diff options
Diffstat (limited to 'nixos')
415 files changed, 9323 insertions, 3103 deletions
diff --git a/nixos/doc/manual/administration/service-mgmt.chapter.md b/nixos/doc/manual/administration/service-mgmt.chapter.md index bb0f9b62e913..674c73741680 100644 --- a/nixos/doc/manual/administration/service-mgmt.chapter.md +++ b/nixos/doc/manual/administration/service-mgmt.chapter.md @@ -75,7 +75,7 @@ necessary). Packages in Nixpkgs sometimes provide systemd units with them, usually in e.g `#pkg-out#/lib/systemd/`. Putting such a package in -`environment.systemPackages` doesn\'t make the service available to +`environment.systemPackages` doesn't make the service available to users or the system. In order to enable a systemd *system* service with provided upstream @@ -87,9 +87,9 @@ systemd.packages = [ pkgs.packagekit ]; Usually NixOS modules written by the community do the above, plus take care of other details. If a module was written for a service you are -interested in, you\'d probably need only to use +interested in, you'd probably need only to use `services.#name#.enable = true;`. These services are defined in -Nixpkgs\' [ `nixos/modules/` directory +Nixpkgs' [ `nixos/modules/` directory ](https://github.com/NixOS/nixpkgs/tree/master/nixos/modules). In case the service is simple enough, the above method should work, and start the service on boot. @@ -98,8 +98,8 @@ the service on boot. differently. Given a package that has a systemd unit file at `#pkg-out#/lib/systemd/user/`, using [](#opt-systemd.packages) will make you able to start the service via `systemctl --user start`, but it -won\'t start automatically on login. However, You can imperatively -enable it by adding the package\'s attribute to +won't start automatically on login. However, You can imperatively +enable it by adding the package's attribute to [](#opt-systemd.packages) and then do this (e.g): ```ShellSession @@ -113,7 +113,7 @@ If you are interested in a timer file, use `timers.target.wants` instead of `default.target.wants` in the 1st and 2nd command. Using `systemctl --user enable syncthing.service` instead of the above, -will work, but it\'ll use the absolute path of `syncthing.service` for +will work, but it'll use the absolute path of `syncthing.service` for the symlink, and this path is in `/nix/store/.../lib/systemd/user/`. Hence [garbage collection](#sec-nix-gc) will remove that file and you will wind up with a broken symlink in your systemd configuration, which diff --git a/nixos/doc/manual/configuration/gpu-accel.chapter.md b/nixos/doc/manual/configuration/gpu-accel.chapter.md index 835cbad55485..aa41e25e56f3 100644 --- a/nixos/doc/manual/configuration/gpu-accel.chapter.md +++ b/nixos/doc/manual/configuration/gpu-accel.chapter.md @@ -159,6 +159,40 @@ environment.variables.VK_ICD_FILENAMES = "/run/opengl-driver/share/vulkan/icd.d/radeon_icd.x86_64.json"; ``` +## VA-API {#sec-gpu-accel-va-api} + +[VA-API (Video Acceleration API)](https://www.intel.com/content/www/us/en/developer/articles/technical/linuxmedia-vaapi.html) +is an open-source library and API specification, which provides access to +graphics hardware acceleration capabilities for video processing. + +VA-API drivers are loaded by `libva`. The version in nixpkgs is built to search +the opengl driver path, so drivers can be installed in +[](#opt-hardware.opengl.extraPackages). + +VA-API can be tested using: + +```ShellSession +$ nix-shell -p libva-utils --run vainfo +``` + +### Intel {#sec-gpu-accel-va-api-intel} + +Modern Intel GPUs use the iHD driver, which can be installed with: + +```nix +hardware.opengl.extraPackages = [ + intel-media-driver +]; +``` + +Older Intel GPUs use the i965 driver, which can be installed with: + +```nix +hardware.opengl.extraPackages = [ + vaapiIntel +]; +``` + ## Common issues {#sec-gpu-accel-common-issues} ### User permissions {#sec-gpu-accel-common-issues-permissions} diff --git a/nixos/doc/manual/configuration/kubernetes.chapter.md b/nixos/doc/manual/configuration/kubernetes.chapter.md index 5d7b083289d9..f39726090e43 100644 --- a/nixos/doc/manual/configuration/kubernetes.chapter.md +++ b/nixos/doc/manual/configuration/kubernetes.chapter.md @@ -17,7 +17,7 @@ services.kubernetes = { }; ``` -Another way is to assign cluster roles (\"master\" and/or \"node\") to +Another way is to assign cluster roles ("master" and/or "node") to the host. This enables apiserver, controllerManager, scheduler, addonManager, kube-proxy and etcd: diff --git a/nixos/doc/manual/configuration/linux-kernel.chapter.md b/nixos/doc/manual/configuration/linux-kernel.chapter.md index 7b84416a8646..f5bce99dd1bb 100644 --- a/nixos/doc/manual/configuration/linux-kernel.chapter.md +++ b/nixos/doc/manual/configuration/linux-kernel.chapter.md @@ -82,61 +82,68 @@ boot.kernel.sysctl."net.ipv4.tcp_keepalive_time" = 120; sets the kernel's TCP keepalive time to 120 seconds. To see the available parameters, run `sysctl -a`. -## Customize your kernel {#sec-linux-config-customizing} +## Building a custom kernel {#sec-linux-config-customizing} -The first step before compiling the kernel is to generate an appropriate -`.config` configuration. Either you pass your own config via the -`configfile` setting of `linuxKernel.manualConfig`: +You can customize the default kernel configuration by overriding the arguments for your kernel package: ```nix -custom-kernel = let base_kernel = linuxKernel.kernels.linux_4_9; - in super.linuxKernel.manualConfig { - inherit (super) stdenv hostPlatform; - inherit (base_kernel) src; - version = "${base_kernel.version}-custom"; - - configfile = /home/me/my_kernel_config; - allowImportFromDerivation = true; -}; +pkgs.linux_latest.override { + ignoreConfigErrors = true; + autoModules = false; + kernelPreferBuiltin = true; + extraStructuredConfig = with lib.kernel; { + DEBUG_KERNEL = yes; + FRAME_POINTER = yes; + KGDB = yes; + KGDB_SERIAL_CONSOLE = yes; + DEBUG_INFO = yes; + }; +} ``` -You can edit the config with this snippet (by default `make - menuconfig` won\'t work out of the box on nixos): +See `pkgs/os-specific/linux/kernel/generic.nix` for details on how these arguments +affect the generated configuration. You can also build a custom version of Linux by calling +`pkgs.buildLinux` directly, which requires the `src` and `version` arguments to be specified. -```ShellSession -nix-shell -E 'with import <nixpkgs> {}; kernelToOverride.overrideAttrs (o: {nativeBuildInputs=o.nativeBuildInputs ++ [ pkg-config ncurses ];})' +To use your custom kernel package in your NixOS configuration, set + +```nix +boot.kernelPackages = pkgs.linuxPackagesFor yourCustomKernel; ``` -or you can let nixpkgs generate the configuration. Nixpkgs generates it -via answering the interactive kernel utility `make config`. The answers -depend on parameters passed to -`pkgs/os-specific/linux/kernel/generic.nix` (which you can influence by -overriding `extraConfig, autoModules, - modDirVersion, preferBuiltin, extraConfig`). +Note that this method will use the common configuration defined in `pkgs/os-specific/linux/kernel/common-config.nix`, +which is suitable for a NixOS system. + +If you already have a generated configuration file, you can build a kernel that uses it with `pkgs.linuxManualConfig`: ```nix -mptcp93.override ({ - name="mptcp-local"; +let + baseKernel = pkgs.linux_latest; +in pkgs.linuxManualConfig { + inherit (baseKernel) src modDirVersion; + version = "${baseKernel.version}-custom"; + configfile = ./my_kernel_config; + allowImportFromDerivation = true; +} +``` - ignoreConfigErrors = true; - autoModules = false; - kernelPreferBuiltin = true; +::: {.note} +The build will fail if `modDirVersion` does not match the source's `kernel.release` file, +so `modDirVersion` should remain tied to `src`. +::: - enableParallelBuilding = true; +To edit the `.config` file for Linux X.Y, proceed as follows: - extraConfig = '' - DEBUG_KERNEL y - FRAME_POINTER y - KGDB y - KGDB_SERIAL_CONSOLE y - DEBUG_INFO y - ''; -}); +```ShellSession +$ nix-shell '<nixpkgs>' -A linuxKernel.kernels.linux_X_Y.configEnv +$ unpackPhase +$ cd linux-* +$ make nconfig ``` ## Developing kernel modules {#sec-linux-config-developing-modules} -When developing kernel modules it\'s often convenient to run +When developing kernel modules it's often convenient to run edit-compile-run loop as quickly as possible. See below snippet as an example of developing `mellanox` drivers. diff --git a/nixos/doc/manual/configuration/profiles.chapter.md b/nixos/doc/manual/configuration/profiles.chapter.md index b4ae1b7d3faa..2c3dea27c181 100644 --- a/nixos/doc/manual/configuration/profiles.chapter.md +++ b/nixos/doc/manual/configuration/profiles.chapter.md @@ -2,7 +2,7 @@ In some cases, it may be desirable to take advantage of commonly-used, predefined configurations provided by nixpkgs, but different from those -that come as default. This is a role fulfilled by NixOS\'s Profiles, +that come as default. This is a role fulfilled by NixOS's Profiles, which come as files living in `<nixpkgs/nixos/modules/profiles>`. That is to say, expected usage is to add them to the imports list of your `/etc/configuration.nix` as such: diff --git a/nixos/doc/manual/configuration/profiles/hardened.section.md b/nixos/doc/manual/configuration/profiles/hardened.section.md index 9fb5e18c384a..2e9bb196c054 100644 --- a/nixos/doc/manual/configuration/profiles/hardened.section.md +++ b/nixos/doc/manual/configuration/profiles/hardened.section.md @@ -7,7 +7,7 @@ This includes a hardened kernel, and limiting the system information available to processes through the `/sys` and `/proc` filesystems. It also disables the User Namespaces feature of the kernel, which stops Nix from being able to build anything -(this particular setting can be overriden via +(this particular setting can be overridden via [](#opt-security.allowUserNamespaces)). See the [profile source](https://github.com/nixos/nixpkgs/tree/master/nixos/modules/profiles/hardened.nix) for further detail on which settings are altered. diff --git a/nixos/doc/manual/configuration/user-mgmt.chapter.md b/nixos/doc/manual/configuration/user-mgmt.chapter.md index 5c3aca3ef9e9..b35b38f6e964 100644 --- a/nixos/doc/manual/configuration/user-mgmt.chapter.md +++ b/nixos/doc/manual/configuration/user-mgmt.chapter.md @@ -30,7 +30,7 @@ to your NixOS configuration. For instance, if you remove a user from [](#opt-users.users) and run nixos-rebuild, the user account will cease to exist. Also, imperative commands for managing users and groups, such as useradd, are no longer available. Passwords may still be -assigned by setting the user\'s +assigned by setting the user's [hashedPassword](#opt-users.users._name_.hashedPassword) option. A hashed password can be generated using `mkpasswd`. diff --git a/nixos/doc/manual/configuration/wayland.chapter.md b/nixos/doc/manual/configuration/wayland.chapter.md index a3a46aa3da6f..0f195bd66567 100644 --- a/nixos/doc/manual/configuration/wayland.chapter.md +++ b/nixos/doc/manual/configuration/wayland.chapter.md @@ -4,7 +4,7 @@ While X11 (see [](#sec-x11)) is still the primary display technology on NixOS, Wayland support is steadily improving. Where X11 separates the X Server and the window manager, on Wayland those are combined: a Wayland Compositor is like an X11 window manager, but also embeds the -Wayland \'Server\' functionality. This means it is sufficient to install +Wayland 'Server' functionality. This means it is sufficient to install a Wayland Compositor such as sway without separately enabling a Wayland server: diff --git a/nixos/doc/manual/configuration/wireless.section.md b/nixos/doc/manual/configuration/wireless.section.md index 6b223d843ac5..3299d2d7ecb8 100644 --- a/nixos/doc/manual/configuration/wireless.section.md +++ b/nixos/doc/manual/configuration/wireless.section.md @@ -50,7 +50,7 @@ networking.wireless.networks = { echelon = { pskRaw = "dca6d6ed41f4ab5a984c9f55f6f66d4efdc720ebf66959810f4329bb391c5435"; }; -} +}; ``` or you can use it to directly generate the `wpa_supplicant.conf`: diff --git a/nixos/doc/manual/configuration/x-windows.chapter.md b/nixos/doc/manual/configuration/x-windows.chapter.md index 27d117238807..f92403ed1c4c 100644 --- a/nixos/doc/manual/configuration/x-windows.chapter.md +++ b/nixos/doc/manual/configuration/x-windows.chapter.md @@ -81,7 +81,7 @@ second password to login can be redundant. To enable auto-login, you need to define your default window manager and desktop environment. If you wanted no desktop environment and i3 as your -your window manager, you\'d define: +your window manager, you'd define: ```nix services.xserver.displayManager.defaultSession = "none+i3"; @@ -110,7 +110,7 @@ maintained but may perform worse in some cases (like in old chipsets). The second driver, `intel`, is specific to Intel GPUs, but not recommended by most distributions: it lacks several modern features (for -example, it doesn\'t support Glamor) and the package hasn\'t been +example, it doesn't support Glamor) and the package hasn't been officially updated since 2015. The results vary depending on the hardware, so you may have to try both @@ -162,7 +162,7 @@ with other kernel modules. AMD provides a proprietary driver for its graphics cards that is not enabled by default because it's not Free Software, is often broken in -nixpkgs and as of this writing doesn\'t offer more features or +nixpkgs and as of this writing doesn't offer more features or performance. If you still want to use it anyway, you need to explicitly set: @@ -215,7 +215,7 @@ US layout, with an additional layer to type some greek symbols by pressing the right-alt key. Create a file called `us-greek` with the following content (under a -directory called `symbols`; it\'s an XKB peculiarity that will help with +directory called `symbols`; it's an XKB peculiarity that will help with testing): ```nix @@ -249,7 +249,7 @@ The name (after `extraLayouts.`) should match the one given to the Applying this customization requires rebuilding several packages, and a broken XKB file can lead to the X session crashing at login. Therefore, -you\'re strongly advised to **test your layout before applying it**: +you're strongly advised to **test your layout before applying it**: ```ShellSession $ nix-shell -p xorg.xkbcomp @@ -313,8 +313,8 @@ prefer to keep the layout definitions inside the NixOS configuration. Unfortunately, the Xorg server does not (currently) support setting a keymap directly but relies instead on XKB rules to select the matching -components (keycodes, types, \...) of a layout. This means that -components other than symbols won\'t be loaded by default. As a +components (keycodes, types, ...) of a layout. This means that +components other than symbols won't be loaded by default. As a workaround, you can set the keymap using `setxkbmap` at the start of the session with: @@ -323,7 +323,7 @@ services.xserver.displayManager.sessionCommands = "setxkbmap -keycodes media"; ``` If you are manually starting the X server, you should set the argument -`-xkbdir /etc/X11/xkb`, otherwise X won\'t find your layout files. For +`-xkbdir /etc/X11/xkb`, otherwise X won't find your layout files. For example with `xinit` run ```ShellSession diff --git a/nixos/doc/manual/configuration/xfce.chapter.md b/nixos/doc/manual/configuration/xfce.chapter.md index ee60d465e3b3..c331e63cfe54 100644 --- a/nixos/doc/manual/configuration/xfce.chapter.md +++ b/nixos/doc/manual/configuration/xfce.chapter.md @@ -31,8 +31,8 @@ enabled. To enable Thunar without enabling Xfce, use the configuration option [](#opt-programs.thunar.enable) instead of simply adding `pkgs.xfce.thunar` to [](#opt-environment.systemPackages). -If you\'d like to add extra plugins to Thunar, add them to -[](#opt-programs.thunar.plugins). You shouldn\'t just add them to +If you'd like to add extra plugins to Thunar, add them to +[](#opt-programs.thunar.plugins). You shouldn't just add them to [](#opt-environment.systemPackages). ## Troubleshooting {#sec-xfce-troubleshooting .unnumbered} @@ -46,7 +46,7 @@ Thunar:2410): GVFS-RemoteVolumeMonitor-WARNING **: remote volume monitor with db ``` This is caused by some needed GNOME services not running. This is all -fixed by enabling \"Launch GNOME services on startup\" in the Advanced +fixed by enabling "Launch GNOME services on startup" in the Advanced tab of the Session and Startup settings panel. Alternatively, you can run this command to do the same thing. diff --git a/nixos/doc/manual/contributing-to-this-manual.chapter.md b/nixos/doc/manual/contributing-to-this-manual.chapter.md index 26813d1042d6..557599809222 100644 --- a/nixos/doc/manual/contributing-to-this-manual.chapter.md +++ b/nixos/doc/manual/contributing-to-this-manual.chapter.md @@ -1,6 +1,6 @@ # Contributing to this manual {#chap-contributing} -The DocBook and CommonMark sources of NixOS' manual are in the [nixos/doc/manual](https://github.com/NixOS/nixpkgs/tree/master/nixos/doc/manual) subdirectory of the [Nixpkgs](https://github.com/NixOS/nixpkgs) repository. +The [DocBook] and CommonMark sources of the NixOS manual are in the [nixos/doc/manual](https://github.com/NixOS/nixpkgs/tree/master/nixos/doc/manual) subdirectory of the [Nixpkgs](https://github.com/NixOS/nixpkgs) repository. You can quickly check your edits with the following: @@ -11,3 +11,25 @@ $ nix-build nixos/release.nix -A manual.x86_64-linux ``` If the build succeeds, the manual will be in `./result/share/doc/nixos/index.html`. + +**Contributing to the man pages** + +The man pages are written in [DocBook] which is XML. + +To see what your edits look like: + +```ShellSession +$ cd /path/to/nixpkgs +$ nix-build nixos/release.nix -A manpages.x86_64-linux +``` + +You can then read the man page you edited by running + +```ShellSession +$ man --manpath=result/share/man nixos-rebuild # Replace nixos-rebuild with the command whose manual you edited +``` + +If you're on a different architecture that's supported by NixOS (check nixos/release.nix) then replace `x86_64-linux` with the architecture. +`nix-build` will complain otherwise, but should also tell you which architecture you have + the supported ones. + +[DocBook]: https://en.wikipedia.org/wiki/DocBook diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix index 6db20cdd6418..9b72e840f4b1 100644 --- a/nixos/doc/manual/default.nix +++ b/nixos/doc/manual/default.nix @@ -102,11 +102,14 @@ let ''; manualXsltprocOptions = toString [ - "--param section.autolabel 1" - "--param section.label.includes.component.label 1" + "--param chapter.autolabel 0" + "--param part.autolabel 0" + "--param preface.autolabel 0" + "--param reference.autolabel 0" + "--param section.autolabel 0" "--stringparam html.stylesheet 'style.css overrides.css highlightjs/mono-blue.css'" "--stringparam html.script './highlightjs/highlight.pack.js ./highlightjs/loader.js'" - "--param xref.with.number.and.title 1" + "--param xref.with.number.and.title 0" "--param toc.section.depth 0" "--param generate.consistent.ids 1" "--stringparam admon.style ''" diff --git a/nixos/doc/manual/development/activation-script.section.md b/nixos/doc/manual/development/activation-script.section.md index 1aee252fddea..c339258c6dc4 100644 --- a/nixos/doc/manual/development/activation-script.section.md +++ b/nixos/doc/manual/development/activation-script.section.md @@ -34,7 +34,7 @@ read which is set to `dry-activate` when a dry activation is done. An activation script can write to special files instructing `switch-to-configuration` to restart/reload units. The script will take these -requests into account and will incorperate the unit configuration as described +requests into account and will incorporate the unit configuration as described above. This means that the activation script will "fake" a modified unit file and `switch-to-configuration` will act accordingly. By doing so, configuration like [systemd.services.\<name\>.restartIfChanged](#opt-systemd.services) is @@ -49,7 +49,7 @@ dry activation being `/run/nixos/dry-activation-restart-list` and `/run/nixos/dry-activation-reload-list`. Those files can contain newline-separated lists of unit names where duplicates are being ignored. These files are not create automatically and activation scripts must take the -possiblility into account that they have to create them first. +possibility into account that they have to create them first. ## NixOS snippets {#sec-activation-script-nixos-snippets} diff --git a/nixos/doc/manual/development/bootspec.chapter.md b/nixos/doc/manual/development/bootspec.chapter.md new file mode 100644 index 000000000000..96c12f24e7f1 --- /dev/null +++ b/nixos/doc/manual/development/bootspec.chapter.md @@ -0,0 +1,36 @@ +# Experimental feature: Bootspec {#sec-experimental-bootspec} + +Bootspec is a experimental feature, introduced in the [RFC-0125 proposal](https://github.com/NixOS/rfcs/pull/125), the reference implementation can be found [there](https://github.com/NixOS/nixpkgs/pull/172237) in order to standardize bootloader support +and advanced boot workflows such as SecureBoot and potentially more. + +You can enable the creation of bootspec documents through [`boot.bootspec.enable = true`](options.html#opt-boot.bootspec.enable), which will prompt a warning until [RFC-0125](https://github.com/NixOS/rfcs/pull/125) is officially merged. + +## Schema {#sec-experimental-bootspec-schema} + +The bootspec schema is versioned and validated against [a CUE schema file](https://cuelang.org/) which should considered as the source of truth for your applications. + +You will find the current version [here](../../../modules/system/activation/bootspec.cue). + +## Extensions mechanism {#sec-experimental-bootspec-extensions} + +Bootspec cannot account for all usecases. + +For this purpose, Bootspec offers a generic extension facility [`boot.bootspec.extensions`](options.html#opt-boot.bootspec.extensions) which can be used to inject any data needed for your usecases. + +An example for SecureBoot is to get the Nix store path to `/etc/os-release` in order to bake it into a unified kernel image: + +```nix +{ config, lib, ... }: { + boot.bootspec.extensions = { + "org.secureboot.osRelease" = config.environment.etc."os-release".source; + }; +} +``` + +To reduce incompatibility and prevent names from clashing between applications, it is **highly recommended** to use a unique namespace for your extensions. + +## External bootloaders {#sec-experimental-bootspec-external-bootloaders} + +It is possible to enable your own bootloader through [`boot.loader.external.installHook`](options.html#opt-boot.loader.external.installHook) which can wrap an existing bootloader. + +Currently, there is no good story to compose existing bootloaders to enrich their features, e.g. SecureBoot, etc. It will be necessary to reimplement or reuse existing parts. diff --git a/nixos/doc/manual/development/development.xml b/nixos/doc/manual/development/development.xml index 624ee3931659..949468c9021d 100644 --- a/nixos/doc/manual/development/development.xml +++ b/nixos/doc/manual/development/development.xml @@ -12,6 +12,7 @@ <xi:include href="../from_md/development/sources.chapter.xml" /> <xi:include href="../from_md/development/writing-modules.chapter.xml" /> <xi:include href="../from_md/development/building-parts.chapter.xml" /> + <xi:include href="../from_md/development/bootspec.chapter.xml" /> <xi:include href="../from_md/development/what-happens-during-a-system-switch.chapter.xml" /> <xi:include href="../from_md/development/writing-documentation.chapter.xml" /> <xi:include href="../from_md/development/nixos-tests.chapter.xml" /> diff --git a/nixos/doc/manual/development/option-declarations.section.md b/nixos/doc/manual/development/option-declarations.section.md index 88617ab1920a..f89aae573068 100644 --- a/nixos/doc/manual/development/option-declarations.section.md +++ b/nixos/doc/manual/development/option-declarations.section.md @@ -149,7 +149,7 @@ multiple modules, or as an alternative to related `enable` options. As an example, we will take the case of display managers. There is a central display manager module for generic display manager options and a -module file per display manager backend (sddm, gdm \...). +module file per display manager backend (sddm, gdm ...). There are two approaches we could take with this module structure: diff --git a/nixos/doc/manual/development/option-types.section.md b/nixos/doc/manual/development/option-types.section.md index 40b4d78b250e..0e9c4a4d16be 100644 --- a/nixos/doc/manual/development/option-types.section.md +++ b/nixos/doc/manual/development/option-types.section.md @@ -92,11 +92,11 @@ merging is handled. : A free-form attribute set. ::: {.warning} - This type will be deprecated in the future because it doesn\'t + This type will be deprecated in the future because it doesn't recurse into attribute sets, silently drops earlier attribute - definitions, and doesn\'t discharge `lib.mkDefault`, `lib.mkIf` + definitions, and doesn't discharge `lib.mkDefault`, `lib.mkIf` and co. For allowing arbitrary attribute sets, prefer - `types.attrsOf types.anything` instead which doesn\'t have these + `types.attrsOf types.anything` instead which doesn't have these problems. ::: @@ -222,7 +222,7 @@ Submodules are detailed in [Submodule](#section-option-types-submodule). - *`specialArgs`* An attribute set of extra arguments to be passed to the module functions. The option `_module.args` should be used instead for most arguments since it allows overriding. - *`specialArgs`* should only be used for arguments that can\'t go + *`specialArgs`* should only be used for arguments that can't go through the module fixed-point, because of infinite recursion or other problems. An example is overriding the `lib` argument, because `lib` itself is used to define `_module.args`, which @@ -236,7 +236,7 @@ Submodules are detailed in [Submodule](#section-option-types-submodule). In such a case it would allow the option to be set with `the-submodule.config = "value"` instead of requiring `the-submodule.config.config = "value"`. This is because - only when modules *don\'t* set the `config` or `options` + only when modules *don't* set the `config` or `options` keys, all keys are interpreted as option definitions in the `config` section. Enabling this option implicitly puts all attributes in the `config` section. @@ -324,7 +324,7 @@ Composed types are types that take a type as parameter. `listOf : Type *`t1`* or type *`t2`*, e.g. `with types; either int str`. Multiple definitions cannot be merged. -`types.oneOf` \[ *`t1 t2`* \... \] +`types.oneOf` \[ *`t1 t2`* ... \] : Type *`t1`* or type *`t2`* and so forth, e.g. `with types; oneOf [ int str bool ]`. Multiple definitions cannot be @@ -345,7 +345,7 @@ that are handled like a separate module. It takes a parameter *`o`*, that should be a set, or a function returning a set with an `options` key defining the sub-options. Submodule option definitions are type-checked accordingly to the `options` declarations. -Of course, you can nest submodule option definitons for even higher +Of course, you can nest submodule option definitions for even higher modularity. The option set can be defined directly diff --git a/nixos/doc/manual/development/replace-modules.section.md b/nixos/doc/manual/development/replace-modules.section.md index 0700a82004c1..0c0d6a7ac2f1 100644 --- a/nixos/doc/manual/development/replace-modules.section.md +++ b/nixos/doc/manual/development/replace-modules.section.md @@ -2,7 +2,7 @@ Modules that are imported can also be disabled. The option declarations, config implementation and the imports of a disabled module will be -ignored, allowing another to take it\'s place. This can be used to +ignored, allowing another to take its place. This can be used to import a set of modules from another channel while keeping the rest of the system on a stable release. @@ -14,7 +14,7 @@ relative to the modules path (eg. \<nixpkgs/nixos/modules> for nixos). This example will replace the existing postgresql module with the version defined in the nixos-unstable channel while keeping the rest of the modules and packages from the original nixos channel. This only -overrides the module definition, this won\'t use postgresql from +overrides the module definition, this won't use postgresql from nixos-unstable unless explicitly configured to do so. ```nix @@ -35,7 +35,7 @@ nixos-unstable unless explicitly configured to do so. This example shows how to define a custom module as a replacement for an existing module. Importing this module will disable the original module -without having to know it\'s implementation details. +without having to know its implementation details. ```nix { config, lib, pkgs, ... }: diff --git a/nixos/doc/manual/development/settings-options.section.md b/nixos/doc/manual/development/settings-options.section.md index d569e23adbdc..334149d021cb 100644 --- a/nixos/doc/manual/development/settings-options.section.md +++ b/nixos/doc/manual/development/settings-options.section.md @@ -9,10 +9,10 @@ can be declared. File formats can be separated into two categories: `{ foo = { bar = 10; }; }`. Other examples are INI, YAML and TOML. The following section explains the convention for these settings. -- Non-nix-representable ones: These can\'t be trivially mapped to a +- Non-nix-representable ones: These can't be trivially mapped to a subset of Nix syntax. Most generic programming languages are in this group, e.g. bash, since the statement `if true; then echo hi; fi` - doesn\'t have a trivial representation in Nix. + doesn't have a trivial representation in Nix. Currently there are no fixed conventions for these, but it is common to have a `configFile` option for setting the configuration file @@ -24,7 +24,7 @@ can be declared. File formats can be separated into two categories: an `extraConfig` option of type `lines` to allow arbitrary text after the autogenerated part of the file. -## Nix-representable Formats (JSON, YAML, TOML, INI, \...) {#sec-settings-nix-representable} +## Nix-representable Formats (JSON, YAML, TOML, INI, ...) {#sec-settings-nix-representable} By convention, formats like this are handled with a generic `settings` option, representing the full program configuration as a Nix value. The diff --git a/nixos/doc/manual/development/writing-documentation.chapter.md b/nixos/doc/manual/development/writing-documentation.chapter.md index 7c29f600d701..4986c9f0a81b 100644 --- a/nixos/doc/manual/development/writing-documentation.chapter.md +++ b/nixos/doc/manual/development/writing-documentation.chapter.md @@ -19,7 +19,7 @@ $ nix-shell nix-shell$ make ``` -Once you are done making modifications to the manual, it\'s important to +Once you are done making modifications to the manual, it's important to build it before committing. You can do that as follows: ```ShellSession diff --git a/nixos/doc/manual/development/writing-modules.chapter.md b/nixos/doc/manual/development/writing-modules.chapter.md index 0c41cbd3cb75..fa24679b7fc8 100644 --- a/nixos/doc/manual/development/writing-modules.chapter.md +++ b/nixos/doc/manual/development/writing-modules.chapter.md @@ -71,7 +71,7 @@ The meaning of each part is as follows. - This `imports` list enumerates the paths to other NixOS modules that should be included in the evaluation of the system configuration. A default set of modules is defined in the file `modules/module-list.nix`. - These don\'t need to be added in the import list. + These don't need to be added in the import list. - The attribute `options` is a nested set of *option declarations* (described below). diff --git a/nixos/doc/manual/development/writing-nixos-tests.section.md b/nixos/doc/manual/development/writing-nixos-tests.section.md index 2efe52b9883c..0d5bc76a2aa5 100644 --- a/nixos/doc/manual/development/writing-nixos-tests.section.md +++ b/nixos/doc/manual/development/writing-nixos-tests.section.md @@ -165,7 +165,7 @@ The following methods are available on machine objects: `get_screen_text_variants` : Return a list of different interpretations of what is currently - visible on the machine\'s screen using optical character + visible on the machine's screen using optical character recognition. The number and order of the interpretations is not specified and is subject to change, but if no exception is raised at least one will be returned. @@ -177,7 +177,7 @@ The following methods are available on machine objects: `get_screen_text` : Return a textual representation of what is currently visible on the - machine\'s screen using optical character recognition. + machine's screen using optical character recognition. ::: {.note} This requires [`enableOCR`](#test-opt-enableOCR) to be set to `true`. @@ -298,7 +298,7 @@ The following methods are available on machine objects: : Wait until the supplied regular expressions match a line of the serial console output. This method is useful when OCR is not - possibile or accurate enough. + possible or accurate enough. `wait_for_window` @@ -350,8 +350,8 @@ machine.wait_for_unit("xautolock.service", "x-session-user") This applies to `systemctl`, `get_unit_info`, `wait_for_unit`, `start_job` and `stop_job`. -For faster dev cycles it\'s also possible to disable the code-linters -(this shouldn\'t be commited though): +For faster dev cycles it's also possible to disable the code-linters +(this shouldn't be committed though): ```nix { @@ -370,7 +370,7 @@ For faster dev cycles it\'s also possible to disable the code-linters This will produce a Nix warning at evaluation time. To fully disable the linter, wrap the test script in comment directives to disable the Black -linter directly (again, don\'t commit this within the Nixpkgs +linter directly (again, don't commit this within the Nixpkgs repository): ```nix diff --git a/nixos/doc/manual/from_md/administration/cleaning-store.chapter.xml b/nixos/doc/manual/from_md/administration/cleaning-store.chapter.xml index 4243d2bf53f9..35dfaf30f457 100644 --- a/nixos/doc/manual/from_md/administration/cleaning-store.chapter.xml +++ b/nixos/doc/manual/from_md/administration/cleaning-store.chapter.xml @@ -23,7 +23,7 @@ $ nix-collect-garbage this unit automatically at certain points in time, for instance, every night at 03:15: </para> - <programlisting language="bash"> + <programlisting language="nix"> nix.gc.automatic = true; nix.gc.dates = "03:15"; </programlisting> diff --git a/nixos/doc/manual/from_md/administration/container-networking.section.xml b/nixos/doc/manual/from_md/administration/container-networking.section.xml index 788a2b7b0acb..a64053cdfa5e 100644 --- a/nixos/doc/manual/from_md/administration/container-networking.section.xml +++ b/nixos/doc/manual/from_md/administration/container-networking.section.xml @@ -31,7 +31,7 @@ $ ping -c1 10.233.4.2 address. This can be accomplished using the following configuration on the host: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.nat.enable = true; networking.nat.internalInterfaces = ["ve-+"]; networking.nat.externalInterface = "eth0"; @@ -45,7 +45,7 @@ networking.nat.externalInterface = "eth0"; If you are using Network Manager, you need to explicitly prevent it from managing container interfaces: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.networkmanager.unmanaged = [ "interface-name:ve-*" ]; </programlisting> <para> diff --git a/nixos/doc/manual/from_md/administration/control-groups.chapter.xml b/nixos/doc/manual/from_md/administration/control-groups.chapter.xml index 8dab2c9d44b4..f78c05878031 100644 --- a/nixos/doc/manual/from_md/administration/control-groups.chapter.xml +++ b/nixos/doc/manual/from_md/administration/control-groups.chapter.xml @@ -42,7 +42,7 @@ $ systemd-cgls process would get 1/1001 of the cgroup’s CPU time.) You can limit a service’s CPU share in <literal>configuration.nix</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> systemd.services.httpd.serviceConfig.CPUShares = 512; </programlisting> <para> @@ -57,7 +57,7 @@ systemd.services.httpd.serviceConfig.CPUShares = 512; <literal>configuration.nix</literal>; for instance, to limit <literal>httpd.service</literal> to 512 MiB of RAM (excluding swap): </para> - <programlisting language="bash"> + <programlisting language="nix"> systemd.services.httpd.serviceConfig.MemoryLimit = "512M"; </programlisting> <para> diff --git a/nixos/doc/manual/from_md/administration/declarative-containers.section.xml b/nixos/doc/manual/from_md/administration/declarative-containers.section.xml index 4831c9c74e84..efc3432ba1a1 100644 --- a/nixos/doc/manual/from_md/administration/declarative-containers.section.xml +++ b/nixos/doc/manual/from_md/administration/declarative-containers.section.xml @@ -6,7 +6,7 @@ following specifies that there shall be a container named <literal>database</literal> running PostgreSQL: </para> - <programlisting language="bash"> + <programlisting language="nix"> containers.database = { config = { config, pkgs, ... }: @@ -29,7 +29,7 @@ containers.database = However, they cannot change the network configuration. You can give a container its own network as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> containers.database = { privateNetwork = true; hostAddress = "192.168.100.10"; diff --git a/nixos/doc/manual/from_md/administration/service-mgmt.chapter.xml b/nixos/doc/manual/from_md/administration/service-mgmt.chapter.xml index 8b01b8f896a4..3b7bd6cd30cf 100644 --- a/nixos/doc/manual/from_md/administration/service-mgmt.chapter.xml +++ b/nixos/doc/manual/from_md/administration/service-mgmt.chapter.xml @@ -85,21 +85,21 @@ Jan 07 15:55:57 hagbard systemd[1]: Started PostgreSQL Server. Packages in Nixpkgs sometimes provide systemd units with them, usually in e.g <literal>#pkg-out#/lib/systemd/</literal>. Putting such a package in <literal>environment.systemPackages</literal> - doesn't make the service available to users or the system. + doesn’t make the service available to users or the system. </para> <para> In order to enable a systemd <emphasis>system</emphasis> service with provided upstream package, use (e.g): </para> - <programlisting language="bash"> + <programlisting language="nix"> systemd.packages = [ pkgs.packagekit ]; </programlisting> <para> Usually NixOS modules written by the community do the above, plus take care of other details. If a module was written for a service - you are interested in, you'd probably need only to use + you are interested in, you’d probably need only to use <literal>services.#name#.enable = true;</literal>. These services - are defined in Nixpkgs' + are defined in Nixpkgs’ <link xlink:href="https://github.com/NixOS/nixpkgs/tree/master/nixos/modules"> <literal>nixos/modules/</literal> directory </link>. In case the service is simple enough, the above method should work, and start @@ -111,8 +111,8 @@ systemd.packages = [ pkgs.packagekit ]; unit file at <literal>#pkg-out#/lib/systemd/user/</literal>, using <xref linkend="opt-systemd.packages" /> will make you able to start the service via <literal>systemctl --user start</literal>, - but it won't start automatically on login. However, You can - imperatively enable it by adding the package's attribute to + but it won’t start automatically on login. However, You can + imperatively enable it by adding the package’s attribute to <xref linkend="opt-systemd.packages" /> and then do this (e.g): </para> <programlisting> @@ -129,7 +129,7 @@ $ systemctl --user enable syncthing.service </para> <para> Using <literal>systemctl --user enable syncthing.service</literal> - instead of the above, will work, but it'll use the absolute path + instead of the above, will work, but it’ll use the absolute path of <literal>syncthing.service</literal> for the symlink, and this path is in <literal>/nix/store/.../lib/systemd/user/</literal>. Hence <link linkend="sec-nix-gc">garbage collection</link> will diff --git a/nixos/doc/manual/from_md/configuration/abstractions.section.xml b/nixos/doc/manual/from_md/configuration/abstractions.section.xml index c71e23e34adf..469e85979e0f 100644 --- a/nixos/doc/manual/from_md/configuration/abstractions.section.xml +++ b/nixos/doc/manual/from_md/configuration/abstractions.section.xml @@ -4,7 +4,7 @@ If you find yourself repeating yourself over and over, it’s time to abstract. Take, for instance, this Apache HTTP Server configuration: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.httpd.virtualHosts = { "blog.example.org" = { @@ -29,7 +29,7 @@ the only difference is the document root directories. To prevent this duplication, we can use a <literal>let</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> let commonConfig = { adminAddr = "alice@example.org"; @@ -55,7 +55,7 @@ in You can write a <literal>let</literal> wherever an expression is allowed. Thus, you also could have written: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.httpd.virtualHosts = let commonConfig = ...; in @@ -74,7 +74,7 @@ in of different virtual hosts, all with identical configuration except for the document root. This can be done as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.httpd.virtualHosts = let diff --git a/nixos/doc/manual/from_md/configuration/ad-hoc-network-config.section.xml b/nixos/doc/manual/from_md/configuration/ad-hoc-network-config.section.xml index 035ee3122e15..516022dc16d2 100644 --- a/nixos/doc/manual/from_md/configuration/ad-hoc-network-config.section.xml +++ b/nixos/doc/manual/from_md/configuration/ad-hoc-network-config.section.xml @@ -7,7 +7,7 @@ network configuration not covered by the existing NixOS modules. For instance, to statically configure an IPv6 address: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.localCommands = '' ip -6 addr add 2001:610:685:1::1/64 dev eth0 diff --git a/nixos/doc/manual/from_md/configuration/adding-custom-packages.section.xml b/nixos/doc/manual/from_md/configuration/adding-custom-packages.section.xml index 07f541666cbe..b1a1a8df3247 100644 --- a/nixos/doc/manual/from_md/configuration/adding-custom-packages.section.xml +++ b/nixos/doc/manual/from_md/configuration/adding-custom-packages.section.xml @@ -28,7 +28,7 @@ $ cd nixpkgs manual. Finally, you add it to <xref linkend="opt-environment.systemPackages" />, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> environment.systemPackages = [ pkgs.my-package ]; </programlisting> <para> @@ -45,7 +45,7 @@ environment.systemPackages = [ pkgs.my-package ]; Hello</link> package directly in <literal>configuration.nix</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> environment.systemPackages = let my-hello = with pkgs; stdenv.mkDerivation rec { @@ -62,13 +62,13 @@ environment.systemPackages = Of course, you can also move the definition of <literal>my-hello</literal> into a separate Nix expression, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> environment.systemPackages = [ (import ./my-hello.nix) ]; </programlisting> <para> where <literal>my-hello.nix</literal> contains: </para> - <programlisting language="bash"> + <programlisting language="nix"> with import <nixpkgs> {}; # bring all of Nixpkgs into scope stdenv.mkDerivation rec { @@ -98,7 +98,7 @@ Hello, world! need to install <literal>appimage-run</literal>: add to <literal>/etc/nixos/configuration.nix</literal> </para> - <programlisting language="bash"> + <programlisting language="nix"> environment.systemPackages = [ pkgs.appimage-run ]; </programlisting> <para> diff --git a/nixos/doc/manual/from_md/configuration/config-file.section.xml b/nixos/doc/manual/from_md/configuration/config-file.section.xml index 9792116eb08d..f6c8f70cffc5 100644 --- a/nixos/doc/manual/from_md/configuration/config-file.section.xml +++ b/nixos/doc/manual/from_md/configuration/config-file.section.xml @@ -3,7 +3,7 @@ <para> The NixOS configuration file generally looks like this: </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: { option definitions @@ -21,7 +21,7 @@ the name of an option and <literal>value</literal> is its value. For example, </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: { services.httpd.enable = true; @@ -44,7 +44,7 @@ <literal>true</literal>. This means that the example above can also be written as: </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: { services = { @@ -96,7 +96,7 @@ The option value `services.httpd.enable' in `/etc/nixos/configuration.nix' is no <para> Strings are enclosed in double quotes, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.hostName = "dexter"; </programlisting> <para> @@ -107,7 +107,7 @@ networking.hostName = "dexter"; Multi-line strings can be enclosed in <emphasis>double single quotes</emphasis>, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.extraHosts = '' 127.0.0.2 other-localhost @@ -135,7 +135,7 @@ networking.extraHosts = These can be <literal>true</literal> or <literal>false</literal>, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.firewall.enable = true; networking.firewall.allowPing = false; </programlisting> @@ -149,7 +149,7 @@ networking.firewall.allowPing = false; <para> For example, </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.kernel.sysctl."net.ipv4.tcp_keepalive_time" = 60; </programlisting> <para> @@ -171,7 +171,7 @@ boot.kernel.sysctl."net.ipv4.tcp_keepalive_time" = 60; Sets were introduced above. They are name/value pairs enclosed in braces, as in the option definition </para> - <programlisting language="bash"> + <programlisting language="nix"> fileSystems."/boot" = { device = "/dev/sda1"; fsType = "ext4"; @@ -189,13 +189,13 @@ fileSystems."/boot" = The important thing to note about lists is that list elements are separated by whitespace, like this: </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.kernelModules = [ "fuse" "kvm-intel" "coretemp" ]; </programlisting> <para> List elements can be any other type, e.g. sets: </para> - <programlisting language="bash"> + <programlisting language="nix"> swapDevices = [ { device = "/dev/disk/by-label/swap"; } ]; </programlisting> </listitem> @@ -211,7 +211,7 @@ swapDevices = [ { device = "/dev/disk/by-label/swap"; } ]; through the function argument <literal>pkgs</literal>. Typical uses: </para> - <programlisting language="bash"> + <programlisting language="nix"> environment.systemPackages = [ pkgs.thunderbird pkgs.emacs diff --git a/nixos/doc/manual/from_md/configuration/customizing-packages.section.xml b/nixos/doc/manual/from_md/configuration/customizing-packages.section.xml index f78b5dc5460c..8026c4102b48 100644 --- a/nixos/doc/manual/from_md/configuration/customizing-packages.section.xml +++ b/nixos/doc/manual/from_md/configuration/customizing-packages.section.xml @@ -22,7 +22,7 @@ a dependency on GTK 2. If you want to build it against GTK 3, you can specify that as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> environment.systemPackages = [ (pkgs.emacs.override { gtk = pkgs.gtk3; }) ]; </programlisting> <para> @@ -46,7 +46,7 @@ environment.systemPackages = [ (pkgs.emacs.override { gtk = pkgs.gtk3; }) ]; the package, such as the source code. For instance, if you want to override the source code of Emacs, you can say: </para> - <programlisting language="bash"> + <programlisting language="nix"> environment.systemPackages = [ (pkgs.emacs.overrideAttrs (oldAttrs: { name = "emacs-25.0-pre"; @@ -72,7 +72,7 @@ environment.systemPackages = [ everything depend on your customised instance, you can apply a <emphasis>global</emphasis> override as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> nixpkgs.config.packageOverrides = pkgs: { emacs = pkgs.emacs.override { gtk = pkgs.gtk3; }; }; diff --git a/nixos/doc/manual/from_md/configuration/declarative-packages.section.xml b/nixos/doc/manual/from_md/configuration/declarative-packages.section.xml index da31f18d9233..bee310c2e34b 100644 --- a/nixos/doc/manual/from_md/configuration/declarative-packages.section.xml +++ b/nixos/doc/manual/from_md/configuration/declarative-packages.section.xml @@ -7,7 +7,7 @@ adding the following line to <literal>configuration.nix</literal> enables the Mozilla Thunderbird email application: </para> - <programlisting language="bash"> + <programlisting language="nix"> environment.systemPackages = [ pkgs.thunderbird ]; </programlisting> <para> diff --git a/nixos/doc/manual/from_md/configuration/file-systems.chapter.xml b/nixos/doc/manual/from_md/configuration/file-systems.chapter.xml index 71441d8b4a5b..e5285c797555 100644 --- a/nixos/doc/manual/from_md/configuration/file-systems.chapter.xml +++ b/nixos/doc/manual/from_md/configuration/file-systems.chapter.xml @@ -7,7 +7,7 @@ <literal>/dev/disk/by-label/data</literal> onto the mount point <literal>/data</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> fileSystems."/data" = { device = "/dev/disk/by-label/data"; fsType = "ext4"; diff --git a/nixos/doc/manual/from_md/configuration/firewall.section.xml b/nixos/doc/manual/from_md/configuration/firewall.section.xml index 24c19bb1c66d..6e1ffab72c54 100644 --- a/nixos/doc/manual/from_md/configuration/firewall.section.xml +++ b/nixos/doc/manual/from_md/configuration/firewall.section.xml @@ -6,14 +6,14 @@ both IPv4 and IPv6 traffic. It is enabled by default. It can be disabled as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.firewall.enable = false; </programlisting> <para> If the firewall is enabled, you can open specific TCP ports to the outside world: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.firewall.allowedTCPPorts = [ 80 443 ]; </programlisting> <para> @@ -26,7 +26,7 @@ networking.firewall.allowedTCPPorts = [ 80 443 ]; <para> To open ranges of TCP ports: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.firewall.allowedTCPPortRanges = [ { from = 4000; to = 4007; } { from = 8000; to = 8010; } diff --git a/nixos/doc/manual/from_md/configuration/gpu-accel.chapter.xml b/nixos/doc/manual/from_md/configuration/gpu-accel.chapter.xml index cc559a1933d9..c95d3dc86525 100644 --- a/nixos/doc/manual/from_md/configuration/gpu-accel.chapter.xml +++ b/nixos/doc/manual/from_md/configuration/gpu-accel.chapter.xml @@ -62,7 +62,7 @@ Platform Vendor Advanced Micro Devices, Inc. <xref linkend="opt-hardware.opengl.extraPackages" /> enables OpenCL support: </para> - <programlisting language="bash"> + <programlisting language="nix"> hardware.opengl.extraPackages = [ rocm-opencl-icd ]; @@ -85,7 +85,7 @@ hardware.opengl.extraPackages = [ enable OpenCL support. For example, for Gen8 and later GPUs, the following configuration can be used: </para> - <programlisting language="bash"> + <programlisting language="nix"> hardware.opengl.extraPackages = [ intel-compute-runtime ]; @@ -162,7 +162,7 @@ GPU1: makes amdvlk the default driver and hides radv and lavapipe from the device list. A specific driver can be forced as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> hardware.opengl.extraPackages = [ pkgs.amdvlk ]; @@ -180,6 +180,48 @@ environment.variables.VK_ICD_FILENAMES = </programlisting> </section> </section> + <section xml:id="sec-gpu-accel-va-api"> + <title>VA-API</title> + <para> + <link xlink:href="https://www.intel.com/content/www/us/en/developer/articles/technical/linuxmedia-vaapi.html">VA-API + (Video Acceleration API)</link> is an open-source library and API + specification, which provides access to graphics hardware + acceleration capabilities for video processing. + </para> + <para> + VA-API drivers are loaded by <literal>libva</literal>. The version + in nixpkgs is built to search the opengl driver path, so drivers + can be installed in + <xref linkend="opt-hardware.opengl.extraPackages" />. + </para> + <para> + VA-API can be tested using: + </para> + <programlisting> +$ nix-shell -p libva-utils --run vainfo +</programlisting> + <section xml:id="sec-gpu-accel-va-api-intel"> + <title>Intel</title> + <para> + Modern Intel GPUs use the iHD driver, which can be installed + with: + </para> + <programlisting language="nix"> +hardware.opengl.extraPackages = [ + intel-media-driver +]; +</programlisting> + <para> + Older Intel GPUs use the i965 driver, which can be installed + with: + </para> + <programlisting language="nix"> +hardware.opengl.extraPackages = [ + vaapiIntel +]; +</programlisting> + </section> + </section> <section xml:id="sec-gpu-accel-common-issues"> <title>Common issues</title> <section xml:id="sec-gpu-accel-common-issues-permissions"> diff --git a/nixos/doc/manual/from_md/configuration/ipv4-config.section.xml b/nixos/doc/manual/from_md/configuration/ipv4-config.section.xml index 047ba2165f07..49ec6f5952ec 100644 --- a/nixos/doc/manual/from_md/configuration/ipv4-config.section.xml +++ b/nixos/doc/manual/from_md/configuration/ipv4-config.section.xml @@ -6,7 +6,7 @@ interfaces. However, you can configure an interface manually as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.interfaces.eth0.ipv4.addresses = [ { address = "192.168.1.2"; prefixLength = 24; @@ -16,7 +16,7 @@ networking.interfaces.eth0.ipv4.addresses = [ { Typically you’ll also want to set a default gateway and set of name servers: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.defaultGateway = "192.168.1.1"; networking.nameservers = [ "8.8.8.8" ]; </programlisting> @@ -32,7 +32,7 @@ networking.nameservers = [ "8.8.8.8" ]; The host name is set using <xref linkend="opt-networking.hostName" />: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.hostName = "cartman"; </programlisting> <para> diff --git a/nixos/doc/manual/from_md/configuration/ipv6-config.section.xml b/nixos/doc/manual/from_md/configuration/ipv6-config.section.xml index 137c3d772a86..2adb10622624 100644 --- a/nixos/doc/manual/from_md/configuration/ipv6-config.section.xml +++ b/nixos/doc/manual/from_md/configuration/ipv6-config.section.xml @@ -10,21 +10,21 @@ <xref linkend="opt-networking.interfaces._name_.tempAddress" />. You can disable IPv6 support globally by setting: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.enableIPv6 = false; </programlisting> <para> You can disable IPv6 on a single interface using a normal sysctl (in this example, we use interface <literal>eth0</literal>): </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.kernel.sysctl."net.ipv6.conf.eth0.disable_ipv6" = true; </programlisting> <para> As with IPv4 networking interfaces are automatically configured via DHCPv6. You can configure an interface manually: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.interfaces.eth0.ipv6.addresses = [ { address = "fe00:aa:bb:cc::2"; prefixLength = 64; @@ -34,7 +34,7 @@ networking.interfaces.eth0.ipv6.addresses = [ { For configuring a gateway, optionally with explicitly specified interface: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.defaultGateway6 = { address = "fe00::1"; interface = "enp0s3"; diff --git a/nixos/doc/manual/from_md/configuration/kubernetes.chapter.xml b/nixos/doc/manual/from_md/configuration/kubernetes.chapter.xml index 1de19f64bdad..da9ba323f18c 100644 --- a/nixos/doc/manual/from_md/configuration/kubernetes.chapter.xml +++ b/nixos/doc/manual/from_md/configuration/kubernetes.chapter.xml @@ -10,7 +10,7 @@ way is to enable and configure cluster components appropriately by hand: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.kubernetes = { apiserver.enable = true; controllerManager.enable = true; @@ -21,24 +21,24 @@ services.kubernetes = { }; </programlisting> <para> - Another way is to assign cluster roles ("master" and/or - "node") to the host. This enables apiserver, + Another way is to assign cluster roles (<quote>master</quote> and/or + <quote>node</quote>) to the host. This enables apiserver, controllerManager, scheduler, addonManager, kube-proxy and etcd: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.kubernetes.roles = [ "master" ]; </programlisting> <para> While this will enable the kubelet and kube-proxy only: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.kubernetes.roles = [ "node" ]; </programlisting> <para> Assigning both the master and node roles is usable if you want a single node Kubernetes cluster for dev or testing purposes: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.kubernetes.roles = [ "master" "node" ]; </programlisting> <para> diff --git a/nixos/doc/manual/from_md/configuration/linux-kernel.chapter.xml b/nixos/doc/manual/from_md/configuration/linux-kernel.chapter.xml index dd570e1d66c2..f889306d51c0 100644 --- a/nixos/doc/manual/from_md/configuration/linux-kernel.chapter.xml +++ b/nixos/doc/manual/from_md/configuration/linux-kernel.chapter.xml @@ -5,7 +5,7 @@ option <literal>boot.kernelPackages</literal>. For instance, this selects the Linux 3.10 kernel: </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.kernelPackages = pkgs.linuxKernel.packages.linux_3_10; </programlisting> <para> @@ -48,7 +48,7 @@ zcat /proc/config.gz <xref linkend="sec-customising-packages" />). For instance, to enable support for the kernel debugger KGDB: </para> - <programlisting language="bash"> + <programlisting language="nix"> nixpkgs.config.packageOverrides = pkgs: pkgs.lib.recursiveUpdate pkgs { linuxKernel.kernels.linux_5_10 = pkgs.linuxKernel.kernels.linux_5_10.override { extraConfig = '' @@ -69,7 +69,7 @@ nixpkgs.config.packageOverrides = pkgs: pkgs.lib.recursiveUpdate pkgs { automatically by <literal>udev</literal>. You can force a module to be loaded via <xref linkend="opt-boot.kernelModules" />, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.kernelModules = [ "fuse" "kvm-intel" "coretemp" ]; </programlisting> <para> @@ -77,7 +77,7 @@ boot.kernelModules = [ "fuse" "kvm-intel" "coretemp&quo root file system), you can use <xref linkend="opt-boot.initrd.kernelModules" />: </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.initrd.kernelModules = [ "cifs" ]; </programlisting> <para> @@ -88,7 +88,7 @@ boot.initrd.kernelModules = [ "cifs" ]; Kernel runtime parameters can be set through <xref linkend="opt-boot.kernel.sysctl" />, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.kernel.sysctl."net.ipv4.tcp_keepalive_time" = 120; </programlisting> <para> @@ -96,65 +96,82 @@ boot.kernel.sysctl."net.ipv4.tcp_keepalive_time" = 120; available parameters, run <literal>sysctl -a</literal>. </para> <section xml:id="sec-linux-config-customizing"> - <title>Customize your kernel</title> + <title>Building a custom kernel</title> <para> - The first step before compiling the kernel is to generate an - appropriate <literal>.config</literal> configuration. Either you - pass your own config via the <literal>configfile</literal> setting - of <literal>linuxKernel.manualConfig</literal>: + You can customize the default kernel configuration by overriding + the arguments for your kernel package: </para> - <programlisting language="bash"> -custom-kernel = let base_kernel = linuxKernel.kernels.linux_4_9; - in super.linuxKernel.manualConfig { - inherit (super) stdenv hostPlatform; - inherit (base_kernel) src; - version = "${base_kernel.version}-custom"; - - configfile = /home/me/my_kernel_config; - allowImportFromDerivation = true; -}; + <programlisting language="nix"> +pkgs.linux_latest.override { + ignoreConfigErrors = true; + autoModules = false; + kernelPreferBuiltin = true; + extraStructuredConfig = with lib.kernel; { + DEBUG_KERNEL = yes; + FRAME_POINTER = yes; + KGDB = yes; + KGDB_SERIAL_CONSOLE = yes; + DEBUG_INFO = yes; + }; +} </programlisting> <para> - You can edit the config with this snippet (by default - <literal>make menuconfig</literal> won't work out of the box on - nixos): + See <literal>pkgs/os-specific/linux/kernel/generic.nix</literal> + for details on how these arguments affect the generated + configuration. You can also build a custom version of Linux by + calling <literal>pkgs.buildLinux</literal> directly, which + requires the <literal>src</literal> and <literal>version</literal> + arguments to be specified. </para> - <programlisting> -nix-shell -E 'with import <nixpkgs> {}; kernelToOverride.overrideAttrs (o: {nativeBuildInputs=o.nativeBuildInputs ++ [ pkg-config ncurses ];})' + <para> + To use your custom kernel package in your NixOS configuration, set + </para> + <programlisting language="nix"> +boot.kernelPackages = pkgs.linuxPackagesFor yourCustomKernel; </programlisting> <para> - or you can let nixpkgs generate the configuration. Nixpkgs - generates it via answering the interactive kernel utility - <literal>make config</literal>. The answers depend on parameters - passed to - <literal>pkgs/os-specific/linux/kernel/generic.nix</literal> - (which you can influence by overriding - <literal>extraConfig, autoModules, modDirVersion, preferBuiltin, extraConfig</literal>). + Note that this method will use the common configuration defined in + <literal>pkgs/os-specific/linux/kernel/common-config.nix</literal>, + which is suitable for a NixOS system. </para> - <programlisting language="bash"> -mptcp93.override ({ - name="mptcp-local"; - - ignoreConfigErrors = true; - autoModules = false; - kernelPreferBuiltin = true; - - enableParallelBuilding = true; - - extraConfig = '' - DEBUG_KERNEL y - FRAME_POINTER y - KGDB y - KGDB_SERIAL_CONSOLE y - DEBUG_INFO y - ''; -}); + <para> + If you already have a generated configuration file, you can build + a kernel that uses it with + <literal>pkgs.linuxManualConfig</literal>: + </para> + <programlisting language="nix"> +let + baseKernel = pkgs.linux_latest; +in pkgs.linuxManualConfig { + inherit (baseKernel) src modDirVersion; + version = "${baseKernel.version}-custom"; + configfile = ./my_kernel_config; + allowImportFromDerivation = true; +} +</programlisting> + <note> + <para> + The build will fail if <literal>modDirVersion</literal> does not + match the source’s <literal>kernel.release</literal> file, so + <literal>modDirVersion</literal> should remain tied to + <literal>src</literal>. + </para> + </note> + <para> + To edit the <literal>.config</literal> file for Linux X.Y, proceed + as follows: + </para> + <programlisting> +$ nix-shell '<nixpkgs>' -A linuxKernel.kernels.linux_X_Y.configEnv +$ unpackPhase +$ cd linux-* +$ make nconfig </programlisting> </section> <section xml:id="sec-linux-config-developing-modules"> <title>Developing kernel modules</title> <para> - When developing kernel modules it's often convenient to run + When developing kernel modules it’s often convenient to run edit-compile-run loop as quickly as possible. See below snippet as an example of developing <literal>mellanox</literal> drivers. </para> @@ -181,7 +198,7 @@ $ make -C $dev/lib/modules/*/build M=$(pwd)/drivers/net/ethernet/mellanox module available kernel version <emphasis>that is supported by ZFS</emphasis> like this: </para> - <programlisting language="bash"> + <programlisting language="nix"> { boot.kernelPackages = pkgs.zfs.latestCompatibleLinuxPackages; } diff --git a/nixos/doc/manual/from_md/configuration/luks-file-systems.section.xml b/nixos/doc/manual/from_md/configuration/luks-file-systems.section.xml index 42b766eba98b..144a5acecae3 100644 --- a/nixos/doc/manual/from_md/configuration/luks-file-systems.section.xml +++ b/nixos/doc/manual/from_md/configuration/luks-file-systems.section.xml @@ -30,7 +30,7 @@ Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: *** at boot time as <literal>/</literal>, add the following to <literal>configuration.nix</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.initrd.luks.devices.crypted.device = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d"; fileSystems."/".device = "/dev/mapper/crypted"; </programlisting> @@ -39,7 +39,7 @@ fileSystems."/".device = "/dev/mapper/crypted"; located on an encrypted partition, it is necessary to add the following grub option: </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.loader.grub.enableCryptodisk = true; </programlisting> <section xml:id="sec-luks-file-systems-fido2"> @@ -67,7 +67,7 @@ Added to key to device /dev/sda2, slot: 2 compatible key, add the following to <literal>configuration.nix</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.initrd.luks.fido2Support = true; boot.initrd.luks.devices."/dev/sda2".fido2.credential = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7"; </programlisting> @@ -77,7 +77,7 @@ boot.initrd.luks.devices."/dev/sda2".fido2.credential = "f1d00200 protected, such as <link xlink:href="https://trezor.io/">Trezor</link>. </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess = true; </programlisting> </section> diff --git a/nixos/doc/manual/from_md/configuration/modularity.section.xml b/nixos/doc/manual/from_md/configuration/modularity.section.xml index a7688090fcc5..987b2fc43c01 100644 --- a/nixos/doc/manual/from_md/configuration/modularity.section.xml +++ b/nixos/doc/manual/from_md/configuration/modularity.section.xml @@ -14,7 +14,7 @@ other modules by including them from <literal>configuration.nix</literal>, e.g.: </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: { imports = [ ./vpn.nix ./kde.nix ]; @@ -28,7 +28,7 @@ <literal>vpn.nix</literal> and <literal>kde.nix</literal>. The latter might look like this: </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: { services.xserver.enable = true; @@ -50,7 +50,7 @@ you want it to appear first, you can use <literal>mkBefore</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.kernelModules = mkBefore [ "kvm-intel" ]; </programlisting> <para> @@ -70,7 +70,7 @@ The unique option `services.httpd.adminAddr' is defined multiple times, in `/etc When that happens, it’s possible to force one definition take precedence over the others: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.httpd.adminAddr = pkgs.lib.mkForce "bob@example.org"; </programlisting> <para> @@ -93,7 +93,7 @@ services.httpd.adminAddr = pkgs.lib.mkForce "bob@example.org"; <xref linkend="opt-services.xserver.enable" /> is set to <literal>true</literal> somewhere else: </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: { environment.systemPackages = @@ -137,7 +137,7 @@ nix-repl> map (x: x.hostName) config.services.httpd.virtualHosts below would have the same effect as importing a file which sets those options. </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: let netConfig = hostName: { diff --git a/nixos/doc/manual/from_md/configuration/network-manager.section.xml b/nixos/doc/manual/from_md/configuration/network-manager.section.xml index 8f0d6d680ae0..c49618b4b942 100644 --- a/nixos/doc/manual/from_md/configuration/network-manager.section.xml +++ b/nixos/doc/manual/from_md/configuration/network-manager.section.xml @@ -4,7 +4,7 @@ To facilitate network configuration, some desktop environments use NetworkManager. You can enable NetworkManager by setting: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.networkmanager.enable = true; </programlisting> <para> @@ -15,7 +15,7 @@ networking.networkmanager.enable = true; All users that should have permission to change network settings must belong to the <literal>networkmanager</literal> group: </para> - <programlisting language="bash"> + <programlisting language="nix"> users.users.alice.extraGroups = [ "networkmanager" ]; </programlisting> <para> @@ -36,7 +36,7 @@ users.users.alice.extraGroups = [ "networkmanager" ]; used together if desired. To do this you need to instruct NetworkManager to ignore those interfaces like: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.networkmanager.unmanaged = [ "*" "except:type:wwan" "except:type:gsm" ]; diff --git a/nixos/doc/manual/from_md/configuration/profiles.chapter.xml b/nixos/doc/manual/from_md/configuration/profiles.chapter.xml index 6f5fc130c6a0..f3aacfc0a245 100644 --- a/nixos/doc/manual/from_md/configuration/profiles.chapter.xml +++ b/nixos/doc/manual/from_md/configuration/profiles.chapter.xml @@ -4,12 +4,12 @@ In some cases, it may be desirable to take advantage of commonly-used, predefined configurations provided by nixpkgs, but different from those that come as default. This is a role fulfilled - by NixOS's Profiles, which come as files living in + by NixOS’s Profiles, which come as files living in <literal><nixpkgs/nixos/modules/profiles></literal>. That is to say, expected usage is to add them to the imports list of your <literal>/etc/configuration.nix</literal> as such: </para> - <programlisting language="bash"> + <programlisting language="nix"> imports = [ <nixpkgs/nixos/modules/profiles/profile-name.nix> ]; diff --git a/nixos/doc/manual/from_md/configuration/profiles/hardened.section.xml b/nixos/doc/manual/from_md/configuration/profiles/hardened.section.xml index 44c11786d940..1fd5a9179887 100644 --- a/nixos/doc/manual/from_md/configuration/profiles/hardened.section.xml +++ b/nixos/doc/manual/from_md/configuration/profiles/hardened.section.xml @@ -9,7 +9,7 @@ available to processes through the <literal>/sys</literal> and <literal>/proc</literal> filesystems. It also disables the User Namespaces feature of the kernel, which stops Nix from being able to - build anything (this particular setting can be overriden via + build anything (this particular setting can be overridden via <xref linkend="opt-security.allowUserNamespaces" />). See the <link xlink:href="https://github.com/nixos/nixpkgs/tree/master/nixos/modules/profiles/hardened.nix">profile source</link> for further detail on which settings are altered. diff --git a/nixos/doc/manual/from_md/configuration/renaming-interfaces.section.xml b/nixos/doc/manual/from_md/configuration/renaming-interfaces.section.xml index 88c9e624c82f..fca99edcbaea 100644 --- a/nixos/doc/manual/from_md/configuration/renaming-interfaces.section.xml +++ b/nixos/doc/manual/from_md/configuration/renaming-interfaces.section.xml @@ -30,7 +30,7 @@ the interface with MAC address <literal>52:54:00:12:01:01</literal> using a netword link unit: </para> - <programlisting language="bash"> + <programlisting language="nix"> systemd.network.links."10-wan" = { matchConfig.PermanentMACAddress = "52:54:00:12:01:01"; linkConfig.Name = "wan"; @@ -43,7 +43,7 @@ systemd.network.links."10-wan" = { <para> Alternatively, we can use a plain old udev rule: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.udev.initrdRules = '' SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", \ ATTR{address}=="52:54:00:12:01:01", KERNEL=="eth*", NAME="wan" diff --git a/nixos/doc/manual/from_md/configuration/ssh.section.xml b/nixos/doc/manual/from_md/configuration/ssh.section.xml index 037418d8ea4d..a330457f51d6 100644 --- a/nixos/doc/manual/from_md/configuration/ssh.section.xml +++ b/nixos/doc/manual/from_md/configuration/ssh.section.xml @@ -3,7 +3,7 @@ <para> Secure shell (SSH) access to your machine can be enabled by setting: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.openssh.enable = true; </programlisting> <para> @@ -16,7 +16,7 @@ services.openssh.enable = true; You can declaratively specify authorised RSA/DSA public keys for a user as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> users.users.alice.openssh.authorizedKeys.keys = [ "ssh-dss AAAAB3NzaC1kc3MAAACBAPIkGWVEt4..." ]; </programlisting> diff --git a/nixos/doc/manual/from_md/configuration/sshfs-file-systems.section.xml b/nixos/doc/manual/from_md/configuration/sshfs-file-systems.section.xml index 5d74712f35dc..26984dd411a1 100644 --- a/nixos/doc/manual/from_md/configuration/sshfs-file-systems.section.xml +++ b/nixos/doc/manual/from_md/configuration/sshfs-file-systems.section.xml @@ -54,7 +54,7 @@ SHA256:yjxl3UbTn31fLWeyLYTAKYJPRmzknjQZoyG8gSNEoIE my-user@workstation <link linkend="opt-fileSystems">fileSystems</link> option. Here’s a typical setup: </para> - <programlisting language="bash"> + <programlisting language="nix"> { system.fsPackages = [ pkgs.sshfs ]; @@ -80,7 +80,7 @@ SHA256:yjxl3UbTn31fLWeyLYTAKYJPRmzknjQZoyG8gSNEoIE my-user@workstation well, for example you can change the default SSH port or specify a jump proxy: </para> - <programlisting language="bash"> + <programlisting language="nix"> { options = [ "ProxyJump=bastion@example.com" @@ -92,7 +92,7 @@ SHA256:yjxl3UbTn31fLWeyLYTAKYJPRmzknjQZoyG8gSNEoIE my-user@workstation It’s also possible to change the <literal>ssh</literal> command used by SSHFS to connect to the server. For example: </para> - <programlisting language="bash"> + <programlisting language="nix"> { options = [ (builtins.replaceStrings [" "] ["\\040"] diff --git a/nixos/doc/manual/from_md/configuration/subversion.chapter.xml b/nixos/doc/manual/from_md/configuration/subversion.chapter.xml index 794c2c34e399..4390fc54ab53 100644 --- a/nixos/doc/manual/from_md/configuration/subversion.chapter.xml +++ b/nixos/doc/manual/from_md/configuration/subversion.chapter.xml @@ -25,7 +25,7 @@ Apache HTTP, setting <xref linkend="opt-services.httpd.adminAddr" /> appropriately: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.httpd.enable = true; services.httpd.adminAddr = ...; networking.firewall.allowedTCPPorts = [ 80 443 ]; @@ -40,7 +40,7 @@ networking.firewall.allowedTCPPorts = [ 80 443 ]; <literal>.authz</literal> file describing access permission, and <literal>AuthUserFile</literal> to the password file. </para> - <programlisting language="bash"> + <programlisting language="nix"> services.httpd.extraModules = [ # note that order is *super* important here { name = "dav_svn"; path = "${pkgs.apacheHttpdPackages.subversion}/modules/mod_dav_svn.so"; } @@ -106,7 +106,7 @@ $ htpasswd -s PASSWORD_FILE USER_NAME <literal>ACCESS_FILE</literal> will look something like the following: </para> - <programlisting language="bash"> + <programlisting language="nix"> [/] * = r diff --git a/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml b/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml index a2d7d2a9f115..d61b248d5eef 100644 --- a/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml +++ b/nixos/doc/manual/from_md/configuration/user-mgmt.chapter.xml @@ -7,7 +7,7 @@ states that a user account named <literal>alice</literal> shall exist: </para> - <programlisting language="bash"> + <programlisting language="nix"> users.users.alice = { isNormalUser = true; home = "/home/alice"; @@ -36,7 +36,7 @@ users.users.alice = { <xref linkend="opt-users.users" /> and run nixos-rebuild, the user account will cease to exist. Also, imperative commands for managing users and groups, such as useradd, are no longer available. - Passwords may still be assigned by setting the user's + Passwords may still be assigned by setting the user’s <link linkend="opt-users.users._name_.hashedPassword">hashedPassword</link> option. A hashed password can be generated using <literal>mkpasswd</literal>. @@ -45,7 +45,7 @@ users.users.alice = { A user ID (uid) is assigned automatically. You can also specify a uid manually by adding </para> - <programlisting language="bash"> + <programlisting language="nix"> uid = 1000; </programlisting> <para> @@ -55,7 +55,7 @@ uid = 1000; Groups can be specified similarly. The following states that a group named <literal>students</literal> shall exist: </para> - <programlisting language="bash"> + <programlisting language="nix"> users.groups.students.gid = 1000; </programlisting> <para> diff --git a/nixos/doc/manual/from_md/configuration/wayland.chapter.xml b/nixos/doc/manual/from_md/configuration/wayland.chapter.xml index 1e90d4f31177..07892c875bb2 100644 --- a/nixos/doc/manual/from_md/configuration/wayland.chapter.xml +++ b/nixos/doc/manual/from_md/configuration/wayland.chapter.xml @@ -5,11 +5,12 @@ display technology on NixOS, Wayland support is steadily improving. Where X11 separates the X Server and the window manager, on Wayland those are combined: a Wayland Compositor is like an X11 window - manager, but also embeds the Wayland 'Server' functionality. This - means it is sufficient to install a Wayland Compositor such as sway - without separately enabling a Wayland server: + manager, but also embeds the Wayland <quote>Server</quote> + functionality. This means it is sufficient to install a Wayland + Compositor such as sway without separately enabling a Wayland + server: </para> - <programlisting language="bash"> + <programlisting language="nix"> programs.sway.enable = true; </programlisting> <para> @@ -21,7 +22,7 @@ programs.sway.enable = true; be able to share your screen, you might want to activate this option: </para> - <programlisting language="bash"> + <programlisting language="nix"> xdg.portal.wlr.enable = true; </programlisting> <para> diff --git a/nixos/doc/manual/from_md/configuration/wireless.section.xml b/nixos/doc/manual/from_md/configuration/wireless.section.xml index 82bc20135157..79feab47203a 100644 --- a/nixos/doc/manual/from_md/configuration/wireless.section.xml +++ b/nixos/doc/manual/from_md/configuration/wireless.section.xml @@ -9,13 +9,13 @@ <para> NixOS will start wpa_supplicant for you if you enable this setting: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.wireless.enable = true; </programlisting> <para> NixOS lets you specify networks for wpa_supplicant declaratively: </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.wireless.networks = { echelon = { # SSID with no spaces or special characters psk = "abcdefgh"; @@ -49,12 +49,12 @@ network={ psk=dca6d6ed41f4ab5a984c9f55f6f66d4efdc720ebf66959810f4329bb391c5435 } </programlisting> - <programlisting language="bash"> + <programlisting language="nix"> networking.wireless.networks = { echelon = { pskRaw = "dca6d6ed41f4ab5a984c9f55f6f66d4efdc720ebf66959810f4329bb391c5435"; }; -} +}; </programlisting> <para> or you can use it to directly generate the diff --git a/nixos/doc/manual/from_md/configuration/x-windows.chapter.xml b/nixos/doc/manual/from_md/configuration/x-windows.chapter.xml index c17e98983b27..c5a8b9bae84d 100644 --- a/nixos/doc/manual/from_md/configuration/x-windows.chapter.xml +++ b/nixos/doc/manual/from_md/configuration/x-windows.chapter.xml @@ -4,7 +4,7 @@ The X Window System (X11) provides the basis of NixOS’ graphical user interface. It can be enabled as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.enable = true; </programlisting> <para> @@ -13,7 +13,7 @@ services.xserver.enable = true; and <literal>intel</literal>). You can also specify a driver manually, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.videoDrivers = [ "r128" ]; </programlisting> <para> @@ -25,7 +25,7 @@ services.xserver.videoDrivers = [ "r128" ]; <literal>xterm</literal> window. Thus you should pick one or more of the following lines: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.desktopManager.plasma5.enable = true; services.xserver.desktopManager.xfce.enable = true; services.xserver.desktopManager.gnome.enable = true; @@ -42,14 +42,14 @@ services.xserver.windowManager.herbstluftwm.enable = true; LightDM. You can select an alternative one by picking one of the following lines: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.displayManager.sddm.enable = true; services.xserver.displayManager.gdm.enable = true; </programlisting> <para> You can set the keyboard layout (and optionally the layout variant): </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.layout = "de"; services.xserver.xkbVariant = "neo"; </programlisting> @@ -57,7 +57,7 @@ services.xserver.xkbVariant = "neo"; The X server is started automatically at boot time. If you don’t want this to happen, you can set: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.autorun = false; </programlisting> <para> @@ -70,7 +70,7 @@ services.xserver.autorun = false; On 64-bit systems, if you want OpenGL for 32-bit programs such as in Wine, you should also set the following: </para> - <programlisting language="bash"> + <programlisting language="nix"> hardware.opengl.driSupport32Bit = true; </programlisting> <section xml:id="sec-x11-auto-login"> @@ -88,16 +88,16 @@ hardware.opengl.driSupport32Bit = true; <para> To enable auto-login, you need to define your default window manager and desktop environment. If you wanted no desktop - environment and i3 as your your window manager, you'd define: + environment and i3 as your your window manager, you’d define: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.displayManager.defaultSession = "none+i3"; </programlisting> <para> Every display manager in NixOS supports auto-login, here is an example using lightdm for a user <literal>alice</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.displayManager.lightdm.enable = true; services.xserver.displayManager.autoLogin.enable = true; services.xserver.displayManager.autoLogin.user = "alice"; @@ -122,8 +122,8 @@ services.xserver.displayManager.autoLogin.user = "alice"; <para> The second driver, <literal>intel</literal>, is specific to Intel GPUs, but not recommended by most distributions: it lacks several - modern features (for example, it doesn't support Glamor) and the - package hasn't been officially updated since 2015. + modern features (for example, it doesn’t support Glamor) and the + package hasn’t been officially updated since 2015. </para> <para> The results vary depending on the hardware, so you may have to try @@ -131,14 +131,14 @@ services.xserver.displayManager.autoLogin.user = "alice"; <xref linkend="opt-services.xserver.videoDrivers" /> to set one. The recommended configuration for modern systems is: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.videoDrivers = [ "modesetting" ]; </programlisting> <para> If you experience screen tearing no matter what, this configuration was reported to resolve the issue: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.videoDrivers = [ "intel" ]; services.xserver.deviceSection = '' Option "DRI" "2" @@ -159,14 +159,14 @@ services.xserver.deviceSection = '' enabled by default because it’s not free software. You can enable it as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.videoDrivers = [ "nvidia" ]; </programlisting> <para> Or if you have an older card, you may have to use one of the legacy drivers: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.videoDrivers = [ "nvidiaLegacy390" ]; services.xserver.videoDrivers = [ "nvidiaLegacy340" ]; services.xserver.videoDrivers = [ "nvidiaLegacy304" ]; @@ -181,11 +181,11 @@ services.xserver.videoDrivers = [ "nvidiaLegacy304" ]; <para> AMD provides a proprietary driver for its graphics cards that is not enabled by default because it’s not Free Software, is often - broken in nixpkgs and as of this writing doesn't offer more + broken in nixpkgs and as of this writing doesn’t offer more features or performance. If you still want to use it anyway, you need to explicitly set: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.videoDrivers = [ "amdgpu-pro" ]; </programlisting> <para> @@ -199,14 +199,14 @@ services.xserver.videoDrivers = [ "amdgpu-pro" ]; Support for Synaptics touchpads (found in many laptops such as the Dell Latitude series) can be enabled as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.libinput.enable = true; </programlisting> <para> The driver has many options (see <xref linkend="ch-options" />). For instance, the following disables tap-to-click behavior: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.libinput.touchpad.tapping = false; </programlisting> <para> @@ -222,7 +222,7 @@ services.xserver.libinput.touchpad.tapping = false; applications look similar to GTK ones, you can use the following configuration: </para> - <programlisting language="bash"> + <programlisting language="nix"> qt5.enable = true; qt5.platformTheme = "gtk2"; qt5.style = "gtk2"; @@ -244,10 +244,10 @@ qt5.style = "gtk2"; <para> Create a file called <literal>us-greek</literal> with the following content (under a directory called - <literal>symbols</literal>; it's an XKB peculiarity that will help + <literal>symbols</literal>; it’s an XKB peculiarity that will help with testing): </para> - <programlisting language="bash"> + <programlisting language="nix"> xkb_symbols "us-greek" { include "us(basic)" // includes the base US keys @@ -263,7 +263,7 @@ xkb_symbols "us-greek" <para> A minimal layout specification must include the following: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.extraLayouts.us-greek = { description = "US layout with alt-gr greek"; languages = [ "eng" ]; @@ -279,7 +279,7 @@ services.xserver.extraLayouts.us-greek = { <para> Applying this customization requires rebuilding several packages, and a broken XKB file can lead to the X session crashing at login. - Therefore, you're strongly advised to <emphasis role="strong">test + Therefore, you’re strongly advised to <emphasis role="strong">test your layout before applying it</emphasis>: </para> <programlisting> @@ -312,7 +312,7 @@ $ echo "$(nix-build --no-out-link '<nixpkgs>' -A xorg.xkeyboardconfig interest, then create a <literal>media-key</literal> file to hold the keycodes definitions </para> - <programlisting language="bash"> + <programlisting language="nix"> xkb_keycodes "media" { <volUp> = 123; @@ -322,7 +322,7 @@ xkb_keycodes "media" <para> Now use the newly define keycodes in <literal>media-sym</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> xkb_symbols "media" { key.type = "ONE_LEVEL"; @@ -333,7 +333,7 @@ xkb_symbols "media" <para> As before, to install the layout do </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.extraLayouts.media = { description = "Multimedia keys remapping"; languages = [ "eng" ]; @@ -352,18 +352,18 @@ services.xserver.extraLayouts.media = { <para> Unfortunately, the Xorg server does not (currently) support setting a keymap directly but relies instead on XKB rules to - select the matching components (keycodes, types, ...) of a layout. - This means that components other than symbols won't be loaded by + select the matching components (keycodes, types, …) of a layout. + This means that components other than symbols won’t be loaded by default. As a workaround, you can set the keymap using <literal>setxkbmap</literal> at the start of the session with: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.displayManager.sessionCommands = "setxkbmap -keycodes media"; </programlisting> <para> If you are manually starting the X server, you should set the argument <literal>-xkbdir /etc/X11/xkb</literal>, otherwise X - won't find your layout files. For example with + won’t find your layout files. For example with <literal>xinit</literal> run </para> <programlisting> diff --git a/nixos/doc/manual/from_md/configuration/xfce.chapter.xml b/nixos/doc/manual/from_md/configuration/xfce.chapter.xml index 42e70d1d81d3..7ec69b5e9b8f 100644 --- a/nixos/doc/manual/from_md/configuration/xfce.chapter.xml +++ b/nixos/doc/manual/from_md/configuration/xfce.chapter.xml @@ -3,7 +3,7 @@ <para> To enable the Xfce Desktop Environment, set </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.desktopManager.xfce.enable = true; services.xserver.displayManager.defaultSession = "xfce"; </programlisting> @@ -11,7 +11,7 @@ services.xserver.displayManager.defaultSession = "xfce"; Optionally, <emphasis>picom</emphasis> can be enabled for nice graphical effects, some example settings: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.picom = { enable = true; fade = true; @@ -36,8 +36,8 @@ services.picom = { <xref linkend="opt-environment.systemPackages" />. </para> <para> - If you'd like to add extra plugins to Thunar, add them to - <xref linkend="opt-programs.thunar.plugins" />. You shouldn't just + If you’d like to add extra plugins to Thunar, add them to + <xref linkend="opt-programs.thunar.plugins" />. You shouldn’t just add them to <xref linkend="opt-environment.systemPackages" />. </para> </section> @@ -54,9 +54,10 @@ Thunar:2410): GVFS-RemoteVolumeMonitor-WARNING **: remote volume monitor with db </programlisting> <para> This is caused by some needed GNOME services not running. This is - all fixed by enabling "Launch GNOME services on startup" - in the Advanced tab of the Session and Startup settings panel. - Alternatively, you can run this command to do the same thing. + all fixed by enabling <quote>Launch GNOME services on + startup</quote> in the Advanced tab of the Session and Startup + settings panel. Alternatively, you can run this command to do the + same thing. </para> <programlisting> $ xfconf-query -c xfce4-session -p /compat/LaunchGNOME -s true diff --git a/nixos/doc/manual/from_md/contributing-to-this-manual.chapter.xml b/nixos/doc/manual/from_md/contributing-to-this-manual.chapter.xml index a9b0c6a5eefa..99dc5ce30b4b 100644 --- a/nixos/doc/manual/from_md/contributing-to-this-manual.chapter.xml +++ b/nixos/doc/manual/from_md/contributing-to-this-manual.chapter.xml @@ -1,7 +1,9 @@ <chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="chap-contributing"> <title>Contributing to this manual</title> <para> - The DocBook and CommonMark sources of NixOS’ manual are in the + The + <link xlink:href="https://en.wikipedia.org/wiki/DocBook">DocBook</link> + and CommonMark sources of the NixOS manual are in the <link xlink:href="https://github.com/NixOS/nixpkgs/tree/master/nixos/doc/manual">nixos/doc/manual</link> subdirectory of the <link xlink:href="https://github.com/NixOS/nixpkgs">Nixpkgs</link> @@ -19,4 +21,32 @@ $ nix-build nixos/release.nix -A manual.x86_64-linux If the build succeeds, the manual will be in <literal>./result/share/doc/nixos/index.html</literal>. </para> + <para> + <emphasis role="strong">Contributing to the man pages</emphasis> + </para> + <para> + The man pages are written in + <link xlink:href="https://en.wikipedia.org/wiki/DocBook">DocBook</link> + which is XML. + </para> + <para> + To see what your edits look like: + </para> + <programlisting> +$ cd /path/to/nixpkgs +$ nix-build nixos/release.nix -A manpages.x86_64-linux +</programlisting> + <para> + You can then read the man page you edited by running + </para> + <programlisting> +$ man --manpath=result/share/man nixos-rebuild # Replace nixos-rebuild with the command whose manual you edited +</programlisting> + <para> + If you’re on a different architecture that’s supported by NixOS + (check nixos/release.nix) then replace + <literal>x86_64-linux</literal> with the architecture. + <literal>nix-build</literal> will complain otherwise, but should + also tell you which architecture you have + the supported ones. + </para> </chapter> diff --git a/nixos/doc/manual/from_md/development/activation-script.section.xml b/nixos/doc/manual/from_md/development/activation-script.section.xml index 981ebf37e60f..429b45c93def 100644 --- a/nixos/doc/manual/from_md/development/activation-script.section.xml +++ b/nixos/doc/manual/from_md/development/activation-script.section.xml @@ -22,7 +22,7 @@ these dependencies into account and order the snippets accordingly. As a simple example: </para> - <programlisting language="bash"> + <programlisting language="nix"> system.activationScripts.my-activation-script = { deps = [ "etc" ]; # supportsDryActivation = true; @@ -45,7 +45,7 @@ system.activationScripts.my-activation-script = { An activation script can write to special files instructing <literal>switch-to-configuration</literal> to restart/reload units. The script will take these requests into account and will - incorperate the unit configuration as described above. This means + incorporate the unit configuration as described above. This means that the activation script will <quote>fake</quote> a modified unit file and <literal>switch-to-configuration</literal> will act accordingly. By doing so, configuration like @@ -66,7 +66,7 @@ system.activationScripts.my-activation-script = { <literal>/run/nixos/dry-activation-reload-list</literal>. Those files can contain newline-separated lists of unit names where duplicates are being ignored. These files are not create - automatically and activation scripts must take the possiblility into + automatically and activation scripts must take the possibility into account that they have to create them first. </para> <section xml:id="sec-activation-script-nixos-snippets"> diff --git a/nixos/doc/manual/from_md/development/assertions.section.xml b/nixos/doc/manual/from_md/development/assertions.section.xml index 0844d484d60f..13f04d5d1883 100644 --- a/nixos/doc/manual/from_md/development/assertions.section.xml +++ b/nixos/doc/manual/from_md/development/assertions.section.xml @@ -18,7 +18,7 @@ <para> This is an example of using <literal>warnings</literal>. </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, lib, ... }: { config = lib.mkIf config.services.foo.enable { @@ -42,7 +42,7 @@ assertion is useful to prevent such a broken system from being built. </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, lib, ... }: { config = lib.mkIf config.services.syslogd.enable { diff --git a/nixos/doc/manual/from_md/development/bootspec.chapter.xml b/nixos/doc/manual/from_md/development/bootspec.chapter.xml new file mode 100644 index 000000000000..9ecbe1d1beed --- /dev/null +++ b/nixos/doc/manual/from_md/development/bootspec.chapter.xml @@ -0,0 +1,73 @@ +<chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-experimental-bootspec"> + <title>Experimental feature: Bootspec</title> + <para> + Bootspec is a experimental feature, introduced in the + <link xlink:href="https://github.com/NixOS/rfcs/pull/125">RFC-0125 + proposal</link>, the reference implementation can be found + <link xlink:href="https://github.com/NixOS/nixpkgs/pull/172237">there</link> + in order to standardize bootloader support and advanced boot + workflows such as SecureBoot and potentially more. + </para> + <para> + You can enable the creation of bootspec documents through + <link xlink:href="options.html#opt-boot.bootspec.enable"><literal>boot.bootspec.enable = true</literal></link>, + which will prompt a warning until + <link xlink:href="https://github.com/NixOS/rfcs/pull/125">RFC-0125</link> + is officially merged. + </para> + <section xml:id="sec-experimental-bootspec-schema"> + <title>Schema</title> + <para> + The bootspec schema is versioned and validated against + <link xlink:href="https://cuelang.org/">a CUE schema file</link> + which should considered as the source of truth for your + applications. + </para> + <para> + You will find the current version + <link xlink:href="../../../modules/system/activation/bootspec.cue">here</link>. + </para> + </section> + <section xml:id="sec-experimental-bootspec-extensions"> + <title>Extensions mechanism</title> + <para> + Bootspec cannot account for all usecases. + </para> + <para> + For this purpose, Bootspec offers a generic extension facility + <link xlink:href="options.html#opt-boot.bootspec.extensions"><literal>boot.bootspec.extensions</literal></link> + which can be used to inject any data needed for your usecases. + </para> + <para> + An example for SecureBoot is to get the Nix store path to + <literal>/etc/os-release</literal> in order to bake it into a + unified kernel image: + </para> + <programlisting language="nix"> +{ config, lib, ... }: { + boot.bootspec.extensions = { + "org.secureboot.osRelease" = config.environment.etc."os-release".source; + }; +} +</programlisting> + <para> + To reduce incompatibility and prevent names from clashing between + applications, it is <emphasis role="strong">highly + recommended</emphasis> to use a unique namespace for your + extensions. + </para> + </section> + <section xml:id="sec-experimental-bootspec-external-bootloaders"> + <title>External bootloaders</title> + <para> + It is possible to enable your own bootloader through + <link xlink:href="options.html#opt-boot.loader.external.installHook"><literal>boot.loader.external.installHook</literal></link> + which can wrap an existing bootloader. + </para> + <para> + Currently, there is no good story to compose existing bootloaders + to enrich their features, e.g. SecureBoot, etc. It will be + necessary to reimplement or reuse existing parts. + </para> + </section> +</chapter> diff --git a/nixos/doc/manual/from_md/development/freeform-modules.section.xml b/nixos/doc/manual/from_md/development/freeform-modules.section.xml index 86a9cf3140d8..c51bc76ff966 100644 --- a/nixos/doc/manual/from_md/development/freeform-modules.section.xml +++ b/nixos/doc/manual/from_md/development/freeform-modules.section.xml @@ -30,7 +30,7 @@ type-checked <literal>settings</literal> attribute</link> for a more complete example. </para> - <programlisting language="bash"> + <programlisting language="nix"> { lib, config, ... }: { options.settings = lib.mkOption { @@ -52,7 +52,7 @@ <para> And the following shows what such a module then allows </para> - <programlisting language="bash"> + <programlisting language="nix"> { # Not a declared option, but the freeform type allows this settings.logLevel = "debug"; @@ -72,7 +72,7 @@ Freeform attributes cannot depend on other attributes of the same set without infinite recursion: </para> - <programlisting language="bash"> + <programlisting language="nix"> { # This throws infinite recursion encountered settings.logLevel = lib.mkIf (config.settings.port == 80) "debug"; diff --git a/nixos/doc/manual/from_md/development/importing-modules.section.xml b/nixos/doc/manual/from_md/development/importing-modules.section.xml index cb04dde67c83..96e5e1bb16b8 100644 --- a/nixos/doc/manual/from_md/development/importing-modules.section.xml +++ b/nixos/doc/manual/from_md/development/importing-modules.section.xml @@ -4,7 +4,7 @@ Sometimes NixOS modules need to be used in configuration but exist outside of Nixpkgs. These modules can be imported: </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, lib, pkgs, ... }: { @@ -23,18 +23,18 @@ Nixpkgs NixOS modules. Like any NixOS module, this module can import additional modules: </para> - <programlisting language="bash"> + <programlisting language="nix"> # ./module-list/default.nix [ ./example-module1 ./example-module2 ] </programlisting> - <programlisting language="bash"> + <programlisting language="nix"> # ./extra-module/default.nix { imports = import ./module-list.nix; } </programlisting> - <programlisting language="bash"> + <programlisting language="nix"> # NIXOS_EXTRA_MODULE_PATH=/absolute/path/to/extra-module { config, lib, pkgs, ... }: diff --git a/nixos/doc/manual/from_md/development/meta-attributes.section.xml b/nixos/doc/manual/from_md/development/meta-attributes.section.xml index 1eb6e0f30368..9cc58afa1fdd 100644 --- a/nixos/doc/manual/from_md/development/meta-attributes.section.xml +++ b/nixos/doc/manual/from_md/development/meta-attributes.section.xml @@ -15,7 +15,7 @@ Each of the meta-attributes must be defined at most once per module file. </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, lib, pkgs, ... }: { options = { diff --git a/nixos/doc/manual/from_md/development/option-declarations.section.xml b/nixos/doc/manual/from_md/development/option-declarations.section.xml index 0932a51a18cd..2e6a12d53095 100644 --- a/nixos/doc/manual/from_md/development/option-declarations.section.xml +++ b/nixos/doc/manual/from_md/development/option-declarations.section.xml @@ -6,7 +6,7 @@ hasn’t been declared in any module. An option declaration generally looks like this: </para> - <programlisting language="bash"> + <programlisting language="nix"> options = { name = mkOption { type = type specification; @@ -127,7 +127,7 @@ options = { For example: </para> <anchor xml:id="ex-options-declarations-util-mkEnableOption-magic" /> - <programlisting language="bash"> + <programlisting language="nix"> lib.mkEnableOption "magic" # is like lib.mkOption { @@ -142,7 +142,7 @@ lib.mkOption { <para> Usage: </para> - <programlisting language="bash"> + <programlisting language="nix"> mkPackageOption pkgs "name" { default = [ "path" "in" "pkgs" ]; example = "literal example"; } </programlisting> <para> @@ -177,7 +177,7 @@ mkPackageOption pkgs "name" { default = [ "path" "in&qu Examples: </para> <anchor xml:id="ex-options-declarations-util-mkPackageOption-hello" /> - <programlisting language="bash"> + <programlisting language="nix"> lib.mkPackageOption pkgs "hello" { } # is like lib.mkOption { @@ -188,7 +188,7 @@ lib.mkOption { } </programlisting> <anchor xml:id="ex-options-declarations-util-mkPackageOption-ghc" /> - <programlisting language="bash"> + <programlisting language="nix"> lib.mkPackageOption pkgs "GHC" { default = [ "ghc" ]; example = "pkgs.haskell.packages.ghc92.ghc.withPackages (hkgs: [ hkgs.primes ])"; @@ -222,7 +222,7 @@ lib.mkOption { As an example, we will take the case of display managers. There is a central display manager module for generic display manager options and a module file per display - manager backend (sddm, gdm ...). + manager backend (sddm, gdm …). </para> <para> There are two approaches we could take with this module @@ -287,7 +287,7 @@ lib.mkOption { <emphasis role="strong">Example: Extensible type placeholder in the service module</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.displayManager.enable = mkOption { description = "Display manager to use"; type = with types; nullOr (enum [ ]); @@ -299,7 +299,7 @@ services.xserver.displayManager.enable = mkOption { <literal>services.xserver.displayManager.enable</literal> in the <literal>gdm</literal> module</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.displayManager.enable = mkOption { type = with types; nullOr (enum [ "gdm" ]); }; @@ -310,7 +310,7 @@ services.xserver.displayManager.enable = mkOption { <literal>services.xserver.displayManager.enable</literal> in the <literal>sddm</literal> module</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> services.xserver.displayManager.enable = mkOption { type = with types; nullOr (enum [ "sddm" ]); }; diff --git a/nixos/doc/manual/from_md/development/option-def.section.xml b/nixos/doc/manual/from_md/development/option-def.section.xml index 3c1a979e70f3..87b290ec39c6 100644 --- a/nixos/doc/manual/from_md/development/option-def.section.xml +++ b/nixos/doc/manual/from_md/development/option-def.section.xml @@ -4,7 +4,7 @@ Option definitions are generally straight-forward bindings of values to option names, like </para> - <programlisting language="bash"> + <programlisting language="nix"> config = { services.httpd.enable = true; }; @@ -21,7 +21,7 @@ config = { another option, you may need to use <literal>mkIf</literal>. Consider, for instance: </para> - <programlisting language="bash"> + <programlisting language="nix"> config = if config.services.httpd.enable then { environment.systemPackages = [ ... ]; ... @@ -34,7 +34,7 @@ config = if config.services.httpd.enable then { value being constructed here. After all, you could also write the clearly circular and contradictory: </para> - <programlisting language="bash"> + <programlisting language="nix"> config = if config.services.httpd.enable then { services.httpd.enable = false; } else { @@ -44,7 +44,7 @@ config = if config.services.httpd.enable then { <para> The solution is to write: </para> - <programlisting language="bash"> + <programlisting language="nix"> config = mkIf config.services.httpd.enable { environment.systemPackages = [ ... ]; ... @@ -55,7 +55,7 @@ config = mkIf config.services.httpd.enable { of the conditional to be <quote>pushed down</quote> into the individual definitions, as if you had written: </para> - <programlisting language="bash"> + <programlisting language="nix"> config = { environment.systemPackages = if config.services.httpd.enable then [ ... ] else []; ... @@ -72,7 +72,7 @@ config = { option defaults have priority 1500. You can specify an explicit priority by using <literal>mkOverride</literal>, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> services.openssh.enable = mkOverride 10 false; </programlisting> <para> @@ -94,7 +94,7 @@ services.openssh.enable = mkOverride 10 false; <literal>mkOrder 500</literal> and <literal>mkOrder 1500</literal>, respectively. As an example, </para> - <programlisting language="bash"> + <programlisting language="nix"> hardware.firmware = mkBefore [ myFirmware ]; </programlisting> <para> @@ -117,7 +117,7 @@ hardware.firmware = mkBefore [ myFirmware ]; to be merged together as if they were declared in separate modules. This can be done using <literal>mkMerge</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> config = mkMerge [ # Unconditional stuff. { environment.systemPackages = [ ... ]; diff --git a/nixos/doc/manual/from_md/development/option-types.section.xml b/nixos/doc/manual/from_md/development/option-types.section.xml index 4036bc0ba743..363399b08661 100644 --- a/nixos/doc/manual/from_md/development/option-types.section.xml +++ b/nixos/doc/manual/from_md/development/option-types.section.xml @@ -81,14 +81,14 @@ <para> Two definitions of this type like </para> - <programlisting language="bash"> + <programlisting language="nix"> { str = lib.mkDefault "foo"; pkg.hello = pkgs.hello; fun.fun = x: x + 1; } </programlisting> - <programlisting language="bash"> + <programlisting language="nix"> { str = lib.mkIf true "bar"; pkg.gcc = pkgs.gcc; @@ -98,7 +98,7 @@ <para> will get merged to </para> - <programlisting language="bash"> + <programlisting language="nix"> { str = "bar"; pkg.gcc = pkgs.gcc; @@ -152,13 +152,13 @@ <warning> <para> This type will be deprecated in the future because it - doesn't recurse into attribute sets, silently drops - earlier attribute definitions, and doesn't discharge + doesn’t recurse into attribute sets, silently drops + earlier attribute definitions, and doesn’t discharge <literal>lib.mkDefault</literal>, <literal>lib.mkIf</literal> and co. For allowing arbitrary attribute sets, prefer <literal>types.attrsOf types.anything</literal> instead - which doesn't have these problems. + which doesn’t have these problems. </para> </warning> </listitem> @@ -453,7 +453,7 @@ <literal>_module.args</literal> should be used instead for most arguments since it allows overriding. <emphasis><literal>specialArgs</literal></emphasis> - should only be used for arguments that can't go through + should only be used for arguments that can’t go through the module fixed-point, because of infinite recursion or other problems. An example is overriding the <literal>lib</literal> argument, because @@ -477,7 +477,7 @@ instead of requiring <literal>the-submodule.config.config = "value"</literal>. This is because only when modules - <emphasis>don't</emphasis> set the + <emphasis>don’t</emphasis> set the <literal>config</literal> or <literal>options</literal> keys, all keys are interpreted as option definitions in the <literal>config</literal> section. Enabling this @@ -668,7 +668,7 @@ <varlistentry> <term> <literal>types.oneOf</literal> [ - <emphasis><literal>t1 t2</literal></emphasis> ... ] + <emphasis><literal>t1 t2</literal></emphasis> … ] </term> <listitem> <para> @@ -712,7 +712,7 @@ <literal>options</literal> key defining the sub-options. Submodule option definitions are type-checked accordingly to the <literal>options</literal> declarations. Of course, you can nest - submodule option definitons for even higher modularity. + submodule option definitions for even higher modularity. </para> <para> The option set can be defined directly @@ -732,7 +732,7 @@ <emphasis role="strong">Example: Directly defined submodule</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> options.mod = mkOption { description = "submodule example"; type = with types; submodule { @@ -752,7 +752,7 @@ options.mod = mkOption { <emphasis role="strong">Example: Submodule defined as a reference</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> let modOptions = { options = { @@ -787,7 +787,7 @@ options.mod = mkOption { <emphasis role="strong">Example: Declaration of a list of submodules</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> options.mod = mkOption { description = "submodule example"; type = with types; listOf (submodule { @@ -807,7 +807,7 @@ options.mod = mkOption { <emphasis role="strong">Example: Definition of a list of submodules</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> config.mod = [ { foo = 1; bar = "one"; } { foo = 2; bar = "two"; } @@ -827,7 +827,7 @@ config.mod = [ <emphasis role="strong">Example: Declaration of attribute sets of submodules</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> options.mod = mkOption { description = "submodule example"; type = with types; attrsOf (submodule { @@ -847,7 +847,7 @@ options.mod = mkOption { <emphasis role="strong">Example: Definition of attribute sets of submodules</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> config.mod.one = { foo = 1; bar = "one"; }; config.mod.two = { foo = 2; bar = "two"; }; </programlisting> @@ -878,7 +878,7 @@ config.mod.two = { foo = 2; bar = "two"; }; <emphasis role="strong">Example: Adding a type check</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> byte = mkOption { description = "An integer between 0 and 255."; type = types.addCheck types.int (x: x >= 0 && x <= 255); @@ -889,7 +889,7 @@ byte = mkOption { <emphasis role="strong">Example: Overriding a type check</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> nixThings = mkOption { description = "words that start with 'nix'"; type = types.str // { diff --git a/nixos/doc/manual/from_md/development/replace-modules.section.xml b/nixos/doc/manual/from_md/development/replace-modules.section.xml index cf8a39ba844f..d8aaf59df366 100644 --- a/nixos/doc/manual/from_md/development/replace-modules.section.xml +++ b/nixos/doc/manual/from_md/development/replace-modules.section.xml @@ -3,8 +3,8 @@ <para> Modules that are imported can also be disabled. The option declarations, config implementation and the imports of a disabled - module will be ignored, allowing another to take it's place. This - can be used to import a set of modules from another channel while + module will be ignored, allowing another to take its place. This can + be used to import a set of modules from another channel while keeping the rest of the system on a stable release. </para> <para> @@ -19,10 +19,10 @@ This example will replace the existing postgresql module with the version defined in the nixos-unstable channel while keeping the rest of the modules and packages from the original nixos channel. This - only overrides the module definition, this won't use postgresql from + only overrides the module definition, this won’t use postgresql from nixos-unstable unless explicitly configured to do so. </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, lib, pkgs, ... }: { @@ -40,9 +40,9 @@ <para> This example shows how to define a custom module as a replacement for an existing module. Importing this module will disable the - original module without having to know it's implementation details. + original module without having to know its implementation details. </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, lib, pkgs, ... }: with lib; diff --git a/nixos/doc/manual/from_md/development/settings-options.section.xml b/nixos/doc/manual/from_md/development/settings-options.section.xml index d26dd96243db..898cd3b2b6e9 100644 --- a/nixos/doc/manual/from_md/development/settings-options.section.xml +++ b/nixos/doc/manual/from_md/development/settings-options.section.xml @@ -19,10 +19,10 @@ </listitem> <listitem> <para> - Non-nix-representable ones: These can't be trivially mapped to a + Non-nix-representable ones: These can’t be trivially mapped to a subset of Nix syntax. Most generic programming languages are in this group, e.g. bash, since the statement - <literal>if true; then echo hi; fi</literal> doesn't have a + <literal>if true; then echo hi; fi</literal> doesn’t have a trivial representation in Nix. </para> <para> @@ -42,8 +42,7 @@ </listitem> </itemizedlist> <section xml:id="sec-settings-nix-representable"> - <title>Nix-representable Formats (JSON, YAML, TOML, INI, - ...)