about summary refs log tree commit diff
path: root/nixos/modules/services/databases
Commit message (Collapse)AuthorAge
* Merge pull request #272556 from SuperSandro2000/influxdb-restartNick Cao2024-01-14
|\ | | | | nixos/influxdb: restart on failure
| * nixos/influxdb: restart on failureSandro Jäckel2023-12-06
| |
* | nixos/aerospike: use NixOS option instead of custom scriptLuflosi2023-12-28
| | | | | | | | Since 2c5abd89c7e917acde9077fc4d12596e35b73e17 setting the option `boot.kernel.sysctl."net.core.rmem_max"` no longer has any downsides compared to what was previously used. Since 439350753ed2e27b0aa4fa1cfdf3ea80ea344644 the same is also true for `boot.kernel.sysctl."net.core.wmem_max"`.
* | Merge pull request #257504 from SuperSandro2000/postgres-docThomas Gerbet2023-12-15
|\ \ | | | | | | nixos/postgresql: point doc link to current like all others
| * | nixos/postgresql: point doc link to current like all othersSandro Jäckel2023-11-20
| | |
* | | nixos/postgresql: take extraPlugins packageset from package optionSandro Jäckel2023-12-08
| |/ |/| | | | | | | This allows to reuse the extraPlugins option in other context's for example an upgrade script.
* | treewide: replace `mkPackageOptionMD` with `mkPackageOption`h7x42023-11-30
| |
* | Merge pull request #261702 from h7x4/replace-mkoption-with-mkpackageoptionWeijia Wang2023-11-30
|\ \ | | | | | | treewide: use `mkPackageOption`
| * | treewide: use `mkPackageOption`h7x42023-11-27
| | | | | | | | | | | | | | | This commit replaces a lot of usages of `mkOption` with the package type, to be `mkPackageOption`, in order to reduce the amount of code.
* | | Merge pull request #268634 from tie/redis-restrict-address-familiesMario Rodas2023-11-27
|\ \ \ | |/ / |/| | nixos/redis: loosen systemd address family restrictions
| * | nixos/redis: loosen systemd address family restrictionsIvan Trubach2023-11-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not assume that port and unixSocket are the only options that affect address families used by Redis. There are other options, e.g. tls-port, and also clustered setup that are not covered by the declarative configuration. Instead of trying to selectively restrict unused address families based on the configuration, limit address families to IP and Unix sockets and let users lib.mkForce a stricter sandboxing is needed. See also https://docs.redis.com/latest/rs/networking/port-configurations/
* | | nixos/postgresql: fix mentioned settings in ensurePermissions warningsSandro2023-11-20
| |/ |/|
* | Merge pull request #266270 from Ma27/postgresql-ownership-15Ryan Lahfa2023-11-17
|\ \
| * | nixos/postgresql: improve the assertions for equality of DB user and DB nameRaito Bezarius2023-11-13
| | | | | | | | | | | | It is hard to figure out which one is offending without the database name.
| * | nixos/postgresql: restore `ensurePermissions` and strong-deprecate itRaito Bezarius2023-11-13
| | | | | | | | | | | | | | | | | | | | | | | | As it is technically a breaking change, we should at least make a strong deprecation of `ensurePermissions` and leave it in the broken state it is, for out of tree users. We give them a 6 months notice to migrate away by doing so, which is honest. In the meantime, we forbid usage of `ensurePermissions` inside of nixpkgs.
