summary refs log tree commit diff
path: root/nixos
Commit message (Collapse)AuthorAge
* base profile: add mkpasswd to system packagesNikolay Amiantov2018-05-09
| | | | Allows the user to generate password hashes for the installed system easier.
* nginx module: add upstream extraConfigNikolay Amiantov2018-05-08
|
* dovecot2: added ssl_dh using security.dhparamsJoachim Schiele2018-05-08
| | | | | The 18.03 channel includes dovecot 2.3, which requires ssl_dh to be set. -> fixes https://github.com/nixcloud/nixcloud-webservices/issues/21
* NetworkManager: add noDns optionjD91mZM22018-05-08
|
* Merge pull request #39526 (improve dhparams)aszlig2018-05-08
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This introduces an option that allows us to turn off stateful generation of Diffie-Hellman parameters, which in some way is still "stateful" as the generated DH params file is non-deterministic. However what we can avoid with this is to have an increased surface for failures during system startup, because generation of the parameters is done during build-time. Aside from adding a NixOS VM test it also restructures the type of the security.dhparams.params option, so that it's a submodule. A new defaultBitSize option is also there to allow users to set a system-wide default. I added a release notes entry that described what has changed and also included a few notes for module developers using this module, as the first usage already popped up in NixOS/nixpkgs#39507. Thanks to @Ekleog and @abbradar for reviewing.
| * nixos: Add release notes about dhparams changesaszlig2018-05-07
| | | | | | | | | | | | | | | | This is not only to make users aware of the changes but also to give a heads up to developers which are using the module. Specifically if they rely on security.dhparams.path only. Signed-off-by: aszlig <aszlig@nix.build>
| * nixos/dhparams: Add a defaultBitSize optionaszlig2018-05-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows to set the default bit size for all the Diffie-Hellman parameters defined in security.dhparams.params and it's particularly useful so that we can set it to a very low value in tests (so it doesn't take ages to generate). Regardless for the use in testing, this also has an impact in production systems if the owner wants to set all of them to a different size than 2048, they don't need to set it individually for every params that are set. I've added a subtest to the "dhparams" NixOS test to ensure this is working properly. Signed-off-by: aszlig <aszlig@nix.build>
| * nixos/dhparams: Set default bit size to 2048aszlig2018-04-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | @Ekleog writes in https://github.com/NixOS/nixpkgs/pull/39526: > I think a default of 4096 is maybe too much? See certbot/certbot#4973; > Let's Encrypt supposedly know what they are doing and use a > pre-generated 2048-bit DH params (and using the same DH params as > others is quite bad, even compared to lower bit size, if I correctly > remember the attacks available -- because it increases by as much the > value of breaking the group). > Basically I don't have anything personal against 4096, but fear it may > re-start the arms race: people like having "more security" than their > distributions, and having NixOS already having more security than is > actually useful (I personally don't know whether a real-size quantum > computer will come before or after our being able to break 2048-bit > keys, let alone 3072-bit ones -- see wikipedia for some numbers). > So basically, I'd have set it to 3072 in order to both decrease build > time and avoid having people setting it to 8192 and complaining about > how slow things are, but that's just my opinion. :) While he suggests is 3072 I'm using 2048 now, because it's the default of "openssl dhparam". If users want to have a higher value, they can still change it. Signed-off-by: aszlig <aszlig@nix.build>
| * nixos/dhparams: Clean up module expressionaszlig2018-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | First of all let's start with a clean up the multiline string indentation for descriptions, because having two indentation levels after description is a waste of screen estate. A quick survey in the form of the following also reveals that the majority of multiline strings in nixpkgs is starting the two beginning quotes in the same line: $ find -name '*.nix' -exec sed -n -e '/=$/ { n; /'\'\''/p }' {} + | wc -l 817 $ find -name '*.nix' -exec grep "= *'' *\$" {} + | wc -l 14818 The next point is to get the type, default and example attributes on top of the description because that's the way it's rendered in the manual. Most services have their enable option close to the beginning of the file, so let's move it to the top. Also, I found the script attribute for dhparams-init.service a bit hard to read as it was using string concatenation to split a "for" loop. Now for the more substantial clean ups rather than just code style: * Remove the "with lib;" at the beginning of the module, because it makes it easier to do a quick check with "nix-instantiate --parse". * Use ConditionPathExists instead of test -e for checking whether we need to generate the dhparams file. This avoids spawning a shell if the file exists already and it's probably more common that it will exist, except for the initial creation of course. * When cleaning up old dhparams file, use RemainAfterExit so that the unit won't be triggered again whenever we stop and start a service depending on it. * Capitalize systemd unit descriptions to be more in par with most other unit descriptions (also see 0c5e837b66f58265ce2b66a33d0f47a3). * Use "=" instead of "==" for conditionals using []. It's just a very small nitpick though and it will only fail for POSIX shells. Bash on the other side accepts it anyway. Signed-off-by: aszlig <aszlig@nix.build> Cc: @Ekleog