</title> + <title>Nix-representable Formats (JSON, YAML, TOML, INI, …)</title> <para> By convention, formats like this are handled with a generic <literal>settings</literal> option, representing the full program @@ -318,7 +317,7 @@ used, along with some other related best practices. See the comments for explanations. </para> - <programlisting language="bash"> + <programlisting language="nix"> { options, config, lib, pkgs, ... }: let cfg = config.services.foo; @@ -391,7 +390,7 @@ in { <emphasis role="strong">Example: Declaring a type-checked <literal>settings</literal> attribute</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> settings = lib.mkOption { type = lib.types.submodule { diff --git a/nixos/doc/manual/from_md/development/writing-documentation.chapter.xml b/nixos/doc/manual/from_md/development/writing-documentation.chapter.xml index 079c80060576..0d8a33df2069 100644 --- a/nixos/doc/manual/from_md/development/writing-documentation.chapter.xml +++ b/nixos/doc/manual/from_md/development/writing-documentation.chapter.xml @@ -23,7 +23,7 @@ $ nix-shell nix-shell$ make </programlisting> <para> - Once you are done making modifications to the manual, it's + Once you are done making modifications to the manual, it’s important to build it before committing. You can do that as follows: </para> diff --git a/nixos/doc/manual/from_md/development/writing-modules.chapter.xml b/nixos/doc/manual/from_md/development/writing-modules.chapter.xml index 367731eda090..35e94845c97e 100644 --- a/nixos/doc/manual/from_md/development/writing-modules.chapter.xml +++ b/nixos/doc/manual/from_md/development/writing-modules.chapter.xml @@ -32,7 +32,7 @@ In <xref linkend="sec-configuration-syntax" />, we saw the following structure of NixOS modules: </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: { option definitions @@ -50,7 +50,7 @@ <emphasis role="strong">Example: Structure of NixOS Modules</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: { @@ -90,7 +90,7 @@ This <literal>imports</literal> list enumerates the paths to other NixOS modules that should be included in the evaluation of the system configuration. A default set of modules is defined in - the file <literal>modules/module-list.nix</literal>. These don't + the file <literal>modules/module-list.nix</literal>. These don’t need to be added in the import list. </para> </listitem> @@ -146,7 +146,7 @@ <emphasis role="strong">Example: NixOS Module for the <quote>locate</quote> Service</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, lib, pkgs, ... }: with lib; @@ -208,7 +208,7 @@ in { <emphasis role="strong">Example: Escaping in Exec directives</emphasis> </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, lib, pkgs, utils, ... }: with lib; diff --git a/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml b/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml index 4db196273dad..dc921dad9749 100644 --- a/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml +++ b/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml @@ -3,7 +3,7 @@ <para> A NixOS test is a module that has the following structure: </para> - <programlisting language="bash"> + <programlisting language="nix"> { # One or more machines: @@ -58,14 +58,14 @@ Tests that are part of NixOS are added to <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/all-tests.nix"><literal>nixos/tests/all-tests.nix</literal></link>. </para> - <programlisting language="bash"> + <programlisting language="nix"> hostname = runTest ./hostname.nix; </programlisting> <para> Overrides can be added by defining an anonymous module in <literal>all-tests.nix</literal>. </para> - <programlisting language="bash"> + <programlisting language="nix"> hostname = runTest { imports = [ ./hostname.nix ]; defaults.networking.firewall.enable = false; @@ -87,7 +87,7 @@ nix-build -A nixosTests.hostname Outside the <literal>nixpkgs</literal> repository, you can instantiate the test by first importing the NixOS library, </para> - <programlisting language="bash"> + <programlisting language="nix"> let nixos-lib = import (nixpkgs + "/nixos/lib") { }; in @@ -255,7 +255,7 @@ start_all() <listitem> <para> Return a list of different interpretations of what is - currently visible on the machine's screen using optical + currently visible on the machine’s screen using optical character recognition. The number and order of the interpretations is not specified and is subject to change, but if no exception is raised at least one will be returned. @@ -276,7 +276,7 @@ start_all() <listitem> <para> Return a textual representation of what is currently visible - on the machine's screen using optical character recognition. + on the machine’s screen using optical character recognition. </para> <note> <para> @@ -536,7 +536,7 @@ start_all() <para> Wait until the supplied regular expressions match a line of the serial console output. This method is useful when OCR is - not possibile or accurate enough. + not possible or accurate enough. </para> </listitem> </varlistentry> @@ -630,10 +630,10 @@ machine.wait_for_unit("xautolock.service", "x-session-user") <literal>stop_job</literal>. </para> <para> - For faster dev cycles it's also possible to disable the - code-linters (this shouldn't be commited though): + For faster dev cycles it’s also possible to disable the + code-linters (this shouldn’t be committed though): </para> - <programlisting language="bash"> + <programlisting language="nix"> { skipLint = true; nodes.machine = @@ -650,10 +650,10 @@ machine.wait_for_unit("xautolock.service", "x-session-user") <para> This will produce a Nix warning at evaluation time. To fully disable the linter, wrap the test script in comment directives to - disable the Black linter directly (again, don't commit this within + disable the Black linter directly (again, don’t commit this within the Nixpkgs repository): </para> - <programlisting language="bash"> + <programlisting language="nix"> testScript = '' # fmt: off @@ -665,7 +665,7 @@ machine.wait_for_unit("xautolock.service", "x-session-user") Similarly, the type checking of test scripts can be disabled in the following way: </para> - <programlisting language="bash"> + <programlisting language="nix"> { skipTypeCheck = true; nodes.machine = @@ -700,25 +700,37 @@ with foo_running: <literal>polling_condition</literal> takes the following (optional) arguments: </para> - <para> - <literal>seconds_interval</literal> - </para> - <para> - : specifies how often the condition should be polled: - </para> + <variablelist> + <varlistentry> + <term> + <literal>seconds_interval</literal> + </term> + <listitem> + <para> + specifies how often the condition should be polled: + </para> + </listitem> + </varlistentry> + </variablelist> <programlisting language="python"> @polling_condition(seconds_interval=10) def foo_running(): machine.succeed("pgrep -x foo") </programlisting> - <para> - <literal>description</literal> - </para> - <para> - : is used in the log when the condition is checked. If this is not - provided, the description is pulled from the docstring of the - function. These two are therefore equivalent: - </para> + <variablelist> + <varlistentry> + <term> + <literal>description</literal> + </term> + <listitem> + <para> + is used in the log when the condition is checked. If this is + not provided, the description is pulled from the docstring + of the function. These two are therefore equivalent: + </para> + </listitem> + </varlistentry> + </variablelist> <programlisting language="python"> @polling_condition def foo_running(): @@ -739,7 +751,7 @@ def foo_running(): <literal>extraPythonPackages</literal>. For example, you could add <literal>numpy</literal> like this: </para> - <programlisting language="bash"> + <programlisting language="nix"> { extraPythonPackages = p: [ p.numpy ]; diff --git a/nixos/doc/manual/from_md/installation/building-nixos.chapter.xml b/nixos/doc/manual/from_md/installation/building-nixos.chapter.xml index ea2d01bebcc2..0e46c1d48ca6 100644 --- a/nixos/doc/manual/from_md/installation/building-nixos.chapter.xml +++ b/nixos/doc/manual/from_md/installation/building-nixos.chapter.xml @@ -24,7 +24,7 @@ </itemizedlist> <para> System images, such as the live installer ones, know how to enforce - configuration settings on wich they immediately depend in order to + configuration settings on which they immediately depend in order to work correctly. </para> <para> @@ -62,7 +62,7 @@ $ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd can create the following file at <literal>modules/installer/cd-dvd/installation-cd-graphical-gnome-macbook.nix</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, ... }: { @@ -102,7 +102,7 @@ $ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd it needs at a minimum for correct functioning, while the installer base image overrides the entire file system layout because there can’t be any other guarantees on a live medium than those given by - the live medium itself. The latter is especially true befor + the live medium itself. The latter is especially true before formatting the target block device(s). On the other hand, the netboot iso only overrides its minimum dependencies since netboot images are always made-to-target. diff --git a/nixos/doc/manual/from_md/installation/changing-config.chapter.xml b/nixos/doc/manual/from_md/installation/changing-config.chapter.xml index 86f0b15b41c5..727c61c45d27 100644 --- a/nixos/doc/manual/from_md/installation/changing-config.chapter.xml +++ b/nixos/doc/manual/from_md/installation/changing-config.chapter.xml @@ -16,7 +16,7 @@ </para> <warning> <para> - This command doesn't start/stop + This command doesn’t start/stop <link linkend="opt-systemd.user.services">user services</link> automatically. <literal>nixos-rebuild</literal> only runs a <literal>daemon-reload</literal> for each user with running user @@ -64,8 +64,8 @@ <para> which causes the new configuration (and previous ones created using <literal>-p test</literal>) to show up in the GRUB submenu - <quote>NixOS - Profile 'test'</quote>. This can be useful to - separate test configurations from <quote>stable</quote> + <quote>NixOS - Profile <quote>test</quote></quote>. This can be + useful to separate test configurations from <quote>stable</quote> configurations. </para> <para> @@ -94,7 +94,7 @@ $ ./result/bin/run-*-vm unless you have set <literal>mutableUsers = false</literal>. Another way is to temporarily add the following to your configuration: </para> - <programlisting language="bash"> + <programlisting language="nix"> users.users.your-user.initialHashedPassword = "test"; </programlisting> <para> diff --git a/nixos/doc/manual/from_md/installation/installing-behind-a-proxy.section.xml b/nixos/doc/manual/from_md/installation/installing-behind-a-proxy.section.xml index a551807cd47c..00b4e8766718 100644 --- a/nixos/doc/manual/from_md/installation/installing-behind-a-proxy.section.xml +++ b/nixos/doc/manual/from_md/installation/installing-behind-a-proxy.section.xml @@ -11,7 +11,7 @@ <literal>/mnt/etc/nixos/configuration.nix</literal> to keep the internet accessible after reboot. </para> - <programlisting language="bash"> + <programlisting language="nix"> networking.proxy.default = "http://user:password@proxy:port/"; networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; </programlisting> diff --git a/nixos/doc/manual/from_md/installation/installing-from-other-distro.section.xml b/nixos/doc/manual/from_md/installation/installing-from-other-distro.section.xml index 35309a7aa326..5f18d528d32d 100644 --- a/nixos/doc/manual/from_md/installation/installing-from-other-distro.section.xml +++ b/nixos/doc/manual/from_md/installation/installing-from-other-distro.section.xml @@ -53,7 +53,7 @@ $ . $HOME/.nix-profile/etc/profile.d/nix.sh # …or open a fresh shell Switch to the NixOS channel: </para> <para> - If you've just installed Nix on a non-NixOS distribution, you + If you’ve just installed Nix on a non-NixOS distribution, you will be on the <literal>nixpkgs</literal> channel by default. </para> <programlisting> @@ -78,11 +78,11 @@ $ nix-channel --add https://nixos.org/channels/nixos-version nixpkgs Install the NixOS installation tools: </para> <para> - You'll need <literal>nixos-generate-config</literal> and + You’ll need <literal>nixos-generate-config</literal> and <literal>nixos-install</literal>, but this also makes some man pages and <literal>nixos-enter</literal> available, just in case you want to chroot into your NixOS partition. NixOS installs - these by default, but you don't have NixOS yet.. + these by default, but you don’t have NixOS yet.. </para> <programlisting> $ nix-env -f '<nixpkgs>' -iA nixos-install-tools @@ -105,7 +105,7 @@ $ nix-env -f '<nixpkgs>' -iA nixos-install-tools mounting steps of <xref linkend="sec-installation" /> </para> <para> - If you're about to install NixOS in place using + If you’re about to install NixOS in place using <literal>NIXOS_LUSTRATE</literal> there is nothing to do for this step. </para> @@ -118,18 +118,18 @@ $ nix-env -f '<nixpkgs>' -iA nixos-install-tools $ sudo `which nixos-generate-config` --root /mnt </programlisting> <para> - You'll probably want to edit the configuration files. Refer to + You’ll probably want to edit the configuration files. Refer to the <literal>nixos-generate-config</literal> step in <xref linkend="sec-installation" /> for more information. </para> <para> Consider setting up the NixOS bootloader to give you the ability to boot on your existing Linux partition. For instance, if - you're using GRUB and your existing distribution is running + you’re using GRUB and your existing distribution is running Ubuntu, you may want to add something like this to your <literal>configuration.nix</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.loader.grub.extraEntries = '' menuentry "Ubuntu" { search --set=ubuntu --fs-uuid 3cc3e652-0c1f-4800-8451-033754f68e6e @@ -215,21 +215,21 @@ $ sudo `which nixos-generate-config` </programlisting> <para> Note that this will place the generated configuration files in - <literal>/etc/nixos</literal>. You'll probably want to edit the + <literal>/etc/nixos</literal>. You’ll probably want to edit the configuration files. Refer to the <literal>nixos-generate-config</literal> step in <xref linkend="sec-installation" /> for more information. </para> <para> - You'll likely want to set a root password for your first boot - using the configuration files because you won't have a chance to - enter a password until after you reboot. You can initalize the + You’ll likely want to set a root password for your first boot + using the configuration files because you won’t have a chance to + enter a password until after you reboot. You can initialize the root password to an empty one with this line: (and of course - don't forget to set one once you've rebooted or to lock the + don’t forget to set one once you’ve rebooted or to lock the account with <literal>sudo passwd -l root</literal> if you use <literal>sudo</literal>) </para> - <programlisting language="bash"> + <programlisting language="nix"> users.users.root.initialHashedPassword = ""; </programlisting> </listitem> @@ -262,7 +262,7 @@ $ sudo chown -R 0:0 /nix </para> <para> <literal>/etc/NIXOS_LUSTRATE</literal> tells the NixOS bootup - scripts to move <emphasis>everything</emphasis> that's in the + scripts to move <emphasis>everything</emphasis> that’s in the root partition to <literal>/old-root</literal>. This will move your existing distribution out of the way in the very early stages of the NixOS bootup. There are exceptions (we do need to @@ -290,12 +290,12 @@ $ sudo chown -R 0:0 /nix <note> <para> Support for <literal>NIXOS_LUSTRATE</literal> was added in - NixOS 16.09. The act of "lustrating" refers to the - wiping of the existing distribution. Creating + NixOS 16.09. The act of <quote>lustrating</quote> refers to + the wiping of the existing distribution. Creating <literal>/etc/NIXOS_LUSTRATE</literal> can also be used on NixOS to remove all mutable files from your root partition - (anything that's not in <literal>/nix</literal> or - <literal>/boot</literal> gets "lustrated" on the + (anything that’s not in <literal>/nix</literal> or + <literal>/boot</literal> gets <quote>lustrated</quote> on the next boot. </para> <para> @@ -307,14 +307,14 @@ $ sudo chown -R 0:0 /nix </para> </note> <para> - Let's create the files: + Let’s create the files: </para> <programlisting> $ sudo touch /etc/NIXOS $ sudo touch /etc/NIXOS_LUSTRATE </programlisting> <para> - Let's also make sure the NixOS configuration files are kept once + Let’s also make sure the NixOS configuration files are kept once we reboot on NixOS: </para> <programlisting> @@ -331,7 +331,7 @@ $ echo etc/nixos | sudo tee -a /etc/NIXOS_LUSTRATE <warning> <para> Once you complete this step, your current distribution will no - longer be bootable! If you didn't get all the NixOS + longer be bootable! If you didn’t get all the NixOS configuration right, especially those settings pertaining to boot loading and root partition, NixOS may not be bootable either. Have a USB rescue device ready in case this happens. @@ -349,7 +349,7 @@ sudo /nix/var/nix/profiles/system/bin/switch-to-configuration boot <listitem> <para> If for some reason you want to revert to the old distribution, - you'll need to boot on a USB rescue disk and do something along + you’ll need to boot on a USB rescue disk and do something along these lines: </para> <programlisting> @@ -367,7 +367,7 @@ sudo /nix/var/nix/profiles/system/bin/switch-to-configuration boot loader. </para> <para> - And of course, if you're happy with NixOS and no longer need the + And of course, if you’re happy with NixOS and no longer need the old distribution: </para> <programlisting> @@ -376,7 +376,7 @@ sudo rm -rf /old-root </listitem> <listitem> <para> - It's also worth noting that this whole process can be automated. + It’s also worth noting that this whole process can be automated. This is especially useful for Cloud VMs, where provider do not provide NixOS. For instance, <link xlink:href="https://github.com/elitak/nixos-infect">nixos-infect</link> diff --git a/nixos/doc/manual/from_md/installation/installing-kexec.section.xml b/nixos/doc/manual/from_md/installation/installing-kexec.section.xml index 46ea0d59b6c3..40a697c74096 100644 --- a/nixos/doc/manual/from_md/installation/installing-kexec.section.xml +++ b/nixos/doc/manual/from_md/installation/installing-kexec.section.xml @@ -54,7 +54,7 @@ nix-build -A kexec.x86_64-linux '<nixpkgs/nixos/release.nix>' running Linux Distribution. </para> <para> - Note it’s symlinks pointing elsewhere, so <literal>cd</literal> in, + Note its symlinks pointing elsewhere, so <literal>cd</literal> in, and use <literal>scp * root@$destination</literal> to copy it over, rather than rsync. </para> @@ -69,7 +69,7 @@ nix-build -A kexec.x86_64-linux '<nixpkgs/nixos/release.nix>' instead of the default installer image, you can build your own <literal>configuration.nix</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> { modulesPath, ... }: { imports = [ (modulesPath + "/installer/netboot/netboot-minimal.nix") diff --git a/nixos/doc/manual/from_md/installation/installing-usb.section.xml b/nixos/doc/manual/from_md/installation/installing-usb.section.xml index 9d12ac45aac2..cb0fd95bc7c5 100644 --- a/nixos/doc/manual/from_md/installation/installing-usb.section.xml +++ b/nixos/doc/manual/from_md/installation/installing-usb.section.xml @@ -110,15 +110,15 @@ diskutil unmountDisk diskX sudo dd if=<path-to-image> of=/dev/rdiskX bs=4m </programlisting> <para> - After <literal>dd</literal> completes, a GUI dialog "The disk - you inserted was not readable by this computer" will pop up, - which can be ignored. + After <literal>dd</literal> completes, a GUI dialog <quote>The + disk you inserted was not readable by this computer</quote> will + pop up, which can be ignored. </para> <note> <para> - Using the 'raw' <literal>rdiskX</literal> device instead of - <literal>diskX</literal> with dd completes in minutes instead of - hours. + Using the <quote>raw</quote> <literal>rdiskX</literal> device + instead of <literal>diskX</literal> with dd completes in minutes + instead of hours. </para> </note> <orderedlist numeration="arabic" spacing="compact"> diff --git a/nixos/doc/manual/from_md/installation/installing-virtualbox-guest.section.xml b/nixos/doc/manual/from_md/installation/installing-virtualbox-guest.section.xml index c8bb286c8f33..e43508185299 100644 --- a/nixos/doc/manual/from_md/installation/installing-virtualbox-guest.section.xml +++ b/nixos/doc/manual/from_md/installation/installing-virtualbox-guest.section.xml @@ -1,4 +1,4 @@ -<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-instaling-virtualbox-guest"> +<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-installing-virtualbox-guest"> <title>Installing in a VirtualBox guest</title> <para> Installing NixOS into a VirtualBox guest is convenient for users who @@ -11,8 +11,8 @@ <orderedlist numeration="arabic"> <listitem> <para> - Add a New Machine in VirtualBox with OS Type "Linux / Other - Linux" + Add a New Machine in VirtualBox with OS Type <quote>Linux / + Other Linux</quote> </para> </listitem> <listitem> @@ -38,7 +38,7 @@ <listitem> <para> Click on Settings / System / Acceleration and enable - "VT-x/AMD-V" acceleration + <quote>VT-x/AMD-V</quote> acceleration </para> </listitem> <listitem> @@ -58,25 +58,25 @@ There are a few modifications you should make in configuration.nix. Enable booting: </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.loader.grub.device = "/dev/sda"; </programlisting> <para> Also remove the fsck that runs at startup. It will always fail to run, stopping your boot until you press <literal>*</literal>. </para> - <programlisting language="bash"> + <programlisting language="nix"> boot.initrd.checkJournalingFS = false; </programlisting> <para> Shared folders can be given a name and a path in the host system in the VirtualBox settings (Machine / Settings / Shared Folders, then - click on the "Add" icon). Add the following to the + click on the <quote>Add</quote> icon). Add the following to the <literal>/etc/nixos/configuration.nix</literal> to auto-mount them. If you do not add <literal>"nofail"</literal>, the system will not boot properly. </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ...} : { fileSystems."/virtualboxshare" = { diff --git a/nixos/doc/manual/from_md/installation/installing.chapter.xml b/nixos/doc/manual/from_md/installation/installing.chapter.xml index f2ed58c0c1fe..5654eb424fc3 100644 --- a/nixos/doc/manual/from_md/installation/installing.chapter.xml +++ b/nixos/doc/manual/from_md/installation/installing.chapter.xml @@ -256,7 +256,7 @@ $ sudo -i </para> <para> On the minimal installer, NetworkManager is not available, so - configuration must be perfomed manually. To configure the wifi, + configuration must be performed manually. To configure the wifi, first start wpa_supplicant with <literal>sudo systemctl start wpa_supplicant</literal>, then run <literal>wpa_cli</literal>. For most home networks, you need to @@ -345,12 +345,12 @@ OK <!-- legacy anchor --> </para> <para> - Here's an example partition scheme for UEFI, using + Here’s an example partition scheme for UEFI, using <literal>/dev/sda</literal> as the device. </para> <note> <para> - You can safely ignore <literal>parted</literal>'s + You can safely ignore <literal>parted</literal>’s informational message about needing to update /etc/fstab. </para> </note> @@ -415,12 +415,12 @@ OK <!-- legacy anchor --> </para> <para> - Here's an example partition scheme for Legacy Boot, using + Here’s an example partition scheme for Legacy Boot, using <literal>/dev/sda</literal> as the device. </para> <note> <para> - You can safely ignore <literal>parted</literal>'s + You can safely ignore <literal>parted</literal>’s informational message about needing to update /etc/fstab. </para> </note> diff --git a/nixos/doc/manual/from_md/installation/upgrading.chapter.xml b/nixos/doc/manual/from_md/installation/upgrading.chapter.xml index f6aedc800aca..9f4cfaf36b62 100644 --- a/nixos/doc/manual/from_md/installation/upgrading.chapter.xml +++ b/nixos/doc/manual/from_md/installation/upgrading.chapter.xml @@ -128,7 +128,7 @@ nixos https://nixos.org/channels/nixos-unstable You can keep a NixOS system up-to-date automatically by adding the following to <literal>configuration.nix</literal>: </para> - <programlisting language="bash"> + <programlisting language="nix"> system.autoUpgrade.enable = true; system.autoUpgrade.allowReboot = true; </programlisting> @@ -145,7 +145,7 @@ system.autoUpgrade.allowReboot = true; contains a different kernel, initrd or kernel modules. You can also specify a channel explicitly, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> system.autoUpgrade.channel = https://nixos.org/channels/nixos-22.11; </programlisting> </section> diff --git a/nixos/doc/manual/from_md/release-notes/rl-1404.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1404.section.xml index 8771623b468a..5686545c1afb 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-1404.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-1404.section.xml @@ -79,7 +79,7 @@ the NixOS configuration. For instance, if a package <literal>foo</literal> provides systemd units, you can say: </para> - <programlisting language="bash"> + <programlisting language="nix"> { systemd.packages = [ pkgs.foo ]; } @@ -88,7 +88,7 @@ to enable those units. You can then set or override unit options in the usual way, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> { systemd.services.foo.wantedBy = [ "multi-user.target" ]; systemd.services.foo.serviceConfig.MemoryLimit = "512M"; @@ -105,7 +105,7 @@ NixOS configuration requires unfree packages from Nixpkgs, you need to enable support for them explicitly by setting: </para> - <programlisting language="bash"> + <programlisting language="nix"> { nixpkgs.config.allowUnfree = true; } @@ -123,7 +123,7 @@ The Adobe Flash player is no longer enabled by default in the Firefox and Chromium wrappers. To enable it, you must set: </para> - <programlisting language="bash"> + <programlisting language="nix"> { nixpkgs.config.allowUnfree = true; nixpkgs.config.firefox.enableAdobeFlash = true; # for Firefox @@ -136,7 +136,7 @@ The firewall is now enabled by default. If you don’t want this, you need to disable it explicitly: </para> - <programlisting language="bash"> + <programlisting language="nix"> { networking.firewall.enable = false; } diff --git a/nixos/doc/manual/from_md/release-notes/rl-1412.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1412.section.xml index 3b6af73359d6..ccaa4f6bd081 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-1412.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-1412.section.xml @@ -370,7 +370,7 @@ documentation</link> for details. If you wish to continue to use httpd 2.2, add the following line to your NixOS configuration: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.httpd.package = pkgs.apacheHttpd_2_2; } diff --git a/nixos/doc/manual/from_md/release-notes/rl-1509.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1509.section.xml index 68d2ab389e8f..96b51a051066 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-1509.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-1509.section.xml @@ -9,12 +9,12 @@ <para> The <link xlink:href="http://haskell.org/">Haskell</link> packages infrastructure has been re-designed from the ground up - ("Haskell NG"). NixOS now distributes the latest + (<quote>Haskell NG</quote>). NixOS now distributes the latest version of every single package registered on <link xlink:href="http://hackage.haskell.org/">Hackage</link> -- well in excess of 8,000 Haskell packages. Detailed instructions on how to use that infrastructure can be found in the - <link xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's + <link xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User’s Guide to the Haskell Infrastructure</link>. Users migrating from an earlier release may find helpful information below, in the list of backwards-incompatible changes. Furthermore, we @@ -23,8 +23,8 @@ Haskell</link> release since version 0.0 as well as the most recent <link xlink:href="http://www.stackage.org/">Stackage Nightly</link> snapshot. The announcement - <link xlink:href="https://nixos.org/nix-dev/2015-September/018138.html">"Full - Stackage Support in Nixpkgs"</link> gives additional + <link xlink:href="https://nixos.org/nix-dev/2015-September/018138.html"><quote>Full + Stackage Support in Nixpkgs</quote></link> gives additional details. </para> </listitem> @@ -42,7 +42,7 @@ </para> </listitem> </itemizedlist> - <programlisting language="bash"> + <programlisting language="nix"> { system.autoUpgrade.enable = true; } @@ -432,7 +432,7 @@ </para> </listitem> </itemizedlist> - <programlisting language="bash"> + <programlisting language="nix"> { system.stateVersion = "14.12"; } @@ -464,7 +464,7 @@ </listitem> <listitem> <para> - Steam now doesn't need root rights to work. Instead of using + Steam now doesn’t need root rights to work. Instead of using <literal>*-steam-chrootenv</literal>, you should now just run <literal>steam</literal>. <literal>steamChrootEnv</literal> package was renamed to <literal>steam</literal>, and old @@ -523,7 +523,7 @@ </para> </listitem> </itemizedlist> - <programlisting language="bash"> + <programlisting language="nix"> { fileSystems."/shiny" = { device = "myshinysharedfolder"; @@ -534,15 +534,15 @@ <itemizedlist spacing="compact"> <listitem> <para> - "<literal>nix-env -qa</literal>" no longer discovers - Haskell packages by name. The only packages visible in the - global scope are <literal>ghc</literal>, + <quote><literal>nix-env -qa</literal></quote> no longer + discovers Haskell packages by name. The only packages visible in + the global scope are <literal>ghc</literal>, <literal>cabal-install</literal>, and <literal>stack</literal>, but all other packages are hidden. The reason for this inconvenience is the sheer size of the Haskell package set. Name-based lookups are expensive, and most <literal>nix-env -qa</literal> operations would become much - slower if we'd add the entire Hackage database into the top + slower if we’d add the entire Hackage database into the top level attribute set. Instead, the list of Haskell packages can be displayed by running: </para> @@ -566,13 +566,13 @@ nix-env -f "<nixpkgs>" -iA haskellPackages.pandoc <para> Previous versions of NixOS came with a feature called <literal>ghc-wrapper</literal>, a small script that allowed GHC - to transparently pick up on libraries installed in the user's + to transparently pick up on libraries installed in the user’s profile. This feature has been deprecated; <literal>ghc-wrapper</literal> was removed from the distribution. The proper way to register Haskell libraries with the compiler now is the <literal>haskellPackages.ghcWithPackages</literal> function. The - <link xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User's + <link xlink:href="https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure">User’s Guide to the Haskell Infrastructure</link> provides more information about this subject. </para> @@ -593,7 +593,7 @@ nix-env -f "<nixpkgs>" -iA haskellPackages.pandoc have a function attribute called <literal>extension</literal> that users could override in their <literal>~/.nixpkgs/config.nix</literal> files to configure - additional attributes, etc. That function still exists, but it's + additional attributes, etc. That function still exists, but it’s now called <literal>overrides</literal>. </para> </listitem> @@ -662,7 +662,7 @@ infinite recursion encountered <literal>lib</literal>, after adding it as argument of the module. The following module </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: with pkgs.lib; @@ -677,7 +677,7 @@ with pkgs.lib; <para> should be modified to look like: </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, lib, ... }: with lib; @@ -695,7 +695,7 @@ with lib; replaced by <literal>(import <nixpkgs> {})</literal>. The following module </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: let @@ -712,7 +712,7 @@ in <para> should be modified to look like: </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, pkgs, ... }: let @@ -748,7 +748,7 @@ in <literal>/etc/ssh/moduli</literal> file with respect to the <link xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html">vulnerabilities discovered in the Diffie-Hellman key exchange</link> can now - replace OpenSSH's default version with one they generated + replace OpenSSH’s default version with one they generated themselves using the new <literal>services.openssh.moduliFile</literal> option. </para> diff --git a/nixos/doc/manual/from_md/release-notes/rl-1603.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1603.section.xml index 172b800b5992..25b356e0aa6a 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-1603.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-1603.section.xml @@ -378,7 +378,7 @@ You will need to add an import statement to your NixOS configuration in order to use it, e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> { imports = [ <nixpkgs/nixos/modules/services/misc/gitit.nix> ]; } @@ -395,7 +395,7 @@ to be built in. All modules now reside in <literal>nginxModules</literal> set. Example configuration: </para> - <programlisting language="bash"> + <programlisting language="nix"> nginx.override { modules = [ nginxModules.rtmp nginxModules.dav nginxModules.moreheaders ]; } @@ -403,7 +403,7 @@ nginx.override { </listitem> <listitem> <para> - <literal>s3sync</literal> is removed, as it hasn't been + <literal>s3sync</literal> is removed, as it hasn’t been developed by upstream for 4 years and only runs with ruby 1.8. For an actively-developer alternative look at <literal>tarsnap</literal> and others. @@ -411,7 +411,7 @@ nginx.override { </listitem> <listitem> <para> - <literal>ruby_1_8</literal> has been removed as it's not + <literal>ruby_1_8</literal> has been removed as it’s not supported from upstream anymore and probably contains security issues. </para> @@ -439,7 +439,7 @@ nginx.override { <listitem> <para> The <literal>Ctrl+Alt+Backspace</literal> key combination no - longer kills the X server by default. There's a new option + longer kills the X server by default. There’s a new option <literal>services.xserver.enableCtrlAltBackspace</literal> allowing to enable the combination again. </para> @@ -457,7 +457,7 @@ nginx.override { <literal>/var/lib/postfix</literal>. Old configurations are migrated automatically. <literal>service.postfix</literal> module has also received many improvements, such as correct - directories' access rights, new <literal>aliasFiles</literal> + directories’ access rights, new <literal>aliasFiles</literal> and <literal>mapFiles</literal> options and more. </para> </listitem> @@ -468,7 +468,7 @@ nginx.override { continue to work, but print a warning, until the 16.09 release. An example of the new style: </para> - <programlisting language="bash"> + <programlisting language="nix"> { fileSystems."/example" = { device = "/dev/sdc"; @@ -497,7 +497,7 @@ nginx.override { <para> There are also Gutenprint improvements; in particular, a new option <literal>services.printing.gutenprint</literal> is added - to enable automatic updating of Gutenprint PPMs; it's greatly + to enable automatic updating of Gutenprint PPMs; it’s greatly recommended to enable it instead of adding <literal>gutenprint</literal> to the <literal>drivers</literal> list. @@ -524,7 +524,7 @@ nginx.override { used input method name, <literal>"ibus"</literal> for ibus. An example of the new style: </para> - <programlisting language="bash"> + <programlisting language="nix"> { i18n.inputMethod.enabled = "ibus"; i18n.inputMethod.ibus.engines = with pkgs.ibus-engines; [ anthy mozc ]; @@ -533,7 +533,7 @@ nginx.override { <para> That is equivalent to the old version: </para> - <programlisting language="bash"> + <programlisting language="nix"> { programs.ibus.enable = true; programs.ibus.plugins = with pkgs; [ ibus-anthy mozc ]; @@ -545,7 +545,7 @@ nginx.override { <literal>services.udev.extraRules</literal> option now writes rules to <literal>99-local.rules</literal> instead of <literal>10-local.rules</literal>. This makes all the user rules - apply after others, so their results wouldn't be overriden by + apply after others, so their results wouldn’t be overridden by anything else. </para> </listitem> @@ -587,7 +587,7 @@ $TTL 1800 point to exact folder where syncthing is writing to. Example configuration should look something like: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.syncthing = { enable = true; @@ -632,8 +632,8 @@ error: path ‘/nix/store/*-broadcom-sta-*’ does not exist and cannot be creat The <literal>services.xserver.startGnuPGAgent</literal> option has been removed. GnuPG 2.1.x changed the way the gpg-agent works, and that new approach no longer requires (or even - supports) the "start everything as a child of the - agent" scheme we've implemented in NixOS for older + supports) the <quote>start everything as a child of the + agent</quote> scheme we’ve implemented in NixOS for older versions. To configure the gpg-agent for your X session, add the following code to <literal>~/.bashrc</literal> or some file that’s sourced when your shell is started: @@ -670,7 +670,7 @@ export GPG_TTY </programlisting> <para> The <literal>gpg-agent(1)</literal> man page has more details - about this subject, i.e. in the "EXAMPLES" section. + about this subject, i.e. in the <quote>EXAMPLES</quote> section. </para> </listitem> </itemizedlist> diff --git a/nixos/doc/manual/from_md/release-notes/rl-1609.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1609.section.xml index 0fba40a0e78d..c2adbc88f5ca 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-1609.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-1609.section.xml @@ -78,7 +78,7 @@ LTS Haskell package set. That support has been dropped. The previously provided <literal>haskell.packages.lts-x_y</literal> package sets still exist in name to aviod breaking user code, - but these package sets don't actually contain the versions + but these package sets don’t actually contain the versions mandated by the corresponding LTS release. Instead, our package set it loosely based on the latest available LTS release, i.e. LTS 7.x at the time of this writing. New releases of NixOS and @@ -119,7 +119,7 @@ </listitem> <listitem> <para> - Gitlab's maintainance script <literal>gitlab-runner</literal> + Gitlab’s maintainance script <literal>gitlab-runner</literal> was removed and split up into the more clearer <literal>gitlab-run</literal> and <literal>gitlab-rake</literal> scripts, because <literal>gitlab-runner</literal> is a component @@ -164,7 +164,7 @@ <para> <literal>goPackages</literal> was replaced with separated Go applications in appropriate <literal>nixpkgs</literal> - categories. Each Go package uses its own dependency set. There's + categories. Each Go package uses its own dependency set. There’s also a new <literal>go2nix</literal> tool introduced to generate a Go package definition from its Go source automatically. </para> @@ -192,7 +192,7 @@ interface has been streamlined. Desktop users should be able to simply set </para> - <programlisting language="bash"> + <programlisting language="nix"> { security.grsecurity.enable = true; } diff --git a/nixos/doc/manual/from_md/release-notes/rl-1703.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1703.section.xml index 1119ec53dfc9..8667063f37e0 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-1703.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-1703.section.xml @@ -22,7 +22,7 @@ </listitem> <listitem> <para> - The default desktop environment now is KDE's Plasma 5. KDE 4 + The default desktop environment now is KDE’s Plasma 5. KDE 4 has been removed </para> </listitem> @@ -560,7 +560,7 @@ Parsoid service now uses YAML configuration format. <literal>service.parsoid.interwikis</literal> is now called <literal>service.parsoid.wikis</literal> and is a list of - either API URLs or attribute sets as specified in parsoid's + either API URLs or attribute sets as specified in parsoid’s documentation. </para> </listitem> @@ -581,7 +581,7 @@ <literal>service.nylon</literal> is now declared using named instances. As an example: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.nylon = { enable = true; @@ -594,7 +594,7 @@ <para> should be replaced with: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.nylon.myvpn = { enable = true; @@ -615,7 +615,7 @@ <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install"> overlays</link>. For example, the following code: </para> - <programlisting language="bash"> + <programlisting language="nix"> let pkgs = import <nixpkgs> {}; in @@ -624,7 +624,7 @@ in <para> should be replaced by: </para> - <programlisting language="bash"> + <programlisting language="nix"> let pkgs = import <nixpkgs> {}; in @@ -647,7 +647,7 @@ in <listitem> <para> <literal>local_recipient_maps</literal> is not set to empty - value by Postfix service. It's an insecure default as stated + value by Postfix service. It’s an insecure default as stated by Postfix documentation. Those who want to retain this setting need to set it via <literal>services.postfix.extraConfig</literal>. @@ -669,7 +669,7 @@ in <listitem> <para> The socket handling of the <literal>services.rmilter</literal> - module has been fixed and refactored. As rmilter doesn't + module has been fixed and refactored. As rmilter doesn’t support binding to more than one socket, the options <literal>bindUnixSockets</literal> and <literal>bindInetSockets</literal> have been replaced by @@ -729,7 +729,7 @@ in improves visual consistency and makes Java follow system font style, improving the situation on HighDPI displays. This has a cost of increased closure size; for server and other headless - workloads it's recommended to use + workloads it’s recommended to use <literal>jre_headless</literal>. </para> </listitem> diff --git a/nixos/doc/manual/from_md/release-notes/rl-1709.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1709.section.xml index 8f0efe816e51..849ec868c783 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-1709.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-1709.section.xml @@ -26,10 +26,10 @@ The module option <literal>services.xserver.xrandrHeads</literal> now causes the first head specified in this list to be set as the primary - head. Apart from that, it's now possible to also set + head. Apart from that, it’s now possible to also set additional options by using an attribute set, for example: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.xserver.xrandrHeads = [ "HDMI-0" { @@ -543,7 +543,7 @@ </listitem> <listitem> <para> - Radicale's default package has changed from 1.x to 2.x. + Radicale’s default package has changed from 1.x to 2.x. Instructions to migrate can be found <link xlink:href="http://radicale.org/1to2/"> here </link>. It is also possible to use the newer version by @@ -582,7 +582,7 @@ </listitem> <listitem> <para> - <literal>flexget</literal>'s state database cannot be upgraded + <literal>flexget</literal>’s state database cannot be upgraded to its new internal format, requiring removal of any existing <literal>db-config.sqlite</literal> which will be automatically recreated. @@ -590,9 +590,9 @@ </listitem> <listitem> <para> - The <literal>ipfs</literal> service now doesn't ignore the - <literal>dataDir</literal> option anymore. If you've ever set - this option to anything other than the default you'll have to + The <literal>ipfs</literal> service now doesn’t ignore the + <literal>dataDir</literal> option anymore. If you’ve ever set + this option to anything other than the default you’ll have to either unset it (so the default gets used) or migrate the old data manually with </para> @@ -651,22 +651,22 @@ rmdir /var/lib/ipfs/.ipfs </listitem> <listitem> <para> - <literal>cc-wrapper</literal>'s setup-hook now exports a + <literal>cc-wrapper</literal><quote>s setup-hook now exports a number of environment variables corresponding to binutils binaries, (e.g. <literal>LD</literal>, <literal>STRIP</literal>, <literal>RANLIB</literal>, etc). - This is done to prevent packages' build systems guessing, - which is harder to predict, especially when cross-compiling. - However, some packages have broken due to this—their build - systems either not supporting, or claiming to support without - adequate testing, taking such environment variables as - parameters. + This is done to prevent packages</quote> build systems + guessing, which is harder to predict, especially when + cross-compiling. However, some packages have broken due to + this—their build systems either not supporting, or claiming to + support without adequate testing, taking such environment + variables as parameters. </para> </listitem> <listitem> <para> <literal>services.firefox.syncserver</literal> now runs by - default as a non-root user. To accomodate this change, the + default as a non-root user. To accommodate this change, the default sqlite database location has also been changed. Migration should work automatically. Refer to the description of the options for more details. @@ -688,10 +688,10 @@ rmdir /var/lib/ipfs/.ipfs </listitem> <listitem> <para> - grsecurity/PaX support has been dropped, following upstream's + grsecurity/PaX support has been dropped, following upstream’s decision to cease free support. See <link xlink:href="https://grsecurity.net/passing_the_baton.php"> - upstream's announcement</link> for more information. No + upstream’s announcement</link> for more information. No complete replacement for grsecurity/PaX is available presently. </para> @@ -794,7 +794,7 @@ FLUSH PRIVILEGES; <para> Modules can now be disabled by using <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-replace-modules"> - disabledModules</link>, allowing another to take it's place. + disabledModules</link>, allowing another to take it’s place. This can be used to import a set of modules from another channel while keeping the rest of the system on a stable release. @@ -808,7 +808,7 @@ FLUSH PRIVILEGES; provided by fontconfig-penultimate, replacing fontconfig-ultimate; the new defaults are less invasive and provide rendering that is more consistent with other systems - and hopefully with each font designer's intent. Some + and hopefully with each font designer’s intent. Some system-wide configuration has been removed from the Fontconfig NixOS module where user Fontconfig settings are available. </para> diff --git a/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml index 910cad467e9d..f197c52906b0 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml @@ -16,9 +16,9 @@ <listitem> <para> Platform support: x86_64-linux and x86_64-darwin since release - time (the latter isn't NixOS, really). Binaries for + time (the latter isn’t NixOS, really). Binaries for aarch64-linux are available, but no channel exists yet, as - it's waiting for some test fixes, etc. + it’s waiting for some test fixes, etc. </para> </listitem> <listitem> @@ -495,11 +495,11 @@ <para> The propagation logic has been changed. The new logic, along with new types of dependencies that go with, is thoroughly - documented in the "Specifying dependencies" section - of the "Standard Environment" chapter of the nixpkgs - manual. The old logic isn't but is easy to describe: - dependencies were propagated as the same type of dependency no - matter what. In practice, that means that many + documented in the <quote>Specifying dependencies</quote> + section of the <quote>Standard Environment</quote> chapter of + the nixpkgs manual. The old logic isn’t but is easy to + describe: dependencies were propagated as the same type of + dependency no matter what. In practice, that means that many <literal>propagatedNativeBuildInputs</literal> should instead be <literal>propagatedBuildInputs</literal>. Thankfully, that was and is the least used type of dependency. Also, it means @@ -541,7 +541,7 @@ Previously, if other options in the Postfix module like <literal>services.postfix.useSrs</literal> were set and the user set config options that were also set by such options, - the resulting config wouldn't include all options that were + the resulting config wouldn’t include all options that were needed. They are now merged correctly. If config options need to be overridden, <literal>lib.mkForce</literal> or <literal>lib.mkOverride</literal> can be used. @@ -626,7 +626,7 @@ if <literal>config.networking.domain</literal> is set, <literal>matomo.${config.networking.hostName}</literal> if it is not set. If you change your - <literal>serverName</literal>, remember you'll need to + <literal>serverName</literal>, remember you’ll need to update the <literal>trustedHosts[]</literal> array in <literal>/var/lib/matomo/config/config.ini.php</literal> as well. @@ -793,7 +793,7 @@ <para> <literal>services.btrfs.autoScrub</literal> has been added, to periodically check btrfs filesystems for data corruption. If - there's a correct copy available, it will automatically repair + there’s a correct copy available, it will automatically repair corrupted blocks. </para> </listitem> @@ -830,7 +830,7 @@ <para> In order to have the previous default configuration add </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.xserver.displayManager.lightdm.greeters.gtk.indicators = [ "~host" "~spacer" diff --git a/nixos/doc/manual/from_md/release-notes/rl-1809.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1809.section.xml index aa4637a99b60..4bbfa7be398e 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-1809.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-1809.section.xml @@ -54,7 +54,7 @@ <para> For example </para> - <programlisting language="bash"> + <programlisting language="nix"> { programs.firejail = { enable = true; @@ -523,8 +523,8 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' <listitem> <para> The <literal>netcat</literal> package is now taken directly - from OpenBSD's <literal>libressl</literal>, instead of relying - on Debian's fork. The new version should be very close to the + from OpenBSD’s <literal>libressl</literal>, instead of relying + on Debian’s fork. The new version should be very close to the old version, but there are some minor differences. Importantly, flags like -b, -q, -C, and -Z are no longer accepted by the nc command. @@ -533,7 +533,7 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' <listitem> <para> The <literal>services.docker-registry.extraConfig</literal> - object doesn't contain environment variables anymore. Instead + object doesn’t contain environment variables anymore. Instead it needs to provide an object structure that can be mapped onto the YAML configuration defined in <link xlink:href="https://github.com/docker/distribution/blob/v2.6.2/docs/configuration.md">the @@ -543,7 +543,7 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' <listitem> <para> <literal>gnucash</literal> has changed from version 2.4 to - 3.x. If you've been using <literal>gnucash</literal> (version + 3.x. If you’ve been using <literal>gnucash</literal> (version 2.4) instead of <literal>gnucash26</literal> (version 2.6) you must open your Gnucash data file(s) with <literal>gnucash26</literal> and then save them to upgrade the @@ -695,7 +695,7 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' A NixOS system can now be constructed more easily based on a preexisting invocation of Nixpkgs. For example: </para> - <programlisting language="bash"> + <programlisting language="nix"> { inherit (pkgs.nixos { boot.loader.grub.enable = false; @@ -791,7 +791,7 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' <para> An example usage of this would be: </para> - <programlisting language="bash"> + <programlisting language="nix"> { config, ... }: { @@ -874,7 +874,7 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' The <literal>programs.screen</literal> module provides allows to configure <literal>/etc/screenrc</literal>, however the module behaved fairly counterintuitive as the config exists, - but the package wasn't available. Since 18.09 + but the package wasn’t available. Since 18.09 <literal>pkgs.screen</literal> will be added to <literal>environment.systemPackages</literal>. </para> @@ -920,7 +920,7 @@ $ nix-instantiate -E '(import <nixpkgsunstable> {}).gitFull' <para> NixOS option descriptions are now automatically broken up into individual paragraphs if the text contains two consecutive - newlines, so it's no longer necessary to use + newlines, so it’s no longer necessary to use <literal></para><para></literal> to start a new paragraph. </para> diff --git a/nixos/doc/manual/from_md/release-notes/rl-1903.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1903.section.xml index f26e68e13200..ed26f2ba45d0 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-1903.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-1903.section.xml @@ -29,9 +29,9 @@ <para> By default, <literal>services.xserver.desktopManager.pantheon</literal> - enables LightDM as a display manager, as pantheon's screen + enables LightDM as a display manager, as pantheon’s screen locking implementation relies on it. Because of that it is - recommended to leave LightDM enabled. If you'd like to + recommended to leave LightDM enabled. If you’d like to disable it anyway, set <literal>services.xserver.displayManager.lightdm.enable</literal> to <literal>false</literal> and enable your preferred @@ -39,8 +39,8 @@ </para> </note> <para> - Also note that Pantheon's LightDM greeter is not enabled by - default, because it has numerous issues in NixOS and isn't + Also note that Pantheon’s LightDM greeter is not enabled by + default, because it has numerous issues in NixOS and isn’t optimal for use here yet. </para> </listitem> @@ -200,7 +200,7 @@ <listitem> <para> The <literal>ntp</literal> module now has sane default - restrictions. If you're relying on the previous defaults, + restrictions. If you’re relying on the previous defaults, which permitted all queries and commands from all firewall-permitted sources, you can set <literal>services.ntp.restrictDefault</literal> and @@ -271,7 +271,7 @@ <listitem> <para> The versioned <literal>postgresql</literal> have been renamed - to use underscore number seperators. For example, + to use underscore number separators. For example, <literal>postgresql96</literal> has been renamed to <literal>postgresql_9_6</literal>. </para> @@ -342,7 +342,7 @@ preserved when also setting interface specific rules such as <literal>networking.firewall.interfaces.en0.allow*</literal>. These rules continue to use the pseudo device - "default" + <quote>default</quote> (<literal>networking.firewall.interfaces.default.*</literal>), and assigning to this pseudo device will override the (<literal>networking.firewall.allow*</literal>) options. @@ -360,9 +360,9 @@ presence of <literal>services.sssd.enable = true</literal> because nscd caching would interfere with <literal>sssd</literal> in unpredictable ways as well. Because - we're using nscd not for caching, but for convincing glibc to + we’re using nscd not for caching, but for convincing glibc to find NSS modules in the nix store instead of an absolute path, - we have decided to disable caching globally now, as it's + we have decided to disable caching globally now, as it’s usually not the behaviour the user wants and can lead to surprising behaviour. Furthermore, negative caching of host lookups is also disabled now by default. This should fix the @@ -374,7 +374,7 @@ setting the <literal>services.nscd.config</literal> option with the desired caching parameters. </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.nscd.config = '' @@ -453,7 +453,7 @@ with its control field set to <literal>sufficient</literal> instead of <literal>required</literal>, so that password managed only by later PAM password modules are being executed. - Previously, for example, changing an LDAP account's password + Previously, for example, changing an LDAP account’s password through PAM was not possible: the whole password module verification was exited prematurely by <literal>pam_unix</literal>, preventing @@ -497,11 +497,11 @@ <link xlink:href="https://matrix.org/blog/2019/02/05/synapse-0-99-0/">the last version to accept self-signed certificates</link>. As such, it is now recommended to use a proper certificate - verified by a root CA (for example Let's Encrypt). The new + verified by a root CA (for example Let’s Encrypt). The new <link linkend="module-services-matrix">manual chapter on Matrix</link> contains a working example of using nginx as a reverse proxy in front of <literal>matrix-synapse</literal>, - using Let's Encrypt certificates. + using Let’s Encrypt certificates. </para> </listitem> <listitem> @@ -682,7 +682,7 @@ <link xlink:href="options.html#opt-services.ndppd.enable">all config options</link> provided by the current upstream version as service options. Additionally the <literal>ndppd</literal> - package doesn't contain the systemd unit configuration from + package doesn’t contain the systemd unit configuration from upstream anymore, the unit is completely configured by the NixOS module now. </para> diff --git a/nixos/doc/manual/from_md/release-notes/rl-1909.section.xml b/nixos/doc/manual/from_md/release-notes/rl-1909.section.xml index 83cd649f4ea0..3bf83e1eccbd 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-1909.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-1909.section.xml @@ -82,13 +82,13 @@ </listitem> <listitem> <para> - We've updated to Xfce 4.14, which brings a new module + We’ve updated to Xfce 4.14, which brings a new module <literal>services.xserver.desktopManager.xfce4-14</literal>. - If you'd like to upgrade, please switch from the + If you’d like to upgrade, please switch from the <literal>services.xserver.desktopManager.xfce</literal> module - as it will be deprecated in a future release. They're - incompatibilities with the current Xfce module; it doesn't - support <literal>thunarPlugins</literal> and it isn't + as it will be deprecated in a future release. They’re + incompatibilities with the current Xfce module; it doesn’t + support <literal>thunarPlugins</literal> and it isn’t recommended to use <literal>services.xserver.desktopManager.xfce</literal> and <literal>services.xserver.desktopManager.xfce4-14</literal> @@ -125,7 +125,7 @@ </itemizedlist> <para> With these options we hope to give users finer grained control - over their systems. Prior to this change you'd either have to + over their systems. Prior to this change you’d either have to manually disable options or use <literal>environment.gnome3.excludePackages</literal> which only excluded the optional applications. @@ -138,7 +138,7 @@ <listitem> <para> Orthogonal to the previous changes to the GNOME 3 desktop - manager module, we've updated all default services and + manager module, we’ve updated all default services and applications to match as close as possible to a default reference GNOME 3 experience. </para> @@ -295,7 +295,7 @@ <literal>services.xserver.desktopManager.mate</literal> Note Mate uses <literal>programs.system-config-printer</literal> as it - doesn't use it as a service, but its graphical interface + doesn’t use it as a service, but its graphical interface directly. </para> </listitem> @@ -347,7 +347,7 @@ <literal>services.prometheus.alertmanager.user</literal> and <literal>services.prometheus.alertmanager.group</literal> have been removed because the alertmanager service is now using - systemd's + systemd’s <link xlink:href="http://0pointer.net/blog/dynamic-users-with-systemd.html"> DynamicUser mechanism</link> which obviates these options. </para> @@ -366,7 +366,7 @@ The <literal>services.nzbget.configFile</literal> and <literal>services.nzbget.openFirewall</literal> options were removed as they are managed internally by the nzbget. The - <literal>services.nzbget.dataDir</literal> option hadn't + <literal>services.nzbget.dataDir</literal> option hadn’t actually been used by the module for some time and so was removed as cleanup. </para> @@ -475,7 +475,7 @@ Make sure you set the <literal>_netdev</literal> option for each of the file systems referring to block devices provided by the autoLuks module. Not doing this might render the system - in a state where it doesn't boot anymore. + in a state where it doesn’t boot anymore. </para> <para> If you are actively using the <literal>autoLuks</literal> @@ -498,7 +498,7 @@ <listitem> <para> The <literal>prometheus-nginx-exporter</literal> package now - uses the offical exporter provided by NGINX Inc. Its metrics + uses the official exporter provided by NGINX Inc. Its metrics are differently structured and are incompatible to the old ones. For information about the metrics, have a look at the <link xlink:href="https://github.com/nginxinc/nginx-prometheus-exporter">official @@ -524,7 +524,7 @@ <para> By default, prometheus exporters are now run with <literal>DynamicUser</literal> enabled. Exporters that need a - real user, now run under a seperate user and group which + real user, now run under a separate user and group which follow the pattern <literal><exporter-name>-exporter</literal>, instead of the previous default <literal>nobody</literal> and @@ -667,7 +667,7 @@ instead of depending on the catch-all <literal>acme-certificates.target</literal>. This target unit was also removed from the codebase. This will mean nginx will - no longer depend on certificates it isn't explicitly managing + no longer depend on certificates it isn’t explicitly managing and fixes a bug with certificate renewal ordering racing with nginx restarting which could lead to nginx getting in a broken state as described at @@ -687,8 +687,8 @@ <literal>services.xserver.desktopManager.xterm</literal> is now disabled by default if <literal>stateVersion</literal> is 19.09 or higher. Previously the xterm desktopManager was - enabled when xserver was enabled, but it isn't useful for all - people so it didn't make sense to have any desktopManager + enabled when xserver was enabled, but it isn’t useful for all + people so it didn’t make sense to have any desktopManager enabled default. </para> </listitem> @@ -696,7 +696,7 @@ <para> The WeeChat plugin <literal>pkgs.weechatScripts.weechat-xmpp</literal> has been - removed as it doesn't receive any updates from upstream and + removed as it doesn’t receive any updates from upstream and depends on outdated Python2-based modules. </para> </listitem> @@ -744,11 +744,11 @@ <literal>services.gitlab.secrets.dbFile</literal>, <literal>services.gitlab.secrets.otpFile</literal> and <literal>services.gitlab.secrets.jwsFile</literal>). This was - done so that secrets aren't stored in the world-readable nix - store, but means that for each option you'll have to create a - file with the same exact string, add "File" to the - end of the option name, and change the definition to a string - pointing to the corresponding file; e.g. + done so that secrets aren’t stored in the world-readable nix + store, but means that for each option you’ll have to create a + file with the same exact string, add <quote>File</quote> to + the end of the option name, and change the definition to a + string pointing to the corresponding file; e.g. <literal>services.gitlab.databasePassword = "supersecurepassword"</literal> becomes <literal>services.gitlab.databasePasswordFile = "/path/to/secret_file"</literal> @@ -791,7 +791,7 @@ <listitem> <para> The <literal>nodejs-11_x</literal> package has been removed as - it's EOLed by upstream. + it’s EOLed by upstream. </para> </listitem> <listitem> @@ -961,7 +961,7 @@ from the upstream default <literal>speex-float-1</literal> to <literal>speex-float-5</literal>. Be aware that low-powered ARM-based and MIPS-based boards will struggle with this so - you'll need to set + you’ll need to set <literal>hardware.pulseaudio.daemon.config.resample-method</literal> back to <literal>speex-float-1</literal>. </para> @@ -1004,7 +1004,7 @@ </listitem> <listitem> <para> - It's now possible to change configuration in + It’s now possible to change configuration in <link xlink:href="options.html#opt-services.nextcloud.enable">services.nextcloud</link> after the initial deploy since all config parameters are persisted in an additional config file generated by the @@ -1178,7 +1178,7 @@ <link xlink:href="https://ceph.com/releases/v14-2-0-nautilus-released/">release notes</link> for details. The mgr dashboard as well as osds backed by loop-devices is no longer explicitly supported by - the package and module. Note: There's been some issues with + the package and module. Note: There’s been some issues with python-cherrypy, which is used by the dashboard and prometheus mgr modules (and possibly others), hence 0000-dont-check-cherrypy-version.patch. diff --git a/nixos/doc/manual/from_md/release-notes/rl-2003.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2003.section.xml index 53e6e1329a94..35fbb7447c70 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2003.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2003.section.xml @@ -73,7 +73,7 @@ <listitem> <para> The graphical installer image starts the graphical session - automatically. Before you'd be greeted by a tty and asked to + automatically. Before you’d be greeted by a tty and asked to enter <literal>systemctl start display-manager</literal>. It is now possible to disable the display-manager from running by selecting the <literal>Disable display-manager</literal> quirk @@ -93,7 +93,7 @@ <link xlink:href="options.html#opt-services.xserver.desktopManager.pantheon.enable">services.xserver.desktopManager.pantheon.enable</link>, we now default to also use <link xlink:href="https://blog.elementary.io/say-hello-to-the-new-greeter/"> - Pantheon's newly designed greeter </link>. Contrary to NixOS's + Pantheon’s newly designed greeter </link>. Contrary to NixOS’s usual update policy, Pantheon will receive updates during the cycle of NixOS 20.03 when backwards compatible. </para> @@ -133,7 +133,7 @@ option to improve support for upstream session files. If you used something like: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.xserver.desktopManager.default = "xfce"; services.xserver.windowManager.default = "icewm"; @@ -142,7 +142,7 @@ <para> you should change it to: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.xserver.displayManager.defaultSession = "xfce+icewm"; } @@ -196,7 +196,7 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. </listitem> <listitem> <para> - UPower's configuration is now managed by NixOS and can be + UPower’s configuration is now managed by NixOS and can be customized via <literal>services.upower</literal>. </para> </listitem> @@ -505,7 +505,7 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. <link xlink:href="https://github.com/NixOS/nixpkgs/pull/71106">#71106</link>. </para> <para> - We already don't support the global + We already don’t support the global <link xlink:href="options.html#opt-networking.useDHCP">networking.useDHCP</link>, <link xlink:href="options.html#opt-networking.defaultGateway">networking.defaultGateway</link> and @@ -522,7 +522,7 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. The stdenv now runs all bash with <literal>set -u</literal>, to catch the use of undefined variables. Before, it itself used <literal>set -u</literal> but was careful to unset it so - other packages' code ran as before. Now, all bash code is held + other packages’ code ran as before. Now, all bash code is held to the same high standard, and the rather complex stateful manipulation of the options can be discarded. </para> @@ -558,7 +558,7 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. <literal>xfceUnstable</literal> all now point to the latest Xfce 4.14 packages. And in the future NixOS releases will be the latest released version of Xfce available at the time of - the release's development (if viable). + the release’s development (if viable). </para> </listitem> <listitem> @@ -662,7 +662,7 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. <listitem> <para> The <literal>dump1090</literal> derivation has been changed to - use FlightAware's dump1090 as its upstream. However, this + use FlightAware’s dump1090 as its upstream. However, this version does not have an internal webserver anymore. The assets in the <literal>share/dump1090</literal> directory of the derivation can be used in conjunction with an external @@ -821,7 +821,7 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. is a <literal>loaOf</literal> option that is commonly used as follows: </para> - <programlisting language="bash"> + <programlisting language="nix"> { users.users = [ { name = "me"; @@ -836,7 +836,7 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. value of <literal>name</literal> as the name of the attribute set: </para> - <programlisting language="bash"> + <programlisting language="nix"> { users.users.me = { description = "My personal user."; @@ -890,7 +890,7 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. <listitem> <para> The<literal>services.buildkite-agent.openssh.publicKeyPath</literal> - option has been removed, as it's not necessary to deploy + option has been removed, as it’s not necessary to deploy public keys to clone private repositories. </para> </listitem> @@ -932,7 +932,7 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. The <literal>services.xserver.displayManager.auto</literal> module has been removed. It was only intended for use in internal NixOS tests, and gave the false impression of it - being a special display manager when it's actually LightDM. + being a special display manager when it’s actually LightDM. Please use the <literal>services.xserver.displayManager.lightdm.autoLogin</literal> options instead, or any other display manager in NixOS as they @@ -940,7 +940,7 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. because it permitted root auto-login you can override the lightdm-autologin pam module like: </para> - <programlisting language="bash"> + <programlisting language="nix"> { security.pam.services.lightdm-autologin.text = lib.mkForce '' auth requisite pam_nologin.so @@ -962,13 +962,13 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. auth required pam_succeed_if.so quiet </programlisting> <para> - line, where default it's: + line, where default it’s: </para> <programlisting> auth required pam_succeed_if.so uid >= 1000 quiet </programlisting> <para> - not permitting users with uid's below 1000 (like root). All + not permitting users with uid’s below 1000 (like root). All other display managers in NixOS are configured like this. </para> </listitem> @@ -1004,7 +1004,7 @@ auth required pam_succeed_if.so quiet Additionally, some Postfix configuration must now be set manually instead of automatically by the Mailman module: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.postfix.relayDomains = [ "hash:/var/lib/mailman/data/postfix_domains" ]; services.postfix.config.transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ]; @@ -1051,14 +1051,14 @@ auth required pam_succeed_if.so quiet <listitem> <para> The <literal>*psu</literal> versions of oraclejdk8 have been - removed as they aren't provided by upstream anymore. + removed as they aren’t provided by upstream anymore. </para> </listitem> <listitem> <para> The <literal>services.dnscrypt-proxy</literal> module has been removed as it used the deprecated version of dnscrypt-proxy. - We've added + We’ve added <link xlink:href="options.html#opt-services.dnscrypt-proxy2.enable">services.dnscrypt-proxy2.enable</link> to use the supported version. This module supports configuration via the Nix attribute set @@ -1066,7 +1066,7 @@ auth required pam_succeed_if.so quiet or by passing a TOML configuration file via <link xlink:href="options.html#opt-services.dnscrypt-proxy2.configFile">services.dnscrypt-proxy2.configFile</link>. </para> - <programlisting language="bash"> + <programlisting language="nix"> { # Example configuration: services.dnscrypt-proxy2.enable = true; @@ -1093,7 +1093,7 @@ auth required pam_succeed_if.so quiet </listitem> <listitem> <para> - sqldeveloper_18 has been removed as it's not maintained + sqldeveloper_18 has been removed as it’s not maintained anymore, sqldeveloper has been updated to version <literal>19.4</literal>. Please note that this means that this means that the oraclejdk is now required. For further @@ -1110,7 +1110,7 @@ auth required pam_succeed_if.so quiet the different lists of dependencies mashed together as one big list, and then partitioning into Haskell and non-Hakell dependencies, they work from the original many different - dependency parameters and don't need to algorithmically + dependency parameters and don’t need to algorithmically partition anything. </para> <para> @@ -1123,7 +1123,7 @@ auth required pam_succeed_if.so quiet </listitem> <listitem> <para> - The gcc-snapshot-package has been removed. It's marked as + The gcc-snapshot-package has been removed. It’s marked as broken for >2 years and used to point to a fairly old snapshot from the gcc7-branch. </para> @@ -1158,7 +1158,7 @@ auth required pam_succeed_if.so quiet <listitem> <para> nextcloud has been updated to <literal>v18.0.2</literal>. This - means that users from NixOS 19.09 can't upgrade directly since + means that users from NixOS 19.09 can’t upgrade directly since you can only move one version forward and 19.09 uses <literal>v16.0.8</literal>. </para> @@ -1181,7 +1181,7 @@ auth required pam_succeed_if.so quiet Existing setups will be detected using <link xlink:href="options.html#opt-system.stateVersion">system.stateVersion</link>: by default, nextcloud17 will be used, but will raise a - warning which notes that after that deploy it's + warning which notes that after that deploy it’s recommended to update to the latest stable version (nextcloud18) by declaring the newly introduced setting <link xlink:href="options.html#opt-services.nextcloud.package">services.nextcloud.package</link>. @@ -1194,7 +1194,7 @@ auth required pam_succeed_if.so quiet get an evaluation error by default. This is done to ensure that our <link xlink:href="options.html#opt-services.nextcloud.package">package</link>-option - doesn't select an older version by accident. It's + doesn’t select an older version by accident. It’s recommended to use pkgs.nextcloud18 or to set <link xlink:href="options.html#opt-services.nextcloud.package">package</link> to pkgs.nextcloud explicitly. @@ -1203,7 +1203,7 @@ auth required pam_succeed_if.so quiet </itemizedlist> <warning> <para> - Please note that if you're coming from + Please note that if you’re coming from <literal>19.03</literal> or older, you have to manually upgrade to <literal>19.09</literal> first to upgrade your server to Nextcloud v16. @@ -1215,7 +1215,7 @@ auth required pam_succeed_if.so quiet Hydra has gained a massive performance improvement due to <link xlink:href="https://github.com/NixOS/hydra/pull/710">some database schema changes</link> by adding several IDs and - better indexing. However, it's necessary to upgrade Hydra in + better indexing. However, it’s necessary to upgrade Hydra in multiple steps: </para> <itemizedlist> @@ -1229,7 +1229,7 @@ auth required pam_succeed_if.so quiet when upgrading. Otherwise, the package can be deployed using the following config: </para> - <programlisting language="bash"> + <programlisting language="nix"> { pkgs, ... }: { services.hydra.package = pkgs.hydra-migration; } @@ -1266,12 +1266,12 @@ $ hydra-backfill-ids <link xlink:href="options.html#opt-system.stateVersion">stateVersion</link> is set to <literal>20.03</literal> or greater, hydra-unstable will be used automatically! This will break - your setup if you didn't run the migration. + your setup if you didn’t run the migration. </para> </warning> <para> Please note that Hydra is currently not available with - nixStable as this doesn't compile anymore. + nixStable as this doesn’t compile anymore. </para> <warning> <para> @@ -1281,7 +1281,7 @@ $ hydra-backfill-ids assertion error will be thrown. To circumvent this, you need to set <link xlink:href="options.html#opt-services.hydra.package">services.hydra.package</link> - to pkgs.hydra explicitly and make sure you know what you're + to pkgs.hydra explicitly and make sure you know what you’re doing! </para> </warning> @@ -1319,7 +1319,7 @@ $ hydra-backfill-ids <para> To continue to use the old approach, you can configure: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.nginx.appendConfig = let cfg = config.services.nginx; in ''user ${cfg.user} ${cfg.group};''; systemd.services.nginx.serviceConfig.User = lib.mkForce "root"; @@ -1413,14 +1413,14 @@ $ hydra-backfill-ids <itemizedlist> <listitem> <para> - If you use <literal>sqlite3</literal> you don't need to do + If you use <literal>sqlite3</literal> you don’t need to do anything. </para> </listitem> <listitem> <para> If you use <literal>postgresql</literal> on a different - server, you don't need to change anything as well since + server, you don’t need to change anything as well since this module was never designed to configure remote databases. </para> @@ -1432,7 +1432,7 @@ $ hydra-backfill-ids older, you simply need to enable postgresql-support explicitly: </para> - <programlisting language="bash"> + <programlisting language="nix"> { ... }: { services.matrix-synapse = { enable = true; @@ -1460,7 +1460,7 @@ $ hydra-backfill-ids <literal>nixos-unstable</literal> <emphasis>after</emphasis> the <literal>19.09</literal>-release, your database is misconfigured due to a regression in NixOS. For now, - matrix-synapse will startup with a warning, but it's + matrix-synapse will startup with a warning, but it’s recommended to reconfigure the database to set the values <literal>LC_COLLATE</literal> and <literal>LC_CTYPE</literal> to @@ -1473,7 +1473,7 @@ $ hydra-backfill-ids <link xlink:href="options.html#opt-systemd.network.links">systemd.network.links</link> option is now respected even when <link xlink:href="options.html#opt-systemd.network.enable">systemd-networkd</link> - is disabled. This mirrors the behaviour of systemd - It's udev + is disabled. This mirrors the behaviour of systemd - It’s udev that parses <literal>.link</literal> files, not <literal>systemd-networkd</literal>. </para> @@ -1486,8 +1486,8 @@ $ hydra-backfill-ids <para> Please note that mongodb has been relicensed under their own <link xlink:href="https://www.mongodb.com/licensing/server-side-public-license/faq"><literal> sspl</literal></link>-license. - Since it's not entirely free and not OSI-approved, it's - listed as non-free. This means that Hydra doesn't provide + Since it’s not entirely free and not OSI-approved, it’s + listed as non-free. This means that Hydra doesn’t provide prebuilt mongodb-packages and needs to be built locally. </para> </warning> diff --git a/nixos/doc/manual/from_md/release-notes/rl-2009.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2009.section.xml index edebd92b327a..a1b007e711d7 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2009.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2009.section.xml @@ -722,7 +722,7 @@ See <link xlink:href="https://mariadb.com/kb/en/authentication-from-mariadb-104/">Authentication from MariaDB 10.4</link>. unix_socket auth plugin does not use - a password, and uses the connecting user's UID instead. When a + a password, and uses the connecting user’s UID instead. When a new MariaDB data directory is initialized, two MariaDB users are created and can be used with new unix_socket auth plugin, as well as traditional mysql_native_password plugin: @@ -730,7 +730,7 @@ traditional mysql_native_password plugin method, one must run the following: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" '' ALTER USER root@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD("verysecret"); @@ -755,7 +755,7 @@ services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" '' allow MySQL to read from /home and /tmp directories when using <literal>LOAD DATA INFILE</literal> </para> - <programlisting language="bash"> + <programlisting language="nix"> { systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce "read-only"; } @@ -766,7 +766,7 @@ services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" '' <literal>SELECT * INTO OUTFILE</literal>, assuming the mysql user has write access to <literal>/var/data</literal> </para> - <programlisting language="bash"> + <programlisting language="nix"> { systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ]; } @@ -864,7 +864,7 @@ WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ <para> <literal>buildGoModule</literal> now internally creates a vendor directory in the source tree for downloaded modules - instead of using go's + instead of using go’s <link xlink:href="https://golang.org/cmd/go/#hdr-Module_proxy_protocol">module proxy protocol</link>. This storage format is simpler and therefore less likely to break with future versions of go. As @@ -885,7 +885,7 @@ WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ <literal>phantomJsSupport = true</literal> to the package instantiation: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.grafana.package = pkgs.grafana.overrideAttrs (oldAttrs: rec { phantomJsSupport = true; @@ -941,24 +941,24 @@ WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ <para> If you used the <literal>boot.initrd.network.ssh.host*Key</literal> options, - you'll get an error explaining how to convert your host keys + you’ll get an error explaining how to convert your host keys and migrate to the new <literal>boot.initrd.network.ssh.hostKeys</literal> option. - Otherwise, if you don't have any host keys set, you'll need to + Otherwise, if you don’t have any host keys set, you’ll need to generate some; see the <literal>hostKeys</literal> option documentation for instructions. </para> </listitem> <listitem> <para> - Since this release there's an easy way to customize your PHP + Since this release there’s an easy way to customize your PHP install to get a much smaller base PHP with only wanted extensions enabled. See the following snippet installing a smaller PHP with the extensions <literal>imagick</literal>, <literal>opcache</literal>, <literal>pdo</literal> and <literal>pdo_mysql</literal> loaded: </para> - <programlisting language="bash"> + <programlisting language="nix"> { environment.systemPackages = [ (pkgs.php.withExtensions @@ -973,7 +973,7 @@ WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ } </programlisting> <para> - The default <literal>php</literal> attribute hasn't lost any + The default <literal>php</literal> attribute hasn’t lost any extensions. The <literal>opcache</literal> extension has been added. All upstream PHP extensions are available under php.extensions.<name?>. @@ -997,7 +997,7 @@ WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ The remaining configuration flags can now be set directly on the <literal>php</literal> attribute. For example, instead of </para> - <programlisting language="bash"> + <programlisting language="nix"> { php.override { config.php.embed = true; @@ -1008,7 +1008,7 @@ WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ <para> you should now write </para> - <programlisting language="bash"> + <programlisting language="nix"> { php.override { embedSupport = true; @@ -1062,7 +1062,7 @@ WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ writing to other folders, use <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal> </para> - <programlisting language="bash"> + <programlisting language="nix"> { systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ]; } @@ -1076,7 +1076,7 @@ WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ docs</link> for details). If you require serving files from home directories, you may choose to set e.g. </para> - <programlisting language="bash"> + <programlisting language="nix"> { systemd.services.nginx.serviceConfig.ProtectHome = "read-only"; } @@ -1093,7 +1093,7 @@ WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ <para> Replace a <literal>nesting.clone</literal> entry with: </para> - <programlisting language="bash"> + <programlisting language="nix"> { specialisation.example-sub-configuration = { configuration = { @@ -1104,7 +1104,7 @@ WHERE table_schema = "zabbix" AND COLLATION_NAME = "utf8_general_ <para> Replace a <literal>nesting.children</literal> entry with: </para> - <programlisting language="bash"> + <programlisting language="nix"> { specialisation.example-sub-configuration = { inheritParentConfig = false; @@ -1162,7 +1162,7 @@ $ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test <para> The <literal>systemd-networkd</literal> option <literal>systemd.network.networks.<name>.dhcp.CriticalConnection</literal> - has been removed following upstream systemd's deprecation of + has been removed following upstream systemd’s deprecation of the same. It is recommended to use <literal>systemd.network.networks.<name>.networkConfig.KeepConfiguration</literal> instead. See systemd.network 5 for details. @@ -1174,7 +1174,7 @@ $ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test <literal>systemd.network.networks._name_.dhcpConfig</literal> has been renamed to <link xlink:href="options.html#opt-systemd.network.networks._name_.dhcpV4Config">systemd.network.networks.<emphasis>name</emphasis>.dhcpV4Config</link> - following upstream systemd's documentation change. See + following upstream systemd’s documentation change. See systemd.network 5 for details. </para> </listitem> @@ -1283,7 +1283,7 @@ $ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test The <link xlink:href="https://github.com/okTurtles/dnschain">DNSChain</link> package and NixOS module have been removed from Nixpkgs as the - software is unmaintained and can't be built. For more + software is unmaintained and can’t be built. For more information see issue <link xlink:href="https://github.com/NixOS/nixpkgs/issues/89205">#89205</link>. </para> @@ -1350,7 +1350,7 @@ $ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test </listitem> <listitem> <para> - Radicale's default package has changed from 2.x to 3.x. An + Radicale’s default package has changed from 2.x to 3.x. An upgrade checklist can be found <link xlink:href="https://github.com/Kozea/Radicale/blob/3.0.x/NEWS.md#upgrade-checklist">here</link>. You can use the newer version in the NixOS service by setting @@ -1385,7 +1385,7 @@ $ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test multi-instance config with an existing bitcoind data directory and user, you have to adjust the original config, e.g.: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.bitcoind = { enable = true; @@ -1397,7 +1397,7 @@ $ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test <para> To something similar: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.bitcoind.mainnet = { enable = true; @@ -1447,7 +1447,7 @@ $ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test the original SSL settings, you have to adjust the original config, e.g.: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.dokuwiki = { enable = true; @@ -1458,7 +1458,7 @@ $ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test <para> To something similar: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.dokuwiki."mywiki" = { enable = true; @@ -1472,8 +1472,8 @@ $ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test </programlisting> <para> The base package has also been upgraded to the 2020-07-29 - "Hogfather" release. Plugins might be incompatible - or require upgrading. + <quote>Hogfather</quote> release. Plugins might be + incompatible or require upgrading. </para> </listitem> <listitem> @@ -1492,7 +1492,7 @@ $ sudo /run/current-system/fine-tune/child-1/bin/switch-to-configuration test option is (<literal>/var/db/postgresql</literal>) and then explicitly set this value to maintain compatibility: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.postgresql.dataDir = "/var/db/postgresql"; } @@ -1587,7 +1587,7 @@ CREATE ROLE postgres LOGIN SUPERUSER; <listitem> <para> The <literal>security.rngd</literal> service is now disabled - by default. This choice was made because there's krngd in the + by default. This choice was made because there’s krngd in the linux kernel space making it (for most usecases) functionally redundent. </para> @@ -1609,13 +1609,13 @@ CREATE ROLE postgres LOGIN SUPERUSER; will be EOL (end of life) within the lifetime of 20.09</link>. </para> <para> - It's necessary to upgrade to nextcloud19: + It’s necessary to upgrade to nextcloud19: </para> <itemizedlist> <listitem> <para> From nextcloud17, you have to upgrade to nextcloud18 first - as Nextcloud doesn't allow going multiple major revisions + as Nextcloud doesn’t allow going multiple major revisions forward in a single upgrade. This is possible by setting <link xlink:href="options.html#opt-services.nextcloud.package">services.nextcloud.package</link> to nextcloud18. @@ -1623,7 +1623,7 @@ CREATE ROLE postgres LOGIN SUPERUSER; </listitem> <listitem> <para> - From nextcloud18, it's possible to directly upgrade to + From nextcloud18, it’s possible to directly upgrade to nextcloud19 by setting <link xlink:href="options.html#opt-services.nextcloud.package">services.nextcloud.package</link> to nextcloud19. @@ -1685,7 +1685,7 @@ CREATE ROLE postgres LOGIN SUPERUSER; <listitem> <para> The notmuch package moves its emacs-related binaries and emacs - lisp files to a separate output. They're not part of the + lisp files to a separate output. They’re not part of the default <literal>out</literal> output anymore - if you relied on the <literal>notmuch-emacs-mua</literal> binary or the emacs lisp files, access them via the @@ -1736,11 +1736,11 @@ CREATE ROLE postgres LOGIN SUPERUSER; </listitem> <listitem> <para> - The cc- and binutils-wrapper's "infix salt" and + The cc- and binutils-wrapper’s <quote>infix salt</quote> and <literal>_BUILD_</literal> and <literal>_TARGET_</literal> - user infixes have been replaced with with a "suffix - salt" and suffixes and <literal>_FOR_BUILD</literal> and - <literal>_FOR_TARGET</literal>. This matches the autotools + user infixes have been replaced with with a <quote>suffix + salt</quote> and suffixes and <literal>_FOR_BUILD</literal> + and <literal>_FOR_TARGET</literal>. This matches the autotools convention for env vars which standard for these things, making interfacing with other tools easier. </para> @@ -1774,8 +1774,8 @@ CREATE ROLE postgres LOGIN SUPERUSER; <literal>network-link-*</literal> units, which have been removed. Bringing the interface up has been moved to the beginning of the <literal>network-addresses-*</literal> unit. - Note this doesn't require <literal>systemd-networkd</literal> - - it's udev that parses <literal>.link</literal> files. Extra + Note this doesn’t require <literal>systemd-networkd</literal> + - it’s udev that parses <literal>.link</literal> files. Extra care needs to be taken in the presence of <link xlink:href="https://wiki.debian.org/NetworkInterfaceNames#THE_.22PERSISTENT_NAMES.22_SCHEME">legacy udev rules</link> to rename interfaces, as MAC Address and MTU @@ -1825,7 +1825,7 @@ CREATE ROLE postgres LOGIN SUPERUSER; you must include those directories into the <literal>BindPaths</literal> of the service: </para> - <programlisting language="bash"> + <programlisting language="nix"> { systemd.services.transmission.serviceConfig.BindPaths = [ "/path/to/alternative/download-dir" ]; } @@ -1835,7 +1835,7 @@ CREATE ROLE postgres LOGIN SUPERUSER; <literal>transmission-daemon</literal> is now only available on the local network interface by default. Use: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.transmission.settings.rpc-bind-address = "0.0.0.0"; } @@ -1850,7 +1850,7 @@ CREATE ROLE postgres LOGIN SUPERUSER; With this release <literal>systemd-networkd</literal> (when enabled through <link xlink:href="options.html#opt-networking.useNetworkd">networking.useNetworkd</link>) - has it's netlink socket created through a + has it’s netlink socket created through a <literal>systemd.socket</literal> unit. This gives us control over socket buffer sizes and other parameters. For larger setups where networkd has to create a lot of (virtual) devices @@ -1873,7 +1873,7 @@ CREATE ROLE postgres LOGIN SUPERUSER; </para> <para> Since the actual memory requirements depend on hardware, - timing, exact configurations etc. it isn't currently possible + timing, exact configurations etc. it isn’t currently possible to infer a good default from within the NixOS module system. Administrators are advised to monitor the logs of <literal>systemd-networkd</literal> for @@ -1882,7 +1882,7 @@ CREATE ROLE postgres LOGIN SUPERUSER; </para> <para> Note: Increasing the <literal>ReceiveBufferSize=</literal> - doesn't allocate any memory. It just increases the upper bound + doesn’t allocate any memory. It just increases the upper bound on the kernel side. The memory allocation depends on the amount of messages that are queued on the kernel side of the netlink socket. @@ -1900,7 +1900,7 @@ CREATE ROLE postgres LOGIN SUPERUSER; <para> This means that a configuration like this </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.dovecot2.mailboxes = [ { name = "Junk"; @@ -1912,7 +1912,7 @@ CREATE ROLE postgres LOGIN SUPERUSER; <para> should now look like this: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.dovecot2.mailboxes = { Junk.auto = "create"; @@ -1934,8 +1934,8 @@ CREATE ROLE postgres LOGIN SUPERUSER; </para> <para> If you have an existing installation, please make sure that - you're on nextcloud18 before upgrading to nextcloud19 since - Nextcloud doesn't support upgrades across multiple major + you’re on nextcloud18 before upgrading to nextcloud19 since + Nextcloud doesn’t support upgrades across multiple major versions. </para> </listitem> diff --git a/nixos/doc/manual/from_md/release-notes/rl-2105.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2105.section.xml index fb11b19229e2..868c1709879d 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2105.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2105.section.xml @@ -235,9 +235,9 @@ <para> The <literal>networking.wireless.iwd</literal> module now installs the upstream-provided 80-iwd.link file, which sets - the NamePolicy= for all wlan devices to "keep - kernel", to avoid race conditions between iwd and - networkd. If you don't want this, you can set + the NamePolicy= for all wlan devices to <quote>keep + kernel</quote>, to avoid race conditions between iwd and + networkd. If you don’t want this, you can set <literal>systemd.network.links."80-iwd" = lib.mkForce {}</literal>. </para> </listitem> @@ -245,7 +245,7 @@ <para> <literal>rubyMinimal</literal> was removed due to being unused and unusable. The default ruby interpreter includes JIT - support, which makes it reference it's compiler. Since JIT + support, which makes it reference it’s compiler. Since JIT support is probably needed by some Gems, it was decided to enable this feature with all cc references by default, and allow to build a Ruby derivation without references to cc, by @@ -330,7 +330,7 @@ <literal>mediatomb</literal> package. If you want to keep the old behavior, you must declare it with: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.mediatomb.package = pkgs.mediatomb; } @@ -341,7 +341,7 @@ service declaration to add the firewall rules itself before, you should now declare it with: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.mediatomb.openFirewall = true; } @@ -368,7 +368,7 @@ <link xlink:href="options.html#opt-services.uwsgi.capabilities">services.uwsgi.capabilities</link>. The previous behaviour can be restored by setting: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.uwsgi.user = "root"; services.uwsgi.group = "root"; @@ -427,7 +427,7 @@ <para> <link xlink:href="options.html#opt-networking.wireguard.interfaces">networking.wireguard.interfaces.<name>.generatePrivateKeyFile</link>, which is off by default, had a <literal>chmod</literal> race - condition fixed. As an aside, the parent directory's + condition fixed. As an aside, the parent directory’s permissions were widened, and the key files were made owner-writable. This only affects newly created keys. However, if the exact permissions are important for your setup, read @@ -527,7 +527,7 @@ $ slapcat -F $TMPDIR -n0 -H 'ldap:///???(!(objectClass=olcSchemaConfig))' this directory are guarded to only run if the files they want to manipulate do not already exist, and so will not re-apply their changes if the IMDS response changes. - Examples: <literal>root</literal>'s SSH key is only added if + Examples: <literal>root</literal>’s SSH key is only added if <literal>/root/.ssh/authorized_keys</literal> does not exist, and SSH host keys are only set from user data if they do not exist in <literal>/etc/ssh</literal>. @@ -550,9 +550,9 @@ $ slapcat -F $TMPDIR -n0 -H 'ldap:///???(!(objectClass=olcSchemaConfig))' configures Privoxy, and the <literal>services.tor.client.privoxy.enable</literal> option has been removed. To enable Privoxy, and to configure it to - use Tor's faster port, use the following configuration: + use Tor’s faster port, use the following configuration: </para> - <programlisting language="bash"> + <programlisting language="nix"> { opt-services.privoxy.enable = true; opt-services.privoxy.enableTor = true; @@ -628,7 +628,7 @@ $ slapcat -F $TMPDIR -n0 -H 'ldap:///???(!(objectClass=olcSchemaConfig))' exporter no longer accepts a fixed command-line parameter to specify the URL of the endpoint serving JSON. It now expects this URL to be passed as an URL parameter, when scraping the - exporter's <literal>/probe</literal> endpoint. In the + exporter’s <literal>/probe</literal> endpoint. In the prometheus scrape configuration the scrape target might look like this: </para> @@ -689,7 +689,7 @@ http://some.json-exporter.host:7979/probe?target=https://example.com/some/json/e <literal>mpich</literal> instead of the default <literal>openmpi</literal> can now be achived like this: </para> - <programlisting language="bash"> + <programlisting language="nix"> self: super: { mpi = super.mpich; @@ -790,7 +790,7 @@ self: super: for any device that the kernel recognises as an hardware RNG, as it will automatically run the krngd task to periodically collect random data from the device and mix it into the - kernel's RNG. + kernel’s RNG. </para> <para> The default SMTP port for GitLab has been changed to @@ -850,7 +850,7 @@ self: super: kodiPackages.inputstream-adaptive and kodiPackages.vfs-sftp addons: </para> - <programlisting language="bash"> + <programlisting language="nix"> { environment.systemPackages = [ pkgs.kodi @@ -867,7 +867,7 @@ self: super: and as a result the above configuration should now be written as: </para> - <programlisting language="bash"> + <programlisting language="nix"> { environment.systemPackages = [ (pkgs.kodi.withPackages (p: with p; [ @@ -893,7 +893,7 @@ self: super: <literal>services.minio.dataDir</literal> changed type to a list of paths, required for specifiyng multiple data directories for using with erasure coding. Currently, the - service doesn't enforce nor checks the correct number of paths + service doesn’t enforce nor checks the correct number of paths to correspond to minio requirements. </para> </listitem> @@ -910,7 +910,7 @@ self: super: <literal>dvorak-programmer</literal> in <literal>console.keyMap</literal> now instead of <literal>dvp</literal>. In - <literal>services.xserver.xkbVariant</literal> it's still + <literal>services.xserver.xkbVariant</literal> it’s still <literal>dvp</literal>. </para> </listitem> @@ -954,7 +954,7 @@ self: super: supported. </para> <para> - Furthermore, Radicale's systemd unit was hardened which might + Furthermore, Radicale’s systemd unit was hardened which might break some deployments. In particular, a non-default <literal>filesystem_folder</literal> has to be added to <literal>systemd.services.radicale.serviceConfig.ReadWritePaths</literal> @@ -991,7 +991,7 @@ self: super: <listitem> <para> <link xlink:href="https://www.gnuradio.org/">GNURadio</link> - has a <literal>pkgs</literal> attribute set, and there's a + has a <literal>pkgs</literal> attribute set, and there’s a <literal>gnuradio.callPackage</literal> function that extends <literal>pkgs</literal> with a <literal>mkDerivation</literal>, and a @@ -1027,7 +1027,7 @@ self: super: <listitem> <para> <link xlink:href="https://kodi.tv/">Kodi</link> has been - updated to version 19.1 "Matrix". See the + updated to version 19.1 <quote>Matrix</quote>. See the <link xlink:href="https://kodi.tv/article/kodi-19-0-matrix-release">announcement</link> for further details. </para> @@ -1098,9 +1098,9 @@ self: super: <listitem> <para> The default-version of <literal>nextcloud</literal> is - nextcloud21. Please note that it's <emphasis>not</emphasis> + nextcloud21. Please note that it’s <emphasis>not</emphasis> possible to upgrade <literal>nextcloud</literal> across - multiple major versions! This means that it's e.g. not + multiple major versions! This means that it’s e.g. not possible to upgrade from nextcloud18 to nextcloud20 in a single deploy and most <literal>20.09</literal> users will have to upgrade to nextcloud20 first. @@ -1122,7 +1122,7 @@ self: super: </listitem> <listitem> <para> - NixOS now emits a deprecation warning if systemd's + NixOS now emits a deprecation warning if systemd’s <literal>StartLimitInterval</literal> setting is used in a <literal>serviceConfig</literal> section instead of in a <literal>unitConfig</literal>; that setting is deprecated and @@ -1158,7 +1158,7 @@ self: super: users to declare autoscan media directories from their nixos configuration: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.mediatomb.mediaDirectories = [ { path = "/var/lib/mediatomb/pictures"; recursive = false; hidden-files = false; } @@ -1255,8 +1255,8 @@ self: super: <listitem> <para> The <literal>services.dnscrypt-proxy2</literal> module now - takes the upstream's example configuration and updates it with - the user's settings. An option has been added to restore the + takes the upstream’s example configuration and updates it with + the user’s settings. An option has been added to restore the old behaviour if you prefer to declare the configuration from scratch. </para> @@ -1298,13 +1298,14 @@ self: super: <para> The zookeeper package does not provide <literal>zooInspector.sh</literal> anymore, as that - "contrib" has been dropped from upstream releases. + <quote>contrib</quote> has been dropped from upstream + releases. </para> </listitem> <listitem> <para> In the ACME module, the data used to build the hash for the - account directory has changed to accomodate new features to + account directory has changed to accommodate new features to reduce account rate limit issues. This will trigger new account creation on the first rebuild following this update. No issues are expected to arise from this, thanks to the new @@ -1317,7 +1318,7 @@ self: super: now always ensures home directory permissions to be <literal>0700</literal>. Permissions had previously been ignored for already existing home directories, possibly - leaving them readable by others. The option's description was + leaving them readable by others. The option’s description was incorrect regarding ownership management and has been simplified greatly. </para> @@ -1518,7 +1519,7 @@ self: super: been dropped. Users that still want it should add the following to their system configuration: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.gvfs.package = pkgs.gvfs.override { samba = null; }; } diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml index 9b6e755fd470..48a717916535 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml @@ -642,7 +642,7 @@ </para> </listitem> </itemizedlist> - <programlisting language="bash"> + <programlisting language="nix"> { services.paperless-ng.extraConfig = { # Provide languages as ISO 639-2 codes @@ -723,7 +723,7 @@ Superuser created successfully. </listitem> <listitem> <para> - The <literal>erigon</literal> ethereum node has moved it’s + The <literal>erigon</literal> ethereum node has moved its database location in <literal>2021-08-03</literal>, users upgrading must manually move their chaindata (see <link xlink:href="https://github.com/ledgerwatch/erigon/releases/tag/v2021.08.03">release @@ -737,7 +737,7 @@ Superuser created successfully. insecure. Out-of-tree modules are likely to require adaptation: instead of </para> - <programlisting language="bash"> + <programlisting language="nix"> { users.users.foo = { isSystemUser = true; @@ -747,7 +747,7 @@ Superuser created successfully. <para> also create a group for your user: </para> - <programlisting language="bash"> + <programlisting language="nix"> { users.users.foo = { isSystemUser = true; diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml index 97e993e83ff0..457bb46137f5 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml @@ -328,7 +328,7 @@ <listitem> <para> <link xlink:href="https://maddy.email/">Maddy</link>, a free - an open source mail server. Availabe as + an open source mail server. Available as <link linkend="opt-services.maddy.enable">services.maddy</link>. </para> </listitem> @@ -714,7 +714,7 @@ <literal>programs.msmtp.*</literal> can be used instead for an equivalent setup. For example: </para> - <programlisting language="bash"> + <programlisting language="nix"> { # Original ssmtp configuration: services.ssmtp = { @@ -847,7 +847,7 @@ <literal>config.nixpkgs.config.allowUnfree</literal> are enabled. If you still want these fonts, use: </para> - <programlisting language="bash"> + <programlisting language="nix"> { fonts.fonts = [ pkgs.xorg.fontbhlucidatypewriter100dpi @@ -942,7 +942,7 @@ <para> Before: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.matrix-synapse = { enable = true; @@ -977,7 +977,7 @@ <para> After: </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.matrix-synapse = { enable = true; @@ -1143,7 +1143,7 @@ <para> Before: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.keycloak = { enable = true; httpPort = "8080"; @@ -1157,7 +1157,7 @@ <para> After: </para> - <programlisting language="bash"> + <programlisting language="nix"> services.keycloak = { enable = true; settings = { @@ -1422,7 +1422,7 @@ derivation if <literal>name</literal> is <literal>"vim"</literal> (the default). This makes the <literal>wrapManual</literal> argument obsolete, - but this behavior can be overriden by setting the + but this behavior can be overridden by setting the <literal>standalone</literal> argument. </para> </listitem> diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml index b47808dc2087..2d7226caa5b5 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml @@ -1082,7 +1082,7 @@ services.github-runner.serviceOverrides.SupplementaryGroups = [ removed. This option was an association of environment variables for Grafana. If you had an expression like </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.grafana.extraOptions.SECURITY_ADMIN_USER = "foobar"; } @@ -1096,7 +1096,7 @@ services.github-runner.serviceOverrides.SupplementaryGroups = [ For the migration, it is recommended to turn it into the INI format, i.e. to declare </para> - <programlisting language="bash"> + <programlisting language="nix"> { services.grafana.settings.security.admin_user = "foobar"; } @@ -1280,9 +1280,9 @@ services.github-runner.serviceOverrides.SupplementaryGroups = [ </listitem> <listitem> <para> - Option descriptions, examples, and defaults writting in - DocBook are now deprecated. Using CommonMark is preferred and - will become the default in a future release. + Option descriptions, examples, and defaults writing in DocBook + are now deprecated. Using CommonMark is preferred and will + become the default in a future release. </para> </listitem> <listitem> diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml index de8a830b0209..b1c4745a3f59 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml @@ -25,6 +25,13 @@ <itemizedlist> <listitem> <para> + <link xlink:href="https://akkoma.social">Akkoma</link>, an + ActivityPub microblogging server. Available as + <link xlink:href="options.html#opt-services.akkoma.enable">services.akkoma</link>. + </para> + </listitem> + <listitem> + <para> <link xlink:href="https://github.com/akinomyoga/ble.sh">blesh</link>, a line editor written in pure bash. Available as <link linkend="opt-programs.bash.blesh.enable">programs.bash.blesh</link>. @@ -32,11 +39,43 @@ </listitem> <listitem> <para> + <link xlink:href="https://github.com/alexivkin/CUPS-PDF-to-PDF">cups-pdf-to-pdf</link>, + a pdf-generating cups backend based on + <link xlink:href="https://www.cups-pdf.de/">cups-pdf</link>. + Available as + <link linkend="opt-services.printing.cups-pdf.enable">services.printing.cups-pdf</link>. + </para> + </listitem> + <listitem> + <para> <link xlink:href="https://github.com/junegunn/fzf">fzf</link>, a command line fuzzyfinder. Available as <link linkend="opt-programs.fzf.fuzzyCompletion">programs.fzf</link>. </para> </listitem> + <listitem> + <para> + <link xlink:href="https://github.com/ellie/atuin">atuin</link>, + a sync server for shell history. Available as + <link linkend="opt-services.atuin.enable">services.atuin</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://gitlab.com/kop316/mmsd">mmsd</link>, + a lower level daemon that transmits and recieves MMSes. + Available as + <link linkend="opt-services.mmsd.enable">services.mmsd</link>. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://v2raya.org">v2rayA</link>, a Linux + web GUI client of Project V which supports V2Ray, Xray, SS, + SSR, Trojan and Pingtunnel. Available as + <link xlink:href="options.html#opt-services.v2raya.enable">services.v2raya</link>. + </para> + </listitem> </itemizedlist> </section> <section xml:id="sec-release-23.05-incompatibilities"> @@ -55,6 +94,14 @@ </listitem> <listitem> <para> + <literal>borgbackup</literal> module now has an option for + inhibiting system sleep while backups are running, defaulting + to off (not inhibiting sleep), available as + <link linkend="opt-services.borgbackup.jobs._name_.inhibitsSleep"><literal>services.borgbackup.jobs.<name>.inhibitsSleep</literal></link>. + </para> + </listitem> + <listitem> + <para> The EC2 image module no longer fetches instance metadata in stage-1. This results in a significantly smaller initramfs, since network drivers no longer need to be included, and @@ -69,6 +116,26 @@ </listitem> <listitem> <para> + <literal>minio</literal> removed support for its legacy + filesystem backend in + <link xlink:href="https://github.com/minio/minio/releases/tag/RELEASE.2022-10-29T06-21-33Z">RELEASE.2022-10-29T06-21-33Z</link>. + This means if your storage was created with the old format, + minio will no longer start. Unfortunately minio doesn’t + provide a an automatic migration, they only provide + <link xlink:href="https://min.io/docs/minio/windows/operations/install-deploy-manage/migrate-fs-gateway.html">instructions + how to manually convert the node</link>. To facilitate this + migration we keep around the last version that still supports + the old filesystem backend as + <literal>minio_legacy_fs</literal>. Use it via + <literal>services.minio.package = minio_legacy_fs;</literal> + to export your data before switching to the new version. See + the corresponding + <link xlink:href="https://github.com/NixOS/nixpkgs/issues/199318">issue</link> + for more details. + </para> + </listitem> + <listitem> + <para> <literal>services.sourcehut.dispatch</literal> and the corresponding package (<literal>sourcehut.dispatchsrht</literal>) have been removed @@ -83,38 +150,38 @@ <link linkend="opt-services.snapserver.openFirewall">services.snapserver.openFirewall</link> module option default value has been changed from <literal>true</literal> to <literal>false</literal>. You will - need to explicitely set this option to - <literal>true</literal>, or configure your firewall. + need to explicitly set this option to <literal>true</literal>, + or configure your firewall. </para> </listitem> <listitem> <para> The - <link linkend="opt-services.avahi.openFirewall">services.avahi.openFirewall</link> + <link linkend="opt-services.tmate-ssh-server.openFirewall">services.tmate-ssh-server.openFirewall</link> module option default value has been changed from <literal>true</literal> to <literal>false</literal>. You will - need to explicitely set this option to - <literal>true</literal>, or configure your firewall. + need to explicitly set this option to <literal>true</literal>, + or configure your firewall. </para> </listitem> <listitem> <para> The - <link linkend="opt-services.tmate-ssh-server.openFirewall">services.tmate-ssh-server.openFirewall</link> + <link linkend="opt-services.unifi-video.openFirewall">services.unifi-video.openFirewall</link> module option default value has been changed from <literal>true</literal> to <literal>false</literal>. You will - need to explicitely set this option to - <literal>true</literal>, or configure your firewall. + need to explicitly set this option to <literal>true</literal>, + or configure your firewall. </para> </listitem> <listitem> <para> - The - <link linkend="opt-services.unifi-video.openFirewall">services.unifi-video.openFirewall</link> - module option default value has been changed from - <literal>true</literal> to <literal>false</literal>. You will - need to explicitely set this option to - <literal>true</literal>, or configure your firewall. + The Nginx module now validates the syntax of config files at + build time. For more complex configurations (using + <literal>include</literal> with out-of-store files notably) + you may need to disable this check by setting + <link linkend="opt-services.nginx.validateConfig">services.nginx.validateConfig</link> + to <literal>false</literal>. </para> </listitem> <listitem> @@ -148,6 +215,17 @@ </listitem> <listitem> <para> + In <literal>mastodon</literal> it is now necessary to specify + location of file with <literal>PostgreSQL</literal> database + password. In + <literal>services.mastodon.database.passwordFile</literal> + parameter default value + <literal>/var/lib/mastodon/secrets/db-password</literal> has + been changed to <literal>null</literal>. + </para> + </listitem> + <listitem> + <para> The <literal>nix.readOnlyStore</literal> option has been renamed to <literal>boot.readOnlyNixStore</literal> to clarify that it configures the NixOS boot process, not the Nix daemon. @@ -179,6 +257,16 @@ </listitem> <listitem> <para> + The module <literal>usbmuxd</literal> now has the ability to + change the package used by the daemon. In case you’re + experiencing issues with <literal>usbmuxd</literal> you can + try an alternative program like <literal>usbmuxd2</literal>. + Available as + <link linkend="opt-services.usbmuxd.package">services.usbmuxd.package</link> + </para> + </listitem> + <listitem> + <para> <literal>services.mastodon</literal> gained a tootctl wrapped named <literal>mastodon-tootctl</literal> similar to <literal>nextcloud-occ</literal> which can be executed from @@ -206,12 +294,69 @@ </listitem> <listitem> <para> - The minimal ISO image now use + The minimal ISO image now uses the <literal>nixos/modules/profiles/minimal.nix</literal> profile. </para> </listitem> <listitem> <para> + <literal>mastodon</literal> now supports connection to a + remote <literal>PostgreSQL</literal> database. + </para> + </listitem> + <listitem> + <para> + <literal>services.peertube</literal> now requires you to + specify the secret file + <literal>secrets.secretsFile</literal>. It can be generated by + running <literal>openssl rand -hex 32</literal>. Before + upgrading, read the release notes for PeerTube: + </para> + <itemizedlist spacing="compact"> + <listitem> + <para> + <link xlink:href="https://github.com/Chocobozzz/PeerTube/releases/tag/v5.0.0">Release + v5.0.0</link> + </para> + </listitem> + </itemizedlist> + <para> + And backup your data. + </para> + </listitem> + <listitem> + <para> + The module <literal>services.headscale</literal> was + refactored to be compliant with + <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC + 0042</link>. To be precise, this means that the following + things have changed: + </para> + <itemizedlist spacing="compact"> + <listitem> + <para> + Most settings has been migrated under + <link linkend="opt-services.headscale.settings">services.headscale.settings</link> + which is an attribute-set that will be converted into + headscale’s YAML config format. This means that the + configuration from + <link xlink:href="https://github.com/juanfont/headscale/blob/main/config-example.yaml">headscale’s + example configuration</link> can be directly written as + attribute-set in Nix within this option. + </para> + </listitem> + </itemizedlist> + </listitem> + <listitem> + <para> + <literal>nixos/lib/make-disk-image.nix</literal> can now + mutate EFI variables, run user-provided EFI firmware or + variable templates. This is now extensively documented in the + NixOS manual. + </para> + </listitem> + <listitem> + <para> A new <literal>virtualisation.rosetta</literal> module was added to allow running <literal>x86_64</literal> binaries through @@ -225,6 +370,21 @@ </listitem> <listitem> <para> + The new option <literal>users.motdFile</literal> allows + configuring a Message Of The Day that can be updated + dynamically. + </para> + </listitem> + <listitem> + <para> + Enabling global redirect in + <literal>services.nginx.virtualHosts</literal> now allows one + to add exceptions with the <literal>locations</literal> + option. + </para> + </listitem> + <listitem> + <para> Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store. @@ -232,11 +392,47 @@ </listitem> <listitem> <para> + The <literal>firewall</literal> and <literal>nat</literal> + module now has a nftables based implementation. Enable + <literal>networking.nftables</literal> to use it. + </para> + </listitem> + <listitem> + <para> + The <literal>services.fwupd</literal> module now allows + arbitrary daemon settings to be configured in a structured + manner + (<link linkend="opt-services.fwupd.daemonSettings"><literal>services.fwupd.daemonSettings</literal></link>). + </para> + </listitem> + <listitem> + <para> The <literal>unifi-poller</literal> package and corresponding NixOS module have been renamed to <literal>unpoller</literal> to match upstream. </para> </listitem> + <listitem> + <para> + The new option + <literal>services.tailscale.useRoutingFeatures</literal> + controls various settings for using Tailscale features like + exit nodes and subnet routers. If you wish to use your machine + as an exit node, you can set this setting to + <literal>server</literal>, otherwise if you wish to use an + exit node you can set this setting to + <literal>client</literal>. The strict RPF warning has been + removed as the RPF will be loosened automatically based on the + value of this setting. + </para> + </listitem> + <listitem> + <para> + <link xlink:href="https://xastir.org/index.php/Main_Page">Xastir</link> + can now access AX.25 interfaces via the + <literal>libax25</literal> package. + </para> + </listitem> </itemizedlist> </section> </section> diff --git a/nixos/doc/manual/installation/building-nixos.chapter.md b/nixos/doc/manual/installation/building-nixos.chapter.md index 17da261fbdaa..7b0b5ea1c447 100644 --- a/nixos/doc/manual/installation/building-nixos.chapter.md +++ b/nixos/doc/manual/installation/building-nixos.chapter.md @@ -9,7 +9,7 @@ You have two options: - Combine them with (any of) your host config(s) System images, such as the live installer ones, know how to enforce configuration settings -on wich they immediately depend in order to work correctly. +on which they immediately depend in order to work correctly. However, if you are confident, you can opt to override those enforced values with `mkForce`. @@ -75,6 +75,6 @@ configuration values upon which the correct functioning of the image depends. For example, the iso base image overrides those file systems which it needs at a minimum for correct functioning, while the installer base image overrides the entire file system layout because there can't be any other guarantees on a live medium than those given -by the live medium itself. The latter is especially true befor formatting the target +by the live medium itself. The latter is especially true before formatting the target block device(s). On the other hand, the netboot iso only overrides its minimum dependencies since netboot images are always made-to-target. diff --git a/nixos/doc/manual/installation/changing-config.chapter.md b/nixos/doc/manual/installation/changing-config.chapter.md index 8a404f085d7c..11b49ccb1f67 100644 --- a/nixos/doc/manual/installation/changing-config.chapter.md +++ b/nixos/doc/manual/installation/changing-config.chapter.md @@ -13,7 +13,7 @@ booting, and try to realise the configuration in the running system (e.g., by restarting system services). ::: {.warning} -This command doesn\'t start/stop [user services](#opt-systemd.user.services) +This command doesn't start/stop [user services](#opt-systemd.user.services) automatically. `nixos-rebuild` only runs a `daemon-reload` for each user with running user services. ::: @@ -51,7 +51,7 @@ GRUB 2 boot screen by giving it a different *profile name*, e.g. ``` which causes the new configuration (and previous ones created using -`-p test`) to show up in the GRUB submenu "NixOS - Profile \'test\'". +`-p test`) to show up in the GRUB submenu "NixOS - Profile 'test'". This can be useful to separate test configurations from "stable" configurations. diff --git a/nixos/doc/manual/installation/installing-from-other-distro.section.md b/nixos/doc/manual/installation/installing-from-other-distro.section.md index b9ccf1415179..921592fe5357 100644 --- a/nixos/doc/manual/installation/installing-from-other-distro.section.md +++ b/nixos/doc/manual/installation/installing-from-other-distro.section.md @@ -30,7 +30,7 @@ The first steps to all these are the same: 1. Switch to the NixOS channel: - If you\'ve just installed Nix on a non-NixOS distribution, you will + If you've just installed Nix on a non-NixOS distribution, you will be on the `nixpkgs` channel by default. ```ShellSession @@ -49,10 +49,10 @@ The first steps to all these are the same: 1. Install the NixOS installation tools: - You\'ll need `nixos-generate-config` and `nixos-install`, but this + You'll need `nixos-generate-config` and `nixos-install`, but this also makes some man pages and `nixos-enter` available, just in case you want to chroot into your NixOS partition. NixOS installs these - by default, but you don\'t have NixOS yet.. + by default, but you don't have NixOS yet.. ```ShellSession $ nix-env -f '<nixpkgs>' -iA nixos-install-tools @@ -70,7 +70,7 @@ The first steps to all these are the same: refer to the partitioning, file-system creation, and mounting steps of [](#sec-installation) - If you\'re about to install NixOS in place using `NIXOS_LUSTRATE` + If you're about to install NixOS in place using `NIXOS_LUSTRATE` there is nothing to do for this step. 1. Generate your NixOS configuration: @@ -79,12 +79,12 @@ The first steps to all these are the same: $ sudo `which nixos-generate-config` --root /mnt ``` - You\'ll probably want to edit the configuration files. Refer to the + You'll probably want to edit the configuration files. Refer to the `nixos-generate-config` step in [](#sec-installation) for more information. Consider setting up the NixOS bootloader to give you the ability to - boot on your existing Linux partition. For instance, if you\'re + boot on your existing Linux partition. For instance, if you're using GRUB and your existing distribution is running Ubuntu, you may want to add something like this to your `configuration.nix`: @@ -152,15 +152,15 @@ The first steps to all these are the same: ``` Note that this will place the generated configuration files in - `/etc/nixos`. You\'ll probably want to edit the configuration files. + `/etc/nixos`. You'll probably want to edit the configuration files. Refer to the `nixos-generate-config` step in [](#sec-installation) for more information. - You\'ll likely want to set a root password for your first boot using - the configuration files because you won\'t have a chance to enter a - password until after you reboot. You can initalize the root password - to an empty one with this line: (and of course don\'t forget to set - one once you\'ve rebooted or to lock the account with + You'll likely want to set a root password for your first boot using + the configuration files because you won't have a chance to enter a + password until after you reboot. You can initialize the root password + to an empty one with this line: (and of course don't forget to set + one once you've rebooted or to lock the account with `sudo passwd -l root` if you use `sudo`) ```nix @@ -186,7 +186,7 @@ The first steps to all these are the same: bootup scripts require its presence). `/etc/NIXOS_LUSTRATE` tells the NixOS bootup scripts to move - *everything* that\'s in the root partition to `/old-root`. This will + *everything* that's in the root partition to `/old-root`. This will move your existing distribution out of the way in the very early stages of the NixOS bootup. There are exceptions (we do need to keep NixOS there after all), so the NixOS lustrate process will not @@ -201,10 +201,10 @@ The first steps to all these are the same: ::: {.note} Support for `NIXOS_LUSTRATE` was added in NixOS 16.09. The act of - \"lustrating\" refers to the wiping of the existing distribution. + "lustrating" refers to the wiping of the existing distribution. Creating `/etc/NIXOS_LUSTRATE` can also be used on NixOS to remove - all mutable files from your root partition (anything that\'s not in - `/nix` or `/boot` gets \"lustrated\" on the next boot. + all mutable files from your root partition (anything that's not in + `/nix` or `/boot` gets "lustrated" on the next boot. lustrate /ˈlʌstreɪt/ verb. @@ -212,14 +212,14 @@ The first steps to all these are the same: ritual action. ::: - Let\'s create the files: + Let's create the files: ```ShellSession $ sudo touch /etc/NIXOS $ sudo touch /etc/NIXOS_LUSTRATE ``` - Let\'s also make sure the NixOS configuration files are kept once we + Let's also make sure the NixOS configuration files are kept once we reboot on NixOS: ```ShellSession @@ -233,7 +233,7 @@ The first steps to all these are the same: ::: {.warning} Once you complete this step, your current distribution will no - longer be bootable! If you didn\'t get all the NixOS configuration + longer be bootable! If you didn't get all the NixOS configuration right, especially those settings pertaining to boot loading and root partition, NixOS may not be bootable either. Have a USB rescue device ready in case this happens. @@ -247,7 +247,7 @@ The first steps to all these are the same: Cross your fingers, reboot, hopefully you should get a NixOS prompt! 