about summary refs log tree commit diff
path: root/nixos
Commit message (Collapse)AuthorAge
...
| * | | | | | | | | | | | | nixos: Add OCI image optionsSamuel Dionne-Riel2023-09-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Follows what amazon images does.
| * | | | | | | | | | | | | nixos/oci-image: Minor cleanupSamuel Dionne-Riel2023-09-21
| | | | | | | | | | | | | |
| * | | | | | | | | | | | | maintainers/scripts/oci: Allow A1 image buildsSamuel Dionne-Riel2023-09-21
| | | | | | | | | | | | | |
| * | | | | | | | | | | | | oci-image: init scripts to build and upload imageilian2023-09-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add image configuration for Oracle Cloud Infrastructure and scripts to build and upload the image as a Custom Image.
* | | | | | | | | | | | | | Merge pull request #81460 from vcunat/p/knot-nixConfigMartin Weinelt2023-09-23
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ | |_|_|_|_|_|_|_|_|/ / / / / |/| | | | | | | | | | | | | nixos/knot: allow full configuration by nix values
| * | | | | | | | | | | | | nixos/knot: add release notes and partial compatibilityVladimír Čunát2023-09-23
| | | | | | | | | | | | | |
| * | | | | | | | | | | | | nixosTests.kea: use knot.settings for configurationMartin Weinelt2023-09-23
| | | | | | | | | | | | | |
| * | | | | | | | | | | | | nixosTests.knot: use settings formatMartin Weinelt2023-09-23
| | | | | | | | | | | | | |
| * | | | | | | | | | | | | nixos/knot: also allow config by YAML fileVladimír Čunát2023-09-23
| | | | | | | | | | | | | |
| * | | | | | | | | | | | | nixos/knot: allow full configuration by nix values (RFC 42)Vladimír Čunát2023-09-23
| | | | | | | | | | | | | |
* | | | | | | | | | | | | | Merge pull request #256906 from oddlama/fix-typesense-0.25.1Nick Cao2023-09-23
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nixos/typesense: disable MemoryDenyWriteExecute which is needed since 0.25.1
| * | | | | | | | | | | | | | nixos/typesense: disable MemoryDenyWriteExecute which is needed since 0.25.1oddlama2023-09-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | also adjust default state directory mode to allow typesense group
* | | | | | | | | | | | | | | Merge pull request #254993 from helsinki-systems/feat/stc-mount-improvementsJanne Heß2023-09-23
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nixos/switch-to-configuration: Mount improvements and a lot more test cases
| * | | | | | | | | | | | | | | nixos/switchTest: Also test swap devicesJanne Heß2023-09-22
| | | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | | nixos/switch-to-configuration: Never unmount / or /nixJanne Heß2023-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also adds a huge test for fstab handling
| * | | | | | | | | | | | | | | nixos/switchTest: Also test restarting from aborted switchesJanne Heß2023-09-13
| | | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | | nixos/switchTest: Also test systemd restartsJanne Heß2023-09-13
| | | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | | nixos/switchTest: Also test init interface versionJanne Heß2023-09-13
| | | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | | nixos/switch-to-configuration: Test more action thingsJanne Heß2023-09-13
| | | | | | | | | | | | | | | |
* | | | | | | | | | | | | | | | Merge pull request #246173 from bb2020/mbpfanAaron Andersen2023-09-23
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nixos/mbpfan: adjust defaults
| * | | | | | | | | | | | | | | | nixos/mbpfan: adjust defaultsbb20202023-09-20
| | | | | | | | | | | | | | | | |
* | | | | | | | | | | | | | | | | Merge pull request #256762 from mweinelt/matrix-synapse-network-onlineNick Cao2023-09-23
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nixos/matrix-synapse: wait for network-online.target
| * | | | | | | | | | | | | | | | | nixos/matrix-synapse: wait for network-online.targetMartin Weinelt2023-09-22
| | |_|_|_|_|_|_|_|_|/ / / / / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While network.target only guarantees that network devices have been created the `network-online.target` allows delaying service startup until after a configurable network state has been reached. This should resolve spurious failures, e.g. when synapse tries to load the discovery information for its OIDC provider from a remote host.