| * nixos/dhparams: Introduce a 'stateful' optionaszlig2018-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This option allows us to turn off stateful generation of Diffie-Hellman parameters, which in some way is still stateful as the generated DH params file is non-deterministic. However what we can avoid with this is to have an increased surface for failures during system startup, because generation of the parameters is done during build-time. Another advantage of this is that we no longer need to take care of cleaning up the files that are no longer used and in my humble opinion I would have preferred that #11505 (which puts the dhparams in the Nix store) would have been merged instead of #22634 (which we have now). Luckily we can still change that and this change gives the user the option to put the dhparams into the Nix store. Beside of the more obvious advantages pointed out here, this also effects test runtime if more services are starting to use this (for example see #39507 and #39288), because generating DH params could take a long time depending on the bit size which adds up to test runtime. If we generate the DH params in a separate derivation, subsequent test runs won't need to wait for DH params generation during bootup. Of course, tests could still mock this by force-disabling the service and adding a service or activation script that places pre-generated DH params in /var/lib/dhparams but this would make tests less readable and the workaround would have to be made for each test affected. Note that the 'stateful' option is still true by default so that we are backwards-compatible with existing systems. Signed-off-by: aszlig <aszlig@nix.build> Cc: @Ekleog, @abbradar, @fpletz
| * nixos/dhparams: Turn params into a submoduleaszlig2018-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We're going to implement an option which allows us to turn off stateful handling of Diffie-Hellman parameter files by putting them into the Nix store. However, modules now might need a way to reference these files, so we add a now path option to every param specified, which carries a read-only value of the path where to find the corresponding DH params file. I've also improved the description of security.dhparams.params a bit so that it uses <warning/> and <note/>. The NixOS VM test also reflects this change and checks whether the old way to specify the bit size still works. Signed-off-by: aszlig <aszlig@nix.build> Cc: @Ekleog
| * nixos/dhparams: Add a VM testaszlig2018-04-26
| | | | | | | | | | | | | | | | | | We're going to make changes to the dhparams module so we really want to make sure we don't break it, so having a NixOS VM test is to make sure we don't blow things up and can iterate on it. Signed-off-by: aszlig <aszlig@nix.build> Cc: @Ekleog
* | modules/virtualisation/qemu-vm: set console baudrate to 115200Florian Klink2018-05-07
| |
* | modules/virtualisation/qemu-vm: always enable serial consoleFlorian Klink2018-05-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Always enable both tty and serial console, but set preferred console depending on cfg.graphical. Even in qemu graphical mode, you can switch to the serial console via Ctrl+Alt+3. With that being done, you also don't need to specify `systemd.services."serial-getty@ttyS0".enable = true;` either as described in https://nixos.wiki/wiki/Cheatsheet#Building_a_service_as_a_VM_.28for_testing.29, as systemd automatically spawns a getty on consoles passwd via cmdline. This also means, vms built by 'nixos-rebuild build-vm' can simply be run properly in nographic mode by appending `-nographic` to `result/bin/run-*-vm`, without the need to explicitly add platform-specific QEMU_KERNEL_PARAMS.
* | virtualisation/qemu-vm.nix: remove ttysFlorian Klink2018-05-07
| | | | | | | | unused.
* | virtualisation/qemu-vm.nix: use lib.optionalStringFlorian Klink2018-05-07
| |
* | Merge pull request #40054 from aszlig/nsd-root-serverChristoph Hrdinka2018-05-07
|\ \ | | | | | | nixos/nsd: Allow to configure root zone
| * | nixos/nsd: Allow to configure root zoneaszlig2018-05-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trying to run NSD to serve the root zone, one gets the following error message: error: illegal name: '.' This is because the name of the zone is used as the derivation name for building the zone file. However, Nix doesn't allow derivation names starting with a period. So whenever the zone is "." now, the file name generated is "root" instead of ".". I also added an assertion that makes sure the user sets services.nsd.rootServer, otherwise NSD will fail at runtime because it prevents serving the root zone without an explicit compile-time option. Tested this by adding a root zone to the "nsd" NixOS VM test. Signed-off-by: aszlig <aszlig@nix.build> Cc: @hrdinka, @qknight
* | | Merge pull request #39680 from bgamari/fix-acme-post-stopMatthew Justin Bauer2018-05-07
|\ \ \ | |/ / |/| | nixos/acme: Fix broken post-stop script
| * | nixos/acme: Fix broken post-stop scriptBen Gamari2018-04-29
| | | | | | | | | | | | | | | | | | Previously the script would contain an empty `if` block (which is invalid syntax) if both `data.activationDelay == null` and `data.postRun == ""`. Fix this by adding a no-op `true`.