1. If for some reason you want to revert to the old distribution, - you\'ll need to boot on a USB rescue disk and do something along + you'll need to boot on a USB rescue disk and do something along these lines: ```ShellSession @@ -264,14 +264,14 @@ The first steps to all these are the same: This may work as is or you might also need to reinstall the boot loader. - And of course, if you\'re happy with NixOS and no longer need the + And of course, if you're happy with NixOS and no longer need the old distribution: ```ShellSession sudo rm -rf /old-root ``` -1. It\'s also worth noting that this whole process can be automated. +1. It's also worth noting that this whole process can be automated. This is especially useful for Cloud VMs, where provider do not provide NixOS. For instance, [nixos-infect](https://github.com/elitak/nixos-infect) uses the diff --git a/nixos/doc/manual/installation/installing-kexec.section.md b/nixos/doc/manual/installation/installing-kexec.section.md index 286cbbda6a69..61d8e8e5999b 100644 --- a/nixos/doc/manual/installation/installing-kexec.section.md +++ b/nixos/doc/manual/installation/installing-kexec.section.md @@ -30,7 +30,7 @@ This will create a `result` directory containing the following: These three files are meant to be copied over to the other already running Linux Distribution. -Note it's symlinks pointing elsewhere, so `cd` in, and use +Note its symlinks pointing elsewhere, so `cd` in, and use `scp * root@$destination` to copy it over, rather than rsync. Once you finished copying, execute `kexec-boot` *on the destination*, and after diff --git a/nixos/doc/manual/installation/installing-usb.section.md b/nixos/doc/manual/installation/installing-usb.section.md index da32935a7a10..adfe22ea2f00 100644 --- a/nixos/doc/manual/installation/installing-usb.section.md +++ b/nixos/doc/manual/installation/installing-usb.section.md @@ -56,12 +56,12 @@ select the image, select the USB flash drive and click "Write". sudo dd if=<path-to-image> of=/dev/rdiskX bs=4m ``` - After `dd` completes, a GUI dialog \"The disk - you inserted was not readable by this computer\" will pop up, which can + After `dd` completes, a GUI dialog "The disk + you inserted was not readable by this computer" will pop up, which can be ignored. ::: {.note} - Using the \'raw\' `rdiskX` device instead of `diskX` with dd completes in + Using the 'raw' `rdiskX` device instead of `diskX` with dd completes in minutes instead of hours. ::: diff --git a/nixos/doc/manual/installation/installing-virtualbox-guest.section.md b/nixos/doc/manual/installation/installing-virtualbox-guest.section.md index e9c2a621c1bb..004838e586be 100644 --- a/nixos/doc/manual/installation/installing-virtualbox-guest.section.md +++ b/nixos/doc/manual/installation/installing-virtualbox-guest.section.md @@ -1,4 +1,4 @@ -# Installing in a VirtualBox guest {#sec-instaling-virtualbox-guest} +# Installing in a VirtualBox guest {#sec-installing-virtualbox-guest} Installing NixOS into a VirtualBox guest is convenient for users who want to try NixOS without installing it on bare metal. If you want to @@ -6,7 +6,7 @@ use a pre-made VirtualBox appliance, it is available at [the downloads page](https://nixos.org/nixos/download.html). If you want to set up a VirtualBox guest manually, follow these instructions: -1. Add a New Machine in VirtualBox with OS Type \"Linux / Other Linux\" +1. Add a New Machine in VirtualBox with OS Type "Linux / Other Linux" 1. Base Memory Size: 768 MB or higher. @@ -16,7 +16,7 @@ VirtualBox guest manually, follow these instructions: 1. Click on Settings / System / Processor and enable PAE/NX -1. Click on Settings / System / Acceleration and enable \"VT-x/AMD-V\" +1. Click on Settings / System / Acceleration and enable "VT-x/AMD-V" acceleration 1. Click on Settings / Display / Screen and select VMSVGA as Graphics @@ -41,7 +41,7 @@ boot.initrd.checkJournalingFS = false; Shared folders can be given a name and a path in the host system in the VirtualBox settings (Machine / Settings / Shared Folders, then click on -the \"Add\" icon). Add the following to the +the "Add" icon). Add the following to the `/etc/nixos/configuration.nix` to auto-mount them. If you do not add `"nofail"`, the system will not boot properly. diff --git a/nixos/doc/manual/installation/installing.chapter.md b/nixos/doc/manual/installation/installing.chapter.md index 2c86cb923a5c..ac7cf5a7bfc5 100644 --- a/nixos/doc/manual/installation/installing.chapter.md +++ b/nixos/doc/manual/installation/installing.chapter.md @@ -162,7 +162,7 @@ network manually, disable NetworkManager with `systemctl stop NetworkManager`. On the minimal installer, NetworkManager is not available, so -configuration must be perfomed manually. To configure the wifi, first +configuration must be performed manually. To configure the wifi, first start wpa_supplicant with `sudo systemctl start wpa_supplicant`, then run `wpa_cli`. For most home networks, you need to type in the following commands: @@ -230,11 +230,11 @@ The recommended partition scheme differs depending if the computer uses #### UEFI (GPT) {#sec-installation-manual-partitioning-UEFI} []{#sec-installation-partitioning-UEFI} <!-- legacy anchor --> -Here\'s an example partition scheme for UEFI, using `/dev/sda` as the +Here's an example partition scheme for UEFI, using `/dev/sda` as the device. ::: {.note} -You can safely ignore `parted`\'s informational message about needing to +You can safely ignore `parted`'s informational message about needing to update /etc/fstab. ::: @@ -279,11 +279,11 @@ Once complete, you can follow with #### Legacy Boot (MBR) {#sec-installation-manual-partitioning-MBR} []{#sec-installation-partitioning-MBR} <!-- legacy anchor --> -Here\'s an example partition scheme for Legacy Boot, using `/dev/sda` as +Here's an example partition scheme for Legacy Boot, using `/dev/sda` as the device. ::: {.note} -You can safely ignore `parted`\'s informational message about needing to +You can safely ignore `parted`'s informational message about needing to update /etc/fstab. ::: diff --git a/nixos/doc/manual/man-nixos-rebuild.xml b/nixos/doc/manual/man-nixos-rebuild.xml index ea96f49fa977..cab871661a75 100644 --- a/nixos/doc/manual/man-nixos-rebuild.xml +++ b/nixos/doc/manual/man-nixos-rebuild.xml @@ -134,7 +134,7 @@ </arg> <arg> <option>-I</option> - <replaceable>path</replaceable> + <replaceable>NIX_PATH</replaceable> </arg> <arg> <group choice='req'> @@ -624,7 +624,7 @@ <para> In addition, <command>nixos-rebuild</command> accepts various Nix-related - flags, including <option>--max-jobs</option> / <option>-j</option>, + flags, including <option>--max-jobs</option> / <option>-j</option>, <option>-I</option>, <option>--show-trace</option>, <option>--keep-failed</option>, <option>--keep-going</option>, <option>--impure</option>, and <option>--verbose</option> / <option>-v</option>. See the Nix manual for details. @@ -649,6 +649,20 @@ <varlistentry> <term> + <envar>NIX_PATH</envar> + </term> + <listitem> + <para> + A colon-separated list of directories used to look up Nix expressions enclosed in angle brackets (e.g <nixpkgs>). Example + <screen> + nixpkgs=./my-nixpkgs + </screen> + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term> <envar>NIX_SSHOPTS</envar> </term> <listitem> diff --git a/nixos/doc/manual/md-to-db.sh b/nixos/doc/manual/md-to-db.sh index beb0ff9f7082..6eca9f3b2c3d 100755 --- a/nixos/doc/manual/md-to-db.sh +++ b/nixos/doc/manual/md-to-db.sh @@ -1,5 +1,5 @@ #! /usr/bin/env nix-shell -#! nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/tarball/21.11 -i bash -p pandoc +#! nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/tarball/22.11 -i bash -p pandoc # This script is temporarily needed while we transition the manual to # CommonMark. It converts the .md files in the regular manual folder diff --git a/nixos/doc/manual/release-notes/rl-1509.section.md b/nixos/doc/manual/release-notes/rl-1509.section.md index 55804ddb988a..1422ae4c299c 100644 --- a/nixos/doc/manual/release-notes/rl-1509.section.md +++ b/nixos/doc/manual/release-notes/rl-1509.section.md @@ -2,7 +2,7 @@ In addition to numerous new and upgraded packages, this release has the following highlights: -- The [Haskell](http://haskell.org/) packages infrastructure has been re-designed from the ground up (\"Haskell NG\"). NixOS now distributes the latest version of every single package registered on [Hackage](http://hackage.haskell.org/) \-- well in excess of 8,000 Haskell packages. Detailed instructions on how to use that infrastructure can be found in the [User\'s Guide to the Haskell Infrastructure](https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure). Users migrating from an earlier release may find helpful information below, in the list of backwards-incompatible changes. Furthermore, we distribute 51(!) additional Haskell package sets that provide every single [LTS Haskell](http://www.stackage.org/) release since version 0.0 as well as the most recent [Stackage Nightly](http://www.stackage.org/) snapshot. The announcement [\"Full Stackage Support in Nixpkgs\"](https://nixos.org/nix-dev/2015-September/018138.html) gives additional details. +- The [Haskell](http://haskell.org/) packages infrastructure has been re-designed from the ground up ("Haskell NG"). NixOS now distributes the latest version of every single package registered on [Hackage](http://hackage.haskell.org/) \-- well in excess of 8,000 Haskell packages. Detailed instructions on how to use that infrastructure can be found in the [User's Guide to the Haskell Infrastructure](https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure). Users migrating from an earlier release may find helpful information below, in the list of backwards-incompatible changes. Furthermore, we distribute 51(!) additional Haskell package sets that provide every single [LTS Haskell](http://www.stackage.org/) release since version 0.0 as well as the most recent [Stackage Nightly](http://www.stackage.org/) snapshot. The announcement ["Full Stackage Support in Nixpkgs"](https://nixos.org/nix-dev/2015-September/018138.html) gives additional details. - Nix has been updated to version 1.10, which among other improvements enables cryptographic signatures on binary caches for improved security. @@ -178,7 +178,7 @@ The new option `system.stateVersion` ensures that certain configuration changes - Nix now requires binary caches to be cryptographically signed. If you have unsigned binary caches that you want to continue to use, you should set `nix.requireSignedBinaryCaches = false`. -- Steam now doesn\'t need root rights to work. Instead of using `*-steam-chrootenv`, you should now just run `steam`. `steamChrootEnv` package was renamed to `steam`, and old `steam` package \-- to `steamOriginal`. +- Steam now doesn't need root rights to work. Instead of using `*-steam-chrootenv`, you should now just run `steam`. `steamChrootEnv` package was renamed to `steam`, and old `steam` package \-- to `steamOriginal`. - CMPlayer has been renamed to bomi upstream. Package `cmplayer` was accordingly renamed to `bomi` @@ -203,7 +203,7 @@ The new option `system.stateVersion` ensures that certain configuration changes } ``` -- \"`nix-env -qa`\" no longer discovers Haskell packages by name. The only packages visible in the global scope are `ghc`, `cabal-install`, and `stack`, but all other packages are hidden. The reason for this inconvenience is the sheer size of the Haskell package set. Name-based lookups are expensive, and most `nix-env -qa` operations would become much slower if we\'d add the entire Hackage database into the top level attribute set. Instead, the list of Haskell packages can be displayed by running: +- "`nix-env -qa`" no longer discovers Haskell packages by name. The only packages visible in the global scope are `ghc`, `cabal-install`, and `stack`, but all other packages are hidden. The reason for this inconvenience is the sheer size of the Haskell package set. Name-based lookups are expensive, and most `nix-env -qa` operations would become much slower if we'd add the entire Hackage database into the top level attribute set. Instead, the list of Haskell packages can be displayed by running: ```ShellSession nix-env -f "<nixpkgs>" -qaP -A haskellPackages @@ -217,11 +217,11 @@ nix-env -f "<nixpkgs>" -iA haskellPackages.pandoc Installing Haskell _libraries_ this way, however, is no longer supported. See the next item for more details. -- Previous versions of NixOS came with a feature called `ghc-wrapper`, a small script that allowed GHC to transparently pick up on libraries installed in the user\'s profile. This feature has been deprecated; `ghc-wrapper` was removed from the distribution. The proper way to register Haskell libraries with the compiler now is the `haskellPackages.ghcWithPackages` function. The [User\'s Guide to the Haskell Infrastructure](https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure) provides more information about this subject. +- Previous versions of NixOS came with a feature called `ghc-wrapper`, a small script that allowed GHC to transparently pick up on libraries installed in the user's profile. This feature has been deprecated; `ghc-wrapper` was removed from the distribution. The proper way to register Haskell libraries with the compiler now is the `haskellPackages.ghcWithPackages` function. The [User's Guide to the Haskell Infrastructure](https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure) provides more information about this subject. - All Haskell builds that have been generated with version 1.x of the `cabal2nix` utility are now invalid and need to be re-generated with a current version of `cabal2nix` to function. The most recent version of this tool can be installed by running `nix-env -i cabal2nix`. -- The `haskellPackages` set in Nixpkgs used to have a function attribute called `extension` that users could override in their `~/.nixpkgs/config.nix` files to configure additional attributes, etc. That function still exists, but it\'s now called `overrides`. +- The `haskellPackages` set in Nixpkgs used to have a function attribute called `extension` that users could override in their `~/.nixpkgs/config.nix` files to configure additional attributes, etc. That function still exists, but it's now called `overrides`. - The OpenBLAS library has been updated to version `0.2.14`. Support for the `x86_64-darwin` platform was added. Dynamic architecture detection was enabled; OpenBLAS now selects microarchitecture-optimized routines at runtime, so optimal performance is achieved without the need to rebuild OpenBLAS locally. OpenBLAS has replaced ATLAS in most packages which use an optimized BLAS or LAPACK implementation. @@ -312,7 +312,7 @@ Other notable improvements: - The nixos and nixpkgs channels were unified, so one _can_ use `nix-env -iA nixos.bash` instead of `nix-env -iA nixos.pkgs.bash`. See [the commit](https://github.com/NixOS/nixpkgs/commit/2cd7c1f198) for details. -- Users running an SSH server who worry about the quality of their `/etc/ssh/moduli` file with respect to the [vulnerabilities discovered in the Diffie-Hellman key exchange](https://stribika.github.io/2015/01/04/secure-secure-shell.html) can now replace OpenSSH\'s default version with one they generated themselves using the new `services.openssh.moduliFile` option. +- Users running an SSH server who worry about the quality of their `/etc/ssh/moduli` file with respect to the [vulnerabilities discovered in the Diffie-Hellman key exchange](https://stribika.github.io/2015/01/04/secure-secure-shell.html) can now replace OpenSSH's default version with one they generated themselves using the new `services.openssh.moduliFile` option. - A newly packaged TeX Live 2015 is provided in `pkgs.texlive`, split into 6500 nix packages. For basic user documentation see [the source](https://github.com/NixOS/nixpkgs/blob/release-15.09/pkgs/tools/typesetting/tex/texlive/default.nix#L1). Beware of [an issue](https://github.com/NixOS/nixpkgs/issues/9757) when installing a too large package set. The plan is to deprecate and maybe delete the original TeX packages until the next release. diff --git a/nixos/doc/manual/release-notes/rl-1603.section.md b/nixos/doc/manual/release-notes/rl-1603.section.md index dce879ec16d0..532a16f937b0 100644 --- a/nixos/doc/manual/release-notes/rl-1603.section.md +++ b/nixos/doc/manual/release-notes/rl-1603.section.md @@ -152,19 +152,19 @@ When upgrading from a previous release, please be aware of the following incompa } ``` -- `s3sync` is removed, as it hasn\'t been developed by upstream for 4 years and only runs with ruby 1.8. For an actively-developer alternative look at `tarsnap` and others. +- `s3sync` is removed, as it hasn't been developed by upstream for 4 years and only runs with ruby 1.8. For an actively-developer alternative look at `tarsnap` and others. -- `ruby_1_8` has been removed as it\'s not supported from upstream anymore and probably contains security issues. +- `ruby_1_8` has been removed as it's not supported from upstream anymore and probably contains security issues. - `tidy-html5` package is removed. Upstream only provided `(lib)tidy5` during development, and now they went back to `(lib)tidy` to work as a drop-in replacement of the original package that has been unmaintained for years. You can (still) use the `html-tidy` package, which got updated to a stable release from this new upstream. - `extraDeviceOptions` argument is removed from `bumblebee` package. Instead there are now two separate arguments: `extraNvidiaDeviceOptions` and `extraNouveauDeviceOptions` for setting extra X11 options for nvidia and nouveau drivers, respectively. -- The `Ctrl+Alt+Backspace` key combination no longer kills the X server by default. There\'s a new option `services.xserver.enableCtrlAltBackspace` allowing to enable the combination again. +- The `Ctrl+Alt+Backspace` key combination no longer kills the X server by default. There's a new option `services.xserver.enableCtrlAltBackspace` allowing to enable the combination again. - `emacsPackagesNg` now contains all packages from the ELPA, MELPA, and MELPA Stable repositories. -- Data directory for Postfix MTA server is moved from `/var/postfix` to `/var/lib/postfix`. Old configurations are migrated automatically. `service.postfix` module has also received many improvements, such as correct directories\' access rights, new `aliasFiles` and `mapFiles` options and more. +- Data directory for Postfix MTA server is moved from `/var/postfix` to `/var/lib/postfix`. Old configurations are migrated automatically. `service.postfix` module has also received many improvements, such as correct directories' access rights, new `aliasFiles` and `mapFiles` options and more. - Filesystem options should now be configured as a list of strings, not a comma-separated string. The old style will continue to work, but print a warning, until the 16.09 release. An example of the new style: @@ -180,7 +180,7 @@ When upgrading from a previous release, please be aware of the following incompa - CUPS, installed by `services.printing` module, now has its data directory in `/var/lib/cups`. Old configurations from `/etc/cups` are moved there automatically, but there might be problems. Also configuration options `services.printing.cupsdConf` and `services.printing.cupsdFilesConf` were removed because they had been allowing one to override configuration variables required for CUPS to work at all on NixOS. For most use cases, `services.printing.extraConf` and new option `services.printing.extraFilesConf` should be enough; if you encounter a situation when they are not, please file a bug. - There are also Gutenprint improvements; in particular, a new option `services.printing.gutenprint` is added to enable automatic updating of Gutenprint PPMs; it\'s greatly recommended to enable it instead of adding `gutenprint` to the `drivers` list. + There are also Gutenprint improvements; in particular, a new option `services.printing.gutenprint` is added to enable automatic updating of Gutenprint PPMs; it's greatly recommended to enable it instead of adding `gutenprint` to the `drivers` list. - `services.xserver.vaapiDrivers` has been removed. Use `hardware.opengl.extraPackages{,32}` instead. You can also specify VDPAU drivers there. @@ -202,7 +202,7 @@ When upgrading from a previous release, please be aware of the following incompa } ``` -- `services.udev.extraRules` option now writes rules to `99-local.rules` instead of `10-local.rules`. This makes all the user rules apply after others, so their results wouldn\'t be overriden by anything else. +- `services.udev.extraRules` option now writes rules to `99-local.rules` instead of `10-local.rules`. This makes all the user rules apply after others, so their results wouldn't be overridden by anything else. - Large parts of the `services.gitlab` module has been been rewritten. There are new configuration options available. The `stateDir` option was renamned to `statePath` and the `satellitesDir` option was removed. Please review the currently available options. @@ -246,7 +246,7 @@ When upgrading from a previous release, please be aware of the following incompa you should either re-run `nixos-generate-config` or manually replace `"${config.boot.kernelPackages.broadcom_sta}"` by `config.boot.kernelPackages.broadcom_sta` in your `/etc/nixos/hardware-configuration.nix`. More discussion is on [ the github issue](https://github.com/NixOS/nixpkgs/pull/12595). -- The `services.xserver.startGnuPGAgent` option has been removed. GnuPG 2.1.x changed the way the gpg-agent works, and that new approach no longer requires (or even supports) the \"start everything as a child of the agent\" scheme we\'ve implemented in NixOS for older versions. To configure the gpg-agent for your X session, add the following code to `~/.bashrc` or some file that's sourced when your shell is started: +- The `services.xserver.startGnuPGAgent` option has been removed. GnuPG 2.1.x changed the way the gpg-agent works, and that new approach no longer requires (or even supports) the "start everything as a child of the agent" scheme we've implemented in NixOS for older versions. To configure the gpg-agent for your X session, add the following code to `~/.bashrc` or some file that's sourced when your shell is started: ```shell GPG_TTY=$(tty) @@ -273,7 +273,7 @@ When upgrading from a previous release, please be aware of the following incompa gpg --import ~/.gnupg/secring.gpg ``` - The `gpg-agent(1)` man page has more details about this subject, i.e. in the \"EXAMPLES\" section. + The `gpg-agent(1)` man page has more details about this subject, i.e. in the "EXAMPLES" section. Other notable improvements: diff --git a/nixos/doc/manual/release-notes/rl-1609.section.md b/nixos/doc/manual/release-notes/rl-1609.section.md index 075f0cf52cd1..e9c650cf4072 100644 --- a/nixos/doc/manual/release-notes/rl-1609.section.md +++ b/nixos/doc/manual/release-notes/rl-1609.section.md @@ -20,7 +20,7 @@ When upgrading from a previous release, please be aware of the following incompa - A large number of packages have been converted to use the multiple outputs feature of Nix to greatly reduce the amount of required disk space, as mentioned above. This may require changes to any custom packages to make them build again; see the relevant chapter in the Nixpkgs manual for more information. (Additional caveat to packagers: some packaging conventions related to multiple-output packages [were changed](https://github.com/NixOS/nixpkgs/pull/14766) late (August 2016) in the release cycle and differ from the initial introduction of multiple outputs.) -- Previous versions of Nixpkgs had support for all versions of the LTS Haskell package set. That support has been dropped. The previously provided `haskell.packages.lts-x_y` package sets still exist in name to aviod breaking user code, but these package sets don\'t actually contain the versions mandated by the corresponding LTS release. Instead, our package set it loosely based on the latest available LTS release, i.e. LTS 7.x at the time of this writing. New releases of NixOS and Nixpkgs will drop those old names entirely. [The motivation for this change](https://nixos.org/nix-dev/2016-June/020585.html) has been discussed at length on the `nix-dev` mailing list and in [Github issue \#14897](https://github.com/NixOS/nixpkgs/issues/14897). Development strategies for Haskell hackers who want to rely on Nix and NixOS have been described in [another nix-dev article](https://nixos.org/nix-dev/2016-June/020642.html). +- Previous versions of Nixpkgs had support for all versions of the LTS Haskell package set. That support has been dropped. The previously provided `haskell.packages.lts-x_y` package sets still exist in name to aviod breaking user code, but these package sets don't actually contain the versions mandated by the corresponding LTS release. Instead, our package set it loosely based on the latest available LTS release, i.e. LTS 7.x at the time of this writing. New releases of NixOS and Nixpkgs will drop those old names entirely. [The motivation for this change](https://nixos.org/nix-dev/2016-June/020585.html) has been discussed at length on the `nix-dev` mailing list and in [Github issue \#14897](https://github.com/NixOS/nixpkgs/issues/14897). Development strategies for Haskell hackers who want to rely on Nix and NixOS have been described in [another nix-dev article](https://nixos.org/nix-dev/2016-June/020642.html). - Shell aliases for systemd sub-commands [were dropped](https://github.com/NixOS/nixpkgs/pull/15598): `start`, `stop`, `restart`, `status`. @@ -28,7 +28,7 @@ When upgrading from a previous release, please be aware of the following incompa - `/var/empty` is now immutable. Activation script runs `chattr +i` to forbid any modifications inside the folder. See [ the pull request](https://github.com/NixOS/nixpkgs/pull/18365) for what bugs this caused. -- Gitlab\'s maintainance script `gitlab-runner` was removed and split up into the more clearer `gitlab-run` and `gitlab-rake` scripts, because `gitlab-runner` is a component of Gitlab CI. +- Gitlab's maintainance script `gitlab-runner` was removed and split up into the more clearer `gitlab-run` and `gitlab-rake` scripts, because `gitlab-runner` is a component of Gitlab CI. - `services.xserver.libinput.accelProfile` default changed from `flat` to `adaptive`, as per [ official documentation](https://wayland.freedesktop.org/libinput/doc/latest/group__config.html#gad63796972347f318b180e322e35cee79). @@ -38,7 +38,7 @@ When upgrading from a previous release, please be aware of the following incompa - `pkgs.linuxPackages.virtualbox` now contains only the kernel modules instead of the VirtualBox user space binaries. If you want to reference the user space binaries, you have to use the new `pkgs.virtualbox` instead. -- `goPackages` was replaced with separated Go applications in appropriate `nixpkgs` categories. Each Go package uses its own dependency set. There\'s also a new `go2nix` tool introduced to generate a Go package definition from its Go source automatically. +- `goPackages` was replaced with separated Go applications in appropriate `nixpkgs` categories. Each Go package uses its own dependency set. There's also a new `go2nix` tool introduced to generate a Go package definition from its Go source automatically. - `services.mongodb.extraConfig` configuration format was changed to YAML. diff --git a/nixos/doc/manual/release-notes/rl-1703.section.md b/nixos/doc/manual/release-notes/rl-1703.section.md index 7f424f2a6ce3..b82c41e28ca3 100644 --- a/nixos/doc/manual/release-notes/rl-1703.section.md +++ b/nixos/doc/manual/release-notes/rl-1703.section.md @@ -8,7 +8,7 @@ In addition to numerous new and upgraded packages, this release has the followin - This release is based on Glibc 2.25, GCC 5.4.0 and systemd 232. The default Linux kernel is 4.9 and Nix is at 1.11.8. -- The default desktop environment now is KDE\'s Plasma 5. KDE 4 has been removed +- The default desktop environment now is KDE's Plasma 5. KDE 4 has been removed - The setuid wrapper functionality now supports setting capabilities. @@ -208,7 +208,7 @@ When upgrading from a previous release, please be aware of the following incompa - Two lone top-level dict dbs moved into `dictdDBs`. This affects: `dictdWordnet` which is now at `dictdDBs.wordnet` and `dictdWiktionary` which is now at `dictdDBs.wiktionary` -- Parsoid service now uses YAML configuration format. `service.parsoid.interwikis` is now called `service.parsoid.wikis` and is a list of either API URLs or attribute sets as specified in parsoid\'s documentation. +- Parsoid service now uses YAML configuration format. `service.parsoid.interwikis` is now called `service.parsoid.wikis` and is a list of either API URLs or attribute sets as specified in parsoid's documentation. - `Ntpd` was replaced by `systemd-timesyncd` as the default service to synchronize system time with a remote NTP server. The old behavior can be restored by setting `services.ntp.enable` to `true`. Upstream time servers for all NTP implementations are now configured using `networking.timeServers`. @@ -260,11 +260,11 @@ When upgrading from a previous release, please be aware of the following incompa - Autoloading connection tracking helpers is now disabled by default. This default was also changed in the Linux kernel and is considered insecure if not configured properly in your firewall. If you need connection tracking helpers (i.e. for active FTP) please enable `networking.firewall.autoLoadConntrackHelpers` and tune `networking.firewall.connectionTrackingModules` to suit your needs. -- `local_recipient_maps` is not set to empty value by Postfix service. It\'s an insecure default as stated by Postfix documentation. Those who want to retain this setting need to set it via `services.postfix.extraConfig`. +- `local_recipient_maps` is not set to empty value by Postfix service. It's an insecure default as stated by Postfix documentation. Those who want to retain this setting need to set it via `services.postfix.extraConfig`. - Iputils no longer provide ping6 and traceroute6. The functionality of these tools has been integrated into ping and traceroute respectively. To enforce an address family the new flags `-4` and `-6` have been added. One notable incompatibility is that specifying an interface (for link-local IPv6 for instance) is no longer done with the `-I` flag, but by encoding the interface into the address (`ping fe80::1%eth0`). -- The socket handling of the `services.rmilter` module has been fixed and refactored. As rmilter doesn\'t support binding to more than one socket, the options `bindUnixSockets` and `bindInetSockets` have been replaced by `services.rmilter.bindSocket.*`. The default is still a unix socket in `/run/rmilter/rmilter.sock`. Refer to the options documentation for more information. +- The socket handling of the `services.rmilter` module has been fixed and refactored. As rmilter doesn't support binding to more than one socket, the options `bindUnixSockets` and `bindInetSockets` have been replaced by `services.rmilter.bindSocket.*`. The default is still a unix socket in `/run/rmilter/rmilter.sock`. Refer to the options documentation for more information. - The `fetch*` functions no longer support md5, please use sha256 instead. @@ -278,7 +278,7 @@ When upgrading from a previous release, please be aware of the following incompa - Module type system have a new extensible option types feature that allow to extend certain types, such as enum, through multiple option declarations of the same option across multiple modules. -- `jre` now defaults to GTK UI by default. This improves visual consistency and makes Java follow system font style, improving the situation on HighDPI displays. This has a cost of increased closure size; for server and other headless workloads it\'s recommended to use `jre_headless`. +- `jre` now defaults to GTK UI by default. This improves visual consistency and makes Java follow system font style, improving the situation on HighDPI displays. This has a cost of increased closure size; for server and other headless workloads it's recommended to use `jre_headless`. - Python 2.6 interpreter and package set have been removed. diff --git a/nixos/doc/manual/release-notes/rl-1709.section.md b/nixos/doc/manual/release-notes/rl-1709.section.md index e5af22721b0c..9f49549901be 100644 --- a/nixos/doc/manual/release-notes/rl-1709.section.md +++ b/nixos/doc/manual/release-notes/rl-1709.section.md @@ -8,7 +8,7 @@ In addition to numerous new and upgraded packages, this release has the followin - The user handling now keeps track of deallocated UIDs/GIDs. When a user or group is revived, this allows it to be allocated the UID/GID it had before. A consequence is that UIDs and GIDs are no longer reused. -- The module option `services.xserver.xrandrHeads` now causes the first head specified in this list to be set as the primary head. Apart from that, it\'s now possible to also set additional options by using an attribute set, for example: +- The module option `services.xserver.xrandrHeads` now causes the first head specified in this list to be set as the primary head. Apart from that, it's now possible to also set additional options by using an attribute set, for example: ```nix { services.xserver.xrandrHeads = [ @@ -208,7 +208,7 @@ When upgrading from a previous release, please be aware of the following incompa - The `mysql` default `dataDir` has changed from `/var/mysql` to `/var/lib/mysql`. - - Radicale\'s default package has changed from 1.x to 2.x. Instructions to migrate can be found [ here ](http://radicale.org/1to2/). It is also possible to use the newer version by setting the `package` to `radicale2`, which is done automatically when `stateVersion` is 17.09 or higher. The `extraArgs` option has been added to allow passing the data migration arguments specified in the instructions; see the `radicale.nix` NixOS test for an example migration. + - Radicale's default package has changed from 1.x to 2.x. Instructions to migrate can be found [ here ](http://radicale.org/1to2/). It is also possible to use the newer version by setting the `package` to `radicale2`, which is done automatically when `stateVersion` is 17.09 or higher. The `extraArgs` option has been added to allow passing the data migration arguments specified in the instructions; see the `radicale.nix` NixOS test for an example migration. - The `aiccu` package was removed. This is due to SixXS [ sunsetting](https://www.sixxs.net/main/) its IPv6 tunnel. @@ -216,9 +216,9 @@ When upgrading from a previous release, please be aware of the following incompa - Top-level `idea` package collection was renamed. All JetBrains IDEs are now at `jetbrains`. -- `flexget`\'s state database cannot be upgraded to its new internal format, requiring removal of any existing `db-config.sqlite` which will be automatically recreated. +- `flexget`'s state database cannot be upgraded to its new internal format, requiring removal of any existing `db-config.sqlite` which will be automatically recreated. -- The `ipfs` service now doesn\'t ignore the `dataDir` option anymore. If you\'ve ever set this option to anything other than the default you\'ll have to either unset it (so the default gets used) or migrate the old data manually with +- The `ipfs` service now doesn't ignore the `dataDir` option anymore. If you've ever set this option to anything other than the default you'll have to either unset it (so the default gets used) or migrate the old data manually with ```ShellSession dataDir=<valueOfDataDir> @@ -236,15 +236,15 @@ When upgrading from a previous release, please be aware of the following incompa - `wvdial` package and module were removed. This is due to the project being dead and not building with openssl 1.1. -- `cc-wrapper`\'s setup-hook now exports a number of environment variables corresponding to binutils binaries, (e.g. `LD`, `STRIP`, `RANLIB`, etc). This is done to prevent packages\' build systems guessing, which is harder to predict, especially when cross-compiling. However, some packages have broken due to this---their build systems either not supporting, or claiming to support without adequate testing, taking such environment variables as parameters. +- `cc-wrapper`'s setup-hook now exports a number of environment variables corresponding to binutils binaries, (e.g. `LD`, `STRIP`, `RANLIB`, etc). This is done to prevent packages' build systems guessing, which is harder to predict, especially when cross-compiling. However, some packages have broken due to this---their build systems either not supporting, or claiming to support without adequate testing, taking such environment variables as parameters. -- `services.firefox.syncserver` now runs by default as a non-root user. To accomodate this change, the default sqlite database location has also been changed. Migration should work automatically. Refer to the description of the options for more details. +- `services.firefox.syncserver` now runs by default as a non-root user. To accommodate this change, the default sqlite database location has also been changed. Migration should work automatically. Refer to the description of the options for more details. - The `compiz` window manager and package was removed. The system support had been broken for several years. - Touchpad support should now be enabled through `libinput` as `synaptics` is now deprecated. See the option `services.xserver.libinput.enable`. -- grsecurity/PaX support has been dropped, following upstream\'s decision to cease free support. See [ upstream\'s announcement](https://grsecurity.net/passing_the_baton.php) for more information. No complete replacement for grsecurity/PaX is available presently. +- grsecurity/PaX support has been dropped, following upstream's decision to cease free support. See [ upstream's announcement](https://grsecurity.net/passing_the_baton.php) for more information. No complete replacement for grsecurity/PaX is available presently. - `services.mysql` now has declarative configuration of databases and users with the `ensureDatabases` and `ensureUsers` options. @@ -283,9 +283,9 @@ When upgrading from a previous release, please be aware of the following incompa ## Other Notable Changes {#sec-release-17.09-notable-changes} -- Modules can now be disabled by using [ disabledModules](https://nixos.org/nixpkgs/manual/#sec-replace-modules), allowing another to take it\'s place. This can be used to import a set of modules from another channel while keeping the rest of the system on a stable release. +- Modules can now be disabled by using [ disabledModules](https://nixos.org/nixpkgs/manual/#sec-replace-modules), allowing another to take it's place. This can be used to import a set of modules from another channel while keeping the rest of the system on a stable release. -- Updated to FreeType 2.7.1, including a new TrueType engine. The new engine replaces the Infinality engine which was the default in NixOS. The default font rendering settings are now provided by fontconfig-penultimate, replacing fontconfig-ultimate; the new defaults are less invasive and provide rendering that is more consistent with other systems and hopefully with each font designer\'s intent. Some system-wide configuration has been removed from the Fontconfig NixOS module where user Fontconfig settings are available. +- Updated to FreeType 2.7.1, including a new TrueType engine. The new engine replaces the Infinality engine which was the default in NixOS. The default font rendering settings are now provided by fontconfig-penultimate, replacing fontconfig-ultimate; the new defaults are less invasive and provide rendering that is more consistent with other systems and hopefully with each font designer's intent. Some system-wide configuration has been removed from the Fontconfig NixOS module where user Fontconfig settings are available. - ZFS/SPL have been updated to 0.7.0, `zfsUnstable, splUnstable` have therefore been removed. diff --git a/nixos/doc/manual/release-notes/rl-1803.section.md b/nixos/doc/manual/release-notes/rl-1803.section.md index c5146015d449..681894eb13ec 100644 --- a/nixos/doc/manual/release-notes/rl-1803.section.md +++ b/nixos/doc/manual/release-notes/rl-1803.section.md @@ -6,7 +6,7 @@ In addition to numerous new and upgraded packages, this release has the followin - End of support is planned for end of October 2018, handing over to 18.09. -- Platform support: x86_64-linux and x86_64-darwin since release time (the latter isn\'t NixOS, really). Binaries for aarch64-linux are available, but no channel exists yet, as it\'s waiting for some test fixes, etc. +- Platform support: x86_64-linux and x86_64-darwin since release time (the latter isn't NixOS, really). Binaries for aarch64-linux are available, but no channel exists yet, as it's waiting for some test fixes, etc. - Nix now defaults to 2.0; see its [release notes](https://nixos.org/nix/manual/#ssec-relnotes-2.0). @@ -176,7 +176,7 @@ When upgrading from a previous release, please be aware of the following incompa - `cc-wrapper` has been split in two; there is now also a `bintools-wrapper`. The most commonly used files in `nix-support` are now split between the two wrappers. Some commonly used ones, like `nix-support/dynamic-linker`, are duplicated for backwards compatability, even though they rightly belong only in `bintools-wrapper`. Other more obscure ones are just moved. -- The propagation logic has been changed. The new logic, along with new types of dependencies that go with, is thoroughly documented in the \"Specifying dependencies\" section of the \"Standard Environment\" chapter of the nixpkgs manual. The old logic isn\'t but is easy to describe: dependencies were propagated as the same type of dependency no matter what. In practice, that means that many `propagatedNativeBuildInputs` should instead be `propagatedBuildInputs`. Thankfully, that was and is the least used type of dependency. Also, it means that some `propagatedBuildInputs` should instead be `depsTargetTargetPropagated`. Other types dependencies should be unaffected. +- The propagation logic has been changed. The new logic, along with new types of dependencies that go with, is thoroughly documented in the "Specifying dependencies" section of the "Standard Environment" chapter of the nixpkgs manual. The old logic isn't but is easy to describe: dependencies were propagated as the same type of dependency no matter what. In practice, that means that many `propagatedNativeBuildInputs` should instead be `propagatedBuildInputs`. Thankfully, that was and is the least used type of dependency. Also, it means that some `propagatedBuildInputs` should instead be `depsTargetTargetPropagated`. Other types dependencies should be unaffected. - `lib.addPassthru drv passthru` is removed. Use `lib.extendDerivation true passthru drv` instead. @@ -184,7 +184,7 @@ When upgrading from a previous release, please be aware of the following incompa - The `hardware.amdHybridGraphics.disable` option was removed for lack of a maintainer. If you still need this module, you may wish to include a copy of it from an older version of nixos in your imports. -- The merging of config options for `services.postfix.config` was buggy. Previously, if other options in the Postfix module like `services.postfix.useSrs` were set and the user set config options that were also set by such options, the resulting config wouldn\'t include all options that were needed. They are now merged correctly. If config options need to be overridden, `lib.mkForce` or `lib.mkOverride` can be used. +- The merging of config options for `services.postfix.config` was buggy. Previously, if other options in the Postfix module like `services.postfix.useSrs` were set and the user set config options that were also set by such options, the resulting config wouldn't include all options that were needed. They are now merged correctly. If config options need to be overridden, `lib.mkForce` or `lib.mkOverride` can be used. - The following changes apply if the `stateVersion` is changed to 18.03 or higher. For `stateVersion = "17.09"` or lower the old behavior is preserved. @@ -204,7 +204,7 @@ When upgrading from a previous release, please be aware of the following incompa - The data directory `/var/lib/piwik` was renamed to `/var/lib/matomo`. All files will be moved automatically on first startup, but you might need to adjust your backup scripts. - - The default `serverName` for the nginx configuration changed from `piwik.${config.networking.hostName}` to `matomo.${config.networking.hostName}.${config.networking.domain}` if `config.networking.domain` is set, `matomo.${config.networking.hostName}` if it is not set. If you change your `serverName`, remember you\'ll need to update the `trustedHosts[]` array in `/var/lib/matomo/config/config.ini.php` as well. + - The default `serverName` for the nginx configuration changed from `piwik.${config.networking.hostName}` to `matomo.${config.networking.hostName}.${config.networking.domain}` if `config.networking.domain` is set, `matomo.${config.networking.hostName}` if it is not set. If you change your `serverName`, remember you'll need to update the `trustedHosts[]` array in `/var/lib/matomo/config/config.ini.php` as well. - The `piwik` user was renamed to `matomo`. The service will adjust ownership automatically for files in the data directory. If you use unix socket authentication, remember to give the new `matomo` user access to the database and to change the `username` to `matomo` in the `[database]` section of `/var/lib/matomo/config/config.ini.php`. @@ -250,7 +250,7 @@ When upgrading from a previous release, please be aware of the following incompa - The option `services.logstash.listenAddress` is now `127.0.0.1` by default. Previously the default behaviour was to listen on all interfaces. -- `services.btrfs.autoScrub` has been added, to periodically check btrfs filesystems for data corruption. If there\'s a correct copy available, it will automatically repair corrupted blocks. +- `services.btrfs.autoScrub` has been added, to periodically check btrfs filesystems for data corruption. If there's a correct copy available, it will automatically repair corrupted blocks. - `displayManager.lightdm.greeters.gtk.clock-format.` has been added, the clock format string (as expected by strftime, e.g. `%H:%M`) to use with the lightdm gtk greeter panel. diff --git a/nixos/doc/manual/release-notes/rl-1809.section.md b/nixos/doc/manual/release-notes/rl-1809.section.md index 3443db37c97e..71afc71d5a89 100644 --- a/nixos/doc/manual/release-notes/rl-1809.section.md +++ b/nixos/doc/manual/release-notes/rl-1809.section.md @@ -204,11 +204,11 @@ When upgrading from a previous release, please be aware of the following incompa - The `clementine` package points now to the free derivation. `clementineFree` is removed now and `clementineUnfree` points to the package which is bundled with the unfree `libspotify` package. -- The `netcat` package is now taken directly from OpenBSD\'s `libressl`, instead of relying on Debian\'s fork. The new version should be very close to the old version, but there are some minor differences. Importantly, flags like -b, -q, -C, and -Z are no longer accepted by the nc command. +- The `netcat` package is now taken directly from OpenBSD's `libressl`, instead of relying on Debian's fork. The new version should be very close to the old version, but there are some minor differences. Importantly, flags like -b, -q, -C, and -Z are no longer accepted by the nc command. -- The `services.docker-registry.extraConfig` object doesn\'t contain environment variables anymore. Instead it needs to provide an object structure that can be mapped onto the YAML configuration defined in [the `docker/distribution` docs](https://github.com/docker/distribution/blob/v2.6.2/docs/configuration.md). +- The `services.docker-registry.extraConfig` object doesn't contain environment variables anymore. Instead it needs to provide an object structure that can be mapped onto the YAML configuration defined in [the `docker/distribution` docs](https://github.com/docker/distribution/blob/v2.6.2/docs/configuration.md). -- `gnucash` has changed from version 2.4 to 3.x. If you\'ve been using `gnucash` (version 2.4) instead of `gnucash26` (version 2.6) you must open your Gnucash data file(s) with `gnucash26` and then save them to upgrade the file format. Then you may use your data file(s) with Gnucash 3.x. See the upgrade [documentation](https://wiki.gnucash.org/wiki/FAQ#Using_Different_Versions.2C_Up_And_Downgrade). Gnucash 2.4 is still available under the attribute `gnucash24`. +- `gnucash` has changed from version 2.4 to 3.x. If you've been using `gnucash` (version 2.4) instead of `gnucash26` (version 2.6) you must open your Gnucash data file(s) with `gnucash26` and then save them to upgrade the file format. Then you may use your data file(s) with Gnucash 3.x. See the upgrade [documentation](https://wiki.gnucash.org/wiki/FAQ#Using_Different_Versions.2C_Up_And_Downgrade). Gnucash 2.4 is still available under the attribute `gnucash24`. - `services.munge` now runs as user (and group) `munge` instead of root. Make sure the key file is accessible to the daemon. @@ -315,7 +315,7 @@ When upgrading from a previous release, please be aware of the following incompa - The Kubernetes Dashboard now has only minimal RBAC permissions by default. If dashboard cluster-admin rights are desired, set `services.kubernetes.addons.dashboard.rbac.clusterAdmin` to true. On existing clusters, in order for the revocation of privileges to take effect, the current ClusterRoleBinding for kubernetes-dashboard must be manually removed: `kubectl delete clusterrolebinding kubernetes-dashboard` -- The `programs.screen` module provides allows to configure `/etc/screenrc`, however the module behaved fairly counterintuitive as the config exists, but the package wasn\'t available. Since 18.09 `pkgs.screen` will be added to `environment.systemPackages`. +- The `programs.screen` module provides allows to configure `/etc/screenrc`, however the module behaved fairly counterintuitive as the config exists, but the package wasn't available. Since 18.09 `pkgs.screen` will be added to `environment.systemPackages`. - The module `services.networking.hostapd` now uses WPA2 by default. @@ -327,6 +327,6 @@ When upgrading from a previous release, please be aware of the following incompa - The default display manager is now LightDM. To use SLiM set `services.xserver.displayManager.slim.enable` to `true`. -- NixOS option descriptions are now automatically broken up into individual paragraphs if the text contains two consecutive newlines, so it\'s no longer necessary to use `</para><para>` to start a new paragraph. +- NixOS option descriptions are now automatically broken up into individual paragraphs if the text contains two consecutive newlines, so it's no longer necessary to use `</para><para>` to start a new paragraph. - Top-level `buildPlatform`, `hostPlatform`, and `targetPlatform` in Nixpkgs are deprecated. Please use their equivalents in `stdenv` instead: `stdenv.buildPlatform`, `stdenv.hostPlatform`, and `stdenv.targetPlatform`. diff --git a/nixos/doc/manual/release-notes/rl-1903.section.md b/nixos/doc/manual/release-notes/rl-1903.section.md index 7637a70c1bf8..b43518c471fd 100644 --- a/nixos/doc/manual/release-notes/rl-1903.section.md +++ b/nixos/doc/manual/release-notes/rl-1903.section.md @@ -11,11 +11,11 @@ In addition to numerous new and upgraded packages, this release has the followin - Added the Pantheon desktop environment. It can be enabled through `services.xserver.desktopManager.pantheon.enable`. ::: {.note} - By default, `services.xserver.desktopManager.pantheon` enables LightDM as a display manager, as pantheon\'s screen locking implementation relies on it. - Because of that it is recommended to leave LightDM enabled. If you\'d like to disable it anyway, set `services.xserver.displayManager.lightdm.enable` to `false` and enable your preferred display manager. + By default, `services.xserver.desktopManager.pantheon` enables LightDM as a display manager, as pantheon's screen locking implementation relies on it. + Because of that it is recommended to leave LightDM enabled. If you'd like to disable it anyway, set `services.xserver.displayManager.lightdm.enable` to `false` and enable your preferred display manager. ::: - Also note that Pantheon\'s LightDM greeter is not enabled by default, because it has numerous issues in NixOS and isn\'t optimal for use here yet. + Also note that Pantheon's LightDM greeter is not enabled by default, because it has numerous issues in NixOS and isn't optimal for use here yet. - A major refactoring of the Kubernetes module has been completed. Refactorings primarily focus on decoupling components and enhancing security. Two-way TLS and RBAC has been enabled by default for all components, which slightly changes the way the module is configured. See: [](#sec-kubernetes) for details. @@ -57,7 +57,7 @@ When upgrading from a previous release, please be aware of the following incompa - The Syncthing state and configuration data has been moved from `services.syncthing.dataDir` to the newly defined `services.syncthing.configDir`, which default to `/var/lib/syncthing/.config/syncthing`. This change makes possible to share synced directories using ACLs without Syncthing resetting the permission on every start. -- The `ntp` module now has sane default restrictions. If you\'re relying on the previous defaults, which permitted all queries and commands from all firewall-permitted sources, you can set `services.ntp.restrictDefault` and `services.ntp.restrictSource` to `[]`. +- The `ntp` module now has sane default restrictions. If you're relying on the previous defaults, which permitted all queries and commands from all firewall-permitted sources, you can set `services.ntp.restrictDefault` and `services.ntp.restrictSource` to `[]`. - Package `rabbitmq_server` is renamed to `rabbitmq-server`. @@ -73,7 +73,7 @@ When upgrading from a previous release, please be aware of the following incompa - OpenSMTPD has been upgraded to version 6.4.0p1. This release makes backwards-incompatible changes to the configuration file format. See `man smtpd.conf` for more information on the new file format. -- The versioned `postgresql` have been renamed to use underscore number seperators. For example, `postgresql96` has been renamed to `postgresql_9_6`. +- The versioned `postgresql` have been renamed to use underscore number separators. For example, `postgresql96` has been renamed to `postgresql_9_6`. - Package `consul-ui` and passthrough `consul.ui` have been removed. The package `consul` now uses upstream releases that vendor the UI into the binary. See [\#48714](https://github.com/NixOS/nixpkgs/pull/48714#issuecomment-433454834) for details. @@ -89,9 +89,9 @@ When upgrading from a previous release, please be aware of the following incompa - The option `services.xserver.displayManager.job.logToFile` which was previously set to `true` when using the display managers `lightdm`, `sddm` or `xpra` has been reset to the default value (`false`). -- Network interface indiscriminate NixOS firewall options (`networking.firewall.allow*`) are now preserved when also setting interface specific rules such as `networking.firewall.interfaces.en0.allow*`. These rules continue to use the pseudo device \"default\" (`networking.firewall.interfaces.default.*`), and assigning to this pseudo device will override the (`networking.firewall.allow*`) options. +- Network interface indiscriminate NixOS firewall options (`networking.firewall.allow*`) are now preserved when also setting interface specific rules such as `networking.firewall.interfaces.en0.allow*`. These rules continue to use the pseudo device "default" (`networking.firewall.interfaces.default.*`), and assigning to this pseudo device will override the (`networking.firewall.allow*`) options. -- The `nscd` service now disables all caching of `passwd` and `group` databases by default. This was interferring with the correct functioning of the `libnss_systemd.so` module which is used by `systemd` to manage uids and usernames in the presence of `DynamicUser=` in systemd services. This was already the default behaviour in presence of `services.sssd.enable = true` because nscd caching would interfere with `sssd` in unpredictable ways as well. Because we\'re using nscd not for caching, but for convincing glibc to find NSS modules in the nix store instead of an absolute path, we have decided to disable caching globally now, as it\'s usually not the behaviour the user wants and can lead to surprising behaviour. Furthermore, negative caching of host lookups is also disabled now by default. This should fix the issue of dns lookups failing in the presence of an unreliable network. +- The `nscd` service now disables all caching of `passwd` and `group` databases by default. This was interferring with the correct functioning of the `libnss_systemd.so` module which is used by `systemd` to manage uids and usernames in the presence of `DynamicUser=` in systemd services. This was already the default behaviour in presence of `services.sssd.enable = true` because nscd caching would interfere with `sssd` in unpredictable ways as well. Because we're using nscd not for caching, but for convincing glibc to find NSS modules in the nix store instead of an absolute path, we have decided to disable caching globally now, as it's usually not the behaviour the user wants and can lead to surprising behaviour. Furthermore, negative caching of host lookups is also disabled now by default. This should fix the issue of dns lookups failing in the presence of an unreliable network. If the old behaviour is desired, this can be restored by setting the `services.nscd.config` option with the desired caching parameters. @@ -137,7 +137,7 @@ When upgrading from a previous release, please be aware of the following incompa - The `pam_unix` account module is now loaded with its control field set to `required` instead of `sufficient`, so that later PAM account modules that might do more extensive checks are being executed. Previously, the whole account module verification was exited prematurely in case a nss module provided the account name to `pam_unix`. The LDAP and SSSD NixOS modules already add their NSS modules when enabled. In case your setup breaks due to some later PAM account module previosuly shadowed, or failing NSS lookups, please file a bug. You can get back the old behaviour by manually setting `security.pam.services.<name?>.text`. -- The `pam_unix` password module is now loaded with its control field set to `sufficient` instead of `required`, so that password managed only by later PAM password modules are being executed. Previously, for example, changing an LDAP account\'s password through PAM was not possible: the whole password module verification was exited prematurely by `pam_unix`, preventing `pam_ldap` to manage the password as it should. +- The `pam_unix` password module is now loaded with its control field set to `sufficient` instead of `required`, so that password managed only by later PAM password modules are being executed. Previously, for example, changing an LDAP account's password through PAM was not possible: the whole password module verification was exited prematurely by `pam_unix`, preventing `pam_ldap` to manage the password as it should. - `fish` has been upgraded to 3.0. It comes with a number of improvements and backwards incompatible changes. See the `fish` [release notes](https://github.com/fish-shell/fish-shell/releases/tag/3.0.0) for more information. @@ -145,7 +145,7 @@ When upgrading from a previous release, please be aware of the following incompa - NixOS module system type `types.optionSet` and `lib.mkOption` argument `options` are deprecated. Use `types.submodule` instead. ([\#54637](https://github.com/NixOS/nixpkgs/pull/54637)) -- `matrix-synapse` has been updated to version 0.99. It will [no longer generate a self-signed certificate on first launch](https://github.com/matrix-org/synapse/pull/4509) and will be [the last version to accept self-signed certificates](https://matrix.org/blog/2019/02/05/synapse-0-99-0/). As such, it is now recommended to use a proper certificate verified by a root CA (for example Let\'s Encrypt). The new [manual chapter on Matrix](#module-services-matrix) contains a working example of using nginx as a reverse proxy in front of `matrix-synapse`, using Let\'s Encrypt certificates. +- `matrix-synapse` has been updated to version 0.99. It will [no longer generate a self-signed certificate on first launch](https://github.com/matrix-org/synapse/pull/4509) and will be [the last version to accept self-signed certificates](https://matrix.org/blog/2019/02/05/synapse-0-99-0/). As such, it is now recommended to use a proper certificate verified by a root CA (for example Let's Encrypt). The new [manual chapter on Matrix](#module-services-matrix) contains a working example of using nginx as a reverse proxy in front of `matrix-synapse`, using Let's Encrypt certificates. - `mailutils` now works by default when `sendmail` is not in a setuid wrapper. As a consequence, the `sendmailPath` argument, having lost its main use, has been removed. @@ -191,7 +191,7 @@ When upgrading from a previous release, please be aware of the following incompa With this change application specific volumes are relative to the master volume which can be adjusted independently, whereas before they were absolute; meaning that in effect, it scaled the device-volume with the volume of the loudest application. ::: -- The [`ndppd`](https://github.com/DanielAdolfsson/ndppd) module now supports [all config options](options.html#opt-services.ndppd.enable) provided by the current upstream version as service options. Additionally the `ndppd` package doesn\'t contain the systemd unit configuration from upstream anymore, the unit is completely configured by the NixOS module now. +- The [`ndppd`](https://github.com/DanielAdolfsson/ndppd) module now supports [all config options](options.html#opt-services.ndppd.enable) provided by the current upstream version as service options. Additionally the `ndppd` package doesn't contain the systemd unit configuration from upstream anymore, the unit is completely configured by the NixOS module now. - New installs of NixOS will default to the Redmine 4.x series unless otherwise specified in `services.redmine.package` while existing installs of NixOS will default to the Redmine 3.x series. diff --git a/nixos/doc/manual/release-notes/rl-1909.section.md b/nixos/doc/manual/release-notes/rl-1909.section.md index 572f1bf5a255..428352388193 100644 --- a/nixos/doc/manual/release-notes/rl-1909.section.md +++ b/nixos/doc/manual/release-notes/rl-1909.section.md @@ -34,7 +34,7 @@ In addition to numerous new and upgraded packages, this release has the followin - The installer now uses a less privileged `nixos` user whereas before we logged in as root. To gain root privileges use `sudo -i` without a password. -- We\'ve updated to Xfce 4.14, which brings a new module `services.xserver.desktopManager.xfce4-14`. If you\'d like to upgrade, please switch from the `services.xserver.desktopManager.xfce` module as it will be deprecated in a future release. They\'re incompatibilities with the current Xfce module; it doesn\'t support `thunarPlugins` and it isn\'t recommended to use `services.xserver.desktopManager.xfce` and `services.xserver.desktopManager.xfce4-14` simultaneously or to downgrade from Xfce 4.14 after upgrading. +- We've updated to Xfce 4.14, which brings a new module `services.xserver.desktopManager.xfce4-14`. If you'd like to upgrade, please switch from the `services.xserver.desktopManager.xfce` module as it will be deprecated in a future release. They're incompatibilities with the current Xfce module; it doesn't support `thunarPlugins` and it isn't recommended to use `services.xserver.desktopManager.xfce` and `services.xserver.desktopManager.xfce4-14` simultaneously or to downgrade from Xfce 4.14 after upgrading. - The GNOME 3 desktop manager module sports an interface to enable/disable core services, applications, and optional GNOME packages like games. @@ -46,9 +46,9 @@ In addition to numerous new and upgraded packages, this release has the followin - `services.gnome3.games.enable` - With these options we hope to give users finer grained control over their systems. Prior to this change you\'d either have to manually disable options or use `environment.gnome3.excludePackages` which only excluded the optional applications. `environment.gnome3.excludePackages` is now unguarded, it can exclude any package installed with `environment.systemPackages` in the GNOME 3 module. + With these options we hope to give users finer grained control over their systems. Prior to this change you'd either have to manually disable options or use `environment.gnome3.excludePackages` which only excluded the optional applications. `environment.gnome3.excludePackages` is now unguarded, it can exclude any package installed with `environment.systemPackages` in the GNOME 3 module. -- Orthogonal to the previous changes to the GNOME 3 desktop manager module, we\'ve updated all default services and applications to match as close as possible to a default reference GNOME 3 experience. +- Orthogonal to the previous changes to the GNOME 3 desktop manager module, we've updated all default services and applications to match as close as possible to a default reference GNOME 3 experience. **The following changes were enacted in `services.gnome3.core-utilities.enable`** @@ -104,7 +104,7 @@ The following new services were added since the last release: - `services.xserver.desktopManager.pantheon` - - `services.xserver.desktopManager.mate` Note Mate uses `programs.system-config-printer` as it doesn\'t use it as a service, but its graphical interface directly. + - `services.xserver.desktopManager.mate` Note Mate uses `programs.system-config-printer` as it doesn't use it as a service, but its graphical interface directly. - [services.blueman.enable](options.html#opt-services.blueman.enable) has been added. If you previously had blueman installed via `environment.systemPackages` please migrate to using the NixOS module, as this would result in an insufficiently configured blueman. @@ -118,11 +118,11 @@ When upgrading from a previous release, please be aware of the following incompa - PostgreSQL 9.4 is scheduled EOL during the 19.09 life cycle and has been removed. -- The options `services.prometheus.alertmanager.user` and `services.prometheus.alertmanager.group` have been removed because the alertmanager service is now using systemd\'s [ DynamicUser mechanism](http://0pointer.net/blog/dynamic-users-with-systemd.html) which obviates these options. +- The options `services.prometheus.alertmanager.user` and `services.prometheus.alertmanager.group` have been removed because the alertmanager service is now using systemd's [ DynamicUser mechanism](http://0pointer.net/blog/dynamic-users-with-systemd.html) which obviates these options. - The NetworkManager systemd unit was renamed back from network-manager.service to NetworkManager.service for better compatibility with other applications expecting this name. The same applies to ModemManager where modem-manager.service is now called ModemManager.service again. -- The `services.nzbget.configFile` and `services.nzbget.openFirewall` options were removed as they are managed internally by the nzbget. The `services.nzbget.dataDir` option hadn\'t actually been used by the module for some time and so was removed as cleanup. +- The `services.nzbget.configFile` and `services.nzbget.openFirewall` options were removed as they are managed internally by the nzbget. The `services.nzbget.dataDir` option hadn't actually been used by the module for some time and so was removed as cleanup. - The `services.mysql.pidDir` option was removed, as it was only used by the wordpress apache-httpd service to wait for mysql to have started up. This can be accomplished by either describing a dependency on mysql.service (preferred) or waiting for the (hardcoded) `/run/mysqld/mysql.sock` file to appear. @@ -148,19 +148,19 @@ When upgrading from a previous release, please be aware of the following incompa A new knob named `nixops.enableDeprecatedAutoLuks` has been introduced to disable the eval failure and to acknowledge the notice was received and read. If you plan on using the feature please note that it might break with subsequent updates. - Make sure you set the `_netdev` option for each of the file systems referring to block devices provided by the autoLuks module. Not doing this might render the system in a state where it doesn\'t boot anymore. + Make sure you set the `_netdev` option for each of the file systems referring to block devices provided by the autoLuks module. Not doing this might render the system in a state where it doesn't boot anymore. If you are actively using the `autoLuks` module please let us know in [issue \#62211](https://github.com/NixOS/nixpkgs/issues/62211). - The setopt declarations will be evaluated at the end of `/etc/zshrc`, so any code in [programs.zsh.interactiveShellInit](options.html#opt-programs.zsh.interactiveShellInit), [programs.zsh.loginShellInit](options.html#opt-programs.zsh.loginShellInit) and [programs.zsh.promptInit](options.html#opt-programs.zsh.promptInit) may break if it relies on those options being set. -- The `prometheus-nginx-exporter` package now uses the offical exporter provided by NGINX Inc. Its metrics are differently structured and are incompatible to the old ones. For information about the metrics, have a look at the [official repo](https://github.com/nginxinc/nginx-prometheus-exporter). +- The `prometheus-nginx-exporter` package now uses the official exporter provided by NGINX Inc. Its metrics are differently structured and are incompatible to the old ones. For information about the metrics, have a look at the [official repo](https://github.com/nginxinc/nginx-prometheus-exporter). - The `shibboleth-sp` package has been updated to version 3. It is largely backward compatible, for further information refer to the [release notes](https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes) and [upgrade guide](https://wiki.shibboleth.net/confluence/display/SP3/UpgradingFromV2). Nodejs 8 is scheduled EOL under the lifetime of 19.09 and has been dropped. -- By default, prometheus exporters are now run with `DynamicUser` enabled. Exporters that need a real user, now run under a seperate user and group which follow the pattern `<exporter-name>-exporter`, instead of the previous default `nobody` and `nogroup`. Only some exporters are affected by the latter, namely the exporters `dovecot`, `node`, `postfix` and `varnish`. +- By default, prometheus exporters are now run with `DynamicUser` enabled. Exporters that need a real user, now run under a separate user and group which follow the pattern `<exporter-name>-exporter`, instead of the previous default `nobody` and `nogroup`. Only some exporters are affected by the latter, namely the exporters `dovecot`, `node`, `postfix` and `varnish`. - The `ibus-qt` package is not installed by default anymore when [i18n.inputMethod.enabled](options.html#opt-i18n.inputMethod.enabled) is set to `ibus`. If IBus support in Qt 4.x applications is required, add the `ibus-qt` package to your [environment.systemPackages](options.html#opt-environment.systemPackages) manually. @@ -196,13 +196,13 @@ When upgrading from a previous release, please be aware of the following incompa Furthermore, the acme module will not automatically add a dependency on `lighttpd.service` anymore. If you are using certficates provided by letsencrypt for lighttpd, then you should depend on the certificate service `acme-${cert}.service>` manually. - For nginx, the dependencies are still automatically managed when `services.nginx.virtualhosts.<name>.enableACME` is enabled just like before. What changed is that nginx now directly depends on the specific certificates that it needs, instead of depending on the catch-all `acme-certificates.target`. This target unit was also removed from the codebase. This will mean nginx will no longer depend on certificates it isn\'t explicitly managing and fixes a bug with certificate renewal ordering racing with nginx restarting which could lead to nginx getting in a broken state as described at [NixOS/nixpkgs\#60180](https://github.com/NixOS/nixpkgs/issues/60180). + For nginx, the dependencies are still automatically managed when `services.nginx.virtualhosts.<name>.enableACME` is enabled just like before. What changed is that nginx now directly depends on the specific certificates that it needs, instead of depending on the catch-all `acme-certificates.target`. This target unit was also removed from the codebase. This will mean nginx will no longer depend on certificates it isn't explicitly managing and fixes a bug with certificate renewal ordering racing with nginx restarting which could lead to nginx getting in a broken state as described at [NixOS/nixpkgs\#60180](https://github.com/NixOS/nixpkgs/issues/60180). - The old deprecated `emacs` package sets have been dropped. What used to be called `emacsPackagesNg` is now simply called `emacsPackages`. -- `services.xserver.desktopManager.xterm` is now disabled by default if `stateVersion` is 19.09 or higher. Previously the xterm desktopManager was enabled when xserver was enabled, but it isn\'t useful for all people so it didn\'t make sense to have any desktopManager enabled default. +- `services.xserver.desktopManager.xterm` is now disabled by default if `stateVersion` is 19.09 or higher. Previously the xterm desktopManager was enabled when xserver was enabled, but it isn't useful for all people so it didn't make sense to have any desktopManager enabled default. -- The WeeChat plugin `pkgs.weechatScripts.weechat-xmpp` has been removed as it doesn\'t receive any updates from upstream and depends on outdated Python2-based modules. +- The WeeChat plugin `pkgs.weechatScripts.weechat-xmpp` has been removed as it doesn't receive any updates from upstream and depends on outdated Python2-based modules. - Old unsupported versions (`logstash5`, `kibana5`, `filebeat5`, `heartbeat5`, `metricbeat5`, `packetbeat5`) of the ELK-stack and Elastic beats have been removed. @@ -210,7 +210,7 @@ When upgrading from a previous release, please be aware of the following incompa - Citrix Receiver (`citrix_receiver`) has been dropped in favor of Citrix Workspace (`citrix_workspace`). -- The `services.gitlab` module has had its literal secret options (`services.gitlab.smtp.password`, `services.gitlab.databasePassword`, `services.gitlab.initialRootPassword`, `services.gitlab.secrets.secret`, `services.gitlab.secrets.db`, `services.gitlab.secrets.otp` and `services.gitlab.secrets.jws`) replaced by file-based versions (`services.gitlab.smtp.passwordFile`, `services.gitlab.databasePasswordFile`, `services.gitlab.initialRootPasswordFile`, `services.gitlab.secrets.secretFile`, `services.gitlab.secrets.dbFile`, `services.gitlab.secrets.otpFile` and `services.gitlab.secrets.jwsFile`). This was done so that secrets aren\'t stored in the world-readable nix store, but means that for each option you\'ll have to create a file with the same exact string, add \"File\" to the end of the option name, and change the definition to a string pointing to the corresponding file; e.g. `services.gitlab.databasePassword = "supersecurepassword"` becomes `services.gitlab.databasePasswordFile = "/path/to/secret_file"` where the file `secret_file` contains the string `supersecurepassword`. +- The `services.gitlab` module has had its literal secret options (`services.gitlab.smtp.password`, `services.gitlab.databasePassword`, `services.gitlab.initialRootPassword`, `services.gitlab.secrets.secret`, `services.gitlab.secrets.db`, `services.gitlab.secrets.otp` and `services.gitlab.secrets.jws`) replaced by file-based versions (`services.gitlab.smtp.passwordFile`, `services.gitlab.databasePasswordFile`, `services.gitlab.initialRootPasswordFile`, `services.gitlab.secrets.secretFile`, `services.gitlab.secrets.dbFile`, `services.gitlab.secrets.otpFile` and `services.gitlab.secrets.jwsFile`). This was done so that secrets aren't stored in the world-readable nix store, but means that for each option you'll have to create a file with the same exact string, add "File" to the end of the option name, and change the definition to a string pointing to the corresponding file; e.g. `services.gitlab.databasePassword = "supersecurepassword"` becomes `services.gitlab.databasePasswordFile = "/path/to/secret_file"` where the file `secret_file` contains the string `supersecurepassword`. The state path (`services.gitlab.statePath`) now has the following restriction: no parent directory can be owned by any other user than `root` or the user specified in `services.gitlab.user`; i.e. if `services.gitlab.statePath` is set to `/var/lib/gitlab/state`, `gitlab` and all parent directories must be owned by either `root` or the user specified in `services.gitlab.user`. @@ -218,7 +218,7 @@ When upgrading from a previous release, please be aware of the following incompa - The Twitter client `corebird` has been dropped as [it is discontinued and does not work against the new Twitter API](https://www.patreon.com/posts/corebirds-future-18921328). Please use the fork `cawbird` instead which has been adapted to the API changes and is still maintained. -- The `nodejs-11_x` package has been removed as it\'s EOLed by upstream. +- The `nodejs-11_x` package has been removed as it's EOLed by upstream. - Because of the systemd upgrade, systemd-timesyncd will no longer work if `system.stateVersion` is not set correctly. When upgrading from NixOS 19.03, please make sure that `system.stateVersion` is set to `"19.03"`, or lower if the installation dates back to an earlier version of NixOS. @@ -252,7 +252,7 @@ When upgrading from a previous release, please be aware of the following incompa - The `consul` package was upgraded past version `1.5`, so its deprecated legacy UI is no longer available. -- The default resample-method for PulseAudio has been changed from the upstream default `speex-float-1` to `speex-float-5`. Be aware that low-powered ARM-based and MIPS-based boards will struggle with this so you\'ll need to set `hardware.pulseaudio.daemon.config.resample-method` back to `speex-float-1`. +- The default resample-method for PulseAudio has been changed from the upstream default `speex-float-1` to `speex-float-5`. Be aware that low-powered ARM-based and MIPS-based boards will struggle with this so you'll need to set `hardware.pulseaudio.daemon.config.resample-method` back to `speex-float-1`. - The `phabricator` package and associated `httpd.extraSubservice`, as well as the `phd` service have been removed from nixpkgs due to lack of maintainer. @@ -264,7 +264,7 @@ When upgrading from a previous release, please be aware of the following incompa - The `tomcat-connector` `httpd.extraSubservice` has been removed from nixpkgs. -- It\'s now possible to change configuration in [services.nextcloud](options.html#opt-services.nextcloud.enable) after the initial deploy since all config parameters are persisted in an additional config file generated by the module. Previously core configuration like database parameters were set using their imperative installer after creating `/var/lib/nextcloud`. +- It's now possible to change configuration in [services.nextcloud](options.html#opt-services.nextcloud.enable) after the initial deploy since all config parameters are persisted in an additional config file generated by the module. Previously core configuration like database parameters were set using their imperative installer after creating `/var/lib/nextcloud`. - There exists now `lib.forEach`, which is like `map`, but with arguments flipped. When mapping function body spans many lines (or has nested `map`s), it is often hard to follow which list is modified. @@ -308,6 +308,6 @@ When upgrading from a previous release, please be aware of the following incompa - The `altcoins` categorization of packages has been removed. You now access these packages at the top level, ie. `nix-shell -p dogecoin` instead of `nix-shell -p altcoins.dogecoin`, etc. -- Ceph has been upgraded to v14.2.1. See the [release notes](https://ceph.com/releases/v14-2-0-nautilus-released/) for details. The mgr dashboard as well as osds backed by loop-devices is no longer explicitly supported by the package and module. Note: There\'s been some issues with python-cherrypy, which is used by the dashboard and prometheus mgr modules (and possibly others), hence 0000-dont-check-cherrypy-version.patch. +- Ceph has been upgraded to v14.2.1. See the [release notes](https://ceph.com/releases/v14-2-0-nautilus-released/) for details. The mgr dashboard as well as osds backed by loop-devices is no longer explicitly supported by the package and module. Note: There's been some issues with python-cherrypy, which is used by the dashboard and prometheus mgr modules (and possibly others), hence 0000-dont-check-cherrypy-version.patch. - `pkgs.weechat` is now compiled against `pkgs.python3`. Weechat also recommends [to use Python3 in their docs.](https://weechat.org/scripts/python3/) diff --git a/nixos/doc/manual/release-notes/rl-2003.section.md b/nixos/doc/manual/release-notes/rl-2003.section.md index b92c7f6634c7..76cee8858e80 100644 --- a/nixos/doc/manual/release-notes/rl-2003.section.md +++ b/nixos/doc/manual/release-notes/rl-2003.section.md @@ -34,11 +34,11 @@ In addition to numerous new and upgraded packages, this release has the followin - Postgresql for NixOS service now defaults to v11. -- The graphical installer image starts the graphical session automatically. Before you\'d be greeted by a tty and asked to enter `systemctl start display-manager`. It is now possible to disable the display-manager from running by selecting the `Disable display-manager` quirk in the boot menu. +- The graphical installer image starts the graphical session automatically. Before you'd be greeted by a tty and asked to enter `systemctl start display-manager`. It is now possible to disable the display-manager from running by selecting the `Disable display-manager` quirk in the boot menu. - GNOME 3 has been upgraded to 3.34. Please take a look at their [Release Notes](https://help.gnome.org/misc/release-notes/3.34) for details. -- If you enable the Pantheon Desktop Manager via [services.xserver.desktopManager.pantheon.enable](options.html#opt-services.xserver.desktopManager.pantheon.enable), we now default to also use [ Pantheon\'s newly designed greeter ](https://blog.elementary.io/say-hello-to-the-new-greeter/). Contrary to NixOS\'s usual update policy, Pantheon will receive updates during the cycle of NixOS 20.03 when backwards compatible. +- If you enable the Pantheon Desktop Manager via [services.xserver.desktopManager.pantheon.enable](options.html#opt-services.xserver.desktopManager.pantheon.enable), we now default to also use [ Pantheon's newly designed greeter ](https://blog.elementary.io/say-hello-to-the-new-greeter/). Contrary to NixOS's usual update policy, Pantheon will receive updates during the cycle of NixOS 20.03 when backwards compatible. - By default zfs pools will now be trimmed on a weekly basis. Trimming is only done on supported devices (i.e. NVME or SSDs) and should improve throughput and lifetime of these devices. It is controlled by the `services.zfs.trim.enable` varname. The zfs scrub service (`services.zfs.autoScrub.enable`) and the zfs autosnapshot service (`services.zfs.autoSnapshot.enable`) are now only enabled if zfs is set in `config.boot.initrd.supportedFilesystems` or `config.boot.supportedFilesystems`. These lists will automatically contain zfs as soon as any zfs mountpoint is configured in `fileSystems`. @@ -77,7 +77,7 @@ The following new services were added since the last release: - The kubernetes kube-proxy now supports a new hostname configuration `services.kubernetes.proxy.hostname` which has to be set if the hostname of the node should be non default. -- UPower\'s configuration is now managed by NixOS and can be customized via `services.upower`. +- UPower's configuration is now managed by NixOS and can be customized via `services.upower`. - To use Geary you should enable [programs.geary.enable](options.html#opt-programs.geary.enable) instead of just adding it to [environment.systemPackages](options.html#opt-environment.systemPackages). It was created so Geary could function properly outside of GNOME. @@ -187,9 +187,9 @@ When upgrading from a previous release, please be aware of the following incompa - The `99-main.network` file was removed. Matching all network interfaces caused many breakages, see [\#18962](https://github.com/NixOS/nixpkgs/pull/18962) and [\#71106](https://github.com/NixOS/nixpkgs/pull/71106). - We already don\'t support the global [networking.useDHCP](options.html#opt-networking.useDHCP), [networking.defaultGateway](options.html#opt-networking.defaultGateway) and [networking.defaultGateway6](options.html#opt-networking.defaultGateway6) options if [networking.useNetworkd](options.html#opt-networking.useNetworkd) is enabled, but direct users to configure the per-device [networking.interfaces.\<name\>....](options.html#opt-networking.interfaces) options. + We already don't support the global [networking.useDHCP](options.html#opt-networking.useDHCP), [networking.defaultGateway](options.html#opt-networking.defaultGateway) and [networking.defaultGateway6](options.html#opt-networking.defaultGateway6) options if [networking.useNetworkd](options.html#opt-networking.useNetworkd) is enabled, but direct users to configure the per-device [networking.interfaces.\<name\>....](options.html#opt-networking.interfaces) options. -- The stdenv now runs all bash with `set -u`, to catch the use of undefined variables. Before, it itself used `set -u` but was careful to unset it so other packages\' code ran as before. Now, all bash code is held to the same high standard, and the rather complex stateful manipulation of the options can be discarded. +- The stdenv now runs all bash with `set -u`, to catch the use of undefined variables. Before, it itself used `set -u` but was careful to unset it so other packages' code ran as before. Now, all bash code is held to the same high standard, and the rather complex stateful manipulation of the options can be discarded. - The SLIM Display Manager has been removed, as it has been unmaintained since 2013. Consider migrating to a different display manager such as LightDM (current default in NixOS), SDDM, GDM, or using the startx module which uses Xinitrc. @@ -197,7 +197,7 @@ When upgrading from a previous release, please be aware of the following incompa - The BEAM package set has been deleted. You will only find there the different interpreters. You should now use the different build tools coming with the languages with sandbox mode disabled. -- There is now only one Xfce package-set and module. This means that attributes `xfce4-14` and `xfceUnstable` all now point to the latest Xfce 4.14 packages. And in the future NixOS releases will be the latest released version of Xfce available at the time of the release\'s development (if viable). +- There is now only one Xfce package-set and module. This means that attributes `xfce4-14` and `xfceUnstable` all now point to the latest Xfce 4.14 packages. And in the future NixOS releases will be the latest released version of Xfce available at the time of the release's development (if viable). - The [phpfpm](options.html#opt-services.phpfpm.pools) module now sets `PrivateTmp=true` in its systemd units for better process isolation. If you rely on `/tmp` being shared with other services, explicitly override this by setting `serviceConfig.PrivateTmp` to `false` for each phpfpm unit. @@ -221,7 +221,7 @@ When upgrading from a previous release, please be aware of the following incompa - The packages `openobex` and `obexftp` are no longer installed when enabling Bluetooth via `hardware.bluetooth.enable`. -- The `dump1090` derivation has been changed to use FlightAware\'s dump1090 as its upstream. However, this version does not have an internal webserver anymore. The assets in the `share/dump1090` directory of the derivation can be used in conjunction with an external webserver to replace this functionality. +- The `dump1090` derivation has been changed to use FlightAware's dump1090 as its upstream. However, this version does not have an internal webserver anymore. The assets in the `share/dump1090` directory of the derivation can be used in conjunction with an external webserver to replace this functionality. - The fourStore and fourStoreEndpoint modules have been removed. @@ -291,7 +291,7 @@ When upgrading from a previous release, please be aware of the following incompa - `services.buildkite-agent.meta-data` has been renamed to [services.buildkite-agents.\<name\>.tags](options.html#opt-services.buildkite-agents), to match upstreams naming for 3.x. Its type has also changed - it now accepts an attrset of strings. - - The`services.buildkite-agent.openssh.publicKeyPath` option has been removed, as it\'s not necessary to deploy public keys to clone private repositories. + - The`services.buildkite-agent.openssh.publicKeyPath` option has been removed, as it's not necessary to deploy public keys to clone private repositories. - `services.buildkite-agent.openssh.privateKeyPath` has been renamed to [buildkite-agents.\<name\>.privateSshKeyPath](options.html#opt-services.buildkite-agents), as the whole `openssh` now only contained that single option. @@ -301,7 +301,7 @@ When upgrading from a previous release, please be aware of the following incompa - The `gcc5` and `gfortran5` packages have been removed. -- The `services.xserver.displayManager.auto` module has been removed. It was only intended for use in internal NixOS tests, and gave the false impression of it being a special display manager when it\'s actually LightDM. Please use the `services.xserver.displayManager.lightdm.autoLogin` options instead, or any other display manager in NixOS as they all support auto-login. If you used this module specifically because it permitted root auto-login you can override the lightdm-autologin pam module like: +- The `services.xserver.displayManager.auto` module has been removed. It was only intended for use in internal NixOS tests, and gave the false impression of it being a special display manager when it's actually LightDM. Please use the `services.xserver.displayManager.lightdm.autoLogin` options instead, or any other display manager in NixOS as they all support auto-login. If you used this module specifically because it permitted root auto-login you can override the lightdm-autologin pam module like: ```nix { @@ -325,13 +325,13 @@ When upgrading from a previous release, please be aware of the following incompa auth required pam_succeed_if.so quiet ``` - line, where default it\'s: + line, where default it's: ``` auth required pam_succeed_if.so uid >= 1000 quiet ``` - not permitting users with uid\'s below 1000 (like root). All other display managers in NixOS are configured like this. + not permitting users with uid's below 1000 (like root). All other display managers in NixOS are configured like this. - There have been lots of improvements to the Mailman module. As a result, @@ -357,9 +357,9 @@ When upgrading from a previous release, please be aware of the following incompa - Rspamd was updated to version 2.2. Read [ the upstream migration notes](https://rspamd.com/doc/migration.html#migration-to-rspamd-20) carefully. Please be especially aware that some modules were removed and the default Bayes backend is now Redis. -- The `*psu` versions of oraclejdk8 have been removed as they aren\'t provided by upstream anymore. +- The `*psu` versions of oraclejdk8 have been removed as they aren't provided by upstream anymore. -- The `services.dnscrypt-proxy` module has been removed as it used the deprecated version of dnscrypt-proxy. We\'ve added [services.dnscrypt-proxy2.enable](options.html#opt-services.dnscrypt-proxy2.enable) to use the supported version. This module supports configuration via the Nix attribute set [services.dnscrypt-proxy2.settings](options.html#opt-services.dnscrypt-proxy2.settings), or by passing a TOML configuration file via [services.dnscrypt-proxy2.configFile](options.html#opt-services.dnscrypt-proxy2.configFile). +- The `services.dnscrypt-proxy` module has been removed as it used the deprecated version of dnscrypt-proxy. We've added [services.dnscrypt-proxy2.enable](options.html#opt-services.dnscrypt-proxy2.enable) to use the supported version. This module supports configuration via the Nix attribute set [services.dnscrypt-proxy2.settings](options.html#opt-services.dnscrypt-proxy2.settings), or by passing a TOML configuration file via [services.dnscrypt-proxy2.configFile](options.html#opt-services.dnscrypt-proxy2.configFile). ```nix { @@ -382,13 +382,13 @@ When upgrading from a previous release, please be aware of the following incompa - `qesteidutil` has been deprecated in favor of `qdigidoc`. -- sqldeveloper_18 has been removed as it\'s not maintained anymore, sqldeveloper has been updated to version `19.4`. Please note that this means that this means that the oraclejdk is now required. For further information please read the [release notes](https://www.oracle.com/technetwork/developer-tools/sql-developer/downloads/sqldev-relnotes-194-5908846.html). +- sqldeveloper_18 has been removed as it's not maintained anymore, sqldeveloper has been updated to version `19.4`. Please note that this means that this means that the oraclejdk is now required. For further information please read the [release notes](https://www.oracle.com/technetwork/developer-tools/sql-developer/downloads/sqldev-relnotes-194-5908846.html). -- Haskell `env` and `shellFor` dev shell environments now organize dependencies the same way as regular builds. In particular, rather than receiving all the different lists of dependencies mashed together as one big list, and then partitioning into Haskell and non-Hakell dependencies, they work from the original many different dependency parameters and don\'t need to algorithmically partition anything. +- Haskell `env` and `shellFor` dev shell environments now organize dependencies the same way as regular builds. In particular, rather than receiving all the different lists of dependencies mashed together as one big list, and then partitioning into Haskell and non-Hakell dependencies, they work from the original many different dependency parameters and don't need to algorithmically partition anything. This means that if you incorrectly categorize a dependency, e.g. non-Haskell library dependency as a `buildDepends` or run-time Haskell dependency as a `setupDepends`, whereas things would have worked before they may not work now. -- The gcc-snapshot-package has been removed. It\'s marked as broken for \>2 years and used to point to a fairly old snapshot from the gcc7-branch. +- The gcc-snapshot-package has been removed. It's marked as broken for \>2 years and used to point to a fairly old snapshot from the gcc7-branch. - The nixos-build-vms8 -script now uses the python test-driver. @@ -398,21 +398,21 @@ When upgrading from a previous release, please be aware of the following incompa - Stand-alone usage of `Upower` now requires `services.upower.enable` instead of just installing into [environment.systemPackages](options.html#opt-environment.systemPackages). -- nextcloud has been updated to `v18.0.2`. This means that users from NixOS 19.09 can\'t upgrade directly since you can only move one version forward and 19.09 uses `v16.0.8`. +- nextcloud has been updated to `v18.0.2`. This means that users from NixOS 19.09 can't upgrade directly since you can only move one version forward and 19.09 uses `v16.0.8`. To provide a safe upgrade-path and to circumvent similar issues in the future, the following measures were taken: - The pkgs.nextcloud-attribute has been removed and replaced with versioned attributes (currently pkgs.nextcloud17 and pkgs.nextcloud18). With this change major-releases can be backported without breaking stuff and to make upgrade-paths easier. - - Existing setups will be detected using [system.stateVersion](options.html#opt-system.stateVersion): by default, nextcloud17 will be used, but will raise a warning which notes that after that deploy it\'s recommended to update to the latest stable version (nextcloud18) by declaring the newly introduced setting [services.nextcloud.package](options.html#opt-services.nextcloud.package). + - Existing setups will be detected using [system.stateVersion](options.html#opt-system.stateVersion): by default, nextcloud17 will be used, but will raise a warning which notes that after that deploy it's recommended to update to the latest stable version (nextcloud18) by declaring the newly introduced setting [services.nextcloud.package](options.html#opt-services.nextcloud.package). - - Users with an overlay (e.g. to use nextcloud at version `v18` on `19.09`) will get an evaluation error by default. This is done to ensure that our [package](options.html#opt-services.nextcloud.package)-option doesn\'t select an older version by accident. It\'s recommended to use pkgs.nextcloud18 or to set [package](options.html#opt-services.nextcloud.package) to pkgs.nextcloud explicitly. + - Users with an overlay (e.g. to use nextcloud at version `v18` on `19.09`) will get an evaluation error by default. This is done to ensure that our [package](options.html#opt-services.nextcloud.package)-option doesn't select an older version by accident. It's recommended to use pkgs.nextcloud18 or to set [package](options.html#opt-services.nextcloud.package) to pkgs.nextcloud explicitly. ::: {.warning} - Please note that if you\'re coming from `19.03` or older, you have to manually upgrade to `19.09` first to upgrade your server to Nextcloud v16. + Please note that if you're coming from `19.03` or older, you have to manually upgrade to `19.09` first to upgrade your server to Nextcloud v16. ::: -- Hydra has gained a massive performance improvement due to [some database schema changes](https://github.com/NixOS/hydra/pull/710) by adding several IDs and better indexing. However, it\'s necessary to upgrade Hydra in multiple steps: +- Hydra has gained a massive performance improvement due to [some database schema changes](https://github.com/NixOS/hydra/pull/710) by adding several IDs and better indexing. However, it's necessary to upgrade Hydra in multiple steps: - At first, an older version of Hydra needs to be deployed which adds those (nullable) columns. When having set [stateVersion ](options.html#opt-system.stateVersion) to a value older than `20.03`, this package will be selected by default from the module when upgrading. Otherwise, the package can be deployed using the following config: @@ -434,13 +434,13 @@ When upgrading from a previous release, please be aware of the following incompa - Deploy a newer version of Hydra to activate the DB optimizations. This can be done by using hydra-unstable. This package already includes [flake-support](https://github.com/nixos/rfcs/pull/49) and is therefore compiled against pkgs.nixFlakes. ::: {.warning} - If your [stateVersion](options.html#opt-system.stateVersion) is set to `20.03` or greater, hydra-unstable will be used automatically! This will break your setup if you didn\'t run the migration. + If your [stateVersion](options.html#opt-system.stateVersion) is set to `20.03` or greater, hydra-unstable will be used automatically! This will break your setup if you didn't run the migration. ::: - Please note that Hydra is currently not available with nixStable as this doesn\'t compile anymore. + Please note that Hydra is currently not available with nixStable as this doesn't compile anymore. ::: {.warning} - pkgs.hydra has been removed to ensure a graceful database-migration using the dedicated package-attributes. If you still have pkgs.hydra defined in e.g. an overlay, an assertion error will be thrown. To circumvent this, you need to set [services.hydra.package](options.html#opt-services.hydra.package) to pkgs.hydra explicitly and make sure you know what you\'re doing! + pkgs.hydra has been removed to ensure a graceful database-migration using the dedicated package-attributes. If you still have pkgs.hydra defined in e.g. an overlay, an assertion error will be thrown. To circumvent this, you need to set [services.hydra.package](options.html#opt-services.hydra.package) to pkgs.hydra explicitly and make sure you know what you're doing! ::: - The TokuDB storage engine will be disabled in mariadb 10.5. It is recommended to switch to RocksDB. See also [TokuDB](https://mariadb.com/kb/en/tokudb/). @@ -478,9 +478,9 @@ When upgrading from a previous release, please be aware of the following incompa Depending on your setup, you need to incorporate one of the following changes in your setup to upgrade to 20.03: - - If you use `sqlite3` you don\'t need to do anything. + - If you use `sqlite3` you don't need to do anything. - - If you use `postgresql` on a different server, you don\'t need to change anything as well since this module was never designed to configure remote databases. + - If you use `postgresql` on a different server, you don't need to change anything as well since this module was never designed to configure remote databases. - If you use `postgresql` and configured your synapse initially on `19.09` or older, you simply need to enable postgresql-support explicitly: @@ -496,12 +496,12 @@ When upgrading from a previous release, please be aware of the following incompa - If you deploy a fresh matrix-synapse, you need to configure the database yourself (e.g. by using the [services.postgresql.initialScript](options.html#opt-services.postgresql.initialScript) option). An example for this can be found in the [documentation of the Matrix module](#module-services-matrix). -- If you initially deployed your matrix-synapse on `nixos-unstable` _after_ the `19.09`-release, your database is misconfigured due to a regression in NixOS. For now, matrix-synapse will startup with a warning, but it\'s recommended to reconfigure the database to set the values `LC_COLLATE` and `LC_CTYPE` to [`'C'`](https://www.postgresql.org/docs/12/locale.html). +- If you initially deployed your matrix-synapse on `nixos-unstable` _after_ the `19.09`-release, your database is misconfigured due to a regression in NixOS. For now, matrix-synapse will startup with a warning, but it's recommended to reconfigure the database to set the values `LC_COLLATE` and `LC_CTYPE` to [`'C'`](https://www.postgresql.org/docs/12/locale.html). -- The [systemd.network.links](options.html#opt-systemd.network.links) option is now respected even when [systemd-networkd](options.html#opt-systemd.network.enable) is disabled. This mirrors the behaviour of systemd - It\'s udev that parses `.link` files, not `systemd-networkd`. +- The [systemd.network.links](options.html#opt-systemd.network.links) option is now respected even when [systemd-networkd](options.html#opt-systemd.network.enable) is disabled. This mirrors the behaviour of systemd - It's udev that parses `.link` files, not `systemd-networkd`. - mongodb has been updated to version `3.4.24`. ::: {.warning} - Please note that mongodb has been relicensed under their own [` sspl`](https://www.mongodb.com/licensing/server-side-public-license/faq)-license. Since it\'s not entirely free and not OSI-approved, it\'s listed as non-free. This means that Hydra doesn\'t provide prebuilt mongodb-packages and needs to be built locally. + Please note that mongodb has been relicensed under their own [` sspl`](https://www.mongodb.com/licensing/server-side-public-license/faq)-license. Since it's not entirely free and not OSI-approved, it's listed as non-free. This means that Hydra doesn't provide prebuilt mongodb-packages and needs to be built locally. ::: diff --git a/nixos/doc/manual/release-notes/rl-2009.section.md b/nixos/doc/manual/release-notes/rl-2009.section.md index 79be2a56a54e..6995ef1d406c 100644 --- a/nixos/doc/manual/release-notes/rl-2009.section.md +++ b/nixos/doc/manual/release-notes/rl-2009.section.md @@ -218,7 +218,7 @@ In addition to 1119 new, 118 updated, and 476 removed options; 61 new modules we When upgrading from a previous release, please be aware of the following incompatible changes: -- MariaDB has been updated to 10.4, MariaDB Galera to 26.4. Before you upgrade, it would be best to take a backup of your database. For MariaDB Galera Cluster, see [Upgrading from MariaDB 10.3 to MariaDB 10.4 with Galera Cluster](https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104-with-galera-cluster/) instead. Before doing the upgrade read [Incompatible Changes Between 10.3 and 10.4](https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104/#incompatible-changes-between-103-and-104). After the upgrade you will need to run `mysql_upgrade`. MariaDB 10.4 introduces a number of changes to the authentication process, intended to make things easier and more intuitive. See [Authentication from MariaDB 10.4](https://mariadb.com/kb/en/authentication-from-mariadb-104/). unix_socket auth plugin does not use a password, and uses the connecting user\'s UID instead. When a new MariaDB data directory is initialized, two MariaDB users are created and can be used with new unix_socket auth plugin, as well as traditional mysql_native_password plugin: root\@localhost and mysql\@localhost. To actually use the traditional mysql_native_password plugin method, one must run the following: +- MariaDB has been updated to 10.4, MariaDB Galera to 26.4. Before you upgrade, it would be best to take a backup of your database. For MariaDB Galera Cluster, see [Upgrading from MariaDB 10.3 to MariaDB 10.4 with Galera Cluster](https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104-with-galera-cluster/) instead. Before doing the upgrade read [Incompatible Changes Between 10.3 and 10.4](https://mariadb.com/kb/en/upgrading-from-mariadb-103-to-mariadb-104/#incompatible-changes-between-103-and-104). After the upgrade you will need to run `mysql_upgrade`. MariaDB 10.4 introduces a number of changes to the authentication process, intended to make things easier and more intuitive. See [Authentication from MariaDB 10.4](https://mariadb.com/kb/en/authentication-from-mariadb-104/). unix_socket auth plugin does not use a password, and uses the connecting user's UID instead. When a new MariaDB data directory is initialized, two MariaDB users are created and can be used with new unix_socket auth plugin, as well as traditional mysql_native_password plugin: root\@localhost and mysql\@localhost. To actually use the traditional mysql_native_password plugin method, one must run the following: ```nix { @@ -284,7 +284,7 @@ When upgrading from a previous release, please be aware of the following incompa - The [matrix-synapse](options.html#opt-services.matrix-synapse.enable) module no longer includes optional dependencies by default, they have to be added through the [plugins](options.html#opt-services.matrix-synapse.plugins) option. -- `buildGoModule` now internally creates a vendor directory in the source tree for downloaded modules instead of using go\'s [module proxy protocol](https://golang.org/cmd/go/#hdr-Module_proxy_protocol). This storage format is simpler and therefore less likely to break with future versions of go. As a result `buildGoModule` switched from `modSha256` to the `vendorSha256` attribute to pin fetched version data. +- `buildGoModule` now internally creates a vendor directory in the source tree for downloaded modules instead of using go's [module proxy protocol](https://golang.org/cmd/go/#hdr-Module_proxy_protocol). This storage format is simpler and therefore less likely to break with future versions of go. As a result `buildGoModule` switched from `modSha256` to the `vendorSha256` attribute to pin fetched version data. - Grafana is now built without support for phantomjs by default. Phantomjs support has been [deprecated in Grafana](https://grafana.com/docs/grafana/latest/guides/whats-new-in-v6-4/) and the phantomjs project is [currently unmaintained](https://github.com/ariya/phantomjs/issues/15344#issue-302015362). It can still be enabled by providing `phantomJsSupport = true` to the package instantiation: @@ -306,9 +306,9 @@ When upgrading from a previous release, please be aware of the following incompa - The initrd SSH support now uses OpenSSH rather than Dropbear to allow the use of Ed25519 keys and other OpenSSH-specific functionality. Host keys must now be in the OpenSSH format, and at least one pre-generated key must be specified. - If you used the `boot.initrd.network.ssh.host*Key` options, you\'ll get an error explaining how to convert your host keys and migrate to the new `boot.initrd.network.ssh.hostKeys` option. Otherwise, if you don\'t have any host keys set, you\'ll need to generate some; see the `hostKeys` option documentation for instructions. + If you used the `boot.initrd.network.ssh.host*Key` options, you'll get an error explaining how to convert your host keys and migrate to the new `boot.initrd.network.ssh.hostKeys` option. Otherwise, if you don't have any host keys set, you'll need to generate some; see the `hostKeys` option documentation for instructions. -- Since this release there\'s an easy way to customize your PHP install to get a much smaller base PHP with only wanted extensions enabled. See the following snippet installing a smaller PHP with the extensions `imagick`, `opcache`, `pdo` and `pdo_mysql` loaded: +- Since this release there's an easy way to customize your PHP install to get a much smaller base PHP with only wanted extensions enabled. See the following snippet installing a smaller PHP with the extensions `imagick`, `opcache`, `pdo` and `pdo_mysql` loaded: ```nix { @@ -325,7 +325,7 @@ When upgrading from a previous release, please be aware of the following incompa } ``` - The default `php` attribute hasn\'t lost any extensions. The `opcache` extension has been added. All upstream PHP extensions are available under php.extensions.\<name?\>. + The default `php` attribute hasn't lost any extensions. The `opcache` extension has been added. All upstream PHP extensions are available under php.extensions.\<name?\>. All PHP `config` flags have been removed for the following reasons: @@ -418,9 +418,9 @@ When upgrading from a previous release, please be aware of the following incompa The default value for [services.httpd.mpm](options.html#opt-services.httpd.mpm) has been changed from `prefork` to `event`. Along with this change the default value for [services.httpd.virtualHosts.