/services/monitoring/telegraf.nix +++ b/nixos/modules/services/monitoring/telegraf.nix @@ -62,7 +62,7 @@ in { }; }; - users.extraUsers = [{ + users.users = [{ name = "telegraf"; uid = config.ids.uids.telegraf; description = "telegraf daemon user"; diff --git a/nixos/modules/services/monitoring/ups.nix b/nixos/modules/services/monitoring/ups.nix index 29dc68f90cc9..bc755612fd9b 100644 --- a/nixos/modules/services/monitoring/ups.nix +++ b/nixos/modules/services/monitoring/ups.nix @@ -259,7 +259,7 @@ in /* - users.extraUsers = [ + users.users = [ { name = "nut"; uid = 84; home = "/var/lib/nut"; @@ -269,7 +269,7 @@ in } ]; - users.extraGroups = [ + users.groups = [ { name = "nut"; gid = 84; } diff --git a/nixos/modules/services/monitoring/vnstat.nix b/nixos/modules/services/monitoring/vnstat.nix index ca56e4a7b958..cb2f8c07edb9 100644 --- a/nixos/modules/services/monitoring/vnstat.nix +++ b/nixos/modules/services/monitoring/vnstat.nix @@ -16,7 +16,7 @@ in { }; config = mkIf cfg.enable { - users.extraUsers.vnstatd = { + users.users.vnstatd = { isSystemUser = true; description = "vnstat daemon user"; home = "/var/lib/vnstat"; diff --git a/nixos/modules/services/monitoring/zabbix-agent.nix b/nixos/modules/services/monitoring/zabbix-agent.nix index 88a63b4bf161..87857225e7d7 100644 --- a/nixos/modules/services/monitoring/zabbix-agent.nix +++ b/nixos/modules/services/monitoring/zabbix-agent.nix @@ -68,7 +68,7 @@ in config = mkIf cfg.enable { - users.extraUsers = mkIf (!config.services.zabbixServer.enable) (singleton + users.users = mkIf (!config.services.zabbixServer.enable) (singleton { name = "zabbix"; uid = config.ids.uids.zabbix; description = "Zabbix daemon user"; diff --git a/nixos/modules/services/monitoring/zabbix-server.nix b/nixos/modules/services/monitoring/zabbix-server.nix index acd1279ddf47..f62d55457ed4 100644 --- a/nixos/modules/services/monitoring/zabbix-server.nix +++ b/nixos/modules/services/monitoring/zabbix-server.nix @@ -85,7 +85,7 @@ in services.postgresql.enable = useLocalPostgres; - users.extraUsers = singleton + users.users = singleton { name = "zabbix"; uid = config.ids.uids.zabbix; description = "Zabbix daemon user"; diff --git a/nixos/modules/services/network-filesystems/ceph.nix b/nixos/modules/services/network-filesystems/ceph.nix index 5de8ae79a246..4e3bc839d400 100644 --- a/nixos/modules/services/network-filesystems/ceph.nix +++ b/nixos/modules/services/network-filesystems/ceph.nix @@ -332,13 +332,13 @@ in in generators.toINI {} totalConfig; - users.extraUsers = singleton { + users.users = singleton { name = "ceph"; uid = config.ids.uids.ceph; description = "Ceph daemon user"; }; - users.extraGroups = singleton { + users.groups = singleton { name = "ceph"; gid = config.ids.gids.ceph; }; diff --git a/nixos/modules/services/network-filesystems/davfs2.nix b/nixos/modules/services/network-filesystems/davfs2.nix index 6b2a770100c5..c16e12378d75 100644 --- a/nixos/modules/services/network-filesystems/davfs2.nix +++ b/nixos/modules/services/network-filesystems/davfs2.nix @@ -57,12 +57,12 @@ in environment.systemPackages = [ pkgs.davfs2 ]; environment.etc."davfs2/davfs2.conf".source = cfgFile; - users.extraGroups = optionalAttrs (cfg.davGroup == "davfs2") (singleton { + users.groups = optionalAttrs (cfg.davGroup == "davfs2") (singleton { name = "davfs2"; gid = config.ids.gids.davfs2; }); - users.extraUsers = optionalAttrs (cfg.davUser == "davfs2") (singleton { + users.users = optionalAttrs (cfg.davUser == "davfs2") (singleton { name = "davfs2"; createHome = false; group = cfg.davGroup; diff --git a/nixos/modules/services/network-filesystems/ipfs.nix b/nixos/modules/services/network-filesystems/ipfs.nix index ab6d3a3d2fa4..21b664e5b2f9 100644 --- a/nixos/modules/services/network-filesystems/ipfs.nix +++ b/nixos/modules/services/network-filesystems/ipfs.nix @@ -212,7 +212,7 @@ in { user_allow_other ''; }; - users.extraUsers = mkIf (cfg.user == "ipfs") { + users.users = mkIf (cfg.user == "ipfs") { ipfs = { group = cfg.group; home = cfg.dataDir; @@ -222,7 +222,7 @@ in { }; }; - users.extraGroups = mkIf (cfg.group == "ipfs") { + users.groups = mkIf (cfg.group == "ipfs") { ipfs.gid = config.ids.gids.ipfs; }; diff --git a/nixos/modules/services/network-filesystems/openafs/client.nix b/nixos/modules/services/network-filesystems/openafs/client.nix index 3826fe3edfd0..52c0966e05bc 100644 --- a/nixos/modules/services/network-filesystems/openafs/client.nix +++ b/nixos/modules/services/network-filesystems/openafs/client.nix @@ -1,6 +1,7 @@ -{ config, pkgs, lib, ... }: +{ config, lib, pkgs, ... }: -with import ./lib.nix { inherit lib; }; +# openafsMod, openafsBin, mkCellServDB +with import ./lib.nix { inherit config lib pkgs; }; let inherit (lib) getBin mkOption mkIf optionalString singleton types; @@ -8,8 +9,8 @@ let cfg = config.services.openafsClient; cellServDB = pkgs.fetchurl { - url = http://dl.central.org/dl/cellservdb/CellServDB.2017-03-14; - sha256 = "1197z6c5xrijgf66rhaymnm5cvyg2yiy1i20y4ah4mrzmjx0m7sc"; + url = http://dl.central.org/dl/cellservdb/CellServDB.2018-05-14; + sha256 = "1wmjn6mmyy2r8p10nlbdzs4nrqxy8a9pjyrdciy5nmppg4053rk2"; }; clientServDB = pkgs.writeText "client-cellServDB-${cfg.cellName}" (mkCellServDB cfg.cellName cfg.cellServDB); @@ -21,8 +22,6 @@ let echo "${cfg.mountPoint}:${cfg.cache.directory}:${toString cfg.cache.blocks}" > $out/cacheinfo ''; - openafsMod = config.boot.kernelPackages.openafs; - openafsBin = lib.getBin pkgs.openafs; in { ###### interface @@ -147,6 +146,19 @@ in ''; }; + packages = { + module = mkOption { + default = config.boot.kernelPackages.openafs; + type = types.package; + description = "OpenAFS kernel module package. MUST match the userland package!"; + }; + programs = mkOption { + default = getBin pkgs.openafs; + type = types.package; + description = "OpenAFS programs package. MUST match the kernel module package!"; + }; + }; + sparse = mkOption { default = true; type = types.bool; @@ -180,7 +192,7 @@ in } ]; - environment.systemPackages = [ pkgs.openafs ]; + environment.systemPackages = [ openafsBin ]; environment.etc = { clientCellServDB = { diff --git a/nixos/modules/services/network-filesystems/openafs/lib.nix b/nixos/modules/services/network-filesystems/openafs/lib.nix index ecfc72d2eaf9..255740ac65ef 100644 --- a/nixos/modules/services/network-filesystems/openafs/lib.nix +++ b/nixos/modules/services/network-filesystems/openafs/lib.nix @@ -1,14 +1,15 @@ -{ lib, ...}: +{ config, lib, pkgs, ...}: let - inherit (lib) concatStringsSep mkOption types; + inherit (lib) concatStringsSep getBin mkOption types; in rec { mkCellServDB = cellName: db: '' >${cellName} '' + (concatStringsSep "\n" (map (dbm: if (dbm.ip != "" && dbm.dnsname != "") then dbm.ip + " #" + dbm.dnsname else "") - db)); + db)) + + "\n"; # CellServDB configuration type cellServDBConfig = { @@ -25,4 +26,8 @@ in rec { description = "DNS full-qualified domain name of a database server"; }; }; + + openafsMod = config.services.openafsClient.packages.module; + openafsBin = config.services.openafsClient.packages.programs; + openafsSrv = config.services.openafsServer.package; } diff --git a/nixos/modules/services/network-filesystems/openafs/server.nix b/nixos/modules/services/network-filesystems/openafs/server.nix index 429eb945ac9e..aa8640fd240e 100644 --- a/nixos/modules/services/network-filesystems/openafs/server.nix +++ b/nixos/modules/services/network-filesystems/openafs/server.nix @@ -1,6 +1,7 @@ -{ config, pkgs, lib, ... }: +{ config, lib, pkgs, ... }: -with import ./lib.nix { inherit lib; }; +# openafsBin, openafsSrv, mkCellServDB +with import ./lib.nix { inherit config lib pkgs; }; let inherit (lib) concatStringsSep intersperse mapAttrsToList mkForce mkIf mkMerge mkOption optionalString types; @@ -11,21 +12,21 @@ let checkbintime 3 0 5 0 0 '' + (optionalString cfg.roles.database.enable '' bnode simple vlserver 1 - parm ${openafsBin}/libexec/openafs/vlserver ${optionalString cfg.dottedPrincipals "-allow-dotted-principals"} ${cfg.roles.database.vlserverArgs} + parm ${openafsSrv}/libexec/openafs/vlserver ${optionalString cfg.dottedPrincipals "-allow-dotted-principals"} ${cfg.roles.database.vlserverArgs} end bnode simple ptserver 1 - parm ${openafsBin}/libexec/openafs/ptserver ${optionalString cfg.dottedPrincipals "-allow-dotted-principals"} ${cfg.roles.database.ptserverArgs} + parm ${openafsSrv}/libexec/openafs/ptserver ${optionalString cfg.dottedPrincipals "-allow-dotted-principals"} ${cfg.roles.database.ptserverArgs} end '') + (optionalString cfg.roles.fileserver.enable '' bnode dafs dafs 1 - parm ${openafsBin}/libexec/openafs/dafileserver ${optionalString cfg.dottedPrincipals "-allow-dotted-principals"} -udpsize ${udpSizeStr} ${cfg.roles.fileserver.fileserverArgs} - parm ${openafsBin}/libexec/openafs/davolserver ${optionalString cfg.dottedPrincipals "-allow-dotted-principals"} -udpsize ${udpSizeStr} ${cfg.roles.fileserver.volserverArgs} - parm ${openafsBin}/libexec/openafs/salvageserver ${cfg.roles.fileserver.salvageserverArgs} - parm ${openafsBin}/libexec/openafs/dasalvager ${cfg.roles.fileserver.salvagerArgs} + parm ${openafsSrv}/libexec/openafs/dafileserver ${optionalString cfg.dottedPrincipals "-allow-dotted-principals"} -udpsize ${udpSizeStr} ${cfg.roles.fileserver.fileserverArgs} + parm ${openafsSrv}/libexec/openafs/davolserver ${optionalString cfg.dottedPrincipals "-allow-dotted-principals"} -udpsize ${udpSizeStr} ${cfg.roles.fileserver.volserverArgs} + parm ${openafsSrv}/libexec/openafs/salvageserver ${cfg.roles.fileserver.salvageserverArgs} + parm ${openafsSrv}/libexec/openafs/dasalvager ${cfg.roles.fileserver.salvagerArgs} end '') + (optionalString (cfg.roles.database.enable && cfg.roles.backup.enable) '' bnode simple buserver 1 - parm ${openafsBin}/libexec/openafs/buserver ${cfg.roles.backup.buserverArgs} ${optionalString (cfg.roles.backup.cellServDB != []) "-cellservdb /etc/openafs/backup/"} + parm ${openafsSrv}/libexec/openafs/buserver ${cfg.roles.backup.buserverArgs} ${optionalString (cfg.roles.backup.cellServDB != []) "-cellservdb /etc/openafs/backup/"} end '')); @@ -39,8 +40,6 @@ let udpSizeStr = toString cfg.udpPacketSize; - openafsBin = lib.getBin pkgs.openafs; - in { options = { @@ -79,6 +78,12 @@ in { description = "Definition of all cell-local database server machines."; }; + package = mkOption { + default = pkgs.openafs.server or pkgs.openafs; + type = types.package; + description = "OpenAFS package for the server binaries"; + }; + roles = { fileserver = { enable = mkOption { @@ -213,7 +218,7 @@ in { } ]; - environment.systemPackages = [ pkgs.openafs ]; + environment.systemPackages = [ openafsBin ]; environment.etc = { bosConfig = { @@ -244,7 +249,10 @@ in { after = [ "syslog.target" "network.target" ]; wantedBy = [ "multi-user.target" ]; restartIfChanged = false; - unitConfig.ConditionPathExists = [ "/etc/openafs/server/rxkad.keytab" ]; + unitConfig.ConditionPathExists = [ + "|/etc/openafs/server/rxkad.keytab" + "|/etc/openafs/server/KeyFileExt" + ]; preStart = '' mkdir -m 0755 -p /var/openafs ${optionalString (netInfo != null) "cp ${netInfo} /var/openafs/netInfo"} diff --git a/nixos/modules/services/network-filesystems/tahoe.nix b/nixos/modules/services/network-filesystems/tahoe.nix index 80b34c48f1d2..534862a3c9e4 100644 --- a/nixos/modules/services/network-filesystems/tahoe.nix +++ b/nixos/modules/services/network-filesystems/tahoe.nix @@ -255,7 +255,7 @@ in cp /etc/tahoe-lafs/introducer-"${node}".cfg ${lib.escapeShellArg nodedir}/tahoe.cfg ''; }); - users.extraUsers = flip mapAttrs' cfg.introducers (node: _: + users.users = flip mapAttrs' cfg.introducers (node: _: nameValuePair "tahoe.introducer-${node}" { description = "Tahoe node user for introducer ${node}"; isSystemUser = true; @@ -355,7 +355,7 @@ in cp /etc/tahoe-lafs/${lib.escapeShellArg node}.cfg ${lib.escapeShellArg nodedir}/tahoe.cfg ''; }); - users.extraUsers = flip mapAttrs' cfg.nodes (node: _: + users.users = flip mapAttrs' cfg.nodes (node: _: nameValuePair "tahoe.${node}" { description = "Tahoe node user for node ${node}"; isSystemUser = true; diff --git a/nixos/modules/services/network-filesystems/xtreemfs.nix b/nixos/modules/services/network-filesystems/xtreemfs.nix index 95d7641e8b53..c93e201da56c 100644 --- a/nixos/modules/services/network-filesystems/xtreemfs.nix +++ b/nixos/modules/services/network-filesystems/xtreemfs.nix @@ -432,14 +432,14 @@ in environment.systemPackages = [ xtreemfs ]; - users.extraUsers.xtreemfs = + users.users.xtreemfs = { uid = config.ids.uids.xtreemfs; description = "XtreemFS user"; createHome = true; home = home; }; - users.extraGroups.xtreemfs = + users.groups.xtreemfs = { gid = config.ids.gids.xtreemfs; }; diff --git a/nixos/modules/services/network-filesystems/yandex-disk.nix b/nixos/modules/services/network-filesystems/yandex-disk.nix index 44b0edf62018..e93f45b49867 100644 --- a/nixos/modules/services/network-filesystems/yandex-disk.nix +++ b/nixos/modules/services/network-filesystems/yandex-disk.nix @@ -73,7 +73,7 @@ in config = mkIf cfg.enable { - users.extraUsers = mkIf (cfg.user == null) [ { + users.users = mkIf (cfg.user == null) [ { name = u; uid = config.ids.uids.yandexdisk; group = "nogroup"; diff --git a/nixos/modules/services/networking/amuled.nix b/nixos/modules/services/networking/amuled.nix index 9898f164c5cf..57f02542eafd 100644 --- a/nixos/modules/services/networking/amuled.nix +++ b/nixos/modules/services/networking/amuled.nix @@ -45,14 +45,14 @@ in config = mkIf cfg.enable { - users.extraUsers = mkIf (cfg.user == null) [ + users.users = mkIf (cfg.user == null) [ { name = "amule"; description = "AMule daemon"; group = "amule"; uid = config.ids.uids.amule; } ]; - users.extraGroups = mkIf (cfg.user == null) [ + users.groups = mkIf (cfg.user == null) [ { name = "amule"; gid = config.ids.gids.amule; } ]; diff --git a/nixos/modules/services/networking/aria2.nix b/nixos/modules/services/networking/aria2.nix index df9c92db2e54..98eb00861016 100644 --- a/nixos/modules/services/networking/aria2.nix +++ b/nixos/modules/services/networking/aria2.nix @@ -92,7 +92,7 @@ in allowedTCPPorts = [ config.services.aria2.rpcListenPort ]; }; - users.extraUsers.aria2 = { + users.users.aria2 = { group = "aria2"; uid = config.ids.uids.aria2; description = "aria2 user"; @@ -100,7 +100,7 @@ in createHome = false; }; - users.extraGroups.aria2.gid = config.ids.gids.aria2; + users.groups.aria2.gid = config.ids.gids.aria2; systemd.services.aria2 = { description = "aria2 Service"; diff --git a/nixos/modules/services/networking/asterisk.nix b/nixos/modules/services/networking/asterisk.nix index 514204db33fa..b8ec2b25a227 100644 --- a/nixos/modules/services/networking/asterisk.nix +++ b/nixos/modules/services/networking/asterisk.nix @@ -211,7 +211,7 @@ in environment.etc.asterisk.source = asteriskEtc; - users.extraUsers.asterisk = + users.users.asterisk = { name = asteriskUser; group = asteriskGroup; uid = config.ids.uids.asterisk; @@ -219,7 +219,7 @@ in home = varlibdir; }; - users.extraGroups.asterisk = + users.groups.asterisk = { name = asteriskGroup; gid = config.ids.gids.asterisk; }; diff --git a/nixos/modules/services/networking/avahi-daemon.nix b/nixos/modules/services/networking/avahi-daemon.nix index 9ccdacb20e91..81e11db10409 100644 --- a/nixos/modules/services/networking/avahi-daemon.nix +++ b/nixos/modules/services/networking/avahi-daemon.nix @@ -187,14 +187,14 @@ in services.avahi.hostName = mkDefault config.networking.hostName; - users.extraUsers = singleton + users.users = singleton { name = "avahi"; uid = config.ids.uids.avahi; description = "`avahi-daemon' privilege separation user"; home = "/var/empty"; }; - users.extraGroups = singleton + users.groups = singleton { name = "avahi"; gid = config.ids.gids.avahi; }; diff --git a/nixos/modules/services/networking/bind.nix b/nixos/modules/services/networking/bind.nix index 7775a4bd87fe..abcd1ef6ff5d 100644 --- a/nixos/modules/services/networking/bind.nix +++ b/nixos/modules/services/networking/bind.nix @@ -170,7 +170,7 @@ in config = mkIf config.services.bind.enable { - users.extraUsers = singleton + users.users = singleton { name = bindUser; uid = config.ids.uids.bind; description = "BIND daemon user"; diff --git a/nixos/modules/services/networking/bird.nix b/nixos/modules/services/networking/bird.nix index c25bd0fdc541..9f08cc0a79ed 100644 --- a/nixos/modules/services/networking/bird.nix +++ b/nixos/modules/services/networking/bird.nix @@ -60,11 +60,11 @@ let }; }; users = { - extraUsers.