| * | nixos/postgresql: drop ensurePermissions, fix ensureUsers for postgresql15Maximilian Bosch2023-11-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes #216989 First of all, a bit of context: in PostgreSQL, newly created users don't have the CREATE privilege on the public schema of a database even with `ALL PRIVILEGES` granted via `ensurePermissions` which is how most of the DB users are currently set up "declaratively"[1]. This means e.g. a freshly deployed Nextcloud service will break early because Nextcloud itself cannot CREATE any tables in the public schema anymore. The other issue here is that `ensurePermissions` is a mere hack. It's effectively a mixture of SQL code (e.g. `DATABASE foo` is relying on how a value is substituted in a query. You'd have to parse a subset of SQL to actually know which object are permissions granted to for a user). After analyzing the existing modules I realized that in every case with a single exception[2] the UNIX system user is equal to the db user is equal to the db name and I don't see a compelling reason why people would change that in 99% of the cases. In fact, some modules would even break if you'd change that because the declarations of the system user & the db user are mixed up[3]. So I decided to go with something new which restricts the ways to use `ensure*` options rather than expanding those[4]. Effectively this means that * The DB user _must_ be equal to the DB name. * Permissions are granted via `ensureDBOwnerhip` for an attribute-set in `ensureUsers`. That way, the user is actually the owner and can perform `CREATE`. * For such a postgres user, a database must be declared in `ensureDatabases`. For anything else, a custom state management should be implemented. This can either be `initialScript`, doing it manual, outside of the module or by implementing proper state management for postgresql[5], but the current state of `ensure*` isn't even declarative, but a convergent tool which is what Nix actually claims to _not_ do. Regarding existing setups: there are effectively two options: * Leave everything as-is (assuming that system user == db user == db name): then the DB user will automatically become the DB owner and everything else stays the same. * Drop the `createDatabase = true;` declarations: nothing will change because a removal of `ensure*` statements is ignored, so it doesn't matter at all whether this option is kept after the first deploy (and later on you'd usually restore from backups anyways). The DB user isn't the owner of the DB then, but for an existing setup this is irrelevant because CREATE on the public schema isn't revoked from existing users (only not granted for new users). [1] not really declarative though because removals of these statements are simply ignored for instance: https://github.com/NixOS/nixpkgs/issues/206467 [2] `services.invidious`: I removed the `ensure*` part temporarily because it IMHO falls into the category "manage the state on your own" (see the commit message). See also https://github.com/NixOS/nixpkgs/pull/265857 [3] e.g. roundcube had `"DATABASE ${cfg.database.username}" = "ALL PRIVILEGES";` [4] As opposed to other changes that are considered a potential fix, but also add more things like collation for DBs or passwords that are _never_ touched again when changing those. [5] As suggested in e.g. https://github.com/NixOS/nixpkgs/issues/206467
* | | nixos/postgresql: document psql 15 changes (#267238)Herwig Hochleitner2023-11-17
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * nixos/postgresql: document psql 15 changes * nixos/postgresql: manual heading ids * nixos/postgresql: reword warning against initialScript Co-authored-by: Ryan Lahfa <masterancpp@gmail.com> * nixos/postgresql: wording PERMISSIONS -> PRIVILEGES Co-authored-by: Ryan Lahfa <masterancpp@gmail.com> * nixos/postgresql: document intermediate oneshot / service user method * nixos/postgresql/docs: clarify security benefits of `ensureDBOwnership` * nixos/postgresql/docs: service type -> serviceConfig.Type --------- Co-authored-by: Ryan Lahfa <masterancpp@gmail.com>
* | treewide: fix redirected and broken URLsAnthony Roussel2023-11-11
| | | | | | | | Using the script in maintainers/scripts/update-redirected-urls.sh
* | postgresql_11: removeMaximilian Bosch2023-10-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | As described in the release lifecycle docs from postgresql[1], v11 will stop receiving fixes as of Nov 9 2023. This means it's EOL throughout the entire lifetime of 23.11, so let's drop it now. A lot of examples are also referencing postgresql_11. Where it's sensible, use postgresql_15 as example now to avoid confusion. This is also handy because the LLVM 16 fix for postgresql is not available for postgresql 11 ;-) [1] https://www.postgresql.org/support/versioning/
* | nixos/ferretdb: fix broken link to documentationJulien Malka2023-10-23
| |
* | Merge master into staging-nextgithub-actions[bot]2023-10-20
|\ \
| * | nixos: fix bad mkEnableOption descriptionsBjørn Forsman2023-10-20
| | | | | | | | | | | | | | | Fix descriptions that don't account for (1) the "Whether to enable" prefix or (2) the automatically added trailing dot.
* | | Merge remote-tracking branch 'origin/master' into staging-nextAlyssa Ross2023-10-16
|\| | | | | | | | | | | | | | Conflicts: pkgs/development/python-modules/cirq-core/default.nix
| * | nixos/ferretdb: initJulien Malka2023-10-16
| | |
* | | Merge master into staging-nextgithub-actions[bot]2023-10-09
|\| |
| * | nixos/postgresql: fix `identMap` exampleMaximilian Bosch2023-10-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This was causing the following warning before when building the manual: warning: literalExample is deprecated, use literalExpression instead, or use literalMD for a non-Nix description. Rather than using `literalExpression`, nothing is used. This option expects a string and the example is a string, no special handling required. Both `literalExample` from the docbook ages and `literalExpression` now are only required if the example is a Nix expression rather than a value of the option's type.