\<name\>.http2](options.html#opt-services.httpd.virtualHosts) has been set to `true`. -- The `systemd-networkd` option `systemd.network.networks.<name>.dhcp.CriticalConnection` has been removed following upstream systemd\'s deprecation of the same. It is recommended to use `systemd.network.networks.<name>.networkConfig.KeepConfiguration` instead. See systemd.network 5 for details. +- The `systemd-networkd` option `systemd.network.networks.<name>.dhcp.CriticalConnection` has been removed following upstream systemd's deprecation of the same. It is recommended to use `systemd.network.networks.<name>.networkConfig.KeepConfiguration` instead. See systemd.network 5 for details. -- The `systemd-networkd` option `systemd.network.networks._name_.dhcpConfig` has been renamed to [systemd.network.networks._name_.dhcpV4Config](options.html#opt-systemd.network.networks._name_.dhcpV4Config) following upstream systemd\'s documentation change. See systemd.network 5 for details. +- The `systemd-networkd` option `systemd.network.networks._name_.dhcpConfig` has been renamed to [systemd.network.networks._name_.dhcpV4Config](options.html#opt-systemd.network.networks._name_.dhcpV4Config) following upstream systemd's documentation change. See systemd.network 5 for details. - In the `picom` module, several options that accepted floating point numbers encoded as strings (for example [services.picom.activeOpacity](options.html#opt-services.picom.activeOpacity)) have been changed to the (relatively) new native `float` type. To migrate your configuration simply remove the quotes around the numbers. @@ -440,7 +440,7 @@ When upgrading from a previous release, please be aware of the following incompa - The GRUB specific option `boot.loader.grub.extraInitrd` has been replaced with the generic option `boot.initrd.secrets`. This option creates a secondary initrd from the specified files, rather than using a manually created initrd file. Due to an existing bug with `boot.loader.grub.extraInitrd`, it is not possible to directly boot an older generation that used that option. It is still possible to rollback to that generation if the required initrd file has not been deleted. -- The [DNSChain](https://github.com/okTurtles/dnschain) package and NixOS module have been removed from Nixpkgs as the software is unmaintained and can\'t be built. For more information see issue [\#89205](https://github.com/NixOS/nixpkgs/issues/89205). +- The [DNSChain](https://github.com/okTurtles/dnschain) package and NixOS module have been removed from Nixpkgs as the software is unmaintained and can't be built. For more information see issue [\#89205](https://github.com/NixOS/nixpkgs/issues/89205). - In the `resilio` module, [services.resilio.httpListenAddr](options.html#opt-services.resilio.httpListenAddr) has been changed to listen to `[::1]` instead of `0.0.0.0`. @@ -456,7 +456,7 @@ When upgrading from a previous release, please be aware of the following incompa - Update servers first, then clients. -- Radicale\'s default package has changed from 2.x to 3.x. An upgrade checklist can be found [here](https://github.com/Kozea/Radicale/blob/3.0.x/NEWS.md#upgrade-checklist). You can use the newer version in the NixOS service by setting the `package` to `radicale3`, which is done automatically if `stateVersion` is 20.09 or higher. +- Radicale's default package has changed from 2.x to 3.x. An upgrade checklist can be found [here](https://github.com/Kozea/Radicale/blob/3.0.x/NEWS.md#upgrade-checklist). You can use the newer version in the NixOS service by setting the `package` to `radicale3`, which is done automatically if `stateVersion` is 20.09 or higher. - `udpt` experienced a complete rewrite from C++ to rust. The configuration format changed from ini to toml. The new configuration documentation can be found at [the official website](https://naim94a.github.io/udpt/config.html) and example configuration is packaged in `${udpt}/share/udpt/udpt.toml`. @@ -522,7 +522,7 @@ When upgrading from a previous release, please be aware of the following incompa } ``` - The base package has also been upgraded to the 2020-07-29 \"Hogfather\" release. Plugins might be incompatible or require upgrading. + The base package has also been upgraded to the 2020-07-29 "Hogfather" release. Plugins might be incompatible or require upgrading. - The [services.postgresql.dataDir](options.html#opt-services.postgresql.dataDir) option is now set to `"/var/lib/postgresql/${cfg.package.psqlSchema}"` regardless of your [system.stateVersion](options.html#opt-system.stateVersion). Users with an existing postgresql install that have a [system.stateVersion](options.html#opt-system.stateVersion) of `17.03` or below should double check what the value of their [services.postgresql.dataDir](options.html#opt-services.postgresql.dataDir) option is (`/var/db/postgresql`) and then explicitly set this value to maintain compatibility: @@ -552,17 +552,17 @@ When upgrading from a previous release, please be aware of the following incompa - The [jellyfin](options.html#opt-services.jellyfin.enable) module will use and stay on the Jellyfin version `10.5.5` if `stateVersion` is lower than `20.09`. This is because significant changes were made to the database schema, and it is highly recommended to backup your instance before upgrading. After making your backup, you can upgrade to the latest version either by setting your `stateVersion` to `20.09` or higher, or set the `services.jellyfin.package` to `pkgs.jellyfin`. If you do not wish to upgrade Jellyfin, but want to change your `stateVersion`, you can set the value of `services.jellyfin.package` to `pkgs.jellyfin_10_5`. -- The `security.rngd` service is now disabled by default. This choice was made because there\'s krngd in the linux kernel space making it (for most usecases) functionally redundent. +- The `security.rngd` service is now disabled by default. This choice was made because there's krngd in the linux kernel space making it (for most usecases) functionally redundent. - The `hardware.nvidia.optimus_prime.enable` service has been renamed to `hardware.nvidia.prime.sync.enable` and has many new enhancements. Related nvidia prime settings may have also changed. - The package nextcloud17 has been removed and nextcloud18 was marked as insecure since both of them will [ will be EOL (end of life) within the lifetime of 20.09](https://docs.nextcloud.com/server/19/admin_manual/release_schedule.html). - It\'s necessary to upgrade to nextcloud19: + It's necessary to upgrade to nextcloud19: - - From nextcloud17, you have to upgrade to nextcloud18 first as Nextcloud doesn\'t allow going multiple major revisions forward in a single upgrade. This is possible by setting [services.nextcloud.package](options.html#opt-services.nextcloud.package) to nextcloud18. + - From nextcloud17, you have to upgrade to nextcloud18 first as Nextcloud doesn't allow going multiple major revisions forward in a single upgrade. This is possible by setting [services.nextcloud.package](options.html#opt-services.nextcloud.package) to nextcloud18. - - From nextcloud18, it\'s possible to directly upgrade to nextcloud19 by setting [services.nextcloud.package](options.html#opt-services.nextcloud.package) to nextcloud19. + - From nextcloud18, it's possible to directly upgrade to nextcloud19 by setting [services.nextcloud.package](options.html#opt-services.nextcloud.package) to nextcloud19. - The GNOME desktop manager no longer default installs gnome3.epiphany. It was chosen to do this as it has a usability breaking issue (see issue [\#98819](https://github.com/NixOS/nixpkgs/issues/98819)) that makes it unsuitable to be a default app. @@ -578,7 +578,7 @@ When upgrading from a previous release, please be aware of the following incompa - `services.journald.rateLimitBurst` was updated from `1000` to `10000` to follow the new upstream systemd default. -- The notmuch package moves its emacs-related binaries and emacs lisp files to a separate output. They\'re not part of the default `out` output anymore - if you relied on the `notmuch-emacs-mua` binary or the emacs lisp files, access them via the `notmuch.emacs` output. +- The notmuch package moves its emacs-related binaries and emacs lisp files to a separate output. They're not part of the default `out` output anymore - if you relied on the `notmuch-emacs-mua` binary or the emacs lisp files, access them via the `notmuch.emacs` output. - Device tree overlay support was improved in [\#79370](https://github.com/NixOS/nixpkgs/pull/79370) and now uses [hardware.deviceTree.kernelPackage](options.html#opt-hardware.deviceTree.kernelPackage) instead of `hardware.deviceTree.base`. [hardware.deviceTree.overlays](options.html#opt-hardware.deviceTree.overlays) configuration was extended to support `.dts` files with symbols. Device trees can now be filtered by setting [hardware.deviceTree.filter](options.html#opt-hardware.deviceTree.filter) option. @@ -590,7 +590,7 @@ When upgrading from a previous release, please be aware of the following incompa Please note that Rust packages utilizing a custom build/install procedure (e.g. by using a `Makefile`) or test suites that rely on the structure of the `target/` directory may break due to those assumptions. For further information, please read the Rust section in the Nixpkgs manual. -- The cc- and binutils-wrapper\'s \"infix salt\" and `_BUILD_` and `_TARGET_` user infixes have been replaced with with a \"suffix salt\" and suffixes and `_FOR_BUILD` and `_FOR_TARGET`. This matches the autotools convention for env vars which standard for these things, making interfacing with other tools easier. +- The cc- and binutils-wrapper's "infix salt" and `_BUILD_` and `_TARGET_` user infixes have been replaced with with a "suffix salt" and suffixes and `_FOR_BUILD` and `_FOR_TARGET`. This matches the autotools convention for env vars which standard for these things, making interfacing with other tools easier. - Additional Git documentation (HTML and text files) is now available via the `git-doc` package. @@ -598,7 +598,7 @@ When upgrading from a previous release, please be aware of the following incompa - The installer now enables sshd by default. This improves installation on headless machines especially ARM single-board-computer. To login through ssh, either a password or an ssh key must be set for the root user or the nixos user. -- The scripted networking system now uses `.link` files in `/etc/systemd/network` to configure mac address and link MTU, instead of the sometimes buggy `network-link-*` units, which have been removed. Bringing the interface up has been moved to the beginning of the `network-addresses-*` unit. Note this doesn\'t require `systemd-networkd` - it\'s udev that parses `.link` files. Extra care needs to be taken in the presence of [legacy udev rules](https://wiki.debian.org/NetworkInterfaceNames#THE_.22PERSISTENT_NAMES.22_SCHEME) to rename interfaces, as MAC Address and MTU defined in these options can only match on the original link name. In such cases, you most likely want to create a `10-*.link` file through [systemd.network.links](options.html#opt-systemd.network.links) and set both name and MAC Address / MTU there. +- The scripted networking system now uses `.link` files in `/etc/systemd/network` to configure mac address and link MTU, instead of the sometimes buggy `network-link-*` units, which have been removed. Bringing the interface up has been moved to the beginning of the `network-addresses-*` unit. Note this doesn't require `systemd-networkd` - it's udev that parses `.link` files. Extra care needs to be taken in the presence of [legacy udev rules](https://wiki.debian.org/NetworkInterfaceNames#THE_.22PERSISTENT_NAMES.22_SCHEME) to rename interfaces, as MAC Address and MTU defined in these options can only match on the original link name. In such cases, you most likely want to create a `10-*.link` file through [systemd.network.links](options.html#opt-systemd.network.links) and set both name and MAC Address / MTU there. - Grafana received a major update to version 7.x. A plugin is now needed for image rendering support, and plugins must now be signed by default. More information can be found [in the Grafana documentation](https://grafana.com/docs/grafana/latest/installation/upgrading/#upgrading-to-v7-0). @@ -624,15 +624,15 @@ When upgrading from a previous release, please be aware of the following incompa to get the previous behavior of listening on all network interfaces. -- With this release `systemd-networkd` (when enabled through [networking.useNetworkd](options.html#opt-networking.useNetworkd)) has it\'s netlink socket created through a `systemd.socket` unit. This gives us control over socket buffer sizes and other parameters. For larger setups where networkd has to create a lot of (virtual) devices the default buffer size (currently 128MB) is not enough. +- With this release `systemd-networkd` (when enabled through [networking.useNetworkd](options.html#opt-networking.useNetworkd)) has it's netlink socket created through a `systemd.socket` unit. This gives us control over socket buffer sizes and other parameters. For larger setups where networkd has to create a lot of (virtual) devices the default buffer size (currently 128MB) is not enough. On a machine with \>100 virtual interfaces (e.g., wireguard tunnels, VLANs, ...), that all have to be brought up during system startup, the receive buffer size will spike for a brief period. Eventually some of the message will be dropped since there is not enough (permitted) buffer space available. By having `systemd-networkd` start with a netlink socket created by `systemd` we can configure the `ReceiveBufferSize=` parameter in the socket options (i.e. `systemd.sockets.systemd-networkd.socketOptions.ReceiveBufferSize`) without recompiling `systemd-networkd`. - Since the actual memory requirements depend on hardware, timing, exact configurations etc. it isn\'t currently possible to infer a good default from within the NixOS module system. Administrators are advised to monitor the logs of `systemd-networkd` for `rtnl: kernel receive buffer overrun` spam and increase the memory limit as they see fit. + Since the actual memory requirements depend on hardware, timing, exact configurations etc. it isn't currently possible to infer a good default from within the NixOS module system. Administrators are advised to monitor the logs of `systemd-networkd` for `rtnl: kernel receive buffer overrun` spam and increase the memory limit as they see fit. - Note: Increasing the `ReceiveBufferSize=` doesn\'t allocate any memory. It just increases the upper bound on the kernel side. The memory allocation depends on the amount of messages that are queued on the kernel side of the netlink socket. + Note: Increasing the `ReceiveBufferSize=` doesn't allocate any memory. It just increases the upper bound on the kernel side. The memory allocation depends on the amount of messages that are queued on the kernel side of the netlink socket. - Specifying [mailboxes](options.html#opt-services.dovecot2.mailboxes) in the dovecot2 module as a list is deprecated and will break eval in 21.05. Instead, an attribute-set should be specified where the `name` should be the key of the attribute. @@ -662,7 +662,7 @@ When upgrading from a previous release, please be aware of the following incompa - nextcloud has been updated to [v19](https://nextcloud.com/blog/nextcloud-hub-brings-productivity-to-home-office/). - If you have an existing installation, please make sure that you\'re on nextcloud18 before upgrading to nextcloud19 since Nextcloud doesn\'t support upgrades across multiple major versions. + If you have an existing installation, please make sure that you're on nextcloud18 before upgrading to nextcloud19 since Nextcloud doesn't support upgrades across multiple major versions. - The `nixos-run-vms` script now deletes the previous run machines states on test startup. You can use the `--keep-vm-state` flag to match the previous behaviour and keep the same VM state between different test runs. diff --git a/nixos/doc/manual/release-notes/rl-2105.section.md b/nixos/doc/manual/release-notes/rl-2105.section.md index 359f2e5b2e58..6244d79e7e78 100644 --- a/nixos/doc/manual/release-notes/rl-2105.section.md +++ b/nixos/doc/manual/release-notes/rl-2105.section.md @@ -68,9 +68,9 @@ When upgrading from a previous release, please be aware of the following incompa - If the `services.dbus` module is enabled, then the user D-Bus session is now always socket activated. The associated options `services.dbus.socketActivated` and `services.xserver.startDbusSession` have therefore been removed and you will receive a warning if they are present in your configuration. This change makes the user D-Bus session available also for non-graphical logins. -- The `networking.wireless.iwd` module now installs the upstream-provided 80-iwd.link file, which sets the NamePolicy= for all wlan devices to \"keep kernel\", to avoid race conditions between iwd and networkd. If you don\'t want this, you can set `systemd.network.links."80-iwd" = lib.mkForce {}`. +- The `networking.wireless.iwd` module now installs the upstream-provided 80-iwd.link file, which sets the NamePolicy= for all wlan devices to "keep kernel", to avoid race conditions between iwd and networkd. If you don't want this, you can set `systemd.network.links."80-iwd" = lib.mkForce {}`. -- `rubyMinimal` was removed due to being unused and unusable. The default ruby interpreter includes JIT support, which makes it reference it\'s compiler. Since JIT support is probably needed by some Gems, it was decided to enable this feature with all cc references by default, and allow to build a Ruby derivation without references to cc, by setting `jitSupport = false;` in an overlay. See [\#90151](https://github.com/NixOS/nixpkgs/pull/90151) for more info. +- `rubyMinimal` was removed due to being unused and unusable. The default ruby interpreter includes JIT support, which makes it reference it's compiler. Since JIT support is probably needed by some Gems, it was decided to enable this feature with all cc references by default, and allow to build a Ruby derivation without references to cc, by setting `jitSupport = false;` in an overlay. See [\#90151](https://github.com/NixOS/nixpkgs/pull/90151) for more info. - Setting `services.openssh.authorizedKeysFiles` now also affects which keys `security.pam.enableSSHAgentAuth` will use. WARNING: If you are using these options in combination do make sure that any key paths you use are present in `services.openssh.authorizedKeysFiles`! @@ -130,7 +130,7 @@ When upgrading from a previous release, please be aware of the following incompa - `vim` and `neovim` switched to Python 3, dropping all Python 2 support. -- [networking.wireguard.interfaces.\<name\>.generatePrivateKeyFile](options.html#opt-networking.wireguard.interfaces), which is off by default, had a `chmod` race condition fixed. As an aside, the parent directory\'s permissions were widened, and the key files were made owner-writable. This only affects newly created keys. However, if the exact permissions are important for your setup, read [\#121294](https://github.com/NixOS/nixpkgs/pull/121294). +- [networking.wireguard.interfaces.\<name\>.generatePrivateKeyFile](options.html#opt-networking.wireguard.interfaces), which is off by default, had a `chmod` race condition fixed. As an aside, the parent directory's permissions were widened, and the key files were made owner-writable. This only affects newly created keys. However, if the exact permissions are important for your setup, read [\#121294](https://github.com/NixOS/nixpkgs/pull/121294). - [boot.zfs.forceImportAll](options.html#opt-boot.zfs.forceImportAll) previously did nothing, but has been fixed. However its default has been changed to `false` to preserve the existing default behaviour. If you have this explicitly set to `true`, please note that your non-root pools will now be forcibly imported. @@ -157,12 +157,12 @@ When upgrading from a previous release, please be aware of the following incompa - Amazon EC2 and OpenStack Compute (nova) images now re-fetch instance meta data and user data from the instance metadata service (IMDS) on each boot. For example: stopping an EC2 instance, changing its user data, and restarting the instance will now cause it to fetch and apply the new user data. ::: {.warning} - Specifically, `/etc/ec2-metadata` is re-populated on each boot. Some NixOS scripts that read from this directory are guarded to only run if the files they want to manipulate do not already exist, and so will not re-apply their changes if the IMDS response changes. Examples: `root`\'s SSH key is only added if `/root/.ssh/authorized_keys` does not exist, and SSH host keys are only set from user data if they do not exist in `/etc/ssh`. + Specifically, `/etc/ec2-metadata` is re-populated on each boot. Some NixOS scripts that read from this directory are guarded to only run if the files they want to manipulate do not already exist, and so will not re-apply their changes if the IMDS response changes. Examples: `root`'s SSH key is only added if `/root/.ssh/authorized_keys` does not exist, and SSH host keys are only set from user data if they do not exist in `/etc/ssh`. ::: - The `rspamd` services is now sandboxed. It is run as a dynamic user instead of root, so secrets and other files may have to be moved or their permissions may have to be fixed. The sockets are now located in `/run/rspamd` instead of `/run`. -- Enabling the Tor client no longer silently also enables and configures Privoxy, and the `services.tor.client.privoxy.enable` option has been removed. To enable Privoxy, and to configure it to use Tor\'s faster port, use the following configuration: +- Enabling the Tor client no longer silently also enables and configures Privoxy, and the `services.tor.client.privoxy.enable` option has been removed. To enable Privoxy, and to configure it to use Tor's faster port, use the following configuration: ```nix { @@ -181,7 +181,7 @@ When upgrading from a previous release, please be aware of the following incompa - The fish-foreign-env package has been replaced with fishPlugins.foreign-env, in which the fish functions have been relocated to the `vendor_functions.d` directory to be loaded automatically. -- The prometheus json exporter is now managed by the prometheus community. Together with additional features some backwards incompatibilities were introduced. Most importantly the exporter no longer accepts a fixed command-line parameter to specify the URL of the endpoint serving JSON. It now expects this URL to be passed as an URL parameter, when scraping the exporter\'s `/probe` endpoint. In the prometheus scrape configuration the scrape target might look like this: +- The prometheus json exporter is now managed by the prometheus community. Together with additional features some backwards incompatibilities were introduced. Most importantly the exporter no longer accepts a fixed command-line parameter to specify the URL of the endpoint serving JSON. It now expects this URL to be passed as an URL parameter, when scraping the exporter's `/probe` endpoint. In the prometheus scrape configuration the scrape target might look like this: ``` http://some.json-exporter.host:7979/probe?target=https://example.com/some/json/endpoint @@ -230,7 +230,7 @@ When upgrading from a previous release, please be aware of the following incompa Additionally, packages flashplayer and hal-flash were removed along with the `services.flashpolicyd` module. -- The `security.rngd` module has been removed. It was disabled by default in 20.09 as it was functionally redundant with krngd in the linux kernel. It is not necessary for any device that the kernel recognises as an hardware RNG, as it will automatically run the krngd task to periodically collect random data from the device and mix it into the kernel\'s RNG. +- The `security.rngd` module has been removed. It was disabled by default in 20.09 as it was functionally redundant with krngd in the linux kernel. It is not necessary for any device that the kernel recognises as an hardware RNG, as it will automatically run the krngd task to periodically collect random data from the device and mix it into the kernel's RNG. The default SMTP port for GitLab has been changed to `25` from its previous default of `465`. If you depended on this default, you should now set the [services.gitlab.smtp.port](options.html#opt-services.gitlab.smtp.port) option. @@ -272,11 +272,11 @@ When upgrading from a previous release, please be aware of the following incompa - `environment.defaultPackages` now includes the nano package. If pkgs.nano is not added to the list, make sure another editor is installed and the `EDITOR` environment variable is set to it. Environment variables can be set using `environment.variables`. -- `services.minio.dataDir` changed type to a list of paths, required for specifiyng multiple data directories for using with erasure coding. Currently, the service doesn\'t enforce nor checks the correct number of paths to correspond to minio requirements. +- `services.minio.dataDir` changed type to a list of paths, required for specifiyng multiple data directories for using with erasure coding. Currently, the service doesn't enforce nor checks the correct number of paths to correspond to minio requirements. - All CUDA toolkit versions prior to CUDA 10 have been removed. -- The kbdKeymaps package was removed since dvp and neo are now included in kbd. If you want to use the Programmer Dvorak Keyboard Layout, you have to use `dvorak-programmer` in `console.keyMap` now instead of `dvp`. In `services.xserver.xkbVariant` it\'s still `dvp`. +- The kbdKeymaps package was removed since dvp and neo are now included in kbd. If you want to use the Programmer Dvorak Keyboard Layout, you have to use `dvorak-programmer` in `console.keyMap` now instead of `dvp`. In `services.xserver.xkbVariant` it's still `dvp`. - The babeld service is now being run as an unprivileged user. To achieve that the module configures `skip-kernel-setup true` and takes care of setting forwarding and rp_filter sysctls by itself as well as for each interface in `services.babeld.interfaces`. @@ -286,7 +286,7 @@ When upgrading from a previous release, please be aware of the following incompa - Instead of determining `services.radicale.package` automatically based on `system.stateVersion`, the latest version is always used because old versions are not officially supported. - Furthermore, Radicale\'s systemd unit was hardened which might break some deployments. In particular, a non-default `filesystem_folder` has to be added to `systemd.services.radicale.serviceConfig.ReadWritePaths` if the deprecated `services.radicale.config` is used. + Furthermore, Radicale's systemd unit was hardened which might break some deployments. In particular, a non-default `filesystem_folder` has to be added to `systemd.services.radicale.serviceConfig.ReadWritePaths` if the deprecated `services.radicale.config` is used. - In the `security.acme` module, use of `--reuse-key` parameter for Lego has been removed. It was introduced for HKPK, but this security feature is now deprecated. It is a better security practice to rotate key pairs instead of always keeping the same. If you need to keep this parameter, you can add it back using `extraLegoRenewFlags` as an option for the appropriate certificate. @@ -294,13 +294,13 @@ When upgrading from a previous release, please be aware of the following incompa - `stdenv.lib` has been deprecated and will break eval in 21.11. Please use `pkgs.lib` instead. See [\#108938](https://github.com/NixOS/nixpkgs/issues/108938) for details. -- [GNURadio](https://www.gnuradio.org/) has a `pkgs` attribute set, and there\'s a `gnuradio.callPackage` function that extends `pkgs` with a `mkDerivation`, and a `mkDerivationWith`, like Qt5. Now all `gnuradio.pkgs` are defined with `gnuradio.callPackage` and some packages that depend on gnuradio are defined with this as well. +- [GNURadio](https://www.gnuradio.org/) has a `pkgs` attribute set, and there's a `gnuradio.callPackage` function that extends `pkgs` with a `mkDerivation`, and a `mkDerivationWith`, like Qt5. Now all `gnuradio.pkgs` are defined with `gnuradio.callPackage` and some packages that depend on gnuradio are defined with this as well. - [Privoxy](https://www.privoxy.org/) has been updated to version 3.0.32 (See [announcement](https://lists.privoxy.org/pipermail/privoxy-announce/2021-February/000007.html)). Compared to the previous release, Privoxy has gained support for HTTPS inspection (still experimental), Brotli decompression, several new filters and lots of bug fixes, including security ones. In addition, the package is now built with compression and external filters support, which were previously disabled. Regarding the NixOS module, new options for HTTPS inspection have been added and `services.privoxy.extraConfig` has been replaced by the new [services.privoxy.settings](options.html#opt-services.privoxy.settings) (See [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) for the motivation). -- [Kodi](https://kodi.tv/) has been updated to version 19.1 \"Matrix\". See the [announcement](https://kodi.tv/article/kodi-19-0-matrix-release) for further details. +- [Kodi](https://kodi.tv/) has been updated to version 19.1 "Matrix". See the [announcement](https://kodi.tv/article/kodi-19-0-matrix-release) for further details. - The `services.packagekit.backend` option has been removed as it only supported a single setting which would always be the default. Instead new [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) compliant [services.packagekit.settings](options.html#opt-services.packagekit.settings) and [services.packagekit.vendorSettings](options.html#opt-services.packagekit.vendorSettings) options have been introduced. @@ -316,13 +316,13 @@ When upgrading from a previous release, please be aware of the following incompa If this option is disabled, default MTA config becomes not set and you should set the options in `services.mailman.settings.mta` according to the desired configuration as described in [Mailman documentation](https://mailman.readthedocs.io/en/latest/src/mailman/docs/mta.html). -- The default-version of `nextcloud` is nextcloud21. Please note that it\'s _not_ possible to upgrade `nextcloud` across multiple major versions! This means that it\'s e.g. not possible to upgrade from nextcloud18 to nextcloud20 in a single deploy and most `20.09` users will have to upgrade to nextcloud20 first. +- The default-version of `nextcloud` is nextcloud21. Please note that it's _not_ possible to upgrade `nextcloud` across multiple major versions! This means that it's e.g. not possible to upgrade from nextcloud18 to nextcloud20 in a single deploy and most `20.09` users will have to upgrade to nextcloud20 first. The package can be manually upgraded by setting [services.nextcloud.package](options.html#opt-services.nextcloud.package) to nextcloud21. - The setting [services.redis.bind](options.html#opt-services.redis.bind) defaults to `127.0.0.1` now, making Redis listen on the loopback interface only, and not all public network interfaces. -- NixOS now emits a deprecation warning if systemd\'s `StartLimitInterval` setting is used in a `serviceConfig` section instead of in a `unitConfig`; that setting is deprecated and now undocumented for the service section by systemd upstream, but still effective and somewhat buggy there, which can be confusing. See [\#45785](https://github.com/NixOS/nixpkgs/issues/45785) for details. +- NixOS now emits a deprecation warning if systemd's `StartLimitInterval` setting is used in a `serviceConfig` section instead of in a `unitConfig`; that setting is deprecated and now undocumented for the service section by systemd upstream, but still effective and somewhat buggy there, which can be confusing. See [\#45785](https://github.com/NixOS/nixpkgs/issues/45785) for details. All services should use [systemd.services._name_.startLimitIntervalSec](options.html#opt-systemd.services._name_.startLimitIntervalSec) or `StartLimitIntervalSec` in [systemd.services._name_.unitConfig](options.html#opt-systemd.services._name_.unitConfig) instead. @@ -357,7 +357,7 @@ When upgrading from a previous release, please be aware of the following incompa `services.unbound.forwardAddresses` and `services.unbound.allowedAccess` have also been changed to use the new settings interface. You can follow the instructions when executing `nixos-rebuild` to upgrade your configuration to use the new interface. -- The `services.dnscrypt-proxy2` module now takes the upstream\'s example configuration and updates it with the user\'s settings. An option has been added to restore the old behaviour if you prefer to declare the configuration from scratch. +- The `services.dnscrypt-proxy2` module now takes the upstream's example configuration and updates it with the user's settings. An option has been added to restore the old behaviour if you prefer to declare the configuration from scratch. - NixOS now defaults to the unified cgroup hierarchy (cgroupsv2). See the [Fedora Article for 31](https://www.redhat.com/sysadmin/fedora-31-control-group-v2) for details on why this is desirable, and how it impacts containers. @@ -367,11 +367,11 @@ When upgrading from a previous release, please be aware of the following incompa - GNOME users may wish to delete their `~/.config/pulse` due to the changes to stream routing logic. See [PulseAudio bug 832](https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/832) for more information. -- The zookeeper package does not provide `zooInspector.sh` anymore, as that \"contrib\" has been dropped from upstream releases. +- The zookeeper package does not provide `zooInspector.sh` anymore, as that "contrib" has been dropped from upstream releases. -- In the ACME module, the data used to build the hash for the account directory has changed to accomodate new features to reduce account rate limit issues. This will trigger new account creation on the first rebuild following this update. No issues are expected to arise from this, thanks to the new account creation handling. +- In the ACME module, the data used to build the hash for the account directory has changed to accommodate new features to reduce account rate limit issues. This will trigger new account creation on the first rebuild following this update. No issues are expected to arise from this, thanks to the new account creation handling. -- [users.users._name_.createHome](options.html#opt-users.users._name_.createHome) now always ensures home directory permissions to be `0700`. Permissions had previously been ignored for already existing home directories, possibly leaving them readable by others. The option\'s description was incorrect regarding ownership management and has been simplified greatly. +- [users.users._name_.createHome](options.html#opt-users.users._name_.createHome) now always ensures home directory permissions to be `0700`. Permissions had previously been ignored for already existing home directories, possibly leaving them readable by others. The option's description was incorrect regarding ownership management and has been simplified greatly. - When defining a new user, one of [users.users._name_.isNormalUser](options.html#opt-users.users._name_.isNormalUser) and [users.users._name_.isSystemUser](options.html#opt-users.users._name_.isSystemUser) is now required. This is to prevent accidentally giving a UID above 1000 to system users, which could have unexpected consequences, like running user activation scripts for system users. Note that users defined with an explicit UID below 500 are exempted from this check, as [users.users._name_.isSystemUser](options.html#opt-users.users._name_.isSystemUser) has no effect for those. diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md index fc4b44957c36..7272e9231582 100644 --- a/nixos/doc/manual/release-notes/rl-2111.section.md +++ b/nixos/doc/manual/release-notes/rl-2111.section.md @@ -235,7 +235,7 @@ In addition to numerous new and upgraded packages, this release has the followin - The `erigon` ethereum node has moved to a new database format in `2021-05-04`, and requires a full resync -- The `erigon` ethereum node has moved it's database location in `2021-08-03`, users upgrading must manually move their chaindata (see [release notes](https://github.com/ledgerwatch/erigon/releases/tag/v2021.08.03)). +- The `erigon` ethereum node has moved its database location in `2021-08-03`, users upgrading must manually move their chaindata (see [release notes](https://github.com/ledgerwatch/erigon/releases/tag/v2021.08.03)). - [users.users.<name>.group](options.html#opt-users.users._name_.group) no longer defaults to `nogroup`, which was insecure. Out-of-tree modules are likely to require adaptation: instead of ```nix diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md index 217aa6056cad..7cc0c308ee65 100644 --- a/nixos/doc/manual/release-notes/rl-2205.section.md +++ b/nixos/doc/manual/release-notes/rl-2205.section.md @@ -107,7 +107,7 @@ In addition to numerous new and upgraded packages, this release has the followin - [kanidm](https://kanidm.github.io/kanidm/stable/), an identity management server written in Rust. Available as [services.kanidm](#opt-services.kanidm.enableServer) -- [Maddy](https://maddy.email/), a free an open source mail server. Availabe as [services.maddy](#opt-services.maddy.enable). +- [Maddy](https://maddy.email/), a free an open source mail server. Available as [services.maddy](#opt-services.maddy.enable). - [matrix-conduit](https://conduit.rs/), a simple, fast and reliable chat server powered by matrix. Available as [services.matrix-conduit](option.html#opt-services.matrix-conduit.enable). @@ -562,7 +562,7 @@ In addition to numerous new and upgraded packages, this release has the followin - `pkgs._7zz` is now correctly licensed as LGPL3+ and BSD3 with optional unfree unRAR licensed code - The `vim.customize` function produced by `vimUtils.makeCustomizable` now has a slightly different interface: - * The wrapper now includes everything in the given Vim derivation if `name` is `"vim"` (the default). This makes the `wrapManual` argument obsolete, but this behavior can be overriden by setting the `standalone` argument. + * The wrapper now includes everything in the given Vim derivation if `name` is `"vim"` (the default). This makes the `wrapManual` argument obsolete, but this behavior can be overridden by setting the `standalone` argument. * All the executables present in the given derivation (or, in `standalone` mode, only the `*vim` ones) are wrapped. This makes the `wrapGui` argument obsolete. * The `vimExecutableName` and `gvimExecutableName` arguments were replaced by a single `executableName` argument in which the shell variable `$exe` can be used to refer to the wrapped executable's name. diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md index cbede784f069..e92c776b33e3 100644 --- a/nixos/doc/manual/release-notes/rl-2211.section.md +++ b/nixos/doc/manual/release-notes/rl-2211.section.md @@ -385,7 +385,7 @@ In addition to numerous new and upgraded packages, this release includes the fol - memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2. It is now the upstream version from https://www.memtest.org/, as coreboot's fork is no longer available. -- Option descriptions, examples, and defaults writting in DocBook are now deprecated. Using CommonMark is preferred and will become the default in a future release. +- Option descriptions, examples, and defaults writing in DocBook are now deprecated. Using CommonMark is preferred and will become the default in a future release. - The `documentation.nixos.options.allowDocBook` option was added to ease the transition to CommonMark option documentation. Setting this option to `false` causes an error for every option included in the manual that uses DocBook documentation; it defaults to `true` to preserve the previous behavior and will be removed once the transition to CommonMark is complete. diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index 049a620eb455..630157901674 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -14,28 +14,42 @@ In addition to numerous new and upgraded packages, this release has the followin <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> +- [Akkoma](https://akkoma.social), an ActivityPub microblogging server. Available as [services.akkoma](options.html#opt-services.akkoma.enable). + - [blesh](https://github.com/akinomyoga/ble.sh), a line editor written in pure bash. Available as [programs.bash.blesh](#opt-programs.bash.blesh.enable). +- [cups-pdf-to-pdf](https://github.com/alexivkin/CUPS-PDF-to-PDF), a pdf-generating cups backend based on [cups-pdf](https://www.cups-pdf.de/). Available as [services.printing.cups-pdf](#opt-services.printing.cups-pdf.enable). + - [fzf](https://github.com/junegunn/fzf), a command line fuzzyfinder. Available as [programs.fzf](#opt-programs.fzf.fuzzyCompletion). +- [atuin](https://github.com/ellie/atuin), a sync server for shell history. Available as [services.atuin](#opt-services.atuin.enable). + +- [mmsd](https://gitlab.com/kop316/mmsd), a lower level daemon that transmits and recieves MMSes. Available as [services.mmsd](#opt-services.mmsd.enable). + +- [v2rayA](https://v2raya.org), a Linux web GUI client of Project V which supports V2Ray, Xray, SS, SSR, Trojan and Pingtunnel. Available as [services.v2raya](options.html#opt-services.v2raya.enable). + ## Backward Incompatibilities {#sec-release-23.05-incompatibilities} <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> - `carnix` and `cratesIO` has been removed due to being unmaintained, use alternatives such as [naersk](https://github.com/nix-community/naersk) and [crate2nix](https://github.com/kolloch/crate2nix) instead. +- `borgbackup` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.borgbackup.jobs.<name>.inhibitsSleep`](#opt-services.borgbackup.jobs._name_.inhibitsSleep). + - The EC2 image module no longer fetches instance metadata in stage-1. This results in a significantly smaller initramfs, since network drivers no longer need to be included, and faster boots, since metadata fetching can happen in parallel with startup of other services. This breaks services which rely on metadata being present by the time stage-2 is entered. Anything which reads EC2 metadata from `/etc/ec2-metadata` should now have an `after` dependency on `fetch-ec2-metadata.service` +- `minio` removed support for its legacy filesystem backend in [RELEASE.2022-10-29T06-21-33Z](https://github.com/minio/minio/releases/tag/RELEASE.2022-10-29T06-21-33Z). This means if your storage was created with the old format, minio will no longer start. Unfortunately minio doesn't provide a an automatic migration, they only provide [instructions how to manually convert the node](https://min.io/docs/minio/windows/operations/install-deploy-manage/migrate-fs-gateway.html). To facilitate this migration we keep around the last version that still supports the old filesystem backend as `minio_legacy_fs`. Use it via `services.minio.package = minio_legacy_fs;` to export your data before switching to the new version. See the corresponding [issue](https://github.com/NixOS/nixpkgs/issues/199318) for more details. + - `services.sourcehut.dispatch` and the corresponding package (`sourcehut.dispatchsrht`) have been removed due to [upstream deprecation](https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/). -- The [services.snapserver.openFirewall](#opt-services.snapserver.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitely set this option to `true`, or configure your firewall. +- The [services.snapserver.openFirewall](#opt-services.snapserver.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall. -- The [services.avahi.openFirewall](#opt-services.avahi.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitely set this option to `true`, or configure your firewall. +- The [services.tmate-ssh-server.openFirewall](#opt-services.tmate-ssh-server.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall. -- The [services.tmate-ssh-server.openFirewall](#opt-services.tmate-ssh-server.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitely set this option to `true`, or configure your firewall. +- The [services.unifi-video.openFirewall](#opt-services.unifi-video.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall. -- The [services.unifi-video.openFirewall](#opt-services.unifi-video.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitely set this option to `true`, or configure your firewall. +- The Nginx module now validates the syntax of config files at build time. For more complex configurations (using `include` with out-of-store files notably) you may need to disable this check by setting [services.nginx.validateConfig](#opt-services.nginx.validateConfig) to `false`. - The EC2 image module previously detected and automatically mounted ext3-formatted instance store devices and partitions in stage-1 (initramfs), storing `/tmp` on the first discovered device. This behaviour, which only catered to very specific use cases and could not be disabled, has been removed. Users relying on this should provide their own implementation, and probably use ext4 and perform the mount in stage-2. @@ -43,16 +57,20 @@ In addition to numerous new and upgraded packages, this release has the followin - Qt 5.12 and 5.14 have been removed, as the corresponding branches have been EOL upstream for a long time. This affected under 10 packages in nixpkgs, largely unmaintained upstream as well, however, out-of-tree package expressions may need to be updated manually. +- In `mastodon` it is now necessary to specify location of file with `PostgreSQL` database password. In `services.mastodon.database.passwordFile` parameter default value `/var/lib/mastodon/secrets/db-password` has been changed to `null`. + - The `nix.readOnlyStore` option has been renamed to `boot.readOnlyNixStore` to clarify that it configures the NixOS boot process, not the Nix daemon. ## Other Notable Changes {#sec-release-23.05-notable-changes} <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> -- `vim_configurable` has been renamed to `vim-full` to avoid confusion: `vim-full`'s build-time features are configurable, but both `vim` and `vim-full` are *customizable* (in the sense of user configuration, like vimrc). +- `vim_configurable` has been renamed to `vim-full` to avoid confusion: `vim-full`'s build-time features are configurable, but both `vim` and `vim-full` are _customizable_ (in the sense of user configuration, like vimrc). - The module for the application firewall `opensnitch` got the ability to configure rules. Available as [services.opensnitch.rules](#opt-services.opensnitch.rules) +- The module `usbmuxd` now has the ability to change the package used by the daemon. In case you're experiencing issues with `usbmuxd` you can try an alternative program like `usbmuxd2`. Available as [services.usbmuxd.package](#opt-services.usbmuxd.package) + - `services.mastodon` gained a tootctl wrapped named `mastodon-tootctl` similar to `nextcloud-occ` which can be executed from any user and switches to the configured mastodon user with sudo and sources the environment variables. - The `dnsmasq` service now takes configuration via the @@ -62,10 +80,39 @@ In addition to numerous new and upgraded packages, this release has the followin - To reduce closure size in `nixos/modules/profiles/minimal.nix` profile disabled installation documentations and manuals. Also disabled `logrotate` and `udisks2` services. -- The minimal ISO image now use `nixos/modules/profiles/minimal.nix` profile. +- The minimal ISO image now uses the `nixos/modules/profiles/minimal.nix` profile. + +- `mastodon` now supports connection to a remote `PostgreSQL` database. + +- `services.peertube` now requires you to specify the secret file `secrets.secretsFile`. It can be generated by running `openssl rand -hex 32`. + Before upgrading, read the release notes for PeerTube: + - [Release v5.0.0](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.0.0) + + And backup your data. + +- The module `services.headscale` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed: + + - Most settings has been migrated under [services.headscale.settings](#opt-services.headscale.settings) which is an attribute-set that + will be converted into headscale's YAML config format. This means that the configuration from + [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml) + can be directly written as attribute-set in Nix within this option. + +- `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual. - A new `virtualisation.rosetta` module was added to allow running `x86_64` binaries through [Rosetta](https://developer.apple.com/documentation/apple-silicon/about-the-rosetta-translation-environment) inside virtualised NixOS guests on Apple silicon. This feature works by default with the [UTM](https://docs.getutm.app/) virtualisation [package](https://search.nixos.org/packages?channel=unstable&show=utm&from=0&size=1&sort=relevance&type=packages&query=utm). +- The new option `users.motdFile` allows configuring a Message Of The Day that can be updated dynamically. + +- Enabling global redirect in `services.nginx.virtualHosts` now allows one to add exceptions with the `locations` option. + - Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store. +- The `firewall` and `nat` module now has a nftables based implementation. Enable `networking.nftables` to use it. + +- The `services.fwupd` module now allows arbitrary daemon settings to be configured in a structured manner ([`services.fwupd.daemonSettings`](#opt-services.fwupd.daemonSettings)). + - The `unifi-poller` package and corresponding NixOS module have been renamed to `unpoller` to match upstream. + +- The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting. + +- [Xastir](https://xastir.org/index.php/Main_Page) can now access AX.25 interfaces via the `libax25` package. diff --git a/nixos/lib/make-disk-image.nix b/nixos/lib/make-disk-image.nix index e784ec9e6778..365fc1f03a5b 100644 --- a/nixos/lib/make-disk-image.nix +++ b/nixos/lib/make-disk-image.nix @@ -1,3 +1,85 @@ +/* Technical details + +`make-disk-image` has a bit of magic to minimize the amount of work to do in a virtual machine. + +It relies on the [LKL (Linux Kernel Library) project](https://github.com/lkl/linux) which provides Linux kernel as userspace library. + +The Nix-store only image only need to run LKL tools to produce an image and will never spawn a virtual machine, whereas full images will always require a virtual machine, but also use LKL. + +### Image preparation phase + +Image preparation phase will produce the initial image layout in a folder: + +- devise a root folder based on `$PWD` +- prepare the contents by copying and restoring ACLs in this root folder +- load in the Nix store database all additional paths computed by `pkgs.closureInfo` in a temporary Nix store +- run `nixos-install` in a temporary folder +- transfer from the temporary store the additional paths registered to the installed NixOS +- compute the size of the disk image based on the apparent size of the root folder +- partition the disk image using the corresponding script according to the partition table type +- format the partitions if needed +- use `cptofs` (LKL tool) to copy the root folder inside the disk image + +At this step, the disk image already contains the Nix store, it now only needs to be converted to the desired format to be used. + +### Image conversion phase + +Using `qemu-img`, the disk image is converted from a raw format to the desired format: qcow2(-compressed), vdi, vpc. + +### Image Partitioning + +#### `none` + +No partition table layout is written. The image is a bare filesystem image. + +#### `legacy` + +The image is partitioned using MBR. There is one primary ext4 partition starting at 1 MiB that fills the rest of the disk image. + +This partition layout is unsuitable for UEFI. + +#### `legacy+gpt` + +This partition table type uses GPT and: + +- create a "no filesystem" partition from 1MiB to 2MiB ; +- set `bios_grub` flag on this "no filesystem" partition, which marks it as a [GRUB BIOS partition](https://www.gnu.org/software/parted/manual/html_node/set.html) ; +- create a primary ext4 partition starting at 2MiB and extending to the full disk image ; +- perform optimal alignments checks on each partition + +This partition layout is unsuitable for UEFI boot, because it has no ESP (EFI System Partition) partition. It can work with CSM (Compatibility Support Module) which emulates legacy (BIOS) boot for UEFI. + +#### `efi` + +This partition table type uses GPT and: + +- creates an FAT32 ESP partition from 8MiB to specified `bootSize` parameter (256MiB by default), set it bootable ; +- creates an primary ext4 partition starting after the boot partition and extending to the full disk image + +#### `hybrid` + +This partition table type uses GPT and: + +- creates a "no filesystem" partition from 0 to 1MiB, set `bios_grub` flag on it ; +- creates an FAT32 ESP partition from 8MiB to specified `bootSize` parameter (256MiB by default), set it bootable ; +- creates a primary ext4 partition starting after the boot one and extending to the full disk image + +This partition could be booted by a BIOS able to understand GPT layouts and recognizing the MBR at the start. + +### How to run determinism analysis on results? + +Build your derivation with `--check` to rebuild it and verify it is the same. + +If it fails, you will be left with two folders with one having `.check`. + +You can use `diffoscope` to see the differences between the folders. + +However, `diffoscope` is currently not able to diff two QCOW2 filesystems, thus, it is advised to use raw format. + +Even if you use raw disks, `diffoscope` cannot diff the partition table and partitions recursively. + +To solve this, you can run `fdisk -l $image` and generate `dd if=$image of=$image-p$i.raw skip=$start count=$sectors` for each `(start, sectors)` listed in the `fdisk` output. Now, you will have each partition as a separate file and you can compare them in pairs. +*/ { pkgs , lib @@ -47,6 +129,18 @@ , # Whether to invoke `switch-to-configuration boot` during image creation installBootLoader ? true +, # Whether to output have EFIVARS available in $out/efi-vars.fd and use it during disk creation + touchEFIVars ? false + +, # OVMF firmware derivation + OVMF ? pkgs.OVMF.fd + +, # EFI firmware + efiFirmware ? OVMF.firmware + +, # EFI variables + efiVariables ? OVMF.variables + , # The root file system type. fsType ? "ext4" @@ -70,6 +164,22 @@ , # Disk image format, one of qcow2, qcow2-compressed, vdi, vpc, raw. format ? "raw" + # Whether to fix: + # - GPT Disk Unique Identifier (diskGUID) + # - GPT Partition Unique Identifier: depends on the layout, root partition UUID can be controlled through `rootGPUID` option + # - GPT Partition Type Identifier: fixed according to the layout, e.g. ESP partition, etc. through `parted` invocation. + # - Filesystem Unique Identifier when fsType = ext4 for *root partition*. + # BIOS/MBR support is "best effort" at the moment. + # Boot partitions may not be deterministic. + # Also, to fix last time checked of the ext4 partition if fsType = ext4. +, deterministic ? true + + # GPT Partition Unique Identifier for root partition. +, rootGPUID ? "F222513B-DED1-49FA-B591-20CE86A2FE7F" + # When fsType = ext4, this is the root Filesystem Unique Identifier. + # TODO: support other filesystems someday. +, rootFSUID ? (if fsType == "ext4" then rootGPUID else null) + , # Whether a nix channel based on the current source tree should be # made available inside the image. Useful for interactive use of nix # utils, but changes the hash of the image when the sources are @@ -80,15 +190,18 @@ additionalPaths ? [] }: -assert partitionTableType == "legacy" || partitionTableType == "legacy+gpt" || partitionTableType == "efi" || partitionTableType == "hybrid" || partitionTableType == "none"; -# We use -E offset=X below, which is only supported by e2fsprogs -assert partitionTableType != "none" -> fsType == "ext4"; +assert (lib.assertOneOf "partitionTableType" partitionTableType [ "legacy" "legacy+gpt" "efi" "hybrid" "none" ]); +assert (lib.assertMsg (fsType == "ext4" && deterministic -> rootFSUID != null) "In deterministic mode with a ext4 partition, rootFSUID must be non-null, by default, it is equal to rootGPUID."); + # We use -E offset=X below, which is only supported by e2fsprogs +assert (lib.assertMsg (partitionTableType != "none" -> fsType == "ext4") "to produce a partition table, we need to use -E offset flag which is support only for fsType = ext4"); +assert (lib.assertMsg (touchEFIVars -> partitionTableType == "hybrid" || partitionTableType == "efi" || partitionTableType == "legacy+gpt") "EFI variables can be used only with a partition table of type: hybrid, efi or legacy+gpt."); + # If only Nix store image, then: contents must be empty, configFile must be unset, and we should no install bootloader. +assert (lib.assertMsg (onlyNixStore -> contents == [] && configFile == null && !installBootLoader) "In a only Nix store image, the contents must be empty, no configuration must be provided and no bootloader should be installed."); # Either both or none of {user,group} need to be set -assert lib.all +assert (lib.assertMsg (lib.all (attrs: ((attrs.user or null) == null) == ((attrs.group or null) == null)) - contents; -assert onlyNixStore -> contents == [] && configFile == null && !installBootLoader; + contents) "Contents of the disk image should set none of {user, group} or both at the same time."); with lib; @@ -127,6 +240,14 @@ let format' = format; in let mkpart primary ext4 2MB -1 \ align-check optimal 2 \ print + ${optionalString deterministic '' + sgdisk \ + --disk-guid=97FD5997-D90B-4AA3-8D16-C1723AEA73C \ + --partition-guid=1:1C06F03B-704E-4657-B9CD-681A087A2FDC \ + --partition-guid=2:970C694F-AFD0-4B99-B750-CDB7A329AB6F \ + --partition-guid=3:${rootGPUID} \ + $diskImage + ''} ''; efi = '' parted --script $diskImage -- \ @@ -134,6 +255,13 @@ let format' = format; in let mkpart ESP fat32 8MiB ${bootSize} \ set 1 boot on \ mkpart primary ext4 ${bootSize} -1 + ${optionalString deterministic '' + sgdisk \ + --disk-guid=97FD5997-D90B-4AA3-8D16-C1723AEA73C \ + --partition-guid=1:1C06F03B-704E-4657-B9CD-681A087A2FDC \ + --partition-guid=2:${rootGPUID} \ + $diskImage + ''} ''; hybrid = '' parted --script $diskImage -- \ @@ -143,10 +271,20 @@ let format' = format; in let mkpart no-fs 0 1024KiB \ set 2 bios_grub on \ mkpart primary ext4 ${bootSize} -1 + ${optionalString deterministic '' + sgdisk \ + --disk-guid=97FD5997-D90B-4AA3-8D16-C1723AEA73C \ + --partition-guid=1:1C06F03B-704E-4657-B9CD-681A087A2FDC \ + --partition-guid=2:970C694F-AFD0-4B99-B750-CDB7A329AB6F \ + --partition-guid=3:${rootGPUID} \ + $diskImage + ''} ''; none = ""; }.${partitionTableType}; + useEFIBoot = touchEFIVars; + nixpkgs = cleanSource pkgs.path; # FIXME: merge with channel.nix / make-channel.nix. @@ -171,7 +309,9 @@ let format' = format; in let config.system.build.nixos-enter nix systemdMinimal - ] ++ stdenv.initialPath); + ] + ++ lib.optional deterministic gptfdisk + ++ stdenv.initialPath); # I'm preserving the line below because I'm going to search for it across nixpkgs to consolidate # image building logic. The comment right below this now appears in 4 different places in nixpkgs :) @@ -368,20 +508,35 @@ let format' = format; in let diskImage=$out/${filename} ''; + createEFIVars = '' + efiVars=$out/efi-vars.fd + cp ${efiVariables} $efiVars + chmod 0644 $efiVars + ''; + buildImage = pkgs.vmTools.runInLinuxVM ( pkgs.runCommand name { - preVM = prepareImage; + preVM = prepareImage + lib.optionalString touchEFIVars createEFIVars; buildInputs = with pkgs; [ util-linux e2fsprogs dosfstools ]; postVM = moveOrConvertImage + postVM; + QEMU_OPTS = + concatStringsSep " " (lib.optional useEFIBoot "-drive if=pflash,format=raw,unit=0,readonly=on,file=${efiFirmware}" + ++ lib.optionals touchEFIVars [ + "-drive if=pflash,format=raw,unit=1,file=$efiVars" + ] + ); memSize = 1024; } '' export PATH=${binPath}:$PATH rootDisk=${if partitionTableType != "none" then "/dev/vda${rootPartition}" else "/dev/vda"} - # Some tools assume these exist - ln -s vda /dev/xvda - ln -s vda /dev/sda + # It is necessary to set root filesystem unique identifier in advance, otherwise + # bootloader might get the wrong one and fail to boot. + # At the end, we reset again because we want deterministic timestamps. + ${optionalString (fsType == "ext4" && deterministic) '' + tune2fs -T now ${optionalString deterministic "-U ${rootFSUID}"} -c 0 -i 0 $rootDisk + ''} # make systemd-boot find ESP without udev mkdir /dev/block ln -s /dev/vda1 /dev/block/254:1 @@ -396,6 +551,8 @@ let format' = format; in let mkdir -p /mnt/boot mkfs.vfat -n ESP /dev/vda1 mount /dev/vda1 /mnt/boot + + ${optionalString touchEFIVars "mount -t efivarfs efivarfs /sys/firmware/efi/efivars"} ''} # Install a configuration.nix @@ -405,7 +562,13 @@ let format' = format; in let ''} ${lib.optionalString installBootLoader '' - # Set up core system link, GRUB, etc. + # In this throwaway resource, we only have /dev/vda, but the actual VM may refer to another disk for bootloader, e.g. /dev/vdb + # Use this option to create a symlink from vda to any arbitrary device you want. + ${optionalString (config.boot.loader.grub.device != "/dev/vda") '' + ln -s /dev/vda ${config.boot.loader.grub.device} + ''} + + # Set up core system link, bootloader (sd-boot, GRUB, uboot, etc.), etc. NIXOS_INSTALL_BOOTLOADER=1 nixos-enter --root $mountPoint -- /nix/var/nix/profiles/system/bin/switch-to-configuration boot # The above scripts will generate a random machine-id and we don't want to bake a single ID into all our images @@ -432,8 +595,12 @@ let format' = format; in let # Make sure resize2fs works. Note that resize2fs has stricter criteria for resizing than a normal # mount, so the `-c 0` and `-i 0` don't affect it. Setting it to `now` doesn't produce deterministic # output, of course, but we can fix that when/if we start making images deterministic. + # In deterministic mode, this is fixed to 1970-01-01 (UNIX timestamp 0). + # This two-step approach is necessary otherwise `tune2fs` will want a fresher filesystem to perform + # some changes. ${optionalString (fsType == "ext4") '' - tune2fs -T now -c 0 -i 0 $rootDisk + tune2fs -T now ${optionalString deterministic "-U ${rootFSUID}"} -c 0 -i 0 $rootDisk + ${optionalString deterministic "tune2fs -f -T 19700101 $rootDisk"} ''} '' ); diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix index dea3eec5bd6d..a3436caad8f9 100644 --- a/nixos/lib/make-options-doc/default.nix +++ b/nixos/lib/make-options-doc/default.nix @@ -19,7 +19,7 @@ { pkgs , lib , options -, transformOptions ? lib.id # function for additional tranformations of the options +, transformOptions ? lib.id # function for additional transformations of the options , documentType ? "appendix" # TODO deprecate "appendix" in favor of "none" # and/or rename function to moduleOptionDoc for clean slate diff --git a/nixos/lib/systemd-lib.nix b/nixos/lib/systemd-lib.nix index 4c52643446ed..c6c8753d5325 100644 --- a/nixos/lib/systemd-lib.nix +++ b/nixos/lib/systemd-lib.nix @@ -8,9 +8,9 @@ let systemd = cfg.package; in rec { - shellEscape = s: (replaceChars [ "\\" ] [ "\\\\" ] s); + shellEscape = s: (replaceStrings [ "\\" ] [ "\\\\" ] s); - mkPathSafeName = lib.replaceChars ["@" ":" "\\" "[" "]"] ["-" "-" "-" "" ""]; + mkPathSafeName = lib.replaceStrings ["@" ":" "\\" "[" "]"] ["-" "-" "-" "" ""]; # a type for options that take a unit name unitNameType = types.strMatching "[a-zA-Z0-9@%:_.\\-]+[.](service|socket|device|mount|automount|swap|target|path|timer|scope|slice)"; @@ -258,7 +258,7 @@ in rec { makeJobScript = name: text: let - scriptName = replaceChars [ "\\" "@" ] [ "-" "_" ] (shellEscape name); + scriptName = replaceStrings [ "\\" "@" ] [ "-" "_" ] (shellEscape name); out = (pkgs.writeShellScriptBin scriptName '' set -e ${text} diff --git a/nixos/lib/systemd-unit-options.nix b/nixos/lib/systemd-unit-options.nix index 44f26572a23b..9c7cb34f14b5 100644 --- a/nixos/lib/systemd-unit-options.nix +++ b/nixos/lib/systemd-unit-options.nix @@ -324,7 +324,11 @@ in rec { scriptArgs = mkOption { type = types.str; default = ""; - description = lib.mdDoc "Arguments passed to the main process script."; + example = "%i"; + description = lib.mdDoc '' + Arguments passed to the main process script. + Can contain specifiers (`%` placeholders expanded by systemd, see {manpage}`systemd.unit(5)`). + ''; }; preStart = mkOption { diff --git a/nixos/lib/test-driver/test_driver/driver.py b/nixos/lib/test-driver/test_driver/driver.py index e32f6810ca87..6542a2e2f693 100644 --- a/nixos/lib/test-driver/test_driver/driver.py +++ b/nixos/lib/test-driver/test_driver/driver.py @@ -220,6 +220,20 @@ class Driver: res = driver.polling_conditions.pop() assert res is self.condition + def wait(self, timeout: int = 900) -> None: + def condition(last: bool) -> bool: + if last: + rootlog.info(f"Last chance for {self.condition.description}") + ret = self.condition.check(force=True) + if not ret and not last: + rootlog.info( + f"({self.condition.description} failure not fatal yet)" + ) + return ret + + with rootlog.nested(f"waiting for {self.condition.description}"): + retry(condition, timeout=timeout) + if fun_ is None: return Poll else: diff --git a/nixos/lib/test-driver/test_driver/polling_condition.py b/nixos/lib/test-driver/test_driver/polling_condition.py index 459845452fa1..02ca0a03ab3d 100644 --- a/nixos/lib/test-driver/test_driver/polling_condition.py +++ b/nixos/lib/test-driver/test_driver/polling_condition.py @@ -1,4 +1,5 @@ from typing import Callable, Optional +from math import isfinite import time from .logger import rootlog @@ -14,7 +15,7 @@ class PollingCondition: description: Optional[str] last_called: float - entered: bool + entry_count: int def __init__( self, @@ -34,14 +35,21 @@ class PollingCondition: self.description = str(description) self.last_called = float("-inf") - self.entered = False + self.entry_count = 0 - def check(self) -> bool: - if self.entered or not self.overdue: + def check(self, force: bool = False) -> bool: + if (self.entered or not self.overdue) and not force: return True with self, rootlog.nested(self.nested_message): - rootlog.info(f"Time since last: {time.monotonic() - self.last_called:.2f}s") + time_since_last = time.monotonic() - self.last_called + last_message = ( + f"Time since last: {time_since_last:.2f}s" + if isfinite(time_since_last) + else "(not called yet)" + ) + + rootlog.info(last_message) try: res = self.condition() # type: ignore except Exception: @@ -69,9 +77,16 @@ class PollingCondition: def overdue(self) -> bool: return self.last_called + self.seconds_interval < time.monotonic() + @property + def entered(self) -> bool: + # entry_count should never dip *below* zero + assert self.entry_count >= 0 + return self.entry_count > 0 + def __enter__(self) -> None: - self.entered = True + self.entry_count += 1 def __exit__(self, exc_type, exc_value, traceback) -> None: # type: ignore - self.entered = False + assert self.entered + self.entry_count -= 1 self.last_called = time.monotonic() diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix index 134d38f1b676..4904ad6e3591 100644 --- a/nixos/lib/testing-python.nix +++ b/nixos/lib/testing-python.nix @@ -1,3 +1,4 @@ +args@ { system , pkgs ? import ../.. { inherit system config; } # Use a minimal kernel? @@ -5,7 +6,7 @@ # Ignored , config ? { } # !!! See comment about args in lib/modules.nix -, specialArgs ? { } +, specialArgs ? throw "legacy - do not use, see error below" # Modules to add to each VM , extraConfigurations ? [ ] }: @@ -13,6 +14,13 @@ let nixos-lib = import ./default.nix { inherit (pkgs) lib; }; in +pkgs.lib.throwIf (args?specialArgs) '' + testing-python.nix: `specialArgs` is not supported anymore. If you're looking + for the public interface to the NixOS test framework, use `runTest`, and + `node.specialArgs`. + See https://nixos.org/manual/nixos/unstable/index.html#sec-calling-nixos-tests + and https://nixos.org/manual/nixos/unstable/index.html#test-opt-node.specialArgs +'' rec { inherit pkgs; diff --git a/nixos/lib/testing/legacy.nix b/nixos/lib/testing/legacy.nix index 868b8b65b17d..b31057556601 100644 --- a/nixos/lib/testing/legacy.nix +++ b/nixos/lib/testing/legacy.nix @@ -3,9 +3,10 @@ let inherit (lib) mkIf mkOption types; in { - # This needs options.warnings, which we don't have (yet?). + # This needs options.warnings and options.assertions, which we don't have (yet?). # imports = [ # (lib.mkRenamedOptionModule [ "machine" ] [ "nodes" "machine" ]) + # (lib.mkRemovedOptionModule [ "minimal" ] "The minimal kernel module was removed as it was broken and not used any more in nixpkgs.") # ]; options = { diff --git a/nixos/lib/testing/nodes.nix b/nixos/lib/testing/nodes.nix index 8e620c96b3bb..c538ab468c52 100644 --- a/nixos/lib/testing/nodes.nix +++ b/nixos/lib/testing/nodes.nix @@ -23,7 +23,7 @@ let nixpkgs.config.allowAliases = false; }) testModuleArgs.config.extraBaseModules - ] ++ optional config.minimal ../../modules/testing/minimal-kernel.nix; + ]; }; @@ -78,14 +78,6 @@ in ''; }; - minimal = mkOption { - type = types.bool; - default = false; - description = mdDoc '' - Enable to configure all [{option}`nodes`](#test-opt-nodes) to run with a minimal kernel. - ''; - }; - nodesCompat = mkOption { internal = true; description = mdDoc '' diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix index 9eefa80d1c8b..def3aa13f320 100644 --- a/nixos/lib/utils.nix +++ b/nixos/lib/utils.nix @@ -48,7 +48,7 @@ rec { trim = s: removeSuffix "/" (removePrefix "/" s); normalizedPath = strings.normalizePath s; in - replaceChars ["/"] ["-"] + replaceStrings ["/"] ["-"] (replacePrefix "." (strings.escapeC ["."] ".") (strings.escapeC (stringToCharacters " !\"#$%&'()*+,;<=>=@[\\]^`{|}~-") (if normalizedPath == "/" then normalizedPath else trim normalizedPath))); @@ -67,7 +67,7 @@ rec { else if builtins.isInt arg || builtins.isFloat arg then toString arg else throw "escapeSystemdExecArg only allows strings, paths and numbers"; in - replaceChars [ "%" "$" ] [ "%%" "$$" ] (builtins.toJSON s); + replaceStrings [ "%" "$" ] [ "%%" "$$" ] (builtins.toJSON s); # Quotes a list of arguments into a single string for use in a Exec* # line. @@ -112,7 +112,7 @@ rec { else if isAttrs item then map (name: let - escapedName = ''"${replaceChars [''"'' "\\"] [''\"'' "\\\\"] name}"''; + escapedName = ''"${replaceStrings [''"'' "\\"] [''\"'' "\\\\"] name}"''; in recurse (prefix + "." + escapedName) item.${name}) (attrNames item) else if isList item then diff --git a/nixos/maintainers/scripts/lxd/lxd-image-inner.nix b/nixos/maintainers/scripts/lxd/lxd-image-inner.nix index ead3d4e99401..c8cf2a04fb10 100644 --- a/nixos/maintainers/scripts/lxd/lxd-image-inner.nix +++ b/nixos/maintainers/scripts/lxd/lxd-image-inner.nix @@ -94,9 +94,4 @@ with lib; # Before changing this value read the documentation for this option # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). system.stateVersion = "21.05"; # Did you read the comment? - - # As this is intended as a stadalone image, undo some of the minimal profile stuff - documentation.enable = true; - documentation.nixos.enable = true; - environment.noXlibs = false; } diff --git a/nixos/maintainers/scripts/lxd/lxd-image.nix b/nixos/maintainers/scripts/lxd/lxd-image.nix index 6aa3f2f55847..cf30836dffe5 100644 --- a/nixos/maintainers/scripts/lxd/lxd-image.nix +++ b/nixos/maintainers/scripts/lxd/lxd-image.nix @@ -26,9 +26,4 @@ with lib; # Network networking.useDHCP = false; networking.interfaces.eth0.useDHCP = true; - - # As this is intended as a standalone image, undo some of the minimal profile stuff - documentation.enable = true; - documentation.nixos.enable = true; - environment.noXlibs = false; } diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix index e5699161ec4b..70e265a65a60 100644 --- a/nixos/modules/config/no-x-libs.nix +++ b/nixos/modules/config/no-x-libs.nix @@ -33,9 +33,13 @@ with lib; ffmpeg_4 = super.ffmpeg_4-headless; ffmpeg_5 = super.ffmpeg_5-headless; gobject-introspection = super.gobject-introspection.override { x11Support = false; }; + gpsd = super.gpsd.override { guiSupport = false; }; imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; }; imagemagickBig = super.imagemagickBig.override { libX11Support = false; libXtSupport = false; }; + libextractor = super.libextractor.override { gstreamerSupport = false; gtkSupport = false; }; libva = super.libva-minimal; + limesuite = super.limesuite.override { withGui = false; }; + msmtp = super.msmtp.override { withKeyring = false; }; networkmanager-fortisslvpn = super.networkmanager-fortisslvpn.override { withGnome = false; }; networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; }; networkmanager-l2tp = super.networkmanager-l2tp.override { withGnome = false; }; @@ -45,6 +49,7 @@ with lib; networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; }; pinentry = super.pinentry.override { enabledFlavors = [ "curses" "tty" "emacs" ]; withLibsecret = false; }; qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; }; + qrencode = super.qrencode.overrideAttrs (_: { doCheck = false; }); zbar = super.zbar.override { enableVideo = false; withXorg = false; }; })); }; diff --git a/nixos/modules/config/shells-environment.nix b/nixos/modules/config/shells-environment.nix index 50bb9b17783b..bc6583442edf 100644 --- a/nixos/modules/config/shells-environment.nix +++ b/nixos/modules/config/shells-environment.nix @@ -42,8 +42,8 @@ in strings. The latter is concatenated, interspersed with colon characters. ''; - type = with types; attrsOf (either str (listOf str)); - apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else v); + type = with types; attrsOf (oneOf [ (listOf str) str path ]); + apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else "${v}"); }; environment.profiles = mkOption { diff --git a/nixos/modules/config/swap.nix b/nixos/modules/config/swap.nix index 10d52ade288b..76a054b100eb 100644 --- a/nixos/modules/config/swap.nix +++ b/nixos/modules/config/swap.nix @@ -160,7 +160,7 @@ let config = rec { device = mkIf options.label.isDefined "/dev/disk/by-label/${config.label}"; - deviceName = lib.replaceChars ["\\"] [""] (escapeSystemdPath config.device); + deviceName = lib.replaceStrings ["\\"] [""] (escapeSystemdPath config.device); realDevice = if config.randomEncryption.enable then "/dev/mapper/${deviceName}" else config.device; }; diff --git a/nixos/modules/config/system-environment.nix b/nixos/modules/config/system-environment.nix index 5b226d5079b0..399304185223 100644 --- a/nixos/modules/config/system-environment.nix +++ b/nixos/modules/config/system-environment.nix @@ -1,6 +1,6 @@ # This module defines a system-wide environment that will be # initialised by pam_env (that is, not only in shells). -{ config, lib, pkgs, ... }: +{ config, lib, options, pkgs, ... }: with lib; @@ -32,8 +32,7 @@ in therefore not possible to use PAM style variables such as `@{HOME}`. ''; - type = with types; attrsOf (either str (listOf str)); - apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else v); + inherit (options.environment.variables) type apply; }; environment.profileRelativeSessionVariables = mkOption { diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix index 61d70ccc19b2..19319b9309cd 100644 --- a/nixos/modules/config/users-groups.nix +++ b/nixos/modules/config/users-groups.nix @@ -101,16 +101,13 @@ let type = types.bool; default = false; description = lib.mdDoc '' - Indicates whether this is an account for a “real” user. This - automatically sets {option}`group` to - `users`, {option}`createHome` to - `true`, {option}`home` to - {file}`/home/«username»`, + Indicates whether this is an account for a “real” user. + This automatically sets {option}`group` to `users`, + {option}`createHome` to `true`, + {option}`home` to {file}`/home/«username»`, {option}`useDefaultShell` to `true`, - and {option}`isSystemUser` to - `false`. - Exactly one of `isNormalUser` and - `isSystemUser` must be true. + and {option}`isSystemUser` to `false`. + Exactly one of `isNormalUser` and `isSystemUser` must be true. ''; }; diff --git a/nixos/modules/config/zram.nix b/nixos/modules/config/zram.nix index cc2ca6314433..87ac53a60b7e 100644 --- a/nixos/modules/config/zram.nix +++ b/nixos/modules/config/zram.nix @@ -132,6 +132,8 @@ in options zram num_devices=${toString cfg.numDevices} ''; + boot.kernelParams = ["zram.num_devices=${toString cfg.numDevices}"]; + services.udev.extraRules = '' KERNEL=="zram[0-9]*", ENV{SYSTEMD_WANTS}="zram-init-%k.service", TAG+="systemd" ''; @@ -178,9 +180,9 @@ in serviceConfig = { Type = "oneshot"; RemainAfterExit = true; - ExecStartPre = "${modprobe} -r zram"; - ExecStart = "${modprobe} zram"; - ExecStop = "${modprobe} -r zram"; + ExecStartPre = "-${modprobe} -r zram"; + ExecStart = "-${modprobe} zram"; + ExecStop = "-${modprobe} -r zram"; }; restartTriggers = [ cfg.numDevices diff --git a/nixos/modules/hardware/gpgsmartcards.nix b/nixos/modules/hardware/gpgsmartcards.nix index 43ade4d12e12..68e1e5f74e2e 100644 --- a/nixos/modules/hardware/gpgsmartcards.nix +++ b/nixos/modules/hardware/gpgsmartcards.nix @@ -8,7 +8,7 @@ let # https://salsa.debian.org/debian/gnupg2/-/blob/debian/main/debian/scdaemon.udev # the latest rev of the entire debian gnupg2 repo as of 2021-04-28 - # the scdaemon.udev file was last commited on 2021-01-05 (7817a03): + # the scdaemon.udev file was last committed on 2021-01-05 (7817a03): scdaemonUdevRev = "01898735a015541e3ffb43c7245ac1e612f40836"; scdaemonRules = pkgs.fetchurl { diff --git a/nixos/modules/hardware/opengl.nix b/nixos/modules/hardware/opengl.nix index 5a5d88d9a4e0..9108bcbd1652 100644 --- a/nixos/modules/hardware/opengl.nix +++ b/nixos/modules/hardware/opengl.nix @@ -26,9 +26,7 @@ in imports = [ (mkRenamedOptionModule [ "services" "xserver" "vaapiDrivers" ] [ "hardware" "opengl" "extraPackages" ]) - (mkRemovedOptionModule [ "hardware" "opengl" "s3tcSupport" ] '' - S3TC support is now always enabled in Mesa. - '') + (mkRemovedOptionModule [ "hardware" "opengl" "s3tcSupport" ] "S3TC support is now always enabled in Mesa.") ]; options = { @@ -89,21 +87,28 @@ in extraPackages = mkOption { type = types.listOf types.package; default = []; - example = literalExpression "with pkgs; [ vaapiIntel libvdpau-va-gl vaapiVdpau intel-ocl ]"; + example = literalExpression "with pkgs; [ intel-media-driver intel-ocl vaapiIntel ]"; description = lib.mdDoc '' - Additional packages to add to OpenGL drivers. This can be used - to add OpenCL drivers, VA-API/VDPAU drivers etc. + Additional packages to add to OpenGL drivers. + This can be used to add OpenCL drivers, VA-API/VDPAU drivers etc. + + ::: {.note} + intel-media-driver supports hardware Broadwell (2014) or newer. Older hardware should use the mostly unmaintained vaapiIntel driver. + ::: ''; }; extraPackages32 = mkOption { type = types.listOf types.package; default = []; - example = literalExpression "with pkgs.pkgsi686Linux; [ vaapiIntel libvdpau-va-gl vaapiVdpau ]"; + example = literalExpression "with pkgs.pkgsi686Linux; [ intel-media-driver vaapiIntel ]"; description = lib.mdDoc '' - Additional packages to add to 32-bit OpenGL drivers on - 64-bit systems. Used when {option}`driSupport32Bit` is - set. This can be used to add OpenCL drivers, VA-API/VDPAU drivers etc. + Additional packages to add to 32-bit OpenGL drivers on 64-bit systems. + Used when {option}`driSupport32Bit` is set. This can be used to add OpenCL drivers, VA-API/VDPAU drivers etc. + + ::: {.note} + intel-media-driver supports hardware Broadwell (2014) or newer. Older hardware should use the mostly unmaintained vaapiIntel driver. + ::: ''; }; @@ -124,7 +129,6 @@ in }; config = mkIf cfg.enable { - assertions = [ { assertion = cfg.driSupport32Bit -> pkgs.stdenv.isx86_64; message = "Option driSupport32Bit only makes sense on a 64-bit system."; diff --git a/nixos/modules/hardware/openrazer.nix b/nixos/modules/hardware/openrazer.nix index 247913297c9e..aaa4000e758f 100644 --- a/nixos/modules/hardware/openrazer.nix +++ b/nixos/modules/hardware/openrazer.nix @@ -110,7 +110,7 @@ in boot.extraModulePackages = [ kernelPackages.openrazer ]; boot.kernelModules = drivers; - # Makes the man pages available so you can succesfully run + # Makes the man pages available so you can successfully run # > systemctl --user help openrazer-daemon environment.systemPackages = [ pkgs.python3Packages.openrazer-daemon.man ]; diff --git a/nixos/modules/hardware/printers.nix b/nixos/modules/hardware/printers.nix index 64c29bb0a5b3..85e3215127fd 100644 --- a/nixos/modules/hardware/printers.nix +++ b/nixos/modules/hardware/printers.nix @@ -100,7 +100,7 @@ in { default = {}; description = lib.mdDoc '' Sets PPD options for the printer. - {command}`lpoptions [-p printername] -l` shows suported PPD options for the given printer. + {command}`lpoptions [-p printername] -l` shows supported PPD options for the given printer. ''; }; }; diff --git a/nixos/modules/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix b/nixos/modules/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix new file mode 100644 index 000000000000..9d09cdbe0206 --- /dev/null +++ b/nixos/modules/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix @@ -0,0 +1,15 @@ +{ pkgs, ... }: + +{ + imports = [ ./installation-cd-minimal-new-kernel.nix ]; + + # Makes `availableOn` fail for zfs, see <nixos/modules/profiles/base.nix>. + # This is a workaround since we cannot remove the `"zfs"` string from `supportedFilesystems`. + # The proper fix would be to make `supportedFilesystems` an attrset with true/false which we + # could then `lib.mkForce false` + nixpkgs.overlays = [(final: super: { + zfs = super.zfs.overrideAttrs(_: { + meta.platforms = []; + }); + })]; +} diff --git a/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix b/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix index abf0a5186b6a..7a3bd74cb70a 100644 --- a/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix +++ b/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix @@ -9,6 +9,9 @@ ./installation-cd-base.nix ]; + # Causes a lot of uncached builds for a negligible decrease in size. + environment.noXlibs = lib.mkOverride 500 false; + documentation.man.enable = lib.mkOverride 500 true; fonts.fontconfig.enable = lib.mkForce false; diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix index e37142f05f41..81aca8617389 100644 --- a/nixos/modules/installer/cd-dvd/iso-image.nix +++ b/nixos/modules/installer/cd-dvd/iso-image.nix @@ -70,18 +70,16 @@ let ; # Timeout in syslinux is in units of 1/10 of a second. - # 0 is used to disable timeouts. + # null means max timeout (35996, just under 1h in 1/10 seconds) + # 0 means disable timeout syslinuxTimeout = if config.boot.loader.timeout == null then - 0 + 35996 else - max (config.boot.loader.timeout * 10) 1; - - - max = x: y: if x > y then x else y; + config.boot.loader.timeout * 10; # The configuration file for syslinux. - # Notes on syslinux configuration and UNetbootin compatiblity: + # Notes on syslinux configuration and UNetbootin compatibility: # * Do not use '/syslinux/syslinux.cfg' as the path for this # configuration. UNetbootin will not parse the file and use it as-is. # This results in a broken configuration if the partition label does diff --git a/nixos/modules/installer/netboot/netboot-minimal.nix b/nixos/modules/installer/netboot/netboot-minimal.nix index 268357c0e41a..91065d52faf4 100644 --- a/nixos/modules/installer/netboot/netboot-minimal.nix +++ b/nixos/modules/installer/netboot/netboot-minimal.nix @@ -1,6 +1,6 @@ # This module defines a small netboot environment. -{ ... }: +{ lib, ... }: { imports = [ diff --git a/nixos/modules/installer/sd-card/sd-image-aarch64-new-kernel-no-zfs-installer.nix b/nixos/modules/installer/sd-card/sd-image-aarch64-new-kernel-no-zfs-installer.nix new file mode 100644 index 000000000000..0e5055960294 --- /dev/null +++ b/nixos/modules/installer/sd-card/sd-image-aarch64-new-kernel-no-zfs-installer.nix @@ -0,0 +1,15 @@ +{ pkgs, ... }: + +{ + imports = [ ./sd-image-aarch64-new-kernel-installer.nix ]; + + # Makes `availableOn` fail for zfs, see <nixos/modules/profiles/base.nix>. + # This is a workaround since we cannot remove the `"zfs"` string from `supportedFilesystems`. + # The proper fix would be to make `supportedFilesystems` an attrset with true/false which we + # could then `lib.mkForce false` + nixpkgs.overlays = [(final: super: { + zfs = super.zfs.overrideAttrs(_: { + meta.platforms = []; + }); + })]; +} diff --git a/nixos/modules/misc/label.nix b/nixos/modules/misc/label.nix index 0c29d13aab1d..44ee812249ce 100644 --- a/nixos/modules/misc/label.nix +++ b/nixos/modules/misc/label.nix @@ -27,7 +27,7 @@ in variable (defaults to the value of {option}`system.nixos.version`). - Can be overriden by setting {env}`NIXOS_LABEL`. + Can be overridden by setting {env}`NIXOS_LABEL`. Useful for not loosing track of configurations built from different nixos branches/revisions, e.g.: diff --git a/nixos/modules/misc/man-db.nix b/nixos/modules/misc/man-db.nix index df903259fa42..299b11d1fcef 100644 --- a/nixos/modules/misc/man-db.nix +++ b/nixos/modules/misc/man-db.nix @@ -52,13 +52,11 @@ in environment.systemPackages = [ cfg.package ]; environment.etc."man_db.conf".text = let - mandbForBuild = if pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform then - cfg.package - else - pkgs.buildPackages.man-db; - manualCache = pkgs.runCommand "man-cache" { } '' + manualCache = pkgs.runCommand "man-cache" { + nativeBuildInputs = [ cfg.package ]; + } '' echo "MANDB_MAP ${cfg.manualPages}/share/man $out" > man.conf - ${mandbForBuild}/bin/mandb -C man.conf -psc >/dev/null 2>&1 + mandb -C man.conf -psc >/dev/null 2>&1 ''; in '' diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix index b3cdaf5568d4..1067b21a22b0 100644 --- a/nixos/modules/misc/version.nix +++ b/nixos/modules/misc/version.nix @@ -89,6 +89,12 @@ in stateVersion = mkOption { type = types.str; + # TODO Remove this and drop the default of the option so people are forced to set it. + # Doing this also means fixing the comment in nixos/modules/testing/test-instrumentation.nix + apply = v: + lib.warnIf (options.system.stateVersion.highestPrio == (lib.mkOptionDefault { }).priority) + "system.stateVersion is not set, defaulting to ${v}. Read why this matters on https://nixos.org/manual/nixos/stable/options.html#opt-system.stateVersion." + v; default = cfg.release; defaultText = literalExpression "config.${opt.release}"; description = lib.mdDoc '' @@ -149,14 +155,6 @@ in "os-release".text = attrsToText osReleaseContents; }; - # We have to use `warnings` because when warning in the default of the option - # the warning would also be shown when building the manual since the manual - # has to evaluate the default. - # - # TODO Remove this and drop the default of the option so people are forced to set it. - # Doing this also means fixing the comment in nixos/modules/testing/test-instrumentation.nix - warnings = lib.optional (options.system.stateVersion.highestPrio == (lib.mkOptionDefault { }).priority) - "system.stateVersion is not set, defaulting to ${config.system.stateVersion}. Read why this matters on https://nixos.org/manual/nixos/stable/options.html#opt-system.stateVersion."; }; # uses version info nixpkgs, which requires a full nixpkgs path diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 24dd30e15750..dd0921243a7c 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1,21 +1,13 @@ [ + ./config/appstream.nix + ./config/console.nix ./config/debug-info.nix ./config/fonts/fontconfig.nix ./config/fonts/fontdir.nix ./config/fonts/fonts.nix ./config/fonts/ghostscript.nix - ./config/xdg/autostart.nix - ./config/xdg/icons.nix - ./config/xdg/menus.nix - ./config/xdg/mime.nix - ./config/xdg/portal.nix - ./config/xdg/portals/wlr.nix - ./config/xdg/portals/lxqt.nix - ./config/appstream.nix - ./config/console.nix - ./config/xdg/sounds.nix - ./config/gtk/gtk-icon-cache.nix ./config/gnu.nix + ./config/gtk/gtk-icon-cache.nix ./config/i18n.nix ./config/iproute2.nix ./config/krb5/default.nix @@ -39,26 +31,32 @@ ./config/unix-odbc-drivers.nix ./config/users-groups.nix ./config/vte.nix + ./config/xdg/autostart.nix + ./config/xdg/icons.nix + ./config/xdg/menus.nix + ./config/xdg/mime.nix + ./config/xdg/portal.nix + ./config/xdg/portals/lxqt.nix + ./config/xdg/portals/wlr.nix + ./config/xdg/sounds.nix ./config/zram.nix ./hardware/acpilight.nix ./hardware/all-firmware.nix ./hardware/bladeRF.nix ./hardware/brillo.nix ./hardware/ckb-next.nix + ./hardware/corectrl.nix ./hardware/cpu/amd-microcode.nix ./hardware/cpu/amd-sev.nix ./hardware/cpu/intel-microcode.nix ./hardware/cpu/intel-sgx.nix - ./hardware/corectrl.nix - ./hardware/digitalbitbox.nix ./hardware/device-tree.nix - ./hardware/gkraken.nix + ./hardware/digitalbitbox.nix ./hardware/flirc.nix + ./hardware/gkraken.nix ./hardware/gpgsmartcards.nix - ./hardware/i2c.nix ./hardware/hackrf.nix - ./hardware/sensor/hddtemp.nix - ./hardware/sensor/iio.nix + ./hardware/i2c.nix ./hardware/keyboard/teck.nix ./hardware/keyboard/uhk.nix ./hardware/keyboard/zsa.nix @@ -71,33 +69,35 @@ ./hardware/network/intel-2200bg.nix ./hardware/new-lg4ff.nix ./hardware/nitrokey.nix + ./hardware/onlykey/default.nix ./hardware/opengl.nix ./hardware/openrazer.nix + ./hardware/opentabletdriver.nix ./hardware/pcmcia.nix ./hardware/printers.nix ./hardware/raid/hpsa.nix ./hardware/rtl-sdr.nix ./hardware/saleae-logic.nix + ./hardware/sata.nix + ./hardware/sensor/hddtemp.nix + ./hardware/sensor/iio.nix ./hardware/steam-hardware.nix ./hardware/system-76.nix ./hardware/tuxedo-keyboard.nix ./hardware/ubertooth.nix - ./hardware/usb-wwan.nix - ./hardware/usb-storage.nix - ./hardware/onlykey/default.nix - ./hardware/opentabletdriver.nix - ./hardware/sata.nix - ./hardware/wooting.nix ./hardware/uinput.nix + ./hardware/usb-storage.nix + ./hardware/usb-wwan.nix ./hardware/video/amdgpu-pro.nix - ./hardware/video/capture/mwprocapture.nix ./hardware/video/bumblebee.nix + ./hardware/video/capture/mwprocapture.nix ./hardware/video/displaylink.nix ./hardware/video/hidpi.nix ./hardware/video/nvidia.nix ./hardware/video/switcheroo-control.nix ./hardware/video/uvcvideo/default.nix ./hardware/video/webcam/facetimehd.nix + ./hardware/wooting.nix ./hardware/xone.nix ./hardware/xpadneo.nix ./i18n/input-method/default.nix @@ -105,40 +105,40 @@ ./i18n/input-method/fcitx5.nix ./i18n/input-method/hime.nix ./i18n/input-method/ibus.nix + ./i18n/input-method/kime.nix ./i18n/input-method/nabi.nix ./i18n/input-method/uim.nix - ./i18n/input-method/kime.nix ./installer/tools/tools.nix ./misc/assertions.nix ./misc/crashdump.nix ./misc/documentation.nix ./misc/extra-arguments.nix ./misc/ids.nix - ./misc/lib.nix ./misc/label.nix + ./misc/lib.nix ./misc/locate.nix ./misc/man-db.nix ./misc/mandoc.nix ./misc/meta.nix + ./misc/nixops-autoluks.nix ./misc/nixpkgs.nix ./misc/passthru.nix ./misc/version.nix ./misc/wordlist.nix - ./misc/nixops-autoluks.nix - ./programs/_1password.nix ./programs/_1password-gui.nix + ./programs/_1password.nix ./programs/adb.nix ./programs/appgate-sdp.nix ./programs/atop.nix ./programs/ausweisapp.nix ./programs/autojump.nix ./programs/bandwhich.nix - ./programs/bash/bash.nix + ./programs/bash-my-aws.nix ./programs/bash/bash-completion.nix + ./programs/bash/bash.nix ./programs/bash/blesh.nix ./programs/bash/ls-colors.nix ./programs/bash/undistract-me.nix - ./programs/bash-my-aws.nix ./programs/bcc.nix ./programs/browserpass.nix ./programs/calls.nix @@ -173,38 +173,40 @@ ./programs/gnome-disks.nix ./programs/gnome-documents.nix ./programs/gnome-terminal.nix - ./programs/gpaste.nix ./programs/gnupg.nix + ./programs/gpaste.nix ./programs/gphoto2.nix ./programs/haguichi.nix ./programs/hamster.nix ./programs/htop.nix ./programs/iftop.nix + ./programs/i3lock.nix ./programs/iotop.nix ./programs/java.nix + ./programs/k3b.nix ./programs/k40-whisperer.nix + ./programs/kbdlight.nix ./programs/kclock.nix - ./programs/k3b.nix ./programs/kdeconnect.nix - ./programs/kbdlight.nix ./programs/less.nix ./programs/liboping.nix ./programs/light.nix ./programs/mdevctl.nix ./programs/mepo.nix - ./programs/mosh.nix ./programs/mininet.nix + ./programs/mosh.nix ./programs/msmtp.nix ./programs/mtr.nix ./programs/nano.nix ./programs/nbd.nix - ./programs/nix-ld.nix ./programs/neovim.nix ./programs/nethoscope.nix + ./programs/nix-index.nix + ./programs/nix-ld.nix ./programs/nm-applet.nix ./programs/nncp.nix - ./programs/npm.nix ./programs/noisetorch.nix + ./programs/npm.nix ./programs/oblogout.nix ./programs/openvpn3.nix ./programs/pantheon-tweaks.nix @@ -215,21 +217,21 @@ ./programs/rog-control-center.nix ./programs/rust-motd.nix ./programs/screen.nix - ./programs/sedutil.nix ./programs/seahorse.nix + ./programs/sedutil.nix + ./programs/shadow.nix + ./programs/singularity.nix ./programs/skim.nix ./programs/slock.nix - ./programs/shadow.nix ./programs/spacefm.nix - ./programs/singularity.nix ./programs/ssh.nix - ./programs/sysdig.nix - ./programs/systemtap.nix ./programs/starship.nix ./programs/steam.nix ./programs/streamdeck-ui.nix ./programs/sway.nix + ./programs/sysdig.nix ./programs/system-config-printer.nix + ./programs/systemtap.nix ./programs/thefuck.nix ./programs/thunar.nix ./programs/tmux.nix @@ -243,6 +245,7 @@ ./programs/waybar.nix ./programs/weylus.nix ./programs/wireshark.nix + ./programs/xastir.nix ./programs/wshowkeys.nix ./programs/xfconf.nix ./programs/xfs_quota.nix @@ -252,10 +255,10 @@ ./programs/yabar.nix ./programs/zmap.nix ./programs/zsh/oh-my-zsh.nix - ./programs/zsh/zsh.nix ./programs/zsh/zsh-autoenv.nix ./programs/zsh/zsh-autosuggestions.nix ./programs/zsh/zsh-syntax-highlighting.nix + ./programs/zsh/zsh.nix ./rename.nix ./security/acme ./security/apparmor.nix @@ -264,23 +267,23 @@ ./security/ca.nix ./security/chromium-suid-sandbox.nix ./security/dhparams.nix + ./security/doas.nix ./security/duosec.nix ./security/google_oslogin.nix ./security/lock-kernel-modules.nix ./security/misc.nix ./security/oath.nix ./security/pam.nix - ./security/pam_usb.nix ./security/pam_mount.nix + ./security/pam_usb.nix ./security/please.nix ./security/polkit.nix ./security/rngd.nix ./security/rtkit.nix - ./security/wrappers/default.nix ./security/sudo.nix - ./security/doas.nix ./security/systemd-confinement.nix ./security/tpm2.nix + ./security/wrappers/default.nix ./services/admin/meshcentral.nix ./services/admin/oxidized.nix ./services/admin/pgadmin.nix @@ -295,17 +298,17 @@ ./services/audio/jack.nix ./services/audio/jmusicbot.nix ./services/audio/liquidsoap.nix + ./services/audio/mopidy.nix ./services/audio/mpd.nix ./services/audio/mpdscribble.nix - ./services/audio/mopidy.nix + ./services/audio/navidrome.nix ./services/audio/networkaudiod.nix ./services/audio/roon-bridge.nix - ./services/audio/navidrome.nix ./services/audio/roon-server.nix ./services/audio/slimserver.nix ./services/audio/snapserver.nix - ./services/audio/squeezelite.nix ./services/audio/spotifyd.nix + ./services/audio/squeezelite.nix ./services/audio/ympd.nix ./services/backup/automysqlbackup.nix ./services/backup/bacula.nix @@ -317,8 +320,8 @@ ./services/backup/mysql-backup.nix ./services/backup/postgresql-backup.nix ./services/backup/postgresql-wal-receiver.nix - ./services/backup/restic.nix ./services/backup/restic-rest-server.nix + ./services/backup/restic.nix ./services/backup/rsnapshot.nix ./services/backup/sanoid.nix ./services/backup/syncoid.nix @@ -326,15 +329,15 @@ ./services/backup/tsm.nix ./services/backup/zfs-replication.nix ./services/backup/znapzend.nix - ./services/blockchain/ethereum/geth.nix + ./services/backup/zrepl.nix ./services/blockchain/ethereum/erigon.nix + ./services/blockchain/ethereum/geth.nix ./services/blockchain/ethereum/lighthouse.nix - ./services/backup/zrepl.nix ./services/cluster/corosync/default.nix ./services/cluster/hadoop/default.nix ./services/cluster/k3s/default.nix - ./services/cluster/kubernetes/addons/dns.nix ./services/cluster/kubernetes/addon-manager.nix + ./services/cluster/kubernetes/addons/dns.nix ./services/cluster/kubernetes/apiserver.nix ./services/cluster/kubernetes/controller-manager.nix ./services/cluster/kubernetes/default.nix @@ -354,14 +357,14 @@ ./services/continuous-integration/buildbot/master.nix ./services/continuous-integration/buildbot/worker.nix ./services/continuous-integration/buildkite-agents.nix - ./services/continuous-integration/hail.nix - ./services/continuous-integration/hercules-ci-agent/default.nix - ./services/continuous-integration/hydra/default.nix ./services/continuous-integration/github-runner.nix ./services/continuous-integration/github-runners.nix ./services/continuous-integration/gitlab-runner.nix ./services/continuous-integration/gocd-agent/default.nix ./services/continuous-integration/gocd-server/default.nix + ./services/continuous-integration/hail.nix + ./services/continuous-integration/hercules-ci-agent/default.nix + ./services/continuous-integration/hydra/default.nix ./services/continuous-integration/jenkins/default.nix ./services/continuous-integration/jenkins/job-builder.nix ./services/continuous-integration/jenkins/slave.nix @@ -370,8 +373,8 @@ ./services/databases/clickhouse.nix ./services/databases/cockroachdb.nix ./services/databases/couchdb.nix - ./services/databases/dragonflydb.nix ./services/databases/dgraph.nix + ./services/databases/dragonflydb.nix ./services/databases/firebird.nix ./services/databases/foundationdb.nix ./services/databases/hbase-standalone.nix @@ -398,12 +401,6 @@ ./services/desktops/espanso.nix ./services/desktops/flatpak.nix ./services/desktops/geoclue2.nix - ./services/desktops/gsignond.nix - ./services/desktops/gvfs.nix - ./services/desktops/malcontent.nix - ./services/desktops/pipewire/pipewire.nix - ./services/desktops/pipewire/pipewire-media-session.nix - ./services/desktops/pipewire/wireplumber.nix ./services/desktops/gnome/at-spi2-core.nix ./services/desktops/gnome/evolution-data-server.nix ./services/desktops/gnome/glib-networking.nix @@ -417,27 +414,33 @@ ./services/desktops/gnome/gnome-user-share.nix ./services/desktops/gnome/rygel.nix ./services/desktops/gnome/sushi.nix - ./services/desktops/gnome/tracker.nix ./services/desktops/gnome/tracker-miners.nix + ./services/desktops/gnome/tracker.nix + ./services/desktops/gsignond.nix + ./services/desktops/gvfs.nix + ./services/desktops/malcontent.nix ./services/desktops/neard.nix + ./services/desktops/pipewire/pipewire-media-session.nix + ./services/desktops/pipewire/pipewire.nix + ./services/desktops/pipewire/wireplumber.nix ./services/desktops/profile-sync-daemon.nix ./services/desktops/system-config-printer.nix ./services/desktops/telepathy.nix ./services/desktops/tumbler.nix ./services/desktops/zeitgeist.nix - ./services/development/bloop.nix ./services/development/blackfire.nix + ./services/development/bloop.nix ./services/development/distccd.nix ./services/development/hoogle.nix ./services/development/jupyter/default.nix ./services/development/jupyterhub/default.nix - ./services/development/rstudio-server/default.nix ./services/development/lorri.nix + ./services/development/rstudio-server/default.nix ./services/development/zammad.nix ./services/display-managers/greetd.nix ./services/editors/emacs.nix - ./services/editors/infinoted.nix ./services/editors/haste.nix + ./services/editors/infinoted.nix ./services/finance/odoo.nix ./services/games/asf.nix ./services/games/crossfire-server.nix @@ -483,22 +486,22 @@ ./services/hardware/spacenavd.nix ./services/hardware/supergfxd.nix ./services/hardware/tcsd.nix - ./services/hardware/tlp.nix + ./services/hardware/thermald.nix ./services/hardware/thinkfan.nix ./services/hardware/throttled.nix + ./services/hardware/tlp.nix ./services/hardware/trezord.nix ./services/hardware/triggerhappy.nix ./services/hardware/udev.nix ./services/hardware/udisks2.nix + ./services/hardware/undervolt.nix ./services/hardware/upower.nix ./services/hardware/usbmuxd.nix ./services/hardware/usbrelayd.nix - ./services/hardware/thermald.nix - ./services/hardware/undervolt.nix ./services/hardware/vdr.nix + ./services/home-automation/evcc.nix ./services/home-automation/home-assistant.nix ./services/home-automation/zigbee2mqtt.nix - ./services/home-automation/evcc.nix ./services/logging/SystemdJournal2Gelf.nix ./services/logging/awstats.nix ./services/logging/filebeat.nix @@ -530,22 +533,22 @@ ./services/mail/mailhog.nix ./services/mail/mailman.nix ./services/mail/mlmmj.nix + ./services/mail/nullmailer.nix ./services/mail/offlineimap.nix ./services/mail/opendkim.nix ./services/mail/opensmtpd.nix ./services/mail/pfix-srsd.nix ./services/mail/postfix.nix ./services/mail/postfixadmin.nix - ./services/mail/postsrsd.nix ./services/mail/postgrey.nix + ./services/mail/postsrsd.nix ./services/mail/public-inbox.nix - ./services/mail/spamassassin.nix + ./services/mail/roundcube.nix ./services/mail/rspamd.nix ./services/mail/rss2email.nix - ./services/mail/roundcube.nix ./services/mail/schleuder.nix + ./services/mail/spamassassin.nix ./services/mail/sympa.nix - ./services/mail/nullmailer.nix ./services/matrix/appservice-discord.nix ./services/matrix/appservice-irc.nix ./services/matrix/conduit.nix @@ -555,32 +558,33 @@ ./services/matrix/mjolnir.nix ./services/matrix/pantalaimon.nix ./services/matrix/synapse.nix - ./services/misc/ananicy.nix ./services/misc/airsonic.nix + ./services/misc/ananicy.nix ./services/misc/ankisyncd.nix ./services/misc/apache-kafka.nix + ./services/misc/atuin.nix ./services/misc/autofs.nix ./services/misc/autorandr.nix ./services/misc/bazarr.nix ./services/misc/beanstalkd.nix ./services/misc/bees.nix ./services/misc/bepasty.nix - ./services/misc/canto-daemon.nix ./services/misc/calibre-server.nix + ./services/misc/canto-daemon.nix ./services/misc/cfdyndns.nix - ./services/misc/clipmenu.nix - ./services/misc/clipcat.nix - ./services/misc/cpuminer-cryptonight.nix ./services/misc/cgminer.nix + ./services/misc/clipcat.nix + ./services/misc/clipmenu.nix ./services/misc/confd.nix + ./services/misc/cpuminer-cryptonight.nix ./services/misc/devmon.nix ./services/misc/dictd.nix - ./services/misc/duckling.nix - ./services/misc/dwm-status.nix - ./services/misc/dysnomia.nix ./services/misc/disnix.nix ./services/misc/docker-registry.nix ./services/misc/domoticz.nix + ./services/misc/duckling.nix + ./services/misc/dwm-status.nix + ./services/misc/dysnomia.nix ./services/misc/errbot.nix ./services/misc/etcd.nix ./services/misc/etebase-server.nix @@ -592,16 +596,16 @@ ./services/misc/gammu-smsd.nix ./services/misc/geoipupdate.nix ./services/misc/gitea.nix - #./services/misc/gitit.nix + # ./services/misc/gitit.nix ./services/misc/gitlab.nix ./services/misc/gitolite.nix ./services/misc/gitweb.nix ./services/misc/gogs.nix ./services/misc/gollum.nix ./services/misc/gpsd.nix + ./services/misc/greenclip.nix ./services/misc/headphones.nix ./services/misc/heisenbridge.nix - ./services/misc/greenclip.nix ./services/misc/ihaskell.nix ./services/misc/input-remapper.nix ./services/misc/irkerd.nix @@ -609,11 +613,11 @@ ./services/misc/jellyfin.nix ./services/misc/klipper.nix ./services/misc/languagetool.nix - ./services/misc/logkeys.nix ./services/misc/leaps.nix - ./services/misc/lidarr.nix ./services/misc/libreddit.nix + ./services/misc/lidarr.nix ./services/misc/lifecycled.nix + ./services/misc/logkeys.nix ./services/misc/mame.nix ./services/misc/mbpfan.nix ./services/misc/mediatomb.nix @@ -638,23 +642,22 @@ ./services/misc/paperless.nix ./services/misc/parsoid.nix ./services/misc/persistent-evdev.nix + ./services/misc/pinnwand.nix ./services/misc/plex.nix ./services/misc/plikd.nix ./services/misc/podgrab.nix ./services/misc/polaris.nix ./services/misc/portunus.nix ./services/misc/prowlarr.nix - ./services/misc/tautulli.nix - ./services/misc/pinnwand.nix ./services/misc/pykms.nix ./services/misc/radarr.nix ./services/misc/redmine.nix - ./services/misc/rippled.nix ./services/misc/ripple-data-api.nix + ./services/misc/rippled.nix ./services/misc/rmfakecloud.nix - ./services/misc/serviio.nix ./services/misc/safeeyes.nix ./services/misc/sdrplay.nix + ./services/misc/serviio.nix ./services/misc/sickbeard.nix ./services/misc/signald.nix ./services/misc/siproxd.nix @@ -672,6 +675,7 @@ ./services/misc/sysprof.nix ./services/misc/tandoor-recipes.nix ./services/misc/taskserver + ./services/misc/tautulli.nix ./services/misc/tiddlywiki.nix ./services/misc/tp-auto-kbbl.nix ./services/misc/tzupdate.nix @@ -691,10 +695,10 @@ ./services/monitoring/datadog-agent.nix ./services/monitoring/do-agent.nix ./services/monitoring/fusion-inventory.nix - ./services/monitoring/grafana.nix ./services/monitoring/grafana-agent.nix ./services/monitoring/grafana-image-renderer.nix ./services/monitoring/grafana-reporter.nix + ./services/monitoring/grafana.nix ./services/monitoring/graphite.nix ./services/monitoring/hdaps.nix ./services/monitoring/heapster.nix @@ -712,17 +716,18 @@ ./services/monitoring/nagios.nix ./services/monitoring/netdata.nix ./services/monitoring/parsedmarc.nix - ./services/monitoring/prometheus/default.nix ./services/monitoring/prometheus/alertmanager.nix + ./services/monitoring/prometheus/default.nix ./services/monitoring/prometheus/exporters.nix ./services/monitoring/prometheus/pushgateway.nix ./services/monitoring/prometheus/sachet.nix ./services/monitoring/prometheus/xmpp-alerts.nix - ./services/monitoring/riemann.nix ./services/monitoring/riemann-dash.nix ./services/monitoring/riemann-tools.nix + ./services/monitoring/riemann.nix ./services/monitoring/scollector.nix ./services/monitoring/smartd.nix + ./services/monitoring/statsd.nix ./services/monitoring/sysstat.nix ./services/monitoring/teamviewer.nix ./services/monitoring/telegraf.nix @@ -731,38 +736,38 @@ ./services/monitoring/tuptime.nix ./services/monitoring/unpoller.nix ./services/monitoring/ups.nix + ./services/monitoring/uptime-kuma.nix ./services/monitoring/uptime.nix ./services/monitoring/vmagent.nix - ./services/monitoring/uptime-kuma.nix ./services/monitoring/vnstat.nix ./services/monitoring/zabbix-agent.nix ./services/monitoring/zabbix-proxy.nix ./services/monitoring/zabbix-server.nix ./services/network-filesystems/cachefilesd.nix + ./services/network-filesystems/ceph.nix ./services/network-filesystems/davfs2.nix + ./services/network-filesystems/diod.nix ./services/network-filesystems/drbd.nix ./services/network-filesystems/glusterfs.nix ./services/network-filesystems/kbfs.nix ./services/network-filesystems/kubo.nix ./services/network-filesystems/litestream/default.nix + ./services/network-filesystems/moosefs.nix ./services/network-filesystems/netatalk.nix ./services/network-filesystems/nfsd.nix - ./services/network-filesystems/moosefs.nix ./services/network-filesystems/openafs/client.nix ./services/network-filesystems/openafs/server.nix - ./services/network-filesystems/orangefs/server.nix ./services/network-filesystems/orangefs/client.nix + ./services/network-filesystems/orangefs/server.nix ./services/network-filesystems/rsyncd.nix - ./services/network-filesystems/samba.nix ./services/network-filesystems/samba-wsdd.nix + ./services/network-filesystems/samba.nix ./services/network-filesystems/tahoe.nix - ./services/network-filesystems/diod.nix ./services/network-filesystems/u9fs.nix - ./services/network-filesystems/webdav.nix ./services/network-filesystems/webdav-server-rs.nix - ./services/network-filesystems/yandex-disk.nix + ./services/network-filesystems/webdav.nix ./services/network-filesystems/xtreemfs.nix - ./services/network-filesystems/ceph.nix + ./services/network-filesystems/yandex-disk.nix ./services/networking/3proxy.nix ./services/networking/adguardhome.nix ./services/networking/amuled.nix @@ -770,16 +775,16 @@ ./services/networking/aria2.nix ./services/networking/asterisk.nix ./services/networking/atftpd.nix + ./services/networking/autossh.nix ./services/networking/avahi-daemon.nix ./services/networking/babeld.nix - ./services/networking/bee.nix ./services/networking/bee-clef.nix + ./services/networking/bee.nix ./services/networking/biboumi.nix ./services/networking/bind.nix - ./services/networking/bitcoind.nix - ./services/networking/autossh.nix - ./services/networking/bird.nix ./services/networking/bird-lg.nix + ./services/networking/bird.nix + ./services/networking/bitcoind.nix ./services/networking/bitlbee.nix ./services/networking/blockbook-frontend.nix ./services/networking/blocky.nix @@ -787,6 +792,7 @@ ./services/networking/chisel-server.nix ./services/networking/cjdns.nix ./services/networking/cloudflare-dyndns.nix + ./services/networking/cloudflared.nix ./services/networking/cntlm.nix ./services/networking/connman.nix ./services/networking/consul.nix @@ -805,8 +811,6 @@ ./services/networking/dnsdist.nix ./services/networking/dnsmasq.nix ./services/networking/doh-proxy-rust.nix - ./services/networking/ncdns.nix - ./services/networking/nomad.nix ./services/networking/ejabberd.nix ./services/networking/envoy.nix ./services/networking/epmd.nix @@ -819,6 +823,8 @@ ./services/networking/firefox-syncserver.nix ./services/networking/fireqos.nix ./services/networking/firewall.nix + ./services/networking/firewall-iptables.nix + ./services/networking/firewall-nftables.nix ./services/networking/flannel.nix ./services/networking/freenet.nix ./services/networking/freeradius.nix @@ -841,10 +847,10 @@ ./services/networking/htpdate.nix ./services/networking/https-dns-proxy.nix ./services/networking/hylafax/default.nix - ./services/networking/i2pd.nix ./services/networking/i2p.nix - ./services/networking/icecream/scheduler.nix + ./services/networking/i2pd.nix ./services/networking/icecream/daemon.nix + ./services/networking/icecream/scheduler.nix ./services/networking/inspircd.nix ./services/networking/iodine.nix ./services/networking/iperf3.nix @@ -869,14 +875,15 @@ ./services/networking/lxd-image-server.nix ./services/networking/magic-wormhole-mailbox-server.nix ./services/networking/matterbridge.nix - ./services/networking/mjpg-streamer.nix ./services/networking/minidlna.nix ./services/networking/miniupnpd.nix - ./services/networking/mosquitto.nix + ./services/networking/miredo.nix + ./services/networking/mjpg-streamer.nix + ./services/networking/mmsd.nix ./services/networking/monero.nix ./services/networking/morty.nix + ./services/networking/mosquitto.nix ./services/networking/mozillavpn.nix - ./services/networking/miredo.nix ./services/networking/mstpd.nix ./services/networking/mtprotoproxy.nix ./services/networking/mtr-exporter.nix @@ -887,20 +894,24 @@ ./services/networking/namecoind.nix ./services/networking/nar-serve.nix ./services/networking/nat.nix + ./services/networking/nat-iptables.nix + ./services/networking/nat-nftables.nix ./services/networking/nats.nix ./services/networking/nbd.nix + ./services/networking/ncdns.nix ./services/networking/ndppd.nix ./services/networking/nebula.nix ./services/networking/netbird.nix ./services/networking/networkmanager.nix ./services/networking/nextdns.nix ./services/networking/nftables.nix - ./services/networking/ngircd.nix ./services/networking/nghttpx/default.nix + ./services/networking/ngircd.nix ./services/networking/nix-serve.nix ./services/networking/nix-store-gcs-proxy.nix ./services/networking/nixops-dns.nix ./services/networking/nntp-proxy.nix + ./services/networking/nomad.nix ./services/networking/nsd.nix ./services/networking/ntopng.nix ./services/networking/ntp/chrony.nix @@ -916,20 +927,20 @@ ./services/networking/openvpn.nix ./services/networking/ostinato.nix ./services/networking/owamp.nix + ./services/networking/pdns-recursor.nix ./services/networking/pdnsd.nix ./services/networking/pixiecore.nix ./services/networking/pleroma.nix ./services/networking/polipo.nix ./services/networking/powerdns.nix - ./services/networking/pdns-recursor.nix ./services/networking/pppd.nix ./services/networking/pptpd.nix ./services/networking/prayer.nix ./services/networking/privoxy.nix ./services/networking/prosody.nix ./services/networking/quassel.nix - ./services/networking/quorum.nix ./services/networking/quicktun.nix + ./services/networking/quorum.nix ./services/networking/r53-ddns.nix ./services/networking/radicale.nix ./services/networking/radvd.nix @@ -943,60 +954,59 @@ ./services/networking/sabnzbd.nix ./services/networking/seafile.nix ./services/networking/searx.nix - ./services/networking/skydns.nix ./services/networking/shadowsocks.nix ./services/networking/shairport-sync.nix ./services/networking/shellhub-agent.nix ./services/networking/shorewall.nix ./services/networking/shorewall6.nix ./services/networking/shout.nix - ./services/networking/sniproxy.nix - ./services/networking/snowflake-proxy.nix + ./services/networking/skydns.nix ./services/networking/smartdns.nix ./services/networking/smokeping.nix + ./services/networking/sniproxy.nix + ./services/networking/snowflake-proxy.nix ./services/networking/softether.nix - ./services/networking/solanum.nix ./services/networking/soju.nix + ./services/networking/solanum.nix ./services/networking/spacecookie.nix ./services/networking/spiped.nix ./services/networking/squid.nix - ./services/networking/sslh.nix ./services/networking/ssh/lshd.nix ./services/networking/ssh/sshd.nix - ./services/networking/strongswan.nix + ./services/networking/sslh.nix ./services/networking/strongswan-swanctl/module.nix - ./services/networking/stunnel.nix + ./services/networking/strongswan.nix ./services/networking/stubby.nix + ./services/networking/stunnel.nix ./services/networking/supplicant.nix ./services/networking/supybot.nix - ./services/networking/syncthing.nix - ./services/networking/syncthing-relay.nix ./services/networking/syncplay.nix + ./services/networking/syncthing-relay.nix + ./services/networking/syncthing.nix ./services/networking/tailscale.nix ./services/networking/tayga.nix ./services/networking/tcpcrypt.nix ./services/networking/teamspeak3.nix ./services/networking/tedicross.nix - ./services/networking/tetrd.nix ./services/networking/teleport.nix + ./services/networking/tetrd.nix + ./services/networking/tftpd.nix ./services/networking/thelounge.nix ./services/networking/tinc.nix ./services/networking/tinydns.nix - ./services/networking/tftpd.nix ./services/networking/tmate-ssh-server.nix - ./services/networking/trickster.nix ./services/networking/tox-bootstrapd.nix ./services/networking/tox-node.nix ./services/networking/toxvpn.nix + ./services/networking/trickster.nix ./services/networking/tvheadend.nix ./services/networking/twingate.nix ./services/networking/ucarp.nix ./services/networking/unbound.nix ./services/networking/unifi.nix - ./services/video/unifi-video.nix - ./services/video/rtsp-simple-server.nix ./services/networking/uptermd.nix ./services/networking/v2ray.nix + ./services/networking/v2raya.nix ./services/networking/vdirsyncer.nix ./services/networking/vsftpd.nix ./services/networking/wasabibackend.nix @@ -1005,10 +1015,10 @@ ./services/networking/wg-quick.nix ./services/networking/wireguard.nix ./services/networking/wpa_supplicant.nix + ./services/networking/x2goserver.nix ./services/networking/xandikos.nix ./services/networking/xinetd.nix ./services/networking/xl2tpd.nix - ./services/networking/x2goserver.nix ./services/networking/xray.nix ./services/networking/xrdp.nix ./services/networking/yggdrasil.nix @@ -1018,11 +1028,12 @@ ./services/networking/znc/default.nix ./services/printing/cupsd.nix ./services/printing/ipp-usb.nix + ./services/printing/cups-pdf.nix ./services/scheduling/atd.nix ./services/scheduling/cron.nix ./services/scheduling/fcron.nix - ./services/search/elasticsearch.nix ./services/search/elasticsearch-curator.nix + ./services/search/elasticsearch.nix ./services/search/hound.nix ./services/search/kibana.nix ./services/search/meilisearch.nix @@ -1031,25 +1042,25 @@ ./services/security/certmgr.nix ./services/security/cfssl.nix ./services/security/clamav.nix - ./services/security/endlessh.nix ./services/security/endlessh-go.nix + ./services/security/endlessh.nix ./services/security/fail2ban.nix ./services/security/fprintd.nix ./services/security/haka.nix ./services/security/haveged.nix ./services/security/hockeypuck.nix - ./services/security/hologram-server.nix ./services/security/hologram-agent.nix - ./services/security/kanidm.nix + ./services/security/hologram-server.nix ./services/security/infnoise.nix + ./services/security/kanidm.nix ./services/security/munge.nix ./services/security/nginx-sso.nix ./services/security/oauth2_proxy.nix ./services/security/oauth2_proxy_nginx.nix ./services/security/opensnitch.nix ./services/security/pass-secret-service.nix - ./services/security/privacyidea.nix ./services/security/physlock.nix + ./services/security/privacyidea.nix ./services/security/shibboleth-sp.nix ./services/security/sks.nix ./services/security/sshguard.nix @@ -1068,8 +1079,8 @@ ./services/system/cloud-init.nix ./services/system/dbus.nix ./services/system/earlyoom.nix - ./services/system/localtimed.nix ./services/system/kerberos/default.nix + ./services/system/localtimed.nix ./services/system/nscd.nix ./services/system/saslauthd.nix ./services/system/self-deploy.nix @@ -1086,19 +1097,22 @@ ./services/ttys/getty.nix ./services/ttys/gpm.nix ./services/ttys/kmscon.nix - ./services/wayland/cage.nix ./services/video/epgstation/default.nix ./services/video/mirakurun.nix ./services/video/replay-sorcery.nix + ./services/video/rtsp-simple-server.nix + ./services/video/unifi-video.nix + ./services/wayland/cage.nix + ./services/web-apps/akkoma.nix ./services/web-apps/alps.nix ./services/web-apps/atlassian/confluence.nix ./services/web-apps/atlassian/crowd.nix ./services/web-apps/atlassian/jira.nix + ./services/web-apps/baget.nix ./services/web-apps/bookstack.nix ./services/web-apps/calibre-web.nix - ./services/web-apps/code-server.nix - ./services/web-apps/baget.nix ./services/web-apps/changedetection-io.nix + ./services/web-apps/code-server.nix ./services/web-apps/convos.nix ./services/web-apps/dex.nix ./services/web-apps/discourse.nix @@ -1119,16 +1133,17 @@ ./services/web-apps/icingaweb2/icingaweb2.nix ./services/web-apps/icingaweb2/module-monitoring.nix ./services/web-apps/ihatemoney + ./services/web-apps/invidious.nix + ./services/web-apps/invoiceplane.nix ./services/web-apps/isso.nix ./services/web-apps/jirafeau.nix ./services/web-apps/jitsi-meet.nix ./services/web-apps/keycloak.nix ./services/web-apps/komga.nix ./services/web-apps/lemmy.nix - ./services/web-apps/invidious.nix - ./services/web-apps/invoiceplane.nix ./services/web-apps/limesurvey.nix ./services/web-apps/mastodon.nix + ./services/web-apps/matomo.nix ./services/web-apps/mattermost.nix ./services/web-apps/mediawiki.nix ./services/web-apps/miniflux.nix @@ -1138,30 +1153,29 @@ ./services/web-apps/nexus.nix ./services/web-apps/nifi.nix ./services/web-apps/node-red.nix - ./services/web-apps/phylactery.nix ./services/web-apps/onlyoffice.nix - ./services/web-apps/pict-rs.nix - ./services/web-apps/peertube.nix + ./services/web-apps/openwebrx.nix + ./services/web-apps/outline.nix ./services/web-apps/peering-manager.nix + ./services/web-apps/peertube.nix + ./services/web-apps/pgpkeyserver-lite.nix + ./services/web-apps/phylactery.nix + ./services/web-apps/pict-rs.nix ./services/web-apps/plantuml-server.nix ./services/web-apps/plausible.nix - ./services/web-apps/pgpkeyserver-lite.nix ./services/web-apps/powerdns-admin.nix ./services/web-apps/prosody-filer.nix - ./services/web-apps/matomo.nix - ./services/web-apps/openwebrx.nix - ./services/web-apps/outline.nix ./services/web-apps/restya-board.nix - ./services/web-apps/sogo.nix ./services/web-apps/rss-bridge.nix - ./services/web-apps/tt-rss.nix - ./services/web-apps/trilium.nix ./services/web-apps/selfoss.nix ./services/web-apps/shiori.nix ./services/web-apps/snipe-it.nix + ./services/web-apps/sogo.nix + ./services/web-apps/trilium.nix + ./services/web-apps/tt-rss.nix ./services/web-apps/vikunja.nix - ./services/web-apps/wiki-js.nix ./services/web-apps/whitebophir.nix + ./services/web-apps/wiki-js.nix ./services/web-apps/wordpress.nix ./services/web-apps/writefreely.nix ./services/web-apps/youtrack.nix @@ -1175,6 +1189,7 @@ ./services/web-servers/hitch/default.nix ./services/web-servers/hydron.nix ./services/web-servers/jboss/default.nix + ./services/web-servers/keter ./services/web-servers/lighttpd/cgit.nix ./services/web-servers/lighttpd/collectd.nix ./services/web-servers/lighttpd/default.nix @@ -1187,21 +1202,16 @@ ./services/web-servers/nginx/gitweb.nix ./services/web-servers/phpfpm/default.nix ./services/web-servers/pomerium.nix - ./services/web-servers/unit/default.nix ./services/web-servers/tomcat.nix - ./services/web-servers/keter ./services/web-servers/traefik.nix ./services/web-servers/trafficserver/default.nix ./services/web-servers/ttyd.nix + ./services/web-servers/unit/default.nix ./services/web-servers/uwsgi.nix ./services/web-servers/varnish/default.nix ./services/web-servers/zope2.nix - ./services/x11/extra-layouts.nix ./services/x11/clight.nix ./services/x11/colord.nix - ./services/x11/picom.nix - ./services/x11/unclutter.nix - ./services/x11/unclutter-xfixes.nix ./services/x11/desktop-managers/default.nix ./services/x11/display-managers/default.nix ./services/x11/display-managers/gdm.nix @@ -1211,24 +1221,30 @@ ./services/x11/display-managers/startx.nix ./services/x11/display-managers/sx.nix ./services/x11/display-managers/xpra.nix + ./services/x11/extra-layouts.nix ./services/x11/fractalart.nix + ./services/x11/gdk-pixbuf.nix + ./services/x11/hardware/cmt.nix + ./services/x11/hardware/digimend.nix ./services/x11/hardware/libinput.nix ./services/x11/hardware/synaptics.nix ./services/x11/hardware/wacom.nix - ./services/x11/hardware/digimend.nix - ./services/x11/hardware/cmt.nix - ./services/x11/gdk-pixbuf.nix ./services/x11/imwheel.nix + ./services/x11/picom.nix ./services/x11/redshift.nix ./services/x11/touchegg.nix + ./services/x11/unclutter-xfixes.nix + ./services/x11/unclutter.nix ./services/x11/urserver.nix ./services/x11/urxvtd.nix ./services/x11/window-managers/awesome.nix - ./services/x11/window-managers/default.nix + ./services/x11/window-managers/bspwm.nix ./services/x11/window-managers/clfswm.nix + ./services/x11/window-managers/default.nix ./services/x11/window-managers/fluxbox.nix ./services/x11/window-managers/icewm.nix ./services/x11/window-managers/bspwm.nix + ./services/x11/window-managers/katriawm.nix ./services/x11/window-managers/metacity.nix ./services/x11/window-managers/none.nix ./services/x11/window-managers/twm.nix @@ -1241,13 +1257,14 @@ ./services/x11/xserver.nix ./system/activation/activation-script.nix ./system/activation/specialisation.nix + ./system/activation/bootspec.nix ./system/activation/top-level.nix ./system/boot/binfmt.nix ./system/boot/emergency-mode.nix ./system/boot/grow-partition.nix ./system/boot/initrd-network.nix - ./system/boot/initrd-ssh.nix ./system/boot/initrd-openvpn.nix + ./system/boot/initrd-ssh.nix ./system/boot/kernel.nix ./system/boot/kexec.nix ./system/boot/loader/efi.nix @@ -1256,6 +1273,7 @@ ./system/boot/loader/grub/grub.nix ./system/boot/loader/grub/ipxe.nix ./system/boot/loader/grub/memtest.nix + ./system/boot/loader/external/external.nix ./system/boot/loader/init-script/init-script.nix ./system/boot/loader/loader.nix ./system/boot/loader/raspberrypi/raspberrypi.nix @@ -1293,6 +1311,7 @@ ./tasks/filesystems/btrfs.nix ./tasks/filesystems/cifs.nix ./tasks/filesystems/ecryptfs.nix + ./tasks/filesystems/envfs.nix ./tasks/filesystems/exfat.nix ./tasks/filesystems/ext.nix ./tasks/filesystems/f2fs.nix @@ -1306,35 +1325,35 @@ ./tasks/filesystems/xfs.nix ./tasks/filesystems/zfs.nix ./tasks/lvm.nix - ./tasks/network-interfaces.nix - ./tasks/network-interfaces-systemd.nix ./tasks/network-interfaces-scripted.nix + ./tasks/network-interfaces-systemd.nix + ./tasks/network-interfaces.nix + ./tasks/powertop.nix ./tasks/scsi-link-power-management.nix ./tasks/snapraid.nix ./tasks/stratis.nix ./tasks/swraid.nix ./tasks/trackpoint.nix - ./tasks/powertop.nix ./testing/service-runner.nix + ./virtualisation/amazon-options.nix ./virtualisation/anbox.nix ./virtualisation/appvm.nix ./virtualisation/build-vm.nix ./virtualisation/container-config.nix ./virtualisation/containerd.nix ./virtualisation/containers.nix - ./virtualisation/nixos-containers.nix - ./virtualisation/oci-containers.nix ./virtualisation/cri-o.nix - ./virtualisation/docker.nix ./virtualisation/docker-rootless.nix + ./virtualisation/docker.nix ./virtualisation/ecs-agent.nix + ./virtualisation/hyperv-guest.nix + ./virtualisation/kvmgt.nix ./virtualisation/libvirtd.nix ./virtualisation/lxc.nix ./virtualisation/lxcfs.nix ./virtualisation/lxd.nix - ./virtualisation/amazon-options.nix - ./virtualisation/hyperv-guest.nix - ./virtualisation/kvmgt.nix + ./virtualisation/nixos-containers.nix + ./virtualisation/oci-containers.nix ./virtualisation/openstack-options.nix ./virtualisation/openvswitch.nix ./virtualisation/parallels-guest.nix @@ -1347,7 +1366,7 @@ ./virtualisation/vmware-guest.nix ./virtualisation/vmware-host.nix ./virtualisation/waydroid.nix - ./virtualisation/xen-dom0.nix ./virtualisation/xe-guest-utilities.nix + ./virtualisation/xen-dom0.nix { documentation.nixos.extraModules = [ ./virtualisation/qemu-vm.nix ]; } ] diff --git a/nixos/modules/profiles/base.nix b/nixos/modules/profiles/base.nix index eebc0df1040c..616b2470dcb4 100644 --- a/nixos/modules/profiles/base.nix +++ b/nixos/modules/profiles/base.nix @@ -42,6 +42,7 @@ pkgs.smartmontools # for diagnosing hard disks pkgs.pciutils pkgs.usbutils + pkgs.nvme-cli # Tools to create / manipulate filesystems. pkgs.ntfsprogs # for resizing NTFS partitions diff --git a/nixos/modules/profiles/keys/ssh_host_ed25519_key b/nixos/modules/profiles/keys/ssh_host_ed25519_key new file mode 100644 index 000000000000..b18489795369 --- /dev/null +++ b/nixos/modules/profiles/keys/ssh_host_ed25519_key @@ -0,0 +1,7 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW +QyNTUxOQAAACCQVnMW/wZWqrdWrjrRPhfEFFq1KLYguagSflLhFnVQmwAAAJASuMMnErjD +JwAAAAtzc2gtZWQyNTUxOQAAACCQVnMW/wZWqrdWrjrRPhfEFFq1KLYguagSflLhFnVQmw +AAAEDIN2VWFyggtoSPXcAFy8dtG1uAig8sCuyE21eMDt2GgJBWcxb/Blaqt1auOtE+F8QU +WrUotiC5qBJ+UuEWdVCbAAAACnJvb3RAbml4b3MBAgM= +-----END OPENSSH PRIVATE KEY----- diff --git a/nixos/modules/profiles/keys/ssh_host_ed25519_key.pub b/nixos/modules/profiles/keys/ssh_host_ed25519_key.pub new file mode 100644 index 000000000000..2c45826715fc --- /dev/null +++ b/nixos/modules/profiles/keys/ssh_host_ed25519_key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBWcxb/Blaqt1auOtE+F8QUWrUotiC5qBJ+UuEWdVCb root@nixos diff --git a/nixos/modules/profiles/macos-builder.nix b/nixos/modules/profiles/macos-builder.nix new file mode 100644 index 000000000000..a981814730a1 --- /dev/null +++ b/nixos/modules/profiles/macos-builder.nix @@ -0,0 +1,163 @@ +{ config, lib, pkgs, ... }: + +let + keysDirectory = "/var/keys"; + + user = "builder"; + + keyType = "ed25519"; + +in + +{ imports = [ + ../virtualisation/qemu-vm.nix + + # Avoid a dependency on stateVersion + { + disabledModules = [ + ../virtualisation/nixos-containers.nix + ../services/x11/desktop-managers/xterm.nix + ]; + config = { + }; + options.boot.isContainer = lib.mkOption { default = false; internal = true; }; + } + ]; + + # The builder is not intended to be used interactively + documentation.enable = false; + + environment.etc = { + "ssh/ssh_host_ed25519_key" = { + mode = "0600"; + + source = ./keys/ssh_host_ed25519_key; + }; + + "ssh/ssh_host_ed25519_key.pub" = { + mode = "0644"; + + source = ./keys/ssh_host_ed25519_key.pub; + }; + }; + + # DNS fails for QEMU user networking (SLiRP) on macOS. See: + # + # https://github.com/utmapp/UTM/issues/2353 + # + # This works around that by using a public DNS server other than the DNS + # server that QEMU provides (normally 10.0.2.3) + networking.nameservers = [ "8.8.8.8" ]; + + nix.settings = { + auto-optimise-store = true; + + min-free = 1024 * 1024 * 1024; + + max-free = 3 * 1024 * 1024 * 1024; + + trusted-users = [ "root" user ]; + }; + + services.openssh = { + enable = true; + + authorizedKeysFiles = [ "${keysDirectory}/%u_${keyType}.pub" ]; + }; + + system.build.macos-builder-installer = + let + privateKey = "/etc/nix/${user}_${keyType}"; + + publicKey = "${privateKey}.pub"; + + # This installCredentials script is written so that it's as easy as + # possible for a user to audit before confirming the `sudo` + installCredentials = hostPkgs.writeShellScript "install-credentials" '' + KEYS="''${1}" + INSTALL=${hostPkgs.coreutils}/bin/install + "''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey} + "''${INSTALL}" -g nixbld -m 644 "''${KEYS}/${user}_${keyType}.pub" ${publicKey} + ''; + + hostPkgs = config.virtualisation.host.pkgs; + + script = hostPkgs.writeShellScriptBin "create-builder" '' + KEYS="''${KEYS:-./keys}" + ${hostPkgs.coreutils}/bin/mkdir --parent "''${KEYS}" + PRIVATE_KEY="''${KEYS}/${user}_${keyType}" + PUBLIC_KEY="''${PRIVATE_KEY}.pub" + if [ ! -e "''${PRIVATE_KEY}" ] || [ ! -e "''${PUBLIC_KEY}" ]; then + ${hostPkgs.coreutils}/bin/rm --force -- "''${PRIVATE_KEY}" "''${PUBLIC_KEY}" + ${hostPkgs.openssh}/bin/ssh-keygen -q -f "''${PRIVATE_KEY}" -t ${keyType} -N "" -C 'builder@localhost' + fi + if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then + (set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}") + fi + KEYS="$(nix-store --add "$KEYS")" ${config.system.build.vm}/bin/run-nixos-vm + ''; + + in + script.overrideAttrs (old: { + meta = (old.meta or { }) // { + platforms = lib.platforms.darwin; + }; + }); + + system = { + # To prevent gratuitous rebuilds on each change to Nixpkgs + nixos.revision = null; + + stateVersion = lib.mkDefault (throw '' + The macOS linux builder should not need a stateVersion to be set, but a module + has accessed stateVersion nonetheless. + Please inspect the trace of the following command to figure out which module + has a dependency on stateVersion. + + nix-instantiate --attr darwin.builder --show-trace + ''); + }; + + users.users."