${variant} = { + users.${variant} = { description = "BIRD Internet Routing Daemon user"; group = variant; }; - extraGroups.${variant} = {}; + groups.${variant} = {}; }; }; }; diff --git a/nixos/modules/services/networking/bitlbee.nix b/nixos/modules/services/networking/bitlbee.nix index bd26804788f3..392a8d5c2e7c 100644 --- a/nixos/modules/services/networking/bitlbee.nix +++ b/nixos/modules/services/networking/bitlbee.nix @@ -149,7 +149,7 @@ in config = mkIf config.services.bitlbee.enable { - users.extraUsers = singleton + users.users = singleton { name = "bitlbee"; uid = bitlbeeUid; description = "BitlBee user"; @@ -157,7 +157,7 @@ in createHome = true; }; - users.extraGroups = singleton + users.groups = singleton { name = "bitlbee"; gid = config.ids.gids.bitlbee; }; diff --git a/nixos/modules/services/networking/btsync.nix b/nixos/modules/services/networking/btsync.nix index 6e479a5860ac..33e85ef58e6e 100644 --- a/nixos/modules/services/networking/btsync.nix +++ b/nixos/modules/services/networking/btsync.nix @@ -284,7 +284,7 @@ in services.btsync.package = mkOptionDefault pkgs.bittorrentSync14; - users.extraUsers.btsync = { + users.users.btsync = { description = "Bittorrent Sync Service user"; home = cfg.storagePath; createHome = true; @@ -292,7 +292,7 @@ in group = "btsync"; }; - users.extraGroups = [ + users.groups = [ { name = "btsync"; }]; diff --git a/nixos/modules/services/networking/charybdis.nix b/nixos/modules/services/networking/charybdis.nix index c354ec61fe23..6d57faa9ac2b 100644 --- a/nixos/modules/services/networking/charybdis.nix +++ b/nixos/modules/services/networking/charybdis.nix @@ -71,14 +71,14 @@ in config = mkIf cfg.enable (lib.mkMerge [ { - users.extraUsers = singleton { + users.users = singleton { name = cfg.user; description = "Charybdis IRC daemon user"; uid = config.ids.uids.ircd; group = cfg.group; }; - users.extraGroups = singleton { + users.groups = singleton { name = cfg.group; gid = config.ids.gids.ircd; }; diff --git a/nixos/modules/services/networking/chrony.nix b/nixos/modules/services/networking/chrony.nix index c287ca01feb5..6a89002b42de 100644 --- a/nixos/modules/services/networking/chrony.nix +++ b/nixos/modules/services/networking/chrony.nix @@ -96,12 +96,12 @@ in # Make chronyc available in the system path environment.systemPackages = [ pkgs.chrony ]; - users.extraGroups = singleton + users.groups = singleton { name = "chrony"; gid = config.ids.gids.chrony; }; - users.extraUsers = singleton + users.users = singleton { name = "chrony"; uid = config.ids.uids.chrony; group = "chrony"; diff --git a/nixos/modules/services/networking/cntlm.nix b/nixos/modules/services/networking/cntlm.nix index 3978a1969ce9..4e4e3104c3a8 100644 --- a/nixos/modules/services/networking/cntlm.nix +++ b/nixos/modules/services/networking/cntlm.nix @@ -117,7 +117,7 @@ in }; }; - users.extraUsers.cntlm = { + users.users.cntlm = { name = "cntlm"; description = "cntlm system-wide daemon"; isSystemUser = true; diff --git a/nixos/modules/services/networking/consul.nix b/nixos/modules/services/networking/consul.nix index 6333970cb338..ab3f81037681 100644 --- a/nixos/modules/services/networking/consul.nix +++ b/nixos/modules/services/networking/consul.nix @@ -155,7 +155,7 @@ in config = mkIf cfg.enable ( mkMerge [{ - users.extraUsers."consul" = { + users.users."consul" = { description = "Consul agent daemon user"; uid = config.ids.uids.consul; # The shell is needed for health checks diff --git a/nixos/modules/services/networking/coturn.nix b/nixos/modules/services/networking/coturn.nix index b3c64490d97e..c430ce5af92a 100644 --- a/nixos/modules/services/networking/coturn.nix +++ b/nixos/modules/services/networking/coturn.nix @@ -294,12 +294,12 @@ in { }; config = mkIf cfg.enable { - users.extraUsers = [ + users.users = [ { name = "turnserver"; uid = config.ids.uids.turnserver; description = "coturn TURN server user"; } ]; - users.extraGroups = [ + users.groups = [ { name = "turnserver"; gid = config.ids.gids.turnserver; members = [ "turnserver" ]; diff --git a/nixos/modules/services/networking/dhcpd.nix b/nixos/modules/services/networking/dhcpd.nix index fd7e317eee95..0b2063bc4246 100644 --- a/nixos/modules/services/networking/dhcpd.nix +++ b/nixos/modules/services/networking/dhcpd.nix @@ -197,7 +197,7 @@ in config = mkIf (cfg4.enable || cfg6.enable) { users = { - extraUsers.dhcpd = { + users.dhcpd = { uid = config.ids.uids.dhcpd; description = "DHCP daemon user"; }; diff --git a/nixos/modules/services/networking/dnscache.nix b/nixos/modules/services/networking/dnscache.nix index ba5c8e2d5e53..fc30f50317fe 100644 --- a/nixos/modules/services/networking/dnscache.nix +++ b/nixos/modules/services/networking/dnscache.nix @@ -84,7 +84,7 @@ in { config = mkIf config.services.dnscache.enable { environment.systemPackages = [ pkgs.djbdns ]; - users.extraUsers.dnscache = {}; + users.users.dnscache = {}; systemd.services.dnscache = { description = "djbdns dnscache server"; diff --git a/nixos/modules/services/networking/dnschain.nix b/nixos/modules/services/networking/dnschain.nix index ee1cd3600039..0c2add424bac 100644 --- a/nixos/modules/services/networking/dnschain.nix +++ b/nixos/modules/services/networking/dnschain.nix @@ -141,7 +141,7 @@ in dns = "127.0.0.1:${toString cfg.dns.port}"; }; - users.extraUsers = singleton { + users.users = singleton { name = username; description = "DNSChain daemon user"; home = dataDir; diff --git a/nixos/modules/services/networking/dnsmasq.nix b/nixos/modules/services/networking/dnsmasq.nix index 91a3e54474ac..24d16046c63e 100644 --- a/nixos/modules/services/networking/dnsmasq.nix +++ b/nixos/modules/services/networking/dnsmasq.nix @@ -86,7 +86,7 @@ in services.dbus.packages = [ dnsmasq ]; - users.extraUsers = singleton { + users.users = singleton { name = "dnsmasq"; uid = config.ids.uids.dnsmasq; description = "Dnsmasq daemon user"; diff --git a/nixos/modules/services/networking/ejabberd.nix b/nixos/modules/services/networking/ejabberd.nix index 82ed7fc4a837..ef5e2cee6f20 100644 --- a/nixos/modules/services/networking/ejabberd.nix +++ b/nixos/modules/services/networking/ejabberd.nix @@ -94,7 +94,7 @@ in { config = mkIf cfg.enable { environment.systemPackages = [ cfg.package ]; - users.extraUsers = optionalAttrs (cfg.user == "ejabberd") (singleton + users.users = optionalAttrs (cfg.user == "ejabberd") (singleton { name = "ejabberd"; group = cfg.group; home = cfg.spoolDir; @@ -102,7 +102,7 @@ in { uid = config.ids.uids.ejabberd; }); - users.extraGroups = optionalAttrs (cfg.group == "ejabberd") (singleton + users.groups = optionalAttrs (cfg.group == "ejabberd") (singleton { name = "ejabberd"; gid = config.ids.gids.ejabberd; }); diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index c4bd0e7f9eef..36f1dd8d2479 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -148,38 +148,42 @@ let ip46tables -A nixos-fw -m conntrack --ctstate ESTABLISHED,RELATED -j nixos-fw-accept # Accept connections to the allowed TCP ports. - ${concatMapStrings (port: + ${concatStrings (mapAttrsToList (iface: cfg: + concatMapStrings (port: '' - ip46tables -A nixos-fw -p tcp --dport ${toString port} -j nixos-fw-accept + ip46tables -A nixos-fw -p tcp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} '' ) cfg.allowedTCPPorts - } + ) cfg.interfaces)} # Accept connections to the allowed TCP port ranges. - ${concatMapStrings (rangeAttr: + ${concatStrings (mapAttrsToList (iface: cfg: + concatMapStrings (rangeAttr: let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in '' - ip46tables -A nixos-fw -p tcp --dport ${range} -j nixos-fw-accept + ip46tables -A nixos-fw -p tcp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} '' ) cfg.allowedTCPPortRanges - } + ) cfg.interfaces)} # Accept packets on the allowed UDP ports. - ${concatMapStrings (port: + ${concatStrings (mapAttrsToList (iface: cfg: + concatMapStrings (port: '' - ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept + ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} '' ) cfg.allowedUDPPorts - } + ) cfg.interfaces)} # Accept packets on the allowed UDP port ranges. - ${concatMapStrings (rangeAttr: + ${concatStrings (mapAttrsToList (iface: cfg: + concatMapStrings (rangeAttr: let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in '' - ip46tables -A nixos-fw -p udp --dport ${range} -j nixos-fw-accept + ip46tables -A nixos-fw -p udp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} '' ) cfg.allowedUDPPortRanges - } + ) cfg.interfaces)} # Accept IPv4 multicast. Not a big security risk since # probably nobody is listening anyway. @@ -254,106 +258,30 @@ let fi ''; -in - -{ - - ###### interface - - options = { - - networking.firewall.enable = mkOption { - type = types.bool; - default = true; - description = - '' - Whether to enable the firewall. This is a simple stateful - firewall that blocks connection attempts to unauthorised TCP - or UDP ports on this machine. It does not affect packet - forwarding. - ''; - }; - - networking.firewall.logRefusedConnections = mkOption { - type = types.bool; - default = true; - description = - '' - Whether to log rejected or dropped incoming connections. - ''; - }; - - networking.firewall.logRefusedPackets = mkOption { - type = types.bool; - default = false; - description = - '' - Whether to log all rejected or dropped incoming packets. - This tends to give a lot of log messages, so it's mostly - useful for debugging. - ''; - }; - - networking.firewall.logRefusedUnicastsOnly = mkOption { - type = types.bool; - default = true; - description = - '' - If <option>networking.firewall.logRefusedPackets</option> - and this option are enabled, then only log packets - specifically directed at this machine, i.e., not broadcasts - or multicasts. - ''; - }; - - networking.firewall.rejectPackets = mkOption { - type = types.bool; - default = false; - description = - '' - If set, refused packets are rejected rather than dropped - (ignored). This means that an ICMP "port unreachable" error - message is sent back to the client (or a TCP RST packet in - case of an existing connection). Rejecting packets makes - port scanning somewhat easier. - ''; - }; - - networking.firewall.trustedInterfaces = mkOption { - type = types.listOf types.str; - default = [ ]; - example = [ "enp0s2" ]; - description = - '' - Traffic coming in from these interfaces will be accepted - unconditionally. Traffic from the loopback (lo) interface - will always be accepted. - ''; - }; - - networking.firewall.allowedTCPPorts = mkOption { + commonOptions = { + allowedTCPPorts = mkOption { type = types.listOf types.int; default = [ ]; example = [ 22 80 ]; description = - '' + '' List of TCP ports on which incoming connections are accepted. ''; }; - networking.firewall.allowedTCPPortRanges = mkOption { + allowedTCPPortRanges = mkOption { type = types.listOf (types.attrsOf types.int); default = [ ]; example = [ { from = 8999; to = 9003; } ]; description = - '' + '' A range of TCP ports on which incoming connections are accepted. ''; }; - networking.firewall.allowedUDPPorts = mkOption { + allowedUDPPorts = mkOption { type = types.listOf types.int; default = [ ]; example = [ 53 ]; @@ -363,7 +291,7 @@ in ''; }; - networking.firewall.allowedUDPPortRanges = mkOption { + allowedUDPPortRanges = mkOption { type = types.listOf (types.attrsOf types.int); default = [ ]; example = [ { from = 60000; to = 61000; } ]; @@ -372,133 +300,226 @@ in Range of open UDP ports. ''; }; + }; - networking.firewall.allowPing = mkOption { - type = types.bool; - default = true; - description = - '' - Whether to respond to incoming ICMPv4 echo requests - ("pings"). ICMPv6 pings are always allowed because the - larger address space of IPv6 makes network scanning much - less effective. - ''; - }; +in - networking.firewall.pingLimit = mkOption { - type = types.nullOr (types.separatedString " "); - default = null; - example = "--limit 1/minute --limit-burst 5"; - description = - '' - If pings are allowed, this allows setting rate limits - on them. If non-null, this option should be in the form of - flags like "--limit 1/minute --limit-burst 5" - ''; - }; +{ - networking.firewall.checkReversePath = mkOption { - type = types.either types.bool (types.enum ["strict" "loose"]); - default = kernelHasRPFilter; - example = "loose"; - description = - '' - Performs a reverse path filter test on a packet. If a reply - to the packet would not be sent via the same interface that - the packet arrived on, it is refused. + ###### interface - If using asymmetric routing or other complicated routing, set - this option to loose mode or disable it and setup your own - counter-measures. + options = { - This option can be either true (or "strict"), "loose" (only - drop the packet if the source address is not reachable via any - interface) or false. Defaults to the value of - kernelHasRPFilter. + networking.firewall = { + enable = mkOption { + type = types.bool; + default = true; + description = + '' + Whether to enable the firewall. This is a simple stateful + firewall that blocks connection attempts to unauthorised TCP + or UDP ports on this machine. It does not affect packet + forwarding. + ''; + }; - (needs kernel 3.3+) - ''; - }; + logRefusedConnections = mkOption { + type = types.bool; + default = true; + description = + '' + Whether to log rejected or dropped incoming connections. + ''; + }; - networking.firewall.logReversePathDrops = mkOption { - type = types.bool; - default = false; - description = - '' - Logs dropped packets failing the reverse path filter test if - the option networking.firewall.checkReversePath is enabled. - ''; - }; + logRefusedPackets = mkOption { + type = types.bool; + default = false; + description = + '' + Whether to log all rejected or dropped incoming packets. + This tends to give a lot of log messages, so it's mostly + useful for debugging. + ''; + }; - networking.firewall.connectionTrackingModules = mkOption { - type = types.listOf types.str; - default = [ ]; - example = [ "ftp" "irc" "sane" "sip" "tftp" "amanda" "h323" "netbios_sn" "pptp" "snmp" ]; - description = - '' - List of connection-tracking helpers that are auto-loaded. - The complete list of possible values is given in the example. - - As helpers can pose as a security risk, it is advised to - set this to an empty list and disable the setting - networking.firewall.autoLoadConntrackHelpers unless you - know what you are doing. Connection tracking is disabled - by default. - - Loading of helpers is recommended to be done through the - CT target. More info: - https://home.regit.org/netfilter-en/secure-use-of-helpers/ - ''; - }; + logRefusedUnicastsOnly = mkOption { + type = types.bool; + default = true; + description = + '' + If <option>networking.firewall.logRefusedPackets</option> + and this option are enabled, then only log packets + specifically directed at this