* | | Merge pull request #39455 from Ekleog/matterbridge-configfileJoachim F2018-05-06
|\ \ \ | | | | | | | | matterbridge module: add configPath option as a workaround, waiting for nix encryption
| * | | matterbridge module: add configPath option as a workaround, waiting for nix ↵Léo Gaspard2018-04-25
| | | | | | | | | | | | | | | | encryption
* | | | nixos/matrix-synapse service: url_preview_url_blacklist fix (#40027)Tristan Helmich2018-05-06
| | | | | | | | | | | | | | | | Moved list of ip ranges to url_preview_ip_range_blacklist defaults. Fixes #40017
* | | | Merge pull request #38622 from obadz/minidlna-modulexeji2018-05-06
|\ \ \ \ | | | | | | | | | | nixos/minidlna: add loglevel config
| * | | | minidlna nixos module: add loglevel configobadz2018-04-09
| | | | |
* | | | | Merge pull request #39055 from abbradar/reload-stopxeji2018-05-05
|\ \ \ \ \ | | | | | | | | | | | | firewall service: run stop commands in reload
| * | | | | firewall service: run stop commands in reloadNikolay Amiantov2018-04-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do cleanup of user-created additional rules. Of course it'd be much better to just use iptables-{save,restore} for declarative management, but as it's still not there...
* | | | | | Merge pull request #40000 from JohnAZoidberg/docmodule-optional-fixJoachim F2018-05-05
|\ \ \ \ \ \ | | | | | | | | | | | | | | nixos/documentation: Correct use of lib.optional
| * | | | | | nixos/documentation: Correct use of lib.optionalDaniel Schaefer2018-05-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lib.optional returns a singleton or an empty list. Therefore the argument does not need to be wrapped in a list. An alternative patch could have used lib.optionals but seems like no more elements are going to be added to the optional list.
* | | | | | | nixos/lib/make-ext4-fs: Add a sanity checkTuomas Tynkkynen2018-05-05
|/ / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I ended up with a corrupted image with the debugfs contraption once, and given I couldn't reproduce the problem I suppose that happens if the filesystem of the builder runs out of space. At least in this instance fsck could detect it, so let's add it as a sanity check.
* | | | | | Merge pull request #39991 from xeji/remove-fleetJaka Hudoklin2018-05-05
|\ \ \ \ \ \ | | | | | | | | | | | | | | fleet, panamax: remove
| * | | | | | fleet: remove package, module, testUli Baum2018-05-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | deprecated and unmaintained upstream
| * | | | | | panamax: remove packages, module and testUli Baum2018-05-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | was broken and depends on (deprecated) fleet packages: panamax_api, panamax_ui
* | | | | | | ndppd module: init (#35533)gnidorah2018-05-05
| | | | | | |
* | | | | | | sshguard: service creates /var/lib/sshguardbricewge2018-05-05
| | | | | | |
* | | | | | | Merge pull request #39938 from edef1c/net-dbus-list-unitsMatthew Justin Bauer2018-05-04
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | switch-to-configuration: use Net::DBus to retrieve the list of units
| * | | | | | | switch-to-configuration: use Net::DBus to retrieve the list of unitsedef2018-05-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This resolves the FIXME, and opens up the possibility of using more of the systemd DBus interface to make things more robust.
* | | | | | | | rl-1809: add googleearthMatthew Justin Bauer2018-05-04
| | | | | | | |
* | | | | | | | restic-rest-server module: initPascal Bach2018-05-04
| |/ / / / / / |/| | | | | |
* | | | | | | nix: 2.0.1 -> 2.0.2Eelco Dolstra2018-05-04
|/ / / / / /
* | | | | | Merge pull request #39654 from AmineChikhaoui/issue-38623Rob Vermaas2018-05-03
|\ \ \ \ \ \ | | | | | | | | | | | | | | GCE: pull the ssh host keys from the metadata service as expected by NixOps.
| * | | | | | barf if pulling the ssh host keys failsAmineChikhaoui2018-04-28
| | | | | | |
| * | | | | | remove the entire temporary directoryAmineChikhaoui2018-04-28
| | | | | | |
| * | | | | | pull the ssh host keys from the metadata service as expected by NixOps.AmineChikhaoui2018-04-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Issues: #38623 https://github.com/NixOS/nixops/issues/930.
* | | | | | | Revert "Merge pull request #28206 from edef1c/net-dbus-list-units"Matthew Bauer2018-05-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit e508f0eec142c978f6b77bf96b3887471c7fc807, reversing changes made to bead42df5d400aba2e8686988dc39ca0f1f9e131.
* | | | | | | dockerTools.pullImage: documentation and release noteAntoine Eiche2018-05-02
| | | | | | |
* | | | | | | Merge pull request #28206 from edef1c/net-dbus-list-unitsMatthew Justin Bauer2018-05-02
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | switch-to-configuration: use Net::DBus to retrieve the list of units
| * | | | | | | switch-to-configuration: use Net::DBus to retrieve the list of unitsedef2018-03-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This resolves the FIXME, and opens up the possibility of using more of the systemd DBus interface to make things more robust.
* | | | | | | | prometheus-nginx-exporter: fix bool to string coercionWilliButz2018-05-02
| | | | | | | |
* | | | | | | | Merge branch 'master' into docker-registry-enhancementsRobin Gloster2018-05-02
|\ \ \ \ \ \ \ \
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-11 11:27:35 +0000