${user}"= { + isNormalUser = true; + }; + + virtualisation = { + diskSize = 20 * 1024; + + memorySize = 3 * 1024; + + forwardPorts = [ + { from = "host"; guest.port = 22; host.port = 22; } + ]; + + # Disable graphics for the builder since users will likely want to run it + # non-interactively in the background. + graphics = false; + + sharedDirectories.keys = { + source = "\"$KEYS\""; + target = keysDirectory; + }; + + # If we don't enable this option then the host will fail to delegate builds + # to the guest, because: + # + # - The host will lock the path to build + # - The host will delegate the build to the guest + # - The guest will attempt to lock the same path and fail because + # the lockfile on the host is visible on the guest + # + # Snapshotting the host's /nix/store as an image isolates the guest VM's + # /nix/store from the host's /nix/store, preventing this problem. + useNixStoreImage = true; + + # Obviously the /nix/store needs to be writable on the guest in order for it + # to perform builds. + writableStore = true; + + # This ensures that anything built on the guest isn't lost when the guest is + # restarted. + writableStoreUseTmpfs = false; + }; +} diff --git a/nixos/modules/programs/firefox.nix b/nixos/modules/programs/firefox.nix index dfd912cdf5c1..3a5105c57d76 100644 --- a/nixos/modules/programs/firefox.nix +++ b/nixos/modules/programs/firefox.nix @@ -42,7 +42,7 @@ in description = mdDoc '' Group policies to install. - See [Mozilla's documentation](https://github.com/mozilla/policy-templates/blob/master/README.md") + See [Mozilla's documentation](https://github.com/mozilla/policy-templates/blob/master/README.md) for a list of available options. This can be used to install extensions declaratively! Check out the @@ -79,6 +79,114 @@ in ''; }; + languagePacks = mkOption { + # Available languages can be found in https://releases.mozilla.org/pub/firefox/releases/${cfg.package.version}/linux-x86_64/xpi/ + type = types.listOf (types.enum ([ + "ach" + "af" + "an" + "ar" + "ast" + "az" + "be" + "bg" + "bn" + "br" + "bs" + "ca-valencia" + "ca" + "cak" + "cs" + "cy" + "da" + "de" + "dsb" + "el" + "en-CA" + "en-GB" + "en-US" + "eo" + "es-AR" + "es-CL" + "es-ES" + "es-MX" + "et" + "eu" + "fa" + "ff" + "fi" + "fr" + "fy-NL" + "ga-IE" + "gd" + "gl" + "gn" + "gu-IN" + "he" + "hi-IN" + "hr" + "hsb" + "hu" + "hy-AM" + "ia" + "id" + "is" + "it" + "ja" + "ka" + "kab" + "kk" + "km" + "kn" + "ko" + "lij" + "lt" + "lv" + "mk" + "mr" + "ms" + "my" + "nb-NO" + "ne-NP" + "nl" + "nn-NO" + "oc" + "pa-IN" + "pl" + "pt-BR" + "pt-PT" + "rm" + "ro" + "ru" + "sco" + "si" + "sk" + "sl" + "son" + "sq" + "sr" + "sv-SE" + "szl" + "ta" + "te" + "th" + "tl" + "tr" + "trs" + "uk" + "ur" + "uz" + "vi" + "xh" + "zh-CN" + "zh-TW" + ])); + default = [ ]; + description = mdDoc '' + The language packs to install. + ''; + }; + autoConfig = mkOption { type = types.lines; default = ""; @@ -136,10 +244,19 @@ in }; # Preferences are converted into a policy - programs.firefox.policies = mkIf (cfg.preferences != { }) { + programs.firefox.policies = { Preferences = (mapAttrs (_: value: { Value = value; Status = cfg.preferencesStatus; }) cfg.preferences); + ExtensionSettings = listToAttrs (map + (lang: nameValuePair + "langpack-${lang}@firefox.mozilla.org" + { + installation_mode = "normal_installed"; + install_url = "https://releases.mozilla.org/pub/firefox/releases/${cfg.package.version}/linux-x86_64/xpi/${lang}.xpi"; + } + ) + cfg.languagePacks); }; }; diff --git a/nixos/modules/programs/firejail.nix b/nixos/modules/programs/firejail.nix index a98c15a04517..6f79c13d94b4 100644 --- a/nixos/modules/programs/firejail.nix +++ b/nixos/modules/programs/firejail.nix @@ -8,18 +8,21 @@ let wrappedBins = pkgs.runCommand "firejail-wrapped-binaries" { preferLocalBuild = true; allowSubstitutes = false; + # take precedence over non-firejailed versions + meta.priority = -1; } '' mkdir -p $out/bin + mkdir -p $out/share/applications ${lib.concatStringsSep "\n" (lib.mapAttrsToList (command: value: let opts = if builtins.isAttrs value then value - else { executable = value; profile = null; extraArgs = []; }; + else { executable = value; desktop = null; profile = null; extraArgs = []; }; args = lib.escapeShellArgs ( opts.extraArgs ++ (optional (opts.profile != null) "--profile=${toString opts.profile}") - ); + ); in '' cat <<_EOF >$out/bin/${command} @@ -27,6 +30,11 @@ let exec /run/wrappers/bin/firejail ${args} -- ${toString opts.executable} "\$@" _EOF chmod 0755 $out/bin/${command} + + ${lib.optionalString (opts.desktop != null) '' + substitute ${opts.desktop} $out/share/applications/$(basename ${opts.desktop}) \ + --replace ${opts.executable} $out/bin/${command} + ''} '') cfg.wrappedBinaries)} ''; @@ -42,6 +50,12 @@ in { description = lib.mdDoc "Executable to run sandboxed"; example = literalExpression ''"''${lib.getBin pkgs.firefox}/bin/firefox"''; }; + desktop = mkOption { + type = types.nullOr types.path; + default = null; + description = lib.mkDoc ".desktop file to modify. Only necessary if it uses the absolute path to the executable."; + example = literalExpression ''"''${pkgs.firefox}/share/applications/firefox.desktop"''; + }; profile = mkOption { type = types.nullOr types.path; default = null; @@ -71,12 +85,6 @@ in { ''; description = lib.mdDoc '' Wrap the binaries in firejail and place them in the global path. - - You will get file collisions if you put the actual application binary in - the global environment (such as by adding the application package to - `environment.systemPackages`), and applications started via - .desktop files are not wrapped if they specify the absolute path to the - binary. ''; }; }; diff --git a/nixos/modules/programs/git.nix b/nixos/modules/programs/git.nix index acff5dfdd888..4e271a8c134b 100644 --- a/nixos/modules/programs/git.nix +++ b/nixos/modules/programs/git.nix @@ -20,15 +20,41 @@ in }; config = mkOption { - type = with types; attrsOf (attrsOf anything); - default = { }; + type = + with types; + let + gitini = attrsOf (attrsOf anything); + in + either gitini (listOf gitini) // { + merge = loc: defs: + let + config = foldl' + (acc: { value, ... }@x: acc // (if isList value then { + ordered = acc.ordered ++ value; + } else { + unordered = acc.unordered ++ [ x ]; + })) + { + ordered = [ ]; + unordered = [ ]; + } + defs; + in + [ (gitini.merge loc config.unordered) ] ++ config.ordered; + }; + default = [ ]; example = { init.defaultBranch = "main"; url."https://github.com/".insteadOf = [ "gh:" "github:" ]; }; description = lib.mdDoc '' - Configuration to write to /etc/gitconfig. See the CONFIGURATION FILE - section of git-config(1) for more information. + Configuration to write to /etc/gitconfig. A list can also be + specified to keep the configuration in order. For example, setting + `config` to `[ { foo.x = 42; } { bar.y = 42; }]` will put the `foo` + section before the `bar` section unlike the default alphabetical + order, which can be helpful for sections such as `include` and + `includeIf`. See the CONFIGURATION FILE section of git-config(1) for + more information. ''; }; @@ -48,8 +74,8 @@ in config = mkMerge [ (mkIf cfg.enable { environment.systemPackages = [ cfg.package ]; - environment.etc.gitconfig = mkIf (cfg.config != {}) { - text = generators.toGitINI cfg.config; + environment.etc.gitconfig = mkIf (cfg.config != [ ]) { + text = concatMapStringsSep "\n" generators.toGitINI cfg.config; }; }) (mkIf (cfg.enable && cfg.lfs.enable) { diff --git a/nixos/modules/programs/i3lock.nix b/nixos/modules/programs/i3lock.nix new file mode 100644 index 000000000000..466ae59c9277 --- /dev/null +++ b/nixos/modules/programs/i3lock.nix @@ -0,0 +1,58 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + + cfg = config.programs.i3lock; + +in { + + ###### interface + + options = { + programs.i3lock = { + enable = mkEnableOption (mdDoc "i3lock"); + package = mkOption { + type = types.package; + default = pkgs.i3lock; + defaultText = literalExpression "pkgs.i3lock"; + example = literalExpression '' + pkgs.i3lock-color + ''; + description = mdDoc '' + Specify which package to use for the i3lock program, + The i3lock package must include a i3lock file or link in its out directory in order for the u2fSupport option to work correctly. + ''; + }; + u2fSupport = mkOption { + type = types.bool; + default = false; + example = true; + description = mdDoc '' + Whether to enable U2F support in the i3lock program. + U2F enables authentication using a hardware device, such as a security key. + When U2F support is enabled, the i3lock program will set the setuid bit on the i3lock binary and enable the pam u2fAuth service, + ''; + }; + }; + }; + + ###### implementation + + config = mkIf cfg.enable { + + environment.systemPackages = [ cfg.package ]; + + security.wrappers.i3lock = mkIf cfg.u2fSupport { + setuid = true; + owner = "root"; + group = "root"; + source = "${cfg.package.out}/bin/i3lock"; + }; + + security.pam.services.i3lock.u2fAuth = cfg.u2fSupport; + + }; + +} diff --git a/nixos/modules/programs/nix-index.nix b/nixos/modules/programs/nix-index.nix new file mode 100644 index 000000000000..a494b9d8c2c9 --- /dev/null +++ b/nixos/modules/programs/nix-index.nix @@ -0,0 +1,62 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.programs.nix-index; +in { + options.programs.nix-index = with lib; { + enable = mkEnableOption (lib.mdDoc "nix-index, a file database for nixpkgs"); + + package = mkOption { + type = types.package; + default = pkgs.nix-index; + defaultText = literalExpression "pkgs.nix-index"; + description = lib.mdDoc "Package providing the `nix-index` tool."; + }; + + enableBashIntegration = mkEnableOption (lib.mdDoc "Bash integration") // { + default = true; + }; + + enableZshIntegration = mkEnableOption (lib.mdDoc "Zsh integration") // { + default = true; + }; + + enableFishIntegration = mkEnableOption (lib.mdDoc "Fish integration") // { + default = true; + }; + }; + + config = lib.mkIf cfg.enable { + assertions = let + checkOpt = name: { + assertion = cfg.${name} -> !config.programs.command-not-found.enable; + message = '' + The 'programs.command-not-found.enable' option is mutually exclusive + with the 'programs.nix-index.${name}' option. + ''; + }; + in [ (checkOpt "enableBashIntegration") (checkOpt "enableZshIntegration") ]; + + environment.systemPackages = [ cfg.package ]; + + programs.bash.interactiveShellInit = lib.mkIf cfg.enableBashIntegration '' + source ${cfg.package}/etc/profile.d/command-not-found.sh + ''; + + programs.zsh.interactiveShellInit = lib.mkIf cfg.enableZshIntegration '' + source ${cfg.package}/etc/profile.d/command-not-found.sh + ''; + + # See https://github.com/bennofs/nix-index/issues/126 + programs.fish.interactiveShellInit = let + wrapper = pkgs.writeScript "command-not-found" '' + #!${pkgs.bash}/bin/bash + source ${cfg.package}/etc/profile.d/command-not-found.sh + command_not_found_handle "$@" + ''; + in lib.mkIf cfg.enableFishIntegration '' + function __fish_command_not_found_handler --on-event fish_command_not_found + ${wrapper} $argv + end + ''; + }; +} diff --git a/nixos/modules/programs/nix-ld.nix b/nixos/modules/programs/nix-ld.nix index 602278d1ba9b..f753cf5f97e5 100644 --- a/nixos/modules/programs/nix-ld.nix +++ b/nixos/modules/programs/nix-ld.nix @@ -1,10 +1,68 @@ { pkgs, lib, config, ... }: +let + cfg = config.programs.nix-ld; + + # TODO make glibc here configureable? + nix-ld-so = pkgs.runCommand "ld.so" {} '' + ln -s "$(cat '${pkgs.stdenv.cc}/nix-support/dynamic-linker')" $out + ''; + + nix-ld-libraries = pkgs.buildEnv { + name = "lb-library-path"; + pathsToLink = [ "/lib" ]; + paths = map lib.getLib cfg.libraries; + extraPrefix = "/share/nix-ld"; + ignoreCollisions = true; + }; + + # We currently take all libraries from systemd and nix as the default. + # Is there a better list? + baseLibraries = with pkgs; [ + zlib + zstd + stdenv.cc.cc + curl + openssl + attr + libssh + bzip2 + libxml2 + acl + libsodium + util-linux + xz + systemd + ]; +in { meta.maintainers = [ lib.maintainers.mic92 ]; options = { - programs.nix-ld.enable = lib.mkEnableOption (lib.mdDoc ''nix-ld, Documentation: <https://github.com/Mic92/nix-ld>''); + programs.nix-ld = { + enable = lib.mkEnableOption (lib.mdDoc ''nix-ld, Documentation: <https://github.com/Mic92/nix-ld>''); + package = lib.mkOption { + type = lib.types.package; + description = lib.mdDoc "Which package to use for the nix-ld."; + default = pkgs.nix-ld; + defaultText = lib.mdDoc "pkgs.nix-ld"; + }; + libraries = lib.mkOption { + type = lib.types.listOf lib.types.package; + description = lib.mdDoc "Libraries that automatically become available to all programs. The default set includes common libraries."; + default = baseLibraries; + defaultText = lib.mdDoc "baseLibraries"; + }; + }; }; config = lib.mkIf config.programs.nix-ld.enable { - systemd.tmpfiles.packages = [ pkgs.nix-ld ]; + systemd.tmpfiles.packages = [ cfg.package ]; + + environment.systemPackages = [ nix-ld-libraries ]; + + environment.pathsToLink = [ "/share/nix-ld" ]; + + environment.variables = { + NIX_LD = toString nix-ld-so; + NIX_LD_LIBRARY_PATH = "/run/current-system/sw/share/nix-ld/lib"; + }; }; } diff --git a/nixos/modules/programs/streamdeck-ui.nix b/nixos/modules/programs/streamdeck-ui.nix index e933b899c55e..113d1d49e151 100644 --- a/nixos/modules/programs/streamdeck-ui.nix +++ b/nixos/modules/programs/streamdeck-ui.nix @@ -4,7 +4,8 @@ with lib; let cfg = config.programs.streamdeck-ui; -in { +in +{ options.programs.streamdeck-ui = { enable = mkEnableOption (lib.mdDoc "streamdeck-ui"); @@ -13,15 +14,20 @@ in { type = types.bool; description = lib.mdDoc "Whether streamdeck-ui should be started automatically."; }; + + package = mkPackageOption pkgs "streamdeck-ui" { + default = [ "streamdeck-ui" ]; + }; + }; config = mkIf cfg.enable { environment.systemPackages = with pkgs; [ - streamdeck-ui - (mkIf cfg.autoStart (makeAutostartItem { name = "streamdeck-ui"; package = streamdeck-ui; })) + cfg.package + (mkIf cfg.autoStart (makeAutostartItem { name = "streamdeck-ui"; package = cfg.package; })) ]; - services.udev.packages = with pkgs; [ streamdeck-ui ]; + services.udev.packages = [ cfg.package ]; }; meta.maintainers = with maintainers; [ majiir ]; diff --git a/nixos/modules/programs/vim.nix b/nixos/modules/programs/vim.nix index 15983e371f0e..b12a45166d56 100644 --- a/nixos/modules/programs/vim.nix +++ b/nixos/modules/programs/vim.nix @@ -19,7 +19,7 @@ in { type = types.package; default = pkgs.vim; defaultText = literalExpression "pkgs.vim"; - example = literalExpression "pkgs.vimHugeX"; + example = literalExpression "pkgs.vim-full"; description = lib.mdDoc '' vim package to use. ''; diff --git a/nixos/modules/programs/xastir.nix b/nixos/modules/programs/xastir.nix new file mode 100644 index 000000000000..0977668d8370 --- /dev/null +++ b/nixos/modules/programs/xastir.nix @@ -0,0 +1,23 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.programs.xastir; +in { + meta.maintainers = with maintainers; [ melling ]; + + options.programs.xastir = { + enable = mkEnableOption (mdDoc "Enable Xastir Graphical APRS client"); + }; + + config = mkIf cfg.enable { + environment.systemPackages = with pkgs; [ xastir ]; + security.wrappers.xastir = { + source = "${pkgs.xastir}/bin/xastir"; + capabilities = "cap_net_raw+p"; + owner = "root"; + group = "root"; + }; + }; +} diff --git a/nixos/modules/programs/xfs_quota.nix b/nixos/modules/programs/xfs_quota.nix index a1e9ff941c6b..0fc2958b3f38 100644 --- a/nixos/modules/programs/xfs_quota.nix +++ b/nixos/modules/programs/xfs_quota.nix @@ -94,7 +94,7 @@ in ''; wantedBy = [ "multi-user.target" ]; - after = [ ((replaceChars [ "/" ] [ "-" ] opts.fileSystem) + ".mount") ]; + after = [ ((replaceStrings [ "/" ] [ "-" ] opts.fileSystem) + ".mount") ]; restartTriggers = [ config.environment.etc.projects.source ]; diff --git a/nixos/modules/programs/xonsh.nix b/nixos/modules/programs/xonsh.nix index 3223761f9340..7202ed06c6af 100644 --- a/nixos/modules/programs/xonsh.nix +++ b/nixos/modules/programs/xonsh.nix @@ -46,8 +46,8 @@ in config = mkIf cfg.enable { - environment.etc.xonshrc.text = '' - # /etc/xonshrc: DO NOT EDIT -- this file has been generated automatically. + environment.etc."xonsh/xonshrc".text = '' + # /etc/xonsh/xonshrc: DO NOT EDIT -- this file has been generated automatically. if not ''${...}.get('__NIXOS_SET_ENVIRONMENT_DONE'): diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix index 4e163901b088..a380bb5484af 100644 --- a/nixos/modules/security/acme/default.nix +++ b/nixos/modules/security/acme/default.nix @@ -714,7 +714,7 @@ in { default = false; description = lib.mdDoc '' Whether to use the root user when generating certs. This is not recommended - for security + compatiblity reasons. If a service requires root owned certificates + for security + compatibility reasons. If a service requires root owned certificates consider following the guide on "Using ACME with services demanding root owned certificates" in the NixOS manual, and only using this as a fallback or for testing. @@ -765,7 +765,7 @@ in { To use the let's encrypt staging server, use security.acme.server = "https://acme-staging-v02.api.letsencrypt.org/directory". '') - (mkRemovedOptionModule [ "security" "acme" "directory" ] "ACME Directory is now hardcoded to /var/lib/acme and its permisisons are managed by systemd. See https://github.com/NixOS/nixpkgs/issues/53852 for more info.") + (mkRemovedOptionModule [ "security" "acme" "directory" ] "ACME Directory is now hardcoded to /var/lib/acme and its permissions are managed by systemd. See https://github.com/NixOS/nixpkgs/issues/53852 for more info.") (mkRemovedOptionModule [ "security" "acme" "preDelay" ] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal") (mkRemovedOptionModule [ "security" "acme" "activationDelay" ] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal") (mkChangedOptionModule [ "security" "acme" "validMin" ] [ "security" "acme" "defaults" "validMinDays" ] (config: config.security.acme.validMin / (24 * 3600))) diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix index 0d858a458564..24b48338ed77 100644 --- a/nixos/modules/security/apparmor.nix +++ b/nixos/modules/security/apparmor.nix @@ -202,7 +202,7 @@ in # (indirectly read from /etc/apparmor.d/*, without recursing into sub-directory). # Note that this does not remove profiles dynamically generated by libvirt. [ "${pkgs.apparmor-utils}/bin/aa-remove-unknown" ] ++ - # Optionaly kill the processes which are unconfined but now have a profile loaded + # Optionally kill the processes which are unconfined but now have a profile loaded # (because AppArmor can only start to confine new processes). optional cfg.killUnconfinedConfinables killUnconfinedConfinables; ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown"; diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 21e1749d8503..273bc796341c 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -282,7 +282,7 @@ let defaultText = literalExpression "config.security.pam.mount.enable"; type = types.bool; description = lib.mdDoc '' - Enable PAM mount (pam_mount) system to mount fileystems on user login. + Enable PAM mount (pam_mount) system to mount filesystems on user login. ''; }; @@ -305,7 +305,7 @@ let default = false; type = types.bool; description = lib.mdDoc '' - Wheather the delay after typing a wrong password should be disabled. + Whether the delay after typing a wrong password should be disabled. ''; }; @@ -694,7 +694,7 @@ let optionalString (cfg.limits != []) '' session required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits} '' + - optionalString (cfg.showMotd && config.users.motd != null) '' + optionalString (cfg.showMotd && (config.users.motd != null || config.users.motdFile != null)) '' session optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd} '' + optionalString (cfg.enableAppArmor && config.security.apparmor.enable) '' @@ -775,7 +775,9 @@ let }; })); - motd = pkgs.writeText "motd" config.users.motd; + motd = if isNull config.users.motdFile + then pkgs.writeText "motd" config.users.motd + else config.users.motdFile; makePAMService = name: service: { name = "pam.d/${name}"; @@ -1199,12 +1201,26 @@ in description = lib.mdDoc "Message of the day shown to users when they log in."; }; + users.motdFile = mkOption { + default = null; + example = "/etc/motd"; + type = types.nullOr types.path; + description = lib.mdDoc "A file containing the message of the day shown to users when they log in."; + }; }; ###### implementation config = { + assertions = [ + { + assertion = isNull config.users.motd || isNull config.users.motdFile; + message = '' + Only one of users.motd and users.motdFile can be set. + ''; + } + ]; environment.systemPackages = # Include the PAM modules in the system path mostly for the manpages. diff --git a/nixos/modules/security/pam_mount.nix b/nixos/modules/security/pam_mount.nix index 11cc13a8cbeb..481f1f3d38eb 100644 --- a/nixos/modules/security/pam_mount.nix +++ b/nixos/modules/security/pam_mount.nix @@ -24,7 +24,7 @@ in type = types.bool; default = false; description = lib.mdDoc '' - Enable PAM mount system to mount fileystems on user login. + Enable PAM mount system to mount filesystems on user login. ''; }; diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix index a58c792d8c5f..4b62abd658a4 100644 --- a/nixos/modules/security/wrappers/default.nix +++ b/nixos/modules/security/wrappers/default.nix @@ -202,7 +202,7 @@ in internal = true; description = lib.mdDoc '' This option defines the path to the wrapper programs. It - should not be overriden. + should not be overridden. ''; }; }; diff --git a/nixos/modules/services/audio/botamusique.nix b/nixos/modules/services/audio/botamusique.nix index 4cd900f945c8..5d3f7db12bc9 100644 --- a/nixos/modules/services/audio/botamusique.nix +++ b/nixos/modules/services/audio/botamusique.nix @@ -103,9 +103,8 @@ in StateDirectory = "botamusique"; SystemCallArchitectures = "native"; SystemCallFilter = [ - "@system-service" + "@system-service @resources" "~@privileged" - "~@resources" ]; UMask = "0077"; WorkingDirectory = "/var/lib/botamusique"; diff --git a/nixos/modules/services/audio/icecast.nix b/nixos/modules/services/audio/icecast.nix index f71a13b9626d..63049bd93ab9 100644 --- a/nixos/modules/services/audio/icecast.nix +++ b/nixos/modules/services/audio/icecast.nix @@ -48,7 +48,7 @@ in { hostname = mkOption { type = types.nullOr types.str; - description = lib.mdDoc "DNS name or IP address that will be used for the stream directory lookups or possibily the playlist generation if a Host header is not provided."; + description = lib.mdDoc "DNS name or IP address that will be used for the stream directory lookups or possibly the playlist generation if a Host header is not provided."; default = config.networking.domain; defaultText = literalExpression "config.networking.domain"; }; diff --git a/nixos/modules/services/audio/roon-bridge.nix b/nixos/modules/services/audio/roon-bridge.nix index db84ba286221..e9335091ba9a 100644 --- a/nixos/modules/services/audio/roon-bridge.nix +++ b/nixos/modules/services/audio/roon-bridge.nix @@ -53,13 +53,18 @@ in { networking.firewall = mkIf cfg.openFirewall { allowedTCPPortRanges = [{ from = 9100; to = 9200; }]; allowedUDPPorts = [ 9003 ]; - extraCommands = '' + extraCommands = optionalString (!config.networking.nftables.enable) '' iptables -A INPUT -s 224.0.0.0/4 -j ACCEPT iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT iptables -A INPUT -s 240.0.0.0/5 -j ACCEPT iptables -A INPUT -m pkttype --pkt-type multicast -j ACCEPT iptables -A INPUT -m pkttype --pkt-type broadcast -j ACCEPT ''; + extraInputRules = optionalString config.networking.nftables.enable '' + ip saddr { 224.0.0.0/4, 240.0.0.0/5 } accept + ip daddr 224.0.0.0/4 accept + pkttype { multicast, broadcast } accept + ''; }; diff --git a/nixos/modules/services/audio/roon-server.nix b/nixos/modules/services/audio/roon-server.nix index 4764ee3e598f..fbe74f63b9da 100644 --- a/nixos/modules/services/audio/roon-server.nix +++ b/nixos/modules/services/audio/roon-server.nix @@ -40,6 +40,7 @@ in { wantedBy = [ "multi-user.target" ]; environment.ROON_DATAROOT = "/var/lib/${name}"; + environment.ROON_ID_DIR = "/var/lib/${name}"; serviceConfig = { ExecStart = "${pkgs.roon-server}/bin/RoonServer"; @@ -57,7 +58,7 @@ in { { from = 30000; to = 30010; } ]; allowedUDPPorts = [ 9003 ]; - extraCommands = '' + extraCommands = optionalString (!config.networking.nftables.enable) '' ## IGMP / Broadcast ## iptables -A INPUT -s 224.0.0.0/4 -j ACCEPT iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT @@ -65,6 +66,11 @@ in { iptables -A INPUT -m pkttype --pkt-type multicast -j ACCEPT iptables -A INPUT -m pkttype --pkt-type broadcast -j ACCEPT ''; + extraInputRules = optionalString config.networking.nftables.enable '' + ip saddr { 224.0.0.0/4, 240.0.0.0/5 } accept + ip daddr 224.0.0.0/4 accept + pkttype { multicast, broadcast } accept + ''; }; diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix index 7b29eb41e72a..c5fc09dcea02 100644 --- a/nixos/modules/services/backup/borgbackup.nix +++ b/nixos/modules/services/backup/borgbackup.nix @@ -11,7 +11,11 @@ let mkExcludeFile = cfg: # Write each exclude pattern to a new line - pkgs.writeText "excludefile" (concatStringsSep "\n" cfg.exclude); + pkgs.writeText "excludefile" (concatMapStrings (s: s + "\n") cfg.exclude); + + mkPatternsFile = cfg: + # Write each pattern to a new line + pkgs.writeText "patternsfile" (concatMapStrings (s: s + "\n") cfg.patterns); mkKeepArgs = cfg: # If cfg.prune.keep e.g. has a yearly attribute, @@ -19,7 +23,8 @@ let concatStringsSep " " (mapAttrsToList (x: y: "--keep-${x}=${toString y}") cfg.prune.keep); - mkBackupScript = cfg: '' + mkBackupScript = name: cfg: pkgs.writeShellScript "${name}-script" ('' + set -e on_exit() { exitStatus=$? @@ -46,6 +51,7 @@ let borg create $extraArgs \ --compression ${cfg.compression} \ --exclude-from ${mkExcludeFile cfg} \ + --patterns-from ${mkPatternsFile cfg} \ $extraCreateArgs \ "::$archiveName$archiveSuffix" \ ${if cfg.paths == null then "-" else escapeShellArgs cfg.paths} @@ -58,10 +64,10 @@ let '' + optionalString (cfg.prune.keep != { }) '' borg prune $extraArgs \ ${mkKeepArgs cfg} \ - ${optionalString (cfg.prune.prefix != null) "--prefix ${escapeShellArg cfg.prune.prefix} \\"} + ${optionalString (cfg.prune.prefix != null) "--glob-archives ${escapeShellArg "${cfg.prune.prefix}*"}"} \ $extraPruneArgs ${cfg.postPrune} - ''; + ''); mkPassEnv = cfg: with cfg.encryption; if passCommand != null then @@ -73,12 +79,19 @@ let mkBackupService = name: cfg: let userHome = config.users.users.${cfg.user}.home; - in nameValuePair "borgbackup-job-${name}" { + backupJobName = "borgbackup-job-${name}"; + backupScript = mkBackupScript backupJobName cfg; + in nameValuePair backupJobName { description = "BorgBackup job ${name}"; path = with pkgs; [ borgbackup openssh ]; - script = mkBackupScript cfg; + script = "exec " + optionalString cfg.inhibitsSleep ''\ + ${pkgs.systemd}/bin/systemd-inhibit \ + --who="borgbackup" \ + --what="sleep" \ + --why="Scheduled backup" \ + '' + backupScript; serviceConfig = { User = cfg.user; Group = cfg.group; @@ -137,8 +150,9 @@ let # Ensure that the home directory already exists # We can't assert createHome == true because that's not the case for root cd "${config.users.users.${cfg.user}.home}" - ${install} -d .config/borg - ${install} -d .cache/borg + # Create each directory separately to prevent root owned parent dirs + ${install} -d .config .config/borg + ${install} -d .cache .cache/borg '' + optionalString (isLocalPath cfg.repo && !cfg.removableDevice) '' ${install} -d ${escapeShellArg cfg.repo} '')); @@ -341,6 +355,15 @@ in { ''; }; + inhibitsSleep = mkOption { + default = false; + type = types.bool; + example = true; + description = lib.mdDoc '' + Prevents the system from sleeping while backing up. + ''; + }; + user = mkOption { type = types.str; description = lib.mdDoc '' @@ -424,6 +447,21 @@ in { ]; }; + patterns = mkOption { + type = with types; listOf str; + description = lib.mdDoc '' + Include/exclude paths matching the given patterns. The first + matching patterns is used, so if an include pattern (prefix `+`) + matches before an exclude pattern (prefix `-`), the file is + backed up. See [{command}`borg help patterns`](https://borgbackup.readthedocs.io/en/stable/usage/help.html#borg-patterns) for pattern syntax. + ''; + default = [ ]; + example = [ + "+ /home/susan" + "- /home/*" + ]; + }; + readWritePaths = mkOption { type = with types; listOf path; description = lib.mdDoc '' diff --git a/nixos/modules/services/backup/zfs-replication.nix b/nixos/modules/services/backup/zfs-replication.nix index f0267c47364d..ce914003c622 100644 --- a/nixos/modules/services/backup/zfs-replication.nix +++ b/nixos/modules/services/backup/zfs-replication.nix @@ -12,7 +12,7 @@ in { enable = mkEnableOption (lib.mdDoc "ZFS snapshot replication."); followDelete = mkOption { - description = lib.mdDoc "Remove remote snapshots that don't have a local correspondant."; + description = lib.mdDoc "Remove remote snapshots that don't have a local correspondent."; default = true; type = types.bool; }; @@ -30,7 +30,7 @@ in { }; localFilesystem = mkOption { - description = lib.mdDoc "Local ZFS fileystem from which snapshots should be sent. Defaults to the attribute name."; + description = lib.mdDoc "Local ZFS filesystem from which snapshots should be sent. Defaults to the attribute name."; example = "pool/file/path"; type = types.str; }; diff --git a/nixos/modules/services/backup/znapzend.nix b/nixos/modules/services/backup/znapzend.nix index f8d741e3ad9a..76f147c18aff 100644 --- a/nixos/modules/services/backup/znapzend.nix +++ b/nixos/modules/services/backup/znapzend.nix @@ -9,7 +9,7 @@ let The znapzend backup plan to use for the source. The plan specifies how often to backup and for how long to keep the - backups. It consists of a series of retention periodes to interval + backups. It consists of a series of retention periods to interval associations: ``` @@ -268,7 +268,7 @@ let mkSrcAttrs = srcCfg: with srcCfg; { enabled = onOff enable; - # mbuffer is not referenced by its full path to accomodate non-NixOS systems or differing mbuffer versions between source and target + # mbuffer is not referenced by its full path to accommodate non-NixOS systems or differing mbuffer versions between source and target mbuffer = with mbuffer; if enable then "mbuffer" + optionalString (port != null) ":${toString port}" else "off"; mbuffer_size = mbuffer.size; @@ -372,7 +372,7 @@ in compressed feature which adds the options `-Lce` to the {command}`zfs send` command. When this is enabled, make sure that both the sending and receiving pool have the same relevant - features enabled. Using `-c` will skip unneccessary + features enabled. Using `-c` will skip unnecessary decompress-compress stages, `-L` is for large block support and -e is for embedded data support. see {manpage}`znapzend(1)` diff --git a/nixos/modules/services/blockchain/ethereum/lighthouse.nix b/nixos/modules/services/blockchain/ethereum/lighthouse.nix index 20a4ead689c8..863e737d908a 100644 --- a/nixos/modules/services/blockchain/ethereum/lighthouse.nix +++ b/nixos/modules/services/blockchain/ethereum/lighthouse.nix @@ -51,7 +51,7 @@ in { type = types.bool; default = false; description = lib.mdDoc '' - Explictly disables syncing of deposit logs from the execution node. + Explicitly disables syncing of deposit logs from the execution node. This overrides any previous option that depends on it. Useful if you intend to run a non-validating beacon node. ''; @@ -280,7 +280,7 @@ in { ${pkgs.lighthouse}/bin/lighthouse validator_client \ --network ${cfg.network} \ --beacon-nodes ${lib.concatStringsSep "," cfg.validator.beaconNodes} \ - --datadir ${cfg.validator.dataDir}/${cfg.network} + --datadir ${cfg.validator.dataDir}/${cfg.network} \ ${optionalString cfg.validator.metrics.enable ''--metrics --metrics-address ${cfg.validator.metrics.address} --metrics-port ${toString cfg.validator.metrics.port}''} \ ${cfg.extraArgs} ${cfg.validator.extraArgs} ''; diff --git a/nixos/modules/services/cluster/kubernetes/addon-manager.nix b/nixos/modules/services/cluster/kubernetes/addon-manager.nix index d6b3428908b2..7aa2a8323b1d 100644 --- a/nixos/modules/services/cluster/kubernetes/addon-manager.nix +++ b/nixos/modules/services/cluster/kubernetes/addon-manager.nix @@ -22,7 +22,7 @@ in bootstrapAddons = mkOption { description = lib.mdDoc '' - Bootstrap addons are like regular addons, but they are applied with cluster-admin rigths. + Bootstrap addons are like regular addons, but they are applied with cluster-admin rights. They are applied at addon-manager startup only. ''; default = { }; diff --git a/nixos/modules/services/cluster/kubernetes/pki.nix b/nixos/modules/services/cluster/kubernetes/pki.nix index d68267883e45..26fe0f5e9e09 100644 --- a/nixos/modules/services/cluster/kubernetes/pki.nix +++ b/nixos/modules/services/cluster/kubernetes/pki.nix @@ -323,7 +323,7 @@ in systemctl restart flannel ''} - echo "Node joined succesfully" + echo "Node joined successfully" '')]; # isolate etcd on loopback at the master node diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix index 680b21dbf21b..5666199c4845 100644 --- a/nixos/modules/services/continuous-integration/buildbot/master.nix +++ b/nixos/modules/services/continuous-integration/buildbot/master.nix @@ -1,4 +1,4 @@ -# NixOS module for Buildbot continous integration server. +# NixOS module for Buildbot continuous integration server. { config, lib, options, pkgs, ... }: diff --git a/nixos/modules/services/continuous-integration/github-runner/options.nix b/nixos/modules/services/continuous-integration/github-runner/options.nix index 796b5a7f1175..72ac0c129900 100644 --- a/nixos/modules/services/continuous-integration/github-runner/options.nix +++ b/nixos/modules/services/continuous-integration/github-runner/options.nix @@ -49,7 +49,7 @@ with lib; registration token on startup as needed. Make sure the PAT has a scope of `admin:org` for organization-wide registrations or a scope of `repo` for a single repository. Fine-grained PATs need read and write permission - to the "Adminstration" resources. + to the "Administration" resources. Changing this option or the file's content triggers a new runner registration. ''; diff --git a/nixos/modules/services/continuous-integration/gitlab-runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner.nix index 2050e04d55cd..7b1c4da86260 100644 --- a/nixos/modules/services/continuous-integration/gitlab-runner.nix +++ b/nixos/modules/services/continuous-integration/gitlab-runner.nix @@ -141,7 +141,7 @@ in default = false; description = lib.mdDoc '' Finish all remaining jobs before stopping. - If not set gitlab-runner will stop immediatly without waiting + If not set gitlab-runner will stop immediately without waiting for jobs to finish, which will lead to failed builds. ''; }; diff --git a/nixos/modules/services/continuous-integration/hail.nix b/nixos/modules/services/continuous-integration/hail.nix index 76d7356e2472..62e8b8077c07 100644 --- a/nixos/modules/services/continuous-integration/hail.nix +++ b/nixos/modules/services/continuous-integration/hail.nix @@ -15,8 +15,8 @@ in { default = false; description = lib.mdDoc '' Enables the Hail Auto Update Service. Hail can automatically deploy artifacts - built by a Hydra Continous Integration server. A common use case is to provide - continous deployment for single services or a full NixOS configuration.''; + built by a Hydra Continuous Integration server. A common use case is to provide + continuous deployment for single services or a full NixOS configuration.''; }; profile = mkOption { type = types.str; diff --git a/nixos/modules/services/databases/firebird.nix b/nixos/modules/services/databases/firebird.nix index b2c4a5dd8f62..4c2855345368 100644 --- a/nixos/modules/services/databases/firebird.nix +++ b/nixos/modules/services/databases/firebird.nix @@ -14,7 +14,7 @@ # # Be careful, virtuoso-opensource also provides a different isql command ! -# There are at least two ways to run firebird. superserver has been choosen +# There are at least two ways to run firebird. superserver has been chosen # however there are no strong reasons to prefer this or the other one AFAIK # Eg superserver is said to be most efficiently using resources according to # http://www.firebirdsql.org/manual/qsg25-classic-or-super.html diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix index fe7ef48075a7..6665e7a088fc 100644 --- a/nixos/modules/services/databases/postgresql.nix +++ b/nixos/modules/services/databases/postgresql.nix @@ -146,6 +146,7 @@ in Name of the user to ensure. ''; }; + ensurePermissions = mkOption { type = types.attrsOf types.str; default = {}; @@ -167,6 +168,154 @@ in } ''; }; + + ensureClauses = mkOption { + description = lib.mdDoc '' + An attrset of clauses to grant to the user. Under the hood this uses the + [ALTER USER syntax](https://www.postgresql.org/docs/current/sql-alteruser.html) for each attrName where + the attrValue is true in the attrSet: + `ALTER USER user.name WITH attrName` + ''; + example = literalExpression '' + { + superuser = true; + createrole = true; + createdb = true; + } + ''; + default = {}; + defaultText = lib.literalMD '' + The default, `null`, means that the user created will have the default permissions assigned by PostgreSQL. Subsequent server starts will not set or unset the clause, so imperative changes are preserved. + ''; + type = types.submodule { + options = let + defaultText = lib.literalMD '' + `null`: do not set. For newly created roles, use PostgreSQL's default. For existing roles, do not touch this clause. + ''; + in { + superuser = mkOption { + type = types.nullOr types.bool; + description = lib.mdDoc '' + Grants the user, created by the ensureUser attr, superuser permissions. From the postgres docs: + + A database superuser bypasses all permission checks, + except the right to log in. This is a dangerous privilege + and should not be used carelessly; it is best to do most + of your work as a role that is not a superuser. To create + a new database superuser, use CREATE ROLE name SUPERUSER. + You must do this as a role that is already a superuser. + + More information on postgres roles can be found [here](https://www.postgresql.org/docs/current/role-attributes.html) + ''; + default = null; + inherit defaultText; + }; + createrole = mkOption { + type = types.nullOr types.bool; + description = lib.mdDoc '' + Grants the user, created by the ensureUser attr, createrole permissions. From the postgres docs: + + A role must be explicitly given permission to create more + roles (except for superusers, since those bypass all + permission checks). To create such a role, use CREATE + ROLE name CREATEROLE. A role with CREATEROLE privilege + can alter and drop other roles, too, as well as grant or + revoke membership in them. However, to create, alter, + drop, or change membership of a superuser role, superuser + status is required; CREATEROLE is insufficient for that. + + More information on postgres roles can be found [here](https://www.postgresql.org/docs/current/role-attributes.html) + ''; + default = null; + inherit defaultText; + }; + createdb = mkOption { + type = types.nullOr types.bool; + description = lib.mdDoc '' + Grants the user, created by the ensureUser attr, createdb permissions. From the postgres docs: + + A role must be explicitly given permission to create + databases (except for superusers, since those bypass all + permission checks). To create such a role, use CREATE + ROLE name CREATEDB. + + More information on postgres roles can be found [here](https://www.postgresql.org/docs/current/role-attributes.html) + ''; + default = null; + inherit defaultText; + }; + "inherit" = mkOption { + type = types.nullOr types.bool; + description = lib.mdDoc '' + Grants the user created inherit permissions. From the postgres docs: + + A role is given permission to inherit the privileges of + roles it is a member of, by default. However, to create a + role without the permission, use CREATE ROLE name + NOINHERIT. + + More information on postgres roles can be found [here](https://www.postgresql.org/docs/current/role-attributes.html) + ''; + default = null; + inherit defaultText; + }; + login = mkOption { + type = types.nullOr types.bool; + description = lib.mdDoc '' + Grants the user, created by the ensureUser attr, login permissions. From the postgres docs: + + Only roles that have the LOGIN attribute can be used as + the initial role name for a database connection. A role + with the LOGIN attribute can be considered the same as a + “database user”. To create a role with login privilege, + use either: + + CREATE ROLE name LOGIN; CREATE USER name; + + (CREATE USER is equivalent to CREATE ROLE except that + CREATE USER includes LOGIN by default, while CREATE ROLE + does not.) + + More information on postgres roles can be found [here](https://www.postgresql.org/docs/current/role-attributes.html) + ''; + default = null; + inherit defaultText; + }; + replication = mkOption { + type = types.nullOr types.bool; + description = lib.mdDoc '' + Grants the user, created by the ensureUser attr, replication permissions. From the postgres docs: + + A role must explicitly be given permission to initiate + streaming replication (except for superusers, since those + bypass all permission checks). A role used for streaming + replication must have LOGIN permission as well. To create + such a role, use CREATE ROLE name REPLICATION LOGIN. + + More information on postgres roles can be found [here](https://www.postgresql.org/docs/current/role-attributes.html) + ''; + default = null; + inherit defaultText; + }; + bypassrls = mkOption { + type = types.nullOr types.bool; + description = lib.mdDoc '' + Grants the user, created by the ensureUser attr, replication permissions. From the postgres docs: + + A role must be explicitly given permission to bypass + every row-level security (RLS) policy (except for + superusers, since those bypass all permission checks). To + create such a role, use CREATE ROLE name BYPASSRLS as a + superuser. + + More information on postgres roles can be found [here](https://www.postgresql.org/docs/current/role-attributes.html) + ''; + default = null; + inherit defaultText; + }; + }; + }; + }; }; }); default = []; @@ -380,12 +529,29 @@ in $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${database}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${database}"' '') cfg.ensureDatabases} '' + '' - ${concatMapStrings (user: '' - $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"' - ${concatStringsSep "\n" (mapAttrsToList (database: permission: '' - $PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"' - '') user.ensurePermissions)} - '') cfg.ensureUsers} + ${ + concatMapStrings + (user: + let + userPermissions = concatStringsSep "\n" + (mapAttrsToList + (database: permission: ''$PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"' '') + user.ensurePermissions + ); + + filteredClauses = filterAttrs (name: value: value != null) user.ensureClauses; + + clauseSqlStatements = attrValues (mapAttrs (n: v: if v then n else "no${n}") filteredClauses); + + userClauses = ''$PSQL -tAc 'ALTER ROLE "${user.name}" ${concatStringsSep " " clauseSqlStatements}' ''; + in '' + $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"' + ${userPermissions} + ${userClauses} + '' + ) + cfg.ensureUsers + } ''; serviceConfig = mkMerge [ diff --git a/nixos/modules/services/databases/surrealdb.nix b/nixos/modules/services/databases/surrealdb.nix index 27269eb02f64..050a5336cb4c 100644 --- a/nixos/modules/services/databases/surrealdb.nix +++ b/nixos/modules/services/databases/surrealdb.nix @@ -10,6 +10,15 @@ in { services.surrealdb = { enable = mkEnableOption (lib.mdDoc "A scalable, distributed, collaborative, document-graph database, for the realtime web "); + package = mkOption { + default = pkgs.surrealdb; + defaultText = literalExpression "pkgs.surrealdb"; + type = types.package; + description = lib.mdDoc '' + Which surrealdb derivation to use. + ''; + }; + dbPath = mkOption { type = types.str; description = lib.mdDoc '' @@ -37,21 +46,46 @@ in { default = 8000; example = 8000; }; + + userNamePath = mkOption { + type = types.path; + description = lib.mdDoc '' + Path to read the username from. + ''; + }; + + passwordPath = mkOption { + type = types.path; + description = lib.mdDoc '' + Path to read the password from. + ''; + }; }; }; config = mkIf cfg.enable { # Used to connect to the running service - environment.systemPackages = [ pkgs.surrealdb ] ; + environment.systemPackages = [ cfg.package ] ; systemd.services.surrealdb = { description = "A scalable, distributed, collaborative, document-graph database, for the realtime web "; wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; + script = '' + ${cfg.package}/bin/surreal start \ + --user $(${pkgs.systemd}/bin/systemd-creds cat SURREALDB_USERNAME) \ + --pass $(${pkgs.systemd}/bin/systemd-creds cat SURREALDB_PASSWORD) \ + --bind ${cfg.host}:${toString cfg.port} \ + -- ${cfg.dbPath} + ''; serviceConfig = { - ExecStart = "${pkgs.surrealdb}/bin/surreal start --bind ${cfg.host}:${toString cfg.port} ${optionalString (cfg.dbPath != null) "-- ${cfg.dbPath}"}"; + LoadCredential = [ + "SURREALDB_USERNAME:${cfg.userNamePath}" + "SURREALDB_PASSWORD:${cfg.passwordPath}" + ]; + DynamicUser = true; Restart = "on-failure"; StateDirectory = "surrealdb"; diff --git a/nixos/modules/services/desktops/pipewire/wireplumber.nix b/nixos/modules/services/desktops/pipewire/wireplumber.nix index 32490773b5e9..4b36b99aa7c1 100644 --- a/nixos/modules/services/desktops/pipewire/wireplumber.nix +++ b/nixos/modules/services/desktops/pipewire/wireplumber.nix @@ -32,6 +32,10 @@ in assertion = !config.services.pipewire.media-session.enable; message = "WirePlumber and pipewire-media-session can't be enabled at the same time."; } + { + assertion = !config.hardware.bluetooth.hsphfpd.enable; + message = "Using Wireplumber conflicts with hsphfpd, as it provides the same functionality. `hardware.bluetooth.hsphfpd.enable` needs be set to false"; + } ]; environment.systemPackages = [ cfg.package ]; diff --git a/nixos/modules/services/display-managers/greetd.nix b/nixos/modules/services/display-managers/greetd.nix index fa3f8fdf4f1d..3a0f59f62afb 100644 --- a/nixos/modules/services/display-managers/greetd.nix +++ b/nixos/modules/services/display-managers/greetd.nix @@ -45,7 +45,7 @@ in default = !(cfg.settings ? initial_session); defaultText = literalExpression "!(config.services.greetd.settings ? initial_session)"; description = lib.mdDoc '' - Wether to restart greetd when it terminates (e.g. on failure). + Whether to restart greetd when it terminates (e.g. on failure). This is usually desirable so a user can always log in, but should be disabled when using 'settings.initial_session' (autologin), because every greetd restart will trigger the autologin again. ''; @@ -89,6 +89,8 @@ in SendSIGHUP = true; TimeoutStopSec = "30s"; KeyringMode = "shared"; + + Type = "idle"; }; # Don't kill a user session when using nixos-rebuild diff --git a/nixos/modules/services/games/asf.nix b/nixos/modules/services/games/asf.nix index d3f7883421ce..7585d56b2d78 100644 --- a/nixos/modules/services/games/asf.nix +++ b/nixos/modules/services/games/asf.nix @@ -35,7 +35,7 @@ in description = lib.mdDoc '' If enabled, starts the ArchisSteamFarm service. For configuring the SteamGuard token you will need to use the web-ui, which is enabled by default over on 127.0.0.1:1242. - You cannot configure ASF in any way outside of nix, since all the config files get wiped on restart and replaced with the programatically set ones by nix. + You cannot configure ASF in any way outside of nix, since all the config files get wiped on restart and replaced with the programnatically set ones by nix. ''; default = false; }; @@ -98,7 +98,7 @@ in ipcPasswordFile = mkOption { type = types.nullOr types.path; default = null; - description = lib.mdDoc "Path to a file containig the password. The file must be readable by the `asf` user/group."; + description = lib.mdDoc "Path to a file containing the password. The file must be readable by the `asf` user/group."; }; ipcSettings = mkOption { @@ -129,7 +129,7 @@ in }; passwordFile = mkOption { type = types.path; - description = lib.mdDoc "Path to a file containig the password. The file must be readable by the `asf` user/group."; + description = lib.mdDoc "Path to a file containing the password. The file must be readable by the `asf` user/group."; }; enabled = mkOption { type = types.bool; diff --git a/nixos/modules/services/games/factorio.nix b/nixos/modules/services/games/factorio.nix index 844fd2bce517..9b15cac149d5 100644 --- a/nixos/modules/services/games/factorio.nix +++ b/nixos/modules/services/games/factorio.nix @@ -39,7 +39,7 @@ let } // cfg.extraSettings; serverSettingsFile = pkgs.writeText "server-settings.json" (builtins.toJSON (filterAttrsRecursive (n: v: v != null) serverSettings)); serverAdminsFile = pkgs.writeText "server-adminlist.json" (builtins.toJSON cfg.admins); - modDir = pkgs.factorio-utils.mkModDirDrv cfg.mods; + modDir = pkgs.factorio-utils.mkModDirDrv cfg.mods cfg.mods-dat; in { options = { @@ -136,6 +136,15 @@ in derivations via nixos-channel. Until then, this is for experts only. ''; }; + mods-dat = mkOption { + type = types.nullOr types.path; + default = null; + description = lib.mdDoc '' + Mods settings can be changed by specifying a dat file, in the [mod + settings file + format](https://wiki.factorio.com/Mod_settings_file_format). + ''; + }; game-name = mkOption { type = types.nullOr types.str; default = "Factorio Game"; diff --git a/nixos/modules/services/games/minetest-server.nix b/nixos/modules/services/games/minetest-server.nix index 34e0ba8c8e5c..e8c96881673b 100644 --- a/nixos/modules/services/games/minetest-server.nix +++ b/nixos/modules/services/games/minetest-server.nix @@ -62,7 +62,7 @@ in Path to logfile for logging. If set to null, logging will be output to stdout which means - all output will be catched by systemd. + all output will be caught by systemd. ''; }; diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix index 98f837bd7824..8d7651f97c39 100644 --- a/nixos/modules/services/hardware/fwupd.nix +++ b/nixos/modules/services/hardware/fwupd.nix @@ -7,13 +7,16 @@ with lib; let cfg = config.services.fwupd; + format = pkgs.formats.ini { + listToValue = l: lib.concatStringsSep ";" (map (s: generators.mkValueStringDefault {} s) l); + mkKeyValue = generators.mkKeyValueDefault {} "="; + }; + customEtc = { "fwupd/daemon.conf" = { - source = pkgs.writeText "daemon.conf" '' - [fwupd] - DisabledDevices=${lib.concatStringsSep ";" cfg.disabledDevices} - DisabledPlugins=${lib.concatStringsSep ";" cfg.disabledPlugins} - ''; + source = format.generate "daemon.conf" { + fwupd = cfg.daemonSettings; + }; }; "fwupd/uefi_capsule.conf" = { source = pkgs.writeText "uefi_capsule.conf" '' @@ -67,24 +70,6 @@ in { ''; }; - disabledDevices = mkOption { - type = types.listOf types.str; - default = []; - example = [ "2082b5e0-7a64-478a-b1b2-e3404fab6dad" ]; - description = lib.mdDoc '' - Allow disabling specific devices by their GUID - ''; - }; - - disabledPlugins = mkOption { - type = types.listOf types.str; - default = []; - example = [ "udev" ]; - description = lib.mdDoc '' - Allow disabling specific plugins - ''; - }; - extraTrustedKeys = mkOption { type = types.listOf types.path; default = []; @@ -120,18 +105,49 @@ in { Which fwupd package to use. ''; }; + + daemonSettings = mkOption { + type = types.submodule { + freeformType = format.type.nestedTypes.elemType; + options = { + DisabledDevices = mkOption { + type = types.listOf types.str; + default = []; + example = [ "2082b5e0-7a64-478a-b1b2-e3404fab6dad" ]; + description = lib.mdDoc '' + List of device GUIDs to be disabled. + ''; + }; + + DisabledPlugins = mkOption { + type = types.listOf types.str; + default = []; + example = [ "udev" ]; + description = lib.mdDoc '' + List of plugins to be disabled. + ''; + }; + }; + }; + default = {}; + description = lib.mdDoc '' + Configurations for the fwupd daemon. + ''; + }; }; }; imports = [ - (mkRenamedOptionModule [ "services" "fwupd" "blacklistDevices"] [ "services" "fwupd" "disabledDevices" ]) - (mkRenamedOptionModule [ "services" "fwupd" "blacklistPlugins"] [ "services" "fwupd" "disabledPlugins" ]) + (mkRenamedOptionModule [ "services" "fwupd" "blacklistDevices"] [ "services" "fwupd" "daemonSettings" "DisabledDevices" ]) + (mkRenamedOptionModule [ "services" "fwupd" "blacklistPlugins"] [ "services" "fwupd" "daemonSettings" "DisabledPlugins" ]) + (mkRenamedOptionModule [ "services" "fwupd" "disabledDevices" ] [ "services" "fwupd" "daemonSettings" "DisabledDevices" ]) + (mkRenamedOptionModule [ "services" "fwupd" "disabledPlugins" ] [ "services" "fwupd" "daemonSettings" "DisabledPlugins" ]) ]; ###### implementation config = mkIf cfg.enable { # Disable test related plug-ins implicitly so that users do not have to care about them. - services.fwupd.disabledPlugins = cfg.package.defaultDisabledPlugins; + services.fwupd.daemonSettings.DisabledPlugins = cfg.package.defaultDisabledPlugins; environment.systemPackages = [ cfg.package ]; diff --git a/nixos/modules/services/hardware/lirc.nix b/nixos/modules/services/hardware/lirc.nix index acc43cd4186b..5b1a8d10c729 100644 --- a/nixos/modules/services/hardware/lirc.nix +++ b/nixos/modules/services/hardware/lirc.nix @@ -19,7 +19,7 @@ in { [lircd] nodaemon = False ''; - description = lib.mdDoc "LIRC default options descriped in man:lircd(8) ({file}`lirc_options.conf`)"; + description = lib.mdDoc "LIRC default options described in man:lircd(8) ({file}`lirc_options.conf`)"; }; configs = mkOption { diff --git a/nixos/modules/services/hardware/sane.nix b/nixos/modules/services/hardware/sane.nix index fe6dd268df60..2cac2e8e8bb4 100644 --- a/nixos/modules/services/hardware/sane.nix +++ b/nixos/modules/services/hardware/sane.nix @@ -28,7 +28,7 @@ let }; env = { - SANE_CONFIG_DIR = "/etc/sane.d"; + SANE_CONFIG_DIR = "/etc/sane-config"; LD_LIBRARY_PATH = [ "/etc/sane-libs" ]; }; @@ -141,7 +141,7 @@ in description = lib.mdDoc '' Enable saned network daemon for remote connection to scanners. - saned would be runned from `scanner` user; to allow + saned would be run from `scanner` user; to allow access to hardware that doesn't have `scanner` group you should add needed groups to this user. ''; @@ -167,7 +167,7 @@ in environment.systemPackages = backends; environment.sessionVariables = env; - environment.etc."sane.d".source = config.hardware.sane.configDir; + environment.etc."sane-config".source = config.hardware.sane.configDir; environment.etc."sane-libs".source = "${saneConfig}/lib/sane"; services.udev.packages = backends; diff --git a/nixos/modules/services/hardware/usbmuxd.nix b/nixos/modules/services/hardware/usbmuxd.nix index b4c954906dd3..9466ea26995b 100644 --- a/nixos/modules/services/hardware/usbmuxd.nix +++ b/nixos/modules/services/hardware/usbmuxd.nix @@ -13,6 +13,7 @@ in { options.services.usbmuxd = { + enable = mkOption { type = types.bool; default = false; @@ -39,6 +40,15 @@ in The group usbmuxd should use to run after startup. ''; }; + + package = mkOption { + type = types.package; + default = pkgs.usbmuxd; + defaultText = literalExpression "pkgs.usbmuxd"; + description = lib.mdDoc "Which package to use for the usbmuxd daemon."; + relatedPackages = [ "usbmuxd" "usbmuxd2" ]; + }; + }; config = mkIf cfg.enable { @@ -68,7 +78,7 @@ in # Trigger the udev rule manually. This doesn't require replugging the # device when first enabling the option to get it to work ExecStartPre = "${pkgs.udev}/bin/udevadm trigger -s usb -a idVendor=${apple}"; - ExecStart = "${pkgs.usbmuxd}/bin/usbmuxd -U ${cfg.user} -f"; + ExecStart = "${cfg.package}/bin/usbmuxd -U ${cfg.user} -v"; }; }; diff --git a/nixos/modules/services/home-automation/evcc.nix b/nixos/modules/services/home-automation/evcc.nix index c12ba9d0c1e2..efa2cf244313 100644 --- a/nixos/modules/services/home-automation/evcc.nix +++ b/nixos/modules/services/home-automation/evcc.nix @@ -48,7 +48,10 @@ in wantedBy = [ "multi-user.target" ]; - + environment.HOME = "/var/lib/evcc"; + path = with pkgs; [ + glibc # requires getent + ]; serviceConfig = { ExecStart = "${package}/bin/evcc --config ${configFile} ${escapeShellArgs cfg.extraArgs}"; CapabilityBoundingSet = [ "" ]; @@ -77,6 +80,7 @@ in ProtectKernelModules = true; ProtectKernelTunables = true; ProtectProc = "invisible"; + StateDirectory = "evcc"; SystemCallArchitectures = "native"; SystemCallFilter = [ "@system-service" diff --git a/nixos/modules/services/logging/logrotate.nix b/nixos/modules/services/logging/logrotate.nix index fd41b982678f..1799e9282b3b 100644 --- a/nixos/modules/services/logging/logrotate.nix +++ b/nixos/modules/services/logging/logrotate.nix @@ -163,7 +163,7 @@ in default = null; description = lib.mdDoc '' How often to rotate the logs. Defaults to previously set global setting, - which itself defauts to weekly. + which itself defaults to weekly. ''; }; diff --git a/nixos/modules/services/mail/exim.nix b/nixos/modules/services/mail/exim.nix index cd0da4fc5098..a9504acee351 100644 --- a/nixos/modules/services/mail/exim.nix +++ b/nixos/modules/services/mail/exim.nix @@ -116,8 +116,9 @@ in wantedBy = [ "multi-user.target" ]; restartTriggers = [ config.environment.etc."exim.conf".source ]; serviceConfig = { - ExecStart = "${cfg.package}/bin/exim -bdf -q${cfg.queueRunnerInterval}"; - ExecReload = "${coreutils}/bin/kill -HUP $MAINPID"; + ExecStart = "+${cfg.package}/bin/exim -bdf -q${cfg.queueRunnerInterval}"; + ExecReload = "+${coreutils}/bin/kill -HUP $MAINPID"; + User = cfg.user; }; preStart = '' if ! test -d ${cfg.spoolDir}; then diff --git a/nixos/modules/services/mail/listmonk.nix b/nixos/modules/services/mail/listmonk.nix index c4ea6747196c..8b636bd5b1ff 100644 --- a/nixos/modules/services/mail/listmonk.nix +++ b/nixos/modules/services/mail/listmonk.nix @@ -8,7 +8,7 @@ let # Escaping is done according to https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-CONSTANTS setDatabaseOption = key: value: "UPDATE settings SET value = '${ - lib.replaceChars [ "'" ] [ "''" ] (builtins.toJSON value) + lib.replaceStrings [ "'" ] [ "''" ] (builtins.toJSON value) }' WHERE key = '${key}';"; updateDatabaseConfigSQL = pkgs.writeText "update-database-config.sql" (concatStringsSep "\n" (mapAttrsToList setDatabaseOption diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix index 5edcd313a91a..0ca87696b143 100644 --- a/nixos/modules/services/mail/mailman.nix +++ b/nixos/modules/services/mail/mailman.nix @@ -113,7 +113,7 @@ in { type = types.str; example = "/run/secrets/ldap-bind"; description = lib.mdDoc '' - Path to the file containing the bind password of the servie account + Path to the file containing the bind password of the service account defined by [](#opt-services.mailman.ldap.bindDn). ''; }; diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix index 5461e89a801d..d01734d61e87 100644 --- a/nixos/modules/services/mail/postfix.nix +++ b/nixos/modules/services/mail/postfix.nix @@ -234,12 +234,12 @@ let headerChecks = concatStringsSep "\n" (map (x: "${x.pattern} ${x.action}") cfg.headerChecks) + cfg.extraHeaderChecks; - aliases = let seperator = if cfg.aliasMapType == "hash" then ":" else ""; in + aliases = let separator = if cfg.aliasMapType == "hash" then ":" else ""; in optionalString (cfg.postmasterAlias != "") '' - postmaster${seperator} ${cfg.postmasterAlias} + postmaster${separator} ${cfg.postmasterAlias} '' + optionalString (cfg.rootAlias != "") '' - root${seperator} ${cfg.rootAlias} + root${separator} ${cfg.rootAlias} '' + cfg.extraAliases ; diff --git a/nixos/modules/services/mail/public-inbox.nix b/nixos/modules/services/mail/public-inbox.nix index ab7ff5f726a4..9cd6726e6cb2 100644 --- a/nixos/modules/services/mail/public-inbox.nix +++ b/nixos/modules/services/mail/public-inbox.nix @@ -275,7 +275,11 @@ in default = {}; description = lib.mdDoc "public inboxes"; type = types.submodule { - freeformType = with types; /*inbox name*/attrsOf (/*inbox option name*/attrsOf /*inbox option value*/iniAtom); + # Keeping in line with the tradition of unnecessarily specific types, allow users to set + # freeform settings either globally under the `publicinbox` section, or for specific + # inboxes through additional nesting. + freeformType = with types; attrsOf (oneOf [ iniAtom (attrsOf iniAtom) ]); + options.css = mkOption { type = with types; listOf str; default = []; diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix index d8adf53e48a9..e05820fb87cf 100644 --- a/nixos/modules/services/mail/roundcube.nix +++ b/nixos/modules/services/mail/roundcube.nix @@ -39,7 +39,7 @@ in ''; description = lib.mdDoc '' - The package which contains roundcube's sources. Can be overriden to create + The package which contains roundcube's sources. Can be overridden to create an environment which contains roundcube and third-party plugins. ''; }; @@ -92,7 +92,7 @@ in default = []; example = literalExpression "with pkgs.aspellDicts; [ en fr de ]"; description = lib.mdDoc '' - List of aspell dictionnaries for spell checking. If empty, spell checking is disabled. + List of aspell dictionaries for spell checking. If empty, spell checking is disabled. ''; }; diff --git a/nixos/modules/services/matrix/mautrix-telegram.nix b/nixos/modules/services/matrix/mautrix-telegram.nix index 2d9c2dc76c29..5a632fd27e80 100644 --- a/nixos/modules/services/matrix/mautrix-telegram.nix +++ b/nixos/modules/services/matrix/mautrix-telegram.nix @@ -105,7 +105,7 @@ in { `MAUTRIX_TELEGRAM_TELEGRAM_BOT_TOKEN`. These environment variables can also be used to set other options by - replacing hierachy levels by `.`, converting the name to uppercase + replacing hierarchy levels by `.`, converting the name to uppercase and prepending `MAUTRIX_TELEGRAM_`. For example, the first value above maps to {option}`settings.appservice.as_token`. @@ -140,7 +140,7 @@ in { path = [ pkgs.lottieconverter ]; # mautrix-telegram tries to generate a dotfile in the home directory of - # the running user if using a postgresql databse: + # the running user if using a postgresql database: # # File "python3.10/site-packages/asyncpg/connect_utils.py", line 257, in _dot_postgre> # return (pathlib.Path.home() / '.postgresql' / filename).resolve() diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix index a80d4cabfec0..3087d879b9d2 100644 --- a/nixos/modules/services/matrix/synapse.nix +++ b/nixos/modules/services/matrix/synapse.nix @@ -80,7 +80,7 @@ in { (mkRemovedOptionModule [ "services" "matrix-synapse" "user_creation_max_duration" ] "It is no longer supported by synapse." ) (mkRemovedOptionModule [ "services" "matrix-synapse" "verbose" ] "Use a log config instead." ) - # options that were moved into rfc42 style settigns + # options that were moved into rfc42 style settings (mkRemovedOptionModule [ "services" "matrix-synapse" "app_service_config_files" ] "Use settings.app_service_config_files instead" ) (mkRemovedOptionModule [ "services" "matrix-synapse" "database_args" ] "Use settings.database.args instead" ) (mkRemovedOptionModule [ "services" "matrix-synapse" "database_name" ] "Use settings.database.args.database instead" ) @@ -507,6 +507,12 @@ in { sqlite3 = null; psycopg2 = "matrix-synapse"; }.${cfg.settings.database.name}; + defaultText = lib.literalExpression '' + { + sqlite3 = null; + psycopg2 = "matrix-synapse"; + }.''${cfg.settings.database.name}; + ''; description = lib.mdDoc '' Username to connect with psycopg2, set to null when using sqlite3. diff --git a/nixos/modules/services/misc/atuin.nix b/nixos/modules/services/misc/atuin.nix new file mode 100644 index 000000000000..c94852e3aad9 --- /dev/null +++ b/nixos/modules/services/misc/atuin.nix @@ -0,0 +1,85 @@ +{ config, pkgs, lib, ... }: + +with lib; + +let + cfg = config.services.atuin; +in +{ + options = { + services.atuin = { + enable = mkEnableOption (mdDoc "Enable server for shell history sync with atuin."); + + openRegistration = mkOption { + type = types.bool; + default = false; + description = mdDoc "Allow new user registrations with the atuin server."; + }; + + path = mkOption { + type = types.str; + default = ""; + description = mdDoc "A path to prepend to all the routes of the server."; + }; + + host = mkOption { + type = types.str; + default = "127.0.0.1"; + description = mdDoc "The host address the atuin server should listen on."; + }; + + port = mkOption { + type = types.port; + default = 8888; + description = mdDoc "The port the atuin server should listen on."; + }; + + openFirewall = mkOption { + type = types.bool; + default = false; + description = mdDoc "Open ports in the firewall for the atuin server."; + }; + + }; + }; + + config = mkIf cfg.enable { + + # enable postgres to host atuin db + services.postgresql = { + enable = true; + ensureUsers = [{ + name = "atuin"; + ensurePermissions = { + "DATABASE atuin" = "ALL PRIVILEGES"; + }; + }]; + ensureDatabases = [ "atuin" ]; + }; + + systemd.services.atuin = { + description = "atuin server"; + after = [ "network.target" "postgresql.service" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + ExecStart = "${pkgs.atuin}/bin/atuin server start"; + RuntimeDirectory = "atuin"; + RuntimeDirectoryMode = "0700"; + DynamicUser = true; + }; + + environment = { + ATUIN_HOST = cfg.host; + ATUIN_PORT = toString cfg.port; + ATUIN_OPEN_REGISTRATION = boolToString cfg.openRegistration; + ATUIN_DB_URI = "postgresql:///atuin"; + ATUIN_PATH = cfg.path; + ATUIN_CONFIG_DIR = "/run/atuin"; # required to start, but not used as configuration is via environment variables + }; + }; + + networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ]; + + }; +} diff --git a/nixos/modules/services/misc/dysnomia.nix b/nixos/modules/services/misc/dysnomia.nix index 4d748ec6eb66..0f92265ccbea 100644 --- a/nixos/modules/services/misc/dysnomia.nix +++ b/nixos/modules/services/misc/dysnomia.nix @@ -114,7 +114,7 @@ in }; components = mkOption { - description = lib.mdDoc "An atttribute set in which each key represents a container and each value an attribute set in which each key represents a component and each value a derivation constructing its initial state"; + description = lib.mdDoc "An attribute set in which each key represents a container and each value an attribute set in which each key represents a component and each value a derivation constructing its initial state"; default = {}; type = types.attrsOf types.attrs; }; diff --git a/nixos/modules/services/misc/gammu-smsd.nix b/nixos/modules/services/misc/gammu-smsd.nix index 2c7d90b28ded..83f4efe695a2 100644 --- a/nixos/modules/services/misc/gammu-smsd.nix +++ b/nixos/modules/services/misc/gammu-smsd.nix @@ -192,7 +192,7 @@ in { password = mkOption { type = types.nullOr types.str; default = null; - description = lib.mdDoc "User password used for connetion to the database"; + description = lib.mdDoc "User password used for connection to the database"; }; }; }; diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix index d29416eda219..ceb4c1172854 100644 --- a/nixos/modules/services/misc/gitea.nix +++ b/nixos/modules/services/misc/gitea.nix @@ -183,7 +183,7 @@ in file = mkOption { type = types.nullOr types.str; default = null; - description = lib.mdDoc "Filename to be used for the dump. If `null` a default name is choosen by gitea."; + description = lib.mdDoc "Filename to be used for the dump. If `null` a default name is chosen by gitea."; example = "gitea-dump"; }; }; @@ -487,7 +487,7 @@ in # In older versions the secret naming for JWT was kind of confusing. # The file jwt_secret hold the value for LFS_JWT_SECRET and JWT_SECRET - # wasn't persistant at all. + # wasn't persistent at all. # To fix that, there is now the file oauth2_jwt_secret containing the # values for JWT_SECRET and the file jwt_secret gets renamed to # lfs_jwt_secret. diff --git a/nixos/modules/services/misc/gitlab.xml b/nixos/modules/services/misc/gitlab.xml index 40424c5039a2..9816fdac7dd7 100644 --- a/nixos/modules/services/misc/gitlab.xml +++ b/nixos/modules/services/misc/gitlab.xml @@ -141,7 +141,7 @@ services.gitlab = { </para> <para> - A list of all availabe rake tasks can be obtained by running: + A list of all available rake tasks can be obtained by running: <screen> <prompt>$ </prompt>sudo -u git -H gitlab-rake -T </screen> diff --git a/nixos/modules/services/misc/gpsd.nix b/nixos/modules/services/misc/gpsd.nix index 1ab8d1bbe062..ec0a8e1eaa1c 100644 --- a/nixos/modules/services/misc/gpsd.nix +++ b/nixos/modules/services/misc/gpsd.nix @@ -77,6 +77,14 @@ in ''; }; + listenany = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + Listen on all addresses rather than just loopback. + ''; + }; + }; }; @@ -106,6 +114,7 @@ in -S "${toString cfg.port}" \ ${optionalString cfg.readonly "-b"} \ ${optionalString cfg.nowait "-n"} \ + ${optionalString cfg.listenany "-G"} \ "${cfg.device}" ''; }; diff --git a/nixos/modules/services/misc/jellyfin.nix b/nixos/modules/services/misc/jellyfin.nix index f49657a07533..2a4483199d7d 100644 --- a/nixos/modules/services/misc/jellyfin.nix +++ b/nixos/modules/services/misc/jellyfin.nix @@ -81,7 +81,7 @@ in ProtectKernelTunables = !config.boot.isContainer; LockPersonality = true; PrivateTmp = !config.boot.isContainer; - # needed for hardware accelaration + # needed for hardware acceleration PrivateDevices = false; PrivateUsers = true; RemoveIPC = true; diff --git a/nixos/modules/services/misc/nitter.nix b/nixos/modules/services/misc/nitter.nix index 95394d9d2113..f0cb5cc15138 100644 --- a/nixos/modules/services/misc/nitter.nix +++ b/nixos/modules/services/misc/nitter.nix @@ -47,7 +47,7 @@ in { options = { services.nitter = { - enable = mkEnableOption (lib.mdDoc "If enabled, start Nitter."); + enable = mkEnableOption (lib.mdDoc "Nitter"); package = mkOption { default = pkgs.nitter; diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix index c88fceb9a92c..10db7cdfb33c 100644 --- a/nixos/modules/services/misc/nix-daemon.nix +++ b/nixos/modules/services/misc/nix-daemon.nix @@ -42,7 +42,7 @@ let else if isDerivation v then toString v else if builtins.isPath v then toString v else if isString v then v - else if isCoercibleToString v then toString v + else if strings.isCoercibleToString v then toString v else abort "The nix conf value: ${toPretty {} v} can not be encoded"; mkKeyValue = k: v: "${escape [ "=" ] k} = ${mkValueString v}"; @@ -609,7 +609,7 @@ in By default, pseudo-features `nixos-test`, `benchmark`, and `big-parallel` used in Nixpkgs are set, `kvm` - is also included in it is avaliable. + is also included if it is available. ''; }; @@ -642,7 +642,7 @@ in description = lib.mdDoc '' Configuration for Nix, see <https://nixos.org/manual/nix/stable/#sec-conf-file> or - {manpage}`nix.conf(5)` for avalaible options. + {manpage}`nix.conf(5)` for available options. The value declared here will be translated directly to the key-value pairs Nix expects. You can use {command}`nix-instantiate --eval --strict '<nixpkgs/nixos>' -A config.nix.settings` @@ -819,7 +819,7 @@ in optionals (pkgs.hostPlatform ? gcc.arch) ( # a builder can run code for `gcc.arch` and inferior architectures [ "gccarch-${pkgs.hostPlatform.gcc.arch}" ] ++ - map (x: "gccarch-${x}") systems.architectures.inferiors.${pkgs.hostPlatform.gcc.arch} + map (x: "gccarch-${x}") (systems.architectures.inferiors.${pkgs.hostPlatform.gcc.arch} or []) ) ); } diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix index 6a98d5cb686d..33a8394dff2d 100644 --- a/nixos/modules/services/misc/paperless.nix +++ b/nixos/modules/services/misc/paperless.nix @@ -211,19 +211,15 @@ in ]; systemd.services.paperless-scheduler = { - description = "Paperless scheduler"; + description = "Paperless Celery Beat"; serviceConfig = defaultServiceConfig // { User = cfg.user; - ExecStart = "${pkg}/bin/paperless-ngx qcluster"; + ExecStart = "${pkg}/bin/celery --app paperless beat --loglevel INFO"; Restart = "on-failure"; - # The `mbind` syscall is needed for running the classifier. - SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "mbind" ]; - # Needs to talk to mail server for automated import rules - PrivateNetwork = false; }; environment = env; wantedBy = [ "multi-user.target" ]; - wants = [ "paperless-consumer.service" "paperless-web.service" ]; + wants = [ "paperless-consumer.service" "paperless-web.service" "paperless-task-queue.service" ]; preStart = '' ln -sf ${manage} ${cfg.dataDir}/paperless-manage @@ -250,6 +246,20 @@ in after = [ "redis-paperless.service" ]; }; + systemd.services.paperless-task-queue = { + description = "Paperless Celery Workers"; + serviceConfig = defaultServiceConfig // { + User = cfg.user; + ExecStart = "${pkg}/bin/celery --app paperless worker --loglevel INFO"; + Restart = "on-failure"; + # The `mbind` syscall is needed for running the classifier. + SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "mbind" ]; + # Needs to talk to mail server for automated import rules + PrivateNetwork = false; + }; + environment = env; + }; + # Reading the user-provided password file requires root access systemd.services.paperless-copy-password = mkIf (cfg.passwordFile != null) { requiredBy = [ "paperless-scheduler.service" ]; @@ -301,7 +311,7 @@ in }; # Allow the web interface to access the private /tmp directory of the server. # This is required to support uploading files via the web interface. - unitConfig.JoinsNamespaceOf = "paperless-scheduler.service"; + unitConfig.JoinsNamespaceOf = "paperless-task-queue.service"; # Bind to `paperless-scheduler` so that the web server never runs # during migrations bindsTo = [ "paperless-scheduler.service" ]; diff --git a/nixos/modules/services/misc/podgrab.nix b/nixos/modules/services/misc/podgrab.nix index c0a124718505..c596122fd31c 100644 --- a/nixos/modules/services/misc/podgrab.nix +++ b/nixos/modules/services/misc/podgrab.nix @@ -12,7 +12,7 @@ in example = "/run/secrets/password.env"; description = lib.mdDoc '' The path to a file containing the PASSWORD environment variable - definition for Podgrab's authentification. + definition for Podgrab's authentication. ''; }; diff --git a/nixos/modules/services/misc/portunus.nix b/nixos/modules/services/misc/portunus.nix index 1dae605e46f2..f60cbe347713 100644 --- a/nixos/modules/services/misc/portunus.nix +++ b/nixos/modules/services/misc/portunus.nix @@ -135,7 +135,7 @@ in type = types.bool; default = false; description = lib.mdDoc '' - Wether to enable LDAPS protocol. + Whether to enable LDAPS protocol. This also adds two entries to the `/etc/hosts` file to point [](#opt-services.portunus.domain) to localhost, so that CLIs and programs can use ldaps protocol and verify the certificate without opening the firewall port for the protocol. diff --git a/nixos/modules/services/misc/serviio.nix b/nixos/modules/services/misc/serviio.nix index 57efebb2c03f..18e64030d79d 100644 --- a/nixos/modules/services/misc/serviio.nix +++ b/nixos/modules/services/misc/serviio.nix @@ -80,7 +80,7 @@ in { 23424 # mediabrowser ]; allowedUDPPorts = [ - 1900 # UPnP service discovey + 1900 # UPnP service discovery ]; }; }; diff --git a/nixos/modules/services/misc/sourcehut/service.nix b/nixos/modules/services/misc/sourcehut/service.nix index 37a439ee352b..aae13e0cc2c9 100644 --- a/nixos/modules/services/misc/sourcehut/service.nix +++ b/nixos/modules/services/misc/sourcehut/service.nix @@ -71,7 +71,7 @@ let # Note that each systemd service gets its own ${runDir}/config.ini file. ExecStartPre = mkBefore [("+"+pkgs.writeShellScript "${serviceName}-credentials" '' set -x - # Replace values begining with a '<' by the content of the file whose name is after. + # Replace values beginning with a '<' by the content of the file whose name is after. gawk '{ if (match($0,/^([^=]+=)<(.+)/,m)) { getline f < m[2]; print m[1] f } else print $0 }' ${configIni} | ${optionalString (!allowStripe) "gawk '!/^stripe-secret-key=/' |"} install -o ${srvCfg.user} -g root -m 400 /dev/stdin ${runDir}/config.ini diff --git a/nixos/modules/services/misc/taskserver/default.nix b/nixos/modules/services/misc/taskserver/default.nix index aeefd657f4d0..ee4bf42183f9 100644 --- a/nixos/modules/services/misc/taskserver/default.nix +++ b/nixos/modules/services/misc/taskserver/default.nix @@ -145,7 +145,7 @@ in { in lib.mdDoc '' Whether to enable the Taskwarrior server. - More instructions about NixOS in conjuction with Taskserver can be + More instructions about NixOS in conjunction with Taskserver can be found [in the NixOS manual](${url}). ''; }; @@ -251,7 +251,7 @@ in { client id (such as `task 2.3.0`). The values `all` or `none` have - special meaning. Overidden by any entry in the option + special meaning. Overridden by any entry in the option {option}`services.taskserver.disallowedClientIDs`. ''; }; diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix index 9b3068796d8e..9a9a0ab75532 100644 --- a/nixos/modules/services/monitoring/grafana.nix +++ b/nixos/modules/services/monitoring/grafana.nix @@ -555,7 +555,7 @@ in { auto_assign_org_role = mkOption { description = lib.mdDoc "Default role new users will be auto assigned."; default = "Viewer"; - type = types.enum ["Viewer" "Editor"]; + type = types.enum ["Viewer" "Editor" "Admin"]; }; }; @@ -1291,7 +1291,10 @@ in { SystemCallArchitectures = "native"; # Upstream grafana is not setting SystemCallFilter for compatibility # reasons, see https://github.com/grafana/grafana/pull/40176 - SystemCallFilter = [ "@system-service" "~@privileged" ]; + SystemCallFilter = [ + "@system-service" + "~@privileged" + ] ++ lib.optional (cfg.settings.server.protocol == "socket") [ "@chown" ]; UMask = "0027"; }; preStart = '' diff --git a/nixos/modules/services/monitoring/graphite.nix b/nixos/modules/services/monitoring/graphite.nix index 8d92e60d3bad..65c91b8f79bb 100644 --- a/nixos/modules/services/monitoring/graphite.nix +++ b/nixos/modules/services/monitoring/graphite.nix @@ -154,14 +154,14 @@ in { }; blacklist = mkOption { - description = lib.mdDoc "Any metrics received which match one of the experssions will be dropped."; + description = lib.mdDoc "Any metrics received which match one of the expressions will be dropped."; default = null; type = types.nullOr types.str; example = "^some\\.noisy\\.metric\\.prefix\\..*"; }; whitelist = mkOption { - description = lib.mdDoc "Only metrics received which match one of the experssions will be persisted."; + description = lib.mdDoc "Only metrics received which match one of the expressions will be persisted."; default = null; type = types.nullOr types.str; example = ".*"; diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager.nix b/nixos/modules/services/monitoring/prometheus/alertmanager.nix index 8706a18a184d..0c0931d3d295 100644 --- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix +++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix @@ -34,7 +34,7 @@ in { (mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "group" ] "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a group setting.") (mkRemovedOptionModule [ "services" "prometheus" "alertmanagerURL" ] '' Due to incompatibility, the alertmanagerURL option has been removed, - please use 'services.prometheus2.alertmanagers' instead. + please use 'services.prometheus.alertmanagers' instead. '') ]; diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix index f6bae8f9e965..f516b75ab10f 100644 --- a/nixos/modules/services/monitoring/prometheus/default.nix +++ b/nixos/modules/services/monitoring/prometheus/default.nix @@ -3,7 +3,7 @@ with lib; let - json = pkgs.formats.json { }; + yaml = pkgs.formats.yaml { }; cfg = config.services.prometheus; checkConfigEnabled = (lib.isBool cfg.checkConfig && cfg.checkConfig) @@ -11,8 +11,6 @@ let workingDir = "/var/lib/" + cfg.stateDir; - prometheusYmlOut = "${workingDir}/prometheus-substituted.yaml"; - triggerReload = pkgs.writeShellScriptBin "trigger-reload-prometheus" '' PATH="${makeBinPath (with pkgs; [ systemd ])}" if systemctl -q is-active prometheus.service; then @@ -38,7 +36,7 @@ let promtool ${what} $out '' else file; - generatedPrometheusYml = json.generate "prometheus.yml" promConfig; + generatedPrometheusYml = yaml.generate "prometheus.yml" promConfig; # This becomes the main config file for Prometheus promConfig = { @@ -73,7 +71,8 @@ let "--web.listen-address=${cfg.listenAddress}:${builtins.toString cfg.port}" "--alertmanager.notification-queue-capacity=${toString cfg.alertmanagerNotificationQueueCapacity}" ] ++ optional (cfg.webExternalUrl != null) "--web.external-url=${cfg.webExternalUrl}" - ++ optional (cfg.retentionTime != null) "--storage.tsdb.retention.time=${cfg.retentionTime}"; + ++ optional (cfg.retentionTime != null) "--storage.tsdb.retention.time=${cfg.retentionTime}" + ++ optional (cfg.webConfigFile != null) "--web.config.file=${cfg.webConfigFile}"; filterValidPrometheus = filterAttrsListRecursive (n: v: !(n == "_module" || v == null)); filterAttrsListRecursive = pred: x: @@ -1719,6 +1718,15 @@ in ''; }; + webConfigFile = mkOption { + type = types.nullOr types.path; + default = null; + description = lib.mdDoc '' + Specifies which file should be used as web.config.file and be passed on startup. + See https://prometheus.io/docs/prometheus/latest/configuration/https/ for valid options. + ''; + }; + checkConfig = mkOption { type = with types; either bool (enum [ "syntax-only" ]); default = true; diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix index 2451f46ba7d7..f3fbfb149ad7 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters.nix @@ -68,6 +68,7 @@ let "smartctl" "smokeping" "sql" + "statsd" "surfboard" "systemd" "tor" diff --git a/nixos/modules/services/monitoring/prometheus/exporters.xml b/nixos/modules/services/monitoring/prometheus/exporters.xml index 1df88bb61a12..e922e1ace8d0 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters.xml +++ b/nixos/modules/services/monitoring/prometheus/exporters.xml @@ -37,7 +37,7 @@ by default</link>, via http under <literal>/metrics</literal>. In this example the firewall should just allow incoming connections to the exporter's port on the bridge interface <literal>br0</literal> (this would - have to be configured seperately of course). For more information about + have to be configured separately of course). For more information about configuration see <literal>man configuration.nix</literal> or search through the <link xlink:href="https://nixos.org/nixos/options.html#prometheus.exporters">available @@ -179,7 +179,7 @@ in # for the exporter's systemd service. One of # `serviceOpts.script` and `serviceOpts.serviceConfig.ExecStart` # has to be specified here. This will be merged with the default - # service confiuration. + # service configuration. # Note that by default 'DynamicUser' is 'true'. serviceOpts = { serviceConfig = { diff --git a/nixos/modules/services/monitoring/prometheus/exporters/nginxlog.nix b/nixos/modules/services/monitoring/prometheus/exporters/nginxlog.nix index 9e507423c7d6..674dc9dd4158 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters/nginxlog.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters/nginxlog.nix @@ -17,7 +17,7 @@ in { settings that can all be used here: https://github.com/martin-helmich/prometheus-nginxlog-exporter The `listen` object is already generated by `port`, `listenAddress` and `metricsEndpoint` and - will be merged with the value of `settings` before writting it as JSON. + will be merged with the value of `settings` before writing it as JSON. ''; }; diff --git a/nixos/modules/services/monitoring/prometheus/exporters/statsd.nix b/nixos/modules/services/monitoring/prometheus/exporters/statsd.nix new file mode 100644 index 000000000000..d9d732d8c125 --- /dev/null +++ b/nixos/modules/services/monitoring/prometheus/exporters/statsd.nix @@ -0,0 +1,19 @@ +{ config, lib, pkgs, options }: + +with lib; + +let + cfg = config.services.prometheus.exporters.statsd; +in +{ + port = 9102; + serviceOpts = { + serviceConfig = { + ExecStart = '' + ${pkgs.prometheus-statsd-exporter}/bin/statsd_exporter \ + --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \ + ${concatStringsSep " \\\n " cfg.extraFlags} + ''; + }; + }; +} diff --git a/nixos/modules/services/monitoring/thanos.nix b/nixos/modules/services/monitoring/thanos.nix index 41462da4ff4c..e6d8afc66624 100644 --- a/nixos/modules/services/monitoring/thanos.nix +++ b/nixos/modules/services/monitoring/thanos.nix @@ -300,7 +300,7 @@ let max-time = mkParamDef types.str "9999-12-31T23:59:59Z" '' End of time range limit to serve. - Thanos Store serves only blocks, which happened eariler than this + Thanos Store serves only blocks, which happened earlier than this value. Option can be a constant time in RFC3339 format or time duration relative to current time, such as -1d or 2h45m. Valid duration units are ms, s, m, h, d, w, y. diff --git a/nixos/modules/services/monitoring/ups.nix b/nixos/modules/services/monitoring/ups.nix index c7abaeb2973e..bb11b6a1c1d0 100644 --- a/nixos/modules/services/monitoring/ups.nix +++ b/nixos/modules/services/monitoring/ups.nix @@ -12,7 +12,7 @@ let upsOptions = {name, config, ...}: { options = { - # This can be infered from the UPS model by looking at + # This can be inferred from the UPS model by looking at # /nix/store/nut/share/driver.list driver = mkOption { type = types.str; @@ -228,7 +228,7 @@ in "} ''; "nut/upssched.conf".source = cfg.schedulerRules; - # These file are containing private informations and thus should not + # These file are containing private information and thus should not # be stored inside the Nix store. /* "nut/upsd.conf".source = ""; diff --git a/nixos/modules/services/network-filesystems/kubo.nix b/nixos/modules/services/network-filesystems/kubo.nix index 51e1282db418..13a062c32128 100644 --- a/nixos/modules/services/network-filesystems/kubo.nix +++ b/nixos/modules/services/network-filesystems/kubo.nix @@ -54,7 +54,7 @@ in services.kubo = { - enable = mkEnableOption (lib.mdDoc "Interplanetary File System (WARNING: may cause severe network degredation)"); + enable = mkEnableOption (lib.mdDoc "Interplanetary File System (WARNING: may cause severe network degradation)"); package = mkOption { type = types.package; diff --git a/nixos/modules/services/network-filesystems/moosefs.nix b/nixos/modules/services/network-filesystems/moosefs.nix index c9a5a43ebcd9..ab82a2a07dd4 100644 --- a/nixos/modules/services/network-filesystems/moosefs.nix +++ b/nixos/modules/services/network-filesystems/moosefs.nix @@ -52,7 +52,7 @@ let chunkserverCfg = settingsFormat.generate "mfschunkserver.cfg" cfg.chunkserver.settings; - # generic template for all deamons + # generic template for all daemons systemdService = name: extraConfig: configFile: { wantedBy = [ "multi-user.target" ]; wants = [ "network-online.target" ]; @@ -94,7 +94,7 @@ in { Enable Moosefs master daemon. You need to run `mfsmaster-init` on a freshly installed master server to - initialize the `DATA_PATH` direcory. + initialize the `DATA_PATH` directory. ''; default = false; }; diff --git a/nixos/modules/services/network-filesystems/orangefs/client.nix b/nixos/modules/services/network-filesystems/orangefs/client.nix index 471e17970ae1..68f23f477af1 100644 --- a/nixos/modules/services/network-filesystems/orangefs/client.nix +++ b/nixos/modules/services/network-filesystems/orangefs/client.nix @@ -21,7 +21,7 @@ in { fileSystems = mkOption { description = lib.mdDoc '' The orangefs file systems to be mounted. - This option is prefered over using {option}`fileSystems` directly since + This option is preferred over using {option}`fileSystems` directly since the pvfs client service needs to be running for it to be mounted. ''; diff --git a/nixos/modules/services/network-filesystems/orangefs/server.nix b/nixos/modules/services/network-filesystems/orangefs/server.nix index 8e6838c04678..e20e7975ebaa 100644 --- a/nixos/modules/services/network-filesystems/orangefs/server.nix +++ b/nixos/modules/services/network-filesystems/orangefs/server.nix @@ -209,7 +209,7 @@ in { after = [ "network-online.target" ]; serviceConfig = { - # Run as "simple" in forground mode. + # Run as "simple" in foreground mode. # This is more reliable ExecStart = '' ${pkgs.orangefs}/bin/pvfs2-server -d \ diff --git a/nixos/modules/services/networking/3proxy.nix b/nixos/modules/services/networking/3proxy.nix index e643ed941315..ef695a7f49fa 100644 --- a/nixos/modules/services/networking/3proxy.nix +++ b/nixos/modules/services/networking/3proxy.nix @@ -158,7 +158,7 @@ in { description = lib.mdDoc '' List of target IP ranges, use empty list for any. May also contain host names instead of addresses. - It's possible to use wildmask in the begginning and in the the end of hostname, e.g. `*badsite.com` or `*badcontent*`. + It's possible to use wildmask in the beginning and in the the end of hostname, e.g. `*badsite.com` or `*badcontent*`. Hostname is only checked if hostname presents in request. ''; }; diff --git a/nixos/modules/services/networking/avahi-daemon.nix b/nixos/modules/services/networking/avahi-daemon.nix index 0875d8a85140..3933ed5a2315 100644 --- a/nixos/modules/services/networking/avahi-daemon.nix +++ b/nixos/modules/services/networking/avahi-daemon.nix @@ -103,16 +103,17 @@ in openFirewall = mkOption { type = types.bool; - default = false; + default = true; description = lib.mdDoc '' Whether to open the firewall for UDP port 5353. + Disabling this setting also disables discovering of network devices. ''; }; allowPointToPoint = mkOption { type = types.bool; default = false; - description= lib.mdDoc '' + description = lib.mdDoc '' Whether to use POINTTOPOINT interfaces. Might make mDNS unreliable due to usually large latencies with such links and opens a potential security hole by allowing mDNS access from Internet connections. diff --git a/nixos/modules/services/networking/biboumi.nix b/nixos/modules/services/networking/biboumi.nix index 896a2350e3d5..1428856764e6 100644 --- a/nixos/modules/services/networking/biboumi.nix +++ b/nixos/modules/services/networking/biboumi.nix @@ -45,7 +45,7 @@ in default = "/etc/ssl/certs/ca-certificates.crt"; description = lib.mdDoc '' Specifies which file should be used as the list of trusted CA - when negociating a TLS session. + when negotiating a TLS session. ''; }; options.db_name = mkOption { @@ -111,7 +111,7 @@ in description = lib.mdDoc '' A directory that should contain the policy files, used to customize Botan’s behaviour - when negociating the TLS connections with the IRC servers. + when negotiating the TLS connections with the IRC servers. ''; }; options.port = mkOption { diff --git a/nixos/modules/services/networking/bitcoind.nix b/nixos/modules/services/networking/bitcoind.nix index 6df809a8b764..a86d52b7202d 100644 --- a/nixos/modules/services/networking/bitcoind.nix +++ b/nixos/modules/services/networking/bitcoind.nix @@ -95,7 +95,7 @@ let } ''; type = types.attrsOf (types.submodule rpcUserOpts); - description = lib.mdDoc "RPC user information for JSON-RPC connnections."; + description = lib.mdDoc "RPC user information for JSON-RPC connections."; }; }; diff --git a/nixos/modules/services/networking/bitlbee.nix b/nixos/modules/services/networking/bitlbee.nix index 88c04597e2bc..146bffaa6edf 100644 --- a/nixos/modules/services/networking/bitlbee.nix +++ b/nixos/modules/services/networking/bitlbee.nix @@ -60,7 +60,7 @@ in type = types.str; default = "127.0.0.1"; description = lib.mdDoc '' - The interface the BitlBee deamon will be listening to. If `127.0.0.1`, + The interface the BitlBee daemon will be listening to. If `127.0.0.1`, only clients on the local host can connect to it; if `0.0.0.0`, clients can access it from any network interface. ''; diff --git a/nixos/modules/services/networking/cloudflared.nix b/nixos/modules/services/networking/cloudflared.nix new file mode 100644 index 000000000000..c8fc9fafee6d --- /dev/null +++ b/nixos/modules/services/networking/cloudflared.nix @@ -0,0 +1,332 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.cloudflared; + + originRequest = { + connectTimeout = mkOption { + type = with types; nullOr str; + default = null; + example = "30s"; + description = lib.mdDoc '' + Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by [https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/#tlstimeout](tlsTimeout). + ''; + }; + + tlsTimeout = mkOption { + type = with types; nullOr str; + default = null; + example = "10s"; + description = lib.mdDoc '' + Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server. + ''; + }; + + tcpKeepAlive = mkOption { + type = with types; nullOr str; + default = null; + example = "30s"; + description = lib.mdDoc '' + The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server. + ''; + }; + + noHappyEyeballs = mkOption { + type = with types; nullOr bool; + default = null; + example = false; + description = lib.mdDoc '' + Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols. + ''; + }; + + keepAliveConnections = mkOption { + type = with types; nullOr int; + default = null; + example = 100; + description = lib.mdDoc '' + Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections. + ''; + }; + + keepAliveTimeout = mkOption { + type = with types; nullOr str; + default = null; + example = "1m30s"; + description = lib.mdDoc '' + Timeout after which an idle keepalive connection can be discarded. + ''; + }; + + httpHostHeader = mkOption { + type = with types; nullOr str; + default = null; + example = ""; + description = lib.mdDoc '' + Sets the HTTP `Host` header on requests sent to the local service. + ''; + }; + + originServerName = mkOption { + type = with types; nullOr str; + default = null; + example = ""; + description = lib.mdDoc '' + Hostname that `cloudflared` should expect from your origin server certificate. + ''; + }; + + caPool = mkOption { + type = with types; nullOr (either str path); + default = null; + example = ""; + description = lib.mdDoc '' + Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare. + ''; + }; + + noTLSVerify = mkOption { + type = with types; nullOr bool; + default = null; + example = false; + description = lib.mdDoc '' + Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted. + ''; + }; + + disableChunkedEncoding = mkOption { + type = with types; nullOr bool; + default = null; + example = false; + description = lib.mdDoc '' + Disables chunked transfer encoding. Useful if you are running a WSGI server. + ''; + }; + + proxyAddress = mkOption { + type = with types; nullOr str; + default = null; + example = "127.0.0.1"; + description = lib.mdDoc '' + `cloudflared` starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures the listen address for that proxy. + ''; + }; + + proxyPort = mkOption { + type = with types; nullOr int; + default = null; + example = 0; + description = lib.mdDoc '' + `cloudflared` starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures the listen port for that proxy. If set to zero, an unused port will randomly be chosen. + ''; + }; + + proxyType = mkOption { + type = with types; nullOr (enum [ "" "socks" ]); + default = null; + example = ""; + description = lib.mdDoc '' + `cloudflared` starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: + + - `""` for the regular proxy + - `"socks"` for a SOCKS5 proxy. Refer to the [https://developers.cloudflare.com/cloudflare-one/tutorials/kubectl/](tutorial on connecting through Cloudflare Access using kubectl) for more information. + ''; + }; + }; +in +{ + options.services.cloudflared = { + enable = mkEnableOption (lib.mdDoc "Cloudflare Tunnel client daemon (formerly Argo Tunnel)"); + + user = mkOption { + type = types.str; + default = "cloudflared"; + description = lib.mdDoc "User account under which Cloudflared runs."; + }; + + group = mkOption { + type = types.str; + default = "cloudflared"; + description = lib.mdDoc "Group under which cloudflared runs."; + }; + + package = mkOption { + type = types.package; + default = pkgs.cloudflared; + defaultText = "pkgs.cloudflared"; + description = lib.mdDoc "The package to use for Cloudflared."; + }; + + tunnels = mkOption { + description = lib.mdDoc '' + Cloudflare tunnels. + ''; + type = types.attrsOf (types.submodule ({ name, ... }: { + options = { + inherit originRequest; + + credentialsFile = mkOption { + type = with types; nullOr str; + default = null; + description = lib.mdDoc '' + Credential file. + + See [https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-useful-terms/#credentials-file](Credentials file). + ''; + }; + + warp-routing = { + enabled = mkOption { + type = with types; nullOr bool; + default = null; + description = lib.mdDoc '' + Enable warp routing. + + See [https://developers.cloudflare.com/cloudflare-one/tutorials/warp-to-tunnel/](Connect from WARP to a private network on Cloudflare using Cloudflare Tunnel). + ''; + }; + }; + + default = mkOption { + type = with types; nullOr str; + default = null; + description = lib.mdDoc '' + Catch-all service if no ingress matches. + + See `service`. + ''; + example = "http_status:404"; + }; + + ingress = mkOption { + type = with types; attrsOf (either str (submodule ({ hostname, ... }: { + options = { + inherit originRequest; + + service = mkOption { + type = with types; nullOr str; + default = null; + description = lib.mdDoc '' + Service to pass the traffic. + + See [https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/#supported-protocols](Supported protocols). + ''; + example = "http://localhost:80, tcp://localhost:8000, unix:/home/production/echo.sock, hello_world or http_status:404"; + }; + + path = mkOption { + type = with types; nullOr str; + default = null; + description = lib.mdDoc '' + Path filter. + + If not specified, all paths will be matched. + ''; + example = "/*.