machine, i.e., not broadcasts + or multicasts. + ''; + }; - networking.firewall.autoLoadConntrackHelpers = mkOption { - type = types.bool; - default = false; - description = - '' - Whether to auto-load connection-tracking helpers. - See the description at networking.firewall.connectionTrackingModules + rejectPackets = mkOption { + type = types.bool; + default = false; + description = + '' + If set, refused packets are rejected rather than dropped + (ignored). This means that an ICMP "port unreachable" error + message is sent back to the client (or a TCP RST packet in + case of an existing connection). Rejecting packets makes + port scanning somewhat easier. + ''; + }; - (needs kernel 3.5+) - ''; - }; + trustedInterfaces = mkOption { + type = types.listOf types.str; + default = [ ]; + example = [ "enp0s2" ]; + description = + '' + Traffic coming in from these interfaces will be accepted + unconditionally. Traffic from the loopback (lo) interface + will always be accepted. + ''; + }; - networking.firewall.extraCommands = mkOption { - type = types.lines; - default = ""; - example = "iptables -A INPUT -p icmp -j ACCEPT"; - description = - '' - Additional shell commands executed as part of the firewall - initialisation script. These are executed just before the - final "reject" firewall rule is added, so they can be used - to allow packets that would otherwise be refused. - ''; - }; + allowPing = mkOption { + type = types.bool; + default = true; + description = + '' + Whether to respond to incoming ICMPv4 echo requests + ("pings"). ICMPv6 pings are always allowed because the + larger address space of IPv6 makes network scanning much + less effective. + ''; + }; - networking.firewall.extraPackages = mkOption { - type = types.listOf types.package; - default = [ ]; - example = literalExample "[ pkgs.ipset ]"; - description = - '' - Additional packages to be included in the environment of the system - as well as the path of networking.firewall.extraCommands. - ''; - }; + pingLimit = mkOption { + type = types.nullOr (types.separatedString " "); + default = null; + example = "--limit 1/minute --limit-burst 5"; + description = + '' + If pings are allowed, this allows setting rate limits + on them. If non-null, this option should be in the form of + flags like "--limit 1/minute --limit-burst 5" + ''; + }; - networking.firewall.extraStopCommands = mkOption { - type = types.lines; - default = ""; - example = "iptables -P INPUT ACCEPT"; - description = - '' - Additional shell commands executed as part of the firewall - shutdown script. These are executed just after the removal - of the NixOS input rule, or if the service enters a failed - state. - ''; - }; + checkReversePath = mkOption { + type = types.either types.bool (types.enum ["strict" "loose"]); + default = kernelHasRPFilter; + example = "loose"; + description = + '' + Performs a reverse path filter test on a packet. If a reply + to the packet would not be sent via the same interface that + the packet arrived on, it is refused. + + If using asymmetric routing or other complicated routing, set + this option to loose mode or disable it and setup your own + counter-measures. + + This option can be either true (or "strict"), "loose" (only + drop the packet if the source address is not reachable via any + interface) or false. Defaults to the value of + kernelHasRPFilter. + + (needs kernel 3.3+) + ''; + }; + + logReversePathDrops = mkOption { + type = types.bool; + default = false; + description = + '' + Logs dropped packets failing the reverse path filter test if + the option networking.firewall.checkReversePath is enabled. + ''; + }; + + connectionTrackingModules = mkOption { + type = types.listOf types.str; + default = [ ]; + example = [ "ftp" "irc" "sane" "sip" "tftp" "amanda" "h323" "netbios_sn" "pptp" "snmp" ]; + description = + '' + List of connection-tracking helpers that are auto-loaded. + The complete list of possible values is given in the example. + + As helpers can pose as a security risk, it is advised to + set this to an empty list and disable the setting + networking.firewall.autoLoadConntrackHelpers unless you + know what you are doing. Connection tracking is disabled + by default. + + Loading of helpers is recommended to be done through the + CT target. More info: + https://home.regit.org/netfilter-en/secure-use-of-helpers/ + ''; + }; + + autoLoadConntrackHelpers = mkOption { + type = types.bool; + default = false; + description = + '' + Whether to auto-load connection-tracking helpers. + See the description at networking.firewall.connectionTrackingModules + + (needs kernel 3.5+) + ''; + }; + + extraCommands = mkOption { + type = types.lines; + default = ""; + example = "iptables -A INPUT -p icmp -j ACCEPT"; + description = + '' + Additional shell commands executed as part of the firewall + initialisation script. These are executed just before the + final "reject" firewall rule is added, so they can be used + to allow packets that would otherwise be refused. + ''; + }; + + extraPackages = mkOption { + type = types.listOf types.package; + default = [ ]; + example = literalExample "[ pkgs.ipset ]"; + description = + '' + Additional packages to be included in the environment of the system + as well as the path of networking.firewall.extraCommands. + ''; + }; + + extraStopCommands = mkOption { + type = types.lines; + default = ""; + example = "iptables -P INPUT ACCEPT"; + description = + '' + Additional shell commands executed as part of the firewall + shutdown script. These are executed just after the removal + of the NixOS input rule, or if the service enters a failed + state. + ''; + }; + + interfaces = mkOption { + default = { + default = mapAttrs (name: value: cfg."${name}") commonOptions; + }; + type = with types; attrsOf (submodule [ { options = commonOptions; } ]); + description = + '' + Interface-specific open ports. Setting this value will override + all values of the <literal>networking.firewall.allowed*</literal> + options. + ''; + }; + } // commonOptions; }; diff --git a/nixos/modules/services/networking/freenet.nix b/nixos/modules/services/networking/freenet.nix index 3903a2c708cb..3da3ab0c7df4 100644 --- a/nixos/modules/services/networking/freenet.nix +++ b/nixos/modules/services/networking/freenet.nix @@ -50,7 +50,7 @@ in serviceConfig.Nice = cfg.nice; }; - users.extraUsers.freenet = { + users.users.freenet = { group = "freenet"; description = "Freenet daemon user"; home = varDir; @@ -58,7 +58,7 @@ in uid = config.ids.uids.freenet; }; - users.extraGroups.freenet.gid = config.ids.gids.freenet; + users.groups.freenet.gid = config.ids.gids.freenet; }; } diff --git a/nixos/modules/services/networking/freeradius.nix b/nixos/modules/services/networking/freeradius.nix index 45cba1ce2770..e192b70c129c 100644 --- a/nixos/modules/services/networking/freeradius.nix +++ b/nixos/modules/services/networking/freeradius.nix @@ -59,7 +59,7 @@ in config = mkIf (cfg.enable) { users = { - extraUsers.radius = { + users.radius = { /*uid = config.ids.uids.radius;*/ description = "Radius daemon user"; }; diff --git a/nixos/modules/services/networking/gale.nix b/nixos/modules/services/networking/gale.nix index fd83f9e3c1b7..7083d87c4073 100644 --- a/nixos/modules/services/networking/gale.nix +++ b/nixos/modules/services/networking/gale.nix @@ -104,7 +104,7 @@ in systemPackages = [ pkgs.gale ]; }; - users.extraUsers = [{ + users.users = [{ name = cfg.user; description = "Gale daemon"; uid = config.ids.uids.gale; @@ -113,7 +113,7 @@ in createHome = true; }]; - users.extraGroups = [{ + users.groups = [{ name = cfg.group; gid = config.ids.gids.gale; }]; diff --git a/nixos/modules/services/networking/gateone.nix b/nixos/modules/services/networking/gateone.nix index 78ff0b76198c..4456a95402ed 100644 --- a/nixos/modules/services/networking/gateone.nix +++ b/nixos/modules/services/networking/gateone.nix @@ -23,12 +23,12 @@ config = mkIf cfg.enable { environment.systemPackages = with pkgs.pythonPackages; [ gateone pkgs.openssh pkgs.procps pkgs.coreutils pkgs.cacert]; - users.extraUsers.gateone = { + users.users.gateone = { description = "GateOne privilege separation user"; uid = config.ids.uids.gateone; home = cfg.settingsDir; }; - users.extraGroups.gateone.gid = config.ids.gids.gateone; + users.groups.gateone.gid = config.ids.gids.gateone; systemd.services.gateone = with pkgs; { description = "GateOne web-based terminal"; diff --git a/nixos/modules/services/networking/git-daemon.nix b/nixos/modules/services/networking/git-daemon.nix index cd3fcd0f8f66..c0020349ec74 100644 --- a/nixos/modules/services/networking/git-daemon.nix +++ b/nixos/modules/services/networking/git-daemon.nix @@ -104,13 +104,13 @@ in config = mkIf cfg.enable { - users.extraUsers = if cfg.user != "git" then {} else singleton + users.users = if cfg.user != "git" then {} else singleton { name = "git"; uid = config.ids.uids.git; description = "Git daemon user"; }; - users.extraGroups = if cfg.group != "git" then {} else singleton + users.groups = if cfg.group != "git" then {} else singleton { name = "git"; gid = config.ids.gids.git; }; diff --git a/nixos/modules/services/networking/gnunet.nix b/nixos/modules/services/networking/gnunet.nix index 008b09e81a57..6a1db81413c5 100644 --- a/nixos/modules/services/networking/gnunet.nix +++ b/nixos/modules/services/networking/gnunet.nix @@ -126,7 +126,7 @@ in config = mkIf config.services.gnunet.enable { - users.extraUsers.gnunet = { + users.users.gnunet = { group = "gnunet"; description = "GNUnet User"; home = homeDir; @@ -134,7 +134,7 @@ in uid = config.ids.uids.gnunet; }; - users.extraGroups.gnunet.gid = config.ids.gids.gnunet; + users.groups.gnunet.gid = config.ids.gids.gnunet; # The user tools that talk to `gnunetd' should come from the same source, # so install them globally. diff --git a/nixos/modules/services/networking/hans.nix b/nixos/modules/services/networking/hans.nix index dd34ef8d4ca1..20e57e4626ef 100644 --- a/nixos/modules/services/networking/hans.nix +++ b/nixos/modules/services/networking/hans.nix @@ -135,7 +135,7 @@ in }; }; - users.extraUsers = singleton { + users.users = singleton { name = hansUser; description = "Hans daemon user"; }; diff --git a/nixos/modules/services/networking/haproxy.nix b/nixos/modules/services/networking/haproxy.nix index 09e48ec4bff0..0438d0bf8d86 100644 --- a/nixos/modules/services/networking/haproxy.nix +++ b/nixos/modules/services/networking/haproxy.nix @@ -52,11 +52,11 @@ with lib; environment.systemPackages = [ pkgs.haproxy ]; - users.extraUsers.haproxy = { + users.users.haproxy = { group = "haproxy"; uid = config.ids.uids.haproxy; }; - users.extraGroups.haproxy.gid = config.ids.uids.haproxy; + users.groups.haproxy.gid = config.ids.uids.haproxy; }; } diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix index 63f56437d1c8..3af0441a89d8 100644 --- a/nixos/modules/services/networking/hostapd.nix +++ b/nixos/modules/services/networking/hostapd.nix @@ -29,7 +29,7 @@ let ctrl_interface_group=${cfg.group} ${if cfg.wpa then '' - wpa=1 + wpa=2 wpa_passphrase=${cfg.wpaPassphrase} '' else ""} diff --git a/nixos/modules/services/networking/i2p.nix b/nixos/modules/services/networking/i2p.nix index e6ee5fd1f957..3b6010531f13 100644 --- a/nixos/modules/services/networking/i2p.nix +++ b/nixos/modules/services/networking/i2p.nix @@ -11,14 +11,14 @@ in { ###### implementation config = mkIf cfg.enable { - users.extraUsers.i2p = { + users.users.i2p = { group = "i2p"; description = "i2p User"; home = homeDir; createHome = true; uid = config.ids.uids.i2p; }; - users.extraGroups.i2p.gid = config.ids.gids.i2p; + users.groups.i2p.gid = config.ids.gids.i2p; systemd.services.i2p = { description = "I2P router with administration interface for hidden services"; after = [ "network.target" ]; diff --git a/nixos/modules/services/networking/i2pd.nix b/nixos/modules/services/networking/i2pd.nix index 8f5aeee4a16b..8875309143fd 100644 --- a/nixos/modules/services/networking/i2pd.nix +++ b/nixos/modules/services/networking/i2pd.nix @@ -456,7 +456,7 @@ in config = mkIf cfg.enable { - users.extraUsers.i2pd = { + users.users.i2pd = { group = "i2pd"; description = "I2Pd User"; home = homeDir; @@ -464,7 +464,7 @@ in uid = config.ids.uids.i2pd; }; - users.extraGroups.i2pd.gid = config.ids.gids.i2pd; + users.groups.i2pd.gid = config.ids.gids.i2pd; systemd.services.i2pd = { description = "Minimal I2P router"; diff --git a/nixos/modules/services/networking/iodine.nix b/nixos/modules/services/networking/iodine.nix index 3f41421d27f7..58ad0df4ff20 100644 --- a/nixos/modules/services/networking/iodine.nix +++ b/nixos/modules/services/networking/iodine.nix @@ -140,11 +140,11 @@ in }; }; - users.extraUsers = singleton { + users.users = singleton { name = iodinedUser; uid = config.ids.uids.iodined; description = "Iodine daemon user"; }; - users.extraGroups.iodined.gid = config.ids.gids.iodined; + users.groups.iodined.gid = config.ids.gids.iodined; }; } diff --git a/nixos/modules/services/networking/ircd-hybrid/default.nix b/nixos/modules/services/networking/ircd-hybrid/default.nix index bd583fb020ec..2bd898edf897 100644 --- a/nixos/modules/services/networking/ircd-hybrid/default.nix +++ b/nixos/modules/services/networking/ircd-hybrid/default.nix @@ -112,14 +112,14 @@ in config = mkIf config.services.ircdHybrid.enable { - users.extraUsers = singleton + users.users = singleton { name = "ircd"; description = "IRCD owner"; group = "ircd"; uid = config.ids.uids.ircd; }; - users.extraGroups.ircd.gid = config.ids.gids.ircd; + users.groups.ircd.gid = config.ids.gids.ircd; systemd.services."ircd-hybrid" = { description = "IRCD Hybrid server"; diff --git a/nixos/modules/services/networking/iwd.nix b/nixos/modules/services/networking/iwd.nix index 344212ad8329..cfc536fc5b5f 100644 --- a/nixos/modules/services/networking/iwd.nix +++ b/nixos/modules/services/networking/iwd.nix @@ -28,6 +28,10 @@ in { serviceConfig.ExecStart = "${pkgs.iwd}/libexec/iwd"; }; + + systemd.tmpfiles.rules = [ + "d /var/lib/iwd 0700 root root -" + ]; }; meta.maintainers = with lib.maintainers; [ mic92 ]; diff --git a/nixos/modules/services/networking/kippo.nix b/nixos/modules/services/networking/kippo.nix index 834de4fdc09f..40c38254a57c 100644 --- a/nixos/modules/services/networking/kippo.nix +++ b/nixos/modules/services/networking/kippo.nix @@ -73,12 +73,12 @@ rec { ${cfg.extraConfig} ''; - users.extraUsers = singleton { + users.users = singleton { name = "kippo"; description = "kippo web server privilege separation user"; uid = 108; # why does config.ids.uids.kippo give an error? }; - users.extraGroups = singleton { name = "kippo";gid=108; }; + users.groups = singleton { name = "kippo";gid=108; }; systemd.services.kippo = with pkgs; { description = "Kippo Web Server"; diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix index aac02b811d71..ca34ff9df4ef 100644 --- a/nixos/modules/services/networking/kresd.nix +++ b/nixos/modules/services/networking/kresd.nix @@ -62,13 +62,13 @@ in config = mkIf cfg.enable { environment.etc."kresd.conf".source = configFile; # not required - users.extraUsers = singleton + users.users = singleton { name = "kresd"; uid = config.ids.uids.kresd; group = "kresd"; description = "Knot-resolver daemon user"; }; - users.extraGroups = singleton + users.groups = singleton { name = "kresd"; gid = config.ids.gids.kresd; }; diff --git a/nixos/modules/services/networking/lambdabot.nix b/nixos/modules/services/networking/lambdabot.nix index 5a61a9f96782..b7c8bd008fe1 100644 --- a/nixos/modules/services/networking/lambdabot.nix +++ b/nixos/modules/services/networking/lambdabot.nix @@ -67,7 +67,7 @@ in }; }; - users.extraUsers.lambdabot = { + users.users.lambdabot = { group = "lambdabot"; description = "Lambdabot daemon user"; home = "/var/lib/lambdabot"; @@ -75,7 +75,7 @@ in uid = config.ids.uids.lambdabot; }; - users.extraGroups.lambdabot.gid = config.ids.gids.lambdabot; + users.groups.lambdabot.gid = config.ids.gids.lambdabot; }; diff --git a/nixos/modules/services/networking/lldpd.nix b/nixos/modules/services/networking/lldpd.nix index db1534edfd7c..dec30cc92f6a 100644 --- a/nixos/modules/services/networking/lldpd.nix +++ b/nixos/modules/services/networking/lldpd.nix @@ -20,13 +20,13 @@ in }; config = mkIf cfg.enable { - users.extraUsers._lldpd = { + users.users._lldpd = { description = "lldpd user"; group = "_lldpd"; home = "/var/run/lldpd"; isSystemUser = true; }; - users.extraGroups._lldpd = {}; + users.groups._lldpd = {}; environment.systemPackages = [ pkgs.lldpd ]; systemd.packages = [ pkgs.lldpd ]; diff --git a/nixos/modules/services/networking/mailpile.nix b/nixos/modules/services/networking/mailpile.nix index e164d41483c7..c42d3d5a44cb 100644 --- a/nixos/modules/services/networking/mailpile.nix +++ b/nixos/modules/services/networking/mailpile.nix @@ -41,14 +41,14 @@ in config = mkIf config.services.mailpile.enable { - users.extraUsers.mailpile = + users.users.mailpile = { uid = config.ids.uids.mailpile; description = "Mailpile user"; createHome = true; home = "/var/lib/mailpile"; }; - users.extraGroups.mailpile = + users.groups.mailpile = { gid = config.ids.gids.mailpile; }; diff --git a/nixos/modules/services/networking/matterbridge.nix b/nixos/modules/services/networking/matterbridge.nix index e2f478405953..1fd63348c16c 100644 --- a/nixos/modules/services/networking/matterbridge.nix +++ b/nixos/modules/services/networking/matterbridge.nix @@ -92,12 +92,12 @@ in warnings = optional options.services.matterbridge.configFile.isDefined "The option services.matterbridge.configFile is insecure and should be replaced with services.matterbridge.configPath"; - users.extraUsers = optional (cfg.user == "matterbridge") + users.users = optional (cfg.user == "matterbridge") { name = "matterbridge"; group = "matterbridge"; }; - users.extraGroups = optional (cfg.group == "matterbridge") + users.groups = optional (cfg.group == "matterbridge") { name = "matterbridge"; }; diff --git a/nixos/modules/services/networking/minidlna.nix b/nixos/modules/services/networking/minidlna.nix index 6401631bf620..1858f03cac1f 100644 --- a/nixos/modules/services/networking/minidlna.nix +++ b/nixos/modules/services/networking/minidlna.nix @@ -84,13 +84,13 @@ in '') cfg.mediaDirs} ''; - users.extraUsers.minidlna = { + users.users.minidlna = { description = "MiniDLNA daemon user"; group = "minidlna"; uid = config.ids.uids.minidlna; }; - users.extraGroups.minidlna.gid = config.ids.gids.minidlna; + users.groups.minidlna.gid = config.ids.gids.minidlna; systemd.services.minidlna = { description = "MiniDLNA Server"; diff --git a/nixos/modules/services/networking/mjpg-streamer.nix b/nixos/modules/services/networking/mjpg-streamer.nix index 1286b0c7ef6c..e0a6c112e3cb 100644 --- a/nixos/modules/services/networking/mjpg-streamer.nix +++ b/nixos/modules/services/networking/mjpg-streamer.nix @@ -49,7 +49,7 @@ in { config = mkIf cfg.enable { - users.extraUsers = optional (cfg.user == "mjpg-streamer") { + users.users = optional (cfg.user == "mjpg-streamer") { name = "mjpg-streamer"; uid = config.ids.uids.mjpg-streamer; group = cfg.group; diff --git a/nixos/modules/services/networking/monero.nix b/nixos/modules/services/networking/monero.nix index 31379189f5de..8241c32bad07 100644 --- a/nixos/modules/services/networking/monero.nix +++ b/nixos/modules/services/networking/monero.nix @@ -197,7 +197,7 @@ in config = mkIf cfg.enable { - users.extraUsers = singleton { + users.users = singleton { name = "monero"; uid = config.ids.uids.monero; description = "Monero daemon user"; @@ -205,7 +205,7 @@ in createHome = true; }; - users.extraGroups = singleton { + users.groups = singleton { name = "monero"; gid = config.ids.gids.monero; }; diff --git a/nixos/modules/services/networking/morty.nix b/nixos/modules/services/networking/morty.nix index b31bec9a8627..f24562f11817 100644 --- a/nixos/modules/services/networking/morty.nix +++ b/nixos/modules/services/networking/morty.nix @@ -72,7 +72,7 @@ in config = mkIf config.services.morty.enable { - users.extraUsers.morty = + users.users.morty = { description = "Morty user"; createHome = true; home = "/var/lib/morty"; diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix index d8135f4d0ffa..332dc541345e 100644 --- a/nixos/modules/services/networking/mosquitto.nix +++ b/nixos/modules/services/networking/mosquitto.nix @@ -218,7 +218,7 @@ in ) cfg.users); }; - users.extraUsers.mosquitto = { + users.users.mosquitto = { description = "Mosquitto MQTT Broker Daemon owner"; group = "mosquitto"; uid = config.ids.uids.mosquitto; @@ -226,7 +226,7 @@ in createHome = true; }; - users.extraGroups.mosquitto.gid = config.ids.gids.mosquitto; + users.groups.mosquitto.gid = config.ids.gids.mosquitto; }; } diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix index 873d62dbf341..fcc813e6898f 100644 --- a/nixos/modules/services/networking/murmur.nix +++ b/nixos/modules/services/networking/murmur.nix @@ -238,7 +238,7 @@ in }; config = mkIf cfg.enable { - users.extraUsers.murmur = { + users.users.murmur = { description = "Murmur Service user"; home = "/var/lib/murmur"; createHome = true; @@ -248,7 +248,7 @@ in systemd.services.murmur = { description = "Murmur Chat Service"; wantedBy = [ "multi-user.target" ]; - after = [ "network.target "]; + after = [ "network-online.target "]; serviceConfig = { Type = "forking"; diff --git a/nixos/modules/services/networking/namecoind.nix b/nixos/modules/services/networking/namecoind.nix index 11f7d7e5caef..8de23b442f93 100644 --- a/nixos/modules/services/networking/namecoind.nix +++ b/nixos/modules/services/networking/namecoind.nix @@ -153,7 +153,7 @@ in config = ${configFile} ''; - users.extraUsers = singleton { + users.users = singleton { name = "namecoin"; uid = config.ids.uids.namecoin; description = "Namecoin daemon user"; @@ -161,7 +161,7 @@ in createHome = true; }; - users.extraGroups = singleton { + users.groups = singleton { name = "namecoin"; gid = config.ids.gids.namecoin; }; diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix index 816234506593..cdc3a3525904 100644 --- a/nixos/modules/services/networking/networkmanager.nix +++ b/nixos/modules/services/networking/networkmanager.nix @@ -9,18 +9,11 @@ let # /var/lib/misc is for dnsmasq.leases. stateDirs = "/var/lib/NetworkManager /var/lib/dhclient /var/lib/misc"; - dns = - if cfg.dns == "none" then "none" - else if cfg.dns == "dnsmasq" then "dnsmasq" - else if config.services.resolved.enable then "systemd-resolved" - else if config.services.unbound.enable then "unbound" - else "default"; - configFile = writeText "NetworkManager.conf" '' [main] plugins=keyfile dhcp=${cfg.dhcp} - dns=${dns} + dns=${cfg.dns} [keyfile] ${optionalString (cfg.unmanaged != []) @@ -217,19 +210,73 @@ in { }; dns = mkOption { - type = types.enum [ "auto" "dnsmasq" "none" ]; - default = "auto"; + type = types.enum [ "default" "dnsmasq" "unbound" "systemd-resolved" "none" ]; + default = "default"; description = '' + Set the DNS (<literal>resolv.conf</literal>) processing mode. + </para> + <para> Options: - - auto: Check for systemd-resolved, unbound, or use default. - - dnsmasq: - Enable NetworkManager's dnsmasq integration. NetworkManager will run - dnsmasq as a local caching nameserver, using a "split DNS" - configuration if you are connected to a VPN, and then update - resolv.conf to point to the local nameserver. - - none: - Disable NetworkManager's DNS integration completely. - It will not touch your /etc/resolv.conf. + <variablelist> + <varlistentry> + <term><literal>"default"</literal></term> + <listitem><para> + NetworkManager will update <literal>/etc/resolv.conf</literal> to + reflect the nameservers provided by currently active connections. + </para></listitem> + </varlistentry> + <varlistentry> + <term><literal>"dnsmasq"</literal></term> + <listitem> + <para> + Enable NetworkManager's dnsmasq integration. NetworkManager will + run dnsmasq as a local caching nameserver, using a "split DNS" + configuration if you are connected to a VPN, and then update + <literal>resolv.conf</literal> to point to the local nameserver. + </para> + <para> + It is possible to pass custom options to the dnsmasq instance by + adding them to files in the + <literal>/etc/NetworkManager/dnsmasq.d/</literal> directory. + </para> + <para> + When multiple upstream servers are available, dnsmasq will + initially contact them in parallel and then use the fastest to + respond, probing again other servers after some time. This + behavior can be modified passing the + <literal>all-servers</literal> or <literal>strict-order</literal> + options to dnsmasq (see the manual page for more details). + </para> + <para> + Note that this option causes NetworkManager to launch and manage + its own instance of the dnsmasq daemon, which is + <emphasis>not</emphasis> the same as setting + <literal>services.dnsmasq.enable = true;</literal>. + </para> + </listitem> + </varlistentry> + <varlistentry> + <term><literal>"unbound"</literal></term> + <listitem><para> + NetworkManager will talk to unbound and dnssec-triggerd, + providing a "split DNS" configuration with DNSSEC support. + <literal>/etc/resolv.conf</literal> will be managed by + dnssec-trigger daemon. + </para></listitem> + </varlistentry> + <varlistentry> + <term><literal>"systemd-resolved"</literal></term> + <listitem><para> + NetworkManager will push the DNS configuration to systemd-resolved. + </para></listitem> + </varlistentry> + <varlistentry> + <term><literal>"none"</literal></term> + <listitem><para> + NetworkManager will not modify resolv.conf. + </para></listitem> + </varlistentry> + </variablelist> ''; }; @@ -319,7 +366,7 @@ in { environment.systemPackages = cfg.packages; - users.extraGroups = [{ + users.groups = [{ name = "networkmanager"; gid = config.ids.gids.networkmanager; } @@ -327,7 +374,7 @@ in { name = "nm-openvpn"; gid = config.ids.gids.nm-openvpn; }]; - users.extraUsers = [{ + users.users = [{ name = "nm-openvpn"; uid = config.ids.uids.nm-openvpn; extraGroups = [ "networkmanager" ]; diff --git a/nixos/modules/services/networking/ngircd.nix b/nixos/modules/services/networking/ngircd.nix index 6a5290ffdee2..4b2fa7795922 100644 --- a/nixos/modules/services/networking/ngircd.nix +++ b/nixos/modules/services/networking/ngircd.nix @@ -51,7 +51,7 @@ in { serviceConfig.User = "ngircd"; }; - users.extraUsers.ngircd = { + users.users.ngircd = { uid = config.ids.uids.ngircd; description = "ngircd user."; }; diff --git a/nixos/modules/services/networking/nix-serve.nix b/nixos/modules/services/networking/nix-serve.nix index 8499e7c0f7c4..e83cad949ae8 100644 --- a/nixos/modules/services/networking/nix-serve.nix +++ b/nixos/modules/services/networking/nix-serve.nix @@ -64,7 +64,7 @@ in }; }; - users.extraUsers.nix-serve = { + users.users.nix-serve = { description = "Nix-serve user"; uid = config.ids.uids.nix-serve; }; diff --git a/nixos/modules/services/networking/nntp-proxy.nix b/nixos/modules/services/networking/nntp-proxy.nix index 7eebecb23b00..d24d6f77a491 100644 --- a/nixos/modules/services/networking/nntp-proxy.nix +++ b/nixos/modules/services/networking/nntp-proxy.nix @@ -210,7 +210,7 @@ in config = mkIf cfg.enable { - users.extraUsers = singleton + users.users = singleton { name = proxyUser; uid = config.ids.uids.nntp-proxy; description = "NNTP-Proxy daemon user"; diff --git a/nixos/modules/services/networking/nsd.nix b/nixos/modules/services/networking/nsd.nix index fc910e59c323..cde47bf23eae 100644 --- a/nixos/modules/services/networking/nsd.nix +++ b/nixos/modules/services/networking/nsd.nix @@ -897,12 +897,12 @@ in environment.systemPackages = [ nsdPkg ]; - users.extraGroups = singleton { + users.groups = singleton { name = username; gid = config.ids.gids.nsd; }; - users.extraUsers = singleton { + users.users = singleton { name = username; description = "NSD service user"; home = stateDir; diff --git a/nixos/modules/services/networking/ntpd.nix b/nixos/modules/services/networking/ntpd.nix index 88e6dbf22b9e..342350d49ab3 100644 --- a/nixos/modules/services/networking/ntpd.nix +++ b/nixos/modules/services/networking/ntpd.nix @@ -67,7 +67,7 @@ in environment.systemPackages = [ pkgs.ntp ]; services.timesyncd.enable = mkForce false; - users.extraUsers = singleton + users.users = singleton { name = ntpUser; uid = config.ids.uids.ntp; description = "NTP daemon user"; diff --git a/nixos/modules/services/networking/nylon.nix b/nixos/modules/services/networking/nylon.nix index 4864ecf3f92f..b7b59d95bf02 100644 --- a/nixos/modules/services/networking/nylon.nix +++ b/nixos/modules/services/networking/nylon.nix @@ -151,7 +151,7 @@ in config = mkIf (length(enabledNylons) > 0) { - users.extraUsers.nylon = { + users.users.nylon = { group = "nylon"; description = "Nylon SOCKS Proxy"; home = homeDir; @@ -159,7 +159,7 @@ in uid = config.ids.uids.nylon; }; - users.extraGroups.nylon.gid = config.ids.gids.nylon; + users.groups.nylon.gid = config.ids.gids.nylon; systemd.services = fold (a: b: a // b) {} nylonUnits; diff --git a/nixos/modules/services/networking/oidentd.nix b/nixos/modules/services/networking/oidentd.nix index ba7acd879546..8cf34623ab5e 100644 --- a/nixos/modules/services/networking/oidentd.nix +++ b/nixos/modules/services/networking/oidentd.nix @@ -32,13 +32,13 @@ with lib; optionalString config.networking.enableIPv6 " -a ::"; }; - users.extraUsers.oidentd = { + users.users.oidentd = { description = "Ident Protocol daemon user"; group = "oidentd"; uid = config.ids.uids.oidentd; }; - users.extraGroups.oidentd.gid = config.ids.gids.oidentd; + users.groups.oidentd.gid = config.ids.gids.oidentd; }; diff --git a/nixos/modules/services/networking/openntpd.nix b/nixos/modules/services/networking/openntpd.nix index 241038ca12ed..57638ebc9c01 100644 --- a/nixos/modules/services/networking/openntpd.nix +++ b/nixos/modules/services/networking/openntpd.nix @@ -59,7 +59,7 @@ in environment.etc."ntpd.conf".text = configFile; - users.extraUsers = singleton { + users.users = singleton { name = "ntp"; uid = config.ids.uids.ntp; description = "OpenNTP daemon user"; diff --git a/nixos/modules/services/networking/owamp.nix b/nixos/modules/services/networking/owamp.nix index a0d3e70d8e57..821a0258f4be 100644 --- a/nixos/modules/services/networking/owamp.nix +++ b/nixos/modules/services/networking/owamp.nix @@ -17,13 +17,13 @@ in ###### implementation config = mkIf cfg.enable { - users.extraUsers = singleton { + users.users = singleton { name = "owamp"; group = "owamp"; description = "Owamp daemon"; }; - users.extraGroups = singleton { + users.groups = singleton { name = "owamp"; }; diff --git a/nixos/modules/services/networking/pdns-recursor.nix b/nixos/modules/services/networking/pdns-recursor.nix index 26be72d2a61e..d07deb9dcc67 100644 --- a/nixos/modules/services/networking/pdns-recursor.nix +++ b/nixos/modules/services/networking/pdns-recursor.nix @@ -128,7 +128,7 @@ in { config = mkIf cfg.enable { - users.extraUsers."${username}" = { + users.users."