about summary refs log tree commit diff
path: root/nixos/modules
Commit message (Collapse)AuthorAge
* Merge pull request #39681 from pstn/gnunet-serviceRobert Schütz2018-05-11
|\ | | | | nixos/gnunet: create switch for package.
| * nixos/gnunet: create switch for package.Philipp Steinpass2018-05-11
| |
* | hostapd: remove assertion (allow 5GHz channels)Yegor Timoshenko2018-05-11
|/
* nixos/dovecot: Fix usage of dhparams optionaszlig2018-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | The pull request that added dhparams (#39507) was made at the time where the dhparams module overhaul (#39526) wasn't done yet, so it's still using the old mechanics of the module. As stated in the release notes: Module implementers should not set a specific bit size in order to let users configure it by themselves if they want to have a different bit size than the default (2048). An example usage of this would be: { config, ... }: { security.dhparams.params.myservice = {}; environment.etc."myservice.conf".text = '' dhparams = ${config.security.dhparams.params.myservice.path} ''; } Signed-off-by: aszlig <aszlig@nix.build> Cc: @qknight, @abbradar, @hrdinka, @leenaars
* nixos/testing: Fix output of systemd messagesaszlig2018-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | Regression introduced by d4468bedb52bf03ff125d721634f83604bddd589. No systemd messages are shown anymore during VM test runs, which is not very helpful if you want to find out about failures. There is a bit of a conflict between testing and the change that introduced the regression. While the mentioned commit makes sure that the primary console is tty0 for virtualisation.graphics = false, our VM tests need to have the serial console as primary console. So in order to support both, I added a new virtualisation.qemu.consoles option, which allows to specify those options using the module system. The default of this option is to use the changes that were introduced and in test-instrumentation.nix we use only the serial console the same way as before. For test-instrumentation.nix I didn't add a baudrate to the serial console because I can't find a reason on top of my head why it should need it. There also wasn't a reason stated when that was introduced in 7499e4a5b917227696b7292ae1bd728d6b1978b0. Signed-off-by: aszlig <aszlig@nix.build> Cc: @flokli, @dezgeg, @edolstra
* Merge pull request #39099 from teto/qemu_agentxeji2018-05-10
|\ | | | | qemu-guest-agent: init module
| * qemu-guest-agent: init moduleMatthieu Coudron2018-04-27
| | | | | | | | | | | | | | Allow out of band communication between qemu VMs and the host. Useful to retrieve IPs of VMs from the host (for instance when libvirt can't analyze DHCP requests because VMs are configured with static addresses or when there is connectivity default).
* | Merge pull request #39671 from johanot/keepalived-vrrpInstanceTrackingSarah Brofeldt2018-05-09
|\ \ | | | | | | nixos/keepalived: Implemented vrrp-instance track scripts and track interfaces
| * | nixos/keepalived: Implemented vrrp-instance tracking scripts and interfaces.Johan Thomsen2018-05-08
| | | | | | | | | | | | | | | Tracking scripts in particular, cannot be included in extraOpts, because script declaration has to be above script usage in keepalived.conf. Changes are fully backward compatible.
* | | Merge pull request #40052 from flokli/input_leds-docMatthew Justin Bauer2018-05-09
|\ \ \ | | | | | | | | modules/system/boot/luksroot: remove comment about input_leds for caps lock
| * | | modules/system/boot/luksroot: remove comment about input_leds for caps lockFlorian Klink2018-05-07
| | | | | | | | | | | | | | | | | | | | Since f2a9f9aeab5016d28ab4bcf6da81924ceecdd676, we already load "input_leds", so this comment isn't useful anymore.
* | | | base profile: add mkpasswd to system packagesNikolay Amiantov2018-05-09
| | | | | | | | | | | | | | | | Allows the user to generate password hashes for the installed system easier.
