summary refs log tree commit diff
path: root/nixos/modules/services
Commit message (Collapse)AuthorAge
* Revert "nginx: Format the config file"Robin Gloster2017-02-16
| | | | | | This reverts commit e362a3d5c94ba379d428fbd2cc40470719a61556. See #22883
* Merge pull request #22813 from benley/pam-kwalletThomas Tuegel2017-02-16
|\ | | | | nixos: add optional pam_kwallet5 integration
| * pam: add optional pam_kwallet5 integrationBenjamin Staffin2017-02-16
| |
* | Fix typo introduced by #22677Kier Davis2017-02-15
| |
* | nixos/geoip-updater: run as user 'geoip' instead of 'nobody'Bjørn Forsman2017-02-15
|/ | | | That way 'nobody' is prevented from messing with the databases.
* prometheus.blackboxExporter service: add CAP_NET_RAWFranz Pletz2017-02-15
| | | | | The blackbox-exporter for prometheus needs CAP_NET_RAW for sending icmp probes.
* nixos/cron: unbreak since new security.wrapperBjørn Forsman2017-02-15
|
* nixos/atd: unbreak after new security.wrappersBjørn Forsman2017-02-15
| | | | | * convert list -> attrset * 'atd' doesn't exist, 'at' does
* Revert "nix-daemon: default useSandbox to true"Graham Christensen2017-02-14
| | | | This reverts commit d0a086770a1be8c1f3175c195587052c5a5bfe1c.
* Merge pull request #22767 from grahamc/sandbox-by-defaultGraham Christensen2017-02-14
|\ | | | | nix-daemon: default useSandbox to true
| * nix-daemon: default useSandbox to trueGraham Christensen2017-02-13
| |
* | Merging against upstream masterParnell Springmeyer2017-02-13
|\|
| * nixos/grafana: Don't print password warning if no password has been setRickard Nilsson2017-02-13
| |
| * ssm-agent NixOS module: initDan Peebles2017-02-13
| |
| * Merge pull request #22723 from benley/fix-sessions-with-sddmGraham Christensen2017-02-12
| |\ | | | | | | Fix sessions with sddm.
| | * Fix sessions with sddm.Karn Kallio2017-02-12
| | |
| * | gitlab service: fix database creationFranz Pletz2017-02-13
| |/ | | | | | | | | Providing custom a username and database name was broken. They were hardcoded to "gitlab".
| * virtualbox: force xorg-server-1.18 for nowVladimír Čunát2017-02-12
| | | | | | | | This is getting a little hacky, but hopefully it won't break anything.
| * fix systemd.services.kube-proxy to use correct extraOptsgeorgewhewell2017-02-12
| |
| * nixos/geoip-updater: new serviceBjørn Forsman2017-02-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The GeoIP databases from MaxMind have no stable URLs and change every month (or so). Our current method of packaging these database in Nix and playing catch-up with ever-changing file hashes is a bad idea. For instance, it makes it impossible to realize old NixOS configurations. This patch adds a NixOS service that periodically updates the GeoIP databases in /var/lib/geoip-databases. Moving NixOS modules over can be done in later patches. I tried adding MD5 check, but not all databases have them, so i skipped it. We are downloading over HTTPS though, it should be good. I also tried adding zip support, but the first zip file I extracted had a different filename inside than the archive name, which breaks an assumption in this service, so I skipped that too. Changes v9 -> v10: - Pass "--max-time" to curl to set upper bound on downloads (ensures no indefinite hanging if there's problem with networking). Timeout for network connectivity check: 60s. Timeout for geoip database (each): 15m. Changes v8 -> v9: - Mention the random timer delay in the documentation for the 'interval' option. Changes v7 -> v8: - Add "RemainAfterExit=true" for the setup service, so it won't be restarted needlessly. (Thanks @danbst!) Changes v6 -> v7: - Add --skip-existing flag to geoip-updater, which skips updating existing database files. Pass that flag when we run the service on boot (and on any NixOS configuration change). (IMHO, this is somewhat a workaround for systemd persistent timers not being triggered immediately when a timer has never expired before. But it does have the nice side effect of ensuring that the installed databases always correspond to the configured ones, since the service is now always run after configuration changes.) Changes v5 -> v6: - Update database files atomically (per DB) - If a database is removed from the configuration, it'll be removed from /var/lib/geoip-databases too (on next run). - Add NixOS module assertion so that if user inputs non- .gz or .xz file there will be a build time error instead of runtime. - Run updater as user "nobody" instead of "root". - Rename NixOS service from "geoip-databases" to "geoip-updater". - Drop RemainAfterExit, or else the timer won't trigger the unit. - Bring back "curl --fail", or else we won't catch and log curl failures. Changes v4 -> v5: - Add "GeoLite2-City.mmdb.gz" to default database list. Changes v3 -> v4: - Remove unneeded geoip-updater-setup.service after adding 'wantedBy = [ "multi-user.target" ]' directly to geoip-updater.service - Drop unneeded "Service" name from service descriptions. Changes v2 -> v3: - Network may be down when starting from a cold boot, so try a few times. Possibly, if using systemd-networkd, it'll pass on the first try. But with default DHCP on NixOS, the service is started before hostnames can be resolved and thus we need a few extra seconds. - Add error handling and mark service as failed if fatal error. - Add proper syslog log levels. - Add RandomizedDelaySec=3600 to the timer to not put high load on the MaxMind servers. Suggested by @Mic92. - Set RemainAfterExit on geoip-updater.service instead of geoip-updater-setup.service. (The latter is only a proxy that pulls in the former service). Changes v1 -> v2: From Данило Глинський (Danylo Hlynskyi) <abcz2.uprola@gmail.com>: nixos/geoip-databases: add `databases` option and fix initial setup There were two great issues when using this service: - When you just enable service, databases aren't downloaded, they are downloaded when timer triggers. Fixed this with automatic download on first system activation. - When there is no internet, updater outputs nothing to logs, which is IMO misbehavior. Fixed this with removing `--fail` option, better be explicit here.