${username}" = { home = dataDir; createHome = true; uid = config.ids.uids.pdns-recursor; diff --git a/nixos/modules/services/networking/pdnsd.nix b/nixos/modules/services/networking/pdnsd.nix index f4467b818958..f5b174dd7b7b 100644 --- a/nixos/modules/services/networking/pdnsd.nix +++ b/nixos/modules/services/networking/pdnsd.nix @@ -62,14 +62,14 @@ in }; config = mkIf cfg.enable { - users.extraUsers = singleton { + users.users = singleton { name = pdnsdUser; uid = config.ids.uids.pdnsd; group = pdnsdGroup; description = "pdnsd user"; }; - users.extraGroups = singleton { + users.groups = singleton { name = pdnsdGroup; gid = config.ids.gids.pdnsd; }; diff --git a/nixos/modules/services/networking/polipo.nix b/nixos/modules/services/networking/polipo.nix index 847fc88ead4c..529115a1c6e1 100644 --- a/nixos/modules/services/networking/polipo.nix +++ b/nixos/modules/services/networking/polipo.nix @@ -85,7 +85,7 @@ in config = mkIf cfg.enable { - users.extraUsers = singleton + users.users = singleton { name = "polipo"; uid = config.ids.uids.polipo; description = "Polipo caching proxy user"; @@ -93,7 +93,7 @@ in createHome = true; }; - users.extraGroups = singleton + users.groups = singleton { name = "polipo"; gid = config.ids.gids.polipo; members = [ "polipo" ]; diff --git a/nixos/modules/services/networking/prayer.nix b/nixos/modules/services/networking/prayer.nix index 8cd4a0823534..f63f86496bee 100644 --- a/nixos/modules/services/networking/prayer.nix +++ b/nixos/modules/services/networking/prayer.nix @@ -72,14 +72,14 @@ in config = mkIf config.services.prayer.enable { environment.systemPackages = [ prayer ]; - users.extraUsers = singleton + users.users = singleton { name = prayerUser; uid = config.ids.uids.prayer; description = "Prayer daemon user"; home = stateDir; }; - users.extraGroups = singleton + users.groups = singleton { name = prayerGroup; gid = config.ids.gids.prayer; }; diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix index 1b4f81f6b56e..a37ef98caec6 100644 --- a/nixos/modules/services/networking/prosody.nix +++ b/nixos/modules/services/networking/prosody.nix @@ -487,7 +487,7 @@ in '') cfg.virtualHosts) } ''; - users.extraUsers.prosody = mkIf (cfg.user == "prosody") { + users.users.prosody = mkIf (cfg.user == "prosody") { uid = config.ids.uids.prosody; description = "Prosody user"; createHome = true; @@ -495,7 +495,7 @@ in home = "${cfg.dataDir}"; }; - users.extraGroups.prosody = mkIf (cfg.group == "prosody") { + users.groups.prosody = mkIf (cfg.group == "prosody") { gid = config.ids.gids.prosody; }; diff --git a/nixos/modules/services/networking/quassel.nix b/nixos/modules/services/networking/quassel.nix index bc7d6912b5ce..d850bb8b1305 100644 --- a/nixos/modules/services/networking/quassel.nix +++ b/nixos/modules/services/networking/quassel.nix @@ -72,14 +72,14 @@ in config = mkIf cfg.enable { - users.extraUsers = mkIf (cfg.user == null) [ + users.users = mkIf (cfg.user == null) [ { name = "quassel"; description = "Quassel IRC client daemon"; group = "quassel"; uid = config.ids.uids.quassel; }]; - users.extraGroups = mkIf (cfg.user == null) [ + users.groups = mkIf (cfg.user == null) [ { name = "quassel"; gid = config.ids.gids.quassel; }]; diff --git a/nixos/modules/services/networking/radicale.nix b/nixos/modules/services/networking/radicale.nix index 97ee05046ff0..2afab5ee3b3e 100644 --- a/nixos/modules/services/networking/radicale.nix +++ b/nixos/modules/services/networking/radicale.nix @@ -59,7 +59,7 @@ in config = mkIf cfg.enable { environment.systemPackages = [ cfg.package ]; - users.extraUsers = singleton + users.users = singleton { name = "radicale"; uid = config.ids.uids.radicale; description = "radicale user"; @@ -67,7 +67,7 @@ in createHome = true; }; - users.extraGroups = singleton + users.groups = singleton { name = "radicale"; gid = config.ids.gids.radicale; }; diff --git a/nixos/modules/services/networking/radvd.nix b/nixos/modules/services/networking/radvd.nix index 85d7f9e4a41b..020faa34922a 100644 --- a/nixos/modules/services/networking/radvd.nix +++ b/nixos/modules/services/networking/radvd.nix @@ -52,7 +52,7 @@ in config = mkIf cfg.enable { - users.extraUsers.radvd = + users.users.radvd = { uid = config.ids.uids.radvd; description = "Router Advertisement Daemon User"; }; diff --git a/nixos/modules/services/networking/rdnssd.nix b/nixos/modules/services/networking/rdnssd.nix index a102242eae71..887772f6e5f0 100644 --- a/nixos/modules/services/networking/rdnssd.nix +++ b/nixos/modules/services/networking/rdnssd.nix @@ -64,7 +64,7 @@ in }; }; - users.extraUsers.rdnssd = { + users.users.rdnssd = { description = "RDNSSD Daemon User"; uid = config.ids.uids.rdnssd; }; diff --git a/nixos/modules/services/networking/resilio.nix b/nixos/modules/services/networking/resilio.nix index 2956a5ecbc04..ee7f82ac7bee 100644 --- a/nixos/modules/services/networking/resilio.nix +++ b/nixos/modules/services/networking/resilio.nix @@ -236,7 +236,7 @@ in } ]; - users.extraUsers.rslsync = { + users.users.rslsync = { description = "Resilio Sync Service user"; home = cfg.storagePath; createHome = true; @@ -244,7 +244,7 @@ in group = "rslsync"; }; - users.extraGroups = [ { name = "rslsync"; } ]; + users.groups = [ { name = "rslsync"; } ]; systemd.services.resilio = with pkgs; { description = "Resilio Sync Service"; diff --git a/nixos/modules/services/networking/rpcbind.nix b/nixos/modules/services/networking/rpcbind.nix index cddcb09054e0..0a5df6987092 100644 --- a/nixos/modules/services/networking/rpcbind.nix +++ b/nixos/modules/services/networking/rpcbind.nix @@ -37,7 +37,7 @@ with lib; wantedBy = [ "multi-user.target" ]; }; - users.extraUsers.rpc = { + users.users.rpc = { group = "nogroup"; uid = config.ids.uids.rpc; }; diff --git a/nixos/modules/services/networking/sabnzbd.nix b/nixos/modules/services/networking/sabnzbd.nix index cacf753fdcd7..62b24d4377f8 100644 --- a/nixos/modules/services/networking/sabnzbd.nix +++ b/nixos/modules/services/networking/sabnzbd.nix @@ -41,7 +41,7 @@ in config = mkIf cfg.enable { - users.extraUsers.sabnzbd = { + users.users.sabnzbd = { uid = config.ids.uids.sabnzbd; group = "sabnzbd"; description = "sabnzbd user"; @@ -49,7 +49,7 @@ in createHome = true; }; - users.extraGroups.sabnzbd = { + users.groups.sabnzbd = { gid = config.ids.gids.sabnzbd; }; diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix index c7a128ae212d..9412d0ef8a62 100644 --- a/nixos/modules/services/networking/searx.nix +++ b/nixos/modules/services/networking/searx.nix @@ -47,14 +47,14 @@ in config = mkIf config.services.searx.enable { - users.extraUsers.searx = + users.users.searx = { uid = config.ids.uids.searx; description = "Searx user"; createHome = true; home = "/var/lib/searx"; }; - users.extraGroups.searx = + users.groups.searx = { gid = config.ids.gids.searx; }; diff --git a/nixos/modules/services/networking/seeks.nix b/nixos/modules/services/networking/seeks.nix index f5bc60be3457..40729225b6d0 100644 --- a/nixos/modules/services/networking/seeks.nix +++ b/nixos/modules/services/networking/seeks.nix @@ -46,14 +46,14 @@ in config = mkIf config.services.seeks.enable { - users.extraUsers.seeks = + users.users.seeks = { uid = config.ids.uids.seeks; description = "Seeks user"; createHome = true; home = "/var/lib/seeks"; }; - users.extraGroups.seeks = + users.groups.seeks = { gid = config.ids.gids.seeks; }; diff --git a/nixos/modules/services/networking/shairport-sync.nix b/nixos/modules/services/networking/shairport-sync.nix index 908de9efd6fb..0b87140b0d8d 100644 --- a/nixos/modules/services/networking/shairport-sync.nix +++ b/nixos/modules/services/networking/shairport-sync.nix @@ -55,7 +55,7 @@ in services.avahi.publish.enable = true; services.avahi.publish.userServices = true; - users.extraUsers = singleton + users.users = singleton { name = cfg.user; description = "Shairport user"; isSystemUser = true; diff --git a/nixos/modules/services/networking/shout.nix b/nixos/modules/services/networking/shout.nix index 3664c2857739..9784f1d160f3 100644 --- a/nixos/modules/services/networking/shout.nix +++ b/nixos/modules/services/networking/shout.nix @@ -82,7 +82,7 @@ in { }; config = mkIf cfg.enable { - users.extraUsers = singleton { + users.users = singleton { name = "shout"; uid = config.ids.uids.shout; description = "Shout daemon user"; diff --git a/nixos/modules/services/networking/smokeping.nix b/nixos/modules/services/networking/smokeping.nix index c5c131cb4c50..9ba6e48f417c 100644 --- a/nixos/modules/services/networking/smokeping.nix +++ b/nixos/modules/services/networking/smokeping.nix @@ -278,7 +278,7 @@ in "fping6".source = "${pkgs.fping}/bin/fping6"; }; environment.systemPackages = [ pkgs.fping ]; - users.extraUsers = singleton { + users.users = singleton { name = cfg.user; isNormalUser = false; isSystemUser = true; diff --git a/nixos/modules/services/networking/sniproxy.nix b/nixos/modules/services/networking/sniproxy.nix index 4d0f36923293..0345c12d3afe 100644 --- a/nixos/modules/services/networking/sniproxy.nix +++ b/nixos/modules/services/networking/sniproxy.nix @@ -82,14 +82,14 @@ in }; }; - users.extraUsers = mkIf (cfg.user == "sniproxy") { + users.users = mkIf (cfg.user == "sniproxy") { sniproxy = { group = cfg.group; uid = config.ids.uids.sniproxy; }; }; - users.extraGroups = mkIf (cfg.group == "sniproxy") { + users.groups = mkIf (cfg.group == "sniproxy") { sniproxy = { gid = config.ids.gids.sniproxy; }; diff --git a/nixos/modules/services/networking/spiped.nix b/nixos/modules/services/networking/spiped.nix index 005d7182351a..e60d9abf42a6 100644 --- a/nixos/modules/services/networking/spiped.nix +++ b/nixos/modules/services/networking/spiped.nix @@ -171,8 +171,8 @@ in message = "A pipe must either encrypt or decrypt"; }) cfg.config; - users.extraGroups.spiped.gid = config.ids.gids.spiped; - users.extraUsers.spiped = { + users.groups.spiped.gid = config.ids.gids.spiped; + users.users.spiped = { description = "Secure Pipe Service user"; group = "spiped"; uid = config.ids.uids.spiped; diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix index 961e72b2b810..8b04fac089ef 100644 --- a/nixos/modules/services/networking/ssh/sshd.nix +++ b/nixos/modules/services/networking/ssh/sshd.nix @@ -49,7 +49,7 @@ let ${concatMapStrings (f: readFile f + "\n") u.openssh.authorizedKeys.keyFiles} ''; }; - usersWithKeys = attrValues (flip filterAttrs config.users.extraUsers (n: u: + usersWithKeys = attrValues (flip filterAttrs config.users.users (n: u: length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0 )); in listToAttrs (map mkAuthKeyFile usersWithKeys); @@ -326,7 +326,7 @@ in config = mkIf cfg.enable { - users.extraUsers.sshd = + users.users.sshd = { isSystemUser = true; description = "SSH privilege separation user"; }; diff --git a/nixos/modules/services/networking/supplicant.nix b/nixos/modules/services/networking/supplicant.nix index dc90a4bcc620..3c4321ab9e9d 100644 --- a/nixos/modules/services/networking/supplicant.nix +++ b/nixos/modules/services/networking/supplicant.nix @@ -183,7 +183,7 @@ in example = literalExample '' { "wlan0 wlan1" = { - configFile = "/etc/wpa_supplicant"; + configFile.path = "/etc/wpa_supplicant.conf"; userControlled.group = "network"; extraConf = ''' ap_scan=1 diff --git a/nixos/modules/services/networking/supybot.nix b/nixos/modules/services/networking/supybot.nix index 2cfb9fc9b923..64eb11068329 100644 --- a/nixos/modules/services/networking/supybot.nix +++ b/nixos/modules/services/networking/supybot.nix @@ -45,7 +45,7 @@ in environment.systemPackages = [ pkgs.pythonPackages.limnoria ]; - users.extraUsers = singleton { + users.users = singleton { name = "supybot"; uid = config.ids.uids.supybot; group = "supybot"; @@ -54,7 +54,7 @@ in createHome = true; }; - users.extraGroups.supybot = { + users.groups.supybot = { name = "supybot"; gid = config.ids.gids.supybot; }; diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix index e485c073cbdd..c610b3b66606 100644 --- a/nixos/modules/services/networking/syncthing.nix +++ b/nixos/modules/services/networking/syncthing.nix @@ -103,7 +103,7 @@ in { systemd.packages = [ pkgs.syncthing ]; users = mkIf (cfg.user == defaultUser) { - extraUsers."${defaultUser}" = + users."${defaultUser}" = { group = cfg.group; home = cfg.dataDir; createHome = true; @@ -111,7 +111,7 @@ in { description = "Syncthing daemon user"; }; - extraGroups."${defaultUser}".gid = + groups."${defaultUser}".gid = config.ids.gids.syncthing; }; diff --git a/nixos/modules/services/networking/tcpcrypt.nix b/nixos/modules/services/networking/tcpcrypt.nix index ee005e11aa32..a0ccb9950094 100644 --- a/nixos/modules/services/networking/tcpcrypt.nix +++ b/nixos/modules/services/networking/tcpcrypt.nix @@ -29,7 +29,7 @@ in config = mkIf cfg.enable { - users.extraUsers = singleton { + users.users = singleton { name = "tcpcryptd"; uid = config.ids.uids.tcpcryptd; description = "tcpcrypt daemon user"; diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix index 77bcdae80191..35cdddc590b8 100644 --- a/nixos/modules/services/networking/tinc.nix +++ b/nixos/modules/services/networking/tinc.nix @@ -209,7 +209,7 @@ in }; in [ cli-wrappers ]; - users.extraUsers = flip mapAttrs' cfg.networks (network: _: + users.users = flip mapAttrs' cfg.networks (network: _: nameValuePair ("tinc.${network}") ({ description = "Tinc daemon user for ${network}"; isSystemUser = true; diff --git a/nixos/modules/services/networking/tinydns.nix b/nixos/modules/services/networking/tinydns.nix index 184888ef05da..7d5db71601ef 100644 --- a/nixos/modules/services/networking/tinydns.nix +++ b/nixos/modules/services/networking/tinydns.nix @@ -32,7 +32,7 @@ with lib; config = mkIf config.services.tinydns.enable { environment.systemPackages = [ pkgs.djbdns ]; - users.extraUsers.tinydns = {}; + users.users.tinydns = {}; systemd.services.tinydns = { description = "djbdns tinydns server"; diff --git a/nixos/modules/services/networking/tox-bootstrapd.nix b/nixos/modules/services/networking/tox-bootstrapd.nix index cb0e6b158651..1d3492151690 100644 --- a/nixos/modules/services/networking/tox-bootstrapd.nix +++ b/nixos/modules/services/networking/tox-bootstrapd.nix @@ -56,7 +56,7 @@ in config = mkIf config.services.toxBootstrapd.enable { - users.extraUsers = singleton + users.users = singleton { name = "tox-bootstrapd"; uid = config.ids.uids.tox-bootstrapd; description = "Tox bootstrap daemon user"; diff --git a/nixos/modules/services/networking/toxvpn.nix b/nixos/modules/services/networking/toxvpn.nix index 5e13402d7645..f5baea9222be 100644 --- a/nixos/modules/services/networking/toxvpn.nix +++ b/nixos/modules/services/networking/toxvpn.nix @@ -57,7 +57,7 @@ with lib; environment.systemPackages = [ pkgs.toxvpn ]; - users.extraUsers = { + users.users = { toxvpn = { uid = config.ids.uids.toxvpn; home = "/var/lib/toxvpn"; diff --git a/nixos/modules/services/networking/tvheadend.nix b/nixos/modules/services/networking/tvheadend.nix index cdd8747ba898..f495c39967e8 100644 --- a/nixos/modules/services/networking/tvheadend.nix +++ b/nixos/modules/services/networking/tvheadend.nix @@ -3,7 +3,7 @@ with lib; let cfg = config.services.tvheadend; - pidFile = "${config.users.extraUsers.tvheadend.home}/tvheadend.pid"; + pidFile = "${config.users.users.tvheadend.home}/tvheadend.pid"; in { @@ -25,7 +25,7 @@ in }; config = mkIf cfg.enable { - users.extraUsers.tvheadend = { + users.users.tvheadend = { description = "Tvheadend Service user"; home = "/var/lib/tvheadend"; createHome = true; diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index 07936faaa133..1a35979ad44c 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -131,6 +131,9 @@ in }; }; + # If networkmanager is enabled, ask it to interface with unbound. + networking.networkmanager.dns = "unbound"; + }; } diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix index 94958bfdd83e..ac10e77ba306 100644 --- a/nixos/modules/services/networking/unifi.nix +++ b/nixos/modules/services/networking/unifi.nix @@ -114,7 +114,7 @@ in config = mkIf cfg.enable { - users.extraUsers.unifi = { + users.users.unifi = { uid = config.ids.uids.unifi; description = "UniFi controller daemon user"; home = "${stateDir}"; diff --git a/nixos/modules/services/networking/vsftpd.nix b/nixos/modules/services/networking/vsftpd.nix index 6b3d658bd852..1f9107c3ce9c 100644 --- a/nixos/modules/services/networking/vsftpd.nix +++ b/nixos/modules/services/networking/vsftpd.nix @@ -193,7 +193,7 @@ in message = "vsftpd: If forceLocalLoginsSSL or forceLocalDataSSL is true then a rsaCertFile must be provided!"; }; - users.extraUsers = + users.users = [ { name = "vsftpd"; uid = config.ids.uids.vsftpd; description = "VSFTPD user"; @@ -207,7 +207,7 @@ in home = cfg.anonymousUserHome; }; - users.extraGroups.ftp.gid = config.ids.gids.ftp; + users.groups.ftp.gid = config.ids.gids.ftp; # If you really have to access root via FTP use mkOverride or userlistDeny # = false and whitelist root diff --git a/nixos/modules/services/networking/zerotierone.nix b/nixos/modules/services/networking/zerotierone.nix index cd1617b8e2ba..4c1ee75d536c 100644 --- a/nixos/modules/services/networking/zerotierone.nix +++ b/nixos/modules/services/networking/zerotierone.nix @@ -47,7 +47,7 @@ in }; # ZeroTier does not issue DHCP leases, but some strangers might... - networking.dhcpcd.denyInterfaces = [ "zt0" ]; + networking.dhcpcd.denyInterfaces = [ "zt*" ]; # ZeroTier receives UDP transmissions on port 9993 by default networking.firewall.allowedUDPPorts = [ 9993 ]; diff --git a/nixos/modules/services/networking/znc.nix b/nixos/modules/services/networking/znc.nix index 72313ab2ee14..76e4899c85ee 100644 --- a/nixos/modules/services/networking/znc.nix +++ b/nixos/modules/services/networking/znc.nix @@ -402,7 +402,7 @@ in script = "${pkgs.znc}/bin/znc --foreground --datadir ${cfg.dataDir} ${toString cfg.extraFlags}"; }; - users.extraUsers = optional (cfg.user == defaultUser) + users.users = optional (cfg.user == defaultUser) { name = defaultUser; description = "ZNC server daemon owner"; group = defaultUser; @@ -411,7 +411,7 @@ in createHome = true; }; - users.extraGroups = optional (cfg.user == defaultUser) + users.groups = optional (cfg.user == defaultUser) { name = defaultUser; gid = config.ids.gids.znc; members = [ defaultUser ]; diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix index c4147986439c..b074d15cbec1 100644 --- a/nixos/modules/services/printing/cupsd.nix +++ b/nixos/modules/services/printing/cupsd.nix @@ -268,7 +268,7 @@ in config = mkIf config.services.printing.enable { - users.extraUsers = singleton + users.users = singleton { name = "cups"; uid = config.ids.uids.cups; group = "lp"; diff --git a/nixos/modules/services/scheduling/atd.nix b/nixos/modules/services/scheduling/atd.nix index 77a3f6b51e80..a32907647a0d 100644 --- a/nixos/modules/services/scheduling/atd.nix +++ b/nixos/modules/services/scheduling/atd.nix @@ -57,14 +57,14 @@ in security.pam.services.atd = {}; - users.extraUsers = singleton + users.users = singleton { name = "atd"; uid = config.ids.uids.atd; description = "atd user"; home = "/var/empty"; }; - users.extraGroups = singleton + users.groups = singleton { name = "atd"; gid = config.ids.gids.atd; }; diff --git a/nixos/modules/services/scheduling/chronos.nix b/nixos/modules/services/scheduling/chronos.nix index 6c39997fec88..9a8ed4c09ac1 100644 --- a/nixos/modules/services/scheduling/chronos.nix +++ b/nixos/modules/services/scheduling/chronos.nix @@ -49,6 +49,6 @@ in { }; }; - users.extraUsers.chronos.uid = config.ids.uids.chronos; + users.users.chronos.uid = config.ids.uids.chronos; }; } diff --git a/nixos/modules/services/scheduling/fcron.nix b/nixos/modules/services/scheduling/fcron.nix index 0ea41f3c3985..ae3828977753 100644 --- a/nixos/modules/services/scheduling/fcron.nix +++ b/nixos/modules/services/scheduling/fcron.nix @@ -115,7 +115,7 @@ in ]; environment.systemPackages = [ pkgs.fcron ]; - users.extraUsers.fcron = { + users.users.fcron = { uid = config.ids.uids.fcron; home = "/var/spool/fcron"; group = "fcron"; diff --git a/nixos/modules/services/scheduling/marathon.nix b/nixos/modules/services/scheduling/marathon.nix index 19c9a708f21f..0961a67770e1 100644 --- a/nixos/modules/services/scheduling/marathon.nix +++ b/nixos/modules/services/scheduling/marathon.nix @@ -93,6 +93,6 @@ in { }; }; - users.extraUsers.${cfg.user} = { }; + users.users.${cfg.user} = { }; }; } diff --git a/nixos/modules/services/search/hound.nix b/nixos/modules/services/search/hound.nix index a94a851e80ec..6740928db9a7 100644 --- a/nixos/modules/services/search/hound.nix +++ b/nixos/modules/services/search/hound.nix @@ -88,12 +88,12 @@ in { }; config = mkIf cfg.enable { - users.extraGroups = optional (cfg.group == "hound") { + users.groups = optional (cfg.group == "hound") { name = "hound"; gid = config.ids.gids.hound; }; - users.extraUsers = optional (cfg.user == "hound") { + users.users = optional (cfg.user == "hound") { name = "hound"; description = "hound code search"; createHome = true; diff --git a/nixos/modules/services/search/kibana.nix b/nixos/modules/services/search/kibana.nix index 9d7d2d799189..5885a72c6628 100644 --- a/nixos/modules/services/search/kibana.nix +++ b/nixos/modules/services/search/kibana.nix @@ -193,7 +193,7 @@ in { environment.systemPackages = [ cfg.package ]; - users.extraUsers = singleton { + users.users = singleton { name = "kibana"; uid = config.ids.uids.kibana; description = "Kibana service user"; diff --git a/nixos/modules/services/security/clamav.nix b/nixos/modules/services/security/clamav.nix index 4161c61ed375..9ad0095252de 100644 --- a/nixos/modules/services/security/clamav.nix +++ b/nixos/modules/services/security/clamav.nix @@ -79,7 +79,7 @@ in config = mkIf (cfg.updater.enable || cfg.daemon.enable) { environment.systemPackages = [ pkg ]; - users.extraUsers = singleton { + users.users = singleton { name = clamavUser; uid = config.ids.uids.clamav; group = clamavGroup; @@ -87,7 +87,7 @@ in home = stateDir; }; - users.extraGroups = singleton { + users.groups = singleton { name = clamavGroup; gid = config.ids.gids.clamav; }; diff --git a/nixos/modules/services/security/fprot.nix b/nixos/modules/services/security/fprot.nix index a12aa01503e3..b1ca4ab23452 100644 --- a/nixos/modules/services/security/fprot.nix +++ b/nixos/modules/services/security/fprot.nix @@ -53,14 +53,14 @@ in { target = "f-prot.conf"; }; - users.extraUsers = singleton + users.users = singleton { name = fprotUser; uid = config.ids.uids.fprot; description = "F-Prot daemon user"; home = stateDir; }; - users.extraGroups = singleton + users.groups = singleton { name = fprotGroup; gid = config.ids.gids.fprot; }; diff --git a/nixos/modules/services/security/oauth2_proxy.nix b/nixos/modules/services/security/oauth2_proxy.nix index 96d78630e6d1..0c5fe8c0ef5f 100644 --- a/nixos/modules/services/security/oauth2_proxy.nix +++ b/nixos/modules/services/security/oauth2_proxy.nix @@ -544,7 +544,7 @@ in cookie.secret = mkDefault null; }; - users.extraUsers.oauth2_proxy = { + users.users.oauth2_proxy = { description = "OAuth2 Proxy"; }; diff --git a/nixos/modules/services/security/oauth2_proxy_nginx.nix b/nixos/modules/services/security/oauth2_proxy_nginx.nix new file mode 100644 index 000000000000..2aa2c57fd22c --- /dev/null +++ b/nixos/modules/services/security/oauth2_proxy_nginx.nix @@ -0,0 +1,64 @@ +{ pkgs, config, lib, ... }: +with lib; +let + cfg = config.services.oauth2_proxy.nginx; +in +{ + options.services.oauth2_proxy.nginx = { + proxy = mkOption { + type = types.string; + default = config.services.oauth2_proxy.httpAddress; + description = '' + The address of the reverse proxy endpoint for oauth2_proxy + ''; + }; + virtualHosts = mkOption { + type = types.listOf types.string; + default = []; + description = '' + A list of nginx virtual hosts to put behind the oauth2 proxy + ''; + }; + }; + config.services.oauth2_proxy = mkIf (cfg.virtualHosts != [] && (hasPrefix "127.0.0.1:" cfg.proxy)) { + enable = true; + }; + config.services.nginx = mkMerge ((optional (cfg.virtualHosts != []) { + recommendedProxySettings = true; # needed because duplicate headers + }) ++ (map (vhost: { + virtualHosts.${vhost} = { + locations."/oauth2/" = { + proxyPass = cfg.proxy; + extraConfig = '' + proxy_set_header X-Scheme $scheme; + proxy_set_header X-Auth-Request-Redirect $request_uri; + ''; + }; + locations."/oauth2/auth" = { + proxyPass = cfg.proxy; + extraConfig = '' + proxy_set_header X-Scheme $scheme; + # nginx auth_request includes headers but not body + proxy_set_header Content-Length ""; + proxy_pass_request_body off; + ''; + }; + locations."/".extraConfig = '' + auth_request /oauth2/auth; + error_page 401 = /oauth2/sign_in; + + # pass information via X-User and X-Email headers to backend, + # requires running with --set-xauthrequest flag + auth_request_set $user $upstream_http_x_auth_request_user; + auth_request_set $email $upstream_http_x_auth_request_email; + proxy_set_header X-User $user; + proxy_set_header X-Email $email; + + # if you enabled --cookie-refresh, this is needed for it to work with auth_request + auth_request_set $auth_cookie $upstream_http_set_cookie; + add_header Set-Cookie $auth_cookie; + ''; + + }; + }) cfg.virtualHosts)); +} diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix index 15200c49d70a..dcb41d187c2b 100644 --- a/nixos/modules/services/security/tor.nix +++ b/nixos/modules/services/security/tor.nix @@ -686,8 +686,8 @@ in always create a container/VM with a separate Tor daemon instance. ''; - users.extraGroups.tor.gid = config.ids.gids.tor; - users.extraUsers.tor = + users.groups.tor.gid = config.ids.gids.tor; + users.users.tor = { description = "Tor Daemon User"; createHome = true; home = torDirectory; diff --git a/nixos/modules/services/security/vault.nix b/nixos/modules/services/security/vault.nix index 146afec344ab..47c70cf0687b 100644 --- a/nixos/modules/services/security/vault.nix +++ b/nixos/modules/services/security/vault.nix @@ -97,13 +97,13 @@ in } ]; - users.extraUsers.vault = { + users.users.vault = { name = "vault"; group = "vault"; uid = config.ids.uids.vault; description = "Vault daemon user"; }; - users.extraGroups.vault.gid = config.ids.gids.vault; + users.groups.vault.gid = config.ids.gids.vault; systemd.services.vault = { description = "Vault server daemon"; diff --git a/nixos/modules/services/system/dbus.nix b/nixos/modules/services/system/dbus.nix index 643bec188142..e04580218442 100644 --- a/nixos/modules/services/system/dbus.nix +++ b/nixos/modules/services/system/dbus.nix @@ -71,14 +71,14 @@ in target = "dbus-1"; }; - users.extraUsers.messagebus = { + users.users.messagebus = { uid = config.ids.uids.messagebus; description = "D-Bus system message bus daemon user"; home = homeDir; group = "messagebus"; }; - users.extraGroups.messagebus.gid = config.ids.gids.messagebus; + users.groups.messagebus.gid = config.ids.gids.messagebus; systemd.packages = [ pkgs.dbus.daemon ]; @@ -100,6 +100,7 @@ in # Don't restart dbus-daemon. Bad things tend to happen if we do. reloadIfChanged = true; restartTriggers = [ configDir ]; + environment = { LD_LIBRARY_PATH = config.system.nssModules.path; }; }; systemd.user = { diff --git a/nixos/modules/services/system/kerberos.nix b/nixos/modules/services/system/kerberos.nix index 4f2e2fdf662b..d85dee089827 100644 --- a/nixos/modules/services/system/kerberos.nix +++ b/nixos/modules/services/system/kerberos.nix @@ -41,8 +41,8 @@ in flags = "REUSE NAMEINARGS"; protocol = "tcp"; user = "root"; - server = "${pkgs.tcp_wrappers}/sbin/tcpd"; - serverArgs = "${pkgs.heimdalFull}/sbin/kadmind"; + server = "${pkgs.tcp_wrappers}/bin/tcpd"; + serverArgs = "${pkgs.heimdalFull}/bin/kadmind"; }; systemd.services.kdc = { @@ -51,13 +51,13 @@ in preStart = '' mkdir -m 0755 -p ${stateDir} ''; - script = "${heimdalFull}/sbin/kdc"; + script = "${heimdalFull}/bin/kdc"; }; systemd.services.kpasswdd = { description = "Kerberos Password Changing daemon"; wantedBy = [ "multi-user.target" ]; - script = "${heimdalFull}/sbin/kpasswdd"; + script = "${heimdalFull}/bin/kpasswdd"; }; }; diff --git a/nixos/modules/services/system/nscd.nix b/nixos/modules/services/system/nscd.nix index eb4b5281c7c6..11a30ea81ba9 100644 --- a/nixos/modules/services/system/nscd.nix +++ b/nixos/modules/services/system/nscd.nix @@ -41,7 +41,7 @@ in config = mkIf cfg.enable { environment.etc."nscd.conf".text = cfg.config; - users.extraUsers.nscd = + users.users.nscd = { isSystemUser = true; description = "Name service cache daemon user"; }; diff --git a/nixos/modules/services/system/uptimed.nix b/nixos/modules/services/system/uptimed.nix index b20d60968032..3c9978ab2269 100644 --- a/nixos/modules/services/system/uptimed.nix +++ b/nixos/modules/services/system/uptimed.nix @@ -20,7 +20,7 @@ in }; config = mkIf cfg.enable { - users.extraUsers.uptimed = { + users.users.uptimed = { description = "Uptimed daemon user"; home = stateDir; createHome = true; diff --git a/nixos/modules/services/torrent/deluge.nix b/nixos/modules/services/torrent/deluge.nix index bff22cd13594..84f0437b9411 100644 --- a/nixos/modules/services/torrent/deluge.nix +++ b/nixos/modules/services/torrent/deluge.nix @@ -55,7 +55,7 @@ in { environment.systemPackages = [ pkgs.deluge ]; - users.extraUsers.deluge = { + users.users.deluge = { group = "deluge"; uid = config.ids.uids.deluge; home = "/var/lib/deluge/"; @@ -63,6 +63,6 @@ in { description = "Deluge Daemon user"; }; - users.extraGroups.deluge.gid = config.ids.gids.deluge; + users.groups.deluge.gid = config.ids.gids.deluge; }; } diff --git a/nixos/modules/services/torrent/peerflix.nix b/nixos/modules/services/torrent/peerflix.nix index 2e3dd9902d72..bed6661f84d6 100644 --- a/nixos/modules/services/torrent/peerflix.nix +++ b/nixos/modules/services/torrent/peerflix.nix @@ -58,6 +58,6 @@ in { }; }; - users.extraUsers.peerflix.uid = config.ids.uids.peerflix; + users.users.peerflix.uid = config.ids.uids.peerflix; }; } diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix index 3564afd77f41..bf4fb76d0c0c 100644 --- a/nixos/modules/services/torrent/transmission.nix +++ b/nixos/modules/services/torrent/transmission.nix @@ -113,8 +113,8 @@ in # It's useful to have transmission in path, e.g. for remote control environment.systemPackages = [ pkgs.transmission ]; - users.extraGroups.transmission.gid = config.ids.gids.transmission; - users.extraUsers.transmission = { + users.groups.transmission.gid = config.ids.gids.transmission; + users.users.transmission = { group = "transmission"; uid = config.ids.uids.transmission; description = "Transmission BitTorrent user"; diff --git a/nixos/modules/services/web-apps/atlassian/confluence.nix b/nixos/modules/services/web-apps/atlassian/confluence.nix index 84c41b6e53c2..f896d92fd6fc 100644 --- a/nixos/modules/services/web-apps/atlassian/confluence.nix +++ b/nixos/modules/services/web-apps/atlassian/confluence.nix @@ -137,12 +137,12 @@ in }; config = mkIf cfg.enable { - users.extraUsers."${cfg.user}" = { + users.users."${cfg.user}" = { isSystemUser = true; group = cfg.group; }; - users.extraGroups."${cfg.group}" = {}; + users.groups."${cfg.group}" = {}; systemd.services.confluence = { description = "Atlassian Confluence"; diff --git a/nixos/modules/services/web-apps/atlassian/crowd.nix b/nixos/modules/services/web-apps/atlassian/crowd.nix index 778e4afa1e0b..b6cb9f3b7c41 100644 --- a/nixos/modules/services/web-apps/atlassian/crowd.nix +++ b/nixos/modules/services/web-apps/atlassian/crowd.nix @@ -103,12 +103,12 @@ in }; config = mkIf cfg.enable { - users.extraUsers."${cfg.user}" = { + users.users."${cfg.user}" = { isSystemUser = true; group = cfg.group; }; - users.extraGroups."${cfg.group}" = {}; + users.groups."