* | | | nginx module: add upstream extraConfigNikolay Amiantov2018-05-08
| | | |
* | | | dovecot2: added ssl_dh using security.dhparamsJoachim Schiele2018-05-08
| | | | | | | | | | | | | | | | | | | | The 18.03 channel includes dovecot 2.3, which requires ssl_dh to be set. -> fixes https://github.com/nixcloud/nixcloud-webservices/issues/21
* | | | NetworkManager: add noDns optionjD91mZM22018-05-08
| |/ / |/| |
* | | Merge pull request #39526 (improve dhparams)aszlig2018-05-08
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This introduces an option that allows us to turn off stateful generation of Diffie-Hellman parameters, which in some way is still "stateful" as the generated DH params file is non-deterministic. However what we can avoid with this is to have an increased surface for failures during system startup, because generation of the parameters is done during build-time. Aside from adding a NixOS VM test it also restructures the type of the security.dhparams.params option, so that it's a submodule. A new defaultBitSize option is also there to allow users to set a system-wide default. I added a release notes entry that described what has changed and also included a few notes for module developers using this module, as the first usage already popped up in NixOS/nixpkgs#39507. Thanks to @Ekleog and @abbradar for reviewing.
| * | | nixos/dhparams: Add a defaultBitSize optionaszlig2018-05-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows to set the default bit size for all the Diffie-Hellman parameters defined in security.dhparams.params and it's particularly useful so that we can set it to a very low value in tests (so it doesn't take ages to generate). Regardless for the use in testing, this also has an impact in production systems if the owner wants to set all of them to a different size than 2048, they don't need to set it individually for every params that are set. I've added a subtest to the "dhparams" NixOS test to ensure this is working properly. Signed-off-by: aszlig <aszlig@nix.build>
| * | | nixos/dhparams: Set default bit size to 2048aszlig2018-04-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | @Ekleog writes in https://github.com/NixOS/nixpkgs/pull/39526: > I think a default of 4096 is maybe too much? See certbot/certbot#4973; > Let's Encrypt supposedly know what they are doing and use a > pre-generated 2048-bit DH params (and using the same DH params as > others is quite bad, even compared to lower bit size, if I correctly > remember the attacks available -- because it increases by as much the > value of breaking the group). > Basically I don't have anything personal against 4096, but fear it may > re-start the arms race: people like having "more security" than their > distributions, and having NixOS already having more security than is > actually useful (I personally don't know whether a real-size quantum > computer will come before or after our being able to break 2048-bit > keys, let alone 3072-bit ones -- see wikipedia for some numbers). > So basically, I'd have set it to 3072 in order to both decrease build > time and avoid having people setting it to 8192 and complaining about > how slow things are, but that's just my opinion. :) While he suggests is 3072 I'm using 2048 now, because it's the default of "openssl dhparam". If users want to have a higher value, they can still change it. Signed-off-by: aszlig <aszlig@nix.build>
| * | | nixos/dhparams: Clean up module expressionaszlig2018-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | First of all let's start with a clean up the multiline string indentation for descriptions, because having two indentation levels after description is a waste of screen estate. A quick survey in the form of the following also reveals that the majority of multiline strings in nixpkgs is starting the two beginning quotes in the same line: $ find -name '*.nix' -exec sed -n -e '/=$/ { n; /'\'\''/p }' {} + | wc -l 817 $ find -name '*.nix' -exec grep "= *'' *\$" {} + | wc -l 14818 The next point is to get the type, default and example attributes on top of the description because that's the way it's rendered in the manual. Most services have their enable option close to the beginning of the file, so let's move it to the top. Also, I found the script attribute for dhparams-init.service a bit hard to read as it was using string concatenation to split a "for" loop. Now for the more substantial clean ups rather than just code style: * Remove the "with lib;" at the beginning of the module, because it makes it easier to do a quick check with "nix-instantiate --parse". * Use ConditionPathExists instead of test -e for checking whether we need to generate the dhparams file. This avoids spawning a shell if the file exists already and it's probably more common that it will exist, except for the initial creation of course. * When cleaning up old dhparams file, use RemainAfterExit so that the unit won't be triggered again whenever we stop and start a service depending on it. * Capitalize systemd unit descriptions to be more in par with most other unit descriptions (also see 0c5e837b66f58265ce2b66a33d0f47a3). * Use "=" instead of "==" for conditionals using []. It's just a very small nitpick though and it will only fail for POSIX shells. Bash on the other side accepts it anyway. Signed-off-by: aszlig <aszlig@nix.build> Cc: @Ekleog