* | | Merge branch 'master' into staging-nextJan Tojnar2023-10-06
|\| | | | | | | | | | | | | | | | | Conflicts: - pkgs/development/python-modules/xdot/default.nix between 2f244e3647bdf63b8aeca31a2f88091ffb3a9041 and 1a9a257cf753f104b59f19d14d04c148f721dfb2
| * | Merge pull request #152631 from jonringer/pgmanage-use-packageArtturi2023-10-07
| |\ \
| | * | nixos/pgmanage: use package optionJonathan Ringer2021-12-29
| | | |
* | | | Merge staging-next into staginggithub-actions[bot]2023-09-27
|\| | |
| * | | services.postgres: add initialScript exampleMatthieu Coudron2023-09-18
| | | |
| * | | services.postgresql: add identMap exampleMatthieu Coudron2023-09-18
| | | | | | | | | | | | | | | | to make things clearer
| * | | services.postgres: move the generated statement at the top of the fileMatthieu Coudron2023-09-18
| | | |
* | | | postgresql: default to v15 in 23.11Gary Guo2023-09-27
|/ / /
* | | nixos/surrealdb: incorporate beta 10 changeshappysalada2023-09-07
| | |
* | | nixos/influxdb2: add org, bucket, users and auth provisioningoddlama2023-08-23
| | |
* | | nixos/influxdb2: do not load passwordFile and tokenFile when provisioning is ↵Nick Cao2023-08-18
| | | | | | | | | | | | disabled
* | | nixos/influxdb2: add initial setup automation and nixos testsoddlama2023-08-16
| | |
* | | services.postgresql: fix exampleMatthieu Coudron2023-07-27
| | |
* | | nixos/pgbouncer: init (#241578)10001012023-07-22
| |/ |/| | | Co-authored-by: Marek Mahut <marek.mahut@gmail.com>
* | foundationdb: cleanupWeijia Wang2023-06-08
| |
* | nixos: fix typosfigsoda2023-05-19
| |
* | nixos/clickhouse: Notify systemd about successful startup (#232443)Yureka2023-05-19
| | | | | | | | https://github.com/ClickHouse/ClickHouse/pull/43400 https://github.com/ClickHouse/ClickHouse/pull/46613
* | nixos: Use checks instead of extraDependenciesRobert Hensing2023-05-11
| | | | | | | | | | | | ... as appropriate. This drops a few unnecessary store paths from the system closure.
* | nixos/lldap: initIndeedNotJames2023-04-29
| | | | | | | | Co-authored-by: LongerHV <46924944+LongerHV@users.noreply.github.com>
* | remove myself (erictapen) from packages which I don't use anymoreKerstin Humm2023-04-03
| |
* | Merge pull request #221851 from Ma27/postgresql-jit-supportSandro2023-03-29
|\ \ | | | | | | postgresql: implement opt-in JIT support
| * | nixos/postgresql: fix enableJITMaximilian Bosch2023-03-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure that JIT is actually available when using services.postgresql = { enable = true; enableJIT = true; package = pkgs.postgresql_15; }; The current behavior is counter-intuitive because the docs state that `enableJIT = true;` is sufficient even though it wasn't in that case because the declared package doesn't have the LLVM dependency. Fixed by using `package.withJIT` if `enableJIT = true;` and `package.jitSupport` is `false`. Also updated the postgresql-jit test to test for that case.
| * | postgresql: pass through JIT-enabled variant of non-JIT postgres and vice versaMaximilian Bosch2023-03-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is useful if your postgresql version is dependant on `system.stateVersion` and not pinned down manually. Then it's not necessary to find out which version exactly is in use and define `package` manually, but just stay with what NixOS provides as default: $ nix-instantiate -A postgresql /nix/store/82fzmb77mz2b787dgj7mn4a8i4f6l6sn-postgresql-14.7.drv $ nix-instantiate -A postgresql_jit /nix/store/qsjkb72fcrrfpsszrwbsi9q9wgp39m50-postgresql-14.7.drv $ nix-instantiate -A postgresql.withJIT /nix/store/qsjkb72fcrrfpsszrwbsi9q9wgp39m50-postgresql-14.7.drv $ nix-instantiate -A postgresql.withJIT.withoutJIT /nix/store/82fzmb77mz2b787dgj7mn4a8i4f6l6sn-postgresql-14.7.drv I.e. you can use postgresql with JIT (for complex queries only[1]) like this: services.postgresql = { enable = true; enableJIT = true; }; Performing a new override instead of re-using the `_jit`-variants for that has the nice property that overlays for the original package apply to the JIT-enabled variant, i.e. with import ./. { overlays = [ (self: super: { postgresql = super.postgresql.overrideAttrs (_: { fnord = "snens"; }); }) ]; }; postgresql.withJIT.fnord still gives the string `snens` whereas `postgresql_jit` doesn't have the attribute `fnord` in its derivation. [1] https://www.postgresql.org/docs/current/runtime-config-query.html#GUC-JIT-ABOVE-COST
* | | dgraph: use --prefix to prefix PATH Sandro2023-03-01
|/ / | | | | This is more robust in case PATH is empty or otherwise weird.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-14 16:05:00 +0000