${cfg.group}" = {}; systemd.services.atlassian-crowd = { description = "Atlassian Crowd"; diff --git a/nixos/modules/services/web-apps/atlassian/jira.nix b/nixos/modules/services/web-apps/atlassian/jira.nix index 13c5951524d9..f5ec0a5f31b8 100644 --- a/nixos/modules/services/web-apps/atlassian/jira.nix +++ b/nixos/modules/services/web-apps/atlassian/jira.nix @@ -141,12 +141,12 @@ in }; config = mkIf cfg.enable { - users.extraUsers."${cfg.user}" = { + users.users."${cfg.user}" = { isSystemUser = true; group = cfg.group; }; - users.extraGroups."${cfg.group}" = {}; + users.groups."${cfg.group}" = {}; systemd.services.atlassian-jira = { description = "Atlassian JIRA"; diff --git a/nixos/modules/services/web-apps/frab.nix b/nixos/modules/services/web-apps/frab.nix index d5329ef03c89..d411727a1a54 100644 --- a/nixos/modules/services/web-apps/frab.nix +++ b/nixos/modules/services/web-apps/frab.nix @@ -174,14 +174,14 @@ in config = mkIf cfg.enable { environment.systemPackages = [ frab-rake ]; - users.extraUsers = [ + users.users = [ { name = cfg.user; group = cfg.group; home = "${cfg.statePath}"; } ]; - users.extraGroups = [ { name = cfg.group; } ]; + users.groups = [ { name = cfg.group; } ]; systemd.services.frab = { after = [ "network.target" "gitlab.service" ]; diff --git a/nixos/modules/services/web-apps/matomo.nix b/nixos/modules/services/web-apps/matomo.nix index ef6ac9698e21..ed38eb9ce1e9 100644 --- a/nixos/modules/services/web-apps/matomo.nix +++ b/nixos/modules/services/web-apps/matomo.nix @@ -109,13 +109,13 @@ in { message = "Either services.matomo.nginx or services.matomo.nginx.webServerUser is mandatory"; }]; - users.extraUsers.${user} = { + users.users.${user} = { isSystemUser = true; createHome = true; home = dataDir; group = user; }; - users.extraGroups.${user} = {}; + users.groups.${user} = {}; systemd.services.matomo_setup_update = { # everything needs to set up and up to date before matomo php files are executed diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix index 96792c47cd24..8c7fc4056adc 100644 --- a/nixos/modules/services/web-apps/mattermost.nix +++ b/nixos/modules/services/web-apps/mattermost.nix @@ -146,14 +146,14 @@ in config = mkMerge [ (mkIf cfg.enable { - users.extraUsers = optionalAttrs (cfg.user == "mattermost") (singleton { + users.users = optionalAttrs (cfg.user == "mattermost") (singleton { name = "mattermost"; group = cfg.group; uid = config.ids.uids.mattermost; home = cfg.statePath; }); - users.extraGroups = optionalAttrs (cfg.group == "mattermost") (singleton { + users.groups = optionalAttrs (cfg.group == "mattermost") (singleton { name = "mattermost"; gid = config.ids.gids.mattermost; }); diff --git a/nixos/modules/services/web-apps/nexus.nix b/nixos/modules/services/web-apps/nexus.nix index b0eaee6040e3..30876889cf25 100644 --- a/nixos/modules/services/web-apps/nexus.nix +++ b/nixos/modules/services/web-apps/nexus.nix @@ -80,12 +80,12 @@ in }; config = mkIf cfg.enable { - users.extraUsers."${cfg.user}" = { + users.users."${cfg.user}" = { isSystemUser = true; group = cfg.group; }; - users.extraGroups."${cfg.group}" = {}; + users.groups."${cfg.group}" = {}; systemd.services.nexus = { description = "Sonatype Nexus3"; diff --git a/nixos/modules/services/web-apps/restya-board.nix b/nixos/modules/services/web-apps/restya-board.nix index cee725e8fe5f..bc6689bdb271 100644 --- a/nixos/modules/services/web-apps/restya-board.nix +++ b/nixos/modules/services/web-apps/restya-board.nix @@ -358,13 +358,13 @@ in ''; }; - users.extraUsers.restya-board = { + users.users.restya-board = { isSystemUser = true; createHome = false; home = runDir; group = "restya-board"; }; - users.extraGroups.restya-board = {}; + users.groups.restya-board = {}; services.postgresql.enable = mkIf (isNull cfg.database.host) true; diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix index 610c6463a5eb..2b171aa1b2b2 100644 --- a/nixos/modules/services/web-apps/tt-rss.nix +++ b/nixos/modules/services/web-apps/tt-rss.nix @@ -76,6 +76,8 @@ let define('SMTP_FROM_NAME', '${escape ["'" "\\"] cfg.email.fromName}'); define('SMTP_FROM_ADDRESS', '${escape ["'" "\\"] cfg.email.fromAddress}'); define('DIGEST_SUBJECT', '${escape ["'" "\\"] cfg.email.digestSubject}'); + + ${cfg.extraConfig} ''; in { @@ -431,6 +433,26 @@ let ''; }; + pluginPackages = mkOption { + type = types.listOf types.package; + default = []; + description = '' + List of plugins to install. The list elements are expected to + be derivations. All elements in this derivation are automatically + copied to the <literal>plugins.local</literal> directory. + ''; + }; + + themePackages = mkOption { + type = types.listOf types.package; + default = []; + description = '' + List of themes to install. The list elements are expected to + be derivations. All elements in this derivation are automatically + copied to the <literal>themes.local</literal> directory. + ''; + }; + logDestination = mkOption { type = types.enum ["" "sql" "syslog"]; default = "sql"; @@ -441,6 +463,14 @@ let error.log). ''; }; + + extraConfig = mkOption { + type = types.lines; + default = ""; + description = '' + Additional lines to append to <literal>config.php</literal>. + ''; + }; }; }; @@ -517,6 +547,16 @@ let rm -rf "${cfg.root}/*" mkdir -m 755 -p "${cfg.root}" cp -r "${pkgs.tt-rss}/"* "${cfg.root}" + ${optionalString (cfg.pluginPackages != []) '' + for plugin in ${concatStringsSep " " cfg.pluginPackages}; do + cp -r "$plugin"/* "${cfg.root}/plugins.local/" + done + ''} + ${optionalString (cfg.themePackages != []) '' + for theme in ${concatStringsSep " " cfg.themePackages}; do + cp -r "$theme"/* "${cfg.root}/themes.local/" + done + ''} ln -sf "${tt-rss-config}" "${cfg.root}/config.php" chown -R "${cfg.user}" "${cfg.root}" chmod -R 755 "${cfg.root}" @@ -584,8 +624,8 @@ let }; users = optionalAttrs (cfg.user == "tt_rss") { - extraUsers.tt_rss.group = "tt_rss"; - extraGroups.tt_rss = {}; + users.tt_rss.group = "tt_rss"; + groups.tt_rss = {}; }; }; } diff --git a/nixos/modules/services/web-apps/virtlyst.nix b/nixos/modules/services/web-apps/virtlyst.nix index 2fc67435ce82..e5c0bff2168a 100644 --- a/nixos/modules/services/web-apps/virtlyst.nix +++ b/nixos/modules/services/web-apps/virtlyst.nix @@ -50,7 +50,7 @@ in }; config = mkIf cfg.enable { - users.extraUsers.virtlyst = { + users.users.virtlyst = { home = stateDir; createHome = true; group = mkIf config.virtualisation.libvirtd.enable "libvirtd"; diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix index f9f2511f45dc..b71ff0531cc8 100644 --- a/nixos/modules/services/web-servers/apache-httpd/default.nix +++ b/nixos/modules/services/web-servers/apache-httpd/default.nix @@ -658,14 +658,14 @@ in warnings = map (cfg: ''apache-httpd's port option is deprecated. Use listen = [{/*ip = "*"; */ port = ${toString cfg.port}";}]; instead'' ) (lib.filter (cfg: cfg.port != 0) allHosts); - users.extraUsers = optionalAttrs (mainCfg.user == "wwwrun") (singleton + users.users = optionalAttrs (mainCfg.user == "wwwrun") (singleton { name = "wwwrun"; group = mainCfg.group; description = "Apache httpd user"; uid = config.ids.uids.wwwrun; }); - users.extraGroups = optionalAttrs (mainCfg.group == "wwwrun") (singleton + users.groups = optionalAttrs (mainCfg.group == "wwwrun") (singleton { name = "wwwrun"; gid = config.ids.gids.wwwrun; }); diff --git a/nixos/modules/services/web-servers/caddy.nix b/nixos/modules/services/web-servers/caddy.nix index fe65fba42a46..4237cfdd9198 100644 --- a/nixos/modules/services/web-servers/caddy.nix +++ b/nixos/modules/services/web-servers/caddy.nix @@ -93,13 +93,13 @@ in { }; }; - users.extraUsers.caddy = { + users.users.caddy = { group = "caddy"; uid = config.ids.uids.caddy; home = cfg.dataDir; createHome = true; }; - users.extraGroups.caddy.gid = config.ids.uids.caddy; + users.groups.caddy.gid = config.ids.uids.caddy; }; } diff --git a/nixos/modules/services/web-servers/hitch/default.nix b/nixos/modules/services/web-servers/hitch/default.nix index 895d02827f71..a6c4cbea1225 100644 --- a/nixos/modules/services/web-servers/hitch/default.nix +++ b/nixos/modules/services/web-servers/hitch/default.nix @@ -102,7 +102,7 @@ with lib; environment.systemPackages = [ pkgs.hitch ]; - users.extraUsers.hitch.group = "hitch"; - users.extraGroups.hitch = {}; + users.users.hitch.group = "hitch"; + users.groups.hitch = {}; }; } diff --git a/nixos/modules/services/web-servers/lighttpd/cgit.nix b/nixos/modules/services/web-servers/lighttpd/cgit.nix index 710fecc0c05c..e6a054c296dc 100644 --- a/nixos/modules/services/web-servers/lighttpd/cgit.nix +++ b/nixos/modules/services/web-servers/lighttpd/cgit.nix @@ -4,8 +4,15 @@ with lib; let cfg = config.services.lighttpd.cgit; + pathPrefix = if stringLength cfg.subdir == 0 then "" else "/" + cfg.subdir; configFile = pkgs.writeText "cgitrc" '' + # default paths to static assets + css=${pathPrefix}/cgit.css + logo=${pathPrefix}/cgit.png + favicon=${pathPrefix}/favicon.ico + + # user configuration ${cfg.configText} ''; in @@ -18,8 +25,17 @@ in type = types.bool; description = '' If true, enable cgit (fast web interface for git repositories) as a - sub-service in lighttpd. cgit will be accessible at - http://yourserver/cgit + sub-service in lighttpd. + ''; + }; + + subdir = mkOption { + default = "cgit"; + example = ""; + type = types.str; + description = '' + The subdirectory in which to serve cgit. The web application will be + accessible at http://yourserver/''${subdir} ''; }; @@ -48,14 +64,14 @@ in services.lighttpd.enableModules = [ "mod_cgi" "mod_alias" "mod_setenv" ]; services.lighttpd.extraConfig = '' - $HTTP["url"] =~ "^/cgit" { + $HTTP["url"] =~ "^/${cfg.subdir}" { cgi.assign = ( "cgit.cgi" => "${pkgs.cgit}/cgit/cgit.cgi" ) alias.url = ( - "/cgit.css" => "${pkgs.cgit}/cgit/cgit.css", - "/cgit.png" => "${pkgs.cgit}/cgit/cgit.png", - "/cgit" => "${pkgs.cgit}/cgit/cgit.cgi" + "${pathPrefix}/cgit.css" => "${pkgs.cgit}/cgit/cgit.css", + "${pathPrefix}/cgit.png" => "${pkgs.cgit}/cgit/cgit.png", + "${pathPrefix}" => "${pkgs.cgit}/cgit/cgit.cgi" ) setenv.add-environment = ( "CGIT_CONFIG" => "${configFile}" diff --git a/nixos/modules/services/web-servers/lighttpd/default.nix b/nixos/modules/services/web-servers/lighttpd/default.nix index d23e810dcc62..7a3df26e47a6 100644 --- a/nixos/modules/services/web-servers/lighttpd/default.nix +++ b/nixos/modules/services/web-servers/lighttpd/default.nix @@ -245,12 +245,12 @@ in serviceConfig.KillSignal = "SIGINT"; }; - users.extraUsers.lighttpd = { + users.users.lighttpd = { group = "lighttpd"; description = "lighttpd web server privilege separation user"; uid = config.ids.uids.lighttpd; }; - users.extraGroups.lighttpd.gid = config.ids.gids.lighttpd; + users.groups.lighttpd.gid = config.ids.gids.lighttpd; }; } diff --git a/nixos/modules/services/web-servers/lighttpd/inginious.nix b/nixos/modules/services/web-servers/lighttpd/inginious.nix index 8c813d116a52..5ff1796e92a1 100644 --- a/nixos/modules/services/web-servers/lighttpd/inginious.nix +++ b/nixos/modules/services/web-servers/lighttpd/inginious.nix @@ -194,7 +194,7 @@ in storageDriver = mkDefault "overlay"; }; - users.extraUsers."lighttpd".extraGroups = [ "docker" ]; + users.users."lighttpd".extraGroups = [ "docker" ]; # Ensure that docker has pulled the required images. systemd.services.inginious-prefetch = { diff --git a/nixos/modules/services/web-servers/meguca.nix b/nixos/modules/services/web-servers/meguca.nix index 8ae86c67a29f..ed7325ff0790 100644 --- a/nixos/modules/services/web-servers/meguca.nix +++ b/nixos/modules/services/web-servers/meguca.nix @@ -104,15 +104,16 @@ in preStart = '' # Ensure folder exists and links are correct or create them mkdir -p ${cfg.baseDir} + chmod 750 ${cfg.baseDir} ln -sf ${pkgs.meguca}/share/meguca/www ${cfg.baseDir} # Ensure the database is correct or create it ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createuser \ -SDR meguca || true - ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/psql \ - -c "ALTER ROLE meguca WITH PASSWORD '$(cat ${cfg.passwordFile})';" || true ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createdb \ -T template0 -E UTF8 -O meguca meguca || true + ${pkgs.sudo}/bin/sudo -u meguca ${postgres.package}/bin/psql \ + -c "ALTER ROLE meguca WITH PASSWORD '$(cat ${cfg.passwordFile})';" || true ''; script = '' @@ -139,7 +140,7 @@ in }; users = { - extraUsers.meguca = { + users.meguca = { description = "meguca server service user"; home = cfg.baseDir; createHome = true; @@ -147,7 +148,7 @@ in uid = config.ids.uids.meguca; }; - extraGroups.meguca = { + groups.meguca = { gid = config.ids.gids.meguca; members = [ "meguca" ]; }; diff --git a/nixos/modules/services/web-servers/mighttpd2.nix b/nixos/modules/services/web-servers/mighttpd2.nix index a888f623616e..4e7082c67690 100644 --- a/nixos/modules/services/web-servers/mighttpd2.nix +++ b/nixos/modules/services/web-servers/mighttpd2.nix @@ -119,13 +119,13 @@ in { }; }; - users.extraUsers.mighttpd2 = { + users.users.mighttpd2 = { group = "mighttpd2"; uid = config.ids.uids.mighttpd2; isSystemUser = true; }; - users.extraGroups.mighttpd2.gid = config.ids.gids.mighttpd2; + users.groups.mighttpd2.gid = config.ids.gids.mighttpd2; }; meta.maintainers = with lib.maintainers; [ fgaz ]; diff --git a/nixos/modules/services/web-servers/minio.nix b/nixos/modules/services/web-servers/minio.nix index 7ead33483ea4..f78a966989b6 100644 --- a/nixos/modules/services/web-servers/minio.nix +++ b/nixos/modules/services/web-servers/minio.nix @@ -101,11 +101,11 @@ in }; }; - users.extraUsers.minio = { + users.users.minio = { group = "minio"; uid = config.ids.uids.minio; }; - users.extraGroups.minio.gid = config.ids.uids.minio; + users.groups.minio.gid = config.ids.uids.minio; }; } diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 0aa780bf6da1..355976c4b7cb 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -613,13 +613,13 @@ in listToAttrs acmePairs ); - users.extraUsers = optionalAttrs (cfg.user == "nginx") (singleton + users.users = optionalAttrs (cfg.user == "nginx") (singleton { name = "nginx"; group = cfg.group; uid = config.ids.uids.nginx; }); - users.extraGroups = optionalAttrs (cfg.group == "nginx") (singleton + users.groups = optionalAttrs (cfg.group == "nginx") (singleton { name = "nginx"; gid = config.ids.gids.nginx; }); diff --git a/nixos/modules/services/web-servers/tomcat.nix b/nixos/modules/services/web-servers/tomcat.nix index bc713a08f18f..d8ccb7ca65d6 100644 --- a/nixos/modules/services/web-servers/tomcat.nix +++ b/nixos/modules/services/web-servers/tomcat.nix @@ -166,12 +166,12 @@ in config = mkIf config.services.tomcat.enable { - users.extraGroups = singleton + users.groups = singleton { name = "tomcat"; gid = config.ids.gids.tomcat; }; - users.extraUsers = singleton + users.users = singleton { name = "tomcat"; uid = config.ids.uids.tomcat; description = "Tomcat user"; diff --git a/nixos/modules/services/web-servers/traefik.nix b/nixos/modules/services/web-servers/traefik.nix index b6c7fef21fb2..700202b1d28f 100644 --- a/nixos/modules/services/web-servers/traefik.nix +++ b/nixos/modules/services/web-servers/traefik.nix @@ -114,12 +114,12 @@ in { }; }; - users.extraUsers.traefik = { + users.users.traefik = { group = "traefik"; home = cfg.dataDir; createHome = true; }; - users.extraGroups.traefik = {}; + users.groups.traefik = {}; }; } diff --git a/nixos/modules/services/web-servers/uwsgi.nix b/nixos/modules/services/web-servers/uwsgi.nix index 356b896a6dc9..3ef78ea77cb2 100644 --- a/nixos/modules/services/web-servers/uwsgi.nix +++ b/nixos/modules/services/web-servers/uwsgi.nix @@ -150,13 +150,13 @@ in { }; }; - users.extraUsers = optionalAttrs (cfg.user == "uwsgi") (singleton + users.users = optionalAttrs (cfg.user == "uwsgi") (singleton { name = "uwsgi"; group = cfg.group; uid = config.ids.uids.uwsgi; }); - users.extraGroups = optionalAttrs (cfg.group == "uwsgi") (singleton + users.groups = optionalAttrs (cfg.group == "uwsgi") (singleton { name = "uwsgi"; gid = config.ids.gids.uwsgi; }); diff --git a/nixos/modules/services/web-servers/varnish/default.nix b/nixos/modules/services/web-servers/varnish/default.nix index bc74d62b116a..63f967185c2d 100644 --- a/nixos/modules/services/web-servers/varnish/default.nix +++ b/nixos/modules/services/web-servers/varnish/default.nix @@ -103,11 +103,11 @@ in }) ]; - users.extraUsers.varnish = { + users.users.varnish = { group = "varnish"; uid = config.ids.uids.varnish; }; - users.extraGroups.varnish.gid = config.ids.uids.varnish; + users.groups.varnish.gid = config.ids.uids.varnish; }; } diff --git a/nixos/modules/services/web-servers/zope2.nix b/nixos/modules/services/web-servers/zope2.nix index 496e34db4a96..1dcc3ac9d8d4 100644 --- a/nixos/modules/services/web-servers/zope2.nix +++ b/nixos/modules/services/web-servers/zope2.nix @@ -103,7 +103,7 @@ in config = mkIf (cfg.instances != {}) { - users.extraUsers.zope2.uid = config.ids.uids.zope2; + users.users.zope2.uid = config.ids.uids.zope2; systemd.services = let diff --git a/nixos/modules/services/x11/display-managers/gdm.nix b/nixos/modules/services/x11/display-managers/gdm.nix index a6a38a21b617..8b08c01ea0db 100644 --- a/nixos/modules/services/x11/display-managers/gdm.nix +++ b/nixos/modules/services/x11/display-managers/gdm.nix @@ -89,7 +89,7 @@ in services.xserver.displayManager.slim.enable = false; - users.extraUsers.gdm = + users.users.gdm = { name = "gdm"; uid = config.ids.uids.gdm; group = "gdm"; @@ -97,7 +97,7 @@ in description = "GDM user"; }; - users.extraGroups.gdm.gid = config.ids.gids.gdm; + users.groups.gdm.gid = config.ids.gids.gdm; # GDM needs different xserverArgs, presumable because using wayland by default. services.xserver.tty = null; diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix index 5beadacdfa93..206ede227efa 100644 --- a/nixos/modules/services/x11/display-managers/lightdm.nix +++ b/nixos/modules/services/x11/display-managers/lightdm.nix @@ -42,7 +42,7 @@ let '' [LightDM] ${optionalString cfg.greeter.enable '' - greeter-user = ${config.users.extraUsers.lightdm.name} + greeter-user = ${config.users.users.lightdm.name} greeters-directory = ${cfg.greeter.package} ''} sessions-directory = ${dmcfg.session.desktops} @@ -252,14 +252,14 @@ in session include lightdm ''; - users.extraUsers.lightdm = { + users.users.lightdm = { createHome = true; home = "/var/lib/lightdm-data"; group = "lightdm"; uid = config.ids.uids.lightdm; }; - users.extraGroups.lightdm.gid = config.ids.gids.lightdm; + users.groups.lightdm.gid = config.ids.gids.lightdm; services.xserver.tty = null; # We might start multiple X servers so let the tty increment themselves.. services.xserver.display = null; # We specify our own display (and logfile) in xserver-wrapper up there }; diff --git a/nixos/modules/services/x11/display-managers/sddm.nix b/nixos/modules/services/x11/display-managers/sddm.nix index df782e82ed15..8db7414e811f 100644 --- a/nixos/modules/services/x11/display-managers/sddm.nix +++ b/nixos/modules/services/x11/display-managers/sddm.nix @@ -268,7 +268,7 @@ in ''; }; - users.extraUsers.sddm = { + users.users.sddm = { createHome = true; home = "/var/lib/sddm"; group = "sddm"; @@ -277,7 +277,7 @@ in environment.etc."sddm.conf".source = cfgFile; - users.extraGroups.sddm.gid = config.ids.gids.sddm; + users.groups.sddm.gid = config.ids.gids.sddm; environment.systemPackages = [ sddm ]; services.dbus.packages = [ sddm ]; diff --git a/nixos/modules/services/x11/hardware/libinput.nix b/nixos/modules/services/x11/hardware/libinput.nix index d0a87f183b6f..072004d5dd91 100644 --- a/nixos/modules/services/x11/hardware/libinput.nix +++ b/nixos/modules/services/x11/hardware/libinput.nix @@ -116,7 +116,7 @@ in { }; scrollMethod = mkOption { - type = types.enum [ "twofinger" "edge" "none" ]; + type = types.enum [ "twofinger" "edge" "button" "none" ]; default = "twofinger"; example = "edge"; description = diff --git a/nixos/modules/system/boot/initrd-ssh.nix b/nixos/modules/system/boot/initrd-ssh.nix index 8b3dc2d90eb3..53e993603e27 100644 --- a/nixos/modules/system/boot/initrd-ssh.nix +++ b/nixos/modules/system/boot/initrd-ssh.nix @@ -79,7 +79,7 @@ in boot.initrd.network.ssh.authorizedKeys = mkOption { type = types.listOf types.str; - default = config.users.extraUsers.root.openssh.authorizedKeys.keys; + default = config.users.users.root.openssh.authorizedKeys.keys; description = '' Authorized keys for the root user on initrd. ''; diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix index 4d9de020c84e..e1095fb988eb 100644 --- a/nixos/modules/system/boot/resolved.nix +++ b/nixos/modules/system/boot/resolved.nix @@ -147,6 +147,8 @@ in ${config.services.resolved.extraConfig} ''; + # If networkmanager is enabled, ask it to interface with resolved. + networking.networkmanager.dns = "systemd-resolved"; }; } diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index d2fe33488a7a..6593b1a02430 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -798,13 +798,13 @@ in mkdir -m 0700 -p /var/log/journal ''; - users.extraUsers.systemd-network.uid = config.ids.uids.systemd-network; - users.extraGroups.systemd-network.gid = config.ids.gids.systemd-network; - users.extraUsers.systemd-resolve.uid = config.ids.uids.systemd-resolve; - users.extraGroups.systemd-resolve.gid = config.ids.gids.systemd-resolve; + users.users.systemd-network.uid = config.ids.uids.systemd-network; + users.groups.systemd-network.gid = config.ids.gids.systemd-network; + users.users.systemd-resolve.uid = config.ids.uids.systemd-resolve; + users.groups.systemd-resolve.gid = config.ids.gids.systemd-resolve; # Target for ‘charon send-keys’ to hook into. - users.extraGroups.keys.gid = config.ids.gids.keys; + users.groups.keys.gid = config.ids.gids.keys; systemd.targets.keys = { description = "Security Keys"; @@ -840,9 +840,9 @@ in "TMPFS_XATTR" "SECCOMP" ]; - users.extraGroups.systemd-journal.gid = config.ids.gids.systemd-journal; - users.extraUsers.systemd-journal-gateway.uid = config.ids.uids.systemd-journal-gateway; - users.extraGroups.systemd-journal-gateway.gid = config.ids.gids.systemd-journal-gateway; + users.groups.systemd-journal.gid = config.ids.gids.systemd-journal; + users.users.systemd-journal-gateway.uid = config.ids.uids.systemd-journal-gateway; + users.groups.systemd-journal-gateway.gid = config.ids.gids.systemd-journal-gateway; # Generate timer units for all services that have a ‘startAt’ value. systemd.timers = diff --git a/nixos/modules/system/boot/timesyncd.nix b/nixos/modules/system/boot/timesyncd.nix index 57853c5698d0..18aad58b36cc 100644 --- a/nixos/modules/system/boot/timesyncd.nix +++ b/nixos/modules/system/boot/timesyncd.nix @@ -37,8 +37,8 @@ with lib; NTP=${concatStringsSep " " config.services.timesyncd.servers} ''; - users.extraUsers.systemd-timesync.uid = config.ids.uids.systemd-timesync; - users.extraGroups.systemd-timesync.gid = config.ids.gids.systemd-timesync; + users.users.systemd-timesync.uid = config.ids.uids.systemd-timesync; + users.groups.systemd-timesync.gid = config.ids.gids.systemd-timesync; }; diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix index b8a420b7d745..39f51c363673 100644 --- a/nixos/modules/tasks/filesystems/zfs.nix +++ b/nixos/modules/tasks/filesystems/zfs.nix @@ -58,6 +58,45 @@ let snapshotNames = [ "frequent" "hourly" "daily" "weekly" "monthly" ]; + # When importing ZFS pools, there's one difficulty: These scripts may run + # before the backing devices (physical HDDs, etc.) of the pool have been + # scanned and initialized. + # + # An attempted import with all devices missing will just fail, and can be + # retried, but an import where e.g. two out of three disks in a three-way + # mirror are missing, will succeed. This is a problem: When the missing disks + # are later discovered, they won't be automatically set online, rendering the + # pool redundancy-less (and far slower) until such time as the system reboots. + # + # The solution is the below. poolReady checks the status of an un-imported + # pool, to see if *every* device is available -- in which case the pool will be + # in state ONLINE, as opposed to DEGRADED, FAULTED or MISSING. + # + # The import scripts then loop over this, waiting until the pool is ready or a + # sufficient amount of time has passed that we can assume it won't be. In the + # latter case it makes one last attempt at importing, allowing the system to + # (eventually) boot even with a degraded pool. + importLib = {zpoolCmd, awkCmd, cfgZfs}: '' + poolReady() { + pool="$1" + state="$("${zpoolCmd}" import | "${awkCmd}" "/pool: $pool/ { found = 1 }; /state:/ { if (found == 1) { print \$2; exit } }; END { if (found == 0) { print \"MISSING\" } }")" + if [[ "$state" = "ONLINE" ]]; then + return 0 + else + echo "Pool $pool in state $state, waiting" + return 1 + fi + } + poolImported() { + pool="$1" + "${zpoolCmd}" list "$pool" >/dev/null 2>/dev/null + } + poolImport() { + pool="$1" + "${zpoolCmd}" import -d "${cfgZfs.devNodes}" -N $ZFS_FORCE "$pool" + } + ''; + in { @@ -171,8 +210,12 @@ in default = config.boot.zfs.enableUnstable; description = '' Request encryption keys or passwords for all encrypted datasets on import. - Dataset encryption is only supported in zfsUnstable at the moment. + For root pools the encryption key can be supplied via both an + interactive prompt (keylocation=prompt) and from a file + (keylocation=file://). Note that for data pools the encryption key can + be only loaded from a file and not via interactive prompt since the + import is processed in a background systemd service. ''; }; @@ -335,19 +378,26 @@ in ;; esac done - ''] ++ (map (pool: '' + ''] ++ [(importLib { + # See comments at importLib definition. + zpoolCmd = "zpool"; + awkCmd = "awk"; + inherit cfgZfs; + })] ++ (map (pool: '' echo -n "importing root ZFS pool \"${pool}\"..." - trial=0 - until msg="$(zpool import -d ${cfgZfs.devNodes} -N $ZFS_FORCE '${pool}' 2>&1)"; do - sleep 0.25 - echo -n . - trial=$(($trial + 1)) - if [[ $trial -eq 60 ]]; then - break + # Loop across the import until it succeeds, because the devices needed may not be discovered yet. + if ! poolImported "${pool}"; then + for trial in `seq 1 60`; do + poolReady "${pool}" > /dev/null && msg="$(poolImport "${pool}" 2>&1)" && break + sleep 1 + echo -n . + done + echo + if [[ -n "$msg" ]]; then + echo "$msg"; fi - done - echo - if [[ -n "$msg" ]]; then echo "$msg"; fi + poolImported "${pool}" || poolImport "${pool}" # Try one last time, e.g. to import a degraded pool. + fi ${lib.optionalString cfgZfs.requestEncryptionCredentials '' zfs load-key -a ''} @@ -391,9 +441,26 @@ in Type = "oneshot"; RemainAfterExit = true; }; - script = '' - zpool_cmd="${packages.zfsUser}/sbin/zpool" - ("$zpool_cmd" list "${pool}" >/dev/null) || "$zpool_cmd" import -d ${cfgZfs.devNodes} -N ${optionalString cfgZfs.forceImportAll "-f"} "${pool}" + script = (importLib { + # See comments at importLib definition. + zpoolCmd="${packages.zfsUser}/sbin/zpool"; + awkCmd="${pkgs.gawk}/bin/awk"; + inherit cfgZfs; + }) + '' + poolImported "${pool}" && exit + echo -n "importing ZFS pool \"${pool}\"..." + # Loop across the import until it succeeds, because the devices needed may not be discovered yet. + for trial in `seq 1 60`; do + poolReady "${pool}" && poolImport "${pool}" && break + sleep 1 + done + poolImported "${pool}" || poolImport "${pool}" # Try one last time, e.g. to import a degraded pool. + if poolImported "${pool}"; then + ${optionalString cfgZfs.requestEncryptionCredentials "\"${packages.zfsUser}/sbin/zfs\" load-key -r \"${pool}\""} + echo "Successfully imported ${pool}" + else + exit 1 + fi ''; }; diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix index 3d46ba72493c..7a7fcbecd64f 100644 --- a/nixos/modules/testing/test-instrumentation.nix +++ b/nixos/modules/testing/test-instrumentation.nix @@ -126,7 +126,7 @@ in networking.usePredictableInterfaceNames = false; # Make it easy to log in as root when running the test interactively. - users.extraUsers.root.initialHashedPassword = mkOverride 150 ""; + users.users.root.initialHashedPassword = mkOverride 150 ""; services.xserver.displayManager.job.logToJournal = true; diff --git a/nixos/modules/virtualisation/docker.nix b/nixos/modules/virtualisation/docker.nix index a9a2095499a7..a1a32c1c59a1 100644 --- a/nixos/modules/virtualisation/docker.nix +++ b/nixos/modules/virtualisation/docker.nix @@ -141,7 +141,7 @@ in config = mkIf cfg.enable (mkMerge [{ environment.systemPackages = [ cfg.package ]; - users.extraGroups.docker.gid = config.ids.gids.docker; + users.groups.docker.gid = config.ids.gids.docker; systemd.packages = [ cfg.package ]; systemd.services.docker = { diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix index 024db7f87c2e..87409db4320c 100644 --- a/nixos/modules/virtualisation/libvirtd.nix +++ b/nixos/modules/virtualisation/libvirtd.nix @@ -108,7 +108,7 @@ in { boot.kernelModules = [ "tun" ]; - users.extraGroups.libvirtd.gid = config.ids.gids.libvirtd; + users.groups.libvirtd.gid = config.ids.gids.libvirtd; systemd.packages = [ pkgs.libvirt ]; diff --git a/nixos/modules/virtualisation/lxc-container.nix b/nixos/modules/virtualisation/lxc-container.nix index 0208787e7795..dbb7b881955a 100644 --- a/nixos/modules/virtualisation/lxc-container.nix +++ b/nixos/modules/virtualisation/lxc-container.nix @@ -8,7 +8,7 @@ with lib; ]; # Allow the user to login as root without password. - users.extraUsers.root.initialHashedPassword = mkOverride 150 ""; + users.users.root.initialHashedPassword = mkOverride 150 ""; # Some more help text. services.mingetty.helpLine = diff --git a/nixos/modules/virtualisation/lxd.nix b/nixos/modules/virtualisation/lxd.nix index 3e76cdacfc4b..505c11abd208 100644 --- a/nixos/modules/virtualisation/lxd.nix +++ b/nixos/modules/virtualisation/lxd.nix @@ -73,9 +73,9 @@ in }; - users.extraGroups.lxd.gid = config.ids.gids.lxd; + users.groups.lxd.gid = config.ids.gids.lxd; - users.extraUsers.root = { + users.users.root = { subUidRanges = [ { startUid = 1000000; count = 65536; } ]; subGidRanges = [ { startGid = 1000000; count = 65536; } ]; }; diff --git a/nixos/modules/virtualisation/rkt.nix b/nixos/modules/virtualisation/rkt.nix index 98be4f680c3a..fd662b52df52 100644 --- a/nixos/modules/virtualisation/rkt.nix +++ b/nixos/modules/virtualisation/rkt.nix @@ -59,6 +59,6 @@ in }; }; - users.extraGroups.rkt = {}; + users.groups.rkt = {}; }; } diff --git a/nixos/modules/virtualisation/virtualbox-guest.nix b/nixos/modules/virtualisation/virtualbox-guest.nix index 5da4b7e3bafd..78c6f740788e 100644 --- a/nixos/modules/virtualisation/virtualbox-guest.nix +++ b/nixos/modules/virtualisation/virtualbox-guest.nix @@ -44,7 +44,7 @@ in boot.supportedFilesystems = [ "vboxsf" ]; boot.initrd.supportedFilesystems = [ "vboxsf" ]; - users.extraGroups.vboxsf.gid = config.ids.gids.vboxsf; + users.groups.vboxsf.gid = config.ids.gids.vboxsf; systemd.services.virtualbox = { description = "VirtualBox Guest Services"; diff --git a/nixos/modules/virtualisation/virtualbox-host.nix b/nixos/modules/virtualisation/virtualbox-host.nix index 885d752577d5..8adf3aa919d8 100644 --- a/nixos/modules/virtualisation/virtualbox-host.nix +++ b/nixos/modules/virtualisation/virtualbox-host.nix @@ -86,7 +86,7 @@ in "VirtualBox" ])); - users.extraGroups.vboxusers.gid = config.ids.gids.vboxusers; + users.groups.vboxusers.gid = config.ids.gids.vboxusers; services.udev.extraRules = '' |