(jpg|png|css|js)"; + }; + + }; + }))); + default = { }; + description = lib.mdDoc '' + Ingress rules. + + See [https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/](Ingress rules). + ''; + example = { + "*.domain.com" = "http://localhost:80"; + "*.anotherone.com" = "http://localhost:80"; + }; + }; + }; + })); + + default = { }; + example = { + "00000000-0000-0000-0000-000000000000" = { + credentialsFile = "/tmp/test"; + ingress = { + "*.domain1.com" = { + service = "http://localhost:80"; + }; + }; + default = "http_status:404"; + }; + }; + }; + }; + + config = mkIf cfg.enable { + systemd.targets = + mapAttrs' + (name: tunnel: + nameValuePair "cloudflared-tunnel-${name}" ({ + description = lib.mdDoc "Cloudflare tunnel '${name}' target"; + requires = [ "cloudflared-tunnel-${name}.service" ]; + after = [ "cloudflared-tunnel-${name}.service" ]; + unitConfig.StopWhenUnneeded = true; + }) + ) + config.services.cloudflared.tunnels; + + systemd.services = + mapAttrs' + (name: tunnel: + let + filterConfig = lib.attrsets.filterAttrsRecursive (_: v: ! builtins.elem v [ null [ ] { } ]); + + filterIngressSet = filterAttrs (_: v: builtins.typeOf v == "set"); + filterIngressStr = filterAttrs (_: v: builtins.typeOf v == "string"); + + ingressesSet = filterIngressSet tunnel.ingress; + ingressesStr = filterIngressStr tunnel.ingress; + + fullConfig = { + tunnel = name; + "credentials-file" = tunnel.credentialsFile; + ingress = + (map + (key: { + hostname = key; + } // getAttr key (filterConfig (filterConfig ingressesSet))) + (attrNames ingressesSet)) + ++ + (map + (key: { + hostname = key; + service = getAttr key ingressesStr; + }) + (attrNames ingressesStr)) + ++ [{ service = tunnel.default; }]; + }; + mkConfigFile = pkgs.writeText "cloudflared.yml" (builtins.toJSON fullConfig); + in + nameValuePair "cloudflared-tunnel-${name}" ({ + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + User = cfg.user; + Group = cfg.group; + ExecStart = "${cfg.package}/bin/cloudflared tunnel --config=${mkConfigFile} --no-autoupdate run"; + Restart = "always"; + }; + }) + ) + config.services.cloudflared.tunnels; + + users.users = mkIf (cfg.user == "cloudflared") { + cloudflared = { + group = cfg.group; + isSystemUser = true; + }; + }; + + users.groups = mkIf (cfg.group == "cloudflared") { + cloudflared = { }; + }; + }; + + meta.maintainers = with maintainers; [ bbigras ]; +} diff --git a/nixos/modules/services/networking/consul.nix b/nixos/modules/services/networking/consul.nix index bee41dcf765d..f1c36138be3e 100644 --- a/nixos/modules/services/networking/consul.nix +++ b/nixos/modules/services/networking/consul.nix @@ -142,7 +142,7 @@ in }; consulAddr = mkOption { - description = lib.mdDoc "Consul api listening adddress"; + description = lib.mdDoc "Consul api listening address"; default = "localhost:8500"; type = types.str; }; diff --git a/nixos/modules/services/networking/epmd.nix b/nixos/modules/services/networking/epmd.nix index 534b80906211..0bc8c71f4eaa 100644 --- a/nixos/modules/services/networking/epmd.nix +++ b/nixos/modules/services/networking/epmd.nix @@ -32,7 +32,7 @@ in default = "[::]:4369"; description = lib.mdDoc '' the listenStream used by the systemd socket. - see https://www.freedesktop.org/software/systemd/man/systemd.socket.html#ListenStream= for more informations. + see https://www.freedesktop.org/software/systemd/man/systemd.socket.html#ListenStream= for more information. use this to change the port epmd will run on. if not defined, epmd will use "[::]:4369" ''; diff --git a/nixos/modules/services/networking/firefox-syncserver.nix b/nixos/modules/services/networking/firefox-syncserver.nix index c3d9f43f7457..9733fb16d903 100644 --- a/nixos/modules/services/networking/firefox-syncserver.nix +++ b/nixos/modules/services/networking/firefox-syncserver.nix @@ -11,8 +11,10 @@ let format = pkgs.formats.toml {}; settings = { - database_url = dbURL; human_logs = true; + syncstorage = { + database_url = dbURL; + }; tokenserver = { node_type = "mysql"; database_url = dbURL; @@ -253,8 +255,7 @@ in serviceConfig = { User = defaultUser; Group = defaultUser; - ExecStart = "${cfg.package}/bin/syncstorage --config ${configFile}"; - Stderr = "journal"; + ExecStart = "${cfg.package}/bin/syncserver --config ${configFile}"; EnvironmentFile = lib.mkIf (cfg.secrets != null) "${cfg.secrets}"; # hardening diff --git a/nixos/modules/services/networking/firewall-iptables.nix b/nixos/modules/services/networking/firewall-iptables.nix new file mode 100644 index 000000000000..63e952194d67 --- /dev/null +++ b/nixos/modules/services/networking/firewall-iptables.nix @@ -0,0 +1,334 @@ +/* This module enables a simple firewall. + + The firewall can be customised in arbitrary ways by setting + ‘networking.firewall.extraCommands’. For modularity, the firewall + uses several chains: + + - ‘nixos-fw’ is the main chain for input packet processing. + + - ‘nixos-fw-accept’ is called for accepted packets. If you want + additional logging, or want to reject certain packets anyway, you + can insert rules at the start of this chain. + + - ‘nixos-fw-log-refuse’ and ‘nixos-fw-refuse’ are called for + refused packets. (The former jumps to the latter after logging + the packet.) If you want additional logging, or want to accept + certain packets anyway, you can insert rules at the start of + this chain. + + - ‘nixos-fw-rpfilter’ is used as the main chain in the mangle table, + called from the built-in ‘PREROUTING’ chain. If the kernel + supports it and `cfg.checkReversePath` is set this chain will + perform a reverse path filter test. + + - ‘nixos-drop’ is used while reloading the firewall in order to drop + all traffic. Since reloading isn't implemented in an atomic way + this'll prevent any traffic from leaking through while reloading + the firewall. However, if the reloading fails, the ‘firewall-stop’ + script will be called which in return will effectively disable the + complete firewall (in the default configuration). + +*/ + +{ config, lib, pkgs, ... }: + +with lib; + +let + + cfg = config.networking.firewall; + + inherit (config.boot.kernelPackages) kernel; + + kernelHasRPFilter = ((kernel.config.isEnabled or (x: false)) "IP_NF_MATCH_RPFILTER") || (kernel.features.netfilterRPFilter or false); + + helpers = import ./helpers.nix { inherit config lib; }; + + writeShScript = name: text: + let + dir = pkgs.writeScriptBin name '' + #! ${pkgs.runtimeShell} -e + ${text} + ''; + in + "${dir}/bin/${name}"; + + startScript = writeShScript "firewall-start" '' + ${helpers} + + # Flush the old firewall rules. !!! Ideally, updating the + # firewall would be atomic. Apparently that's possible + # with iptables-restore. + ip46tables -D INPUT -j nixos-fw 2> /dev/null || true + for chain in nixos-fw nixos-fw-accept nixos-fw-log-refuse nixos-fw-refuse; do + ip46tables -F "$chain" 2> /dev/null || true + ip46tables -X "$chain" 2> /dev/null || true + done + + + # The "nixos-fw-accept" chain just accepts packets. + ip46tables -N nixos-fw-accept + ip46tables -A nixos-fw-accept -j ACCEPT + + + # The "nixos-fw-refuse" chain rejects or drops packets. + ip46tables -N nixos-fw-refuse + + ${if cfg.rejectPackets then '' + # Send a reset for existing TCP connections that we've + # somehow forgotten about. Send ICMP "port unreachable" + # for everything else. + ip46tables -A nixos-fw-refuse -p tcp ! --syn -j REJECT --reject-with tcp-reset + ip46tables -A nixos-fw-refuse -j REJECT + '' else '' + ip46tables -A nixos-fw-refuse -j DROP + ''} + + + # The "nixos-fw-log-refuse" chain performs logging, then + # jumps to the "nixos-fw-refuse" chain. + ip46tables -N nixos-fw-log-refuse + + ${optionalString cfg.logRefusedConnections '' + ip46tables -A nixos-fw-log-refuse -p tcp --syn -j LOG --log-level info --log-prefix "refused connection: " + ''} + ${optionalString (cfg.logRefusedPackets && !cfg.logRefusedUnicastsOnly) '' + ip46tables -A nixos-fw-log-refuse -m pkttype --pkt-type broadcast \ + -j LOG --log-level info --log-prefix "refused broadcast: " + ip46tables -A nixos-fw-log-refuse -m pkttype --pkt-type multicast \ + -j LOG --log-level info --log-prefix "refused multicast: " + ''} + ip46tables -A nixos-fw-log-refuse -m pkttype ! --pkt-type unicast -j nixos-fw-refuse + ${optionalString cfg.logRefusedPackets '' + ip46tables -A nixos-fw-log-refuse \ + -j LOG --log-level info --log-prefix "refused packet: " + ''} + ip46tables -A nixos-fw-log-refuse -j nixos-fw-refuse + + + # The "nixos-fw" chain does the actual work. + ip46tables -N nixos-fw + + # Clean up rpfilter rules + ip46tables -t mangle -D PREROUTING -j nixos-fw-rpfilter 2> /dev/null || true + ip46tables -t mangle -F nixos-fw-rpfilter 2> /dev/null || true + ip46tables -t mangle -X nixos-fw-rpfilter 2> /dev/null || true + + ${optionalString (kernelHasRPFilter && (cfg.checkReversePath != false)) '' + # Perform a reverse-path test to refuse spoofers + # For now, we just drop, as the mangle table doesn't have a log-refuse yet + ip46tables -t mangle -N nixos-fw-rpfilter 2> /dev/null || true + ip46tables -t mangle -A nixos-fw-rpfilter -m rpfilter --validmark ${optionalString (cfg.checkReversePath == "loose") "--loose"} -j RETURN + + # Allows this host to act as a DHCP4 client without first having to use APIPA + iptables -t mangle -A nixos-fw-rpfilter -p udp --sport 67 --dport 68 -j RETURN + + # Allows this host to act as a DHCPv4 server + iptables -t mangle -A nixos-fw-rpfilter -s 0.0.0.0 -d 255.255.255.255 -p udp --sport 68 --dport 67 -j RETURN + + ${optionalString cfg.logReversePathDrops '' + ip46tables -t mangle -A nixos-fw-rpfilter -j LOG --log-level info --log-prefix "rpfilter drop: " + ''} + ip46tables -t mangle -A nixos-fw-rpfilter -j DROP + + ip46tables -t mangle -A PREROUTING -j nixos-fw-rpfilter + ''} + + # Accept all traffic on the trusted interfaces. + ${flip concatMapStrings cfg.trustedInterfaces (iface: '' + ip46tables -A nixos-fw -i ${iface} -j nixos-fw-accept + '')} + + # Accept packets from established or related connections. + ip46tables -A nixos-fw -m conntrack --ctstate ESTABLISHED,RELATED -j nixos-fw-accept + + # Accept connections to the allowed TCP ports. + ${concatStrings (mapAttrsToList (iface: cfg: + concatMapStrings (port: + '' + ip46tables -A nixos-fw -p tcp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} + '' + ) cfg.allowedTCPPorts + ) cfg.allInterfaces)} + + # Accept connections to the allowed TCP port ranges. + ${concatStrings (mapAttrsToList (iface: cfg: + concatMapStrings (rangeAttr: + let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in + '' + ip46tables -A nixos-fw -p tcp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} + '' + ) cfg.allowedTCPPortRanges + ) cfg.allInterfaces)} + + # Accept packets on the allowed UDP ports. + ${concatStrings (mapAttrsToList (iface: cfg: + concatMapStrings (port: + '' + ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} + '' + ) cfg.allowedUDPPorts + ) cfg.allInterfaces)} + + # Accept packets on the allowed UDP port ranges. + ${concatStrings (mapAttrsToList (iface: cfg: + concatMapStrings (rangeAttr: + let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in + '' + ip46tables -A nixos-fw -p udp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} + '' + ) cfg.allowedUDPPortRanges + ) cfg.allInterfaces)} + + # Optionally respond to ICMPv4 pings. + ${optionalString cfg.allowPing '' + iptables -w -A nixos-fw -p icmp --icmp-type echo-request ${optionalString (cfg.pingLimit != null) + "-m limit ${cfg.pingLimit} " + }-j nixos-fw-accept + ''} + + ${optionalString config.networking.enableIPv6 '' + # Accept all ICMPv6 messages except redirects and node + # information queries (type 139). See RFC 4890, section + # 4.4. + ip6tables -A nixos-fw -p icmpv6 --icmpv6-type redirect -j DROP + ip6tables -A nixos-fw -p icmpv6 --icmpv6-type 139 -j DROP + ip6tables -A nixos-fw -p icmpv6 -j nixos-fw-accept + + # Allow this host to act as a DHCPv6 client + ip6tables -A nixos-fw -d fe80::/64 -p udp --dport 546 -j nixos-fw-accept + ''} + + ${cfg.extraCommands} + + # Reject/drop everything else. + ip46tables -A nixos-fw -j nixos-fw-log-refuse + + + # Enable the firewall. + ip46tables -A INPUT -j nixos-fw + ''; + + stopScript = writeShScript "firewall-stop" '' + ${helpers} + + # Clean up in case reload fails + ip46tables -D INPUT -j nixos-drop 2>/dev/null || true + + # Clean up after added ruleset + ip46tables -D INPUT -j nixos-fw 2>/dev/null || true + + ${optionalString (kernelHasRPFilter && (cfg.checkReversePath != false)) '' + ip46tables -t mangle -D PREROUTING -j nixos-fw-rpfilter 2>/dev/null || true + ''} + + ${cfg.extraStopCommands} + ''; + + reloadScript = writeShScript "firewall-reload" '' + ${helpers} + + # Create a unique drop rule + ip46tables -D INPUT -j nixos-drop 2>/dev/null || true + ip46tables -F nixos-drop 2>/dev/null || true + ip46tables -X nixos-drop 2>/dev/null || true + ip46tables -N nixos-drop + ip46tables -A nixos-drop -j DROP + + # Don't allow traffic to leak out until the script has completed + ip46tables -A INPUT -j nixos-drop + + ${cfg.extraStopCommands} + + if ${startScript}; then + ip46tables -D INPUT -j nixos-drop 2>/dev/null || true + else + echo "Failed to reload firewall... Stopping" + ${stopScript} + exit 1 + fi + ''; + +in + +{ + + options = { + + networking.firewall = { + extraCommands = mkOption { + type = types.lines; + default = ""; + example = "iptables -A INPUT -p icmp -j ACCEPT"; + description = lib.mdDoc '' + Additional shell commands executed as part of the firewall + initialisation script. These are executed just before the + final "reject" firewall rule is added, so they can be used + to allow packets that would otherwise be refused. + + This option only works with the iptables based firewall. + ''; + }; + + extraStopCommands = mkOption { + type = types.lines; + default = ""; + example = "iptables -P INPUT ACCEPT"; + description = lib.mdDoc '' + Additional shell commands executed as part of the firewall + shutdown script. These are executed just after the removal + of the NixOS input rule, or if the service enters a failed + state. + + This option only works with the iptables based firewall. + ''; + }; + }; + + }; + + # FIXME: Maybe if `enable' is false, the firewall should still be + # built but not started by default? + config = mkIf (cfg.enable && config.networking.nftables.enable == false) { + + assertions = [ + # This is approximately "checkReversePath -> kernelHasRPFilter", + # but the checkReversePath option can include non-boolean + # values. + { + assertion = cfg.checkReversePath == false || kernelHasRPFilter; + message = "This kernel does not support rpfilter"; + } + ]; + + networking.firewall.checkReversePath = mkIf (!kernelHasRPFilter) (mkDefault false); + + systemd.services.firewall = { + description = "Firewall"; + wantedBy = [ "sysinit.target" ]; + wants = [ "network-pre.target" ]; + before = [ "network-pre.target" ]; + after = [ "systemd-modules-load.service" ]; + + path = [ cfg.package ] ++ cfg.extraPackages; + + # FIXME: this module may also try to load kernel modules, but + # containers don't have CAP_SYS_MODULE. So the host system had + # better have all necessary modules already loaded. + unitConfig.ConditionCapability = "CAP_NET_ADMIN"; + unitConfig.DefaultDependencies = false; + + reloadIfChanged = true; + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + ExecStart = "@${startScript} firewall-start"; + ExecReload = "@${reloadScript} firewall-reload"; + ExecStop = "@${stopScript} firewall-stop"; + }; + }; + + }; + +} diff --git a/nixos/modules/services/networking/firewall-nftables.nix b/nixos/modules/services/networking/firewall-nftables.nix new file mode 100644 index 000000000000..0ed3c228075d --- /dev/null +++ b/nixos/modules/services/networking/firewall-nftables.nix @@ -0,0 +1,167 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + + cfg = config.networking.firewall; + + ifaceSet = concatStringsSep ", " ( + map (x: ''"${x}"'') cfg.trustedInterfaces + ); + + portsToNftSet = ports: portRanges: concatStringsSep ", " ( + map (x: toString x) ports + ++ map (x: "${toString x.from}-${toString x.to}") portRanges + ); + +in + +{ + + options = { + + networking.firewall = { + extraInputRules = mkOption { + type = types.lines; + default = ""; + example = "ip6 saddr { fc00::/7, fe80::/10 } tcp dport 24800 accept"; + description = lib.mdDoc '' + Additional nftables rules to be appended to the input-allow + chain. + + This option only works with the nftables based firewall. + ''; + }; + + extraForwardRules = mkOption { + type = types.lines; + default = ""; + example = "iifname wg0 accept"; + description = lib.mdDoc '' + Additional nftables rules to be appended to the forward-allow + chain. + + This option only works with the nftables based firewall. + ''; + }; + }; + + }; + + config = mkIf (cfg.enable && config.networking.nftables.enable) { + + assertions = [ + { + assertion = cfg.extraCommands == ""; + message = "extraCommands is incompatible with the nftables based firewall: ${cfg.extraCommands}"; + } + { + assertion = cfg.extraStopCommands == ""; + message = "extraStopCommands is incompatible with the nftables based firewall: ${cfg.extraStopCommands}"; + } + { + assertion = cfg.pingLimit == null || !(hasPrefix "--" cfg.pingLimit); + message = "nftables syntax like \"2/second\" should be used in networking.firewall.pingLimit"; + } + { + assertion = config.networking.nftables.rulesetFile == null; + message = "networking.nftables.rulesetFile conflicts with the firewall"; + } + ]; + + networking.nftables.ruleset = '' + + table inet nixos-fw { + + ${optionalString (cfg.checkReversePath != false) '' + chain rpfilter { + type filter hook prerouting priority mangle + 10; policy drop; + + meta nfproto ipv4 udp sport . udp dport { 67 . 68, 68 . 67 } accept comment "DHCPv4 client/server" + fib saddr . mark ${optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept + + ${optionalString cfg.logReversePathDrops '' + log level info prefix "rpfilter drop: " + ''} + + } + ''} + + chain input { + type filter hook input priority filter; policy drop; + + ${optionalString (ifaceSet != "") ''iifname { ${ifaceSet} } accept comment "trusted interfaces"''} + + # Some ICMPv6 types like NDP is untracked + ct state vmap { invalid : drop, established : accept, related : accept, * : jump input-allow } comment "*: new and untracked" + + ${optionalString cfg.logRefusedConnections '' + tcp flags syn / fin,syn,rst,ack log level info prefix "refused connection: " + ''} + ${optionalString (cfg.logRefusedPackets && !cfg.logRefusedUnicastsOnly) '' + pkttype broadcast log level info prefix "refused broadcast: " + pkttype multicast log level info prefix "refused multicast: " + ''} + ${optionalString cfg.logRefusedPackets '' + pkttype host log level info prefix "refused packet: " + ''} + + ${optionalString cfg.rejectPackets '' + meta l4proto tcp reject with tcp reset + reject + ''} + + } + + chain input-allow { + + ${concatStrings (mapAttrsToList (iface: cfg: + let + ifaceExpr = optionalString (iface != "default") "iifname ${iface}"; + tcpSet = portsToNftSet cfg.allowedTCPPorts cfg.allowedTCPPortRanges; + udpSet = portsToNftSet cfg.allowedUDPPorts cfg.allowedUDPPortRanges; + in + '' + ${optionalString (tcpSet != "") "${ifaceExpr} tcp dport { ${tcpSet} } accept"} + ${optionalString (udpSet != "") "${ifaceExpr} udp dport { ${udpSet} } accept"} + '' + ) cfg.allInterfaces)} + + ${optionalString cfg.allowPing '' + icmp type echo-request ${optionalString (cfg.pingLimit != null) "limit rate ${cfg.pingLimit}"} accept comment "allow ping" + ''} + + icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139). See RFC 4890, section 4.4." + ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client" + + ${cfg.extraInputRules} + + } + + ${optionalString cfg.filterForward '' + chain forward { + type filter hook forward priority filter; policy drop; + + ct state vmap { invalid : drop, established : accept, related : accept, * : jump forward-allow } comment "*: new and untracked" + + } + + chain forward-allow { + + icmpv6 type != { router-renumbering, 139 } accept comment "Accept all ICMPv6 messages except renumbering and node information queries (type 139). See RFC 4890, section 4.3." + + ct status dnat accept comment "allow port forward" + + ${cfg.extraForwardRules} + + } + ''} + + } + + ''; + + }; + +} diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index 27119dcc57c5..4e332d489e4d 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -1,35 +1,3 @@ -/* This module enables a simple firewall. - - The firewall can be customised in arbitrary ways by setting - ‘networking.firewall.extraCommands’. For modularity, the firewall - uses several chains: - - - ‘nixos-fw’ is the main chain for input packet processing. - - - ‘nixos-fw-accept’ is called for accepted packets. If you want - additional logging, or want to reject certain packets anyway, you - can insert rules at the start of this chain. - - - ‘nixos-fw-log-refuse’ and ‘nixos-fw-refuse’ are called for - refused packets. (The former jumps to the latter after logging - the packet.) If you want additional logging, or want to accept - certain packets anyway, you can insert rules at the start of - this chain. - - - ‘nixos-fw-rpfilter’ is used as the main chain in the mangle table, - called from the built-in ‘PREROUTING’ chain. If the kernel - supports it and `cfg.checkReversePath` is set this chain will - perform a reverse path filter test. - - - ‘nixos-drop’ is used while reloading the firewall in order to drop - all traffic. Since reloading isn't implemented in an atomic way - this'll prevent any traffic from leaking through while reloading - the firewall. However, if the reloading fails, the ‘firewall-stop’ - script will be called which in return will effectively disable the - complete firewall (in the default configuration). - -*/ - { config, lib, pkgs, ... }: with lib; @@ -38,216 +6,6 @@ let cfg = config.networking.firewall; - inherit (config.boot.kernelPackages) kernel; - - kernelHasRPFilter = ((kernel.config.isEnabled or (x: false)) "IP_NF_MATCH_RPFILTER") || (kernel.features.netfilterRPFilter or false); - - helpers = import ./helpers.nix { inherit config lib; }; - - writeShScript = name: text: let dir = pkgs.writeScriptBin name '' - #! ${pkgs.runtimeShell} -e - ${text} - ''; in "${dir}/bin/${name}"; - - defaultInterface = { default = mapAttrs (name: value: cfg.${name}) commonOptions; }; - allInterfaces = defaultInterface // cfg.interfaces; - - startScript = writeShScript "firewall-start" '' - ${helpers} - - # Flush the old firewall rules. !!! Ideally, updating the - # firewall would be atomic. Apparently that's possible - # with iptables-restore. - ip46tables -D INPUT -j nixos-fw 2> /dev/null || true - for chain in nixos-fw nixos-fw-accept nixos-fw-log-refuse nixos-fw-refuse; do - ip46tables -F "$chain" 2> /dev/null || true - ip46tables -X "$chain" 2> /dev/null || true - done - - - # The "nixos-fw-accept" chain just accepts packets. - ip46tables -N nixos-fw-accept - ip46tables -A nixos-fw-accept -j ACCEPT - - - # The "nixos-fw-refuse" chain rejects or drops packets. - ip46tables -N nixos-fw-refuse - - ${if cfg.rejectPackets then '' - # Send a reset for existing TCP connections that we've - # somehow forgotten about. Send ICMP "port unreachable" - # for everything else. - ip46tables -A nixos-fw-refuse -p tcp ! --syn -j REJECT --reject-with tcp-reset - ip46tables -A nixos-fw-refuse -j REJECT - '' else '' - ip46tables -A nixos-fw-refuse -j DROP - ''} - - - # The "nixos-fw-log-refuse" chain performs logging, then - # jumps to the "nixos-fw-refuse" chain. - ip46tables -N nixos-fw-log-refuse - - ${optionalString cfg.logRefusedConnections '' - ip46tables -A nixos-fw-log-refuse -p tcp --syn -j LOG --log-level info --log-prefix "refused connection: " - ''} - ${optionalString (cfg.logRefusedPackets && !cfg.logRefusedUnicastsOnly) '' - ip46tables -A nixos-fw-log-refuse -m pkttype --pkt-type broadcast \ - -j LOG --log-level info --log-prefix "refused broadcast: " - ip46tables -A nixos-fw-log-refuse -m pkttype --pkt-type multicast \ - -j LOG --log-level info --log-prefix "refused multicast: " - ''} - ip46tables -A nixos-fw-log-refuse -m pkttype ! --pkt-type unicast -j nixos-fw-refuse - ${optionalString cfg.logRefusedPackets '' - ip46tables -A nixos-fw-log-refuse \ - -j LOG --log-level info --log-prefix "refused packet: " - ''} - ip46tables -A nixos-fw-log-refuse -j nixos-fw-refuse - - - # The "nixos-fw" chain does the actual work. - ip46tables -N nixos-fw - - # Clean up rpfilter rules - ip46tables -t mangle -D PREROUTING -j nixos-fw-rpfilter 2> /dev/null || true - ip46tables -t mangle -F nixos-fw-rpfilter 2> /dev/null || true - ip46tables -t mangle -X nixos-fw-rpfilter 2> /dev/null || true - - ${optionalString (kernelHasRPFilter && (cfg.checkReversePath != false)) '' - # Perform a reverse-path test to refuse spoofers - # For now, we just drop, as the mangle table doesn't have a log-refuse yet - ip46tables -t mangle -N nixos-fw-rpfilter 2> /dev/null || true - ip46tables -t mangle -A nixos-fw-rpfilter -m rpfilter --validmark ${optionalString (cfg.checkReversePath == "loose") "--loose"} -j RETURN - - # Allows this host to act as a DHCP4 client without first having to use APIPA - iptables -t mangle -A nixos-fw-rpfilter -p udp --sport 67 --dport 68 -j RETURN - - # Allows this host to act as a DHCPv4 server - iptables -t mangle -A nixos-fw-rpfilter -s 0.0.0.0 -d 255.255.255.255 -p udp --sport 68 --dport 67 -j RETURN - - ${optionalString cfg.logReversePathDrops '' - ip46tables -t mangle -A nixos-fw-rpfilter -j LOG --log-level info --log-prefix "rpfilter drop: " - ''} - ip46tables -t mangle -A nixos-fw-rpfilter -j DROP - - ip46tables -t mangle -A PREROUTING -j nixos-fw-rpfilter - ''} - - # Accept all traffic on the trusted interfaces. - ${flip concatMapStrings cfg.trustedInterfaces (iface: '' - ip46tables -A nixos-fw -i ${iface} -j nixos-fw-accept - '')} - - # Accept packets from established or related connections. - ip46tables -A nixos-fw -m conntrack --ctstate ESTABLISHED,RELATED -j nixos-fw-accept - - # Accept connections to the allowed TCP ports. - ${concatStrings (mapAttrsToList (iface: cfg: - concatMapStrings (port: - '' - ip46tables -A nixos-fw -p tcp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} - '' - ) cfg.allowedTCPPorts - ) allInterfaces)} - - # Accept connections to the allowed TCP port ranges. - ${concatStrings (mapAttrsToList (iface: cfg: - concatMapStrings (rangeAttr: - let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in - '' - ip46tables -A nixos-fw -p tcp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} - '' - ) cfg.allowedTCPPortRanges - ) allInterfaces)} - - # Accept packets on the allowed UDP ports. - ${concatStrings (mapAttrsToList (iface: cfg: - concatMapStrings (port: - '' - ip46tables -A nixos-fw -p udp --dport ${toString port} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} - '' - ) cfg.allowedUDPPorts - ) allInterfaces)} - - # Accept packets on the allowed UDP port ranges. - ${concatStrings (mapAttrsToList (iface: cfg: - concatMapStrings (rangeAttr: - let range = toString rangeAttr.from + ":" + toString rangeAttr.to; in - '' - ip46tables -A nixos-fw -p udp --dport ${range} -j nixos-fw-accept ${optionalString (iface != "default") "-i ${iface}"} - '' - ) cfg.allowedUDPPortRanges - ) allInterfaces)} - - # Optionally respond to ICMPv4 pings. - ${optionalString cfg.allowPing '' - iptables -w -A nixos-fw -p icmp --icmp-type echo-request ${optionalString (cfg.pingLimit != null) - "-m limit ${cfg.pingLimit} " - }-j nixos-fw-accept - ''} - - ${optionalString config.networking.enableIPv6 '' - # Accept all ICMPv6 messages except redirects and node - # information queries (type 139). See RFC 4890, section - # 4.4. - ip6tables -A nixos-fw -p icmpv6 --icmpv6-type redirect -j DROP - ip6tables -A nixos-fw -p icmpv6 --icmpv6-type 139 -j DROP - ip6tables -A nixos-fw -p icmpv6 -j nixos-fw-accept - - # Allow this host to act as a DHCPv6 client - ip6tables -A nixos-fw -d fe80::/64 -p udp --dport 546 -j nixos-fw-accept - ''} - - ${cfg.extraCommands} - - # Reject/drop everything else. - ip46tables -A nixos-fw -j nixos-fw-log-refuse - - - # Enable the firewall. - ip46tables -A INPUT -j nixos-fw - ''; - - stopScript = writeShScript "firewall-stop" '' - ${helpers} - - # Clean up in case reload fails - ip46tables -D INPUT -j nixos-drop 2>/dev/null || true - - # Clean up after added ruleset - ip46tables -D INPUT -j nixos-fw 2>/dev/null || true - - ${optionalString (kernelHasRPFilter && (cfg.checkReversePath != false)) '' - ip46tables -t mangle -D PREROUTING -j nixos-fw-rpfilter 2>/dev/null || true - ''} - - ${cfg.extraStopCommands} - ''; - - reloadScript = writeShScript "firewall-reload" '' - ${helpers} - - # Create a unique drop rule - ip46tables -D INPUT -j nixos-drop 2>/dev/null || true - ip46tables -F nixos-drop 2>/dev/null || true - ip46tables -X nixos-drop 2>/dev/null || true - ip46tables -N nixos-drop - ip46tables -A nixos-drop -j DROP - - # Don't allow traffic to leak out until the script has completed - ip46tables -A INPUT -j nixos-drop - - ${cfg.extraStopCommands} - - if ${startScript}; then - ip46tables -D INPUT -j nixos-drop 2>/dev/null || true - else - echo "Failed to reload firewall... Stopping" - ${stopScript} - exit 1 - fi - ''; - canonicalizePortList = ports: lib.unique (builtins.sort builtins.lessThan ports); @@ -257,22 +15,20 @@ let default = [ ]; apply = canonicalizePortList; example = [ 22 80 ]; - description = - lib.mdDoc '' - List of TCP ports on which incoming connections are - accepted. - ''; + description = lib.mdDoc '' + List of TCP ports on which incoming connections are + accepted. + ''; }; allowedTCPPortRanges = mkOption { type = types.listOf (types.attrsOf types.port); default = [ ]; - example = [ { from = 8999; to = 9003; } ]; - description = - lib.mdDoc '' - A range of TCP ports on which incoming connections are - accepted. - ''; + example = [{ from = 8999; to = 9003; }]; + description = lib.mdDoc '' + A range of TCP ports on which incoming connections are + accepted. + ''; }; allowedUDPPorts = mkOption { @@ -280,20 +36,18 @@ let default = [ ]; apply = canonicalizePortList; example = [ 53 ]; - description = - lib.mdDoc '' - List of open UDP ports. - ''; + description = lib.mdDoc '' + List of open UDP ports. + ''; }; allowedUDPPortRanges = mkOption { type = types.listOf (types.attrsOf types.port); default = [ ]; - example = [ { from = 60000; to = 61000; } ]; - description = - lib.mdDoc '' - Range of open UDP ports. - ''; + example = [{ from = 60000; to = 61000; }]; + description = lib.mdDoc '' + Range of open UDP ports. + ''; }; }; @@ -301,240 +55,222 @@ in { - ###### interface - options = { networking.firewall = { enable = mkOption { type = types.bool; default = true; - description = - lib.mdDoc '' - Whether to enable the firewall. This is a simple stateful - firewall that blocks connection attempts to unauthorised TCP - or UDP ports on this machine. It does not affect packet - forwarding. - ''; + description = lib.mdDoc '' + Whether to enable the firewall. This is a simple stateful + firewall that blocks connection attempts to unauthorised TCP + or UDP ports on this machine. + ''; }; package = mkOption { type = types.package; - default = pkgs.iptables; - defaultText = literalExpression "pkgs.iptables"; + default = if config.networking.nftables.enable then pkgs.nftables else pkgs.iptables; + defaultText = literalExpression ''if config.networking.nftables.enable then "pkgs.nftables" else "pkgs.iptables"''; example = literalExpression "pkgs.iptables-legacy"; - description = - lib.mdDoc '' - The iptables package to use for running the firewall service. - ''; + description = lib.mdDoc '' + The package to use for running the firewall service. + ''; }; logRefusedConnections = mkOption { type = types.bool; default = true; - description = - lib.mdDoc '' - Whether to log rejected or dropped incoming connections. - Note: The logs are found in the kernel logs, i.e. dmesg - or journalctl -k. - ''; + description = lib.mdDoc '' + Whether to log rejected or dropped incoming connections. + Note: The logs are found in the kernel logs, i.e. dmesg + or journalctl -k. + ''; }; logRefusedPackets = mkOption { type = types.bool; default = false; - description = - lib.mdDoc '' - Whether to log all rejected or dropped incoming packets. - This tends to give a lot of log messages, so it's mostly - useful for debugging. - Note: The logs are found in the kernel logs, i.e. dmesg - or journalctl -k. - ''; + description = lib.mdDoc '' + Whether to log all rejected or dropped incoming packets. + This tends to give a lot of log messages, so it's mostly + useful for debugging. + Note: The logs are found in the kernel logs, i.e. dmesg + or journalctl -k. + ''; }; logRefusedUnicastsOnly = mkOption { type = types.bool; default = true; - description = - lib.mdDoc '' - If {option}`networking.firewall.logRefusedPackets` - and this option are enabled, then only log packets - specifically directed at this machine, i.e., not broadcasts - or multicasts. - ''; + description = lib.mdDoc '' + If {option}`networking.firewall.logRefusedPackets` + and this option are enabled, then only log packets + specifically directed at this machine, i.e., not broadcasts + or multicasts. + ''; }; rejectPackets = mkOption { type = types.bool; default = false; - description = - lib.mdDoc '' - If set, refused packets are rejected rather than dropped - (ignored). This means that an ICMP "port unreachable" error - message is sent back to the client (or a TCP RST packet in - case of an existing connection). Rejecting packets makes - port scanning somewhat easier. - ''; + description = lib.mdDoc '' + If set, refused packets are rejected rather than dropped + (ignored). This means that an ICMP "port unreachable" error + message is sent back to the client (or a TCP RST packet in + case of an existing connection). Rejecting packets makes + port scanning somewhat easier. + ''; }; trustedInterfaces = mkOption { type = types.listOf types.str; default = [ ]; example = [ "enp0s2" ]; - description = - lib.mdDoc '' - Traffic coming in from these interfaces will be accepted - unconditionally. Traffic from the loopback (lo) interface - will always be accepted. - ''; + description = lib.mdDoc '' + Traffic coming in from these interfaces will be accepted + unconditionally. Traffic from the loopback (lo) interface + will always be accepted. + ''; }; allowPing = mkOption { type = types.bool; default = true; - description = - lib.mdDoc '' - Whether to respond to incoming ICMPv4 echo requests - ("pings"). ICMPv6 pings are always allowed because the - larger address space of IPv6 makes network scanning much - less effective. - ''; + description = lib.mdDoc '' + Whether to respond to incoming ICMPv4 echo requests + ("pings"). ICMPv6 pings are always allowed because the + larger address space of IPv6 makes network scanning much + less effective. + ''; }; pingLimit = mkOption { type = types.nullOr (types.separatedString " "); default = null; example = "--limit 1/minute --limit-burst 5"; - description = - lib.mdDoc '' - If pings are allowed, this allows setting rate limits - on them. If non-null, this option should be in the form of - flags like "--limit 1/minute --limit-burst 5" - ''; + description = lib.mdDoc '' + If pings are allowed, this allows setting rate limits on them. + + For the iptables based firewall, it should be set like + "--limit 1/minute --limit-burst 5". + + For the nftables based firewall, it should be set like + "2/second" or "1/minute burst 5 packets". + ''; }; checkReversePath = mkOption { - type = types.either types.bool (types.enum ["strict" "loose"]); - default = kernelHasRPFilter; - defaultText = literalMD "`true` if supported by the chosen kernel"; + type = types.either types.bool (types.enum [ "strict" "loose" ]); + default = true; + defaultText = literalMD "`true` except if the iptables based firewall is in use and the kernel lacks rpfilter support"; example = "loose"; - description = - lib.mdDoc '' - Performs a reverse path filter test on a packet. If a reply - to the packet would not be sent via the same interface that - the packet arrived on, it is refused. - - If using asymmetric routing or other complicated routing, set - this option to loose mode or disable it and setup your own - counter-measures. - - This option can be either true (or "strict"), "loose" (only - drop the packet if the source address is not reachable via any - interface) or false. Defaults to the value of - kernelHasRPFilter. - ''; + description = lib.mdDoc '' + Performs a reverse path filter test on a packet. If a reply + to the packet would not be sent via the same interface that + the packet arrived on, it is refused. + + If using asymmetric routing or other complicated routing, set + this option to loose mode or disable it and setup your own + counter-measures. + + This option can be either true (or "strict"), "loose" (only + drop the packet if the source address is not reachable via any + interface) or false. + ''; }; logReversePathDrops = mkOption { type = types.bool; default = false; - description = - lib.mdDoc '' - Logs dropped packets failing the reverse path filter test if - the option networking.firewall.checkReversePath is enabled. - ''; + description = lib.mdDoc '' + Logs dropped packets failing the reverse path filter test if + the option networking.firewall.checkReversePath is enabled. + ''; + }; + + filterForward = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + Enable filtering in IP forwarding. + + This option only works with the nftables based firewall. + ''; }; connectionTrackingModules = mkOption { type = types.listOf types.str; default = [ ]; example = [ "ftp" "irc" "sane" "sip" "tftp" "amanda" "h323" "netbios_sn" "pptp" "snmp" ]; - description = - lib.mdDoc '' - List of connection-tracking helpers that are auto-loaded. - The complete list of possible values is given in the example. - - As helpers can pose as a security risk, it is advised to - set this to an empty list and disable the setting - networking.firewall.autoLoadConntrackHelpers unless you - know what you are doing. Connection tracking is disabled - by default. - - Loading of helpers is recommended to be done through the - CT target. More info: - https://home.regit.org/netfilter-en/secure-use-of-helpers/ - ''; + description = lib.mdDoc '' + List of connection-tracking helpers that are auto-loaded. + The complete list of possible values is given in the example. + + As helpers can pose as a security risk, it is advised to + set this to an empty list and disable the setting + networking.firewall.autoLoadConntrackHelpers unless you + know what you are doing. Connection tracking is disabled + by default. + + Loading of helpers is recommended to be done through the + CT target. More info: + https://home.regit.org/netfilter-en/secure-use-of-helpers/ + ''; }; autoLoadConntrackHelpers = mkOption { type = types.bool; default = false; - description = - lib.mdDoc '' - Whether to auto-load connection-tracking helpers. - See the description at networking.firewall.connectionTrackingModules - - (needs kernel 3.5+) - ''; - }; + description = lib.mdDoc '' + Whether to auto-load connection-tracking helpers. + See the description at networking.firewall.connectionTrackingModules - extraCommands = mkOption { - type = types.lines; - default = ""; - example = "iptables -A INPUT -p icmp -j ACCEPT"; - description = - lib.mdDoc '' - Additional shell commands executed as part of the firewall - initialisation script. These are executed just before the - final "reject" firewall rule is added, so they can be used - to allow packets that would otherwise be refused. - ''; + (needs kernel 3.5+) + ''; }; extraPackages = mkOption { type = types.listOf types.package; default = [ ]; example = literalExpression "[ pkgs.ipset ]"; - description = - lib.mdDoc '' - Additional packages to be included in the environment of the system - as well as the path of networking.firewall.extraCommands. - ''; - }; - - extraStopCommands = mkOption { - type = types.lines; - default = ""; - example = "iptables -P INPUT ACCEPT"; - description = - lib.mdDoc '' - Additional shell commands executed as part of the firewall - shutdown script. These are executed just after the removal - of the NixOS input rule, or if the service enters a failed - state. - ''; + description = lib.mdDoc '' + Additional packages to be included in the environment of the system + as well as the path of networking.firewall.extraCommands. + ''; }; interfaces = mkOption { default = { }; - type = with types; attrsOf (submodule [ { options = commonOptions; } ]); - description = - lib.mdDoc '' - Interface-specific open ports. - ''; + type = with types; attrsOf (submodule [{ options = commonOptions; }]); + description = lib.mdDoc '' + Interface-specific open ports. + ''; + }; + + allInterfaces = mkOption { + internal = true; + visible = false; + default = { default = mapAttrs (name: value: cfg.${name}) commonOptions; } // cfg.interfaces; + type = with types; attrsOf (submodule [{ options = commonOptions; }]); + description = lib.mdDoc '' + All open ports. + ''; }; } // commonOptions; }; - ###### implementation - - # FIXME: Maybe if `enable' is false, the firewall should still be - # built but not started by default? config = mkIf cfg.enable { + assertions = [ + { + assertion = cfg.filterForward -> config.networking.nftables.enable; + message = "filterForward only works with the nftables based firewall"; + } + ]; + networking.firewall.trustedInterfaces = [ "lo" ]; environment.systemPackages = [ cfg.package ] ++ cfg.extraPackages; @@ -545,40 +281,6 @@ in options nf_conntrack nf_conntrack_helper=1 ''; - assertions = [ - # This is approximately "checkReversePath -> kernelHasRPFilter", - # but the checkReversePath option can include non-boolean - # values. - { assertion = cfg.checkReversePath == false || kernelHasRPFilter; - message = "This kernel does not support rpfilter"; } - ]; - - systemd.services.firewall = { - description = "Firewall"; - wantedBy = [ "sysinit.target" ]; - wants = [ "network-pre.target" ]; - before = [ "network-pre.target" ]; - after = [ "systemd-modules-load.service" ]; - - path = [ cfg.package ] ++ cfg.extraPackages; - - # FIXME: this module may also try to load kernel modules, but - # containers don't have CAP_SYS_MODULE. So the host system had - # better have all necessary modules already loaded. - unitConfig.ConditionCapability = "CAP_NET_ADMIN"; - unitConfig.DefaultDependencies = false; - - reloadIfChanged = true; - - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - ExecStart = "@${startScript} firewall-start"; - ExecReload = "@${reloadScript} firewall-reload"; - ExecStop = "@${stopScript} firewall-stop"; - }; - }; - }; } diff --git a/nixos/modules/services/networking/hans.nix b/nixos/modules/services/networking/hans.nix index ffb2ee841c64..3ea95b3bdae9 100644 --- a/nixos/modules/services/networking/hans.nix +++ b/nixos/modules/services/networking/hans.nix @@ -55,7 +55,7 @@ in passwordFile = mkOption { type = types.str; default = ""; - description = lib.mdDoc "File that containts password"; + description = lib.mdDoc "File that contains password"; }; }; @@ -92,7 +92,7 @@ in passwordFile = mkOption { type = types.str; default = ""; - description = lib.mdDoc "File that containts password"; + description = lib.mdDoc "File that contains password"; }; }; diff --git a/nixos/modules/services/networking/headscale.nix b/nixos/modules/services/networking/headscale.nix index 0334c5a00bab..cc46819eed5a 100644 --- a/nixos/modules/services/networking/headscale.nix +++ b/nixos/modules/services/networking/headscale.nix @@ -1,15 +1,18 @@ -{ config, lib, pkgs, ... }: -with lib; -let +{ + config, + lib, + pkgs, + ... +}: +with lib; let cfg = config.services.headscale; dataDir = "/var/lib/headscale"; runDir = "/run/headscale"; - settingsFormat = pkgs.formats.yaml { }; + settingsFormat = pkgs.formats.yaml {}; configFile = settingsFormat.generate "headscale.yaml" cfg.settings; -in -{ +in { options = { services.headscale = { enable = mkEnableOption (lib.mdDoc "headscale, Open Source coordination server for Tailscale"); @@ -51,15 +54,6 @@ in ''; }; - serverUrl = mkOption { - type = types.str; - default = "http://127.0.0.1:8080"; - description = lib.mdDoc '' - The url clients will connect to. - ''; - example = "https://myheadscale.example.com:443"; - }; - address = mkOption { type = types.str; default = "127.0.0.1"; @@ -78,337 +72,346 @@ in example = 443; }; - privateKeyFile = mkOption { - type = types.path; - default = "${dataDir}/private.key"; - description = lib.mdDoc '' - Path to private key file, generated automatically if it does not exist. - ''; - }; - - derp = { - urls = mkOption { - type = types.listOf types.str; - default = [ "https://controlplane.tailscale.com/derpmap/default" ]; - description = lib.mdDoc '' - List of urls containing DERP maps. - See [How Tailscale works](https://tailscale.com/blog/how-tailscale-works/) for more information on DERP maps. - ''; - }; - - paths = mkOption { - type = types.listOf types.path; - default = [ ]; - description = lib.mdDoc '' - List of file paths containing DERP maps. - See [How Tailscale works](https://tailscale.com/blog/how-tailscale-works/) for more information on DERP maps. - ''; - }; - - - autoUpdate = mkOption { - type = types.bool; - default = true; - description = lib.mdDoc '' - Whether to automatically update DERP maps on a set frequency. - ''; - example = false; - }; - - updateFrequency = mkOption { - type = types.str; - default = "24h"; - description = lib.mdDoc '' - Frequency to update DERP maps. - ''; - example = "5m"; - }; - - }; - - ephemeralNodeInactivityTimeout = mkOption { - type = types.str; - default = "30m"; - description = lib.mdDoc '' - Time before an inactive ephemeral node is deleted. - ''; - example = "5m"; - }; - - database = { - type = mkOption { - type = types.enum [ "sqlite3" "postgres" ]; - example = "postgres"; - default = "sqlite3"; - description = lib.mdDoc "Database engine to use."; - }; - - host = mkOption { - type = types.nullOr types.str; - default = null; - example = "127.0.0.1"; - description = lib.mdDoc "Database host address."; - }; - - port = mkOption { - type = types.nullOr types.port; - default = null; - example = 3306; - description = lib.mdDoc "Database host port."; - }; - - name = mkOption { - type = types.nullOr types.str; - default = null; - example = "headscale"; - description = lib.mdDoc "Database name."; - }; - - user = mkOption { - type = types.nullOr types.str; - default = null; - example = "headscale"; - description = lib.mdDoc "Database user."; - }; - - passwordFile = mkOption { - type = types.nullOr types.path; - default = null; - example = "/run/keys/headscale-dbpassword"; - description = lib.mdDoc '' - A file containing the password corresponding to - {option}`database.user`. - ''; - }; - - path = mkOption { - type = types.nullOr types.str; - default = "${dataDir}/db.sqlite"; - description = lib.mdDoc "Path to the sqlite3 database file."; - }; - }; - - logLevel = mkOption { - type = types.str; - default = "info"; - description = lib.mdDoc '' - headscale log level. - ''; - example = "debug"; - }; - - dns = { - nameservers = mkOption { - type = types.listOf types.str; - default = [ "1.1.1.1" ]; - description = lib.mdDoc '' - List of nameservers to pass to Tailscale clients. - ''; - }; - - domains = mkOption { - type = types.listOf types.str; - default = [ ]; - description = lib.mdDoc '' - Search domains to inject to Tailscale clients. - ''; - example = [ "mydomain.internal" ]; - }; - - magicDns = mkOption { - type = types.bool; - default = true; - description = lib.mdDoc '' - Whether to use [MagicDNS](https://tailscale.com/kb/1081/magicdns/). - Only works if there is at least a nameserver defined. - ''; - example = false; - }; - - baseDomain = mkOption { - type = types.str; - default = ""; - description = lib.mdDoc '' - Defines the base domain to create the hostnames for MagicDNS. - {option}`baseDomain` must be a FQDNs, without the trailing dot. - The FQDN of the hosts will be - `hostname.namespace.base_domain` (e.g. - `myhost.mynamespace.example.com`). - ''; - }; - }; - - openIdConnect = { - issuer = mkOption { - type = types.str; - default = ""; - description = lib.mdDoc '' - URL to OpenID issuer. - ''; - example = "https://openid.example.com"; - }; - - clientId = mkOption { - type = types.str; - default = ""; - description = lib.mdDoc '' - OpenID Connect client ID. - ''; - }; - - clientSecretFile = mkOption { - type = types.nullOr types.path; - default = null; - description = lib.mdDoc '' - Path to OpenID Connect client secret file. - ''; - }; - - domainMap = mkOption { - type = types.attrsOf types.str; - default = { }; - description = lib.mdDoc '' - Domain map is used to map incomming users (by their email) to - a namespace. The key can be a string, or regex. - ''; - example = { - ".*" = "default-namespace"; - }; - }; - - }; - - tls = { - letsencrypt = { - hostname = mkOption { - type = types.nullOr types.str; - default = ""; - description = lib.mdDoc '' - Domain name to request a TLS certificate for. - ''; - }; - challengeType = mkOption { - type = types.enum [ "TLS-ALPN-01" "HTTP-01" ]; - default = "HTTP-01"; - description = lib.mdDoc '' - Type of ACME challenge to use, currently supported types: - `HTTP-01` or `TLS-ALPN-01`. - ''; - }; - httpListen = mkOption { - type = types.nullOr types.str; - default = ":http"; - description = lib.mdDoc '' - When HTTP-01 challenge is chosen, letsencrypt must set up a - verification endpoint, and it will be listening on: - `:http = port 80`. - ''; - }; - }; - - certFile = mkOption { - type = types.nullOr types.path; - default = null; - description = lib.mdDoc '' - Path to already created certificate. - ''; - }; - keyFile = mkOption { - type = types.nullOr types.path; - default = null; - description = lib.mdDoc '' - Path to key for already created certificate. - ''; - }; - }; - - aclPolicyFile = mkOption { - type = types.nullOr types.path; - default = null; - description = lib.mdDoc '' - Path to a file containg ACL policies. - ''; - }; - settings = mkOption { - type = settingsFormat.type; - default = { }; description = lib.mdDoc '' Overrides to {file}`config.yaml` as a Nix attribute set. - This option is ideal for overriding settings not exposed as Nix options. Check the [example config](https://github.com/juanfont/headscale/blob/main/config-example.yaml) for possible options. ''; + type = types.submodule { + freeformType = settingsFormat.type; + + options = { + server_url = mkOption { + type = types.str; + default = "http://127.0.0.1:8080"; + description = lib.mdDoc '' + The url clients will connect to. + ''; + example = "https://myheadscale.example.com:443"; + }; + + private_key_path = mkOption { + type = types.path; + default = "${dataDir}/private.key"; + description = lib.mdDoc '' + Path to private key file, generated automatically if it does not exist. + ''; + }; + + noise.private_key_path = mkOption { + type = types.path; + default = "${dataDir}/noise_private.key"; + description = lib.mdDoc '' + Path to noise private key file, generated automatically if it does not exist. + ''; + }; + + derp = { + urls = mkOption { + type = types.listOf types.str; + default = ["https://controlplane.tailscale.com/derpmap/default"]; + description = lib.mdDoc '' + List of urls containing DERP maps. + See [How Tailscale works](https://tailscale.com/blog/how-tailscale-works/) for more information on DERP maps. + ''; + }; + + paths = mkOption { + type = types.listOf types.path; + default = []; + description = lib.mdDoc '' + List of file paths containing DERP maps. + See [How Tailscale works](https://tailscale.com/blog/how-tailscale-works/) for more information on DERP maps. + ''; + }; + + auto_update_enable = mkOption { + type = types.bool; + default = true; + description = lib.mdDoc '' + Whether to automatically update DERP maps on a set frequency. + ''; + example = false; + }; + + update_frequency = mkOption { + type = types.str; + default = "24h"; + description = lib.mdDoc '' + Frequency to update DERP maps. + ''; + example = "5m"; + }; + }; + + ephemeral_node_inactivity_timeout = mkOption { + type = types.str; + default = "30m"; + description = lib.mdDoc '' + Time before an inactive ephemeral node is deleted. + ''; + example = "5m"; + }; + + db_type = mkOption { + type = types.enum ["sqlite3" "postgres"]; + example = "postgres"; + default = "sqlite3"; + description = lib.mdDoc "Database engine to use."; + }; + + db_host = mkOption { + type = types.nullOr types.str; + default = null; + example = "127.0.0.1"; + description = lib.mdDoc "Database host address."; + }; + + db_port = mkOption { + type = types.nullOr types.port; + default = null; + example = 3306; + description = lib.mdDoc "Database host port."; + }; + + db_name = mkOption { + type = types.nullOr types.str; + default = null; + example = "headscale"; + description = lib.mdDoc "Database name."; + }; + + db_user = mkOption { + type = types.nullOr types.str; + default = null; + example = "headscale"; + description = lib.mdDoc "Database user."; + }; + + db_password_file = mkOption { + type = types.nullOr types.path; + default = null; + example = "/run/keys/headscale-dbpassword"; + description = lib.mdDoc '' + A file containing the password corresponding to + {option}`database.user`. + ''; + }; + + db_path = mkOption { + type = types.nullOr types.str; + default = "${dataDir}/db.sqlite"; + description = lib.mdDoc "Path to the sqlite3 database file."; + }; + + log.level = mkOption { + type = types.str; + default = "info"; + description = lib.mdDoc '' + headscale log level. + ''; + example = "debug"; + }; + + log.format = mkOption { + type = types.str; + default = "text"; + description = lib.mdDoc '' + headscale log format. + ''; + example = "json"; + }; + + dns_config = { + nameservers = mkOption { + type = types.listOf types.str; + default = ["1.1.1.1"]; + description = lib.mdDoc '' + List of nameservers to pass to Tailscale clients. + ''; + }; + + override_local_dns = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + Whether to use [Override local DNS](https://tailscale.com/kb/1054/dns/). + ''; + example = true; + }; + + domains = mkOption { + type = types.listOf types.str; + default = []; + description = lib.mdDoc '' + Search domains to inject to Tailscale clients. + ''; + example = ["mydomain.internal"]; + }; + + magic_dns = mkOption { + type = types.bool; + default = true; + description = lib.mdDoc '' + Whether to use [MagicDNS](https://tailscale.com/kb/1081/magicdns/). + Only works if there is at least a nameserver defined. + ''; + example = false; + }; + + base_domain = mkOption { + type = types.str; + default = ""; + description = lib.mdDoc '' + Defines the base domain to create the hostnames for MagicDNS. + {option}`baseDomain` must be a FQDNs, without the trailing dot. + The FQDN of the hosts will be + `hostname.namespace.base_domain` (e.g. + `myhost.mynamespace.example.com`). + ''; + }; + }; + + oidc = { + issuer = mkOption { + type = types.str; + default = ""; + description = lib.mdDoc '' + URL to OpenID issuer. + ''; + example = "https://openid.example.com"; + }; + + client_id = mkOption { + type = types.str; + default = ""; + description = lib.mdDoc '' + OpenID Connect client ID. + ''; + }; + + client_secret_file = mkOption { + type = types.nullOr types.path; + default = null; + description = lib.mdDoc '' + Path to OpenID Connect client secret file. + ''; + }; + + domain_map = mkOption { + type = types.attrsOf types.str; + default = {}; + description = lib.mdDoc '' + Domain map is used to map incomming users (by their email) to + a namespace. The key can be a string, or regex. + ''; + example = { + ".*" = "default-namespace"; + }; + }; + }; + + tls_letsencrypt_hostname = mkOption { + type = types.nullOr types.str; + default = ""; + description = lib.mdDoc '' + Domain name to request a TLS certificate for. + ''; + }; + + tls_letsencrypt_challenge_type = mkOption { + type = types.enum ["TLS-ALPN-01" "HTTP-01"]; + default = "HTTP-01"; + description = lib.mdDoc '' + Type of ACME challenge to use, currently supported types: + `HTTP-01` or `TLS-ALPN-01`. + ''; + }; + + tls_letsencrypt_listen = mkOption { + type = types.nullOr types.str; + default = ":http"; + description = lib.mdDoc '' + When HTTP-01 challenge is chosen, letsencrypt must set up a + verification endpoint, and it will be listening on: + `:http = port 80`. + ''; + }; + + tls_cert_path = mkOption { + type = types.nullOr types.path; + default = null; + description = lib.mdDoc '' + Path to already created certificate. + ''; + }; + + tls_key_path = mkOption { + type = types.nullOr types.path; + default = null; + description = lib.mdDoc '' + Path to key for already created certificate. + ''; + }; + + acl_policy_path = mkOption { + type = types.nullOr types.path; + default = null; + description = lib.mdDoc '' + Path to a file containg ACL policies. + ''; + }; + }; + }; }; - - }; - }; - config = mkIf cfg.enable { + imports = [ + # TODO address + port = listen_addr + (mkRenamedOptionModule ["services" "headscale" "serverUrl"] ["services" "headscale" "settings" "server_url"]) + (mkRenamedOptionModule ["services" "headscale" "privateKeyFile"] ["services" "headscale" "settings" "private_key_path"]) + (mkRenamedOptionModule ["services" "headscale" "derp" "urls"] ["services" "headscale" "settings" "derp" "urls"]) + (mkRenamedOptionModule ["services" "headscale" "derp" "paths"] ["services" "headscale" "settings" "derp" "paths"]) + (mkRenamedOptionModule ["services" "headscale" "derp" "autoUpdate"] ["services" "headscale" "settings" "derp" "auto_update_enable"]) + (mkRenamedOptionModule ["services" "headscale" "derp" "updateFrequency"] ["services" "headscale" "settings" "derp" "update_frequency"]) + (mkRenamedOptionModule ["services" "headscale" "ephemeralNodeInactivityTimeout"] ["services" "headscale" "settings" "ephemeral_node_inactivity_timeout"]) + (mkRenamedOptionModule ["services" "headscale" "database" "type"] ["services" "headscale" "settings" "db_type"]) + (mkRenamedOptionModule ["services" "headscale" "database" "path"] ["services" "headscale" "settings" "db_path"]) + (mkRenamedOptionModule ["services" "headscale" "database" "host"] ["services" "headscale" "settings" "db_host"]) + (mkRenamedOptionModule ["services" "headscale" "database" "port"] ["services" "headscale" "settings" "db_port"]) + (mkRenamedOptionModule ["services" "headscale" "database" "name"] ["services" "headscale" "settings" "db_name"]) + (mkRenamedOptionModule ["services" "headscale" "database" "user"] ["services" "headscale" "settings" "db_user"]) + (mkRenamedOptionModule ["services" "headscale" "database" "passwordFile"] ["services" "headscale" "settings" "db_password_file"]) + (mkRenamedOptionModule ["services" "headscale" "logLevel"] ["services" "headscale" "settings" "log" "level"]) + (mkRenamedOptionModule ["services" "headscale" "dns" "nameservers"] ["services" "headscale" "settings" "dns_config" "nameservers"]) + (mkRenamedOptionModule ["services" "headscale" "dns" "domains"] ["services" "headscale" "settings" "dns_config" "domains"]) + (mkRenamedOptionModule ["services" "headscale" "dns" "magicDns"] ["services" "headscale" "settings" "dns_config" "magic_dns"]) + (mkRenamedOptionModule ["services" "headscale" "dns" "baseDomain"] ["services" "headscale" "settings" "dns_config" "base_domain"]) + (mkRenamedOptionModule ["services" "headscale" "openIdConnect" "issuer"] ["services" "headscale" "settings" "oidc" "issuer"]) + (mkRenamedOptionModule ["services" "headscale" "openIdConnect" "clientId"] ["services" "headscale" "settings" "oidc" "client_id"]) + (mkRenamedOptionModule ["services" "headscale" "openIdConnect" "clientSecretFile"] ["services" "headscale" "settings" "oidc" "client_secret_file"]) + (mkRenamedOptionModule ["services" "headscale" "openIdConnect" "domainMap"] ["services" "headscale" "settings" "oidc" "domain_map"]) + (mkRenamedOptionModule ["services" "headscale" "tls" "letsencrypt" "hostname"] ["services" "headscale" "settings" "tls_letsencrypt_hostname"]) + (mkRenamedOptionModule ["services" "headscale" "tls" "letsencrypt" "challengeType"] ["services" "headscale" "settings" "tls_letsencrypt_challenge_type"]) + (mkRenamedOptionModule ["services" "headscale" "tls" "letsencrypt" "httpListen"] ["services" "headscale" "settings" "tls_letsencrypt_listen"]) + (mkRenamedOptionModule ["services" "headscale" "tls" "certFile"] ["services" "headscale" "settings" "tls_cert_path"]) + (mkRenamedOptionModule ["services" "headscale" "tls" "keyFile"] ["services" "headscale" "settings" "tls_key_path"]) + (mkRenamedOptionModule ["services" "headscale" "aclPolicyFile"] ["services" "headscale" "settings" "acl_policy_path"]) + ]; + + config = mkIf cfg.enable { services.headscale.settings = { - server_url = mkDefault cfg.serverUrl; listen_addr = mkDefault "${cfg.address}:${toString cfg.port}"; - private_key_path = mkDefault cfg.privateKeyFile; - - derp = { - urls = mkDefault cfg.derp.urls; - paths = mkDefault cfg.derp.paths; - auto_update_enable = mkDefault cfg.derp.autoUpdate; - update_frequency = mkDefault cfg.derp.updateFrequency; - }; - # Turn off update checks since the origin of our package # is nixpkgs and not Github. disable_check_updates = true; - ephemeral_node_inactivity_timeout = mkDefault cfg.ephemeralNodeInactivityTimeout; - - db_type = mkDefault cfg.database.type; - db_path = mkDefault cfg.database.path; - - log_level = mkDefault cfg.logLevel; - - dns_config = { - nameservers = mkDefault cfg.dns.nameservers; - domains = mkDefault cfg.dns.domains; - magic_dns = mkDefault cfg.dns.magicDns; - base_domain = mkDefault cfg.dns.baseDomain; - }; - unix_socket = "${runDir}/headscale.sock"; - # OpenID Connect - oidc = { - issuer = mkDefault cfg.openIdConnect.issuer; - client_id = mkDefault cfg.openIdConnect.clientId; - domain_map = mkDefault cfg.openIdConnect.domainMap; - }; - tls_letsencrypt_cache_dir = "${dataDir}/.cache"; - - } // optionalAttrs (cfg.database.host != null) { - db_host = mkDefault cfg.database.host; - } // optionalAttrs (cfg.database.port != null) { - db_port = mkDefault cfg.database.port; - } // optionalAttrs (cfg.database.name != null) { - db_name = mkDefault cfg.database.name; - } // optionalAttrs (cfg.database.user != null) { - db_user = mkDefault cfg.database.user; - } // optionalAttrs (cfg.tls.letsencrypt.hostname != null) { - tls_letsencrypt_hostname = mkDefault cfg.tls.letsencrypt.hostname; - } // optionalAttrs (cfg.tls.letsencrypt.challengeType != null) { - tls_letsencrypt_challenge_type = mkDefault cfg.tls.letsencrypt.challengeType; - } // optionalAttrs (cfg.tls.letsencrypt.httpListen != null) { - tls_letsencrypt_listen = mkDefault cfg.tls.letsencrypt.httpListen; - } // optionalAttrs (cfg.tls.certFile != null) { - tls_cert_path = mkDefault cfg.tls.certFile; - } // optionalAttrs (cfg.tls.keyFile != null) { - tls_key_path = mkDefault cfg.tls.keyFile; - } // optionalAttrs (cfg.aclPolicyFile != null) { - acl_policy_path = mkDefault cfg.aclPolicyFile; }; # Setup the headscale configuration in a known path in /etc to @@ -416,7 +419,7 @@ in # for communication. environment.etc."headscale/config.yaml".source = configFile; - users.groups.headscale = mkIf (cfg.group == "headscale") { }; + users.groups.headscale = mkIf (cfg.group == "headscale") {}; users.users.headscale = mkIf (cfg.user == "headscale") { description = "headscale user"; @@ -427,70 +430,68 @@ in systemd.services.headscale = { description = "headscale coordination server for Tailscale"; - after = [ "network-online.target" ]; - wantedBy = [ "multi-user.target" ]; - restartTriggers = [ configFile ]; + after = ["network-online.target"]; + wantedBy = ["multi-user.target"]; + restartTriggers = [configFile]; environment.GIN_MODE = "release"; script = '' - ${optionalString (cfg.database.passwordFile != null) '' - export HEADSCALE_DB_PASS="$(head -n1 ${escapeShellArg cfg.database.passwordFile})" + ${optionalString (cfg.settings.db_password_file != null) '' + export HEADSCALE_DB_PASS="$(head -n1 ${escapeShellArg cfg.settings.db_password_file})" ''} - ${optionalString (cfg.openIdConnect.clientSecretFile != null) '' - export HEADSCALE_OIDC_CLIENT_SECRET="$(head -n1 ${escapeShellArg cfg.openIdConnect.clientSecretFile})" + ${optionalString (cfg.settings.oidc.client_secret_file != null) '' + export HEADSCALE_OIDC_CLIENT_SECRET="$(head -n1 ${escapeShellArg cfg.settings.oidc.client_secret_file})" ''} exec ${cfg.package}/bin/headscale serve ''; - serviceConfig = - let - capabilityBoundingSet = [ "CAP_CHOWN" ] ++ optional (cfg.port < 1024) "CAP_NET_BIND_SERVICE"; - in - { - Restart = "always"; - Type = "simple"; - User = cfg.user; - Group = cfg.group; - - # Hardening options - RuntimeDirectory = "headscale"; - # Allow headscale group access so users can be added and use the CLI. - RuntimeDirectoryMode = "0750"; - - StateDirectory = "headscale"; - StateDirectoryMode = "0750"; - - ProtectSystem = "strict"; - ProtectHome = true; - PrivateTmp = true; - PrivateDevices = true; - ProtectKernelTunables = true; - ProtectControlGroups = true; - RestrictSUIDSGID = true; - PrivateMounts = true; - ProtectKernelModules = true; - ProtectKernelLogs = true; - ProtectHostname = true; - ProtectClock = true; - ProtectProc = "invisible"; - ProcSubset = "pid"; - RestrictNamespaces = true; - RemoveIPC = true; - UMask = "0077"; - - CapabilityBoundingSet = capabilityBoundingSet; - AmbientCapabilities = capabilityBoundingSet; - NoNewPrivileges = true; - LockPersonality = true; - RestrictRealtime = true; - SystemCallFilter = [ "@system-service" "~@privileged" "@chown" ]; - SystemCallArchitectures = "native"; - RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX"; - }; + serviceConfig = let + capabilityBoundingSet = ["CAP_CHOWN"] ++ optional (cfg.port < 1024) "CAP_NET_BIND_SERVICE"; + in { + Restart = "always"; + Type = "simple"; + User = cfg.user; + Group = cfg.group; + + # Hardening options + RuntimeDirectory = "headscale"; + # Allow headscale group access so users can be added and use the CLI. + RuntimeDirectoryMode = "0750"; + + StateDirectory = "headscale"; + StateDirectoryMode = "0750"; + + ProtectSystem = "strict"; + ProtectHome = true; + PrivateTmp = true; + PrivateDevices = true; + ProtectKernelTunables = true; + ProtectControlGroups = true; + RestrictSUIDSGID = true; + PrivateMounts = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectHostname = true; + ProtectClock = true; + ProtectProc = "invisible"; + ProcSubset = "pid"; + RestrictNamespaces = true; + RemoveIPC = true; + UMask = "0077"; + + CapabilityBoundingSet = capabilityBoundingSet; + AmbientCapabilities = capabilityBoundingSet; + NoNewPrivileges = true; + LockPersonality = true; + RestrictRealtime = true; + SystemCallFilter = ["@system-service" "~@privileged" "@chown"]; + SystemCallArchitectures = "native"; + RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX"; + }; }; }; - meta.maintainers = with maintainers; [ kradalby ]; + meta.maintainers = with maintainers; [kradalby misterio77]; } diff --git a/nixos/modules/services/networking/hylafax/systemd.nix b/nixos/modules/services/networking/hylafax/systemd.nix index 4506bbbc5eb7..df6d0f49eec4 100644 --- a/nixos/modules/services/networking/hylafax/systemd.nix +++ b/nixos/modules/services/networking/hylafax/systemd.nix @@ -96,7 +96,7 @@ let hardenService = # Add some common systemd service hardening settings, # but allow each service (here) to override - # settings by explicitely setting those to `null`. + # settings by explicitly setting those to `null`. # More hardening would be nice but makes # customizing hylafax setups very difficult. # If at all, it should only be added along diff --git a/nixos/modules/services/networking/i2pd.nix b/nixos/modules/services/networking/i2pd.nix index a02f8df11163..3f6cb97296b5 100644 --- a/nixos/modules/services/networking/i2pd.nix +++ b/nixos/modules/services/networking/i2pd.nix @@ -473,7 +473,7 @@ in type = with types; nullOr str; default = null; description = lib.mdDoc '' - Router Familiy to trust for first hops. + Router Family to trust for first hops. ''; }; diff --git a/nixos/modules/services/networking/iperf3.nix b/nixos/modules/services/networking/iperf3.nix index a70085bb1f5a..0a204524e00f 100644 --- a/nixos/modules/services/networking/iperf3.nix +++ b/nixos/modules/services/networking/iperf3.nix @@ -7,7 +7,7 @@ let port = mkOption { type = types.ints.u16; default = 5201; - description = lib.mdDoc "Server port to listen on for iperf3 client requsts."; + description = lib.mdDoc "Server port to listen on for iperf3 client requests."; }; affinity = mkOption { type = types.nullOr types.ints.unsigned; diff --git a/nixos/modules/services/networking/kea.nix b/nixos/modules/services/networking/kea.nix index f39b149dd609..945f4113bd47 100644 --- a/nixos/modules/services/networking/kea.nix +++ b/nixos/modules/services/networking/kea.nix @@ -47,7 +47,7 @@ in type = listOf str; default = []; description = lib.mdDoc '' - List of additonal arguments to pass to the daemon. + List of additional arguments to pass to the daemon. ''; }; @@ -86,7 +86,7 @@ in type = listOf str; default = []; description = lib.mdDoc '' - List of additonal arguments to pass to the daemon. + List of additional arguments to pass to the daemon. ''; }; @@ -146,7 +146,7 @@ in type = listOf str; default = []; description = lib.mdDoc '' - List of additonal arguments to pass to the daemon. + List of additional arguments to pass to the daemon. ''; }; @@ -207,7 +207,7 @@ in type = listOf str; default = []; description = lib.mdDoc '' - List of additonal arguments to pass to the daemon. + List of additional arguments to pass to the daemon. ''; }; diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix index ee7ea83456d4..e97195d82919 100644 --- a/nixos/modules/services/networking/knot.nix +++ b/nixos/modules/services/networking/knot.nix @@ -43,7 +43,7 @@ in { type = types.listOf types.str; default = []; description = lib.mdDoc '' - List of additional command line paramters for knotd + List of additional command line parameters for knotd ''; }; diff --git a/nixos/modules/services/networking/libreswan.nix b/nixos/modules/services/networking/libreswan.nix index b5df31c28d7c..785729d8f742 100644 --- a/nixos/modules/services/networking/libreswan.nix +++ b/nixos/modules/services/networking/libreswan.nix @@ -106,7 +106,7 @@ in type = types.bool; default = true; description = lib.mdDoc '' - Whether to disable send and accept redirects for all nework interfaces. + Whether to disable send and accept redirects for all network interfaces. See the Libreswan [ FAQ](https://libreswan.org/wiki/FAQ#Why_is_it_recommended_to_disable_send_redirects_in_.2Fproc.2Fsys.2Fnet_.3F) page for why this is recommended. ''; diff --git a/nixos/modules/services/networking/lxd-image-server.nix b/nixos/modules/services/networking/lxd-image-server.nix index 1099169440a8..d8e32eb997e8 100644 --- a/nixos/modules/services/networking/lxd-image-server.nix +++ b/nixos/modules/services/networking/lxd-image-server.nix @@ -87,7 +87,7 @@ in }; }; }) - # this is seperate so it can be enabled on mirrored hosts + # this is separate so it can be enabled on mirrored hosts (mkIf (cfg.nginx.enable) { # https://github.com/Avature/lxd-image-server/blob/master/resources/nginx/includes/lxd-image-server.pkg.conf services.nginx.virtualHosts = { diff --git a/nixos/modules/services/networking/mmsd.nix b/nixos/modules/services/networking/mmsd.nix new file mode 100644 index 000000000000..7e262a9326c1 --- /dev/null +++ b/nixos/modules/services/networking/mmsd.nix @@ -0,0 +1,38 @@ +{ pkgs, lib, config, ... }: +with lib; +let + cfg = config.services.mmsd; + dbusServiceFile = pkgs.writeTextDir "share/dbus-1/services/org.ofono.mms.service" '' + [D-BUS Service] + Name=org.ofono.mms + SystemdService=dbus-org.ofono.mms.service + + # Exec= is still required despite SystemdService= being used: + # https://github.com/freedesktop/dbus/blob/ef55a3db0d8f17848f8a579092fb05900cc076f5/test/data/systemd-activation/com.example.SystemdActivatable1.service + Exec=${pkgs.coreutils}/bin/false mmsd + ''; +in +{ + options.services.mmsd = { + enable = mkEnableOption (mdDoc "Multimedia Messaging Service Daemon"); + extraArgs = mkOption { + type = with types; listOf str; + description = mdDoc "Extra arguments passed to `mmsd-tng`"; + default = []; + example = ["--debug"]; + }; + }; + config = mkIf cfg.enable { + services.dbus.packages = [ dbusServiceFile ]; + systemd.user.services.mmsd = { + after = [ "ModemManager.service" ]; + aliases = [ "dbus-org.ofono.mms.service" ]; + serviceConfig = { + Type = "dbus"; + ExecStart = "${pkgs.mmsd-tng}/bin/mmsdtng " + escapeShellArgs cfg.extraArgs; + BusName = "org.ofono.mms"; + Restart = "on-failure"; + }; + }; + }; +} diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix index 6543eb34b4b2..270450cb0c62 100644 --- a/nixos/modules/services/networking/mosquitto.nix +++ b/nixos/modules/services/networking/mosquitto.nix @@ -479,7 +479,7 @@ let Directories to be scanned for further config files to include. Directories will processed in the order given, `*.conf` files in the directory will be - read in case-sensistive alphabetical order. + read in case-sensitive alphabetical order. ''; default = []; }; diff --git a/nixos/modules/services/networking/nat-iptables.nix b/nixos/modules/services/networking/nat-iptables.nix new file mode 100644 index 000000000000..d1bed401feeb --- /dev/null +++ b/nixos/modules/services/networking/nat-iptables.nix @@ -0,0 +1,191 @@ +# This module enables Network Address Translation (NAT). +# XXX: todo: support multiple upstream links +# see http://yesican.chsoft.biz/lartc/MultihomedLinuxNetworking.html + +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.networking.nat; + + mkDest = externalIP: + if externalIP == null + then "-j MASQUERADE" + else "-j SNAT --to-source ${externalIP}"; + dest = mkDest cfg.externalIP; + destIPv6 = mkDest cfg.externalIPv6; + + # Whether given IP (plus optional port) is an IPv6. + isIPv6 = ip: builtins.length (lib.splitString ":" ip) > 2; + + helpers = import ./helpers.nix { inherit config lib; }; + + flushNat = '' + ${helpers} + ip46tables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true + ip46tables -w -t nat -F nixos-nat-pre 2>/dev/null || true + ip46tables -w -t nat -X nixos-nat-pre 2>/dev/null || true + ip46tables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true + ip46tables -w -t nat -F nixos-nat-post 2>/dev/null || true + ip46tables -w -t nat -X nixos-nat-post 2>/dev/null || true + ip46tables -w -t nat -D OUTPUT -j nixos-nat-out 2>/dev/null || true + ip46tables -w -t nat -F nixos-nat-out 2>/dev/null || true + ip46tables -w -t nat -X nixos-nat-out 2>/dev/null || true + + ${cfg.extraStopCommands} + ''; + + mkSetupNat = { iptables, dest, internalIPs, forwardPorts }: '' + # We can't match on incoming interface in POSTROUTING, so + # mark packets coming from the internal interfaces. + ${concatMapStrings (iface: '' + ${iptables} -w -t nat -A nixos-nat-pre \ + -i '${iface}' -j MARK --set-mark 1 + '') cfg.internalInterfaces} + + # NAT the marked packets. + ${optionalString (cfg.internalInterfaces != []) '' + ${iptables} -w -t nat -A nixos-nat-post -m mark --mark 1 \ + ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest} + ''} + + # NAT packets coming from the internal IPs. + ${concatMapStrings (range: '' + ${iptables} -w -t nat -A nixos-nat-post \ + -s '${range}' ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest} + '') internalIPs} + + # NAT from external ports to internal ports. + ${concatMapStrings (fwd: '' + ${iptables} -w -t nat -A nixos-nat-pre \ + -i ${toString cfg.externalInterface} -p ${fwd.proto} \ + --dport ${builtins.toString fwd.sourcePort} \ + -j DNAT --to-destination ${fwd.destination} + + ${concatMapStrings (loopbackip: + let + matchIP = if isIPv6 fwd.destination then "[[]([0-9a-fA-F:]+)[]]" else "([0-9.]+)"; + m = builtins.match "${matchIP}:([0-9-]+)" fwd.destination; + destinationIP = if m == null then throw "bad ip:ports `${fwd.destination}'" else elemAt m 0; + destinationPorts = if m == null then throw "bad ip:ports `${fwd.destination}'" else builtins.replaceStrings ["-"] [":"] (elemAt m 1); + in '' + # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from the host itself + ${iptables} -w -t nat -A nixos-nat-out \ + -d ${loopbackip} -p ${fwd.proto} \ + --dport ${builtins.toString fwd.sourcePort} \ + -j DNAT --to-destination ${fwd.destination} + + # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from other hosts behind NAT + ${iptables} -w -t nat -A nixos-nat-pre \ + -d ${loopbackip} -p ${fwd.proto} \ + --dport ${builtins.toString fwd.sourcePort} \ + -j DNAT --to-destination ${fwd.destination} + + ${iptables} -w -t nat -A nixos-nat-post \ + -d ${destinationIP} -p ${fwd.proto} \ + --dport ${destinationPorts} \ + -j SNAT --to-source ${loopbackip} + '') fwd.loopbackIPs} + '') forwardPorts} + ''; + + setupNat = '' + ${helpers} + # Create subchains where we store rules + ip46tables -w -t nat -N nixos-nat-pre + ip46tables -w -t nat -N nixos-nat-post + ip46tables -w -t nat -N nixos-nat-out + + ${mkSetupNat { + iptables = "iptables"; + inherit dest; + inherit (cfg) internalIPs; + forwardPorts = filter (x: !(isIPv6 x.destination)) cfg.forwardPorts; + }} + + ${optionalString cfg.enableIPv6 (mkSetupNat { + iptables = "ip6tables"; + dest = destIPv6; + internalIPs = cfg.internalIPv6s; + forwardPorts = filter (x: isIPv6 x.destination) cfg.forwardPorts; + })} + + ${optionalString (cfg.dmzHost != null) '' + iptables -w -t nat -A nixos-nat-pre \ + -i ${toString cfg.externalInterface} -j DNAT \ + --to-destination ${cfg.dmzHost} + ''} + + ${cfg.extraCommands} + + # Append our chains to the nat tables + ip46tables -w -t nat -A PREROUTING -j nixos-nat-pre + ip46tables -w -t nat -A POSTROUTING -j nixos-nat-post + ip46tables -w -t nat -A OUTPUT -j nixos-nat-out + ''; + +in + +{ + + options = { + + networking.nat.extraCommands = mkOption { + type = types.lines; + default = ""; + example = "iptables -A INPUT -p icmp -j ACCEPT"; + description = lib.mdDoc '' + Additional shell commands executed as part of the nat + initialisation script. + + This option is incompatible with the nftables based nat module. + ''; + }; + + networking.nat.extraStopCommands = mkOption { + type = types.lines; + default = ""; + example = "iptables -D INPUT -p icmp -j ACCEPT || true"; + description = lib.mdDoc '' + Additional shell commands executed as part of the nat + teardown script. + + This option is incompatible with the nftables based nat module. + ''; + }; + + }; + + + config = mkIf (!config.networking.nftables.enable) + (mkMerge [ + ({ networking.firewall.extraCommands = mkBefore flushNat; }) + (mkIf config.networking.nat.enable { + + networking.firewall = mkIf config.networking.firewall.enable { + extraCommands = setupNat; + extraStopCommands = flushNat; + }; + + systemd.services = mkIf (!config.networking.firewall.enable) { + nat = { + description = "Network Address Translation"; + wantedBy = [ "network.target" ]; + after = [ "network-pre.target" "systemd-modules-load.service" ]; + path = [ config.networking.firewall.package ]; + unitConfig.ConditionCapability = "CAP_NET_ADMIN"; + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + + script = flushNat + setupNat; + + postStop = flushNat; + }; + }; + }) + ]); +} diff --git a/nixos/modules/services/networking/nat-nftables.nix b/nixos/modules/services/networking/nat-nftables.nix new file mode 100644 index 000000000000..483910a16658 --- /dev/null +++ b/nixos/modules/services/networking/nat-nftables.nix @@ -0,0 +1,184 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.networking.nat; + + mkDest = externalIP: + if externalIP == null + then "masquerade" + else "snat ${externalIP}"; + dest = mkDest cfg.externalIP; + destIPv6 = mkDest cfg.externalIPv6; + + toNftSet = list: concatStringsSep ", " list; + toNftRange = ports: replaceStrings [ ":" ] [ "-" ] (toString ports); + + ifaceSet = toNftSet (map (x: ''"${x}"'') cfg.internalInterfaces); + ipSet = toNftSet cfg.internalIPs; + ipv6Set = toNftSet cfg.internalIPv6s; + oifExpr = optionalString (cfg.externalInterface != null) ''oifname "${cfg.externalInterface}"''; + + # Whether given IP (plus optional port) is an IPv6. + isIPv6 = ip: length (lib.splitString ":" ip) > 2; + + splitIPPorts = IPPorts: + let + matchIP = if isIPv6 IPPorts then "[[]([0-9a-fA-F:]+)[]]" else "([0-9.]+)"; + m = builtins.match "${matchIP}:([0-9-]+)" IPPorts; + in + { + IP = if m == null then throw "bad ip:ports `${IPPorts}'" else elemAt m 0; + ports = if m == null then throw "bad ip:ports `${IPPorts}'" else elemAt m 1; + }; + + mkTable = { ipVer, dest, ipSet, forwardPorts, dmzHost }: + let + # nftables does not support both port and port range as values in a dnat map. + # e.g. "dnat th dport map { 80 : 10.0.0.1 . 80, 443 : 10.0.0.2 . 900-1000 }" + # So we split them. + fwdPorts = filter (x: length (splitString "-" x.destination) == 1) forwardPorts; + fwdPortsRange = filter (x: length (splitString "-" x.destination) > 1) forwardPorts; + + # nftables maps for port forward + # l4proto . dport : addr . port + toFwdMap = forwardPorts: toNftSet (map + (fwd: + with (splitIPPorts fwd.destination); + "${fwd.proto} . ${toNftRange fwd.sourcePort} : ${IP} . ${ports}" + ) + forwardPorts); + fwdMap = toFwdMap fwdPorts; + fwdRangeMap = toFwdMap fwdPortsRange; + + # nftables maps for port forward loopback dnat + # daddr . l4proto . dport : addr . port + toFwdLoopDnatMap = forwardPorts: toNftSet (concatMap + (fwd: map + (loopbackip: + with (splitIPPorts fwd.destination); + "${loopbackip} . ${fwd.proto} . ${toNftRange fwd.sourcePort} : ${IP} . ${ports}" + ) + fwd.loopbackIPs) + forwardPorts); + fwdLoopDnatMap = toFwdLoopDnatMap fwdPorts; + fwdLoopDnatRangeMap = toFwdLoopDnatMap fwdPortsRange; + + # nftables set for port forward loopback snat + # daddr . l4proto . dport + fwdLoopSnatSet = toNftSet (map + (fwd: + with (splitIPPorts fwd.destination); + "${IP} . ${fwd.proto} . ${ports}" + ) + forwardPorts); + in + '' + chain pre { + type nat hook prerouting priority dstnat; + + ${optionalString (fwdMap != "") '' + iifname "${cfg.externalInterface}" dnat meta l4proto . th dport map { ${fwdMap} } comment "port forward" + ''} + ${optionalString (fwdRangeMap != "") '' + iifname "${cfg.externalInterface}" dnat meta l4proto . th dport map { ${fwdRangeMap} } comment "port forward" + ''} + + ${optionalString (fwdLoopDnatMap != "") '' + dnat ${ipVer} daddr . meta l4proto . th dport map { ${fwdLoopDnatMap} } comment "port forward loopback from other hosts behind NAT" + ''} + ${optionalString (fwdLoopDnatRangeMap != "") '' + dnat ${ipVer} daddr . meta l4proto . th dport map { ${fwdLoopDnatRangeMap} } comment "port forward loopback from other hosts behind NAT" + ''} + + ${optionalString (dmzHost != null) '' + iifname "${cfg.externalInterface}" dnat ${dmzHost} comment "dmz" + ''} + } + + chain post { + type nat hook postrouting priority srcnat; + + ${optionalString (ifaceSet != "") '' + iifname { ${ifaceSet} } ${oifExpr} ${dest} comment "from internal interfaces" + ''} + ${optionalString (ipSet != "") '' + ${ipVer} saddr { ${ipSet} } ${oifExpr} ${dest} comment "from internal IPs" + ''} + + ${optionalString (fwdLoopSnatSet != "") '' + iifname != "${cfg.externalInterface}" ${ipVer} daddr . meta l4proto . th dport { ${fwdLoopSnatSet} } masquerade comment "port forward loopback snat" + ''} + } + + chain out { + type nat hook output priority mangle; + + ${optionalString (fwdLoopDnatMap != "") '' + dnat ${ipVer} daddr . meta l4proto . th dport map { ${fwdLoopDnatMap} } comment "port forward loopback from the host itself" + ''} + ${optionalString (fwdLoopDnatRangeMap != "") '' + dnat ${ipVer} daddr . meta l4proto . th dport map { ${fwdLoopDnatRangeMap} } comment "port forward loopback from the host itself" + ''} + } + ''; + +in + +{ + + config = mkIf (config.networking.nftables.enable && cfg.enable) { + + assertions = [ + { + assertion = cfg.extraCommands == ""; + message = "extraCommands is incompatible with the nftables based nat module: ${cfg.extraCommands}"; + } + { + assertion = cfg.extraStopCommands == ""; + message = "extraStopCommands is incompatible with the nftables based nat module: ${cfg.extraStopCommands}"; + } + { + assertion = config.networking.nftables.rulesetFile == null; + message = "networking.nftables.rulesetFile conflicts with the nat module"; + } + ]; + + networking.nftables.ruleset = '' + table ip nixos-nat { + ${mkTable { + ipVer = "ip"; + inherit dest ipSet; + forwardPorts = filter (x: !(isIPv6 x.destination)) cfg.forwardPorts; + inherit (cfg) dmzHost; + }} + } + + ${optionalString cfg.enableIPv6 '' + table ip6 nixos-nat { + ${mkTable { + ipVer = "ip6"; + dest = destIPv6; + ipSet = ipv6Set; + forwardPorts = filter (x: isIPv6 x.destination) cfg.forwardPorts; + dmzHost = null; + }} + } + ''} + ''; + + networking.firewall.extraForwardRules = optionalString config.networking.firewall.filterForward '' + ${optionalString (ifaceSet != "") '' + iifname { ${ifaceSet} } ${oifExpr} accept comment "from internal interfaces" + ''} + ${optionalString (ipSet != "") '' + ip saddr { ${ipSet} } ${oifExpr} accept comment "from internal IPs" + ''} + ${optionalString (ipv6Set != "") '' + ip6 saddr { ${ipv6Set} } ${oifExpr} accept comment "from internal IPv6s" + ''} + ''; + + }; +} diff --git a/nixos/modules/services/networking/nat.nix b/nixos/modules/services/networking/nat.nix index 0b70ae47ccf5..a6f403b46f87 100644 --- a/nixos/modules/services/networking/nat.nix +++ b/nixos/modules/services/networking/nat.nix @@ -7,219 +7,95 @@ with lib; let - cfg = config.networking.nat; - - mkDest = externalIP: if externalIP == null - then "-j MASQUERADE" - else "-j SNAT --to-source ${externalIP}"; - dest = mkDest cfg.externalIP; - destIPv6 = mkDest cfg.externalIPv6; - - # Whether given IP (plus optional port) is an IPv6. - isIPv6 = ip: builtins.length (lib.splitString ":" ip) > 2; - - helpers = import ./helpers.nix { inherit config lib; }; - - flushNat = '' - ${helpers} - ip46tables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true - ip46tables -w -t nat -F nixos-nat-pre 2>/dev/null || true - ip46tables -w -t nat -X nixos-nat-pre 2>/dev/null || true - ip46tables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true - ip46tables -w -t nat -F nixos-nat-post 2>/dev/null || true - ip46tables -w -t nat -X nixos-nat-post 2>/dev/null || true - ip46tables -w -t nat -D OUTPUT -j nixos-nat-out 2>/dev/null || true - ip46tables -w -t nat -F nixos-nat-out 2>/dev/null || true - ip46tables -w -t nat -X nixos-nat-out 2>/dev/null || true - - ${cfg.extraStopCommands} - ''; - - mkSetupNat = { iptables, dest, internalIPs, forwardPorts }: '' - # We can't match on incoming interface in POSTROUTING, so - # mark packets coming from the internal interfaces. - ${concatMapStrings (iface: '' - ${iptables} -w -t nat -A nixos-nat-pre \ - -i '${iface}' -j MARK --set-mark 1 - '') cfg.internalInterfaces} - - # NAT the marked packets. - ${optionalString (cfg.internalInterfaces != []) '' - ${iptables} -w -t nat -A nixos-nat-post -m mark --mark 1 \ - ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest} - ''} - - # NAT packets coming from the internal IPs. - ${concatMapStrings (range: '' - ${iptables} -w -t nat -A nixos-nat-post \ - -s '${range}' ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest} - '') internalIPs} - - # NAT from external ports to internal ports. - ${concatMapStrings (fwd: '' - ${iptables} -w -t nat -A nixos-nat-pre \ - -i ${toString cfg.externalInterface} -p ${fwd.proto} \ - --dport ${builtins.toString fwd.sourcePort} \ - -j DNAT --to-destination ${fwd.destination} - ${concatMapStrings (loopbackip: - let - matchIP = if isIPv6 fwd.destination then "[[]([0-9a-fA-F:]+)[]]" else "([0-9.]+)"; - m = builtins.match "${matchIP}:([0-9-]+)" fwd.destination; - destinationIP = if m == null then throw "bad ip:ports `${fwd.destination}'" else elemAt m 0; - destinationPorts = if m == null then throw "bad ip:ports `${fwd.destination}'" else builtins.replaceStrings ["-"] [":"] (elemAt m 1); - in '' - # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from the host itself - ${iptables} -w -t nat -A nixos-nat-out \ - -d ${loopbackip} -p ${fwd.proto} \ - --dport ${builtins.toString fwd.sourcePort} \ - -j DNAT --to-destination ${fwd.destination} - - # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from other hosts behind NAT - ${iptables} -w -t nat -A nixos-nat-pre \ - -d ${loopbackip} -p ${fwd.proto} \ - --dport ${builtins.toString fwd.sourcePort} \ - -j DNAT --to-destination ${fwd.destination} - - ${iptables} -w -t nat -A nixos-nat-post \ - -d ${destinationIP} -p ${fwd.proto} \ - --dport ${destinationPorts} \ - -j SNAT --to-source ${loopbackip} - '') fwd.loopbackIPs} - '') forwardPorts} - ''; - - setupNat = '' - ${helpers} - # Create subchains where we store rules - ip46tables -w -t nat -N nixos-nat-pre - ip46tables -w -t nat -N nixos-nat-post - ip46tables -w -t nat -N nixos-nat-out - - ${mkSetupNat { - iptables = "iptables"; - inherit dest; - inherit (cfg) internalIPs; - forwardPorts = filter (x: !(isIPv6 x.destination)) cfg.forwardPorts; - }} - - ${optionalString cfg.enableIPv6 (mkSetupNat { - iptables = "ip6tables"; - dest = destIPv6; - internalIPs = cfg.internalIPv6s; - forwardPorts = filter (x: isIPv6 x.destination) cfg.forwardPorts; - })} - - ${optionalString (cfg.dmzHost != null) '' - iptables -w -t nat -A nixos-nat-pre \ - -i ${toString cfg.externalInterface} -j DNAT \ - --to-destination ${cfg.dmzHost} - ''} - - ${cfg.extraCommands} - - # Append our chains to the nat tables - ip46tables -w -t nat -A PREROUTING -j nixos-nat-pre - ip46tables -w -t nat -A POSTROUTING -j nixos-nat-post - ip46tables -w -t nat -A OUTPUT -j nixos-nat-out - ''; + cfg = config.networking.nat; in { - ###### interface - options = { networking.nat.enable = mkOption { type = types.bool; default = false; - description = - lib.mdDoc '' - Whether to enable Network Address Translation (NAT). - ''; + description = lib.mdDoc '' + Whether to enable Network Address Translation (NAT). + ''; }; networking.nat.enableIPv6 = mkOption { type = types.bool; default = false; - description = - lib.mdDoc '' - Whether to enable IPv6 NAT. - ''; + description = lib.mdDoc '' + Whether to enable IPv6 NAT. + ''; }; networking.nat.internalInterfaces = mkOption { type = types.listOf types.str; - default = []; + default = [ ]; example = [ "eth0" ]; - description = - lib.mdDoc '' - The interfaces for which to perform NAT. Packets coming from - these interface and destined for the external interface will - be rewritten. - ''; + description = lib.mdDoc '' + The interfaces for which to perform NAT. Packets coming from + these interface and destined for the external interface will + be rewritten. + ''; }; networking.nat.internalIPs = mkOption { type = types.listOf types.str; - default = []; + default = [ ]; example = [ "192.168.1.0/24" ]; - description = - lib.mdDoc '' - The IP address ranges for which to perform NAT. Packets - coming from these addresses (on any interface) and destined - for the external interface will be rewritten. - ''; + description = lib.mdDoc '' + The IP address ranges for which to perform NAT. Packets + coming from these addresses (on any interface) and destined + for the external interface will be rewritten. + ''; }; networking.nat.internalIPv6s = mkOption { type = types.listOf types.str; - default = []; + default = [ ]; example = [ "fc00::/64" ]; - description = - lib.mdDoc '' - The IPv6 address ranges for which to perform NAT. Packets - coming from these addresses (on any interface) and destined - for the external interface will be rewritten. - ''; + description = lib.mdDoc '' + The IPv6 address ranges for which to perform NAT. Packets + coming from these addresses (on any interface) and destined + for the external interface will be rewritten. + ''; }; networking.nat.externalInterface = mkOption { type = types.nullOr types.str; default = null; example = "eth1"; - description = - lib.mdDoc '' - The name of the external network interface. - ''; + description = lib.mdDoc '' + The name of the external network interface. + ''; }; networking.nat.externalIP = mkOption { type = types.nullOr types.str; default = null; example = "203.0.113.123"; - description = - lib.mdDoc '' - The public IP address to which packets from the local - network are to be rewritten. If this is left empty, the - IP address associated with the external interface will be - used. - ''; + description = lib.mdDoc '' + The public IP address to which packets from the local + network are to be rewritten. If this is left empty, the + IP address associated with the external interface will be + used. + ''; }; networking.nat.externalIPv6 = mkOption { type = types.nullOr types.str; default = null; example = "2001:dc0:2001:11::175"; - description = - lib.mdDoc '' - The public IPv6 address to which packets from the local - network are to be rewritten. If this is left empty, the - IP address associated with the external interface will be - used. - ''; + description = lib.mdDoc '' + The public IPv6 address to which packets from the local + network are to be rewritten. If this is left empty, the + IP address associated with the external interface will be + used. + ''; }; networking.nat.forwardPorts = mkOption { @@ -246,122 +122,75 @@ in loopbackIPs = mkOption { type = types.listOf types.str; - default = []; + default = [ ]; example = literalExpression ''[ "55.1.2.3" ]''; description = lib.mdDoc "Public IPs for NAT reflection; for connections to `loopbackip:sourcePort' from the host itself and from other hosts behind NAT"; }; }; }); - default = []; + default = [ ]; example = [ { sourcePort = 8080; destination = "10.0.0.1:80"; proto = "tcp"; } { sourcePort = 8080; destination = "[fc00::2]:80"; proto = "tcp"; } ]; - description = - lib.mdDoc '' - List of forwarded ports from the external interface to - internal destinations by using DNAT. Destination can be - IPv6 if IPv6 NAT is enabled. - ''; + description = lib.mdDoc '' + List of forwarded ports from the external interface to + internal destinations by using DNAT. Destination can be + IPv6 if IPv6 NAT is enabled. + ''; }; networking.nat.dmzHost = mkOption { type = types.nullOr types.str; default = null; example = "10.0.0.1"; - description = - lib.mdDoc '' - The local IP address to which all traffic that does not match any - forwarding rule is forwarded. - ''; - }; - - networking.nat.extraCommands = mkOption { - type = types.lines; - default = ""; - example = "iptables -A INPUT -p icmp -j ACCEPT"; - description = - lib.mdDoc '' - Additional shell commands executed as part of the nat - initialisation script. - ''; - }; - - networking.nat.extraStopCommands = mkOption { - type = types.lines; - default = ""; - example = "iptables -D INPUT -p icmp -j ACCEPT || true"; - description = - lib.mdDoc '' - Additional shell commands executed as part of the nat - teardown script. - ''; + description = lib.mdDoc '' + The local IP address to which all traffic that does not match any + forwarding rule is forwarded. + ''; }; }; - ###### implementation - - config = mkMerge [ - { networking.firewall.extraCommands = mkBefore flushNat; } - (mkIf config.networking.nat.enable { - - assertions = [ - { assertion = cfg.enableIPv6 -> config.networking.enableIPv6; - message = "networking.nat.enableIPv6 requires networking.enableIPv6"; - } - { assertion = (cfg.dmzHost != null) -> (cfg.externalInterface != null); - message = "networking.nat.dmzHost requires networking.nat.externalInterface"; - } - { assertion = (cfg.forwardPorts != []) -> (cfg.externalInterface != null); - message = "networking.nat.forwardPorts requires networking.nat.externalInterface"; - } - ]; - - # Use the same iptables package as in config.networking.firewall. - # When the firewall is enabled, this should be deduplicated without any - # error. - environment.systemPackages = [ config.networking.firewall.package ]; - - boot = { - kernelModules = [ "nf_nat_ftp" ]; - kernel.sysctl = { - "net.ipv4.conf.all.forwarding" = mkOverride 99 true; - "net.ipv4.conf.default.forwarding" = mkOverride 99 true; - } // optionalAttrs cfg.enableIPv6 { - # Do not prevent IPv6 autoconfiguration. - # See <http://strugglers.net/~andy/blog/2011/09/04/linux-ipv6-router-advertisements-and-forwarding/>. - "net.ipv6.conf.all.accept_ra" = mkOverride 99 2; - "net.ipv6.conf.default.accept_ra" = mkOverride 99 2; - - # Forward IPv6 packets. - "net.ipv6.conf.all.forwarding" = mkOverride 99 true; - "net.ipv6.conf.default.forwarding" = mkOverride 99 true; - }; - }; - - networking.firewall = mkIf config.networking.firewall.enable { - extraCommands = setupNat; - extraStopCommands = flushNat; + config = mkIf config.networking.nat.enable { + + assertions = [ + { + assertion = cfg.enableIPv6 -> config.networking.enableIPv6; + message = "networking.nat.enableIPv6 requires networking.enableIPv6"; + } + { + assertion = (cfg.dmzHost != null) -> (cfg.externalInterface != null); + message = "networking.nat.dmzHost requires networking.nat.externalInterface"; + } + { + assertion = (cfg.forwardPorts != [ ]) -> (cfg.externalInterface != null); + message = "networking.nat.forwardPorts requires networking.nat.externalInterface"; + } + ]; + + # Use the same iptables package as in config.networking.firewall. + # When the firewall is enabled, this should be deduplicated without any + # error. + environment.systemPackages = [ config.networking.firewall.package ]; + + boot = { + kernelModules = [ "nf_nat_ftp" ]; + kernel.sysctl = { + "net.ipv4.conf.all.forwarding" = mkOverride 99 true; + "net.ipv4.conf.default.forwarding" = mkOverride 99 true; + } // optionalAttrs cfg.enableIPv6 { + # Do not prevent IPv6 autoconfiguration. + # See <http://strugglers.net/~andy/blog/2011/09/04/linux-ipv6-router-advertisements-and-forwarding/>. + "net.ipv6.conf.all.accept_ra" = mkOverride 99 2; + "net.ipv6.conf.default.accept_ra" = mkOverride 99 2; + + # Forward IPv6 packets. + "net.ipv6.conf.all.forwarding" = mkOverride 99 true; + "net.ipv6.conf.default.forwarding" = mkOverride 99 true; }; + }; - systemd.services = mkIf (!config.networking.firewall.enable) { nat = { - description = "Network Address Translation"; - wantedBy = [ "network.target" ]; - after = [ "network-pre.target" "systemd-modules-load.service" ]; - path = [ config.networking.firewall.package ]; - unitConfig.ConditionCapability = "CAP_NET_ADMIN"; - - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - }; - - script = flushNat + setupNat; - - postStop = flushNat; - }; }; - }) - ]; + }; } diff --git a/nixos/modules/services/networking/ncdns.nix b/nixos/modules/services/networking/ncdns.nix index 1d494332095f..cc97beb14e01 100644 --- a/nixos/modules/services/networking/ncdns.nix +++ b/nixos/modules/services/networking/ncdns.nix @@ -85,7 +85,7 @@ in ``` bit. IN NS ns1.example.com. ``` - If unset ncdns will generate an internal psuedo-hostname under the + If unset ncdns will generate an internal pseudo-hostname under the zone, which will resolve to the value of {option}`services.ncdns.identity.address`. If you are only using ncdns locally you can ignore this. diff --git a/nixos/modules/services/networking/ndppd.nix b/nixos/modules/services/networking/ndppd.nix index 6cbc9712be31..98c58d2d5db1 100644 --- a/nixos/modules/services/networking/ndppd.nix +++ b/nixos/modules/services/networking/ndppd.nix @@ -43,7 +43,7 @@ let timeout = mkOption { type = types.int; description = lib.mdDoc '' - Controls how long to wait for a Neighbor Advertisment Message before + Controls how long to wait for a Neighbor Advertisement Message before invalidating the entry, in milliseconds. ''; default = 500; @@ -74,7 +74,7 @@ let type = types.nullOr types.str; description = lib.mdDoc '' This is the target address is to match against. If no netmask - is provided, /128 is assumed. The addresses of serveral rules + is provided, /128 is assumed. The addresses of several rules may or may not overlap. Defaults to the name of the attrset. ''; diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix index d2d7543e8cf3..bd13e8c9929a 100644 --- a/nixos/modules/services/networking/nftables.nix +++ b/nixos/modules/services/networking/nftables.nix @@ -12,11 +12,9 @@ in default = false; description = lib.mdDoc '' - Whether to enable nftables. nftables is a Linux-based packet - filtering framework intended to replace frameworks like iptables. - - This conflicts with the standard networking firewall, so make sure to - disable it before using nftables. + Whether to enable nftables and use nftables based firewall if enabled. + nftables is a Linux-based packet filtering framework intended to + replace frameworks like iptables. Note that if you have Docker enabled you will not be able to use nftables without intervention. Docker uses iptables internally to @@ -37,7 +35,7 @@ in # Check out https://wiki.nftables.org/ for better documentation. # Table for both IPv4 and IPv6. table inet filter { - # Block all incomming connections traffic except SSH and "ping". + # Block all incoming connections traffic except SSH and "ping". chain input { type filter hook input priority 0; @@ -79,19 +77,17 @@ in lib.mdDoc '' The ruleset to be used with nftables. Should be in a format that can be loaded using "/bin/nft -f". The ruleset is updated atomically. + This option conflicts with rulesetFile. ''; }; networking.nftables.rulesetFile = mkOption { - type = types.path; - default = pkgs.writeTextFile { - name = "nftables-rules"; - text = cfg.ruleset; - }; - defaultText = literalMD ''a file with the contents of {option}`networking.nftables.ruleset`''; + type = types.nullOr types.path; + default = null; description = lib.mdDoc '' The ruleset file to be used with nftables. Should be in a format that can be loaded using "nft -f". The ruleset is updated atomically. + This option conflicts with ruleset and nftables based firewall. ''; }; }; @@ -99,10 +95,6 @@ in ###### implementation config = mkIf cfg.enable { - assertions = [{ - assertion = config.networking.firewall.enable == false; - message = "You can not use nftables and iptables at the same time. networking.firewall.enable must be set to false."; - }]; boot.blacklistedKernelModules = [ "ip_tables" ]; environment.systemPackages = [ pkgs.nftables ]; networking.networkmanager.firewallBackend = mkDefault "nftables"; @@ -116,7 +108,9 @@ in rulesScript = pkgs.writeScript "nftables-rules" '' #! ${pkgs.nftables}/bin/nft -f flush ruleset - include "${cfg.rulesetFile}" + ${if cfg.rulesetFile != null then '' + include "${cfg.rulesetFile}" + '' else cfg.ruleset} ''; in { Type = "oneshot"; diff --git a/nixos/modules/services/networking/nsd.nix b/nixos/modules/services/networking/nsd.nix index 0ded92652093..09f3bdc7ae07 100644 --- a/nixos/modules/services/networking/nsd.nix +++ b/nixos/modules/services/networking/nsd.nix @@ -371,7 +371,7 @@ let default = null; example = "2000::1@1234"; description = lib.mdDoc '' - This address will be used for zone-transfere requests if configured + This address will be used for zone-transfer requests if configured as a secondary server or notifications in case of a primary server. Supply either a plain IPv4 or IPv6 address with an optional port number (ip@port). diff --git a/nixos/modules/services/networking/ostinato.nix b/nixos/modules/services/networking/ostinato.nix index 40c227ea0c68..dc07313ea901 100644 --- a/nixos/modules/services/networking/ostinato.nix +++ b/nixos/modules/services/networking/ostinato.nix @@ -54,7 +54,7 @@ in default = "0.0.0.0"; description = lib.mdDoc '' By default, the Drone RPC server will listen on all interfaces and - local IPv4 adresses for incoming connections from clients. Specify + local IPv4 addresses for incoming connections from clients. Specify a single IPv4 or IPv6 address if you want to restrict that. To listen on any IPv6 address, use :: ''; diff --git a/nixos/modules/services/networking/pixiecore.nix b/nixos/modules/services/networking/pixiecore.nix index ea4008d4d515..f410be471646 100644 --- a/nixos/modules/services/networking/pixiecore.nix +++ b/nixos/modules/services/networking/pixiecore.nix @@ -23,7 +23,7 @@ in mode = mkOption { description = lib.mdDoc "Which mode to use"; default = "boot"; - type = types.enum [ "api" "boot" ]; + type = types.enum [ "api" "boot" "quick" ]; }; debug = mkOption { @@ -38,6 +38,12 @@ in description = lib.mdDoc "Handle DHCP traffic without binding to the DHCP server port"; }; + quick = mkOption { + description = lib.mdDoc "Which quick option to use"; + default = "xyz"; + type = types.enum [ "arch" "centos" "coreos" "debian" "fedora" "ubuntu" "xyz" ]; + }; + kernel = mkOption { type = types.str or types.path; default = ""; @@ -117,6 +123,8 @@ in then [ "boot" cfg.kernel ] ++ optional (cfg.initrd != "") cfg.initrd ++ optionals (cfg.cmdLine != "") [ "--cmdline" cfg.cmdLine ] + else if cfg.mode == "quick" + then [ "quick" cfg.quick ] else [ "api" cfg.apiServer ]; in '' diff --git a/nixos/modules/services/networking/pleroma.nix b/nixos/modules/services/networking/pleroma.nix index dfd1ed4036ab..f317510258ba 100644 --- a/nixos/modules/services/networking/pleroma.nix +++ b/nixos/modules/services/networking/pleroma.nix @@ -52,7 +52,7 @@ in { the right place to store any secret Have a look to Pleroma section in the NixOS manual for more - informations. + information. ''; }; @@ -141,6 +141,8 @@ in { NoNewPrivileges = true; CapabilityBoundingSet = "~CAP_SYS_ADMIN"; }; + # disksup requires bash + path = [ pkgs.bash ]; }; }; diff --git a/nixos/modules/services/networking/powerdns.nix b/nixos/modules/services/networking/powerdns.nix index 6aa5928d6370..850a128cf1a4 100644 --- a/nixos/modules/services/networking/powerdns.nix +++ b/nixos/modules/services/networking/powerdns.nix @@ -5,6 +5,7 @@ with lib; let cfg = config.services.powerdns; configDir = pkgs.writeTextDir "pdns.conf" "${cfg.extraConfig}"; + finalConfigDir = if cfg.secretFile == null then configDir else "/run/pdns"; in { options = { services.powerdns = { @@ -19,6 +20,19 @@ in { for details on supported values. ''; }; + + secretFile = mkOption { + type = types.nullOr types.path; + default = null; + example = "/run/keys/powerdns.env"; + description = lib.mdDoc '' + Environment variables from this file will be interpolated into the + final config file using envsubst with this syntax: `$ENVIRONMENT` + or `''${VARIABLE}`. + The file should contain lines formatted as `SECRET_VAR=SECRET_VALUE`. + This is useful to avoid putting secrets into the nix store. + ''; + }; }; }; @@ -31,7 +45,13 @@ in { after = [ "network.target" "mysql.service" "postgresql.service" "openldap.service" ]; serviceConfig = { - ExecStart = [ "" "${pkgs.pdns}/bin/pdns_server --config-dir=${configDir} --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no" ]; + EnvironmentFile = lib.optional (cfg.secretFile != null) cfg.secretFile; + ExecStartPre = lib.optional (cfg.secretFile != null) + (pkgs.writeShellScript "pdns-pre-start" '' + umask 077 + ${pkgs.envsubst}/bin/envsubst -i "${configDir}/pdns.conf" > ${finalConfigDir}/pdns.conf + ''); + ExecStart = [ "" "${pkgs.pdns}/bin/pdns_server --config-dir=${finalConfigDir} --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no" ]; }; }; diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix index 2d122bcf655a..342638f93bae 100644 --- a/nixos/modules/services/networking/prosody.nix +++ b/nixos/modules/services/networking/prosody.nix @@ -309,7 +309,7 @@ let type = types.int; default = 300; description = lib.mdDoc '' - Timout after which the room is destroyed or unlocked if not + Timeout after which the room is destroyed or unlocked if not configured, in seconds ''; }; @@ -489,7 +489,7 @@ in Setting this option to true will prevent you from building a NixOS configuration which won't comply with this standard. - You can explicitely decide to ignore this standard if you + You can explicitly decide to ignore this standard if you know what you are doing by setting this option to false. [1] https://xmpp.org/extensions/xep-0423.html @@ -649,7 +649,7 @@ in extraPluginPaths = mkOption { type = types.listOf types.path; default = []; - description = lib.mdDoc "Addtional path in which to look find plugins/modules"; + description = lib.mdDoc "Additional path in which to look find plugins/modules"; }; uploadHttp = mkOption { @@ -733,7 +733,7 @@ in Having a server not XEP-0423-compliant might make your XMPP experience terrible. See the NixOS manual for further - informations. + information. If you know what you're doing, you can disable this warning by setting config.services.prosody.xmppComplianceSuite to false. diff --git a/nixos/modules/services/networking/radicale.nix b/nixos/modules/services/networking/radicale.nix index a343dab7af25..9ec507fe2ab6 100644 --- a/nixos/modules/services/networking/radicale.nix +++ b/nixos/modules/services/networking/radicale.nix @@ -77,7 +77,7 @@ in { <https://radicale.org/3.0.html#documentation/authentication-and-rights>. This option only works in conjunction with {option}`settings`. Setting this will also set {option}`settings.rights.type` and - {option}`settings.rights.file` to approriate values. + {option}`settings.rights.file` to appropriate values. ''; default = { }; example = literalExpression '' diff --git a/nixos/modules/services/networking/resilio.nix b/nixos/modules/services/networking/resilio.nix index cc9495bf2383..7f6358d00d0b 100644 --- a/nixos/modules/services/networking/resilio.nix +++ b/nixos/modules/services/networking/resilio.nix @@ -52,17 +52,22 @@ let runConfigPath = "/run/rslsync/config.json"; - createConfig = pkgs.writeShellScriptBin "create-resilio-config" '' - ${pkgs.jq}/bin/jq \ - '.shared_folders |= map(.secret = $ARGS.named[.dir])' \ - ${ - lib.concatMapStringsSep " \\\n " - (entry: ''--arg '${entry.dir}' "$(cat '${entry.secretFile}')"'') - sharedFoldersSecretFiles - } \ - <${configFile} \ - >${runConfigPath} - ''; + createConfig = pkgs.writeShellScriptBin "create-resilio-config" ( + if cfg.sharedFolders != [ ] then '' + ${pkgs.jq}/bin/jq \ + '.shared_folders |= map(.secret = $ARGS.named[.dir])' \ + ${ + lib.concatMapStringsSep " \\\n " + (entry: ''--arg '${entry.dir}' "$(cat '${entry.secretFile}')"'') + sharedFoldersSecretFiles + } \ + <${configFile} \ + >${runConfigPath} + '' else '' + # no secrets, passing through config + cp ${configFile} ${runConfigPath}; + '' + ); in { diff --git a/nixos/modules/services/networking/rpcbind.nix b/nixos/modules/services/networking/rpcbind.nix index aa04214debb0..60e78dfec51b 100644 --- a/nixos/modules/services/networking/rpcbind.nix +++ b/nixos/modules/services/networking/rpcbind.nix @@ -35,6 +35,16 @@ with lib; systemd.services.rpcbind = { wantedBy = [ "multi-user.target" ]; + # rpcbind performs a check for /var/run/rpcbind.lock at startup + # and will crash if /var/run isn't present. In the stock NixOS + # var.conf tmpfiles configuration file, /var/run is symlinked to + # /run, so rpcbind can enter a race condition in which /var/run + # isn't symlinked yet but tries to interact with the path, so + # controlling the order explicitly here ensures that rpcbind can + # start successfully. The `wants` instead of `requires` should + # avoid creating a strict/brittle dependency. + wants = [ "systemd-tmpfiles-setup.service" ]; + after = [ "systemd-tmpfiles-setup.service" ]; }; users.users.rpc = { diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix index 214b6c6a787a..6c57ddbde2d4 100644 --- a/nixos/modules/services/networking/searx.nix +++ b/nixos/modules/services/networking/searx.nix @@ -124,7 +124,7 @@ in description = lib.mdDoc '' Whether to run searx in uWSGI as a "vassal", instead of using its built-in HTTP server. This is the recommended mode for public or - large instances, but is unecessary for LAN or local-only use. + large instances, but is unnecessary for LAN or local-only use. ::: {.warning} The built-in HTTP server logs all queries by default. @@ -223,7 +223,7 @@ in module = "searx.webapp"; env = [ "SEARX_SETTINGS_PATH=${cfg.settingsFile}" - # searxng compatiblity https://github.com/searxng/searxng/issues/1519 + # searxng compatibility https://github.com/searxng/searxng/issues/1519 "SEARXNG_SETTINGS_PATH=${cfg.settingsFile}" ]; buffer-size = 32768; diff --git a/nixos/modules/services/networking/stunnel.nix b/nixos/modules/services/networking/stunnel.nix index 3bd0367a0bb1..4f592fb312d3 100644 --- a/nixos/modules/services/networking/stunnel.nix +++ b/nixos/modules/services/networking/stunnel.nix @@ -78,7 +78,7 @@ in servers = mkOption { description = lib.mdDoc '' - Define the server configuations. + Define the server configurations. See "SERVICE-LEVEL OPTIONS" in {manpage}`stunnel(8)`. ''; diff --git a/nixos/modules/services/networking/supplicant.nix b/nixos/modules/services/networking/supplicant.nix index 0a48e73932e8..13d84736e2c2 100644 --- a/nixos/modules/services/networking/supplicant.nix +++ b/nixos/modules/services/networking/supplicant.nix @@ -13,7 +13,7 @@ let serviceName = iface: "supplicant-${if (iface=="WLAN") then "wlan@" else ( if (iface=="LAN") then "lan@" else ( if (iface=="DBUS") then "dbus" - else (replaceChars [" "] ["-"] iface)))}"; + else (replaceStrings [" "] ["-"] iface)))}"; # TODO: Use proper privilege separation for wpa_supplicant supplicantService = iface: suppl: @@ -27,7 +27,7 @@ let driverArg = optionalString (suppl.driver != null) "-D${suppl.driver}"; bridgeArg = optionalString (suppl.bridge!="") "-b${suppl.bridge}"; confFileArg = optionalString (suppl.configFile.path!=null) "-c${suppl.configFile.path}"; - extraConfFile = pkgs.writeText "supplicant-extra-conf-${replaceChars [" "] ["-"] iface}" '' + extraConfFile = pkgs.writeText "supplicant-extra-conf-${replaceStrings [" "] ["-"] iface}" '' ${optionalString suppl.userControlled.enable "ctrl_interface=DIR=${suppl.userControlled.socketDir} GROUP=${suppl.userControlled.group}"} ${optionalString suppl.configFile.writable "update_config=1"} ${suppl.extraConf} @@ -223,7 +223,7 @@ in text = '' ${flip (concatMapStringsSep "\n") (filter (n: n!="WLAN" && n!="LAN" && n!="DBUS") (attrNames cfg)) (iface: flip (concatMapStringsSep "\n") (splitString " " iface) (i: '' - ACTION=="add", SUBSYSTEM=="net", ENV{INTERFACE}=="${i}", TAG+="systemd", ENV{SYSTEMD_WANTS}+="supplicant-${replaceChars [" "] ["-"] iface}.service", TAG+="SUPPLICANT_ASSIGNED"''))} + ACTION=="add", SUBSYSTEM=="net", ENV{INTERFACE}=="${i}", TAG+="systemd", ENV{SYSTEMD_WANTS}+="supplicant-${replaceStrings [" "] ["-"] iface}.service", TAG+="SUPPLICANT_ASSIGNED"''))} ${optionalString (hasAttr "WLAN" cfg) '' ACTION=="add", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", TAG!="SUPPLICANT_ASSIGNED", TAG+="systemd", PROGRAM="/run/current-system/systemd/bin/systemd-escape -p %E{INTERFACE}", ENV{SYSTEMD_WANTS}+="supplicant-wlan@$result.service" diff --git a/nixos/modules/services/networking/tailscale.nix b/nixos/modules/services/networking/tailscale.nix index 26997dd96013..233bfdf9ebf5 100644 --- a/nixos/modules/services/networking/tailscale.nix +++ b/nixos/modules/services/networking/tailscale.nix @@ -4,10 +4,7 @@ with lib; let cfg = config.services.tailscale; - firewallOn = config.networking.firewall.enable; - rpfMode = config.networking.firewall.checkReversePath; isNetworkd = config.networking.useNetworkd; - rpfIsStrict = rpfMode == true || rpfMode == "strict"; in { meta.maintainers = with maintainers; [ danderson mbaillie twitchyliquid64 ]; @@ -38,14 +35,23 @@ in { defaultText = literalExpression "pkgs.tailscale"; description = lib.mdDoc "The package to use for tailscale"; }; + + useRoutingFeatures = mkOption { + type = types.enum [ "none" "client" "server" "both" ]; + default = "none"; + example = "server"; + description = lib.mdDoc '' + Enables settings required for Tailscale's routing features like subnet routers and exit nodes. + + To use these these features, you will still need to call `sudo tailscale up` with the relevant flags like `--advertise-exit-node` and `--exit-node`. + + When set to `client` or `both`, reverse path filtering will be set to loose instead of strict. + When set to `server` or `both`, IP forwarding will be enabled. + ''; + }; }; config = mkIf cfg.enable { - warnings = optional (firewallOn && rpfIsStrict) '' - Strict reverse path filtering breaks Tailscale exit node use and some subnet routing setups. Consider setting: - - networking.firewall.checkReversePath = "loose"; - ''; environment.systemPackages = [ cfg.package ]; # for the CLI systemd.packages = [ cfg.package ]; systemd.services.tailscaled = { @@ -75,6 +81,13 @@ in { stopIfChanged = false; }; + boot.kernel.sysctl = mkIf (cfg.useRoutingFeatures == "server" || cfg.useRoutingFeatures == "both") { + "net.ipv4.conf.all.forwarding" = mkDefault true; + "net.ipv6.conf.all.forwarding" = mkDefault true; + }; + + networking.firewall.checkReversePath = mkIf (cfg.useRoutingFeatures == "client" || cfg.useRoutingFeatures == "both") "loose"; + networking.dhcpcd.denyInterfaces = [ cfg.interfaceName ]; systemd.network.networks."50-tailscale" = mkIf isNetworkd { diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix index 09b23a60a4af..7db83e6a584b 100644 --- a/nixos/modules/services/networking/tinc.nix +++ b/nixos/modules/services/networking/tinc.nix @@ -349,91 +349,94 @@ in ###### implementation - config = mkIf (cfg.networks != { }) { - - environment.etc = foldr (a: b: a // b) { } - (flip mapAttrsToList cfg.networks (network: data: - flip mapAttrs' data.hosts (host: text: nameValuePair - ("tinc/${network}/hosts/${host}") - ({ mode = "0644"; user = "tinc.${network}"; inherit text; }) - ) // { - "tinc/${network}/tinc.conf" = { - mode = "0444"; - text = '' - ${toTincConf ({ Interface = "tinc.${network}"; } // data.settings)} - ${data.extraConfig} - ''; + config = mkIf (cfg.networks != { }) ( + let + etcConfig = foldr (a: b: a // b) { } + (flip mapAttrsToList cfg.networks (network: data: + flip mapAttrs' data.hosts (host: text: nameValuePair + ("tinc/${network}/hosts/${host}") + ({ mode = "0644"; user = "tinc.${network}"; inherit text; }) + ) // { + "tinc/${network}/tinc.conf" = { + mode = "0444"; + text = '' + ${toTincConf ({ Interface = "tinc.${network}"; } // data.settings)} + ${data.extraConfig} + ''; + }; + } + )); + in { + environment.etc = etcConfig; + + systemd.services = flip mapAttrs' cfg.networks (network: data: nameValuePair + ("tinc.${network}") + (let version = getVersion data.package; in { + description = "Tinc Daemon - ${network}"; + wantedBy = [ "multi-user.target" ]; + path = [ data.package ]; + reloadTriggers = mkIf (versionAtLeast version "1.1pre") [ (builtins.toJSON etcConfig) ]; + restartTriggers = mkIf (versionOlder version "1.1pre") [ (builtins.toJSON etcConfig) ]; + serviceConfig = { + Type = "simple"; + Restart = "always"; + RestartSec = "3"; + ExecReload = mkIf (versionAtLeast version "1.1pre") "${data.package}/bin/tinc -n ${network} reload"; + ExecStart = "${data.package}/bin/tincd -D -U tinc.${network} -n ${network} ${optionalString (data.chroot) "-R"} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}"; }; - } - )); - - systemd.services = flip mapAttrs' cfg.networks (network: data: nameValuePair - ("tinc.${network}") - ({ - description = "Tinc Daemon - ${network}"; - wantedBy = [ "multi-user.target" ]; - path = [ data.package ]; - restartTriggers = [ config.environment.etc."tinc/${network}/tinc.conf".source ]; - serviceConfig = { - Type = "simple"; - Restart = "always"; - RestartSec = "3"; - ExecReload = mkIf (versionAtLeast (getVersion data.package) "1.1pre") "${data.package}/bin/tinc -n ${network} reload"; - ExecStart = "${data.package}/bin/tincd -D -U tinc.${network} -n ${network} ${optionalString (data.chroot) "-R"} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}"; + preStart = '' + mkdir -p /etc/tinc/${network}/hosts + chown tinc.${network} /etc/tinc/${network}/hosts + mkdir -p /etc/tinc/${network}/invitations + chown tinc.${network} /etc/tinc/${network}/invitations + + # Determine how we should generate our keys + if type tinc >/dev/null 2>&1; then + # Tinc 1.1+ uses the tinc helper application for key generation + ${if data.ed25519PrivateKeyFile != null then " # ed25519 Keyfile managed by nix" else '' + # Prefer ED25519 keys (only in 1.1+) + [ -f "/etc/tinc/${network}/ed25519_key.priv" ] || tinc -n ${network} generate-ed25519-keys + ''} + ${if data.rsaPrivateKeyFile != null then " # RSA Keyfile managed by nix" else '' + [ -f "/etc/tinc/${network}/rsa_key.priv" ] || tinc -n ${network} generate-rsa-keys 4096 + ''} + # In case there isn't anything to do + true + else + # Tinc 1.0 uses the tincd application + [ -f "/etc/tinc/${network}/rsa_key.priv" ] || tincd -n ${network} -K 4096 + fi + ''; + }) + ); + + environment.systemPackages = let + cli-wrappers = pkgs.stdenv.mkDerivation { + name = "tinc-cli-wrappers"; + nativeBuildInputs = [ pkgs.makeWrapper ]; + buildCommand = '' + mkdir -p $out/bin + ${concatStringsSep "\n" (mapAttrsToList (network: data: + optionalString (versionAtLeast data.package.version "1.1pre") '' + makeWrapper ${data.package}/bin/tinc "$out/bin/tinc.${network}" \ + --add-flags "--pidfile=/run/tinc.${network}.pid" \ + --add-flags "--config=/etc/tinc/${network}" + '') cfg.networks)} + ''; }; - preStart = '' - mkdir -p /etc/tinc/${network}/hosts - chown tinc.