| * | | nixos/dhparams: Introduce a 'stateful' optionaszlig2018-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This option allows us to turn off stateful generation of Diffie-Hellman parameters, which in some way is still stateful as the generated DH params file is non-deterministic. However what we can avoid with this is to have an increased surface for failures during system startup, because generation of the parameters is done during build-time. Another advantage of this is that we no longer need to take care of cleaning up the files that are no longer used and in my humble opinion I would have preferred that #11505 (which puts the dhparams in the Nix store) would have been merged instead of #22634 (which we have now). Luckily we can still change that and this change gives the user the option to put the dhparams into the Nix store. Beside of the more obvious advantages pointed out here, this also effects test runtime if more services are starting to use this (for example see #39507 and #39288), because generating DH params could take a long time depending on the bit size which adds up to test runtime. If we generate the DH params in a separate derivation, subsequent test runs won't need to wait for DH params generation during bootup. Of course, tests could still mock this by force-disabling the service and adding a service or activation script that places pre-generated DH params in /var/lib/dhparams but this would make tests less readable and the workaround would have to be made for each test affected. Note that the 'stateful' option is still true by default so that we are backwards-compatible with existing systems. Signed-off-by: aszlig <aszlig@nix.build> Cc: @Ekleog, @abbradar, @fpletz
| * | | nixos/dhparams: Turn params into a submoduleaszlig2018-04-26
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We're going to implement an option which allows us to turn off stateful handling of Diffie-Hellman parameter files by putting them into the Nix store. However, modules now might need a way to reference these files, so we add a now path option to every param specified, which carries a read-only value of the path where to find the corresponding DH params file. I've also improved the description of security.dhparams.params a bit so that it uses <warning/> and <note/>. The NixOS VM test also reflects this change and checks whether the old way to specify the bit size still works. Signed-off-by: aszlig <aszlig@nix.build> Cc: @Ekleog
* | | modules/virtualisation/qemu-vm: set console baudrate to 115200Florian Klink2018-05-07
| | |
* | | modules/virtualisation/qemu-vm: always enable serial consoleFlorian Klink2018-05-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Always enable both tty and serial console, but set preferred console depending on cfg.graphical. Even in qemu graphical mode, you can switch to the serial console via Ctrl+Alt+3. With that being done, you also don't need to specify `systemd.services."serial-getty@ttyS0".enable = true;` either as described in https://nixos.wiki/wiki/Cheatsheet#Building_a_service_as_a_VM_.28for_testing.29, as systemd automatically spawns a getty on consoles passwd via cmdline. This also means, vms built by 'nixos-rebuild build-vm' can simply be run properly in nographic mode by appending `-nographic` to `result/bin/run-*-vm`, without the need to explicitly add platform-specific QEMU_KERNEL_PARAMS.
* | | virtualisation/qemu-vm.nix: remove ttysFlorian Klink2018-05-07
| | | | | | | | | | | | unused.
* | | virtualisation/qemu-vm.nix: use lib.optionalStringFlorian Klink2018-05-07
| | |
* | | Merge pull request #40054 from aszlig/nsd-root-serverChristoph Hrdinka2018-05-07
|\ \ \ | | | | | | | | nixos/nsd: Allow to configure root zone
| * | | nixos/nsd: Allow to configure root zoneaszlig2018-05-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trying to run NSD to serve the root zone, one gets the following error message: error: illegal name: '.' This is because the name of the zone is used as the derivation name for building the zone file. However, Nix doesn't allow derivation names starting with a period. So whenever the zone is "." now, the file name generated is "root" instead of ".". I also added an assertion that makes sure the user sets services.nsd.rootServer, otherwise NSD will fail at runtime because it prevents serving the root zone without an explicit compile-time option. Tested this by adding a root zone to the "nsd" NixOS VM test. Signed-off-by: aszlig <aszlig@nix.build> Cc: @hrdinka, @qknight
* | | | Merge pull request #39680 from bgamari/fix-acme-post-stopMatthew Justin Bauer2018-05-07
|\ \ \ \ | |/ / / |/| | | nixos/acme: Fix broken post-stop script
| * | | nixos/acme: Fix broken post-stop scriptBen Gamari2018-04-29
| | | | | | | | | | | | | | | | | | | | | | | | Previously the script would contain an empty `if` block (which is invalid syntax) if both `data.activationDelay == null` and `data.postRun == ""`. Fix this by adding a no-op `true`.