| * nixos: drop references to kde4Graham Christensen2017-02-11
| | | | | | | | Excluding modules/programs/environment.nix for PATHand QT_PLUGIN_PATH to allow the programs to continue running.
| * kdm: drop serviceGraham Christensen2017-02-11
| |
| * Merge pull request #22642 from grahamc/kde4-deprecateGraham Christensen2017-02-11
| |\ | | | | | | kde4, kdm: mark services as deprecated
| | * kde4, kdm: mark services as deprecatedGraham Christensen2017-02-10
| | |
| * | caddy: set file descriptor limit to 8192, fixes #22454davidak2017-02-11
| |/ | | | | | | | | the value is recommended for production use a warning is produced when not set
| * modules/searx: add package option (#22636)Profpatsch2017-02-10
| | | | | | The user should be able to specify a patched version of searx.
| * nixos: update default cases from KDM/KDE4 to SDDM/KDE5Graham Christensen2017-02-09
| |
| * libreswan service: make EnvironmentFile optional (#22591)afranchuk2017-02-10
| | | | | | Recent versions of libreswan seem to omit this file, but it may be added/changed in the future. It is silly to have the service fail because a file is missing that only enriches the environment.
| * Merge pull request #22356 from Ekleog/redsocksJoachim F2017-02-09
| |\ | | | | | | Redsocks
| | * redsocks module: initializeLéo Gaspard2017-02-09
| | | | | | | | | | | | redsocks module: use separate user for redsocks daemon
| * | Merge pull request #22297 from nand0p/buildbot-0.9.3Daniel Peebles2017-02-09
| |\ \ | | | | | | | | buildbot: 0.9.0.post1 -> 0.9.3
| | * | buildbot: 0.9.0.post1 -> 0.9.3Fernando J Pando2017-02-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Fixes unneeded patching - Adds worker to build inputs now needed for tests - Replaces enableworker option with worker configuration module - Openssh required for tests - Fixes worker hardcoded paths - Tested on Nixos Unstable
| * | | nginx module: make acme group overrideable easilyFranz Pletz2017-02-08
| | | |
| * | | trezord: init at 1.2.0 (#22054)Andrew Cann2017-02-08
| | | |
| * | | moodle: Remove due to continued security issues.Graham Christensen2017-02-08
| | | |
| * | | Merge pull request #22524 from wizeman/u/chrony-imprFranz Pletz2017-02-07
| |\ \ \ | | | | | | | | | | nixos.chrony: add extraFlags config option
| | * | | nixos.chrony: remove generatecommandkey optionRicardo M. Correia2017-02-07
| | | | | | | | | | | | | | | | | | | | It's deprecated and no longer used.
| | * | | nixos.chrony: add extraFlags config optionRicardo M. Correia2017-02-07
| | | | |
| * | | | nixos: fix taskserver module to evaluate properly when keys are managed manuallyPeter Simons2017-02-07
| |/ / /
| * | | Merge pull request #22518 from wizeman/u/fix-chrony-confJörg Thalheim2017-02-07
| |\ \ \ | | |/ / | |/| | nixos.chrony: pass config file directly to daemon
| | * | nixos.chrony: pass config file directly to daemonRicardo M. Correia2017-02-07
| | | | | | | | | | | | | | | | | | | | | | | | This fixes an issue where `nixops deploy` wouldn't restart the chrony service when the chrony configuration changed, because it wouldn't detect that `/etc/chrony.conf` was a dependency of the chrony service.
| * | | nginx: Format the config fileSvein Ove Aas2017-02-07
| |/ /
| * | firewall: Fix check for rpfilter on manual-config kernelsShea Levy2017-02-06
| | |
| * | Merge pull request #22431 from abbradar/postfix-localNikolay Amiantov2017-02-06
| |\ \ | | | | | | | | postfix service: don't empty local_recipient_maps
| | * | postfix service: don't empty local_recipient_mapsNikolay Amiantov2017-02-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From Postfix documentation: With this setting, the Postfix SMTP server will not reject mail with "User unknown in local recipient table". Don't do this on systems that receive mail directly from the Internet. With today's worms and viruses, Postfix will become a backscatter source: it accepts mail for non-existent recipients and then tries to return that mail as "undeliverable" to the often forged sender address.
| * | | httpd: added serviceExpression which extends the serviceType concept -> ↵Joachim Schiele2017-02-06
| | | | | | | | | | | | | | | | allows that httpd services can live outside of nixpkgs (#22269)
| * | | Merge pull request #22175 from dancek/illumJoachim F2017-02-05
| |\ \ \ | | | | | | | | | | illum: init at 0.4
| | * | | illum: init at 0.4Hannu Hartikainen2017-02-04
| | | | |
| * | | | supplicant nixos module: Allow not specifying the configFile pathShea Levy2017-02-05
| | | | |
| * | | | Merge pull request #22353 from abbradar/bluetoothNikolay Amiantov2017-02-05
| |\ \ \ \ | | | | | | | | | | | | Bluetooth improvements
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-31 15:56:27 +0000