${network} /etc/tinc/${network}/hosts - mkdir -p /etc/tinc/${network}/invitations - chown tinc.${network} /etc/tinc/${network}/invitations - - # Determine how we should generate our keys - if type tinc >/dev/null 2>&1; then - # Tinc 1.1+ uses the tinc helper application for key generation - ${if data.ed25519PrivateKeyFile != null then " # ed25519 Keyfile managed by nix" else '' - # Prefer ED25519 keys (only in 1.1+) - [ -f "/etc/tinc/${network}/ed25519_key.priv" ] || tinc -n ${network} generate-ed25519-keys - ''} - ${if data.rsaPrivateKeyFile != null then " # RSA Keyfile managed by nix" else '' - [ -f "/etc/tinc/${network}/rsa_key.priv" ] || tinc -n ${network} generate-rsa-keys 4096 - ''} - # In case there isn't anything to do - true - else - # Tinc 1.0 uses the tincd application - [ -f "/etc/tinc/${network}/rsa_key.priv" ] || tincd -n ${network} -K 4096 - fi - ''; - }) - ); - - environment.systemPackages = let - cli-wrappers = pkgs.stdenv.mkDerivation { - name = "tinc-cli-wrappers"; - nativeBuildInputs = [ pkgs.makeWrapper ]; - buildCommand = '' - mkdir -p $out/bin - ${concatStringsSep "\n" (mapAttrsToList (network: data: - optionalString (versionAtLeast data.package.version "1.1pre") '' - makeWrapper ${data.package}/bin/tinc "$out/bin/tinc.${network}" \ - --add-flags "--pidfile=/run/tinc.${network}.pid" \ - --add-flags "--config=/etc/tinc/${network}" - '') cfg.networks)} - ''; - }; - in [ cli-wrappers ]; - - users.users = flip mapAttrs' cfg.networks (network: _: - nameValuePair ("tinc.${network}") ({ - description = "Tinc daemon user for ${network}"; - isSystemUser = true; - group = "tinc.${network}"; - }) - ); - users.groups = flip mapAttrs' cfg.networks (network: _: - nameValuePair "tinc.${network}" {} - ); - }; + in [ cli-wrappers ]; + + users.users = flip mapAttrs' cfg.networks (network: _: + nameValuePair ("tinc.${network}") ({ + description = "Tinc daemon user for ${network}"; + isSystemUser = true; + group = "tinc.${network}"; + }) + ); + users.groups = flip mapAttrs' cfg.networks (network: _: + nameValuePair "tinc.${network}" {} + ); + }); meta.maintainers = with maintainers; [ minijackson mic92 ]; } diff --git a/nixos/modules/services/networking/tox-node.nix b/nixos/modules/services/networking/tox-node.nix index fa5b241f9183..884fd55dae51 100644 --- a/nixos/modules/services/networking/tox-node.nix +++ b/nixos/modules/services/networking/tox-node.nix @@ -8,7 +8,7 @@ let homeDir = "/var/lib/tox-node"; configFile = let - src = "${pkg.src}/dpkg/config.yml"; + src = "${pkg.src}/tox_node/dpkg/config.yml"; confJSON = pkgs.writeText "config.json" ( builtins.toJSON { log-type = cfg.logType; diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index fa24c70e63de..c85dd03867f7 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -245,7 +245,7 @@ in { NotifyAccess = "main"; Type = "notify"; - # FIXME: Which of these do we actualy need, can we drop the chroot flag? + # FIXME: Which of these do we actually need, can we drop the chroot flag? AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_NET_RAW" diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix index d30f7c89633b..d220aa9fbbe4 100644 --- a/nixos/modules/services/networking/unifi.nix +++ b/nixos/modules/services/networking/unifi.nix @@ -24,8 +24,8 @@ in services.unifi.jrePackage = mkOption { type = types.package; - default = pkgs.jre8; - defaultText = literalExpression "pkgs.jre8"; + default = if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.3") then pkgs.jdk11 else pkgs.jre8; + defaultText = literalExpression ''if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.3" then pkgs.jdk11 else pkgs.jre8''; description = lib.mdDoc '' The JRE package to use. Check the release notes to ensure it is supported. ''; @@ -76,7 +76,7 @@ in default = null; example = 4096; description = lib.mdDoc '' - Set the maximimum heap size for the JVM in MB. If this option isn't set, the + Set the maximum heap size for the JVM in MB. If this option isn't set, the JVM will decide this value at runtime. ''; }; diff --git a/nixos/modules/services/networking/v2raya.nix b/nixos/modules/services/networking/v2raya.nix new file mode 100644 index 000000000000..2d697b4fb56f --- /dev/null +++ b/nixos/modules/services/networking/v2raya.nix @@ -0,0 +1,39 @@ +{ config, pkgs, lib, ... }: + +with lib; + +{ + options = { + services.v2raya = { + enable = options.mkEnableOption (mdDoc "the v2rayA service"); + }; + }; + + config = mkIf config.services.v2raya.enable { + environment.systemPackages = [ pkgs.v2raya ]; + + systemd.services.v2raya = { + unitConfig = { + Description = "v2rayA service"; + Documentation = "https://github.com/v2rayA/v2rayA/wiki"; + After = [ "network.target" "nss-lookup.target" "iptables.service" "ip6tables.service" ]; + Wants = [ "network.target" ]; + }; + + serviceConfig = { + User = "root"; + ExecStart = "${getExe pkgs.v2raya} --log-disable-timestamp"; + Environment = [ "V2RAYA_LOG_FILE=/var/log/v2raya/v2raya.log" ]; + LimitNPROC = 500; + LimitNOFILE = 1000000; + Restart = "on-failure"; + Type = "simple"; + }; + + wantedBy = [ "multi-user.target" ]; + path = with pkgs; [ iptables bash iproute2 ]; # required by v2rayA TProxy functionality + }; + }; + + meta.maintainers = with maintainers; [ elliot ]; +} diff --git a/nixos/modules/services/networking/vsftpd.nix b/nixos/modules/services/networking/vsftpd.nix index 5fee7b66a4dc..b1f0f7403243 100644 --- a/nixos/modules/services/networking/vsftpd.nix +++ b/nixos/modules/services/networking/vsftpd.nix @@ -168,7 +168,7 @@ in The default is a file containing the users from {option}`userlist`. - If explicitely set to null userlist_file will not be set in vsftpd's config file. + If explicitly set to null userlist_file will not be set in vsftpd's config file. ''; }; diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix index ce5616672c16..1d6556f626be 100644 --- a/nixos/modules/services/networking/wireguard.nix +++ b/nixos/modules/services/networking/wireguard.nix @@ -303,7 +303,7 @@ let set -e # If the parent dir does not already exist, create it. - # Otherwise, does nothing, keeping existing permisions intact. + # Otherwise, does nothing, keeping existing permissions intact. mkdir -p --mode 0755 "${dirOf values.privateKeyFile}" if [ ! -f "${values.privateKeyFile}" ]; then @@ -315,7 +315,7 @@ let peerUnitServiceName = interfaceName: publicKey: dynamicRefreshEnabled: let - keyToUnitName = replaceChars + keyToUnitName = replaceStrings [ "/" "-" " " "+" "=" ] [ "-" "\\x2d" "\\x20" "\\x2b" "\\x3d" ]; unitName = keyToUnitName publicKey; diff --git a/nixos/modules/services/networking/yggdrasil.xml b/nixos/modules/services/networking/yggdrasil.xml index bc9da84fa431..a7b8c469529a 100644 --- a/nixos/modules/services/networking/yggdrasil.xml +++ b/nixos/modules/services/networking/yggdrasil.xml @@ -30,7 +30,7 @@ An annotated example of a simple configuration: settings = { Peers = [ # Yggdrasil will automatically connect and "peer" with other nodes it - # discovers via link-local multicast annoucements. Unless this is the + # discovers via link-local multicast announcements. Unless this is the # case (it probably isn't) a node needs peers within the existing # network that it can tunnel to. "tcp://1.2.3.4:1024" @@ -78,7 +78,7 @@ in { }]; services.radvd = { - # Annouce the 300::/8 prefix to eth0. + # Announce the 300::/8 prefix to eth0. enable = true; config = '' interface eth0 diff --git a/nixos/modules/services/printing/cups-pdf.nix b/nixos/modules/services/printing/cups-pdf.nix new file mode 100644 index 000000000000..07f24367132f --- /dev/null +++ b/nixos/modules/services/printing/cups-pdf.nix @@ -0,0 +1,185 @@ +{ config, lib, pkgs, ... }: + +let + + # cups calls its backends as user `lp` (which is good!), + # but cups-pdf wants to be called as `root`, so it can change ownership of files. + # We add a suid wrapper and a wrapper script to trick cups into calling the suid wrapper. + # Note that a symlink to the suid wrapper alone wouldn't suffice, cups would complain + # > File "/nix/store/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-cups-progs/lib/cups/backend/cups-pdf" has insecure permissions (0104554/uid=0/gid=20) + + # wrapper script that redirects calls to the suid wrapper + cups-pdf-wrapper = pkgs.writeTextFile { + name = "${pkgs.cups-pdf-to-pdf.name}-wrapper.sh"; + executable = true; + destination = "/lib/cups/backend/cups-pdf"; + checkPhase = '' + ${pkgs.stdenv.shellDryRun} "$target" + ${lib.getExe pkgs.shellcheck} "$target" + ''; + text = '' + #! ${pkgs.runtimeShell} + exec "${config.security.wrapperDir}/cups-pdf" "$@" + ''; + }; + + # wrapped cups-pdf package that uses the suid wrapper + cups-pdf-wrapped = pkgs.buildEnv { + name = "${pkgs.cups-pdf-to-pdf.name}-wrapped"; + # using the wrapper as first path ensures it is used + paths = [ cups-pdf-wrapper pkgs.cups-pdf-to-pdf ]; + ignoreCollisions = true; + }; + + instanceSettings = name: { + freeformType = with lib.types; nullOr (oneOf [ int str path package ]); + # override defaults: + # inject instance name into paths, + # also avoid conflicts between user names and special dirs + options.Out = lib.mkOption { + type = with lib.types; nullOr singleLineStr; + default = "/var/spool/cups-pdf-${name}/users/\${USER}"; + defaultText = "/var/spool/cups-pdf-{instance-name}/users/\${USER}"; + example = "\${HOME}/cups-pdf"; + description = lib.mdDoc '' + output directory; + `''${HOME}` will be expanded to the user's home directory, + `''${USER}` will be expanded to the user name. + ''; + }; + options.AnonDirName = lib.mkOption { + type = with lib.types; nullOr singleLineStr; + default = "/var/spool/cups-pdf-${name}/anonymous"; + defaultText = "/var/spool/cups-pdf-{instance-name}/anonymous"; + example = "/var/lib/cups-pdf"; + description = lib.mdDoc "path for anonymously created PDF files"; + }; + options.Spool = lib.mkOption { + type = with lib.types; nullOr singleLineStr; + default = "/var/spool/cups-pdf-${name}/spool"; + defaultText = "/var/spool/cups-pdf-{instance-name}/spool"; + example = "/var/lib/cups-pdf"; + description = lib.mdDoc "spool directory"; + }; + options.Anonuser = lib.mkOption { + type = lib.types.singleLineStr; + default = "root"; + description = lib.mdDoc '' + User for anonymous PDF creation. + An empty string disables this feature. + ''; + }; + options.GhostScript = lib.mkOption { + type = with lib.types; nullOr path; + default = lib.getExe pkgs.ghostscript; + defaultText = lib.literalExpression "lib.getExe pkgs.ghostscript"; + example = lib.literalExpression ''''${pkgs.ghostscript}/bin/ps2pdf''; + description = lib.mdDoc "location of GhostScript binary"; + }; + }; + + instanceConfig = { name, config, ... }: { + options = { + enable = (lib.mkEnableOption (lib.mdDoc "this cups-pdf instance")) // { default = true; }; + installPrinter = (lib.mkEnableOption (lib.mdDoc '' + a CUPS printer queue for this instance. + The queue will be named after the instance and will use the {file}`CUPS-PDF_opt.ppd` ppd file. + If this is disabled, you need to add the queue yourself to use the instance + '')) // { default = true; }; + confFileText = lib.mkOption { + type = lib.types.lines; + description = lib.mdDoc '' + This will contain the contents of {file}`cups-pdf.conf` for this instance, derived from {option}`settings`. + You can use this option to append text to the file. + ''; + }; + settings = lib.mkOption { + type = lib.types.submodule (instanceSettings name); + default = {}; + example = { + Out = "\${HOME}/cups-pdf"; + UserUMask = "0033"; + }; + description = lib.mdDoc '' + Settings for a cups-pdf instance, see the descriptions in the template config file in the cups-pdf package. + The key value pairs declared here will be translated into proper key value pairs for {file}`cups-pdf.conf`. + Setting a value to `null` disables the option and removes it from the file. + ''; + }; + }; + config.confFileText = lib.pipe config.settings [ + (lib.filterAttrs (key: value: value != null)) + (lib.mapAttrs (key: builtins.toString)) + (lib.mapAttrsToList (key: value: "${key} ${value}\n")) + lib.concatStrings + ]; + }; + + cupsPdfCfg = config.services.printing.cups-pdf; + + copyConfigFileCmds = lib.pipe cupsPdfCfg.instances [ + (lib.filterAttrs (name: lib.getAttr "enable")) + (lib.mapAttrs (name: lib.getAttr "confFileText")) + (lib.mapAttrs (name: pkgs.writeText "cups-pdf-${name}.conf")) + (lib.mapAttrsToList (name: confFile: "ln --symbolic --no-target-directory ${confFile} /var/lib/cups/cups-pdf-${name}.conf\n")) + lib.concatStrings + ]; + + printerSettings = lib.pipe cupsPdfCfg.instances [ + (lib.filterAttrs (name: lib.getAttr "enable")) + (lib.filterAttrs (name: lib.getAttr "installPrinter")) + (lib.mapAttrsToList (name: instance: (lib.mapAttrs (key: lib.mkDefault) { + inherit name; + model = "CUPS-PDF_opt.ppd"; + deviceUri = "cups-pdf:/${name}"; + description = "virtual printer for cups-pdf instance ${name}"; + location = instance.settings.Out; + }))) + ]; + +in + +{ + + options.services.printing.cups-pdf = { + enable = lib.mkEnableOption (lib.mdDoc '' + the cups-pdf virtual pdf printer backend. + By default, this will install a single printer `pdf`. + but this can be changed/extended with {option}`services.printing.cups-pdf.instances` + ''); + instances = lib.mkOption { + type = lib.types.attrsOf (lib.types.submodule instanceConfig); + default.pdf = {}; + example.pdf.settings = { + Out = "\${HOME}/cups-pdf"; + UserUMask = "0033"; + }; + description = lib.mdDoc '' + Permits to raise one or more cups-pdf instances. + Each instance is named by an attribute name, and the attribute's values control the instance' configuration. + ''; + }; + }; + + config = lib.mkIf cupsPdfCfg.enable { + services.printing.enable = true; + services.printing.drivers = [ cups-pdf-wrapped ]; + hardware.printers.ensurePrinters = printerSettings; + # the cups module will install the default config file, + # but we don't need it and it would confuse cups-pdf + systemd.services.cups.preStart = lib.mkAfter '' + rm -f /var/lib/cups/cups-pdf.conf + ${copyConfigFileCmds} + ''; + security.wrappers.cups-pdf = { + group = "lp"; + owner = "root"; + permissions = "+r,ug+x"; + setuid = true; + source = "${pkgs.cups-pdf-to-pdf}/lib/cups/backend/cups-pdf"; + }; + }; + + meta.maintainers = [ lib.maintainers.yarny ]; + +} diff --git a/nixos/modules/services/printing/ipp-usb.nix b/nixos/modules/services/printing/ipp-usb.nix index 0425eb913731..8ed2ff826871 100644 --- a/nixos/modules/services/printing/ipp-usb.nix +++ b/nixos/modules/services/printing/ipp-usb.nix @@ -7,7 +7,7 @@ config = lib.mkIf config.services.ipp-usb.enable { systemd.services.ipp-usb = { description = "Daemon for IPP over USB printer support"; - after = [ "cups.service" "avahi-deamon.service" ]; + after = [ "cups.service" "avahi-daemon.service" ]; wants = [ "avahi-daemon.service" ]; serviceConfig = { ExecStart = [ "${pkgs.ipp-usb}/bin/ipp-usb" ]; diff --git a/nixos/modules/services/security/aesmd.nix b/nixos/modules/services/security/aesmd.nix index 7b0a46d6d029..8b3f010d7c4d 100644 --- a/nixos/modules/services/security/aesmd.nix +++ b/nixos/modules/services/security/aesmd.nix @@ -25,6 +25,22 @@ in default = false; description = lib.mdDoc "Whether to build the PSW package in debug mode."; }; + environment = mkOption { + type = with types; attrsOf str; + default = { }; + description = mdDoc "Additional environment variables to pass to the AESM service."; + # Example environment variable for `sgx-azure-dcap-client` provider library + example = { + AZDCAP_COLLATERAL_VERSION = "v2"; + AZDCAP_DEBUG_LOG_LEVEL = "INFO"; + }; + }; + quoteProviderLibrary = mkOption { + type = with types; nullOr path; + default = null; + example = literalExpression "pkgs.sgx-azure-dcap-client"; + description = lib.mdDoc "Custom quote provider library to use."; + }; settings = mkOption { description = lib.mdDoc "AESM configuration"; default = { }; @@ -83,7 +99,6 @@ in storeAesmFolder = "${sgx-psw}/aesm"; # Hardcoded path AESM_DATA_FOLDER in psw/ae/aesm_service/source/oal/linux/aesm_util.cpp aesmDataFolder = "/var/opt/aesmd/data"; - aesmStateDirSystemd = "%S/aesmd"; in { description = "Intel Architectural Enclave Service Manager"; @@ -98,8 +113,8 @@ in environment = { NAME = "aesm_service"; AESM_PATH = storeAesmFolder; - LD_LIBRARY_PATH = storeAesmFolder; - }; + LD_LIBRARY_PATH = makeLibraryPath [ cfg.quoteProviderLibrary ]; + } // cfg.environment; # Make sure any of the SGX application enclave devices is available unitConfig.AssertPathExists = [ diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix index e208eed008ae..3b124a4f0e08 100644 --- a/nixos/modules/services/security/fail2ban.nix +++ b/nixos/modules/services/security/fail2ban.nix @@ -161,7 +161,7 @@ in type = types.str; example = "2 4 16 128"; description = lib.mdDoc '' - "bantime-increment.multipliers" used to calculate next value of ban time instead of formula, coresponding + "bantime-increment.multipliers" used to calculate next value of ban time instead of formula, corresponding previously ban count and given "bantime.factor" (for multipliers default is 1); following example grows ban time by 1, 2, 4, 8, 16 ... and if last ban count greater as multipliers count, always used last multiplier (64 in example), for factor '1' and original ban time 600 - 10.6 hours @@ -174,7 +174,7 @@ in example = true; description = lib.mdDoc '' "bantime-increment.overalljails" (if true) specifies the search of IP in the database will be executed - cross over all jails, if false (dafault), only current jail of the ban IP will be searched + cross over all jails, if false (default), only current jail of the ban IP will be searched ''; }; diff --git a/nixos/modules/services/security/shibboleth-sp.nix b/nixos/modules/services/security/shibboleth-sp.nix index 6626ea213625..e7897c3324cf 100644 --- a/nixos/modules/services/security/shibboleth-sp.nix +++ b/nixos/modules/services/security/shibboleth-sp.nix @@ -27,13 +27,13 @@ in { fastcgi.shibAuthorizerPort = mkOption { type = types.int; default = 9100; - description = lib.mdDoc "Port for shibauthorizer FastCGI proccess to bind to"; + description = lib.mdDoc "Port for shibauthorizer FastCGI process to bind to"; }; fastcgi.shibResponderPort = mkOption { type = types.int; default = 9101; - description = lib.mdDoc "Port for shibauthorizer FastCGI proccess to bind to"; + description = lib.mdDoc "Port for shibauthorizer FastCGI process to bind to"; }; }; }; diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix index b85b78f269a1..2aa2964f8818 100644 --- a/nixos/modules/services/security/tor.nix +++ b/nixos/modules/services/security/tor.nix @@ -146,7 +146,7 @@ let ]))]; description = lib.mdDoc (descriptionGeneric optionName); }; - optionBandwith = optionName: mkOption { + optionBandwidth = optionName: mkOption { type = with types; nullOr (either int str); default = null; description = lib.mdDoc (descriptionGeneric optionName); @@ -205,7 +205,7 @@ in (mkRemovedOptionModule [ "services" "tor" "client" "transparentProxy" "isolationOptions" ] "Use services.tor.settings.TransPort instead.") (mkRemovedOptionModule [ "services" "tor" "client" "transparentProxy" "listenAddress" ] "Use services.tor.settings.TransPort instead.") (mkRenamedOptionModule [ "services" "tor" "controlPort" ] [ "services" "tor" "settings" "ControlPort" ]) - (mkRemovedOptionModule [ "services" "tor" "extraConfig" ] "Plese use services.tor.settings instead.") + (mkRemovedOptionModule [ "services" "tor" "extraConfig" ] "Please use services.tor.settings instead.") (mkRenamedOptionModule [ "services" "tor" "hiddenServices" ] [ "services" "tor" "relay" "onionServices" ]) (mkRenamedOptionModule [ "services" "tor" "relay" "accountingMax" ] [ "services" "tor" "settings" "AccountingMax" ]) (mkRenamedOptionModule [ "services" "tor" "relay" "accountingStart" ] [ "services" "tor" "settings" "AccountingStart" ]) @@ -546,7 +546,7 @@ in }; options.Address = optionString "Address"; options.AssumeReachable = optionBool "AssumeReachable"; - options.AccountingMax = optionBandwith "AccountingMax"; + options.AccountingMax = optionBandwidth "AccountingMax"; options.AccountingStart = optionString "AccountingStart"; options.AuthDirHasIPv6Connectivity = optionBool "AuthDirHasIPv6Connectivity"; options.AuthDirListBadExits = optionBool "AuthDirListBadExits"; @@ -559,8 +559,8 @@ in default = [".onion" ".exit"]; example = [".onion"]; }; - options.BandwidthBurst = optionBandwith "BandwidthBurst"; - options.BandwidthRate = optionBandwith "BandwidthRate"; + options.BandwidthBurst = optionBandwidth "BandwidthBurst"; + options.BandwidthRate = optionBandwidth "BandwidthRate"; options.BridgeAuthoritativeDir = optionBool "BridgeAuthoritativeDir"; options.BridgeRecordUsageByCountry = optionBool "BridgeRecordUsageByCountry"; options.BridgeRelay = optionBool "BridgeRelay" // { default = false; }; @@ -709,7 +709,7 @@ in options.LogMessageDomains = optionBool "LogMessageDomains"; options.LongLivedPorts = optionPorts "LongLivedPorts"; options.MainloopStats = optionBool "MainloopStats"; - options.MaxAdvertisedBandwidth = optionBandwith "MaxAdvertisedBandwidth"; + options.MaxAdvertisedBandwidth = optionBandwidth "MaxAdvertisedBandwidth"; options.MaxCircuitDirtiness = optionInt "MaxCircuitDirtiness"; options.MaxClientCircuitsPending = optionInt "MaxClientCircuitsPending"; options.NATDPort = optionIsolablePorts "NATDPort"; @@ -719,8 +719,8 @@ in options.OfflineMasterKey = optionBool "OfflineMasterKey"; options.OptimisticData = optionBool "OptimisticData"; # default is null and like "auto" options.PaddingStatistics = optionBool "PaddingStatistics"; - options.PerConnBWBurst = optionBandwith "PerConnBWBurst"; - options.PerConnBWRate = optionBandwith "PerConnBWRate"; + options.PerConnBWBurst = optionBandwidth "PerConnBWBurst"; + options.PerConnBWRate = optionBandwidth "PerConnBWRate"; options.PidFile = optionPath "PidFile"; options.ProtocolWarnings = optionBool "ProtocolWarnings"; options.PublishHidServDescriptors = optionBool "PublishHidServDescriptors"; @@ -732,8 +732,8 @@ in options.ReducedExitPolicy = optionBool "ReducedExitPolicy"; options.RefuseUnknownExits = optionBool "RefuseUnknownExits"; # default is null and like "auto" options.RejectPlaintextPorts = optionPorts "RejectPlaintextPorts"; - options.RelayBandwidthBurst = optionBandwith "RelayBandwidthBurst"; - options.RelayBandwidthRate = optionBandwith "RelayBandwidthRate"; + options.RelayBandwidthBurst = optionBandwidth "RelayBandwidthBurst"; + options.RelayBandwidthRate = optionBandwidth "RelayBandwidthRate"; #options.RunAsDaemon options.Sandbox = optionBool "Sandbox"; options.ServerDNSAllowBrokenConfig = optionBool "ServerDNSAllowBrokenConfig"; diff --git a/nixos/modules/services/security/usbguard.nix b/nixos/modules/services/security/usbguard.nix index 1b1fa84c4fa3..1d846b194077 100644 --- a/nixos/modules/services/security/usbguard.nix +++ b/nixos/modules/services/security/usbguard.nix @@ -118,9 +118,9 @@ in description = lib.mdDoc '' The USBGuard daemon modifies some attributes of controller devices like the default authorization state of new child device - instances. Using this setting, you can controll whether the daemon + instances. Using this setting, you can control whether the daemon will try to restore the attribute values to the state before - modificaton on shutdown. + modification on shutdown. ''; }; diff --git a/nixos/modules/services/security/vaultwarden/default.nix b/nixos/modules/services/security/vaultwarden/default.nix index 3ef0bfb090ac..aaa3f5507f77 100644 --- a/nixos/modules/services/security/vaultwarden/default.nix +++ b/nixos/modules/services/security/vaultwarden/default.nix @@ -162,8 +162,8 @@ in { webVaultPackage = mkOption { type = package; - default = pkgs.vaultwarden-vault; - defaultText = literalExpression "pkgs.vaultwarden-vault"; + default = pkgs.vaultwarden.webvault; + defaultText = literalExpression "pkgs.vaultwarden.webvault"; description = lib.mdDoc "Web vault package to use."; }; }; diff --git a/nixos/modules/services/system/cachix-agent/default.nix b/nixos/modules/services/system/cachix-agent/default.nix index aa3b2153422c..11769d4e3095 100644 --- a/nixos/modules/services/system/cachix-agent/default.nix +++ b/nixos/modules/services/system/cachix-agent/default.nix @@ -67,7 +67,8 @@ in { serviceConfig = { # we don't want to kill children processes as those are deployments KillMode = "process"; - Restart = "on-failure"; + Restart = "always"; + RestartSec = 5; EnvironmentFile = cfg.credentialsFile; ExecStart = '' ${cfg.package}/bin/cachix ${lib.optionalString cfg.verbose "--verbose"} ${lib.optionalString (cfg.host != null) "--host ${cfg.host}"} \ diff --git a/nixos/modules/services/system/cloud-init.nix b/nixos/modules/services/system/cloud-init.nix index 30b2ca568e12..d75070dea434 100644 --- a/nixos/modules/services/system/cloud-init.nix +++ b/nixos/modules/services/system/cloud-init.nix @@ -27,7 +27,7 @@ in This configuration is not completely compatible with the NixOS way of doing configuration, as configuration done by - cloud-init might be overriden by a subsequent nixos-rebuild + cloud-init might be overridden by a subsequent nixos-rebuild call. However, some parts of cloud-init fall outside of NixOS's responsibility, like filesystem resizing and ssh public key provisioning, and cloud-init is useful for that diff --git a/nixos/modules/services/system/kerberos/default.nix b/nixos/modules/services/system/kerberos/default.nix index 0c9e44a45c15..4ed48e463741 100644 --- a/nixos/modules/services/system/kerberos/default.nix +++ b/nixos/modules/services/system/kerberos/default.nix @@ -51,7 +51,7 @@ in ###### interface options = { services.kerberos_server = { - enable = lib.mkEnableOption (lib.mdDoc "the kerberos authentification server"); + enable = lib.mkEnableOption (lib.mdDoc "the kerberos authentication server"); realms = mkOption { type = types.attrsOf (types.submodule realm); diff --git a/nixos/modules/services/torrent/deluge.nix b/nixos/modules/services/torrent/deluge.nix index 70fad4d7d76c..de3d077daec9 100644 --- a/nixos/modules/services/torrent/deluge.nix +++ b/nixos/modules/services/torrent/deluge.nix @@ -66,7 +66,7 @@ in { `true`. String values must be quoted, integer and boolean values must not. See <https://git.deluge-torrent.org/deluge/tree/deluge/core/preferencesmanager.py#n41> - for the availaible options. + for the available options. ''; }; @@ -117,7 +117,7 @@ in { when {option}`services.deluge.declarative` is set to `true`. See <https://dev.deluge-torrent.org/wiki/UserGuide/Authentication> for - more informations. + more information. ''; }; diff --git a/nixos/modules/services/torrent/magnetico.nix b/nixos/modules/services/torrent/magnetico.nix index b681c58dfe2a..b813f1205119 100644 --- a/nixos/modules/services/torrent/magnetico.nix +++ b/nixos/modules/services/torrent/magnetico.nix @@ -143,7 +143,7 @@ in { The path to the file holding the credentials to access the web interface. If unset no authentication will be required. - The file must constain user names and password hashes in the format + The file must contain user names and password hashes in the format `username:hash `, one for each line. Usernames must start with a lowecase ([a-z]) ASCII character, might contain non-consecutive underscores except at the end, and consists of diff --git a/nixos/modules/services/torrent/rtorrent.nix b/nixos/modules/services/torrent/rtorrent.nix index 935c11e3eb00..627439e1079b 100644 --- a/nixos/modules/services/torrent/rtorrent.nix +++ b/nixos/modules/services/torrent/rtorrent.nix @@ -82,7 +82,7 @@ in { type = types.lines; default = ""; description = lib.mdDoc '' - The content of {file}`rtorrent.rc`. The [modernized configuration template](https://rtorrent-docs.readthedocs.io/en/latest/cookbook.html#modernized-configuration-template) with the values specified in this module will be prepended using mkBefore. You can use mkForce to overwrite the config completly. + The content of {file}`rtorrent.rc`. The [modernized configuration template](https://rtorrent-docs.readthedocs.io/en/latest/cookbook.html#modernized-configuration-template) with the values specified in this module will be prepended using mkBefore. You can use mkForce to overwrite the config completely. ''; }; }; diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix index 9b53f5de143d..437823384833 100644 --- a/nixos/modules/services/torrent/transmission.nix +++ b/nixos/modules/services/torrent/transmission.nix @@ -44,7 +44,7 @@ in (each time the service starts). See [Transmission's Wiki](https://github.com/transmission/transmission/wiki/Editing-Configuration-Files) - for documentation of settings not explicitely covered by this module. + for documentation of settings not explicitly covered by this module. ''; default = {}; type = types.submodule { @@ -174,6 +174,8 @@ in }; }; + package = mkPackageOption pkgs "transmission" {}; + downloadDirPermissions = mkOption { type = with types; nullOr str; default = null; @@ -287,7 +289,7 @@ in install -D -m 600 -o '${cfg.user}' -g '${cfg.group}' /dev/stdin \ '${cfg.home}/${settingsDir}/settings.json' '')]; - ExecStart="${pkgs.transmission}/bin/transmission-daemon -f -g ${cfg.home}/${settingsDir} ${escapeShellArgs cfg.extraFlags}"; + ExecStart="${cfg.package}/bin/transmission-daemon -f -g ${cfg.home}/${settingsDir} ${escapeShellArgs cfg.extraFlags}"; ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; User = cfg.user; Group = cfg.group; @@ -353,7 +355,7 @@ in PrivateUsers = true; ProtectClock = true; ProtectControlGroups = true; - # ProtectHome=true would not allow BindPaths= to work accross /home, + # ProtectHome=true would not allow BindPaths= to work across /home, # and ProtectHome=tmpfs would break statfs(), # preventing transmission-daemon to report the available free space. # However, RootDirectory= is used, so this is not a security concern @@ -385,7 +387,7 @@ in }; # It's useful to have transmission in path, e.g. for remote control - environment.systemPackages = [ pkgs.transmission ]; + environment.systemPackages = [ cfg.package ]; users.users = optionalAttrs (cfg.user == "transmission") ({ transmission = { @@ -457,7 +459,7 @@ in ]; security.apparmor.policies."bin.transmission-daemon".profile = '' - include "${pkgs.transmission.apparmor}/bin.transmission-daemon" + include "${cfg.package.apparmor}/bin.transmission-daemon" ''; security.apparmor.includes."local/bin.transmission-daemon" = '' r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE}, diff --git a/nixos/modules/services/video/unifi-video.nix b/nixos/modules/services/video/unifi-video.nix index 450e92dd9a37..93d4d5060b70 100644 --- a/nixos/modules/services/video/unifi-video.nix +++ b/nixos/modules/services/video/unifi-video.nix @@ -159,7 +159,7 @@ in default = 1024; example = 4096; description = lib.mdDoc '' - Set the maximimum heap size for the JVM in MB. + Set the maximum heap size for the JVM in MB. ''; }; diff --git a/nixos/modules/services/web-apps/akkoma.md b/nixos/modules/services/web-apps/akkoma.md new file mode 100644 index 000000000000..fc849be0c872 --- /dev/null +++ b/nixos/modules/services/web-apps/akkoma.md @@ -0,0 +1,332 @@ +# Akkoma {#module-services-akkoma} + +[Akkoma](https://akkoma.dev/) is a lightweight ActivityPub microblogging server forked from Pleroma. + +## Service configuration {#modules-services-akkoma-service-configuration} + +The Elixir configuration file required by Akkoma is generated automatically from +[{option}`services.akkoma.config`](options.html#opt-services.akkoma.config). Secrets must be +included from external files outside of the Nix store by setting the configuration option to +an attribute set containing the attribute {option}`_secret` – a string pointing to the file +containing the actual value of the option. + +For the mandatory configuration settings these secrets will be generated automatically if the +referenced file does not exist during startup, unless disabled through +[{option}`services.akkoma.initSecrets`](options.html#opt-services.akkoma.initSecrets). + +The following configuration binds Akkoma to the Unix socket `/run/akkoma/socket`, expecting to +be run behind a HTTP proxy on `fediverse.example.com`. + + +```nix +services.akkoma.enable = true; +services.akkoma.config = { + ":pleroma" = { + ":instance" = { + name = "My Akkoma instance"; + description = "More detailed description"; + email = "admin@example.com"; + registration_open = false; + }; + + "Pleroma.Web.Endpoint" = { + url.host = "fediverse.example.com"; + }; + }; +}; +``` + +Please refer to the [configuration cheat sheet](https://docs.akkoma.dev/stable/configuration/cheatsheet/) +for additional configuration options. + +## User management {#modules-services-akkoma-user-management} + +After the Akkoma service is running, the administration utility can be used to +[manage users](https://docs.akkoma.dev/stable/administration/CLI_tasks/user/). In particular an +administrative user can be created with + +```ShellSession +$ pleroma_ctl user new <nickname> <email> --admin --moderator --password <password> +``` + +## Proxy configuration {#modules-services-akkoma-proxy-configuration} + +Although it is possible to expose Akkoma directly, it is common practice to operate it behind an +HTTP reverse proxy such as nginx. + +```nix +services.akkoma.nginx = { + enableACME = true; + forceSSL = true; +}; + +services.nginx = { + enable = true; + + clientMaxBodySize = "16m"; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; +}; +``` + +Please refer to [](#module-security-acme) for details on how to provision an SSL/TLS certificate. + +### Media proxy {#modules-services-akkoma-media-proxy} + +Without the media proxy function, Akkoma does not store any remote media like pictures or video +locally, and clients have to fetch them directly from the source server. + +```nix +# Enable nginx slice module distributed with Tengine +services.nginx.package = pkgs.tengine; + +# Enable media proxy +services.akkoma.config.":pleroma".":media_proxy" = { + enabled = true; + proxy_opts.redirect_on_failure = true; +}; + +# Adjust the persistent cache size as needed: +# Assuming an average object size of 128 KiB, around 1 MiB +# of memory is required for the key zone per GiB of cache. +# Ensure that the cache directory exists and is writable by nginx. +services.nginx.commonHttpConfig = '' + proxy_cache_path /var/cache/nginx/cache/akkoma-media-cache + levels= keys_zone=akkoma_media_cache:16m max_size=16g + inactive=1y use_temp_path=off; +''; + +services.akkoma.nginx = { + locations."/proxy" = { + proxyPass = "http://unix:/run/akkoma/socket"; + + extraConfig = '' + proxy_cache akkoma_media_cache; + + # Cache objects in slices of 1 MiB + slice 1m; + proxy_cache_key $host$uri$is_args$args$slice_range; + proxy_set_header Range $slice_range; + + # Decouple proxy and upstream responses + proxy_buffering on; + proxy_cache_lock on; + proxy_ignore_client_abort on; + + # Default cache times for various responses + proxy_cache_valid 200 1y; + proxy_cache_valid 206 301 304 1h; + + # Allow serving of stale items + proxy_cache_use_stale error timeout invalid_header updating; + ''; + }; +}; +``` + +#### Prefetch remote media {#modules-services-akkoma-prefetch-remote-media} + +The following example enables the `MediaProxyWarmingPolicy` MRF policy which automatically +fetches all media associated with a post through the media proxy, as soon as the post is +received by the instance. + +```nix +services.akkoma.config.":pleroma".":mrf".policies = + map (pkgs.formats.elixirConf { }).lib.mkRaw [ + "Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy" +]; +``` + +#### Media previews {#modules-services-akkoma-media-previews} + +Akkoma can generate previews for media. + +```nix +services.akkoma.config.":pleroma".":media_preview_proxy" = { + enabled = true; + thumbnail_max_width = 1920; + thumbnail_max_height = 1080; +}; +``` + +## Frontend management {#modules-services-akkoma-frontend-management} + +Akkoma will be deployed with the `pleroma-fe` and `admin-fe` frontends by default. These can be +modified by setting +[{option}`services.akkoma.frontends`](options.html#opt-services.akkoma.frontends). + +The following example overrides the primary frontend’s default configuration using a custom +derivation. + +```nix +services.akkoma.frontends.primary.package = pkgs.runCommand "pleroma-fe" { + config = builtins.toJSON { + expertLevel = 1; + collapseMessageWithSubject = false; + stopGifs = false; + replyVisibility = "following"; + webPushHideIfCW = true; + hideScopeNotice = true; + renderMisskeyMarkdown = false; + hideSiteFavicon = true; + postContentType = "text/markdown"; + showNavShortcuts = false; + }; + nativeBuildInputs = with pkgs; [ jq xorg.lndir ]; + passAsFile = [ "config" ]; +} '' + mkdir $out + lndir ${pkgs.akkoma-frontends.pleroma-fe} $out + + rm $out/static/config.json + jq -s add ${pkgs.akkoma-frontends.pleroma-fe}/static/config.json ${config} \ + >$out/static/config.json +''; +``` + +## Federation policies {#modules-services-akkoma-federation-policies} + +Akkoma comes with a number of modules to police federation with other ActivityPub instances. +The most valuable for typical users is the +[`:mrf_simple`](https://docs.akkoma.dev/stable/configuration/cheatsheet/#mrf_simple) module +which allows limiting federation based on instance hostnames. + +This configuration snippet provides an example on how these can be used. Choosing an adequate +federation policy is not trivial and entails finding a balance between connectivity to the rest +of the fediverse and providing a pleasant experience to the users of an instance. + + +```nix +services.akkoma.config.":pleroma" = with (pkgs.formats.elixirConf { }).lib; { + ":mrf".policies = map mkRaw [ + "Pleroma.Web.ActivityPub.MRF.SimplePolicy" + ]; + + ":mrf_simple" = { + # Tag all media as sensitive + media_nsfw = mkMap { + "nsfw.weird.kinky" = "Untagged NSFW content"; + }; + + # Reject all activities except deletes + reject = mkMap { + "kiwifarms.cc" = "Persistent harassment of users, no moderation"; + }; + + # Force posts to be visible by followers only + followers_only = mkMap { + "beta.birdsite.live" = "Avoid polluting timelines with Twitter posts"; + }; + }; +}; +``` + +## Upload filters {#modules-services-akkoma-upload-filters} + +This example strips GPS and location metadata from uploads, deduplicates them and anonymises the +the file name. + +```nix +services.akkoma.config.":pleroma"."Pleroma.Upload".filters = + map (pkgs.formats.elixirConf { }).lib.mkRaw [ + "Pleroma.Upload.Filter.Exiftool" + "Pleroma.Upload.Filter.Dedupe" + "Pleroma.Upload.Filter.AnonymizeFilename" + ]; +``` + +## Migration from Pleroma {#modules-services-akkoma-migration-pleroma} + +Pleroma instances can be migrated to Akkoma either by copying the database and upload data or by +pointing Akkoma to the existing data. The necessary database migrations are run automatically +during startup of the service. + +The configuration has to be copy‐edited manually. + +Depending on the size of the database, the initial migration may take a long time and exceed the +startup timeout of the system manager. To work around this issue one may adjust the startup timeout +{option}`systemd.services.akkoma.serviceConfig.TimeoutStartSec` or simply run the migrations +manually: + +```ShellSession +pleroma_ctl migrate +``` + +### Copying data {#modules-services-akkoma-migration-pleroma-copy} + +Copying the Pleroma data instead of re‐using it in place may permit easier reversion to Pleroma, +but allows the two data sets to diverge. + +First disable Pleroma and then copy its database and upload data: + +```ShellSession +# Create a copy of the database +nix-shell -p postgresql --run 'createdb -T pleroma akkoma' + +# Copy upload data +mkdir /var/lib/akkoma +cp -R --reflink=auto /var/lib/pleroma/uploads /var/lib/akkoma/ +``` + +After the data has been copied, enable the Akkoma service and verify that the migration has been +successful. If no longer required, the original data may then be deleted: + +```ShellSession +# Delete original database +nix-shell -p postgresql --run 'dropdb pleroma' + +# Delete original Pleroma state +rm -r /var/lib/pleroma +``` + +### Re‐using data {#modules-services-akkoma-migration-pleroma-reuse} + +To re‐use the Pleroma data in place, disable Pleroma and enable Akkoma, pointing it to the +Pleroma database and upload directory. + +```nix +# Adjust these settings according to the database name and upload directory path used by Pleroma +services.akkoma.config.":pleroma"."Pleroma.Repo".database = "pleroma"; +services.akkoma.config.":pleroma".":instance".upload_dir = "/var/lib/pleroma/uploads"; +``` + +Please keep in mind that after the Akkoma service has been started, any migrations applied by +Akkoma have to be rolled back before the database can be used again with Pleroma. This can be +achieved through `pleroma_ctl ecto.rollback`. Refer to the +[Ecto SQL documentation](https://hexdocs.pm/ecto_sql/Mix.Tasks.Ecto.Rollback.html) for +details. + +## Advanced deployment options {#modules-services-akkoma-advanced-deployment} + +### Confinement {#modules-services-akkoma-confinement} + +The Akkoma systemd service may be confined to a chroot with + +```nix +services.systemd.akkoma.confinement.enable = true; +``` + +Confinement of services is not generally supported in NixOS and therefore disabled by default. +Depending on the Akkoma configuration, the default confinement settings may be insufficient and +lead to subtle errors at run time, requiring adjustment: + +Use +[{option}`services.systemd.akkoma.confinement.packages`](options.html#opt-systemd.services._name_.confinement.packages) +to make packages available in the chroot. + +{option}`services.systemd.akkoma.serviceConfig.BindPaths` and +{option}`services.systemd.akkoma.serviceConfig.BindReadOnlyPaths` permit access to outside paths +through bind mounts. Refer to +[{manpage}`systemd.exec(5)`](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#BindPaths=) +for details. + +### Distributed deployment {#modules-services-akkoma-distributed-deployment} + +Being an Elixir application, Akkoma can be deployed in a distributed fashion. + +This requires setting +[{option}`services.akkoma.dist.address`](options.html#opt-services.akkoma.dist.address) and +[{option}`services.akkoma.dist.cookie`](options.html#opt-services.akkoma.dist.cookie). The +specifics depend strongly on the deployment environment. For more information please check the +relevant [Erlang documentation](https://www.erlang.org/doc/reference_manual/distributed.html). diff --git a/nixos/modules/services/web-apps/akkoma.nix b/nixos/modules/services/web-apps/akkoma.nix new file mode 100644 index 000000000000..47ba53e42221 --- /dev/null +++ b/nixos/modules/services/web-apps/akkoma.nix @@ -0,0 +1,1086 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.services.akkoma; + ex = cfg.config; + db = ex.":pleroma"."Pleroma.Repo"; + web = ex.":pleroma"."Pleroma.Web.Endpoint"; + + isConfined = config.systemd.services.akkoma.confinement.enable; + hasSmtp = (attrByPath [ ":pleroma" "Pleroma.Emails.Mailer" "adapter" "value" ] null ex) == "Swoosh.Adapters.SMTP"; + + isAbsolutePath = v: isString v && substring 0 1 v == "/"; + isSecret = v: isAttrs v && v ? _secret && isAbsolutePath v._secret; + + absolutePath = with types; mkOptionType { + name = "absolutePath"; + description = "absolute path"; + descriptionClass = "noun"; + check = isAbsolutePath; + inherit (str) merge; + }; + + secret = mkOptionType { + name = "secret"; + description = "secret value"; + descriptionClass = "noun"; + check = isSecret; + nestedTypes = { + _secret = absolutePath; + }; + }; + + ipAddress = with types; mkOptionType { + name = "ipAddress"; + description = "IPv4 or IPv6 address"; + descriptionClass = "conjunction"; + check = x: str.check x && builtins.match "[.0-9:A-Fa-f]+" x != null; + inherit (str) merge; + }; + + elixirValue = let + elixirValue' = with types; + nullOr (oneOf [ bool int float str (attrsOf elixirValue') (listOf elixirValue') ]) // { + description = "Elixir value"; + }; + in elixirValue'; + + frontend = { + options = { + package = mkOption { + type = types.package; + description = mdDoc "Akkoma frontend package."; + example = literalExpression "pkgs.akkoma-frontends.pleroma-fe"; + }; + + name = mkOption { + type = types.nonEmptyStr; + description = mdDoc "Akkoma frontend name."; + example = "pleroma-fe"; + }; + + ref = mkOption { + type = types.nonEmptyStr; + description = mdDoc "Akkoma frontend reference."; + example = "stable"; + }; + }; + }; + + sha256 = builtins.hashString "sha256"; + + replaceSec = let + replaceSec' = { }@args: v: + if isAttrs v + then if v ? _secret + then if isAbsolutePath v._secret + then sha256 v._secret + else abort "Invalid secret path (_secret = ${v._secret})" + else mapAttrs (_: val: replaceSec' args val) v + else if isList v + then map (replaceSec' args) v + else v; + in replaceSec' { }; + + # Erlang/Elixir uses a somewhat special format for IP addresses + erlAddr = addr: fileContents + (pkgs.runCommand addr { + nativeBuildInputs = with pkgs; [ elixir ]; + code = '' + case :inet.parse_address('${addr}') do + {:ok, addr} -> IO.inspect addr + {:error, _} -> System.halt(65) + end + ''; + passAsFile = [ "code" ]; + } ''elixir "$codePath" >"$out"''); + + format = pkgs.formats.elixirConf { }; + configFile = format.generate "config.exs" + (replaceSec + (attrsets.updateManyAttrsByPath [{ + path = [ ":pleroma" "Pleroma.Web.Endpoint" "http" "ip" ]; + update = addr: + if isAbsolutePath addr + then format.lib.mkTuple + [ (format.lib.mkAtom ":local") addr ] + else format.lib.mkRaw (erlAddr addr); + }] cfg.config)); + + writeShell = { name, text, runtimeInputs ? [ ] }: + pkgs.writeShellApplication { inherit name text runtimeInputs; } + "/bin/${name}"; + + genScript = writeShell { + name = "akkoma-gen-cookie"; + runtimeInputs = with pkgs; [ coreutils util-linux ]; + text = '' + install -m 0400 \ + -o ${escapeShellArg cfg.user } \ + -g ${escapeShellArg cfg.group} \ + <(hexdump -n 16 -e '"%02x"' /dev/urandom) \ + "$RUNTIME_DIRECTORY/cookie" + ''; + }; + + copyScript = writeShell { + name = "akkoma-copy-cookie"; + runtimeInputs = with pkgs; [ coreutils ]; + text = '' + install -m 0400 \ + -o ${escapeShellArg cfg.user} \ + -g ${escapeShellArg cfg.group} \ + ${escapeShellArg cfg.dist.cookie._secret} \ + "$RUNTIME_DIRECTORY/cookie" + ''; + }; + + secretPaths = catAttrs "_secret" (collect isSecret cfg.config); + + vapidKeygen = pkgs.writeText "vapidKeygen.exs" '' + [public_path, private_path] = System.argv() + {public_key, private_key} = :crypto.generate_key :ecdh, :prime256v1 + File.write! public_path, Base.url_encode64(public_key, padding: false) + File.write! private_path, Base.url_encode64(private_key, padding: false) + ''; + + initSecretsScript = writeShell { + name = "akkoma-init-secrets"; + runtimeInputs = with pkgs; [ coreutils elixir ]; + text = let + key-base = web.secret_key_base; + jwt-signer = ex.":joken".":default_signer"; + signing-salt = web.signing_salt; + liveview-salt = web.live_view.signing_salt; + vapid-private = ex.":web_push_encryption".":vapid_details".private_key; + vapid-public = ex.":web_push_encryption".":vapid_details".public_key; + in '' + secret() { + # Generate default secret if non‐existent + test -e "$2" || install -D -m 0600 <(tr -dc 'A-Za-z-._~' </dev/urandom | head -c "$1") "$2" + if [ "$(stat --dereference --format='%s' "$2")" -lt "$1" ]; then + echo "Secret '$2' is smaller than minimum size of $1 bytes." >&2 + exit 65 + fi + } + + secret 64 ${escapeShellArg key-base._secret} + secret 64 ${escapeShellArg jwt-signer._secret} + secret 8 ${escapeShellArg signing-salt._secret} + secret 8 ${escapeShellArg liveview-salt._secret} + + ${optionalString (isSecret vapid-public) '' + { test -e ${escapeShellArg vapid-private._secret} && \ + test -e ${escapeShellArg vapid-public._secret}; } || \ + elixir ${escapeShellArgs [ vapidKeygen vapid-public._secret vapid-private._secret ]} + ''} + ''; + }; + + configScript = writeShell { + name = "akkoma-config"; + runtimeInputs = with pkgs; [ coreutils replace-secret ]; + text = '' + cd "$RUNTIME_DIRECTORY" + tmp="$(mktemp config.exs.XXXXXXXXXX)" + trap 'rm -f "$tmp"' EXIT TERM + + cat ${escapeShellArg configFile} >"$tmp" + ${concatMapStrings (file: '' + replace-secret ${escapeShellArgs [ (sha256 file) file ]} "$tmp" + '') secretPaths} + + chown ${escapeShellArg cfg.user}:${escapeShellArg cfg.group} "$tmp" + chmod 0400 "$tmp" + mv -f "$tmp" config.exs + ''; + }; + + pgpass = let + esc = escape [ ":" ''\'' ]; + in if (cfg.initDb.password != null) + then pkgs.writeText "pgpass.conf" '' + *:*:*${esc cfg.initDb.username}:${esc (sha256 cfg.initDb.password._secret)} + '' + else null; + + escapeSqlId = x: ''"${replaceStrings [ ''"'' ] [ ''""'' ] x}"''; + escapeSqlStr = x: "'${replaceStrings [ "'" ] [ "''" ] x}'"; + + setupSql = pkgs.writeText "setup.psql" '' + \set ON_ERROR_STOP on + + ALTER ROLE ${escapeSqlId db.username} + LOGIN PASSWORD ${if db ? password + then "${escapeSqlStr (sha256 db.password._secret)}" + else "NULL"}; + + ALTER DATABASE ${escapeSqlId db.database} + OWNER TO ${escapeSqlId db.username}; + + \connect ${escapeSqlId db.database} + CREATE EXTENSION IF NOT EXISTS citext; + CREATE EXTENSION IF NOT EXISTS pg_trgm; + CREATE EXTENSION IF NOT EXISTS "uuid-ossp"; + ''; + + dbHost = if db ? socket_dir then db.socket_dir + else if db ? socket then db.socket + else if db ? hostname then db.hostname + else null; + + initDbScript = writeShell { + name = "akkoma-initdb"; + runtimeInputs = with pkgs; [ coreutils replace-secret config.services.postgresql.package ]; + text = '' + pgpass="$(mktemp -t pgpass-XXXXXXXXXX.conf)" + setupSql="$(mktemp -t setup-XXXXXXXXXX.psql)" + trap 'rm -f "$pgpass $setupSql"' EXIT TERM + + ${optionalString (dbHost != null) '' + export PGHOST=${escapeShellArg dbHost} + ''} + export PGUSER=${escapeShellArg cfg.initDb.username} + ${optionalString (pgpass != null) '' + cat ${escapeShellArg pgpass} >"$pgpass" + replace-secret ${escapeShellArgs [ + (sha256 cfg.initDb.password._secret) cfg.initDb.password._secret ]} "$pgpass" + export PGPASSFILE="$pgpass" + ''} + + cat ${escapeShellArg setupSql} >"$setupSql" + ${optionalString (db ? password) '' + replace-secret ${escapeShellArgs [ + (sha256 db.password._secret) db.password._secret ]} "$setupSql" + ''} + + # Create role if non‐existent + psql -tAc "SELECT 1 FROM pg_roles + WHERE rolname = "${escapeShellArg (escapeSqlStr db.username)} | grep -F -q 1 || \ + psql -tAc "CREATE ROLE "${escapeShellArg (escapeSqlId db.username)} + + # Create database if non‐existent + psql -tAc "SELECT 1 FROM pg_database + WHERE datname = "${escapeShellArg (escapeSqlStr db.database)} | grep -F -q 1 || \ + psql -tAc "CREATE DATABASE "${escapeShellArg (escapeSqlId db.database)}" + OWNER "${escapeShellArg (escapeSqlId db.username)}" + TEMPLATE template0 + ENCODING 'utf8' + LOCALE 'C'" + + psql -f "$setupSql" + ''; + }; + + envWrapper = let + script = writeShell { + name = "akkoma-env"; + text = '' + cd "${cfg.package}" + + RUNTIME_DIRECTORY="''${RUNTIME_DIRECTORY:-/run/akkoma}" + AKKOMA_CONFIG_PATH="$RUNTIME_DIRECTORY/config.exs" \ + ERL_EPMD_ADDRESS="${cfg.dist.address}" \ + ERL_EPMD_PORT="${toString cfg.dist.epmdPort}" \ + ERL_FLAGS="${concatStringsSep " " [ + "-kernel inet_dist_use_interface '${erlAddr cfg.dist.address}'" + "-kernel inet_dist_listen_min ${toString cfg.dist.portMin}" + "-kernel inet_dist_listen_max ${toString cfg.dist.portMax}" + ]}" \ + RELEASE_COOKIE="$(<"$RUNTIME_DIRECTORY/cookie")" \ + RELEASE_NAME="akkoma" \ + exec "${cfg.package}/bin/$(basename "$0")" "$@" + ''; + }; + in pkgs.runCommandLocal "akkoma-env" { } '' + mkdir -p "$out/bin" + + ln -r -s ${escapeShellArg script} "$out/bin/pleroma" + ln -r -s ${escapeShellArg script} "$out/bin/pleroma_ctl" + ''; + + userWrapper = pkgs.writeShellApplication { + name = "pleroma_ctl"; + text = '' + if [ "''${1-}" == "update" ]; then + echo "OTP releases are not supported on NixOS." >&2 + exit 64 + fi + + exec sudo -u ${escapeShellArg cfg.user} \ + "${envWrapper}/bin/pleroma_ctl" "$@" + ''; + }; + + socketScript = if isAbsolutePath web.http.ip + then writeShell { + name = "akkoma-socket"; + runtimeInputs = with pkgs; [ coreutils inotify-tools ]; + text = '' + coproc { + inotifywait -q -m -e create ${escapeShellArg (dirOf web.http.ip)} + } + + trap 'kill "$COPROC_PID"' EXIT TERM + + until test -S ${escapeShellArg web.http.ip} + do read -r -u "''${COPROC[0]}" + done + + chmod 0666 ${escapeShellArg web.http.ip} + ''; + } + else null; + + staticDir = ex.":pleroma".":instance".static_dir; + uploadDir = ex.":pleroma".":instance".upload_dir; + + staticFiles = pkgs.runCommandLocal "akkoma-static" { } '' + ${concatStringsSep "\n" (mapAttrsToList (key: val: '' + mkdir -p $out/frontends/${escapeShellArg val.name}/ + ln -s ${escapeShellArg val.package} $out/frontends/${escapeShellArg val.name}/${escapeShellArg val.ref} + '') cfg.frontends)} + + ${optionalString (cfg.extraStatic != null) + (concatStringsSep "\n" (mapAttrsToList (key: val: '' + mkdir -p "$out/$(dirname ${escapeShellArg key})" + ln -s ${escapeShellArg val} $out/${escapeShellArg key} + '') cfg.extraStatic))} + ''; +in { + options = { + services.akkoma = { + enable = mkEnableOption (mdDoc "Akkoma"); + + package = mkOption { + type = types.package; + default = pkgs.akkoma; + defaultText = literalExpression "pkgs.akkoma"; + description = mdDoc "Akkoma package to use."; + }; + + user = mkOption { + type = types.nonEmptyStr; + default = "akkoma"; + description = mdDoc "User account under which Akkoma runs."; + }; + + group = mkOption { + type = types.nonEmptyStr; + default = "akkoma"; + description = mdDoc "Group account under which Akkoma runs."; + }; + + initDb = { + enable = mkOption { + type = types.bool; + default = true; + description = mdDoc '' + Whether to automatically initialise the database on startup. This will create a + database role and database if they do not already exist, and (re)set the role password + and the ownership of the database. + + This setting can be used safely even if the database already exists and contains data. + + The database settings are configured through + [{option}`config.services.akkoma.config.":pleroma"."Pleroma.Repo"`](#opt-services.akkoma.config.__pleroma_._Pleroma.Repo_). + + If disabled, the database has to be set up manually: + + ```SQL + CREATE ROLE akkoma LOGIN; + + CREATE DATABASE akkoma + OWNER akkoma + TEMPLATE template0 + ENCODING 'utf8' + LOCALE 'C'; + + \connect akkoma + CREATE EXTENSION IF NOT EXISTS citext; + CREATE EXTENSION IF NOT EXISTS pg_trgm; + CREATE EXTENSION IF NOT EXISTS "uuid-ossp"; + ``` + ''; + }; + + username = mkOption { + type = types.nonEmptyStr; + default = config.services.postgresql.superUser; + defaultText = literalExpression "config.services.postgresql.superUser"; + description = mdDoc '' + Name of the database user to initialise the database with. + + This user is required to have the `CREATEROLE` and `CREATEDB` capabilities. + ''; + }; + + password = mkOption { + type = types.nullOr secret; + default = null; + description = mdDoc '' + Password of the database user to initialise the database with. + + If set to `null`, no password will be used. + + The attribute `_secret` should point to a file containing the secret. + ''; + }; + }; + + initSecrets = mkOption { + type = types.bool; + default = true; + description = mdDoc '' + Whether to initialise non‐existent secrets with random values. + + If enabled, appropriate secrets for the following options will be created automatically + if the files referenced in the `_secrets` attribute do not exist during startup. + + - {option}`config.":pleroma"."Pleroma.Web.Endpoint".secret_key_base` + - {option}`config.":pleroma"."Pleroma.Web.Endpoint".signing_salt` + - {option}`config.":pleroma"."Pleroma.Web.Endpoint".live_view.signing_salt` + - {option}`config.":web_push_encryption".":vapid_details".private_key` + - {option}`config.":web_push_encryption".":vapid_details".public_key` + - {option}`config.":joken".":default_signer"` + ''; + }; + + installWrapper = mkOption { + type = types.bool; + default = true; + description = mdDoc '' + Whether to install a wrapper around `pleroma_ctl` to simplify administration of the + Akkoma instance. + ''; + }; + + extraPackages = mkOption { + type = with types; listOf package; + default = with pkgs; [ exiftool ffmpeg_5-headless graphicsmagick-imagemagick-compat ]; + defaultText = literalExpression "with pkgs; [ exiftool graphicsmagick-imagemagick-compat ffmpeg_5-headless ]"; + example = literalExpression "with pkgs; [ exiftool imagemagick ffmpeg_5-full ]"; + description = mdDoc '' + List of extra packages to include in the executable search path of the service unit. + These are needed by various configurable components such as: + + - ExifTool for the `Pleroma.Upload.Filter.Exiftool` upload filter, + - ImageMagick for still image previews in the media proxy as well as for the + `Pleroma.Upload.Filters.Mogrify` upload filter, and + - ffmpeg for video previews in the media proxy. + ''; + }; + + frontends = mkOption { + description = mdDoc "Akkoma frontends."; + type = with types; attrsOf (submodule frontend); + default = { + primary = { + package = pkgs.akkoma-frontends.pleroma-fe; + name = "pleroma-fe"; + ref = "stable"; + }; + admin = { + package = pkgs.akkoma-frontends.admin-fe; + name = "admin-fe"; + ref = "stable"; + }; + }; + defaultText = literalExpression '' + { + primary = { + package = pkgs.akkoma-frontends.pleroma-fe; + name = "pleroma-fe"; + ref = "stable"; + }; + admin = { + package = pkgs.akkoma-frontends.admin-fe; + name = "admin-fe"; + ref = "stable"; + }; + } + ''; + }; + + extraStatic = mkOption { + type = with types; nullOr (attrsOf package); + description = mdDoc '' + Attribute set of extra packages to add to the static files directory. + + Do not add frontends here. These should be configured through + [{option}`services.akkoma.frontends`](#opt-services.akkoma.frontends). + ''; + default = null; + example = literalExpression '' + { + "emoji/blobs.gg" = pkgs.akkoma-emoji.blobs_gg; + "static/terms-of-service.html" = pkgs.writeText "terms-of-service.html" ''' + … + '''; + "favicon.png" = let + rev = "697a8211b0f427a921e7935a35d14bb3e32d0a2c"; + in pkgs.stdenvNoCC.mkDerivation { + name = "favicon.png"; + + src = pkgs.fetchurl { + url = "https://raw.githubusercontent.com/TilCreator/NixOwO/''${rev}/NixOwO_plain.svg"; + hash = "sha256-tWhHMfJ3Od58N9H5yOKPMfM56hYWSOnr/TGCBi8bo9E="; + }; + + nativeBuildInputs = with pkgs; [ librsvg ]; + + dontUnpack = true; + installPhase = ''' + rsvg-convert -o $out -w 96 -h 96 $src + '''; + }; + } + ''; + }; + + dist = { + address = mkOption { + type = ipAddress; + default = "127.0.0.1"; + description = mdDoc '' + Listen address for Erlang distribution protocol and Port Mapper Daemon (epmd). + ''; + }; + + epmdPort = mkOption { + type = types.port; + default = 4369; + description = mdDoc "TCP port to bind Erlang Port Mapper Daemon to."; + }; + + portMin = mkOption { + type = types.port; + default = 49152; + description = mdDoc "Lower bound for Erlang distribution protocol TCP port."; + }; + + portMax = mkOption { + type = types.port; + default = 65535; + description = mdDoc "Upper bound for Erlang distribution protocol TCP port."; + }; + + cookie = mkOption { + type = types.nullOr secret; + default = null; + example = { _secret = "/var/lib/secrets/akkoma/releaseCookie"; }; + description = mdDoc '' + Erlang release cookie. + + If set to `null`, a temporary random cookie will be generated. + ''; + }; + }; + + config = mkOption { + description = mdDoc '' + Configuration for Akkoma. The attributes are serialised to Elixir DSL. + + Refer to <https://docs.akkoma.dev/stable/configuration/cheatsheet/> for + configuration options. + + Settings containing secret data should be set to an attribute set containing the + attribute `_secret` - a string pointing to a file containing the value the option + should be set to. + ''; + type = types.submodule { + freeformType = format.type; + options = { + ":pleroma" = { + ":instance" = { + name = mkOption { + type = types.nonEmptyStr; + description = mdDoc "Instance name."; + }; + + email = mkOption { + type = types.nonEmptyStr; + description = mdDoc "Instance administrator email."; + }; + + description = mkOption { + type = types.nonEmptyStr; + description = mdDoc "Instance description."; + }; + + static_dir = mkOption { + type = types.path; + default = toString staticFiles; + defaultText = literalMD '' + Derivation gathering the following paths into a directory: + + - [{option}`services.akkoma.frontends`](#opt-services.akkoma.frontends) + - [{option}`services.akkoma.extraStatic`](#opt-services.akkoma.extraStatic) + ''; + description = mdDoc '' + Directory of static files. + + This directory can be built using a derivation, or it can be managed as mutable + state by setting the option to an absolute path. + ''; + }; + + upload_dir = mkOption { + type = absolutePath; + default = "/var/lib/akkoma/uploads"; + description = mdDoc '' + Directory where Akkoma will put uploaded files. + ''; + }; + }; + + "Pleroma.Repo" = mkOption { + type = elixirValue; + default = { + adapter = format.lib.mkRaw "Ecto.Adapters.Postgres"; + socket_dir = "/run/postgresql"; + username = cfg.user; + database = "akkoma"; + }; + defaultText = literalExpression '' + { + adapter = (pkgs.formats.elixirConf { }).lib.mkRaw "Ecto.Adapters.Postgres"; + socket_dir = "/run/postgresql"; + username = config.services.akkoma.user; + database = "akkoma"; + } + ''; + description = mdDoc '' + Database configuration. + + Refer to + <https://hexdocs.pm/ecto_sql/Ecto.Adapters.Postgres.html#module-connection-options> + for options. + ''; + }; + + "Pleroma.Web.Endpoint" = { + url = { + host = mkOption { + type = types.nonEmptyStr; + default = config.networking.fqdn; + defaultText = literalExpression "config.networking.fqdn"; + description = mdDoc "Domain name of the instance."; + }; + + scheme = mkOption { + type = types.nonEmptyStr; + default = "https"; + description = mdDoc "URL scheme."; + }; + + port = mkOption { + type = types.port; + default = 443; + description = mdDoc "External port number."; + }; + }; + + http = { + ip = mkOption { + type = types.either absolutePath ipAddress; + default = "/run/akkoma/socket"; + example = "::1"; + description = mdDoc '' + Listener IP address or Unix socket path. + + The value is automatically converted to Elixir’s internal address + representation during serialisation. + ''; + }; + + port = mkOption { + type = types.port; + default = if isAbsolutePath web.http.ip then 0 else 4000; + defaultText = literalExpression '' + if isAbsolutePath config.services.akkoma.config.:pleroma"."Pleroma.Web.Endpoint".http.ip + then 0 + else 4000; + ''; + description = mdDoc '' + Listener port number. + + Must be 0 if using a Unix socket. + ''; + }; + }; + + secret_key_base = mkOption { + type = secret; + default = { _secret = "/var/lib/secrets/akkoma/key-base"; }; + description = mdDoc '' + Secret key used as a base to generate further secrets for encrypting and + signing data. + + The attribute `_secret` should point to a file containing the secret. + + This key can generated can be generated as follows: + + ```ShellSession + $ tr -dc 'A-Za-z-._~' </dev/urandom | head -c 64 + ``` + ''; + }; + + live_view = { + signing_salt = mkOption { + type = secret; + default = { _secret = "/var/lib/secrets/akkoma/liveview-salt"; }; + description = mdDoc '' + LiveView signing salt. + + The attribute `_secret` should point to a file containing the secret. + + This salt can be generated as follows: + + ```ShellSession + $ tr -dc 'A-Za-z0-9-._~' </dev/urandom | head -c 8 + ``` + ''; + }; + }; + + signing_salt = mkOption { + type = secret; + default = { _secret = "/var/lib/secrets/akkoma/signing-salt"; }; + description = mdDoc '' + Signing salt. + + The attribute `_secret` should point to a file containing the secret. + + This salt can be generated as follows: + + ```ShellSession + $ tr -dc 'A-Za-z0-9-._~' </dev/urandom | head -c 8 + ``` + ''; + }; + }; + + ":frontends" = mkOption { + type = elixirValue; + default = mapAttrs + (key: val: format.lib.mkMap { name = val.name; ref = val.ref; }) + cfg.frontends; + defaultText = literalExpression '' + lib.mapAttrs (key: val: + (pkgs.formats.elixirConf { }).lib.mkMap { name = val.name; ref = val.ref; }) + config.services.akkoma.frontends; + ''; + description = mdDoc '' + Frontend configuration. + + Users should rely on the default value and prefer to configure frontends through + [{option}`config.services.akkoma.frontends`](#opt-services.akkoma.frontends). + ''; + }; + }; + + ":web_push_encryption" = mkOption { + default = { }; + description = mdDoc '' + Web Push Notifications configuration. + + The necessary key pair can be generated as follows: + + ```ShellSession + $ nix-shell -p nodejs --run 'npx web-push generate-vapid-keys' + ``` + ''; + type = types.submodule { + freeformType = elixirValue; + options = { + ":vapid_details" = { + subject = mkOption { + type = types.nonEmptyStr; + default = "mailto:${ex.":pleroma".":instance".email}"; + defaultText = literalExpression '' + "mailto:''${config.services.akkoma.config.":pleroma".":instance".email}" + ''; + description = mdDoc "mailto URI for administrative contact."; + }; + + public_key = mkOption { + type = with types; either nonEmptyStr secret; + default = { _secret = "/var/lib/secrets/akkoma/vapid-public"; }; + description = mdDoc "base64-encoded public ECDH key."; + }; + + private_key = mkOption { + type = secret; + default = { _secret = "/var/lib/secrets/akkoma/vapid-private"; }; + description = mdDoc '' + base64-encoded private ECDH key. + + The attribute `_secret` should point to a file containing the secret. + ''; + }; + }; + }; + }; + }; + + ":joken" = { + ":default_signer" = mkOption { + type = secret; + default = { _secret = "/var/lib/secrets/akkoma/jwt-signer"; }; + description = mdDoc '' + JWT signing secret. + + The attribute `_secret` should point to a file containing the secret. + + This secret can be generated as follows: + + ```ShellSession + $ tr -dc 'A-Za-z0-9-._~' </dev/urandom | head -c 64 + ``` + ''; + }; + }; + + ":logger" = { + ":backends" = mkOption { + type = types.listOf elixirValue; + visible = false; + default = with format.lib; [ + (mkTuple [ (mkRaw "ExSyslogger") (mkAtom ":ex_syslogger") ]) + ]; + }; + + ":ex_syslogger" = { + ident = mkOption { + type = types.str; + visible = false; + default = "akkoma"; + }; + + level = mkOption { + type = types.nonEmptyStr; + apply = format.lib.mkAtom; + default = ":info"; + example = ":warning"; + description = mdDoc '' + Log level. + + Refer to + <https://hexdocs.pm/logger/Logger.html#module-levels> + for options. + ''; + }; + }; + }; + + ":tzdata" = { + ":data_dir" = mkOption { + type = elixirValue; + internal = true; + default = format.lib.mkRaw '' + Path.join(System.fetch_env!("CACHE_DIRECTORY"), "tzdata") + ''; + }; + }; + }; + }; + }; + + nginx = mkOption { + type = with types; nullOr (submodule + (import ../web-servers/nginx/vhost-options.nix { inherit config lib; })); + default = null; + description = mdDoc '' + Extra configuration for the nginx virtual host of Akkoma. + + If set to `null`, no virtual host will be added to the nginx configuration. + ''; + }; + }; + }; + + config = mkIf cfg.enable { + warnings = optionals (!config.security.sudo.enable) ['' + The pleroma_ctl wrapper enabled by the installWrapper option relies on + sudo, which appears to have been disabled through security.sudo.enable. + '']; + + users = { + users."${cfg.user}" = { + description = "Akkoma user"; + group = cfg.group; + isSystemUser = true; + }; + groups."${cfg.group}" = { }; + }; + + # Confinement of the main service unit requires separation of the + # configuration generation into a separate unit to permit access to secrets + # residing outside of the chroot. + systemd.services.akkoma-config = { + description = "Akkoma social network configuration"; + reloadTriggers = [ configFile ] ++ secretPaths; + + unitConfig.PropagatesReloadTo = [ "akkoma.service" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + UMask = "0077"; + + RuntimeDirectory = "akkoma"; + + ExecStart = mkMerge [ + (mkIf (cfg.dist.cookie == null) [ genScript ]) + (mkIf (cfg.dist.cookie != null) [ copyScript ]) + (mkIf cfg.initSecrets [ initSecretsScript ]) + [ configScript ] + ]; + + ExecReload = mkMerge [ + (mkIf cfg.initSecrets [ initSecretsScript ]) + [ configScript ] + ]; + }; + }; + + systemd.services.akkoma-initdb = mkIf cfg.initDb.enable { + description = "Akkoma social network database setup"; + requires = [ "akkoma-config.service" ]; + requiredBy = [ "akkoma.service" ]; + after = [ "akkoma-config.service" "postgresql.service" ]; + before = [ "akkoma.service" ]; + + serviceConfig = { + Type = "oneshot"; + User = mkIf (db ? socket_dir || db ? socket) + cfg.initDb.username; + RemainAfterExit = true; + UMask = "0077"; + ExecStart = initDbScript; + PrivateTmp = true; + }; + }; + + systemd.services.akkoma = let + runtimeInputs = with pkgs; [ coreutils gawk gnused ] ++ cfg.extraPackages; + in { + description = "Akkoma social network"; + documentation = [ "https://docs.akkoma.dev/stable/" ]; + + # This service depends on network-online.target and is sequenced after + # it because it requires access to the Internet to function properly. + bindsTo = [ "akkoma-config.service" ]; + wants = [ "network-online.service" ]; + wantedBy = [ "multi-user.target" ]; + after = [ + "akkoma-config.target" + "network.target" + "network-online.target" + "postgresql.service" + ]; + + confinement.packages = mkIf isConfined runtimeInputs; + path = runtimeInputs; + + serviceConfig = { + Type = "exec"; + User = cfg.user; + Group = cfg.group; + UMask = "0077"; + + # The run‐time directory is preserved as it is managed by the akkoma-config.service unit. + RuntimeDirectory = "akkoma"; + RuntimeDirectoryPreserve = true; + + CacheDirectory = "akkoma"; + + BindPaths = [ "${uploadDir}:${uploadDir}:norbind" ]; + BindReadOnlyPaths = mkMerge [ + (mkIf (!isStorePath staticDir) [ "${staticDir}:${staticDir}:norbind" ]) + (mkIf isConfined (mkMerge [ + [ "/etc/hosts" "/etc/resolv.conf" ] + (mkIf (isStorePath staticDir) (map (dir: "${dir}:${dir}:norbind") + (splitString "\n" (readFile ((pkgs.closureInfo { rootPaths = staticDir; }) + "/store-paths"))))) + (mkIf (db ? socket_dir) [ "${db.socket_dir}:${db.socket_dir}:norbind" ]) + (mkIf (db ? socket) [ "${db.socket}:${db.socket}:norbind" ]) + ])) + ]; + + ExecStartPre = "${envWrapper}/bin/pleroma_ctl migrate"; + ExecStart = "${envWrapper}/bin/pleroma start"; + ExecStartPost = socketScript; + ExecStop = "${envWrapper}/bin/pleroma stop"; + ExecStopPost = mkIf (isAbsolutePath web.http.ip) + "${pkgs.coreutils}/bin/rm -f '${web.http.ip}'"; + + ProtectProc = "noaccess"; + ProcSubset = "pid"; + ProtectSystem = mkIf (!isConfined) "strict"; + ProtectHome = true; + PrivateTmp = true; + PrivateDevices = true; + PrivateIPC = true; + ProtectHostname = true; + ProtectClock = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + + RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; + RestrictNamespaces = true; + LockPersonality = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + RemoveIPC = true; + + CapabilityBoundingSet = mkIf + (any (port: port > 0 && port < 1024) + [ web.http.port cfg.dist.epmdPort cfg.dist.portMin ]) + [ "CAP_NET_BIND_SERVICE" ]; + + NoNewPrivileges = true; + SystemCallFilter = [ "@system-service" "~@privileged" "@chown" ]; + SystemCallArchitectures = "native"; + + DeviceAllow = null; + DevicePolicy = "closed"; + + # SMTP adapter uses dynamic port 0 binding, which is incompatible with bind address filtering + SocketBindAllow = mkIf (!hasSmtp) (mkMerge [ + [ "tcp:${toString cfg.dist.epmdPort}" "tcp:${toString cfg.dist.portMin}-${toString cfg.dist.portMax}" ] + (mkIf (web.http.port != 0) [ "tcp:${toString web.http.port}" ]) + ]); + SocketBindDeny = mkIf (!hasSmtp) "any"; + }; + }; + + systemd.tmpfiles.rules = [ + "d ${uploadDir} 0700 ${cfg.user} ${cfg.group} - -" + "Z ${uploadDir} ~0700 ${cfg.user} ${cfg.group} - -" + ]; + + environment.systemPackages = mkIf (cfg.installWrapper) [ userWrapper ]; + + services.nginx.virtualHosts = mkIf (cfg.nginx != null) { + ${web.url.host} = mkMerge [ cfg.nginx { + locations."/" = { + proxyPass = + if isAbsolutePath web.http.ip + then "http://unix:${web.http.ip}" + else if hasInfix ":" web.http.ip + then "http://[${web.http.ip}]:${toString web.http.port}" + else "http://${web.http.ip}:${toString web.http.port}"; + + proxyWebsockets = true; + recommendedProxySettings = true; + }; + }]; + }; + }; + + meta.maintainers = with maintainers; [ mvs ]; + meta.doc = ./akkoma.xml; +} diff --git a/nixos/modules/services/web-apps/akkoma.xml b/nixos/modules/services/web-apps/akkoma.xml new file mode 100644 index 000000000000..76e6b806f30f --- /dev/null +++ b/nixos/modules/services/web-apps/akkoma.xml @@ -0,0 +1,396 @@ +<chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="module-services-akkoma"> + <title>Akkoma</title> + <para> + <link xlink:href="https://akkoma.dev/">Akkoma</link> is a + lightweight ActivityPub microblogging server forked from Pleroma. + </para> + <section xml:id="modules-services-akkoma-service-configuration"> + <title>Service configuration</title> + <para> + The Elixir configuration file required by Akkoma is generated + automatically from + <link xlink:href="options.html#opt-services.akkoma.config"><option>services.akkoma.config</option></link>. + Secrets must be included from external files outside of the Nix + store by setting the configuration option to an attribute set + containing the attribute <option>_secret</option> – a string + pointing to the file containing the actual value of the option. + </para> + <para> + For the mandatory configuration settings these secrets will be + generated automatically if the referenced file does not exist + during startup, unless disabled through + <link xlink:href="options.html#opt-services.akkoma.initSecrets"><option>services.akkoma.initSecrets</option></link>. + </para> + <para> + The following configuration binds Akkoma to the Unix socket + <literal>/run/akkoma/socket</literal>, expecting to be run behind + a HTTP proxy on <literal>fediverse.example.com</literal>. + </para> + <programlisting language="nix"> +services.akkoma.enable = true; +services.akkoma.config = { + ":pleroma" = { + ":instance" = { + name = "My Akkoma instance"; + description = "More detailed description"; + email = "admin@example.com"; + registration_open = false; + }; + + "Pleroma.Web.Endpoint" = { + url.host = "fediverse.example.com"; + }; + }; +}; +</programlisting> + <para> + Please refer to the + <link xlink:href="https://docs.akkoma.dev/stable/configuration/cheatsheet/">configuration + cheat sheet</link> for additional configuration options. + </para> + </section> + <section xml:id="modules-services-akkoma-user-management"> + <title>User management</title> + <para> + After the Akkoma service is running, the administration utility + can be used to + <link xlink:href="https://docs.akkoma.dev/stable/administration/CLI_tasks/user/">manage + users</link>. In particular an administrative user can be created + with + </para> + <programlisting> +$ pleroma_ctl user new <nickname> <email> --admin --moderator --password <password> +</programlisting> + </section> + <section xml:id="modules-services-akkoma-proxy-configuration"> + <title>Proxy configuration</title> + <para> + Although it is possible to expose Akkoma directly, it is common + practice to operate it behind an HTTP reverse proxy such as nginx. + </para> + <programlisting language="nix"> +services.akkoma.nginx = { + enableACME = true; + forceSSL = true; +}; + +services.nginx = { + enable = true; + + clientMaxBodySize = "16m"; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; +}; +</programlisting> + <para> + Please refer to <xref linkend="module-security-acme" /> for + details on how to provision an SSL/TLS certificate. + </para> + <section xml:id="modules-services-akkoma-media-proxy"> + <title>Media proxy</title> + <para> + Without the media proxy function, Akkoma does not store any + remote media like pictures or video locally, and clients have to + fetch them directly from the source server. + </para> + <programlisting language="nix"> +# Enable nginx slice module distributed with Tengine +services.nginx.package = pkgs.tengine; + +# Enable media proxy +services.akkoma.config.":pleroma".":media_proxy" = { + enabled = true; + proxy_opts.redirect_on_failure = true; +}; + +# Adjust the persistent cache size as needed: +# Assuming an average object size of 128 KiB, around 1 MiB +# of memory is required for the key zone per GiB of cache. +# Ensure that the cache directory exists and is writable by nginx. +services.nginx.commonHttpConfig = '' + proxy_cache_path /var/cache/nginx/cache/akkoma-media-cache + levels= keys_zone=akkoma_media_cache:16m max_size=16g + inactive=1y use_temp_path=off; +''; + +services.akkoma.nginx = { + locations."/proxy" = { + proxyPass = "http://unix:/run/akkoma/socket"; + + extraConfig = '' + proxy_cache akkoma_media_cache; + + # Cache objects in slices of 1 MiB + slice 1m; + proxy_cache_key $host$uri$is_args$args$slice_range; + proxy_set_header Range $slice_range; + + # Decouple proxy and upstream responses + proxy_buffering on; + proxy_cache_lock on; + proxy_ignore_client_abort on; + + # Default cache times for various responses + proxy_cache_valid 200 1y; + proxy_cache_valid 206 301 304 1h; + + # Allow serving of stale items + proxy_cache_use_stale error timeout invalid_header updating; + ''; + }; +}; +</programlisting> + <section xml:id="modules-services-akkoma-prefetch-remote-media"> + <title>Prefetch remote media</title> + <para> + The following example enables the + <literal>MediaProxyWarmingPolicy</literal> MRF policy which + automatically fetches all media associated with a post through + the media proxy, as soon as the post is received by the + instance. + </para> + <programlisting language="nix"> +services.akkoma.config.":pleroma".":mrf".policies = + map (pkgs.formats.elixirConf { }).lib.mkRaw [ + "Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy" +]; +</programlisting> + </section> + <section xml:id="modules-services-akkoma-media-previews"> + <title>Media previews</title> + <para> + Akkoma can generate previews for media. + </para> + <programlisting language="nix"> +services.akkoma.config.":pleroma".":media_preview_proxy" = { + enabled = true; + thumbnail_max_width = 1920; + thumbnail_max_height = 1080; +}; +</programlisting> + </section> + </section> + </section> + <section xml:id="modules-services-akkoma-frontend-management"> + <title>Frontend management</title> + <para> + Akkoma will be deployed with the <literal>pleroma-fe</literal> and + <literal>admin-fe</literal> frontends by default. These can be + modified by setting + <link xlink:href="options.html#opt-services.akkoma.frontends"><option>services.akkoma.frontends</option></link>. + </para> + <para> + The following example overrides the primary frontend’s default + configuration using a custom derivation. + </para> + <programlisting language="nix"> +services.akkoma.frontends.primary.package = pkgs.runCommand "pleroma-fe" { + config = builtins.toJSON { + expertLevel = 1; + collapseMessageWithSubject = false; + stopGifs = false; + replyVisibility = "following"; + webPushHideIfCW = true; + hideScopeNotice = true; + renderMisskeyMarkdown = false; + hideSiteFavicon = true; + postContentType = "text/markdown"; + showNavShortcuts = false; + }; + nativeBuildInputs = with pkgs; [ jq xorg.lndir ]; + passAsFile = [ "config" ]; +} '' + mkdir $out + lndir ${pkgs.akkoma-frontends.pleroma-fe} $out + + rm $out/static/config.json + jq -s add ${pkgs.akkoma-frontends.pleroma-fe}/static/config.json ${config} \ + >$out/static/config.json +''; +</programlisting> + </section> + <section xml:id="modules-services-akkoma-federation-policies"> + <title>Federation policies</title> + <para> + Akkoma comes with a number of modules to police federation with + other ActivityPub instances. The most valuable for typical users + is the + <link xlink:href="https://docs.akkoma.dev/stable/configuration/cheatsheet/#mrf_simple"><literal>:mrf_simple</literal></link> + module which allows limiting federation based on instance + hostnames. + </para> + <para> + This configuration snippet provides an example on how these can be + used. Choosing an adequate federation policy is not trivial and + entails finding a balance between connectivity to the rest of the + fediverse and providing a pleasant experience to the users of an + instance. + </para> + <programlisting language="nix"> +services.akkoma.config.":pleroma" = with (pkgs.formats.elixirConf { }).lib; { + ":mrf".policies = map mkRaw [ + "Pleroma.Web.ActivityPub.MRF.SimplePolicy" + ]; + + ":mrf_simple" = { + # Tag all media as sensitive + media_nsfw = mkMap { + "nsfw.weird.kinky" = "Untagged NSFW content"; + }; + + # Reject all activities except deletes + reject = mkMap { + "kiwifarms.cc" = "Persistent harassment of users, no moderation"; + }; + + # Force posts to be visible by followers only + followers_only = mkMap { + "beta.birdsite.live" = "Avoid polluting timelines with Twitter posts"; + }; + }; +}; +</programlisting> + </section> + <section xml:id="modules-services-akkoma-upload-filters"> + <title>Upload filters</title> + <para> + This example strips GPS and location metadata from uploads, + deduplicates them and anonymises the the file name. + </para> + <programlisting language="nix"> +services.akkoma.config.":pleroma"."Pleroma.Upload".filters = + map (pkgs.formats.elixirConf { }).lib.mkRaw [ + "Pleroma.Upload.Filter.Exiftool" + "Pleroma.Upload.Filter.Dedupe" + "Pleroma.Upload.Filter.AnonymizeFilename" + ]; +</programlisting> + </section> + <section xml:id="modules-services-akkoma-migration-pleroma"> + <title>Migration from Pleroma</title> + <para> + Pleroma instances can be migrated to Akkoma either by copying the + database and upload data or by pointing Akkoma to the existing + data. The necessary database migrations are run automatically + during startup of the service. + </para> + <para> + The configuration has to be copy‐edited manually. + </para> + <para> + Depending on the size of the database, the initial migration may + take a long time and exceed the startup timeout of the system + manager. To work around this issue one may adjust the startup + timeout + <option>systemd.services.akkoma.serviceConfig.TimeoutStartSec</option> + or simply run the migrations manually: + </para> + <programlisting> +pleroma_ctl migrate +</programlisting> + <section xml:id="modules-services-akkoma-migration-pleroma-copy"> + <title>Copying data</title> + <para> + Copying the Pleroma data instead of re‐using it in place may + permit easier reversion to Pleroma, but allows the two data sets + to diverge. + </para> + <para> + First disable Pleroma and then copy its database and upload + data: + </para> + <programlisting> +# Create a copy of the database +nix-shell -p postgresql --run 'createdb -T pleroma akkoma' + +# Copy upload data +mkdir /var/lib/akkoma +cp -R --reflink=auto /var/lib/pleroma/uploads /var/lib/akkoma/ +</programlisting> + <para> + After the data has been copied, enable the Akkoma service and + verify that the migration has been successful. If no longer + required, the original data may then be deleted: + </para> + <programlisting> +# Delete original database +nix-shell -p postgresql --run 'dropdb pleroma' + +# Delete original Pleroma state +rm -r /var/lib/pleroma +</programlisting> + </section> + <section xml:id="modules-services-akkoma-migration-pleroma-reuse"> + <title>Re‐using data</title> + <para> + To re‐use the Pleroma data in place, disable Pleroma and enable + Akkoma, pointing it to the Pleroma database and upload + directory. + </para> + <programlisting language="nix"> +# Adjust these settings according to the database name and upload directory path used by Pleroma +services.akkoma.config.":pleroma"."Pleroma.Repo".database = "pleroma"; +services.akkoma.config.":pleroma".":instance".upload_dir = "/var/lib/pleroma/uploads"; +</programlisting> + <para> + Please keep in mind that after the Akkoma service has been + started, any migrations applied by Akkoma have to be rolled back + before the database can be used again with Pleroma. This can be + achieved through <literal>pleroma_ctl ecto.rollback</literal>. + Refer to the + <link xlink:href="https://hexdocs.pm/ecto_sql/Mix.Tasks.Ecto.Rollback.html">Ecto + SQL documentation</link> for details. + </para> + </section> + </section> + <section xml:id="modules-services-akkoma-advanced-deployment"> + <title>Advanced deployment options</title> + <section xml:id="modules-services-akkoma-confinement"> + <title>Confinement</title> + <para> + The Akkoma systemd service may be confined to a chroot with + </para> + <programlisting language="nix"> +services.systemd.akkoma.confinement.enable = true; +</programlisting> + <para> + Confinement of services is not generally supported in NixOS and + therefore disabled by default. Depending on the Akkoma + configuration, the default confinement settings may be + insufficient and lead to subtle errors at run time, requiring + adjustment: + </para> + <para> + Use + <link xlink:href="options.html#opt-systemd.services._name_.confinement.packages"><option>services.systemd.akkoma.confinement.packages</option></link> + to make packages available in the chroot. + </para> + <para> + <option>services.systemd.akkoma.serviceConfig.BindPaths</option> + and + <option>services.systemd.akkoma.serviceConfig.BindReadOnlyPaths</option> + permit access to outside paths through bind mounts. Refer to + <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.exec.html#BindPaths="><link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.exec.html"><citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry></link></link> + for details. + </para> + </section> + <section xml:id="modules-services-akkoma-distributed-deployment"> + <title>Distributed deployment</title> + <para> + Being an Elixir application, Akkoma can be deployed in a + distributed fashion. + </para> + <para> + This requires setting + <link xlink:href="options.html#opt-services.akkoma.dist.address"><option>services.akkoma.dist.address</option></link> + and + <link xlink:href="options.html#opt-services.akkoma.dist.cookie"><option>services.akkoma.dist.cookie</option></link>. + The specifics depend strongly on the deployment environment. For + more information please check the relevant + <link xlink:href="https://www.erlang.org/doc/reference_manual/distributed.html">Erlang + documentation</link>. + </para> + </section> + </section> +</chapter> diff --git a/nixos/modules/services/web-apps/bookstack.nix b/nixos/modules/services/web-apps/bookstack.nix index 40bb377e2c88..d846c98577c8 100644 --- a/nixos/modules/services/web-apps/bookstack.nix +++ b/nixos/modules/services/web-apps/bookstack.nix @@ -359,7 +359,7 @@ in { }; systemd.services.bookstack-setup = { - description = "Preperation tasks for BookStack"; + description = "Preparation tasks for BookStack"; before = [ "phpfpm-bookstack.service" ]; after = optional db.createLocally "mysql.service"; wantedBy = [ "multi-user.target" ]; diff --git a/nixos/modules/services/web-apps/dex.nix b/nixos/modules/services/web-apps/dex.nix index 1dcc6f7a7c5b..f69f1749aeb8 100644 --- a/nixos/modules/services/web-apps/dex.nix +++ b/nixos/modules/services/web-apps/dex.nix @@ -83,11 +83,12 @@ in AmbientCapabilities = "CAP_NET_BIND_SERVICE"; BindReadOnlyPaths = [ "/nix/store" - "-/etc/resolv.conf" - "-/etc/nsswitch.conf" + "-/etc/dex" "-/etc/hosts" "-/etc/localtime" - "-/etc/dex" + "-/etc/nsswitch.conf" + "-/etc/resolv.conf" + "-/etc/ssl/certs/ca-certificates.crt" ]; BindPaths = optional (cfg.settings.storage.type == "postgres") "/var/run/postgresql"; CapabilityBoundingSet = "CAP_NET_BIND_SERVICE"; diff --git a/nixos/modules/services/web-apps/dolibarr.nix b/nixos/modules/services/web-apps/dolibarr.nix index 5335c439329c..f262099354d2 100644 --- a/nixos/modules/services/web-apps/dolibarr.nix +++ b/nixos/modules/services/web-apps/dolibarr.nix @@ -1,11 +1,11 @@ { config, pkgs, lib, ... }: let - inherit (lib) any boolToString concatStringsSep isBool isString literalExpression mapAttrsToList mkDefault mkEnableOption mkIf mkOption optionalAttrs types; + inherit (lib) any boolToString concatStringsSep isBool isString mapAttrsToList mkDefault mkEnableOption mkIf mkMerge mkOption optionalAttrs types; package = pkgs.dolibarr.override { inherit (cfg) stateDir; }; cfg = config.services.dolibarr; - vhostCfg = config.services.nginx.virtualHosts."${cfg.domain}"; + vhostCfg = lib.optionalAttr (cfg.nginx != null) config.services.nginx.virtualHosts."${cfg.domain}"; mkConfigFile = filename: settings: let @@ -38,7 +38,7 @@ let force_install_database = cfg.database.name; force_install_databaselogin = cfg.database.user; - force_install_mainforcehttps = vhostCfg.forceSSL; + force_install_mainforcehttps = vhostCfg.forceSSL or false; force_install_createuser = false; force_install_dolibarrlogin = null; } // optionalAttrs (cfg.database.passwordFile != null) { @@ -183,7 +183,8 @@ in }; # implementation - config = mkIf cfg.enable { + config = mkIf cfg.enable (mkMerge [ + { assertions = [ { assertion = cfg.database.createLocally -> cfg.database.user == cfg.user; @@ -214,7 +215,7 @@ in # Security settings dolibarr_main_prod = true; - dolibarr_main_force_https = vhostCfg.forceSSL; + dolibarr_main_force_https = vhostCfg.forceSSL or false; dolibarr_main_restrict_os_commands = "${pkgs.mariadb}/bin/mysqldump, ${pkgs.mariadb}/bin/mysql"; dolibarr_nocsrfcheck = false; dolibarr_main_instance_unique_id = '' @@ -314,7 +315,9 @@ in users.groups = optionalAttrs (cfg.group == "dolibarr") { dolibarr = { }; }; - - users.users."${config.services.nginx.group}".extraGroups = [ cfg.group ]; - }; + } + (mkIf (cfg.nginx != null) { + users.users."${config.services.nginx.group}".extraGroups = mkIf (cfg.nginx != null) [ cfg.group ]; + }) +]); } diff --git a/nixos/modules/services/web-apps/healthchecks.nix b/nixos/modules/services/web-apps/healthchecks.nix index 7da6dce1f954..b3fdb681e2f3 100644 --- a/nixos/modules/services/web-apps/healthchecks.nix +++ b/nixos/modules/services/web-apps/healthchecks.nix @@ -98,7 +98,7 @@ in description = lib.mdDoc '' Environment variables which are read by healthchecks `(local)_settings.py`. - Settings which are explictly covered in options bewlow, are type-checked and/or transformed + Settings which are explicitly covered in options bewlow, are type-checked and/or transformed before added to the environment, everything else is passed as a string. See <https://healthchecks.io/docs/self_hosted_configuration/> diff --git a/nixos/modules/services/web-apps/hedgedoc.nix b/nixos/modules/services/web-apps/hedgedoc.nix index a623e45691df..90ca3002c592 100644 --- a/nixos/modules/services/web-apps/hedgedoc.nix +++ b/nixos/modules/services/web-apps/hedgedoc.nix @@ -291,7 +291,8 @@ in }; defaultNotePath = mkOption { type = types.nullOr types.str; - default = "./public/default.md"; + default = "${cfg.package}/public/default.md"; + defaultText = literalExpression "\"\${cfg.package}/public/default.md\""; description = lib.mdDoc '' Path to the default Note file. (Non-canonical paths are relative to HedgeDoc's base directory) @@ -299,7 +300,8 @@ in }; docsPath = mkOption { type = types.nullOr types.str; - default = "./public/docs"; + default = "${cfg.package}/public/docs"; + defaultText = literalExpression "\"\${cfg.package}/public/docs\""; description = lib.mdDoc '' Path to the docs directory. (Non-canonical paths are relative to HedgeDoc's base directory) @@ -307,7 +309,8 @@ in }; indexPath = mkOption { type = types.nullOr types.str; - default = "./public/views/index.ejs"; + default = "${cfg.package}/public/views/index.ejs"; + defaultText = literalExpression "\"\${cfg.package}/public/views/index.ejs\""; description = lib.mdDoc '' Path to the index template file. (Non-canonical paths are relative to HedgeDoc's base directory) @@ -315,7 +318,8 @@ in }; hackmdPath = mkOption { type = types.nullOr types.str; - default = "./public/views/hackmd.ejs"; + default = "${cfg.package}/public/views/hackmd.ejs"; + defaultText = literalExpression "\"\${cfg.package}/public/views/hackmd.ejs\""; description = lib.mdDoc '' Path to the hackmd template file. (Non-canonical paths are relative to HedgeDoc's base directory) @@ -323,8 +327,8 @@ in }; errorPath = mkOption { type = types.nullOr types.str; - default = null; - defaultText = literalExpression "./public/views/error.ejs"; + default = "${cfg.package}/public/views/error.ejs"; + defaultText = literalExpression "\"\${cfg.package}/public/views/error.ejs\""; description = lib.mdDoc '' Path to the error template file. (Non-canonical paths are relative to HedgeDoc's base directory) @@ -332,8 +336,8 @@ in }; prettyPath = mkOption { type = types.nullOr types.str; - default = null; - defaultText = literalExpression "./public/views/pretty.ejs"; + default = "${cfg.package}/public/views/pretty.ejs"; + defaultText = literalExpression "\"\${cfg.package}/public/views/pretty.ejs\""; description = lib.mdDoc '' Path to the pretty template file. (Non-canonical paths are relative to HedgeDoc's base directory) @@ -341,8 +345,8 @@ in }; slidePath = mkOption { type = types.nullOr types.str; - default = null; - defaultText = literalExpression "./public/views/slide.hbs"; + default = "${cfg.package}/public/views/slide.hbs"; + defaultText = literalExpression "\"\${cfg.package}/public/views/slide.hbs\""; description = lib.mdDoc '' Path to the slide template file. (Non-canonical paths are relative to HedgeDoc's base directory) @@ -351,7 +355,7 @@ in uploadsPath = mkOption { type = types.str; default = "${cfg.workDir}/uploads"; - defaultText = literalExpression "/var/lib/${name}/uploads"; + defaultText = literalExpression "\"\${cfg.workDir}/uploads\""; description = lib.mdDoc '' Path under which uploaded files are saved. ''; diff --git a/nixos/modules/services/web-apps/ihatemoney/default.nix b/nixos/modules/services/web-apps/ihatemoney/default.nix index b0da0acfcf8a..a61aa445f82c 100644 --- a/nixos/modules/services/web-apps/ihatemoney/default.nix +++ b/nixos/modules/services/web-apps/ihatemoney/default.nix @@ -68,7 +68,7 @@ in example = { http = ":8000"; }; - description = lib.mdDoc "Additionnal configuration of the UWSGI vassal running ihatemoney. It should notably specify on which interfaces and ports the vassal should listen."; + description = lib.mdDoc "Additional configuration of the UWSGI vassal running ihatemoney. It should notably specify on which interfaces and ports the vassal should listen."; }; defaultSender = { name = mkOption { diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix index a153aa3fb0c3..61c52ee03dc6 100644 --- a/nixos/modules/services/web-apps/invidious.nix +++ b/nixos/modules/services/web-apps/invidious.nix @@ -171,7 +171,7 @@ in description = lib.mdDoc '' A file including Invidious settings. - It gets merged with the setttings specified in {option}`services.invidious.settings` + It gets merged with the settings specified in {option}`services.invidious.settings` and can be used to store secrets like `hmac_key` outside of the nix store. ''; }; diff --git a/nixos/modules/services/web-apps/invoiceplane.nix b/nixos/modules/services/web-apps/invoiceplane.nix index 99e7b1f96eac..8be1fd3055d0 100644 --- a/nixos/modules/services/web-apps/invoiceplane.nix +++ b/nixos/modules/services/web-apps/invoiceplane.nix @@ -74,7 +74,7 @@ let type = types.path; default = "/var/lib/invoiceplane/${name}"; description = lib.mdDoc '' - This directory is used for uploads of attachements and cache. + This directory is used for uploads of attachments and cache. The directory passed here is automatically created and permissions adjusted as required. ''; diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix index a42e249189f6..5b0934b2fb76 100644 --- a/nixos/modules/services/web-apps/jitsi-meet.nix +++ b/nixos/modules/services/web-apps/jitsi-meet.nix @@ -28,7 +28,7 @@ let ''); # Essential config - it's probably not good to have these as option default because - # types.attrs doesn't do merging. Let's merge explicitly, can still be overriden if + # types.attrs doesn't do merging. Let's merge explicitly, can still be overridden if # user desires. defaultCfg = { hosts = { diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix index 35b96734be77..b6e2309555f2 100644 --- a/nixos/modules/services/web-apps/mastodon.nix +++ b/nixos/modules/services/web-apps/mastodon.nix @@ -1,7 +1,9 @@ -{ config, lib, pkgs, ... }: +{ lib, pkgs, config, options, ... }: let cfg = config.services.mastodon; + opt = options.services.mastodon; + # We only want to create a database if we're actually going to connect to it. databaseActuallyCreateLocally = cfg.database.createLocally && cfg.database.host == "/run/postgresql"; @@ -23,7 +25,6 @@ let REDIS_HOST = cfg.redis.host; REDIS_PORT = toString(cfg.redis.port); DB_HOST = cfg.database.host; - DB_PORT = toString(cfg.database.port); DB_NAME = cfg.database.name; LOCAL_DOMAIN = cfg.localDomain; SMTP_SERVER = cfg.smtp.host; @@ -37,7 +38,8 @@ let TRUSTED_PROXY_IP = cfg.trustedProxy; } - // (if cfg.smtp.authenticate then { SMTP_LOGIN = cfg.smtp.user; } else {}) + // lib.optionalAttrs (cfg.database.host != "/run/postgresql" && cfg.database.port != null) { DB_PORT = toString cfg.database.port; } + // lib.optionalAttrs cfg.smtp.authenticate { SMTP_LOGIN = cfg.smtp.user; } // cfg.extraConfig; systemCallsList = [ "@cpu-emulation" "@debug" "@keyring" "@ipc" "@mount" "@obsolete" "@privileged" "@setuid" ]; @@ -314,8 +316,13 @@ in { }; port = lib.mkOption { - type = lib.types.port; - default = 5432; + type = lib.types.nullOr lib.types.port; + default = if cfg.database.createLocally then null else 5432; + defaultText = lib.literalExpression '' + if config.${opt.database.createLocally} + then null + else 5432 + ''; description = lib.mdDoc "Database host port."; }; @@ -333,8 +340,8 @@ in { passwordFile = lib.mkOption { type = lib.types.nullOr lib.types.path; - default = "/var/lib/mastodon/secrets/db-password"; - example = "/run/keys/mastodon-db-password"; + default = null; + example = "/var/lib/mastodon/secrets/db-password"; description = lib.mdDoc '' A file containing the password corresponding to {option}`database.user`. @@ -468,7 +475,18 @@ in { assertions = [ { assertion = databaseActuallyCreateLocally -> (cfg.user == cfg.database.user); - message = ''For local automatic database provisioning (services.mastodon.database.createLocally == true) with peer authentication (services.mastodon.database.host == "/run/postgresql") to work services.mastodon.user and services.mastodon.database.user must be identical.''; + message = '' + For local automatic database provisioning (services.mastodon.database.createLocally == true) with peer + authentication (services.mastodon.database.host == "/run/postgresql") to work services.mastodon.user + and services.mastodon.database.user must be identical. + ''; + } + { + assertion = !databaseActuallyCreateLocally -> (cfg.database.host != "/run/postgresql"); + message = '' + <option>services.mastodon.database.host</option> needs to be set if + <option>services.mastodon.database.createLocally</option> is not enabled. + ''; } { assertion = cfg.smtp.authenticate -> (cfg.smtp.user != null); @@ -512,10 +530,11 @@ in { OTP_SECRET="$(cat ${cfg.otpSecretFile})" VAPID_PRIVATE_KEY="$(cat ${cfg.vapidPrivateKeyFile})" VAPID_PUBLIC_KEY="$(cat ${cfg.vapidPublicKeyFile})" + '' + lib.optionalString (cfg.database.passwordFile != null) '' DB_PASS="$(cat ${cfg.database.passwordFile})" - '' + (if cfg.smtp.authenticate then '' + '' + lib.optionalString cfg.smtp.authenticate '' SMTP_PASSWORD="$(cat ${cfg.smtp.passwordFile})" - '' else "") + '' + '' + '' EOF ''; environment = env; @@ -530,7 +549,16 @@ in { }; systemd.services.mastodon-init-db = lib.mkIf cfg.automaticMigrations { - script = '' + script = lib.optionalString (!databaseActuallyCreateLocally) '' + umask 077 + + export PGPASSFILE + PGPASSFILE=$(mktemp) + cat > $PGPASSFILE <<EOF + ${cfg.database.host}:${toString cfg.database.port}:${cfg.database.name}:${cfg.database.user}:$(cat ${cfg.database.passwordFile}) + EOF + + '' + '' if [ `psql ${cfg.database.name} -c \ "select count(*) from pg_class c \ join pg_namespace s on s.oid = c.relnamespace \ @@ -541,9 +569,15 @@ in { else rails db:migrate fi + '' + lib.optionalString (!databaseActuallyCreateLocally) '' + rm $PGPASSFILE + unset PGPASSFILE ''; path = [ cfg.package pkgs.postgresql ]; - environment = env; + environment = env // lib.optionalAttrs (!databaseActuallyCreateLocally) { + PGHOST = cfg.database.host; + PGUSER = cfg.database.user; + }; serviceConfig = { Type = "oneshot"; EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ]; @@ -658,8 +692,9 @@ in { recommendedProxySettings = true; # required for redirections to work virtualHosts."${cfg.localDomain}" = { root = "${cfg.package}/public/"; - forceSSL = true; # mastodon only supports https - enableACME = true; + # mastodon only supports https, but you can override this if you offload tls elsewhere. + forceSSL = lib.mkDefault true; + enableACME = lib.mkDefault true; locations."/system/".alias = "/var/lib/mastodon/public-system/"; diff --git a/nixos/modules/services/web-apps/matomo.nix b/nixos/modules/services/web-apps/matomo.nix index 117d540ba36b..0435d21ce8a2 100644 --- a/nixos/modules/services/web-apps/matomo.nix +++ b/nixos/modules/services/web-apps/matomo.nix @@ -174,7 +174,7 @@ in { CURRENT_PACKAGE=$(readlink ${dataDir}/current-package) NEW_PACKAGE=${cfg.package} if [ "$CURRENT_PACKAGE" != "$NEW_PACKAGE" ]; then - # keeping tmp arround between upgrades seems to bork stuff, so delete it + # keeping tmp around between upgrades seems to bork stuff, so delete it rm -rf ${dataDir}/tmp fi elif [ -e ${dataDir}/tmp ]; then diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix index 99042821f5eb..56a53198b3fb 100644 --- a/nixos/modules/services/web-apps/mattermost.nix +++ b/nixos/modules/services/web-apps/mattermost.nix @@ -170,7 +170,7 @@ in type = types.attrs; default = { }; description = lib.mdDoc '' - Addtional configuration options as Nix attribute set in config.json schema. + Additional configuration options as Nix attribute set in config.json schema. ''; }; diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix index e332847f5a28..07f296748629 100644 --- a/nixos/modules/services/web-apps/mediawiki.nix +++ b/nixos/modules/services/web-apps/mediawiki.nix @@ -129,7 +129,7 @@ let ## Set $wgCacheDirectory to a writable directory on the web server ## to make your wiki go slightly faster. The directory should not - ## be publically accessible from the web. + ## be publicly accessible from the web. $wgCacheDirectory = "${cacheDir}"; # Site language code, should be one of the list in ./languages/data/Names.php diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix index 34a108cebd2b..7cc8ce10ffe0 100644 --- a/nixos/modules/services/web-apps/miniflux.nix +++ b/nixos/modules/services/web-apps/miniflux.nix @@ -21,6 +21,13 @@ in services.miniflux = { enable = mkEnableOption (lib.mdDoc "miniflux and creates a local postgres database for it"); + package = mkOption { + type = types.package; + default = pkgs.miniflux; + defaultText = literalExpression "pkgs.miniflux"; + description = lib.mdDoc "Miniflux package to use."; + }; + config = mkOption { type = types.attrsOf types.str; example = literalExpression '' @@ -89,7 +96,7 @@ in after = [ "network.target" "postgresql.service" "miniflux-dbsetup.service" ]; serviceConfig = { - ExecStart = "${pkgs.miniflux}/bin/miniflux"; + ExecStart = "${cfg.package}/bin/miniflux"; User = dbUser; DynamicUser = true; RuntimeDirectory = "miniflux"; @@ -122,6 +129,6 @@ in environment = cfg.config; }; - environment.systemPackages = [ pkgs.miniflux ]; + environment.systemPackages = [ cfg.package ]; }; } diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix index 800af234e278..e028f16004ef 100644 --- a/nixos/modules/services/web-apps/netbox.nix +++ b/nixos/modules/services/web-apps/netbox.nix @@ -135,7 +135,7 @@ in { type = types.path; default = ""; description = lib.mdDoc '' - Path to the Configuration-File for LDAP-Authentification, will be loaded as `ldap_config.py`. + Path to the Configuration-File for LDAP-Authentication, will be loaded as `ldap_config.py`. See the [documentation](https://netbox.readthedocs.io/en/stable/installation/6-ldap/#configuration) for possible options. ''; }; diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix index da621573f2a2..90801e996817 100644 --- a/nixos/modules/services/web-apps/nextcloud.nix +++ b/nixos/modules/services/web-apps/nextcloud.nix @@ -16,7 +16,7 @@ let # disable default openssl extension (lib.filter (e: e.pname != "php-openssl") enabled) # use OpenSSL 1.1 for RC4 Nextcloud encryption if user - # has acknowledged the brokeness of the ciphers (RC4). + # has acknowledged the brokenness of the ciphers (RC4). # TODO: remove when https://github.com/nextcloud/server/issues/32003 is fixed. ++ (if cfg.enableBrokenCiphersForSSE then [ cfg.phpPackage.extensions.openssl-legacy ] else [ cfg.phpPackage.extensions.openssl ]) ++ optional cfg.enableImagemagick imagick @@ -76,7 +76,7 @@ in { * setting `listen.owner` & `listen.group` in the phpfpm-pool to a different value Further details about this can be found in the `Nextcloud`-section of the NixOS-manual - (which can be openend e.g. by running `nixos-help`). + (which can be opened e.g. by running `nixos-help`). '') (mkRemovedOptionModule [ "services" "nextcloud" "disableImagemagick" ] '' Use services.nextcloud.nginx.enableImagemagick instead. @@ -388,7 +388,7 @@ in { default = []; description = lib.mdDoc '' Trusted domains, from which the nextcloud installation will be - acessible. You don't need to add + accessible. You don't need to add `services.nextcloud.hostname` here. ''; }; @@ -698,7 +698,7 @@ in { services.nextcloud.enableBrokenCiphersForSSE = false; - If you need to use server-side encryption you can ignore this waring. + If you need to use server-side encryption you can ignore this warning. Otherwise you'd have to disable server-side encryption first in order to be able to safely disable this option and get rid of this warning. See <https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html#disabling-encryption> on how to achieve this. @@ -758,7 +758,7 @@ in { nextcloud-setup = let c = cfg.config; - writePhpArrary = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]"; + writePhpArray = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]"; requiresReadSecretFunction = c.dbpassFile != null || c.objectstore.s3.enable; objectstoreConfig = let s3 = c.objectstore.s3; in optionalString s3.enable '' 'objectstore' => [ @@ -838,8 +838,8 @@ in { '' } 'dbtype' => '${c.dbtype}', - 'trusted_domains' => ${writePhpArrary ([ cfg.hostName ] ++ c.extraTrustedDomains)}, - 'trusted_proxies' => ${writePhpArrary (c.trustedProxies)}, + 'trusted_domains' => ${writePhpArray ([ cfg.hostName ] ++ c.extraTrustedDomains)}, + 'trusted_proxies' => ${writePhpArray (c.trustedProxies)}, ${optionalString (c.defaultPhoneRegion != null) "'default_phone_region' => '${c.defaultPhoneRegion}',"} ${optionalString (nextcloudGreaterOrEqualThan "23") "'profile.enabled' => ${boolToString cfg.globalProfiles},"} ${objectstoreConfig} diff --git a/nixos/modules/services/web-apps/nextcloud.xml b/nixos/modules/services/web-apps/nextcloud.xml index ca57692fc16a..4207c4008d5b 100644 --- a/nixos/modules/services/web-apps/nextcloud.xml +++ b/nixos/modules/services/web-apps/nextcloud.xml @@ -283,7 +283,7 @@ <para> If major-releases will be abandoned by upstream, we should check first if those are needed - in NixOS for a safe upgrade-path before removing those. In that case we shold keep those + in NixOS for a safe upgrade-path before removing those. In that case we should keep those packages, but mark them as insecure in an expression like this (in <literal><nixpkgs/pkgs/servers/nextcloud/default.nix></literal>): <programlisting>/* ... */ diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix index 1478e8da87a1..79ed3e43dd18 100644 --- a/nixos/modules/services/web-apps/onlyoffice.nix +++ b/nixos/modules/services/web-apps/onlyoffice.nix @@ -54,7 +54,7 @@ in postgresName = mkOption { type = types.str; default = "onlyoffice"; - description = lib.mdDoc "The name of databse OnlyOffice should user."; + description = lib.mdDoc "The name of database OnlyOffice should user."; }; postgresPasswordFile = mkOption { diff --git a/nixos/modules/services/web-apps/outline.nix b/nixos/modules/services/web-apps/outline.nix index 701930393f01..b72dd8243bb4 100644 --- a/nixos/modules/services/web-apps/outline.nix +++ b/nixos/modules/services/web-apps/outline.nix @@ -465,7 +465,7 @@ in options = { host = lib.mkOption { type = lib.types.str; - description = lib.mdDoc "Host name or IP adress of the SMTP server."; + description = lib.mdDoc "Host name or IP address of the SMTP server."; }; port = lib.mkOption { type = lib.types.port; diff --git a/nixos/modules/services/web-apps/peering-manager.nix b/nixos/modules/services/web-apps/peering-manager.nix index 0db2e8e4aeda..666b82621268 100644 --- a/nixos/modules/services/web-apps/peering-manager.nix +++ b/nixos/modules/services/web-apps/peering-manager.nix @@ -130,7 +130,7 @@ in { ldapConfigPath = mkOption { type = types.path; description = lib.mdDoc '' - Path to the Configuration-File for LDAP-Authentification, will be loaded as `ldap_config.py`. + Path to the Configuration-File for LDAP-Authentication, will be loaded as `ldap_config.py`. See the [documentation](https://peering-manager.readthedocs.io/en/stable/setup/6-ldap/#configuration) for possible options. ''; }; diff --git a/nixos/modules/services/web-apps/peertube.nix b/nixos/modules/services/web-apps/peertube.nix index 4dbcb09d2ae2..7e418f2869c8 100644 --- a/nixos/modules/services/web-apps/peertube.nix +++ b/nixos/modules/services/web-apps/peertube.nix @@ -161,6 +161,18 @@ in { description = lib.mdDoc "Configure nginx as a reverse proxy for peertube."; }; + secrets = { + secretsFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + example = "/run/secrets/peertube"; + description = lib.mdDoc '' + Secrets to run PeerTube. + Generate one using `openssl rand -hex 32` + ''; + }; + }; + database = { createLocally = lib.mkOption { type = lib.types.bool; @@ -201,7 +213,7 @@ in { passwordFile = lib.mkOption { type = lib.types.nullOr lib.types.path; default = null; - example = "/run/keys/peertube/password-posgressql-db"; + example = "/run/keys/peertube/password-postgresql"; description = lib.mdDoc "Password for PostgreSQL database."; }; }; @@ -282,6 +294,11 @@ in { prevent this. ''; } + { assertion = cfg.secrets.secretsFile != null; + message = '' + <option>services.peertube.secrets.secretsFile</option> needs to be set. + ''; + } { assertion = !(cfg.redis.enableUnixSocket && (cfg.redis.host != null || cfg.redis.port != null)); message = '' <option>services.peertube.redis.createLocally</option> and redis network connection (<option>services.peertube.redis.host</option> or <option>services.peertube.redis.port</option>) enabled. Disable either of them. @@ -349,6 +366,7 @@ in { captions = lib.mkDefault "/var/lib/peertube/storage/captions/"; cache = lib.mkDefault "/var/lib/peertube/storage/cache/"; plugins = lib.mkDefault "/var/lib/peertube/storage/plugins/"; + well_known = lib.mkDefault "/var/lib/peertube/storage/well_known/"; client_overrides = lib.mkDefault "/var/lib/peertube/storage/client-overrides/"; }; import = { @@ -417,6 +435,10 @@ in { #!/bin/sh umask 077 cat > /var/lib/peertube/config/local.yaml <<EOF + ${lib.optionalString (cfg.secrets.secretsFile != null) '' + secrets: + peertube: '$(cat ${cfg.secrets.secretsFile})' + ''} ${lib.optionalString ((!cfg.database.createLocally) && (cfg.database.passwordFile != null)) '' database: password: '$(cat ${cfg.database.passwordFile})' @@ -443,6 +465,7 @@ in { RestartSec = 20; TimeoutSec = 60; WorkingDirectory = cfg.package; + SyslogIdentifier = "peertube"; # User and group User = cfg.user; Group = cfg.group; @@ -548,9 +571,14 @@ in { ''; }; + locations."~ ^/plugins/[^/]+(/[^/]+)?/ws/" = { + tryFiles = "/dev/null @api_websocket"; + priority = 1230; + }; + locations."@api_websocket" = { proxyPass = "http://127.0.0.1:${toString cfg.listenHttp}"; - priority = 1230; + priority = 1240; extraConfig = '' proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -581,7 +609,7 @@ in { ''; }; - locations."~ ^/lazy-static/(avatars|banners)/" = { + locations."^~ /lazy-static/avatars/" = { tryFiles = "$uri @api"; root = cfg.settings.storage.avatars; priority = 1330; @@ -599,6 +627,26 @@ in { add_header Cache-Control 'public, max-age=7200'; rewrite ^/lazy-static/avatars/(.*)$ /$1 break; + ''; + }; + + locations."^~ /lazy-static/banners/" = { + tryFiles = "$uri @api"; + root = cfg.settings.storage.avatars; + priority = 1340; + extraConfig = '' + if ($request_method = 'OPTIONS') { + ${nginxCommonHeaders} + add_header Access-Control-Max-Age 1728000; + add_header Cache-Control 'no-cache'; + add_header Content-Type 'text/plain charset=UTF-8'; + add_header Content-Length 0; + return 204; + } + + ${nginxCommonHeaders} + add_header Cache-Control 'public, max-age=7200'; + rewrite ^/lazy-static/banners/(.*)$ /$1 break; ''; }; @@ -606,7 +654,7 @@ in { locations."^~ /lazy-static/previews/" = { tryFiles = "$uri @api"; root = cfg.settings.storage.previews; - priority = 1340; + priority = 1350; extraConfig = '' if ($request_method = 'OPTIONS') { ${nginxCommonHeaders} @@ -624,10 +672,34 @@ in { ''; }; + locations."^~ /static/streaming-playlists/private/" = { + proxyPass = "http://127.0.0.1:${toString cfg.listenHttp}"; + priority = 1410; + extraConfig = '' + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + + proxy_limit_rate 5M; + ''; + }; + + locations."^~ /static/webseed/private/" = { + proxyPass = "http://127.0.0.1:${toString cfg.listenHttp}"; + priority = 1420; + extraConfig = '' + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + + proxy_limit_rate 5M; + ''; + }; + locations."^~ /static/thumbnails/" = { tryFiles = "$uri @api"; root = cfg.settings.storage.thumbnails; - priority = 1350; + priority = 1430; extraConfig = '' if ($request_method = 'OPTIONS') { ${nginxCommonHeaders} @@ -648,8 +720,14 @@ in { locations."^~ /static/redundancy/" = { tryFiles = "$uri @api"; root = cfg.settings.storage.redundancy; - priority = 1360; + priority = 1440; extraConfig = '' + set $peertube_limit_rate 800k; + + if ($request_uri ~ -fragmented.mp4$) { + set $peertube_limit_rate 5M; + } + if ($request_method = 'OPTIONS') { ${nginxCommonHeaders} add_header Access-Control-Max-Age 1728000; @@ -662,15 +740,14 @@ in { access_log off; } + aio threads; sendfile on; sendfile_max_chunk 1M; + limit_rate $peertube_limit_rate; limit_rate_after 5M; - set $peertube_limit_rate 800k; - set $limit_rate $peertube_limit_rate; - rewrite ^/static/redundancy/(.*)$ /$1 break; ''; }; @@ -678,8 +755,14 @@ in { locations."^~ /static/streaming-playlists/" = { tryFiles = "$uri @api"; root = cfg.settings.storage.streaming_playlists; - priority = 1370; + priority = 1450; extraConfig = '' + set $peertube_limit_rate 800k; + + if ($request_uri ~ -fragmented.mp4$) { + set $peertube_limit_rate 5M; + } + if ($request_method = 'OPTIONS') { ${nginxCommonHeaders} add_header Access-Control-Max-Age 1728000; @@ -697,20 +780,24 @@ in { sendfile on; sendfile_max_chunk 1M; + limit_rate $peertube_limit_rate; limit_rate_after 5M; - set $peertube_limit_rate 5M; - set $limit_rate $peertube_limit_rate; - rewrite ^/static/streaming-playlists/(.*)$ /$1 break; ''; }; - locations."~ ^/static/webseed/" = { + locations."^~ /static/webseed/" = { tryFiles = "$uri @api"; root = cfg.settings.storage.videos; - priority = 1380; + priority = 1460; extraConfig = '' + set $peertube_limit_rate 800k; + + if ($request_uri ~ -fragmented.mp4$) { + set $peertube_limit_rate 5M; + } + if ($request_method = 'OPTIONS') { ${nginxCommonHeaders} add_header Access-Control-Max-Age 1728000; @@ -728,11 +815,9 @@ in { sendfile on; sendfile_max_chunk 1M; + limit_rate $peertube_limit_rate; limit_rate_after 5M; - set $peertube_limit_rate 800k; - set $limit_rate $peertube_limit_rate; - rewrite ^/static/webseed/(.