* | | | Merge pull request #39455 from Ekleog/matterbridge-configfileJoachim F2018-05-06
|\ \ \ \ | | | | | | | | | | matterbridge module: add configPath option as a workaround, waiting for nix encryption
| * | | | matterbridge module: add configPath option as a workaround, waiting for nix ↵Léo Gaspard2018-04-25
| | | | | | | | | | | | | | | | | | | | encryption
* | | | | nixos/matrix-synapse service: url_preview_url_blacklist fix (#40027)Tristan Helmich2018-05-06
| | | | | | | | | | | | | | | | | | | | Moved list of ip ranges to url_preview_ip_range_blacklist defaults. Fixes #40017
* | | | | Merge pull request #38622 from obadz/minidlna-modulexeji2018-05-06
|\ \ \ \ \ | | | | | | | | | | | | nixos/minidlna: add loglevel config
| * | | | | minidlna nixos module: add loglevel configobadz2018-04-09
| | | | | |
* | | | | | Merge pull request #39055 from abbradar/reload-stopxeji2018-05-05
|\ \ \ \ \ \ | | | | | | | | | | | | | | firewall service: run stop commands in reload
| * | | | | | firewall service: run stop commands in reloadNikolay Amiantov2018-04-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do cleanup of user-created additional rules. Of course it'd be much better to just use iptables-{save,restore} for declarative management, but as it's still not there...
* | | | | | | nixos/documentation: Correct use of lib.optionalDaniel Schaefer2018-05-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lib.optional returns a singleton or an empty list. Therefore the argument does not need to be wrapped in a list. An alternative patch could have used lib.optionals but seems like no more elements are going to be added to the optional list.
* | | | | | | Merge pull request #39991 from xeji/remove-fleetJaka Hudoklin2018-05-05
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | fleet, panamax: remove
| * | | | | | | fleet: remove package, module, testUli Baum2018-05-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | deprecated and unmaintained upstream
| * | | | | | | panamax: remove packages, module and testUli Baum2018-05-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | was broken and depends on (deprecated) fleet packages: panamax_api, panamax_ui
* | | | | | | | ndppd module: init (#35533)gnidorah2018-05-05
| | | | | | | |
* | | | | | | | sshguard: service creates /var/lib/sshguardbricewge2018-05-05
| | | | | | | |
* | | | | | | | Merge pull request #39938 from edef1c/net-dbus-list-unitsMatthew Justin Bauer2018-05-04
|\ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | switch-to-configuration: use Net::DBus to retrieve the list of units
| * | | | | | | | switch-to-configuration: use Net::DBus to retrieve the list of unitsedef2018-05-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This resolves the FIXME, and opens up the possibility of using more of the systemd DBus interface to make things more robust.
* | | | | | | | | restic-rest-server module: initPascal Bach2018-05-04
| |/ / / / / / / |/| | | | | | |
* | | | | | | | nix: 2.0.1 -> 2.0.2Eelco Dolstra2018-05-04
|/ / / / / / /
* | | | | | | Merge pull request #39654 from AmineChikhaoui/issue-38623Rob Vermaas2018-05-03
|\ \ \ \ \ \ \ | |_|_|_|_|_|/ |/| | | | | | GCE: pull the ssh host keys from the metadata service as expected by NixOps.
| * | | | | | barf if pulling the ssh host keys failsAmineChikhaoui2018-04-28
| | | | | | |
| * | | | | | remove the entire temporary directoryAmineChikhaoui2018-04-28
| | | | | | |
| * | | | | | pull the ssh host keys from the metadata service as expected by NixOps.AmineChikhaoui2018-04-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Issues: #38623 https://github.com/NixOS/nixops/issues/930.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-05 14:14:15 +0000