*)$ /$1 break; ''; }; diff --git a/nixos/modules/services/web-apps/pgpkeyserver-lite.nix b/nixos/modules/services/web-apps/pgpkeyserver-lite.nix index 0ab39b079315..dd51bacd75ea 100644 --- a/nixos/modules/services/web-apps/pgpkeyserver-lite.nix +++ b/nixos/modules/services/web-apps/pgpkeyserver-lite.nix @@ -41,7 +41,7 @@ in defaultText = literalExpression "head config.${sksOpt.hkpAddress}"; type = types.str; description = lib.mdDoc '' - Wich ip address the sks-keyserver is listening on. + Which IP address the sks-keyserver is listening on. ''; }; diff --git a/nixos/modules/services/web-apps/snipe-it.nix b/nixos/modules/services/web-apps/snipe-it.nix index 6da44f1bdf34..314a69a73a87 100644 --- a/nixos/modules/services/web-apps/snipe-it.nix +++ b/nixos/modules/services/web-apps/snipe-it.nix @@ -381,7 +381,7 @@ in { }; systemd.services.snipe-it-setup = { - description = "Preperation tasks for snipe-it"; + description = "Preparation tasks for snipe-it"; before = [ "phpfpm-snipe-it.service" ]; after = optional db.createLocally "mysql.service"; wantedBy = [ "multi-user.target" ]; diff --git a/nixos/modules/services/web-apps/sogo.nix b/nixos/modules/services/web-apps/sogo.nix index ca1f426623f5..5e5d9472829d 100644 --- a/nixos/modules/services/web-apps/sogo.nix +++ b/nixos/modules/services/web-apps/sogo.nix @@ -49,7 +49,7 @@ in { Replacement-filepath mapping for sogo.conf. Every key is replaced with the contents of the file specified as value. - In the example, every occurence of LDAP_BINDPW will be replaced with the text of the + In the example, every occurrence of LDAP_BINDPW will be replaced with the text of the specified file. ''; type = attrsOf str; diff --git a/nixos/modules/services/web-apps/wiki-js.nix b/nixos/modules/services/web-apps/wiki-js.nix index c5627a28b849..b6e5b4594f1d 100644 --- a/nixos/modules/services/web-apps/wiki-js.nix +++ b/nixos/modules/services/web-apps/wiki-js.nix @@ -17,7 +17,7 @@ in { default = null; example = "/root/wiki-js.env"; description = lib.mdDoc '' - Environment fiel to inject e.g. secrets into the configuration. + Environment file to inject e.g. secrets into the configuration. ''; }; diff --git a/nixos/modules/services/web-servers/agate.nix b/nixos/modules/services/web-servers/agate.nix index 9d635c64a44e..a0c8a8c94ee5 100644 --- a/nixos/modules/services/web-servers/agate.nix +++ b/nixos/modules/services/web-servers/agate.nix @@ -43,7 +43,7 @@ in type = types.listOf types.str; description = lib.mdDoc '' Domain name of this Gemini server, enables checking hostname and port - in requests. (multiple occurences means basic vhosts) + in requests. (multiple occurrences means basic vhosts) ''; }; diff --git a/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix b/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix index 0d60d533c994..7b87f9ef4bde 100644 --- a/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix +++ b/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix @@ -61,7 +61,7 @@ in description = lib.mdDoc '' Listen addresses for this virtual host. - Compared to `listen` this only sets the addreses + Compared to `listen` this only sets the addresses and the ports are chosen automatically. ''; default = [ "*" ]; diff --git a/nixos/modules/services/web-servers/keter/default.nix b/nixos/modules/services/web-servers/keter/default.nix index 42ab6640b4c9..9adbe65de69f 100644 --- a/nixos/modules/services/web-servers/keter/default.nix +++ b/nixos/modules/services/web-servers/keter/default.nix @@ -140,7 +140,7 @@ Keep an old app running and swap the ports when the new one is booted. # On deploy this will load our app, by moving it into the incoming dir # If the bundle content changes, this will run again. - # Because the bundle content contains the nix path to the exectuable, + # Because the bundle content contains the nix path to the executable, # we inherit nix based cache busting. systemd.services.load-keter-bundle = { description = "load keter bundle into incoming folder"; diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 85c76ed59d66..8377e8a76d52 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -241,7 +241,7 @@ let configPath = if cfg.enableReload then "/etc/nginx/nginx.conf" - else configFile; + else finalConfigFile; execCommand = "${cfg.package}/bin/nginx -c '${configPath}'"; @@ -318,7 +318,9 @@ let ${acmeLocation} ${optionalString (vhost.root != null) "root ${vhost.root};"} ${optionalString (vhost.globalRedirect != null) '' - return 301 http${optionalString hasSSL "s"}://${vhost.globalRedirect}$request_uri; + location / { + return 301 http${optionalString hasSSL "s"}://${vhost.globalRedirect}$request_uri; + } ''} ${optionalString hasSSL '' ssl_certificate ${vhost.sslCertificate}; @@ -391,6 +393,38 @@ let ); mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix; + + snakeOilCert = pkgs.runCommand "nginx-config-validate-cert" { nativeBuildInputs = [ pkgs.openssl.bin ]; } '' + mkdir $out + openssl genrsa -des3 -passout pass:xxxxx -out server.pass.key 2048 + openssl rsa -passin pass:xxxxx -in server.pass.key -out $out/server.key + openssl req -new -key $out/server.key -out server.csr \ + -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com" + openssl x509 -req -days 1 -in server.csr -signkey $out/server.key -out $out/server.crt + ''; + validatedConfigFile = pkgs.runCommand "validated-nginx.conf" { nativeBuildInputs = [ cfg.package ]; } '' + # nginx absolutely wants to read the certificates even when told to only validate config, so let's provide fake certs + sed ${configFile} \ + -e "s|ssl_certificate .*;|ssl_certificate ${snakeOilCert}/server.crt;|g" \ + -e "s|ssl_trusted_certificate .*;|ssl_trusted_certificate ${snakeOilCert}/server.crt;|g" \ + -e "s|ssl_certificate_key .*;|ssl_certificate_key ${snakeOilCert}/server.key;|g" \ + > conf + + LD_PRELOAD=${pkgs.libredirect}/lib/libredirect.so \ + NIX_REDIRECTS="/etc/resolv.conf=/dev/null" \ + nginx -t -c $(readlink -f ./conf) > out 2>&1 || true + if ! grep -q "syntax is ok" out; then + echo nginx config validation failed. + echo config was ${configFile}. + echo 'in case of false positive, set `services.nginx.validateConfig` to false.' + echo nginx output: + cat out + exit 1 + fi + cp ${configFile} $out + ''; + + finalConfigFile = if cfg.validateConfig then validatedConfigFile else configFile; in { @@ -489,6 +523,17 @@ in ''; }; + validateConfig = mkOption { + # FIXME: re-enable if we can make of the configurations work. + #default = pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform; + default = false; + defaultText = literalExpression "pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform"; + type = types.bool; + description = lib.mdDoc '' + Validate the generated nginx config at build time. The check is not very robust and can be disabled in case of false positives. This is notably the case when cross-compiling or when using `include` with files outside of the store. + ''; + }; + additionalModules = mkOption { default = []; type = types.listOf (types.attrsOf types.anything); @@ -1027,7 +1072,7 @@ in }; environment.etc."nginx/nginx.conf" = mkIf cfg.enableReload { - source = configFile; + source = finalConfigFile; }; # This service waits for all certificates to be available @@ -1046,7 +1091,7 @@ in # certs are updated _after_ config has been reloaded. before = sslTargets; after = sslServices; - restartTriggers = optionals (cfg.enableReload) [ configFile ]; + restartTriggers = optionals (cfg.enableReload) [ finalConfigFile ]; # Block reloading if not all certs exist yet. # Happens when config changes add new vhosts/certs. unitConfig.ConditionPathExists = optionals (sslServices != []) (map (certName: certs.${certName}.directory + "/fullchain.pem") dependentCertNames); diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix index 2bdc046c0d8f..089decb5f433 100644 --- a/nixos/modules/services/web-servers/nginx/vhost-options.nix +++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix @@ -54,8 +54,8 @@ with lib; description = lib.mdDoc '' Listen addresses for this virtual host. - Compared to `listen` this only sets the addreses - and the ports are choosen automatically. + Compared to `listen` this only sets the addresses + and the ports are chosen automatically. Note: This option overrides `enableIPv6` ''; diff --git a/nixos/modules/services/web-servers/ttyd.nix b/nixos/modules/services/web-servers/ttyd.nix index affd5bbeea3c..e0a8b5179e06 100644 --- a/nixos/modules/services/web-servers/ttyd.nix +++ b/nixos/modules/services/web-servers/ttyd.nix @@ -163,7 +163,7 @@ in assertions = [ { assertion = cfg.enableSSL -> cfg.certFile != null && cfg.keyFile != null && cfg.caFile != null; - message = "SSL is enabled for ttyd, but no certFile, keyFile or caFile has been specefied."; } + message = "SSL is enabled for ttyd, but no certFile, keyFile or caFile has been specified."; } { assertion = ! (cfg.interface != null && cfg.socket != null); message = "Cannot set both interface and socket for ttyd."; } { assertion = (cfg.username != null) == (cfg.passwordFile != null); diff --git a/nixos/modules/services/web-servers/zope2.nix b/nixos/modules/services/web-servers/zope2.nix index a80fe882f1a7..a17fe6bc2082 100644 --- a/nixos/modules/services/web-servers/zope2.nix +++ b/nixos/modules/services/web-servers/zope2.nix @@ -95,7 +95,7 @@ in }; } ''; - description = lib.mdDoc "zope2 instances to be created automaticaly by the system."; + description = lib.mdDoc "zope2 instances to be created automatically by the system."; }; }; diff --git a/nixos/modules/services/x11/desktop-managers/cinnamon.nix b/nixos/modules/services/x11/desktop-managers/cinnamon.nix index aaad1de5f87b..08c5625fc7dd 100644 --- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix +++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix @@ -105,7 +105,7 @@ in services.dbus.packages = with pkgs.cinnamon; [ cinnamon-common cinnamon-screensaver - nemo + nemo-with-extensions xapp ]; services.cinnamon.apps.enable = mkDefault true; @@ -154,7 +154,7 @@ in polkit_gnome # packages - nemo + nemo-with-extensions cinnamon-control-center cinnamon-settings-daemon libgnomekbd diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix index a6ab3053087c..9fcb408c287d 100644 --- a/nixos/modules/services/x11/desktop-managers/plasma5.nix +++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix @@ -384,6 +384,11 @@ in ++ lib.optionals config.services.samba.enable [ kdenetwork-filesharing pkgs.samba ] ++ lib.optional config.services.xserver.wacom.enable pkgs.wacomtablet; + # Extra services for D-Bus activation + services.dbus.packages = [ + plasma5.kactivitymanagerd + ]; + environment.pathsToLink = [ # FIXME: modules should link subdirs of `/share` rather than relying on this "/share" @@ -446,6 +451,9 @@ in xdg.portal.enable = true; xdg.portal.extraPortals = [ plasma5.xdg-desktop-portal-kde ]; + # xdg-desktop-portal-kde expects PipeWire to be running. + # This does not, by default, replace PulseAudio. + services.pipewire.enable = mkDefault true; # Update the start menu for each user that is currently logged in system.userActivationScripts.plasmaSetup = activationScript; @@ -577,6 +585,8 @@ in hardware.bluetooth.enable = true; hardware.pulseaudio.enable = true; networking.networkmanager.enable = true; + # Required for autorotate + hardware.sensor.iio.enable = lib.mkDefault true; # Recommendations can be found here: # - https://invent.kde.org/plasma-mobile/plasma-phone-settings/-/tree/master/etc/xdg diff --git a/nixos/modules/services/x11/display-managers/sddm.nix b/nixos/modules/services/x11/display-managers/sddm.nix index e86a18ff618e..a3f03d7a19a6 100644 --- a/nixos/modules/services/x11/display-managers/sddm.nix +++ b/nixos/modules/services/x11/display-managers/sddm.nix @@ -123,7 +123,7 @@ in }; }; description = lib.mdDoc '' - Extra settings merged in and overwritting defaults in sddm.conf. + Extra settings merged in and overwriting defaults in sddm.conf. ''; }; diff --git a/nixos/modules/services/x11/hardware/libinput.nix b/nixos/modules/services/x11/hardware/libinput.nix index 0d30b9b5e68d..f77036360e02 100644 --- a/nixos/modules/services/x11/hardware/libinput.nix +++ b/nixos/modules/services/x11/hardware/libinput.nix @@ -171,7 +171,7 @@ let cfg = config.services.xserver.libinput; lib.mdDoc '' Enables or disables drag lock during tapping behavior. When enabled, a finger up during tap- and-drag will not immediately release the button. If the finger is set down again within the - timeout, the draging process continues. + timeout, the dragging process continues. ''; }; diff --git a/nixos/modules/services/x11/imwheel.nix b/nixos/modules/services/x11/imwheel.nix index 03cbdbfb09a4..133e64c65cdd 100644 --- a/nixos/modules/services/x11/imwheel.nix +++ b/nixos/modules/services/x11/imwheel.nix @@ -37,8 +37,8 @@ in Window class translation rules. /etc/X11/imwheelrc is generated based on this config which means this config is global for all users. - See [offical man pages](http://imwheel.sourceforge.net/imwheel.1.html) - for more informations. + See [official man pages](http://imwheel.sourceforge.net/imwheel.1.html) + for more information. ''; }; }; diff --git a/nixos/modules/services/x11/window-managers/katriawm.nix b/nixos/modules/services/x11/window-managers/katriawm.nix new file mode 100644 index 000000000000..106631792ff4 --- /dev/null +++ b/nixos/modules/services/x11/window-managers/katriawm.nix @@ -0,0 +1,27 @@ +{ config, lib, pkgs, ... }: + +let + inherit (lib) mdDoc mkEnableOption mkIf mkPackageOption singleton; + cfg = config.services.xserver.windowManager.katriawm; +in +{ + ###### interface + options = { + services.xserver.windowManager.katriawm = { + enable = mkEnableOption (mdDoc "katriawm"); + package = mkPackageOption pkgs "katriawm" {}; + }; + }; + + ###### implementation + config = mkIf cfg.enable { + services.xserver.windowManager.session = singleton { + name = "katriawm"; + start = '' + ${cfg.package}/bin/katriawm & + waitPID=$! + ''; + }; + environment.systemPackages = [ cfg.package ]; + }; +} diff --git a/nixos/modules/services/x11/xautolock.nix b/nixos/modules/services/x11/xautolock.nix index 8200057660e5..5b8b748a086b 100644 --- a/nixos/modules/services/x11/xautolock.nix +++ b/nixos/modules/services/x11/xautolock.nix @@ -71,7 +71,7 @@ in type = types.nullOr types.str; description = lib.mdDoc '' - The script to use when nothing has happend for as long as {option}`killtime` + The script to use when nothing has happened for as long as {option}`killtime` ''; }; diff --git a/nixos/modules/system/activation/bootspec.cue b/nixos/modules/system/activation/bootspec.cue new file mode 100644 index 000000000000..9f857a1b1cd8 --- /dev/null +++ b/nixos/modules/system/activation/bootspec.cue @@ -0,0 +1,18 @@ +#V1: { + system: string + init: string + initrd?: string + initrdSecrets?: string + kernel: string + kernelParams: [...string] + label: string + toplevel: string + specialisation?: { + [=~"^"]: #V1 + } + extensions?: {...} +} + +Document: { + v1: #V1 +} diff --git a/nixos/modules/system/activation/bootspec.nix b/nixos/modules/system/activation/bootspec.nix new file mode 100644 index 000000000000..61407ab67558 --- /dev/null +++ b/nixos/modules/system/activation/bootspec.nix @@ -0,0 +1,126 @@ +# Note that these schemas are defined by RFC-0125. +# This document is considered a stable API, and is depended upon by external tooling. +# Changes to the structure of the document, or the semantics of the values should go through an RFC. +# +# See: https://github.com/NixOS/rfcs/pull/125 +{ config +, pkgs +, lib +, ... +}: +let + cfg = config.boot.bootspec; + children = lib.mapAttrs (childName: childConfig: childConfig.configuration.system.build.toplevel) config.specialisation; + schemas = { + v1 = rec { + filename = "boot.json"; + json = + pkgs.writeText filename + (builtins.toJSON + { + v1 = { + system = config.boot.kernelPackages.stdenv.hostPlatform.system; + kernel = "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}"; + kernelParams = config.boot.kernelParams; + label = "NixOS ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"; + + inherit (cfg) extensions; + } // lib.optionalAttrs config.boot.initrd.enable { + initrd = "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}"; + initrdSecrets = "${config.system.build.initialRamdiskSecretAppender}/bin/append-initrd-secrets"; + }; + }); + + generator = + let + # NOTE: Be careful to not introduce excess newlines at the end of the + # injectors, as that may affect the pipes and redirects. + + # Inject toplevel and init into the bootspec. + # This can only be done here because we *cannot* depend on $out + # referring to the toplevel, except by living in the toplevel itself. + toplevelInjector = lib.escapeShellArgs [ + "${pkgs.jq}/bin/jq" + '' + .v1.toplevel = $toplevel | + .v1.init = $init + '' + "--sort-keys" + "--arg" "toplevel" "${placeholder "out"}" + "--arg" "init" "${placeholder "out"}/init" + ] + " < ${json}"; + + # We slurp all specialisations and inject them as values, such that + # `.specialisations.${name}` embeds the specialisation's bootspec + # document. + specialisationInjector = + let + specialisationLoader = (lib.mapAttrsToList + (childName: childToplevel: lib.escapeShellArgs [ "--slurpfile" childName "${childToplevel}/${filename}" ]) + children); + in + lib.escapeShellArgs [ + "${pkgs.jq}/bin/jq" + "--sort-keys" + ".v1.specialisation = ($ARGS.named | map_values(. | first | .v1))" + ] + " ${lib.concatStringsSep " " specialisationLoader}"; + in + '' + mkdir -p $out/bootspec + + ${toplevelInjector} | ${specialisationInjector} > $out/${filename} + ''; + + validator = pkgs.writeCueValidator ./bootspec.cue { + document = "Document"; # Universal validator for any version as long the schema is correctly set. + }; + }; + }; +in +{ + options.boot.bootspec = { + enable = lib.mkEnableOption (lib.mdDoc "Enable generation of RFC-0125 bootspec in $system/bootspec, e.g. /run/current-system/bootspec"); + + extensions = lib.mkOption { + type = lib.types.attrsOf lib.types.attrs; # <namespace>: { ...namespace-specific fields } + default = { }; + description = lib.mdDoc '' + User-defined data that extends the bootspec document. + + To reduce incompatibility and prevent names from clashing + between applications, it is **highly recommended** to use a + unique namespace for your extensions. + ''; + }; + + # This will be run as a part of the `systemBuilder` in ./top-level.nix. This + # means `$out` points to the output of `config.system.build.toplevel` and can + # be used for a variety of things (though, for now, it's only used to report + # the path of the `toplevel` itself and the `init` executable). + writer = lib.mkOption { + internal = true; + default = schemas.v1.generator; + }; + + validator = lib.mkOption { + internal = true; + default = schemas.v1.validator; + }; + + filename = lib.mkOption { + internal = true; + default = schemas.v1.filename; + }; + }; + + config = lib.mkIf (cfg.enable) { + warnings = [ + ''RFC-0125 is not merged yet, this is a feature preview of bootspec. + The schema is not definitive and features are not guaranteed to be stable until RFC-0125 is merged. + See: + - https://github.com/NixOS/nixpkgs/pull/172237 to track merge status in nixpkgs. + - https://github.com/NixOS/rfcs/pull/125 to track RFC status. + '' + ]; + }; +} diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix index 64e97b510b06..00b11471e1c7 100644 --- a/nixos/modules/system/activation/top-level.nix +++ b/nixos/modules/system/activation/top-level.nix @@ -79,6 +79,11 @@ let echo -n "$extraDependencies" > $out/extra-dependencies + ${optionalString (!config.boot.isContainer && config.boot.bootspec.enable) '' + ${config.boot.bootspec.writer} + ${config.boot.bootspec.validator} "$out/${config.boot.bootspec.filename}" + ''} + ${config.system.extraSystemBuilderCmds} ''; diff --git a/nixos/modules/system/boot/binfmt.nix b/nixos/modules/system/boot/binfmt.nix index 87e66f73be0e..7f817e5d350d 100644 --- a/nixos/modules/system/boot/binfmt.nix +++ b/nixos/modules/system/boot/binfmt.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: let - inherit (lib) mkOption types optionalString stringAfter; + inherit (lib) mkOption mkDefault types optionalString stringAfter; cfg = config.boot.binfmt; @@ -281,7 +281,7 @@ in { config = { boot.binfmt.registrations = builtins.listToAttrs (map (system: { name = system; - value = let + value = { config, ... }: let interpreter = getEmulator system; qemuArch = getQemuArch system; @@ -292,13 +292,13 @@ in { in if preserveArgvZero then "${wrapper}/bin/${wrapperName}" else interpreter; - in { - inherit preserveArgvZero; + in ({ + preserveArgvZero = mkDefault preserveArgvZero; - interpreter = interpreterReg; - wrapInterpreterInShell = !preserveArgvZero; - interpreterSandboxPath = dirOf (dirOf interpreterReg); - } // (magics.${system} or (throw "Cannot create binfmt registration for system ${system}")); + interpreter = mkDefault interpreterReg; + wrapInterpreterInShell = mkDefault (!config.preserveArgvZero); + interpreterSandboxPath = mkDefault (dirOf (dirOf config.interpreter)); + } // (magics.${system} or (throw "Cannot create binfmt registration for system ${system}"))); }) cfg.emulatedSystems); nix.settings = lib.mkIf (cfg.emulatedSystems != []) { extra-platforms = cfg.emulatedSystems ++ lib.optional pkgs.stdenv.hostPlatform.isx86_64 "i686-linux"; diff --git a/nixos/modules/system/boot/initrd-openvpn.nix b/nixos/modules/system/boot/initrd-openvpn.nix index b41e7524320e..cbc61d55d6bb 100644 --- a/nixos/modules/system/boot/initrd-openvpn.nix +++ b/nixos/modules/system/boot/initrd-openvpn.nix @@ -68,11 +68,8 @@ in $out/bin/openvpn --show-gateway ''; - # Add `iproute /bin/ip` to the config, to ensure that openvpn - # is able to set the routes boot.initrd.network.postCommands = '' - (cat /etc/initrd.ovpn; echo -e '\niproute /bin/ip') | \ - openvpn /dev/stdin & + openvpn /etc/initrd.ovpn & ''; }; diff --git a/nixos/modules/system/boot/loader/external/external.md b/nixos/modules/system/boot/loader/external/external.md new file mode 100644 index 000000000000..ba1dfd4d9b9a --- /dev/null +++ b/nixos/modules/system/boot/loader/external/external.md @@ -0,0 +1,26 @@ +# External Bootloader Backends {#sec-bootloader-external} + +NixOS has support for several bootloader backends by default: systemd-boot, grub, uboot, etc. +The built-in bootloader backend support is generic and supports most use cases. +Some users may prefer to create advanced workflows around managing the bootloader and bootable entries. + +You can replace the built-in bootloader support with your own tooling using the "external" bootloader option. + +Imagine you have created a new package called FooBoot. +FooBoot provides a program at `${pkgs.fooboot}/bin/fooboot-install` which takes the system closure's path as its only argument and configures the system's bootloader. + +You can enable FooBoot like this: + +```nix +{ pkgs, ... }: { + boot.loader.external = { + enable = true; + installHook = "${pkgs.fooboot}/bin/fooboot-install"; + }; +} +``` + +## Developing Custom Bootloader Backends + +Bootloaders should use [RFC-0125](https://github.com/NixOS/rfcs/pull/125)'s Bootspec format and synthesis tools to identify the key properties for bootable system generations. + diff --git a/nixos/modules/system/boot/loader/external/external.nix b/nixos/modules/system/boot/loader/external/external.nix new file mode 100644 index 000000000000..5cf478e6c83c --- /dev/null +++ b/nixos/modules/system/boot/loader/external/external.nix @@ -0,0 +1,38 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.boot.loader.external; +in +{ + meta = { + maintainers = with maintainers; [ cole-h grahamc raitobezarius ]; + # Don't edit the docbook xml directly, edit the md and generate it: + # `pandoc external.md -t docbook --top-level-division=chapter --extract-media=media -f markdown+smart > external.xml` + doc = ./external.xml; + }; + + options.boot.loader.external = { + enable = mkEnableOption (lib.mdDoc "use an external tool to install your bootloader"); + + installHook = mkOption { + type = with types; path; + description = lib.mdDoc '' + The full path to a program of your choosing which performs the bootloader installation process. + + The program will be called with an argument pointing to the output of the system's toplevel. + ''; + }; + }; + + config = mkIf cfg.enable { + boot.loader = { + grub.enable = mkDefault false; + systemd-boot.enable = mkDefault false; + supportsInitrdSecrets = mkDefault false; + }; + + system.build.installBootLoader = cfg.installHook; + }; +} diff --git a/nixos/modules/system/boot/loader/external/external.xml b/nixos/modules/system/boot/loader/external/external.xml new file mode 100644 index 000000000000..39ab2156bc8c --- /dev/null +++ b/nixos/modules/system/boot/loader/external/external.xml @@ -0,0 +1,41 @@ +<chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-bootloader-external"> + <title>External Bootloader Backends</title> + <para> + NixOS has support for several bootloader backends by default: + systemd-boot, grub, uboot, etc. The built-in bootloader backend + support is generic and supports most use cases. Some users may + prefer to create advanced workflows around managing the bootloader + and bootable entries. + </para> + <para> + You can replace the built-in bootloader support with your own + tooling using the <quote>external</quote> bootloader option. + </para> + <para> + Imagine you have created a new package called FooBoot. FooBoot + provides a program at + <literal>${pkgs.fooboot}/bin/fooboot-install</literal> which takes + the system closure’s path as its only argument and configures the + system’s bootloader. + </para> + <para> + You can enable FooBoot like this: + </para> + <programlisting language="nix"> +{ pkgs, ... }: { + boot.loader.external = { + enable = true; + installHook = "${pkgs.fooboot}/bin/fooboot-install"; + }; +} +</programlisting> + <section xml:id="developing-custom-bootloader-backends"> + <title>Developing Custom Bootloader Backends</title> + <para> + Bootloaders should use + <link xlink:href="https://github.com/NixOS/rfcs/pull/125">RFC-0125</link>’s + Bootspec format and synthesis tools to identify the key properties + for bootable system generations. + </para> + </section> +</chapter> diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix index a67b10608aa7..1d266b5a37d5 100644 --- a/nixos/modules/system/boot/loader/grub/grub.nix +++ b/nixos/modules/system/boot/loader/grub/grub.nix @@ -38,7 +38,7 @@ let grubConfig = args: let efiSysMountPoint = if args.efiSysMountPoint == null then args.path else args.efiSysMountPoint; - efiSysMountPoint' = replaceChars [ "/" ] [ "-" ] efiSysMountPoint; + efiSysMountPoint' = replaceStrings [ "/" ] [ "-" ] efiSysMountPoint; in pkgs.writeText "grub-config.xml" (builtins.toXML { splashImage = f cfg.splashImage; diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix index 28c76fb169f1..95dcdfd7fbe1 100644 --- a/nixos/modules/system/boot/stage-1.nix +++ b/nixos/modules/system/boot/stage-1.nix @@ -205,8 +205,9 @@ let # Copy ld manually since it isn't detected correctly cp -pv ${pkgs.stdenv.cc.libc.out}/lib/ld*.so.? $out/lib - # Copy all of the needed libraries - find $out/bin $out/lib -type f | while read BIN; do + # Copy all of the needed libraries in a consistent order so + # duplicates are resolved the same way. + find $out/bin $out/lib -type f | sort | while read BIN; do echo "Copying libs for executable $BIN" for LIB in $(${findLibs}/bin/find-libs $BIN); do TGT="$out/lib/$(basename $LIB)" diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix index 31702499b0f1..196f44ccd783 100644 --- a/nixos/modules/system/boot/systemd/initrd.nix +++ b/nixos/modules/system/boot/systemd/initrd.nix @@ -148,6 +148,16 @@ in { visible = false; }; + extraConfig = mkOption { + default = ""; + type = types.lines; + example = "DefaultLimitCORE=infinity"; + description = lib.mdDoc '' + Extra config options for systemd. See systemd-system.conf(5) man page + for available options. + ''; + }; + contents = mkOption { description = lib.mdDoc "Set of files that have to be linked into the initrd"; example = literalExpression '' @@ -352,6 +362,7 @@ in { "/etc/systemd/system.conf".text = '' [Manager] DefaultEnvironment=PATH=/bin:/sbin ${optionalString (isBool cfg.emergencyAccess && cfg.emergencyAccess) "SYSTEMD_SULOGIN_FORCE=1"} + ${cfg.extraConfig} ''; "/lib/modules".source = "${modulesClosure}/lib/modules"; diff --git a/nixos/modules/tasks/filesystems.nix b/nixos/modules/tasks/filesystems.nix index a093baea6a65..7f2c8a41b20a 100644 --- a/nixos/modules/tasks/filesystems.nix +++ b/nixos/modules/tasks/filesystems.nix @@ -54,7 +54,7 @@ let default = [ "defaults" ]; example = [ "data=journal" ]; description = lib.mdDoc "Options used to mount the file system."; - type = types.listOf nonEmptyStr; + type = types.nonEmptyListOf nonEmptyStr; }; depends = mkOption { diff --git a/nixos/modules/tasks/filesystems/envfs.nix b/nixos/modules/tasks/filesystems/envfs.nix new file mode 100644 index 000000000000..ef8f655c532a --- /dev/null +++ b/nixos/modules/tasks/filesystems/envfs.nix @@ -0,0 +1,51 @@ +{ pkgs, config, lib, ... }: + +let + cfg = config.services.envfs; + mounts = { + "/usr/bin" = { + device = "none"; + fsType = "envfs"; + options = [ + "fallback-path=${pkgs.runCommand "fallback-path" {} '' + mkdir -p $out + ln -s ${pkgs.coreutils}/bin/env $out/env + ln -s ${config.system.build.binsh}/bin/sh $out/sh + ''}" + ]; + }; + "/bin" = { + device = "/usr/bin"; + fsType = "none"; + options = [ "bind" ]; + }; + }; +in { + options = { + services.envfs = { + enable = lib.mkEnableOption (lib.mdDoc "Envfs filesystem") // { + description = lib.mdDoc '' + Fuse filesystem that returns symlinks to executables based on the PATH + of the requesting process. This is useful to execute shebangs on NixOS + that assume hard coded locations in locations like /bin or /usr/bin + etc. + ''; + }; + package = lib.mkOption { + type = lib.types.package; + description = lib.mdDoc "Which package to use for the envfs."; + default = pkgs.envfs; + defaultText = lib.mdDoc "pkgs.envfs"; + }; + }; + }; + config = lib.mkIf (cfg.enable) { + environment.systemPackages = [ cfg.package ]; + # we also want these mounts in virtual machines. + fileSystems = if config.virtualisation ? qemu then lib.mkVMOverride mounts else mounts; + + # We no longer need those when using envfs + system.activationScripts.usrbinenv = lib.mkForce ""; + system.activationScripts.binsh = lib.mkForce ""; + }; +} diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix index 4b4f4cc801ab..6c7759647517 100644 --- a/nixos/modules/tasks/filesystems/zfs.nix +++ b/nixos/modules/tasks/filesystems/zfs.nix @@ -97,10 +97,15 @@ let in map (x: "${mountPoint x}.mount") (getPoolFilesystems pool); - getKeyLocations = pool: - if isBool cfgZfs.requestEncryptionCredentials - then "${cfgZfs.package}/sbin/zfs list -rHo name,keylocation,keystatus ${pool}" - else "${cfgZfs.package}/sbin/zfs list -Ho name,keylocation,keystatus ${toString (filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials)}"; + getKeyLocations = pool: if isBool cfgZfs.requestEncryptionCredentials then { + hasKeys = cfgZfs.requestEncryptionCredentials; + command = "${cfgZfs.package}/sbin/zfs list -rHo name,keylocation,keystatus ${pool}"; + } else let + keys = filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials; + in { + hasKeys = keys != []; + command = "${cfgZfs.package}/sbin/zfs list -Ho name,keylocation,keystatus ${toString keys}"; + }; createImportService = { pool, systemd, force, prefix ? "" }: nameValuePair "zfs-import-${pool}" { @@ -124,7 +129,9 @@ let RemainAfterExit = true; }; environment.ZFS_FORCE = optionalString force "-f"; - script = (importLib { + script = let + keyLocations = getKeyLocations pool; + in (importLib { # See comments at importLib definition. zpoolCmd = "${cfgZfs.package}/sbin/zpool"; awkCmd = "${pkgs.gawk}/bin/awk"; @@ -139,10 +146,8 @@ let done poolImported "${pool}" || poolImport "${pool}" # Try one last time, e.g. to import a degraded pool. if poolImported "${pool}"; then - ${optionalString (if isBool cfgZfs.requestEncryptionCredentials - then cfgZfs.requestEncryptionCredentials - else cfgZfs.requestEncryptionCredentials != []) '' - ${getKeyLocations pool} | while IFS=$'\t' read ds kl ks; do + ${optionalString keyLocations.hasKeys '' + ${keyLocations.command} | while IFS=$'\t' read ds kl ks; do { if [[ "$ks" != unavailable ]]; then continue @@ -503,6 +508,10 @@ in assertion = !cfgZfs.forceImportAll || cfgZfs.forceImportRoot; message = "If you enable boot.zfs.forceImportAll, you must also enable boot.zfs.forceImportRoot"; } + { + assertion = cfgZfs.allowHibernation -> !cfgZfs.forceImportRoot && !cfgZfs.forceImportAll; + message = "boot.zfs.allowHibernation while force importing is enabled will cause data corruption"; + } ]; boot = { @@ -561,7 +570,7 @@ in '' else concatMapStrings (fs: '' zfs load-key -- ${escapeShellArg fs} - '') cfgZfs.requestEncryptionCredentials} + '') (filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials)} '') rootPools)); # Systemd in stage 1 diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix index 4c211b747614..4d47a56ccca3 100644 --- a/nixos/modules/tasks/network-interfaces.nix +++ b/nixos/modules/tasks/network-interfaces.nix @@ -1377,12 +1377,12 @@ in # networkmanager falls back to "/proc/sys/net/ipv6/conf/default/use_tempaddr" "net.ipv6.conf.default.use_tempaddr" = tempaddrValues.${cfg.tempAddresses}.sysctl; } // listToAttrs (forEach interfaces - (i: nameValuePair "net.ipv4.conf.${replaceChars ["."] ["/"] i.name}.proxy_arp" i.proxyARP)) + (i: nameValuePair "net.ipv4.conf.${replaceStrings ["."] ["/"] i.name}.proxy_arp" i.proxyARP)) // listToAttrs (forEach interfaces (i: let opt = i.tempAddress; val = tempaddrValues.${opt}.sysctl; - in nameValuePair "net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr" val)); + in nameValuePair "net.ipv6.conf.${replaceStrings ["."] ["/"] i.name}.use_tempaddr" val)); security.wrappers = { ping = { @@ -1495,7 +1495,7 @@ in in '' # override to ${msg} for ${i.name} - ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr=${val}" + ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceStrings ["."] ["/"] i.name}.use_tempaddr=${val}" '') (filter (i: i.tempAddress != cfg.tempAddresses) interfaces); }) ] ++ lib.optional (cfg.wlanInterfaces != {}) diff --git a/nixos/modules/testing/minimal-kernel.nix b/nixos/modules/testing/minimal-kernel.nix deleted file mode 100644 index 7c2b9c05cf9a..000000000000 --- a/nixos/modules/testing/minimal-kernel.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ config, pkgs, lib, ... }: - -let - configfile = builtins.storePath (builtins.toFile "config" (lib.concatStringsSep "\n" - (map (builtins.getAttr "configLine") config.system.requiredKernelConfig)) - ); - - origKernel = pkgs.buildLinux { - inherit (pkgs.linux) src version stdenv; - inherit configfile; - allowImportFromDerivation = true; - kernelPatches = [ pkgs.kernelPatches.cifs_timeout_2_6_38 ]; - }; - - kernel = origKernel // (derivation (origKernel.drvAttrs // { - configurePhase = '' - runHook preConfigure - mkdir ../build - make $makeFlags "''${makeFlagsArray[@]}" mrproper - make $makeFlags "''${makeFlagsArray[@]}" KCONFIG_ALLCONFIG=${configfile} allnoconfig - runHook postConfigure - ''; - })); - - kernelPackages = pkgs.linuxPackagesFor kernel; -in { - boot.kernelPackages = kernelPackages; -} diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix index 4ab2578eb81e..028099c64643 100644 --- a/nixos/modules/testing/test-instrumentation.nix +++ b/nixos/modules/testing/test-instrumentation.nix @@ -96,6 +96,12 @@ in MaxLevelConsole=debug ''; + boot.initrd.systemd.contents."/etc/systemd/journald.conf".text = '' + [Journal] + ForwardToConsole=yes + MaxLevelConsole=debug + ''; + systemd.extraConfig = '' # Don't clobber the console with duplicate systemd messages. ShowStatus=no @@ -107,6 +113,8 @@ in DefaultTimeoutStartSec=300 ''; + boot.initrd.systemd.extraConfig = config.systemd.extraConfig; + boot.consoleLogLevel = 7; # Prevent tests from accessing the Internet. diff --git a/nixos/modules/virtualisation/appvm.nix b/nixos/modules/virtualisation/appvm.nix index b23b321095cf..9fe2995d37a0 100644 --- a/nixos/modules/virtualisation/appvm.nix +++ b/nixos/modules/virtualisation/appvm.nix @@ -20,7 +20,7 @@ in { user = mkOption { type = types.str; description = lib.mdDoc '' - AppVM user login. Currenly only AppVMs are supported for a single user only. + AppVM user login. Currently only AppVMs are supported for a single user only. ''; }; }; diff --git a/nixos/modules/virtualisation/hyperv-guest.nix b/nixos/modules/virtualisation/hyperv-guest.nix index 7c73e32be695..cba4f92abe82 100644 --- a/nixos/modules/virtualisation/hyperv-guest.nix +++ b/nixos/modules/virtualisation/hyperv-guest.nix @@ -56,8 +56,6 @@ in { systemd = { packages = [ config.boot.kernelPackages.hyperv-daemons.lib ]; - services.hv-vss.unitConfig.ConditionPathExists = [ "/dev/vmbus/hv_vss" ]; - targets.hyperv-daemons = { wantedBy = [ "multi-user.target" ]; }; diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix index 3b30bc8c4165..7c95405ed318 100644 --- a/nixos/modules/virtualisation/libvirtd.nix +++ b/nixos/modules/virtualisation/libvirtd.nix @@ -220,6 +220,17 @@ in ''; }; + parallelShutdown = mkOption { + type = types.ints.unsigned; + default = 0; + description = lib.mdDoc '' + Number of guests that will be shutdown concurrently, taking effect when onShutdown + is set to "shutdown". If set to 0, guests will be shutdown one after another. + Number of guests on shutdown at any time will not exceed number set in this + variable. + ''; + }; + allowedBridges = mkOption { type = types.listOf types.str; default = [ "virbr0" ]; @@ -373,6 +384,7 @@ in environment.ON_BOOT = "${cfg.onBoot}"; environment.ON_SHUTDOWN = "${cfg.onShutdown}"; + environment.PARALLEL_SHUTDOWN = "${toString cfg.parallelShutdown}"; }; systemd.sockets.virtlogd = { diff --git a/nixos/modules/virtualisation/lxc-container.nix b/nixos/modules/virtualisation/lxc-container.nix index a71b69341051..4963d9f3f9e4 100644 --- a/nixos/modules/virtualisation/lxc-container.nix +++ b/nixos/modules/virtualisation/lxc-container.nix @@ -51,8 +51,8 @@ in { imports = [ ../installer/cd-dvd/channel.nix - ../profiles/minimal.nix ../profiles/clone-config.nix + ../profiles/minimal.nix ]; options = { @@ -199,5 +199,11 @@ in # Containers should be light-weight, so start sshd on demand. services.openssh.enable = mkDefault true; services.openssh.startWhenNeeded = mkDefault true; + + # As this is intended as a standalone image, undo some of the minimal profile stuff + environment.noXlibs = false; + documentation.enable = true; + documentation.nixos.enable = true; + services.logrotate.enable = true; }; } diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix index 118bf82cdd66..13bbb4471ea5 100644 --- a/nixos/modules/virtualisation/podman/default.nix +++ b/nixos/modules/virtualisation/podman/default.nix @@ -109,6 +109,37 @@ in ''; }; + autoPrune = { + enable = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + Whether to periodically prune Podman resources. If enabled, a + systemd timer will run `podman system prune -f` + as specified by the `dates` option. + ''; + }; + + flags = mkOption { + type = types.listOf types.str; + default = []; + example = [ "--all" ]; + description = lib.mdDoc '' + Any additional flags passed to {command}`podman system prune`. + ''; + }; + + dates = mkOption { + default = "weekly"; + type = types.str; + description = lib.mdDoc '' + Specification (in the format described by + {manpage}`systemd.time(7)`) of the time at + which the prune will occur. + ''; + }; + }; + package = lib.mkOption { type = types.package; default = podmanPackage; @@ -151,6 +182,23 @@ in ExecStart = [ "" "${cfg.package}/bin/podman $LOGGING system service" ]; }; + systemd.services.podman-prune = { + description = "Prune podman resources"; + + restartIfChanged = false; + unitConfig.X-StopOnRemoval = false; + + serviceConfig.Type = "oneshot"; + + script = '' + ${cfg.package}/bin/podman system prune -f ${toString cfg.autoPrune.flags} + ''; + + startAt = lib.optional cfg.autoPrune.enable cfg.autoPrune.dates; + after = [ "podman.service" ]; + requires = [ "podman.service" ]; + }; + systemd.sockets.podman.wantedBy = [ "sockets.target" ]; systemd.sockets.podman.socketConfig.SocketGroup = "podman"; diff --git a/nixos/modules/virtualisation/proxmox-image.nix b/nixos/modules/virtualisation/proxmox-image.nix index 42c52c12edf0..6a4220fd265c 100644 --- a/nixos/modules/virtualisation/proxmox-image.nix +++ b/nixos/modules/virtualisation/proxmox-image.nix @@ -28,7 +28,7 @@ with lib; default = "local-lvm:vm-9999-disk-0"; example = "ceph:vm-123-disk-0"; description = lib.mdDoc '' - Configuration for the default virtio disk. It can be used as a cue for PVE to autodetect the target sotrage. + Configuration for the default virtio disk. It can be used as a cue for PVE to autodetect the target storage. This parameter is required by PVE even if it isn't used. ''; }; diff --git a/nixos/modules/virtualisation/vmware-host.nix b/nixos/modules/virtualisation/vmware-host.nix index e1d695640be1..4b2dc28aeac7 100644 --- a/nixos/modules/virtualisation/vmware-host.nix +++ b/nixos/modules/virtualisation/vmware-host.nix @@ -120,7 +120,7 @@ in # Services systemd.services."vmware-authdlauncher" = { - description = "VMware Authentification Daemon"; + description = "VMware Authentication Daemon"; serviceConfig = { Type = "forking"; ExecStart = [ "${cfg.package}/bin/vmware-authdlauncher" ]; diff --git a/nixos/release.nix b/nixos/release.nix index 919aa86a2d63..946379bcd661 100644 --- a/nixos/release.nix +++ b/nixos/release.nix @@ -181,14 +181,22 @@ in rec { inherit system; }); - # A variant with a more recent (but possibly less stable) kernel - # that might support more hardware. + # A variant with a more recent (but possibly less stable) kernel that might support more hardware. + # This variant keeps zfs support enabled, hoping it will build and work. iso_minimal_new_kernel = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system: makeIso { module = ./modules/installer/cd-dvd/installation-cd-minimal-new-kernel.nix; type = "minimal-new-kernel"; inherit system; }); + # A variant with a more recent (but possibly less stable) kernel that might support more hardware. + # ZFS support disabled since it is unlikely to support the latest kernel. + iso_minimal_new_kernel_no_zfs = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system: makeIso { + module = ./modules/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix; + type = "minimal-new-kernel-no-zfs"; + inherit system; + }); + sd_image = forMatchingSystems [ "armv6l-linux" "armv7l-linux" "aarch64-linux" ] (system: makeSdImage { module = { armv6l-linux = ./modules/installer/sd-card/sd-image-raspberrypi-installer.nix; @@ -206,6 +214,14 @@ in rec { inherit system; }); + sd_image_new_kernel_no_zfs = forMatchingSystems [ "aarch64-linux" ] (system: makeSdImage { + module = { + aarch64-linux = ./modules/installer/sd-card/sd-image-aarch64-new-kernel-no-zfs-installer.nix; + }.${system}; + type = "minimal-new-kernel-no-zfs"; + inherit system; + }); + # A bootable VirtualBox virtual appliance as an OVA file (i.e. packaged OVF). ova = forMatchingSystems [ "x86_64-linux" ] (system: diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix index d540bc6ec31b..d62bf0c0fd92 100644 --- a/nixos/tests/acme.nix +++ b/nixos/tests/acme.nix @@ -144,7 +144,11 @@ in { name = "acme"; - meta.maintainers = lib.teams.acme.members; + meta = { + maintainers = lib.teams.acme.members; + # Hard timeout in seconds. Average run time is about 7 minutes. + timeout = 1800; + }; nodes = { # The fake ACME server which will respond to client requests @@ -277,7 +281,7 @@ in { }; }; - # Test compatiblity with Caddy + # Test compatibility with Caddy # It only supports useACMEHost, hence not using mkServerConfigs } // (let baseCaddyConfig = { nodes, config, ... }: { @@ -357,6 +361,30 @@ in { import time + TOTAL_RETRIES = 20 + + + class BackoffTracker(object): + delay = 1 + increment = 1 + + def handle_fail(self, retries, message) -> int: + assert retries < TOTAL_RETRIES, message + + print(f"Retrying in {self.delay}s, {retries + 1}/{TOTAL_RETRIES}") + time.sleep(self.delay) + + # Only increment after the first try + if retries == 0: + self.delay += self.increment + self.increment *= 2 + + return retries + 1 + + + backoff = BackoffTracker() + + def switch_to(node, name): # On first switch, this will create a symlink to the current system so that we can # quickly switch between derivations @@ -404,9 +432,7 @@ in { assert False - def check_connection(node, domain, retries=3): - assert retries >= 0, f"Failed to connect to https://{domain}" - + def check_connection(node, domain, retries=0): result = node.succeed( "openssl s_client -brief -verify 2 -CAfile /tmp/ca.crt" f" -servername {domain} -connect {domain}:443 < /dev/null 2>&1" @@ -414,13 +440,11 @@ in { for line in result.lower().split("\n"): if "verification" in line and "error" in line: - time.sleep(3) - return check_connection(node, domain, retries - 1) + retries = backoff.handle_fail(retries, f"Failed to connect to https://{domain}") + return check_connection(node, domain, retries) - def check_connection_key_bits(node, domain, bits, retries=3): - assert retries >= 0, f"Did not find expected number of bits ({bits}) in key" - + def check_connection_key_bits(node, domain, bits, retries=0): result = node.succeed( "openssl s_client -CAfile /tmp/ca.crt" f" -servername {domain} -connect {domain}:443 < /dev/null" @@ -429,13 +453,11 @@ in { print("Key type:", result) if bits not in result: - time.sleep(3) - return check_connection_key_bits(node, domain, bits, retries - 1) - + retries = backoff.handle_fail(retries, f"Did not find expected number of bits ({bits}) in key") + return check_connection_key_bits(node, domain, bits, retries) - def check_stapling(node, domain, retries=3): - assert retries >= 0, "OCSP Stapling check failed" + def check_stapling(node, domain, retries=0): # Pebble doesn't provide a full OCSP responder, so just check the URL result = node.succeed( "openssl s_client -CAfile /tmp/ca.crt" @@ -445,21 +467,19 @@ in { print("OCSP Responder URL:", result) if "${caDomain}:4002" not in result.lower(): - time.sleep(3) - return check_stapling(node, domain, retries - 1) - + retries = backoff.handle_fail(retries, "OCSP Stapling check failed") + return check_stapling(node, domain, retries) - def download_ca_certs(node, retries=5): - assert retries >= 0, "Failed to connect to pebble to download root CA certs" + def download_ca_certs(node, retries=0): exit_code, _ = node.execute("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt") exit_code_2, _ = node.execute( "curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt" ) if exit_code + exit_code_2 > 0: - time.sleep(3) - return download_ca_certs(node, retries - 1) + retries = backoff.handle_fail(retries, "Failed to connect to pebble to download root CA certs") + return download_ca_certs(node, retries) start_all() diff --git a/nixos/tests/aesmd.nix b/nixos/tests/aesmd.nix index 5da661afd548..848e1c599201 100644 --- a/nixos/tests/aesmd.nix +++ b/nixos/tests/aesmd.nix @@ -1,7 +1,7 @@ { pkgs, lib, ... }: { name = "aesmd"; meta = { - maintainers = with lib.maintainers; [ veehaitch ]; + maintainers = with lib.maintainers; [ trundle veehaitch ]; }; nodes.machine = { lib, ... }: { @@ -25,38 +25,78 @@ # We don't have a real SGX machine in NixOS tests systemd.services.aesmd.unitConfig.AssertPathExists = lib.mkForce [ ]; + + specialisation = { + withQuoteProvider.configuration = { ... }: { + services.aesmd = { + quoteProviderLibrary = pkgs.sgx-azure-dcap-client; + environment = { + AZDCAP_DEBUG_LOG_LEVEL = "INFO"; + }; + }; + }; + }; }; - testScript = '' - with subtest("aesmd.service starts"): - machine.wait_for_unit("aesmd.service") - status, main_pid = machine.systemctl("show --property MainPID --value aesmd.service") - assert status == 0, "Could not get MainPID of aesmd.service" - main_pid = main_pid.strip() - - with subtest("aesmd.service runtime directory permissions"): - runtime_dir = "/run/aesmd"; - res = machine.succeed(f"stat -c '%a %U %G' {runtime_dir}").strip() - assert "750 aesmd sgx" == res, f"{runtime_dir} does not have the expected permissions: {res}" - - with subtest("aesm.socket available on host"): - socket_path = "/var/run/aesmd/aesm.socket" - machine.wait_until_succeeds(f"test -S {socket_path}") - machine.succeed(f"test 777 -eq $(stat -c '%a' {socket_path})") - for op in [ "-r", "-w", "-x" ]: - machine.succeed(f"sudo -u sgxtest test {op} {socket_path}") - machine.fail(f"sudo -u nosgxtest test {op} {socket_path}") - - with subtest("Copies white_list_cert_to_be_verify.bin"): - whitelist_path = "/var/opt/aesmd/data/white_list_cert_to_be_verify.bin" - whitelist_perms = machine.succeed( - f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/stat -c '%a' {whitelist_path}" - ).strip() - assert "644" == whitelist_perms, f"white_list_cert_to_be_verify.bin has permissions {whitelist_perms}" - - with subtest("Writes and binds aesm.conf in service namespace"): - aesmd_config = machine.succeed(f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/cat /etc/aesmd.conf") - - assert aesmd_config == "whitelist url = http://nixos.org\nproxy type = direct\ndefault quoting type = ecdsa_256\n", "aesmd.conf differs" - ''; + testScript = { nodes, ... }: + let + specialisations = "${nodes.machine.system.build.toplevel}/specialisation"; + in + '' + def get_aesmd_pid(): + status, main_pid = machine.systemctl("show --property MainPID --value aesmd.service") + assert status == 0, "Could not get MainPID of aesmd.service" + return main_pid.strip() + + with subtest("aesmd.service starts"): + machine.wait_for_unit("aesmd.service") + + main_pid = get_aesmd_pid() + + with subtest("aesmd.service runtime directory permissions"): + runtime_dir = "/run/aesmd"; + res = machine.succeed(f"stat -c '%a %U %G' {runtime_dir}").strip() + assert "750 aesmd sgx" == res, f"{runtime_dir} does not have the expected permissions: {res}" + + with subtest("aesm.socket available on host"): + socket_path = "/var/run/aesmd/aesm.socket" + machine.wait_until_succeeds(f"test -S {socket_path}") + machine.succeed(f"test 777 -eq $(stat -c '%a' {socket_path})") + for op in [ "-r", "-w", "-x" ]: + machine.succeed(f"sudo -u sgxtest test {op} {socket_path}") + machine.fail(f"sudo -u nosgxtest test {op} {socket_path}") + + with subtest("Copies white_list_cert_to_be_verify.bin"): + whitelist_path = "/var/opt/aesmd/data/white_list_cert_to_be_verify.bin" + whitelist_perms = machine.succeed( + f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/stat -c '%a' {whitelist_path}" + ).strip() + assert "644" == whitelist_perms, f"white_list_cert_to_be_verify.bin has permissions {whitelist_perms}" + + with subtest("Writes and binds aesm.conf in service namespace"): + aesmd_config = machine.succeed(f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/cat /etc/aesmd.conf") + + assert aesmd_config == "whitelist url = http://nixos.org\nproxy type = direct\ndefault quoting type = ecdsa_256\n", "aesmd.conf differs" + + with subtest("aesmd.service without quote provider library has correct LD_LIBRARY_PATH"): + status, environment = machine.systemctl("show --property Environment --value aesmd.service") + assert status == 0, "Could not get Environment of aesmd.service" + env_by_name = dict(entry.split("=", 1) for entry in environment.split()) + assert not env_by_name["LD_LIBRARY_PATH"], "LD_LIBRARY_PATH is not empty" + + with subtest("aesmd.service with quote provider library starts"): + machine.succeed('${specialisations}/withQuoteProvider/bin/switch-to-configuration test') + machine.wait_for_unit("aesmd.service") + + main_pid = get_aesmd_pid() + + with subtest("aesmd.service with quote provider library has correct LD_LIBRARY_PATH"): + ld_library_path = machine.succeed(f"xargs -0 -L1 -a /proc/{main_pid}/environ | grep LD_LIBRARY_PATH") + assert ld_library_path.startswith("LD_LIBRARY_PATH=${pkgs.sgx-azure-dcap-client}/lib:"), \ + "LD_LIBRARY_PATH is not set to the configured quote provider library" + + with subtest("aesmd.service with quote provider library has set AZDCAP_DEBUG_LOG_LEVEL"): + azdcp_debug_log_level = machine.succeed(f"xargs -0 -L1 -a /proc/{main_pid}/environ | grep AZDCAP_DEBUG_LOG_LEVEL") + assert azdcp_debug_log_level == "AZDCAP_DEBUG_LOG_LEVEL=INFO\n", "AZDCAP_DEBUG_LOG_LEVEL is not set to INFO" + ''; } diff --git a/nixos/tests/akkoma.nix b/nixos/tests/akkoma.nix new file mode 100644 index 000000000000..7115c0beed34 --- /dev/null +++ b/nixos/tests/akkoma.nix @@ -0,0 +1,121 @@ +/* + End-to-end test for Akkoma. + + Based in part on nixos/tests/pleroma. + + TODO: Test federation. +*/ +import ./make-test-python.nix ({ pkgs, package ? pkgs.akkoma, confined ? false, ... }: +let + userPassword = "4LKOrGo8SgbPm1a6NclVU5Wb"; + + provisionUser = pkgs.writers.writeBashBin "provisionUser" '' + set -eu -o errtrace -o pipefail + + pleroma_ctl user new jamy jamy@nixos.test --password '${userPassword}' --moderator --admin -y + ''; + + tlsCert = pkgs.runCommand "selfSignedCerts" { + nativeBuildInputs = with pkgs; [ openssl ]; + } '' + mkdir -p $out + openssl req -x509 \ + -subj '/CN=akkoma.nixos.test/' -days 49710 \ + -addext 'subjectAltName = DNS:akkoma.nixos.test' \ + -keyout "$out/key.pem" -newkey ed25519 \ + -out "$out/cert.pem" -noenc + ''; + + sendToot = pkgs.writers.writeBashBin "sendToot" '' + set -eu -o errtrace -o pipefail + + export REQUESTS_CA_BUNDLE="/etc/ssl/certs/ca-certificates.crt" + + echo '${userPassword}' | ${pkgs.toot}/bin/toot login_cli -i "akkoma.nixos.test" -e "jamy@nixos.test" + echo "y" | ${pkgs.toot}/bin/toot post "hello world Jamy here" + echo "y" | ${pkgs.toot}/bin/toot timeline | grep -F -q "hello world Jamy here" + + # Test file upload + echo "y" | ${pkgs.toot}/bin/toot upload <(dd if=/dev/zero bs=1024 count=1024 status=none) \ + | grep -F -q "https://akkoma.nixos.test/media" + ''; + + checkFe = pkgs.writers.writeBashBin "checkFe" '' + set -eu -o errtrace -o pipefail + + paths=( / /static/{config,styles}.json /pleroma/admin/ ) + + for path in "''${paths[@]}"; do + diff \ + <(${pkgs.curl}/bin/curl -f -S -s -o /dev/null -w '%{response_code}' "https://akkoma.nixos.test$path") \ + <(echo -n 200) + done + ''; + + hosts = nodes: '' + ${nodes.akkoma.networking.primaryIPAddress} akkoma.nixos.test + ${nodes.client.networking.primaryIPAddress} client.nixos.test + ''; +in +{ + name = "akkoma"; + nodes = { + client = { nodes, pkgs, config, ... }: { + security.pki.certificateFiles = [ "${tlsCert}/cert.pem" ]; + networking.extraHosts = hosts nodes; + }; + + akkoma = { nodes, pkgs, config, ... }: { + networking.extraHosts = hosts nodes; + networking.firewall.allowedTCPPorts = [ 443 ]; + environment.systemPackages = with pkgs; [ provisionUser ]; + systemd.services.akkoma.confinement.enable = confined; + + services.akkoma = { + enable = true; + package = package; + config = { + ":pleroma" = { + ":instance" = { + name = "NixOS test Akkoma server"; + description = "NixOS test Akkoma server"; + email = "akkoma@nixos.test"; + notify_email = "akkoma@nixos.test"; + registration_open = true; + }; + + ":media_proxy" = { + enabled = false; + }; + + "Pleroma.Web.Endpoint" = { + url.host = "akkoma.nixos.test"; + }; + }; + }; + + nginx = { + addSSL = true; + sslCertificate = "${tlsCert}/cert.pem"; + sslCertificateKey = "${tlsCert}/key.pem"; + }; + }; + + services.nginx.enable = true; + services.postgresql.enable = true; + }; + }; + + testScript = { nodes, ... }: '' + start_all() + akkoma.wait_for_unit('akkoma-initdb.service') + akkoma.systemctl('restart akkoma-initdb.service') # test repeated initialisation + akkoma.wait_for_unit('akkoma.service') + akkoma.wait_for_file('/run/akkoma/socket'); + akkoma.succeed('${provisionUser}/bin/provisionUser') + akkoma.wait_for_unit('nginx.service') + client.succeed('${sendToot}/bin/sendToot') + client.succeed('${checkFe}/bin/checkFe') + ''; +}) + diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index b372ae20480b..36a5c9843c2f 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -69,10 +69,12 @@ in { _3proxy = runTest ./3proxy.nix; acme = runTest ./acme.nix; adguardhome = runTest ./adguardhome.nix; - aesmd = runTest ./aesmd.nix; + aesmd = runTestOn ["x86_64-linux"] ./aesmd.nix; agate = runTest ./web-servers/agate.nix; agda = handleTest ./agda.nix {}; airsonic = handleTest ./airsonic.nix {}; + akkoma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix {}; + akkoma-confined = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix { confined = true; }; allTerminfo = handleTest ./all-terminfo.nix {}; alps = handleTest ./alps.nix {}; amazon-init-shell = handleTest ./amazon-init-shell.nix {}; @@ -80,6 +82,7 @@ in { apparmor = handleTest ./apparmor.nix {}; atd = handleTest ./atd.nix {}; atop = handleTest ./atop.nix {}; + atuin = handleTest ./atuin.nix {}; auth-mysql = handleTest ./auth-mysql.nix {}; avahi = handleTest ./avahi.nix {}; avahi-with-resolved = handleTest ./avahi.nix { networkd = true; }; @@ -95,6 +98,7 @@ in { blockbook-frontend = handleTest ./blockbook-frontend.nix {}; blocky = handleTest ./blocky.nix {}; boot = handleTestOn ["x86_64-linux" "aarch64-linux"] ./boot.nix {}; + bootspec = handleTestOn ["x86_64-linux"] ./bootspec.nix {}; boot-stage1 = handleTest ./boot-stage1.nix {}; borgbackup = handleTest ./borgbackup.nix {}; botamusique = handleTest ./botamusique.nix {}; @@ -151,6 +155,7 @@ in { coturn = handleTest ./coturn.nix {}; couchdb = handleTest ./couchdb.nix {}; cri-o = handleTestOn ["aarch64-linux" "x86_64-linux"] ./cri-o.nix {}; + cups-pdf = handleTest ./cups-pdf.nix {}; custom-ca = handleTest ./custom-ca.nix {}; croc = handleTest ./croc.nix {}; deluge = handleTest ./deluge.nix {}; @@ -190,6 +195,7 @@ in { engelsystem = handleTest ./engelsystem.nix {}; enlightenment = handleTest ./enlightenment.nix {}; env = handleTest ./env.nix {}; + envfs = handleTest ./envfs.nix {}; envoy = handleTest ./envoy.nix {}; ergo = handleTest ./ergo.nix {}; ergochat = handleTest ./ergochat.nix {}; @@ -209,7 +215,8 @@ in { firefox-esr = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr; }; # used in `tested` job firefox-esr-102 = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr-102; }; firejail = handleTest ./firejail.nix {}; - firewall = handleTest ./firewall.nix {}; + firewall = handleTest ./firewall.nix { nftables = false; }; + firewall-nftables = handleTest ./firewall.nix { nftables = true; }; fish = handleTest ./fish.nix {}; flannel = handleTestOn ["x86_64-linux"] ./flannel.nix {}; fluentd = handleTest ./fluentd.nix {}; @@ -255,6 +262,7 @@ in { haste-server = handleTest ./haste-server.nix {}; haproxy = handleTest ./haproxy.nix {}; hardened = handleTest ./hardened.nix {}; + headscale = handleTest ./headscale.nix {}; healthchecks = handleTest ./web-apps/healthchecks.nix {}; hbase2 = handleTest ./hbase.nix { package=pkgs.hbase2; }; hbase_2_4 = handleTest ./hbase.nix { package=pkgs.hbase_2_4; }; @@ -365,7 +373,7 @@ in { mailhog = handleTest ./mailhog.nix {}; man = handleTest ./man.nix {}; mariadb-galera = handleTest ./mysql/mariadb-galera.nix {}; - mastodon = handleTestOn ["x86_64-linux" "i686-linux" "aarch64-linux"] ./web-apps/mastodon.nix {}; + mastodon = discoverTests (import ./web-apps/mastodon { inherit handleTestOn; }); matomo = handleTest ./matomo.nix {}; matrix-appservice-irc = handleTest ./matrix/appservice-irc.nix {}; matrix-conduit = handleTest ./matrix/conduit.nix {}; @@ -410,6 +418,9 @@ in { nat.firewall = handleTest ./nat.nix { withFirewall = true; }; nat.firewall-conntrack = handleTest ./nat.nix { withFirewall = true; withConntrackHelpers = true; }; nat.standalone = handleTest ./nat.nix { withFirewall = false; }; + nat.nftables.firewall = handleTest ./nat.nix { withFirewall = true; nftables = true; }; + nat.nftables.firewall-conntrack = handleTest ./nat.nix { withFirewall = true; withConntrackHelpers = true; nftables = true; }; + nat.nftables.standalone = handleTest ./nat.nix { withFirewall = false; nftables = true; }; nats = handleTest ./nats.nix {}; navidrome = handleTest ./navidrome.nix {}; nbd = handleTest ./nbd.nix {}; @@ -434,6 +445,7 @@ in { nginx = handleTest ./nginx.nix {}; nginx-auth = handleTest ./nginx-auth.nix {}; nginx-etag = handleTest ./nginx-etag.nix {}; + nginx-globalredirect = handleTest ./nginx-globalredirect.nix {}; nginx-http3 = handleTest ./nginx-http3.nix {}; nginx-modsecurity = handleTest ./nginx-modsecurity.nix {}; nginx-njs = handleTest ./nginx-njs.nix {}; diff --git a/nixos/tests/atuin.nix b/nixos/tests/atuin.nix new file mode 100644 index 000000000000..85213d1e53ea --- /dev/null +++ b/nixos/tests/atuin.nix @@ -0,0 +1,65 @@ +import ./make-test-python.nix ({ pkgs, lib, ... }: + +let + testPort = 8888; + testUser = "testerman"; + testPass = "password"; + testEmail = "test.testerman@test.com"; +in +with lib; +{ + name = "atuin"; + meta.maintainers = with pkgs.lib.maintainers; [ devusb ]; + + nodes = { + server = + { ... }: + { + services.atuin = { + enable = true; + port = testPort; + host = "0.0.0.0"; + openFirewall = true; + openRegistration = true; + }; + }; + + client = + { ... }: + { }; + + }; + + testScript = with pkgs; '' + start_all() + + # wait for atuin server startup + server.wait_for_unit("atuin.service") + server.wait_for_open_port(${toString testPort}) + + # configure atuin client on server node + server.execute("mkdir -p ~/.config/atuin") + server.execute("echo 'sync_address = \"http://localhost:${toString testPort}\"' > ~/.config/atuin/config.toml") + + # register with atuin server on server node + server.succeed("${atuin}/bin/atuin register -u ${testUser} -p ${testPass} -e ${testEmail}") + _, key = server.execute("${atuin}/bin/atuin key") + + # store test record in atuin server and sync + server.succeed("ATUIN_SESSION=$(${atuin}/bin/atuin uuid) ${atuin}/bin/atuin history start 'shazbot'") + server.succeed("${atuin}/bin/atuin sync") + + # configure atuin client on client node + client.execute("mkdir -p ~/.config/atuin") + client.execute("echo 'sync_address = \"http://server:${toString testPort}\"' > ~/.config/atuin/config.toml") + + # log in to atuin server on client node + client.succeed(f"${atuin}/bin/atuin login -u ${testUser} -p ${testPass} -k {key}") + + # pull records from atuin server + client.succeed("${atuin}/bin/atuin sync -f") + + # check for test record + client.succeed("ATUIN_SESSION=$(${atuin}/bin/atuin uuid) ${atuin}/bin/atuin history list | grep shazbot") + ''; +}) diff --git a/nixos/tests/bootspec.nix b/nixos/tests/bootspec.nix new file mode 100644 index 000000000000..077dff918e0d --- /dev/null +++ b/nixos/tests/bootspec.nix @@ -0,0 +1,170 @@ +{ system ? builtins.currentSystem, + config ? {}, + pkgs ? import ../.. { inherit system config; } +}: + +with import ../lib/testing-python.nix { inherit system pkgs; }; +with pkgs.lib; + +let + baseline = { + virtualisation.useBootLoader = true; + }; + grub = { + boot.loader.grub.enable = true; + }; + systemd-boot = { + boot.loader.systemd-boot.enable = true; + }; + uefi = { + virtualisation.useEFIBoot = true; + boot.loader.efi.canTouchEfiVariables = true; + boot.loader.grub.efiSupport = true; + environment.systemPackages = [ pkgs.efibootmgr ]; + }; + standard = { + boot.bootspec.enable = true; + + imports = [ + baseline + systemd-boot + uefi + ]; + }; +in +{ + basic = makeTest { + name = "systemd-boot-with-bootspec"; + meta.maintainers = with pkgs.lib.maintainers; [ raitobezarius ]; + + nodes.machine = standard; + + testScript = '' + machine.start() + machine.wait_for_unit("multi-user.target") + + machine.succeed("test -e /run/current-system/boot.json") + ''; + }; + + grub = makeTest { + name = "grub-with-bootspec"; + meta.maintainers = with pkgs.lib.maintainers; [ raitobezarius ]; + + nodes.machine = { + boot.bootspec.enable = true; + + imports = [ + baseline + grub + uefi + ]; + }; + + testScript = '' + machine.start() + machine.wait_for_unit("multi-user.target") + + machine.succeed("test -e /run/current-system/boot.json") + ''; + }; + + legacy-boot = makeTest { + name = "legacy-boot-with-bootspec"; + meta.maintainers = with pkgs.lib.maintainers; [ raitobezarius ]; + + nodes.machine = { + boot.bootspec.enable = true; + + imports = [ + baseline + grub + ]; + }; + + testScript = '' + machine.start() + machine.wait_for_unit("multi-user.target") + + machine.succeed("test -e /run/current-system/boot.json") + ''; + }; + + # Check that initrd create corresponding entries in bootspec. + initrd = makeTest { + name = "bootspec-with-initrd"; + meta.maintainers = with pkgs.lib.maintainers; [ raitobezarius ]; + + nodes.machine = { + imports = [ standard ]; + environment.systemPackages = [ pkgs.jq ]; + # It's probably the case, but we want to make it explicit here. + boot.initrd.enable = true; + }; + + testScript = '' + import json + + machine.start() + machine.wait_for_unit("multi-user.target") + + machine.succeed("test -e /run/current-system/bootspec/boot.json") + + bootspec = json.loads(machine.succeed("jq -r '.v1' /run/current-system/bootspec/boot.json")) + + assert all(key in bootspec for key in ('initrd', 'initrdSecrets')), "Bootspec should contain initrd or initrdSecrets field when initrd is enabled" + ''; + }; + + # Check that specialisations create corresponding entries in bootspec. + specialisation = makeTest { + name = "bootspec-with-specialisation"; + meta.maintainers = with pkgs.lib.maintainers; [ raitobezarius ]; + + nodes.machine = { + imports = [ standard ]; + environment.systemPackages = [ pkgs.jq ]; + specialisation.something.configuration = {}; + }; + + testScript = '' + import json + + machine.start() + machine.wait_for_unit("multi-user.target") + + machine.succeed("test -e /run/current-system/boot.json") + machine.succeed("test -e /run/current-system/specialisation/something/boot.json") + + sp_in_parent = json.loads(machine.succeed("jq -r '.v1.specialisation.something' /run/current-system/boot.json")) + sp_in_fs = json.loads(machine.succeed("cat /run/current-system/specialisation/something/boot.json")) + + assert sp_in_parent == sp_in_fs['v1'], "Bootspecs of the same specialisation are different!" + ''; + }; + + # Check that extensions are propagated. + extensions = makeTest { + name = "bootspec-with-extensions"; + meta.maintainers = with pkgs.lib.maintainers; [ raitobezarius ]; + + nodes.machine = { config, ... }: { + imports = [ standard ]; + environment.systemPackages = [ pkgs.jq ]; + boot.bootspec.extensions = { + osRelease = config.environment.etc."os-release".source; + }; + }; + + testScript = '' + machine.start() + machine.wait_for_unit("multi-user.target") + + current_os_release = machine.succeed("cat /etc/os-release") + bootspec_os_release = machine.succeed("cat $(jq -r '.v1.extensions.osRelease' /run/current-system/boot.json)") + + assert current_os_release == bootspec_os_release, "Filename referenced by extension has unexpected contents" + ''; + }; + +} diff --git a/nixos/tests/borgbackup.nix b/nixos/tests/borgbackup.nix index d3cd6c66bfeb..9afe4d537da4 100644 --- a/nixos/tests/borgbackup.nix +++ b/nixos/tests/borgbackup.nix @@ -99,6 +99,18 @@ in { environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519"; }; + sleepInhibited = { + inhibitsSleep = true; + # Blocks indefinitely while "backing up" so that we can try to suspend the local system while it's hung + dumpCommand = pkgs.writeScript "sleepInhibited" '' + cat /dev/zero + ''; + repo = remoteRepo; + encryption.mode = "none"; + startAt = [ ]; + environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519"; + }; + }; }; @@ -204,5 +216,13 @@ in { client.wait_for_unit("network.target") client.systemctl("start --wait borgbackup-job-commandFail") client.succeed("systemctl is-failed borgbackup-job-commandFail") + + with subtest("sleepInhibited"): + server.wait_for_unit("sshd.service") + client.wait_for_unit("network.target") + client.fail("systemd-inhibit --list | grep -q borgbackup") + client.systemctl("start borgbackup-job-sleepInhibited") + client.wait_until_succeeds("systemd-inhibit --list | grep -q borgbackup") + client.systemctl("stop borgbackup-job-sleepInhibited") ''; }) diff --git a/nixos/tests/cockroachdb.nix b/nixos/tests/cockroachdb.nix index d793842f0ab2..5b1e1a7dee1f 100644 --- a/nixos/tests/cockroachdb.nix +++ b/nixos/tests/cockroachdb.nix @@ -8,7 +8,7 @@ # Cluster joins that are outside this window will fail, and nodes that skew # outside the window after joining will promptly get kicked out. # -# To accomodate this, we use QEMU/virtio infrastructure and load the 'ptp_kvm' +# To accommodate this, we use QEMU/virtio infrastructure and load the 'ptp_kvm' # driver inside a guest. This driver allows the host machine to pass its clock # through to the guest as a hardware clock that appears as a Precision Time # Protocol (PTP) Clock device, generally /dev/ptp0. PTP devices can be measured diff --git a/nixos/tests/common/ec2.nix b/nixos/tests/common/ec2.nix index 64b0a91ac1f7..6ed420e0aae7 100644 --- a/nixos/tests/common/ec2.nix +++ b/nixos/tests/common/ec2.nix @@ -46,7 +46,7 @@ with pkgs.lib; # Note: we use net=169.0.0.0/8 rather than # net=169.254.0.0/16 to prevent dhcpcd from getting horribly # confused. (It would get a DHCP lease in the 169.254.* - # range, which it would then configure and prompty delete + # range, which it would then configure and promptly delete # again when it deletes link-local addresses.) Ideally we'd # turn off the DHCP server, but qemu does not have an option # to do that. diff --git a/nixos/tests/cups-pdf.nix b/nixos/tests/cups-pdf.nix new file mode 100644 index 000000000000..70d14f29e2e5 --- /dev/null +++ b/nixos/tests/cups-pdf.nix @@ -0,0 +1,40 @@ +import ./make-test-python.nix ({ lib, pkgs, ... }: { + name = "cups-pdf"; + + nodes.machine = { pkgs, ... }: { + imports = [ ./common/user-account.nix ]; + environment.systemPackages = [ pkgs.poppler_utils ]; + fonts.fonts = [ pkgs.dejavu_fonts ]; # yields more OCR-able pdf + services.printing.cups-pdf.enable = true; + services.printing.cups-pdf.instances = { + opt = {}; + noopt.installPrinter = false; + }; + hardware.printers.ensurePrinters = [{ + name = "noopt"; + model = "CUPS-PDF_noopt.ppd"; + deviceUri = "cups-pdf:/noopt"; + }]; + }; + + # we cannot check the files with pdftotext, due to + # https://github.com/alexivkin/CUPS-PDF-to-PDF/issues/7 + # we need `imagemagickBig` as it has ghostscript support + + testScript = '' + from subprocess import run + machine.wait_for_unit("cups.service") + for name in ("opt", "noopt"): + text = f"test text {name}".upper() + machine.wait_until_succeeds(f"lpstat -v {name}") + machine.succeed(f"su - alice -c 'echo -e \"\n {text}\" | lp -d {name}'") + # wait until the pdf files are completely produced and readable by alice + machine.wait_until_succeeds(f"su - alice -c 'pdfinfo /var/spool/cups-pdf-{name}/users/alice/*.pdf'") + machine.succeed(f"cp /var/spool/cups-pdf-{name}/users/alice/*.pdf /tmp/{name}.pdf") + machine.copy_from_vm(f"/tmp/{name}.pdf", "") + run(f"${pkgs.imagemagickBig}/bin/convert -density 300 $out/{name}.pdf $out/{name}.jpeg", shell=True, check=True) + assert text.encode() in run(f"${lib.getExe pkgs.tesseract} $out/{name}.jpeg stdout", shell=True, check=True, capture_output=True).stdout + ''; + + meta.maintainers = [ lib.maintainers.yarny ]; +}) diff --git a/nixos/tests/envfs.nix b/nixos/tests/envfs.nix new file mode 100644 index 000000000000..3f9cd1edb595 --- /dev/null +++ b/nixos/tests/envfs.nix @@ -0,0 +1,42 @@ +import ./make-test-python.nix ({ lib, pkgs, ... }: +let + pythonShebang = pkgs.writeScript "python-shebang" '' + #!/usr/bin/python + print("OK") + ''; + + bashShebang = pkgs.writeScript "bash-shebang" '' + #!/usr/bin/bash + echo "OK" + ''; +in +{ + name = "envfs"; + nodes.machine.services.envfs.enable = true; + + testScript = '' + start_all() + machine.wait_until_succeeds("mountpoint -q /usr/bin/") + machine.succeed( + "PATH=${pkgs.coreutils}/bin /usr/bin/cp --version", + # check fallback paths + "PATH= /usr/bin/sh --version", + "PATH= /usr/bin/env --version", + "PATH= test -e /usr/bin/sh", + "PATH= test -e /usr/bin/env", + # no stat + "! test -e /usr/bin/cp", + # also picks up PATH that was set after execve + "! /usr/bin/hello", + "PATH=${pkgs.hello}/bin /usr/bin/hello", + ) + + out = machine.succeed("PATH=${pkgs.python3}/bin ${pythonShebang}") + print(out) + assert out == "OK\n" + + out = machine.succeed("PATH=${pkgs.bash}/bin ${bashShebang}") + print(out) + assert out == "OK\n" + ''; +}) diff --git a/nixos/tests/evcc.nix b/nixos/tests/evcc.nix index 0fc261142f78..c223977a9d82 100644 --- a/nixos/tests/evcc.nix +++ b/nixos/tests/evcc.nix @@ -87,6 +87,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : with subtest("Check journal for errors"): _, output = machine.execute("journalctl -o cat -u evcc.service") + assert "FATAL" not in output assert "ERROR" not in output with subtest("Check systemd hardening"): diff --git a/nixos/tests/firewall.nix b/nixos/tests/firewall.nix index 5c434c1cb6d6..dd7551f143a5 100644 --- a/nixos/tests/firewall.nix +++ b/nixos/tests/firewall.nix @@ -1,7 +1,7 @@ # Test the firewall module. -import ./make-test-python.nix ( { pkgs, ... } : { - name = "firewall"; +import ./make-test-python.nix ( { pkgs, nftables, ... } : { + name = "firewall" + pkgs.lib.optionalString nftables "-nftables"; meta = with pkgs.lib.maintainers; { maintainers = [ eelco ]; }; @@ -11,6 +11,7 @@ import ./make-test-python.nix ( { pkgs, ... } : { { ... }: { networking.firewall.enable = true; networking.firewall.logRefusedPackets = true; + networking.nftables.enable = nftables; services.httpd.enable = true; services.httpd.adminAddr = "foo@example.org"; }; @@ -23,6 +24,7 @@ import ./make-test-python.nix ( { pkgs, ... } : { { ... }: { networking.firewall.enable = true; networking.firewall.rejectPackets = true; + networking.nftables.enable = nftables; }; attacker = @@ -35,10 +37,11 @@ import ./make-test-python.nix ( { pkgs, ... } : { testScript = { nodes, ... }: let newSystem = nodes.walled2.config.system.build.toplevel; + unit = if nftables then "nftables" else "firewall"; in '' start_all() - walled.wait_for_unit("firewall") + walled.wait_for_unit("${unit}") walled.wait_for_unit("httpd") attacker.wait_for_unit("network.target") @@ -54,12 +57,12 @@ import ./make-test-python.nix ( { pkgs, ... } : { walled.succeed("ping -c 1 attacker >&2") # If we stop the firewall, then connections should succeed. - walled.stop_job("firewall") + walled.stop_job("${unit}") attacker.succeed("curl -v http://walled/ >&2") # Check whether activation of a new configuration reloads the firewall. walled.succeed( - "${newSystem}/bin/switch-to-configuration test 2>&1 | grep -qF firewall.service" + "${newSystem}/bin/switch-to-configuration test 2>&1 | grep -qF ${unit}.service" ) ''; }) diff --git a/nixos/tests/grafana/basic.nix b/nixos/tests/grafana/basic.nix index f6566d449709..8bf4caad7fbf 100644 --- a/nixos/tests/grafana/basic.nix +++ b/nixos/tests/grafana/basic.nix @@ -25,6 +25,22 @@ let extraNodeConfs = { sqlite = {}; + socket = { config, ... }: { + services.grafana.settings.server = { + protocol = "socket"; + socket = "/run/grafana/sock"; + socket_gid = config.users.groups.nginx.gid; + }; + + users.users.grafana.extraGroups = [ "nginx" ]; + + services.nginx = { + enable = true; + recommendedProxySettings = true; + virtualHosts."_".locations."/".proxyPass = "http://unix:/run/grafana/sock"; + }; + }; + declarativePlugins = { services.grafana.declarativePlugins = [ pkgs.grafanaPlugins.grafana-clock-panel ]; }; @@ -92,6 +108,17 @@ in { ) sqlite.shutdown() + with subtest("Successful API query as admin user with sqlite db listening on socket"): + socket.wait_for_unit("grafana.service") + socket.wait_for_open_port(80) + print(socket.succeed( + "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1/api/org/users -i" + )) + socket.succeed( + "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1/api/org/users | grep admin\@localhost" + ) + socket.shutdown() + with subtest("Successful API query as admin user with postgresql db"): postgresql.wait_for_unit("grafana.service") postgresql.wait_for_unit("postgresql.service") diff --git a/nixos/tests/graphite.nix b/nixos/tests/graphite.nix index c534d45428e1..de6cd8a50e17 100644 --- a/nixos/tests/graphite.nix +++ b/nixos/tests/graphite.nix @@ -13,7 +13,7 @@ import ./make-test-python.nix ({ pkgs, ... } : ''; }; carbon.enableCache = true; - seyren.enable = false; # Implicitely requires openssl-1.0.2u which is marked insecure + seyren.enable = false; # Implicitly requires openssl-1.0.2u which is marked insecure }; }; }; diff --git a/nixos/tests/headscale.nix b/nixos/tests/headscale.nix new file mode 100644 index 000000000000..48658b5dade4 --- /dev/null +++ b/nixos/tests/headscale.nix @@ -0,0 +1,17 @@ +import ./make-test-python.nix ({ pkgs, lib, ... }: { + name = "headscale"; + meta.maintainers = with lib.maintainers; [ misterio77 ]; + + nodes.machine = { ... }: { + services.headscale.enable = true; + environment.systemPackages = [ pkgs.headscale ]; + }; + + testScript = '' + machine.wait_for_unit("headscale") + machine.wait_for_open_port(8080) + # Test basic funcionality + machine.succeed("headscale namespaces create test") + machine.succeed("headscale preauthkeys -n test create") + ''; +}) diff --git a/nixos/tests/home-assistant.nix b/nixos/tests/home-assistant.nix index 0bbeffd18cf0..8d58de75eabc 100644 --- a/nixos/tests/home-assistant.nix +++ b/nixos/tests/home-assistant.nix @@ -120,7 +120,7 @@ in { start_all() # Parse the package path out of the systemd unit, as we cannot - # access the final package, that is overriden inside the module, + # access the final package, that is overridden inside the module, # by any other means. pattern = re.compile(r"path=(?P<path>[\/a-z0-9-.]+)\/bin\/hass") response = hass.execute("systemctl show -p ExecStart home-assistant.service")[1] diff --git a/nixos/tests/initrd-network-openvpn/default.nix b/nixos/tests/initrd-network-openvpn/default.nix index bb4c41e6d709..dbb34c28eea7 100644 --- a/nixos/tests/initrd-network-openvpn/default.nix +++ b/nixos/tests/initrd-network-openvpn/default.nix @@ -91,6 +91,7 @@ import ../make-test-python.nix ({ lib, ...}: config = '' dev tun0 ifconfig 10.8.0.1 10.8.0.2 + cipher AES-256-CBC ${secretblock} ''; }; diff --git a/nixos/tests/initrd-network-openvpn/initrd.ovpn b/nixos/tests/initrd-network-openvpn/initrd.ovpn index 5926a48af00f..3ada4130e868 100644 --- a/nixos/tests/initrd-network-openvpn/initrd.ovpn +++ b/nixos/tests/initrd-network-openvpn/initrd.ovpn @@ -3,6 +3,7 @@ dev tun ifconfig 10.8.0.2 10.8.0.1 # Only force VLAN 2 through the VPN route 192.168.2.0 255.255.255.0 10.8.0.1 +cipher AES-256-CBC secret [inline] <secret> # @@ -26,4 +27,4 @@ be5a69522a8e60ccb217f8521681b45d e7811584363597599cce2040a68ac00e f2125540e0f7f4adc37cb3f0d922eeb7 -----END OpenVPN Static key V1----- -</secret> \ No newline at end of file +</secret> diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix index 9b3c8a762991..398ad8de19cf 100644 --- a/nixos/tests/installer.nix +++ b/nixos/tests/installer.nix @@ -57,7 +57,7 @@ let hardware.enableAllFirmware = lib.mkForce false; - ${replaceChars ["\n"] ["\n "] extraConfig} + ${replaceStrings ["\n"] ["\n "] extraConfig} } ''; diff --git a/nixos/tests/keymap.nix b/nixos/tests/keymap.nix index 4306a9ae2cf9..0bde21093b0a 100644 --- a/nixos/tests/keymap.nix +++ b/nixos/tests/keymap.nix @@ -64,7 +64,6 @@ let # wait for reader to be ready machine.wait_for_file("${readyFile}") - machine.sleep(1) # send all keys for key in inputs: @@ -78,9 +77,18 @@ let with open("${pkgs.writeText "tests.json" (builtins.toJSON tests)}") as json_file: tests = json.load(json_file) + # These environments used to run in the opposite order, causing the + # following error at openvt startup. + # + # openvt: Couldn't deallocate console 1 + # + # This error did not appear in successful runs. + # I don't know the exact cause, but I it seems that openvt and X are + # fighting over the virtual terminal. This does not appear to be a problem + # when the X test runs first. keymap_environments = { - "VT Keymap": "openvt -sw --", "Xorg Keymap": "DISPLAY=:0 xterm -title testterm -class testterm -fullscreen -e", + "VT Keymap": "openvt -sw --", } machine.wait_for_x() diff --git a/nixos/tests/nat.nix b/nixos/tests/nat.nix index 545eb46f2bf5..912a04deae8b 100644 --- a/nixos/tests/nat.nix +++ b/nixos/tests/nat.nix @@ -3,14 +3,16 @@ # client on the inside network, a server on the outside network, and a # router connected to both that performs Network Address Translation # for the client. -import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false, ... }: +import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false, nftables ? false, ... }: let - unit = if withFirewall then "firewall" else "nat"; + unit = if nftables then "nftables" else (if withFirewall then "firewall" else "nat"); routerBase = lib.mkMerge [ { virtualisation.vlans = [ 2 1 ]; networking.firewall.enable = withFirewall; + networking.firewall.filterForward = nftables; + networking.nftables.enable = nftables; networking.nat.internalIPs = [ "192.168.1.0/24" ]; networking.nat.externalInterface = "eth1"; } @@ -21,7 +23,8 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? ]; in { - name = "nat" + (if withFirewall then "WithFirewall" else "Standalone") + name = "nat" + (lib.optionalString nftables "Nftables") + + (if withFirewall then "WithFirewall" else "Standalone") + (lib.optionalString withConntrackHelpers "withConntrackHelpers"); meta = with pkgs.lib.maintainers; { maintainers = [ eelco rob ]; @@ -34,6 +37,7 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? { virtualisation.vlans = [ 1 ]; networking.defaultGateway = (pkgs.lib.head nodes.router.config.networking.interfaces.eth2.ipv4.addresses).address; + networking.nftables.enable = nftables; } (lib.optionalAttrs withConntrackHelpers { networking.firewall.connectionTrackingModules = [ "ftp" ]; @@ -111,7 +115,7 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? # FIXME: this should not be necessary, but nat.service is not started because # network.target is not triggered # (https://github.com/NixOS/nixpkgs/issues/16230#issuecomment-226408359) - ${lib.optionalString (!withFirewall) '' + ${lib.optionalString (!withFirewall && !nftables) '' router.succeed("systemctl start nat.service") ''} client.succeed("curl --fail http://server/ >&2") diff --git a/nixos/tests/networking-proxy.nix b/nixos/tests/networking-proxy.nix index fcb2558cf3b0..330bac2588a5 100644 --- a/nixos/tests/networking-proxy.nix +++ b/nixos/tests/networking-proxy.nix @@ -37,7 +37,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : { default-config // { networking.proxy = { - # useless because overriden by the next options + # useless because overridden by the next options default = "http://user:pass@host:port"; # advanced proxy setup httpProxy = "123-http://user:pass@http-host:port"; diff --git a/nixos/tests/nginx-globalredirect.nix b/nixos/tests/nginx-globalredirect.nix new file mode 100644 index 000000000000..5f5f4f344d82 --- /dev/null +++ b/nixos/tests/nginx-globalredirect.nix @@ -0,0 +1,24 @@ +import ./make-test-python.nix ({ pkgs, ... }: { + name = "nginx-globalredirect"; + + nodes = { + webserver = { pkgs, lib, ... }: { + services.nginx = { + enable = true; + virtualHosts.localhost = { + globalRedirect = "other.example.com"; + # Add an exception + locations."/noredirect".return = "200 'foo'"; + }; + }; + }; + }; + + testScript = '' + webserver.wait_for_unit("nginx") + webserver.wait_for_open_port(80) + + webserver.succeed("curl --fail -si http://localhost/alf | grep '^Location:.*/alf'") + webserver.fail("curl --fail -si http://localhost/noredirect | grep '^Location:'") + ''; +}) diff --git a/nixos/tests/nginx-modsecurity.nix b/nixos/tests/nginx-modsecurity.nix index 5ceee3787297..3c41da3e8d9b 100644 --- a/nixos/tests/nginx-modsecurity.nix +++ b/nixos/tests/nginx-modsecurity.nix @@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: { nodes.machine = { config, lib, pkgs, ... }: { services.nginx = { enable = true; - additionalModules = [ pkgs.nginxModules.modsecurity-nginx ]; + additionalModules = [ pkgs.nginxModules.modsecurity ]; virtualHosts.localhost = let modsecurity_conf = pkgs.writeText "modsecurity.conf" '' SecRuleEngine On diff --git a/nixos/tests/nginx.nix b/nixos/tests/nginx.nix index d9d073822a14..73f1133bd6ca 100644 --- a/nixos/tests/nginx.nix +++ b/nixos/tests/nginx.nix @@ -61,7 +61,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { specialisation.reloadWithErrorsSystem.configuration = { services.nginx.package = pkgs.nginxMainline; - services.nginx.virtualHosts."!@$$(#*%".locations."~@#*$*!)".proxyPass = ";;;"; + services.nginx.virtualHosts."hello".extraConfig = "access_log /does/not/exist.log;"; }; }; }; diff --git a/nixos/tests/nix-ld.nix b/nixos/tests/nix-ld.nix index ae5297ab87ea..8733f5b0c397 100644 --- a/nixos/tests/nix-ld.nix +++ b/nixos/tests/nix-ld.nix @@ -12,9 +12,6 @@ import ./make-test-python.nix ({ lib, pkgs, ...} : }; testScript = '' start_all() - path = "${pkgs.stdenv.cc}/nix-support/dynamic-linker" - with open(path) as f: - real_ld = f.read().strip() - machine.succeed(f"NIX_LD={real_ld} hello") + machine.succeed("hello") ''; }) diff --git a/nixos/tests/ntfy-sh.nix b/nixos/tests/ntfy-sh.nix index c0c289b904b6..9a36fcdf3922 100644 --- a/nixos/tests/ntfy-sh.nix +++ b/nixos/tests/ntfy-sh.nix @@ -1,4 +1,5 @@ import ./make-test-python.nix { + name = "ntfy-sh"; nodes.machine = { ... }: { services.ntfy-sh.enable = true; diff --git a/nixos/tests/os-prober.nix b/nixos/tests/os-prober.nix index 1c89cf8c1c67..8f3e2494047c 100644 --- a/nixos/tests/os-prober.nix +++ b/nixos/tests/os-prober.nix @@ -1,7 +1,7 @@ import ./make-test-python.nix ({pkgs, lib, ...}: let # A filesystem image with a (presumably) bootable debian - debianImage = pkgs.vmTools.diskImageFuns.debian9i386 { + debianImage = pkgs.vmTools.diskImageFuns.debian11i386 { # os-prober cannot detect systems installed on disks without a partition table # so we create the disk ourselves createRootFS = with pkgs; '' diff --git a/nixos/tests/pgadmin4-standalone.nix b/nixos/tests/pgadmin4-standalone.nix index 442570c5306b..5aa17fcb5bb9 100644 --- a/nixos/tests/pgadmin4-standalone.nix +++ b/nixos/tests/pgadmin4-standalone.nix @@ -1,5 +1,5 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: - # This is seperate from pgadmin4 since we don't want both running at once + # This is separate from pgadmin4 since we don't want both running at once { name = "pgadmin4-standalone"; diff --git a/nixos/tests/pgadmin4.nix b/nixos/tests/pgadmin4.nix index bec2554a3f04..2a2b5aaa2841 100644 --- a/nixos/tests/pgadmin4.nix +++ b/nixos/tests/pgadmin4.nix @@ -106,7 +106,7 @@ import ./make-test-python.nix ({ pkgs, lib, buildDeps ? [ ], pythonEnv ? [ ], .. && sed -i 's|driver_local.maximize_window()||' web/regression/runtests.py" ) - # Don't bother to test LDAP or kerberos authentification + # Don't bother to test LDAP or kerberos authentication with subtest("run browser test"): machine.succeed( 'cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/web \ diff --git a/nixos/tests/postgresql.nix b/nixos/tests/postgresql.nix index 7864f5d6ff32..7e0a82c38828 100644 --- a/nixos/tests/postgresql.nix +++ b/nixos/tests/postgresql.nix @@ -130,8 +130,97 @@ let ''; }; + + mk-ensure-clauses-test = postgresql-name: postgresql-package: makeTest { + name = postgresql-name; + meta = with pkgs.lib.maintainers; { + maintainers = [ zagy ]; + }; + + machine = {...}: + { + services.postgresql = { + enable = true; + package = postgresql-package; + ensureUsers = [ + { + name = "all-clauses"; + ensureClauses = { + superuser = true; + createdb = true; + createrole = true; + "inherit" = true; + login = true; + replication = true; + bypassrls = true; + }; + } + { + name = "default-clauses"; + } + ]; + }; + }; + + testScript = let + getClausesQuery = user: pkgs.lib.concatStringsSep " " + [ + "SELECT row_to_json(row)" + "FROM (" + "SELECT" + "rolsuper," + "rolinherit," + "rolcreaterole," + "rolcreatedb," + "rolcanlogin," + "rolreplication," + "rolbypassrls" + "FROM pg_roles" + "WHERE rolname = '${user}'" + ") row;" + ]; + in '' + import json + machine.start() + machine.wait_for_unit("postgresql") + + with subtest("All user permissions are set according to the ensureClauses attr"): + clauses = json.loads( + machine.succeed( + "sudo -u postgres psql -tc \"${getClausesQuery "all-clauses"}\"" + ) + ) + print(clauses) + assert clauses['rolsuper'], 'expected user with clauses to have superuser clause' + assert clauses['rolinherit'], 'expected user with clauses to have inherit clause' + assert clauses['rolcreaterole'], 'expected user with clauses to have create role clause' + assert clauses['rolcreatedb'], 'expected user with clauses to have create db clause' + assert clauses['rolcanlogin'], 'expected user with clauses to have login clause' + assert clauses['rolreplication'], 'expected user with clauses to have replication clause' + assert clauses['rolbypassrls'], 'expected user with clauses to have bypassrls clause' + + with subtest("All user permissions default when ensureClauses is not provided"): + clauses = json.loads( + machine.succeed( + "sudo -u postgres psql -tc \"${getClausesQuery "default-clauses"}\"" + ) + ) + assert not clauses['rolsuper'], 'expected user with no clauses set to have default superuser clause' + assert clauses['rolinherit'], 'expected user with no clauses set to have default inherit clause' + assert not clauses['rolcreaterole'], 'expected user with no clauses set to have default create role clause' + assert not clauses['rolcreatedb'], 'expected user with no clauses set to have default create db clause' + assert clauses['rolcanlogin'], 'expected user with no clauses set to have default login clause' + assert not clauses['rolreplication'], 'expected user with no clauses set to have default replication clause' + assert not clauses['rolbypassrls'], 'expected user with no clauses set to have default bypassrls clause' + + machine.shutdown() + ''; + }; in - (mapAttrs' (name: package: { inherit name; value=make-postgresql-test name package false;}) postgresql-versions) // { + concatMapAttrs (name: package: { + ${name} = make-postgresql-test name package false; + ${name + "-clauses"} = mk-ensure-clauses-test name package; + }) postgresql-versions + // { postgresql_11-backup-all = make-postgresql-test "postgresql_11-backup-all" postgresql-versions.postgresql_11 true; } - diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix index 8b40d7e41c00..5f50a3f87d5d 100644 --- a/nixos/tests/prometheus-exporters.nix +++ b/nixos/tests/prometheus-exporters.nix @@ -6,7 +6,7 @@ let inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest; inherit (pkgs.lib) concatStringsSep maintainers mapAttrs mkMerge - removeSuffix replaceChars singleton splitString; + removeSuffix replaceStrings singleton splitString; /* * The attrset `exporterTests` contains one attribute @@ -182,7 +182,7 @@ let enable = true; extraFlags = [ "--web.collectd-push-path /collectd" ]; }; - exporterTest = let postData = replaceChars [ "\n" ] [ "" ] '' + exporterTest = let postData = replaceStrings [ "\n" ] [ "" ] '' [{ "values":[23], "dstypes":["gauge"], @@ -1172,6 +1172,25 @@ let ''; }; + statsd = { + exporterConfig = { + enable = true; + }; + exporterTest = '' + wait_for_unit("prometheus-statsd-exporter.service") + wait_for_open_port(9102) + succeed("curl http://localhost:9102/metrics | grep 'statsd_exporter_build_info{'") + succeed( + "echo 'test.udp:1|c' > /dev/udp/localhost/9125", + "curl http://localhost:9102/metrics | grep 'test_udp 1'", + ) + succeed( + "echo 'test.tcp:1|c' > /dev/tcp/localhost/9125", + "curl http://localhost:9102/metrics | grep 'test_tcp 1'", + ) + ''; + }; + surfboard = { exporterConfig = { enable = true; @@ -1244,10 +1263,8 @@ let exporterConfig.enable = true; exporterConfig.controllers = [{ }]; exporterTest = '' - wait_for_unit("prometheus-unpoller-exporter.service") - wait_for_open_port(9130) - succeed( - "curl -sSf localhost:9130/metrics | grep 'unpoller_build_info{.\\+} 1'" + wait_until_succeeds( + 'journalctl -eu prometheus-unpoller-exporter.service -o cat | grep "Connection Error"' ) ''; }; diff --git a/nixos/tests/sourcehut.nix b/nixos/tests/sourcehut.nix index d52fbddd20f3..9caa1bcd98f5 100644 --- a/nixos/tests/sourcehut.nix +++ b/nixos/tests/sourcehut.nix @@ -35,7 +35,7 @@ let }; security.sudo.wheelNeedsPassword = false; - nix.trustedUsers = [ "root" "build" ]; + nix.settings.trusted-users = [ "root" "build" ]; documentation.nixos.enable = false; # builds.sr.ht-image-specific network settings diff --git a/nixos/tests/trafficserver.nix b/nixos/tests/trafficserver.nix index 983ded4f172e..e4557c6c50e5 100644 --- a/nixos/tests/trafficserver.nix +++ b/nixos/tests/trafficserver.nix @@ -172,6 +172,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { assert re.fullmatch(expected, out) is not None, "no matching logs" out = json.loads(ats.succeed(f"traffic_logstats -jf {access_log_path}")) + assert isinstance(out, dict) assert out["total"]["error.total"]["req"] == "0", "unexpected log stat" ''; }) diff --git a/nixos/tests/vaultwarden.nix b/nixos/tests/vaultwarden.nix index 408019666da3..c0e1d0585b93 100644 --- a/nixos/tests/vaultwarden.nix +++ b/nixos/tests/vaultwarden.nix @@ -87,6 +87,9 @@ let testRunner = pkgs.writers.writePython3Bin "test-runner" { libraries = [ pkgs.python3Packages.selenium ]; + flakeIgnore = [ + "E501" + ]; } '' from selenium.webdriver.common.by import By @@ -106,25 +109,25 @@ let wait.until(EC.title_contains("Create Account")) - driver.find_element(By.CSS_SELECTOR, 'input#email').send_keys( - '${userEmail}' + driver.find_element(By.CSS_SELECTOR, 'input#register-form_input_email').send_keys( + '${userEmail}' ) - driver.find_element(By.CSS_SELECTOR, 'input#name').send_keys( - 'A Cat' + driver.find_element(By.CSS_SELECTOR, 'input#register-form_input_name').send_keys( + 'A Cat' ) - driver.find_element(By.CSS_SELECTOR, 'input#masterPassword').send_keys( - '${userPassword}' + driver.find_element(By.CSS_SELECTOR, 'input#register-form_input_master-password').send_keys( + '${userPassword}' ) - driver.find_element(By.CSS_SELECTOR, 'input#masterPasswordRetype').send_keys( - '${userPassword}' + driver.find_element(By.CSS_SELECTOR, 'input#register-form_input_confirm-master-password').send_keys( + '${userPassword}' ) - driver.find_element(By.XPATH, "//button[contains(., 'Submit')]").click() + driver.find_element(By.XPATH, "//button[contains(., 'Create Account')]").click() wait.until_not(EC.title_contains("Create Account")) - driver.find_element(By.CSS_SELECTOR, 'input#masterPassword').send_keys( - '${userPassword}' + driver.find_element(By.CSS_SELECTOR, 'input#login_input_master-password').send_keys( + '${userPassword}' ) driver.find_element(By.XPATH, "//button[contains(., 'Log In')]").click() @@ -133,10 +136,10 @@ let driver.find_element(By.XPATH, "//button[contains(., 'Add Item')]").click() driver.find_element(By.CSS_SELECTOR, 'input#name').send_keys( - 'secrets' + 'secrets' ) driver.find_element(By.CSS_SELECTOR, 'input#loginPassword').send_keys( - '${storedPassword}' + '${storedPassword}' ) driver.find_element(By.XPATH, "//button[contains(., 'Save')]").click() @@ -161,7 +164,7 @@ let with subtest("configure the cli"): client.succeed("bw --nointeraction config server http://server") - with subtest("can't login to nonexistant account"): + with subtest("can't login to nonexistent account"): client.fail( "bw --nointeraction --raw login ${userEmail} ${userPassword}" ) diff --git a/nixos/tests/vscodium.nix b/nixos/tests/vscodium.nix index ee884cc4295d..37bb649889b4 100644 --- a/nixos/tests/vscodium.nix +++ b/nixos/tests/vscodium.nix @@ -49,8 +49,8 @@ let start_all() machine.wait_for_unit('graphical.target') - machine.wait_until_succeeds('pgrep -x codium') + codium_running.wait() with codium_running: # Wait until vscodium is visible. "File" is in the menu bar. machine.wait_for_text('Get Started') diff --git a/nixos/tests/web-apps/mastodon.nix b/nixos/tests/web-apps/mastodon.nix deleted file mode 100644 index f10cb8cdc677..000000000000 --- a/nixos/tests/web-apps/mastodon.nix +++ /dev/null @@ -1,130 +0,0 @@ -import ../make-test-python.nix ({pkgs, ...}: -let - cert = pkgs: pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } '' - openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=mastodon.local' -days 36500 - mkdir -p $out - cp key.pem cert.pem $out - ''; - - hosts = '' - 192.168.2.101 mastodon.local - ''; - -in -{ - name = "mastodon"; - meta.maintainers = with pkgs.lib.maintainers; [ erictapen izorkin turion ]; - - nodes = { - server = { pkgs, ... }: { - - virtualisation.memorySize = 2048; - - networking = { - interfaces.eth1 = { - ipv4.addresses = [ - { address = "192.168.2.101"; prefixLength = 24; } - ]; - }; - extraHosts = hosts; - firewall.allowedTCPPorts = [ 80 443 ]; - }; - - security = { - pki.certificateFiles = [ "${cert pkgs}/cert.pem" ]; - }; - - services.redis.servers.mastodon = { - enable = true; - bind = "127.0.0.1"; - port = 31637; - }; - - services.mastodon = { - enable = true; - configureNginx = true; - localDomain = "mastodon.local"; - enableUnixSocket = false; - smtp = { - createLocally = false; - fromAddress = "mastodon@mastodon.local"; - }; - extraConfig = { - EMAIL_DOMAIN_ALLOWLIST = "example.com"; - }; - }; - - services.nginx = { - virtualHosts."mastodon.local" = { - enableACME = pkgs.lib.mkForce false; - sslCertificate = "${cert pkgs}/cert.pem"; - sslCertificateKey = "${cert pkgs}/key.pem"; - }; - }; - }; - - client = { pkgs, ... }: { - environment.systemPackages = [ pkgs.jq ]; - networking = { - interfaces.eth1 = { - ipv4.addresses = [ - { address = "192.168.2.102"; prefixLength = 24; } - ]; - }; - extraHosts = hosts; - }; - - security = { - pki.certificateFiles = [ "${cert pkgs}/cert.pem" ]; - }; - }; - }; - - testScript = '' - start_all() - - server.wait_for_unit("nginx.service") - server.wait_for_unit("redis-mastodon.service") - server.wait_for_unit("postgresql.service") - server.wait_for_unit("mastodon-sidekiq.service") - server.wait_for_unit("mastodon-streaming.service") - server.wait_for_unit("mastodon-web.service") - server.wait_for_open_port(55000) - server.wait_for_open_port(55001) - - # Check that mastodon-media-auto-remove is scheduled - server.succeed("systemctl status mastodon-media-auto-remove.timer") - - # Check Mastodon version from remote client - client.succeed("curl --fail https://mastodon.local/api/v1/instance | jq -r '.version' | grep '${pkgs.mastodon.version}'") - - # Check access from remote client - client.succeed("curl --fail https://mastodon.local/about | grep 'Mastodon hosted on mastodon.local'") - client.succeed("curl --fail $(curl https://mastodon.local/api/v1/instance 2> /dev/null | jq -r .thumbnail) --output /dev/null") - - # Simple check tootctl commands - # Check Mastodon version - server.succeed("mastodon-tootctl version | grep '${pkgs.mastodon.version}'") - - # Manage accounts - server.succeed("mastodon-tootctl email_domain_blocks add example.com") - server.succeed("mastodon-tootctl email_domain_blocks list | grep example.com") - server.fail("mastodon-tootctl email_domain_blocks list | grep mastodon.local") - server.fail("mastodon-tootctl accounts create alice --email=alice@example.com") - server.succeed("mastodon-tootctl email_domain_blocks remove example.com") - server.succeed("mastodon-tootctl accounts create bob --email=bob@example.com") - server.succeed("mastodon-tootctl accounts approve bob") - server.succeed("mastodon-tootctl accounts delete bob") - - # Manage IP access - server.succeed("mastodon-tootctl ip_blocks add 192.168.0.0/16 --severity=no_access") - server.succeed("mastodon-tootctl ip_blocks export | grep 192.168.0.0/16") - server.fail("mastodon-tootctl ip_blocks export | grep 172.16.0.0/16") - client.fail("curl --fail https://mastodon.local/about") - server.succeed("mastodon-tootctl ip_blocks remove 192.168.0.0/16") - client.succeed("curl --fail https://mastodon.local/about") - - server.shutdown() - client.shutdown() - ''; -}) diff --git a/nixos/tests/web-apps/mastodon/default.nix b/nixos/tests/web-apps/mastodon/default.nix new file mode 100644 index 000000000000..411ebfcd731b --- /dev/null +++ b/nixos/tests/web-apps/mastodon/default.nix @@ -0,0 +1,9 @@ +{ system ? builtins.currentSystem, handleTestOn }: +let + supportedSystems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ]; + +in +{ + standard = handleTestOn supportedSystems ./standard.nix { inherit system; }; + remote-postgresql = handleTestOn supportedSystems ./remote-postgresql.nix { inherit system; }; +} diff --git a/nixos/tests/web-apps/mastodon/remote-postgresql.nix b/nixos/tests/web-apps/mastodon/remote-postgresql.nix new file mode 100644 index 000000000000..2fd3983e13ec --- /dev/null +++ b/nixos/tests/web-apps/mastodon/remote-postgresql.nix @@ -0,0 +1,160 @@ +import ../../make-test-python.nix ({pkgs, ...}: +let + cert = pkgs: pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } '' + openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=mastodon.local' -days 36500 + mkdir -p $out + cp key.pem cert.pem $out + ''; + + hosts = '' + 192.168.2.103 mastodon.local + ''; + +in +{ + name = "mastodon-remote-postgresql"; + meta.maintainers = with pkgs.lib.maintainers; [ erictapen izorkin turion ]; + + nodes = { + database = { + networking = { + interfaces.eth1 = { + ipv4.addresses = [ + { address = "192.168.2.102"; prefixLength = 24; } + ]; + }; + extraHosts = hosts; + firewall.allowedTCPPorts = [ 5432 ]; + }; + + services.postgresql = { + enable = true; + enableTCPIP = true; + authentication = '' + hostnossl mastodon_local mastodon_test 192.168.2.201/32 md5 + ''; + initialScript = pkgs.writeText "postgresql_init.sql" '' + CREATE ROLE mastodon_test LOGIN PASSWORD 'SoDTZcISc3f1M1LJsRLT'; + CREATE DATABASE mastodon_local TEMPLATE template0 ENCODING UTF8; + GRANT ALL PRIVILEGES ON DATABASE mastodon_local TO mastodon_test; + ''; + }; + }; + + nginx = { + networking = { + interfaces.eth1 = { + ipv4.addresses = [ + { address = "192.168.2.103"; prefixLength = 24; } + ]; + }; + extraHosts = hosts; + firewall.allowedTCPPorts = [ 80 443 ]; + }; + + security = { + pki.certificateFiles = [ "${cert pkgs}/cert.pem" ]; + }; + + services.nginx = { + enable = true; + recommendedProxySettings = true; + virtualHosts."mastodon.local" = { + root = "/var/empty"; + forceSSL = true; + enableACME = pkgs.lib.mkForce false; + sslCertificate = "${cert pkgs}/cert.pem"; + sslCertificateKey = "${cert pkgs}/key.pem"; + locations."/" = { + tryFiles = "$uri @proxy"; + }; + locations."@proxy" = { + proxyPass = "http://192.168.2.201:55001"; + proxyWebsockets = true; + }; + locations."/api/v1/streaming/" = { + proxyPass = "http://192.168.2.201:55002"; + proxyWebsockets = true; + }; + }; + }; + }; + + server = { pkgs, ... }: { + virtualisation.memorySize = 2048; + + environment = { + etc = { + "mastodon/password-posgressql-db".text = '' + SoDTZcISc3f1M1LJsRLT + ''; + }; + }; + + networking = { + interfaces.eth1 = { + ipv4.addresses = [ + { address = "192.168.2.201"; prefixLength = 24; } + ]; + }; + extraHosts = hosts; + firewall.allowedTCPPorts = [ 55001 55002 ]; + }; + + services.mastodon = { + enable = true; + configureNginx = false; + localDomain = "mastodon.local"; + enableUnixSocket = false; + database = { + createLocally = false; + host = "192.168.2.102"; + port = 5432; + name = "mastodon_local"; + user = "mastodon_test"; + passwordFile = "/etc/mastodon/password-posgressql-db"; + }; + smtp = { + createLocally = false; + fromAddress = "mastodon@mastodon.local"; + }; + extraConfig = { + BIND = "0.0.0.0"; + EMAIL_DOMAIN_ALLOWLIST = "example.com"; + RAILS_SERVE_STATIC_FILES = "true"; + TRUSTED_PROXY_IP = "192.168.2.103"; + }; + }; + }; + + client = { pkgs, ... }: { + environment.systemPackages = [ pkgs.jq ]; + networking = { + interfaces.eth1 = { + ipv4.addresses = [ + { address = "192.168.2.202"; prefixLength = 24; } + ]; + }; + extraHosts = hosts; + }; + + security = { + pki.certificateFiles = [ "${cert pkgs}/cert.pem" ]; + }; + }; + }; + + testScript = import ./script.nix { + inherit pkgs; + extraInit = '' + nginx.wait_for_unit("nginx.service") + nginx.wait_for_open_port(443) + database.wait_for_unit("postgresql.service") + database.wait_for_open_port(5432) + ''; + extraShutdown = '' + nginx.shutdown() + database.shutdown() + ''; + }; +}) diff --git a/nixos/tests/web-apps/mastodon/script.nix b/nixos/tests/web-apps/mastodon/script.nix new file mode 100644 index 000000000000..cdb1d4379b64 --- /dev/null +++ b/nixos/tests/web-apps/mastodon/script.nix @@ -0,0 +1,54 @@ +{ pkgs +, extraInit ? "" +, extraShutdown ? "" +}: + +'' + start_all() + + ${extraInit} + + server.wait_for_unit("redis-mastodon.service") + server.wait_for_unit("mastodon-sidekiq.service") + server.wait_for_unit("mastodon-streaming.service") + server.wait_for_unit("mastodon-web.service") + server.wait_for_open_port(55000) + server.wait_for_open_port(55001) + + # Check that mastodon-media-auto-remove is scheduled + server.succeed("systemctl status mastodon-media-auto-remove.timer") + + # Check Mastodon version from remote client + client.succeed("curl --fail https://mastodon.local/api/v1/instance | jq -r '.version' | grep '${pkgs.mastodon.version}'") + + # Check access from remote client + client.succeed("curl --fail https://mastodon.local/about | grep 'Mastodon hosted on mastodon.local'") + client.succeed("curl --fail $(curl https://mastodon.local/api/v1/instance 2> /dev/null | jq -r .thumbnail) --output /dev/null") + + # Simple check tootctl commands + # Check Mastodon version + server.succeed("mastodon-tootctl version | grep '${pkgs.mastodon.version}'") + + # Manage accounts + server.succeed("mastodon-tootctl email_domain_blocks add example.com") + server.succeed("mastodon-tootctl email_domain_blocks list | grep example.com") + server.fail("mastodon-tootctl email_domain_blocks list | grep mastodon.local") + server.fail("mastodon-tootctl accounts create alice --email=alice@example.com") + server.succeed("mastodon-tootctl email_domain_blocks remove example.com") + server.succeed("mastodon-tootctl accounts create bob --email=bob@example.com") + server.succeed("mastodon-tootctl accounts approve bob") + server.succeed("mastodon-tootctl accounts delete bob") + + # Manage IP access + server.succeed("mastodon-tootctl ip_blocks add 192.168.0.0/16 --severity=no_access") + server.succeed("mastodon-tootctl ip_blocks export | grep 192.168.0.0/16") + server.fail("mastodon-tootctl ip_blocks export | grep 172.16.0.0/16") + client.fail("curl --fail https://mastodon.local/about") + server.succeed("mastodon-tootctl ip_blocks remove 192.168.0.0/16") + client.succeed("curl --fail https://mastodon.local/about") + + server.shutdown() + client.shutdown() + + ${extraShutdown} +'' diff --git a/nixos/tests/web-apps/mastodon/standard.nix b/nixos/tests/web-apps/mastodon/standard.nix new file mode 100644 index 000000000000..14311afea3f7 --- /dev/null +++ b/nixos/tests/web-apps/mastodon/standard.nix @@ -0,0 +1,92 @@ +import ../../make-test-python.nix ({pkgs, ...}: +let + cert = pkgs: pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } '' + openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=mastodon.local' -days 36500 + mkdir -p $out + cp key.pem cert.pem $out + ''; + + hosts = '' + 192.168.2.101 mastodon.local + ''; + +in +{ + name = "mastodon-standard"; + meta.maintainers = with pkgs.lib.maintainers; [ erictapen izorkin turion ]; + + nodes = { + server = { pkgs, ... }: { + + virtualisation.memorySize = 2048; + + networking = { + interfaces.eth1 = { + ipv4.addresses = [ + { address = "192.168.2.101"; prefixLength = 24; } + ]; + }; + extraHosts = hosts; + firewall.allowedTCPPorts = [ 80 443 ]; + }; + + security = { + pki.certificateFiles = [ "${cert pkgs}/cert.pem" ]; + }; + + services.redis.servers.mastodon = { + enable = true; + bind = "127.0.0.1"; + port = 31637; + }; + + services.mastodon = { + enable = true; + configureNginx = true; + localDomain = "mastodon.local"; + enableUnixSocket = false; + smtp = { + createLocally = false; + fromAddress = "mastodon@mastodon.local"; + }; + extraConfig = { + EMAIL_DOMAIN_ALLOWLIST = "example.com"; + }; + }; + + services.nginx = { + virtualHosts."mastodon.local" = { + enableACME = pkgs.lib.mkForce false; + sslCertificate = "${cert pkgs}/cert.pem"; + sslCertificateKey = "${cert pkgs}/key.pem"; + }; + }; + }; + + client = { pkgs, ... }: { + environment.systemPackages = [ pkgs.jq ]; + networking = { + interfaces.eth1 = { + ipv4.addresses = [ + { address = "192.168.2.102"; prefixLength = 24; } + ]; + }; + extraHosts = hosts; + }; + + security = { + pki.certificateFiles = [ "${cert pkgs}/cert.pem" ]; + }; + }; + }; + + testScript = import ./script.nix { + inherit pkgs; + extraInit = '' + server.wait_for_unit("nginx.service") + server.wait_for_open_port(443) + server.wait_for_unit("postgresql.service") + server.wait_for_open_port(5432) + ''; + }; +}) diff --git a/nixos/tests/web-apps/peertube.nix b/nixos/tests/web-apps/peertube.nix index ecc45bff2e2c..0e5f39c08a02 100644 --- a/nixos/tests/web-apps/peertube.nix +++ b/nixos/tests/web-apps/peertube.nix @@ -41,6 +41,9 @@ import ../make-test-python.nix ({pkgs, ...}: server = { pkgs, ... }: { environment = { etc = { + "peertube/secrets-peertube".text = '' + 063d9c60d519597acef26003d5ecc32729083965d09181ef3949200cbe5f09ee + ''; "peertube/password-posgressql-db".text = '' 0gUN0C1mgST6czvjZ8T9 ''; @@ -67,6 +70,10 @@ import ../make-test-python.nix ({pkgs, ...}: localDomain = "peertube.local"; enableWebHttps = false; + secrets = { + secretsFile = "/etc/peertube/secrets-peertube"; + }; + database = { host = "192.168.2.10"; name = "peertube_local"; diff --git a/nixos/tests/zfs.nix b/nixos/tests/zfs.nix index 29df691cecbe..3e55369daa06 100644 --- a/nixos/tests/zfs.nix +++ b/nixos/tests/zfs.nix @@ -17,103 +17,151 @@ let makeTest { name = "zfs-" + name; meta = with pkgs.lib.maintainers; { - maintainers = [ adisbladis ]; + maintainers = [ adisbladis elvishjerricco ]; }; nodes.machine = { pkgs, lib, ... }: let usersharePath = "/var/lib/samba/usershares"; in { - virtualisation.emptyDiskImages = [ 4096 ]; + virtualisation = { + emptyDiskImages = [ 4096 4096 ]; + useBootLoader = true; + useEFIBoot = true; + }; + boot.loader.systemd-boot.enable = true; + boot.loader.timeout = 0; + boot.loader.efi.canTouchEfiVariables = true; networking.hostId = "deadbeef"; boot.kernelPackages = kernelPackage; boot.supportedFilesystems = [ "zfs" ]; boot.zfs.enableUnstable = enableUnstable; - services.samba = { - enable = true; - extraConfig = '' - registry shares = yes - usershare path = ${usersharePath} - usershare allow guests = yes - usershare max shares = 100 - usershare owner only = no - ''; + environment.systemPackages = [ pkgs.parted ]; + + # /dev/disk/by-id doesn't get populated in the NixOS test framework + boot.zfs.devNodes = "/dev/disk/by-uuid"; + + specialisation.samba.configuration = { + services.samba = { + enable = true; + extraConfig = '' + registry shares = yes + usershare path = ${usersharePath} + usershare allow guests = yes + usershare max shares = 100 + usershare owner only = no + ''; + }; + systemd.services.samba-smbd.serviceConfig.ExecStartPre = + "${pkgs.coreutils}/bin/mkdir -m +t -p ${usersharePath}"; + virtualisation.fileSystems = { + "/tmp/mnt" = { + device = "rpool/root"; + fsType = "zfs"; + }; + }; }; - systemd.services.samba-smbd.serviceConfig.ExecStartPre = - "${pkgs.coreutils}/bin/mkdir -m +t -p ${usersharePath}"; - environment.systemPackages = [ pkgs.parted ]; + specialisation.encryption.configuration = { + boot.zfs.requestEncryptionCredentials = [ "automatic" ]; + virtualisation.fileSystems."/automatic" = { + device = "automatic"; + fsType = "zfs"; + }; + virtualisation.fileSystems."/manual" = { + device = "manual"; + fsType = "zfs"; + }; + virtualisation.fileSystems."/manual/encrypted" = { + device = "manual/encrypted"; + fsType = "zfs"; + options = [ "noauto" ]; + }; + }; - # Setup regular fileSystems machinery to ensure forceImportAll can be - # tested via the regular service units. - virtualisation.fileSystems = { - "/forcepool" = { + specialisation.forcepool.configuration = { + systemd.services.zfs-import-forcepool.wantedBy = lib.mkVMOverride [ "forcepool.mount" ]; + systemd.targets.zfs.wantedBy = lib.mkVMOverride []; + boot.zfs.forceImportAll = true; + virtualisation.fileSystems."/forcepool" = { device = "forcepool"; fsType = "zfs"; options = [ "noauto" ]; }; }; - - # forcepool doesn't exist at first boot, and we need to manually test - # the import after tweaking the hostId. - systemd.services.zfs-import-forcepool.wantedBy = lib.mkVMOverride []; - systemd.targets.zfs.wantedBy = lib.mkVMOverride []; - boot.zfs.forceImportAll = true; - # /dev/disk/by-id doesn't get populated in the NixOS test framework - boot.zfs.devNodes = "/dev/disk/by-uuid"; }; testScript = '' + machine.wait_for_unit("multi-user.target") machine.succeed( - "modprobe zfs", "zpool status", - "ls /dev", - "mkdir /tmp/mnt", - "udevadm settle", - "parted --script /dev/vdb mklabel msdos", - "parted --script /dev/vdb -- mkpart primary 1024M -1s", - "udevadm settle", - "zpool create rpool /dev/vdb1", - "zfs create -o mountpoint=legacy rpool/root", - # shared datasets cannot have legacy mountpoint - "zfs create rpool/shared_smb", - "mount -t zfs rpool/root /tmp/mnt", - "udevadm settle", - # wait for samba services - "systemctl is-system-running --wait", - "zfs set sharesmb=on rpool/shared_smb", - "zfs share rpool/shared_smb", - "smbclient -gNL localhost | grep rpool_shared_smb", - "umount /tmp/mnt", - "zpool destroy rpool", - "udevadm settle", + "parted --script /dev/vdc mklabel msdos", + "parted --script /dev/vdc -- mkpart primary 1024M -1s", + "parted --script /dev/vdd mklabel msdos", + "parted --script /dev/vdd -- mkpart primary 1024M -1s", ) - machine.succeed( - 'echo password | zpool create -o altroot="/tmp/mnt" ' - + "-O encryption=aes-256-gcm -O keyformat=passphrase rpool /dev/vdb1", - "zfs create -o mountpoint=legacy rpool/root", - "mount -t zfs rpool/root /tmp/mnt", - "udevadm settle", - "umount /tmp/mnt", - "zpool destroy rpool", - "udevadm settle", - ) + with subtest("sharesmb works"): + machine.succeed( + "zpool create rpool /dev/vdc1", + "zfs create -o mountpoint=legacy rpool/root", + # shared datasets cannot have legacy mountpoint + "zfs create rpool/shared_smb", + "bootctl set-default nixos-generation-1-specialisation-samba.conf", + "sync", + ) + machine.crash() + machine.wait_for_unit("multi-user.target") + machine.succeed( + "zfs set sharesmb=on rpool/shared_smb", + "zfs share rpool/shared_smb", + "smbclient -gNL localhost | grep rpool_shared_smb", + "umount /tmp/mnt", + "zpool destroy rpool", + ) + + with subtest("encryption works"): + machine.succeed( + 'echo password | zpool create -O mountpoint=legacy ' + + "-O encryption=aes-256-gcm -O keyformat=passphrase automatic /dev/vdc1", + "zpool create -O mountpoint=legacy manual /dev/vdd1", + "echo otherpass | zfs create " + + "-o encryption=aes-256-gcm -o keyformat=passphrase manual/encrypted", + "bootctl set-default nixos-generation-1-specialisation-encryption.conf", + "sync", + "zpool export automatic", + "zpool export manual", + ) + machine.crash() + machine.start() + machine.wait_for_console_text("Starting password query on") + machine.send_console("password\n") + machine.wait_for_unit("multi-user.target") + machine.succeed( + "zfs get keystatus manual/encrypted | grep unavailable", + "echo otherpass | zfs load-key manual/encrypted", + "systemctl start manual-encrypted.mount", + "umount /automatic /manual/encrypted /manual", + "zpool destroy automatic", + "zpool destroy manual", + ) with subtest("boot.zfs.forceImportAll works"): machine.succeed( "rm /etc/hostid", "zgenhostid deadcafe", - "zpool create forcepool /dev/vdb1 -O mountpoint=legacy", + "zpool create forcepool /dev/vdc1 -O mountpoint=legacy", + "bootctl set-default nixos-generation-1-specialisation-forcepool.conf", + "rm /etc/hostid", + "sync", ) - machine.shutdown() - machine.start() - machine.succeed("udevadm settle") + machine.crash() + machine.wait_for_unit("multi-user.target") machine.fail("zpool import forcepool") machine.succeed( - "systemctl start zfs-import-forcepool.service", - "mount -t zfs forcepool /tmp/mnt", + "systemctl start forcepool.mount", + "mount | grep forcepool", ) '' + extraTest; |