* | | | | | | | | | | | | | | | | Merge pull request #256491 from mkg20001/mkg/sudo-rs-resolveMaciej Krüger2023-09-23
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nixos/{sudo,-rs}: revert sudo-rs, make own module
| * | | | | | | | | | | | | | | | | release-notes: adjust to sudo-rs moduleMaciej Krüger2023-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As it's now called sudo-rs and also remove breaking changes for sudo
| * | | | | | | | | | | | | | | | | nixos/sudo-rs: add crossCompile 'fix'Maciej Krüger2023-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is just a quick fix based on pname, as I have no idea how to use slicing in the module We should instead use slicing to get the package for the host
| * | | | | | | | | | | | | | | | | nixosTests.sudo-rs: use sudo-rsMaciej Krüger2023-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As the module was renamed, we need to use the new one
| * | | | | | | | | | | | | | | | | test-driver: revert stderr nullpipeMaciej Krüger2023-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Removes 2>/dev/null which re-adds stderr output breaking execute
| * | | | | | | | | | | | | | | | | nixos/sudo-rs: initMaciej Krüger2023-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | adds a new sudo-rs module that contains sudo-rs changes removed from sudo module
| * | | | | | | | | | | | | | | | | nixos/sudo: revert sudo-rs 922926cfbc08f3e4065b51a41ebf613e59888015 (partial ↵Maciej Krüger2023-09-22
| | |_|_|_|_|/ / / / / / / / / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | #253876) This reverts the module changes that were added by the addition of sudo-rs (merge 922926cfbc08f3e4065b51a41ebf613e59888015) from the sudo module. Individual commits reverted: * 409d29ca7373 2023-08-31 | [nicoo] nixos/sudo: Split up `configFile` into individual sections * 454151375d62 2023-09-04 | [nicoo] nixos/sudo: Don't include empty sections * 8742134c8053 2023-09-04 | [nicoo] nixos/sudo: Only keep SSH_AUTH_SOCK if used for authentication * f5aadb56bed0 2023-09-07 | [nicoo] nixos/sudo: Refactor option definitions * 8b9e867ac83f 2023-09-07 | [nicoo] nixos/sudo: Refactor checks for Todd C. Miller's implemetation * 3a95964fd5ba 2023-09-07 | [nicoo] nixos/sudo: Drop useless `lib.` qualifiers * b1eab8ca53dc 2023-09-07 | [nicoo] nixos/sudo: Handle `root`'s default rule through `extraRules` * 717e51a140d6 2023-09-07 | [nicoo] nixos/sudo: Make the default rules' options configurable * c11da3911787 2023-09-07 | [nicoo] nixos/sudo: Drop the sudoers comment for `extraRules` * f0107b4f63a7 2023-09-07 | [nicoo] nixos/sudo: Check syntax using the configured package * 914bf5836974 2023-09-07 | [nicoo] nixos/{sudo, terminfo}: Adjust defaults for compatibility with `sudo-rs` * f66eb0df3b23 2023-09-07 | [nicoo] nixos/sudo: Only wrap `sudoedit` when using Miller's sudo * d63eb55e81ad 2023-09-13 | [nicoo] nixos/sudo: Generate `sudo-i` PAM config for interactive use of `sudo-rs` * d8d0b8019ff3 2023-09-13 | [nicoo] nixos/sudo: Add myself as maintainer (nbraud/nixos/sudo-rs)
* | | | | | | | | | | | | | | | | nixos/boot/rasbperrypi: add support for boot.initrd.secret with uboot (#240358)digital2023-09-23
| |_|_|_|_|/ / / / / / / / / / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Co-authored-by: digital <didev@dinid.net>
* | | | | | | | | | | | | | | | Merge pull request #176886 from hyperfekt/nonderivation_fish-completionArtturi2023-09-23
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | |_|/ / / / / / / / / / / / / / |/| | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | | nixos/fish: fix completion generation for non-derivation packageshyperfekt2023-03-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | environment.systemPackages can include any package, which means it can be a top-level store path that is not a derivation and thus will not have a name attribute - their name is extracted from the path instead.
* | | | | | | | | | | | | | | | Merge pull request #254071 from alois31/plasma-setuidK9002023-09-22
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nixos/plasma5: remove pointless setuid wrappers
| * | | | | | | | | | | | | | | | nixos/plasma5: remove pointless setuid wrappersAlois Wohlschlager2023-09-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The module for Plasma 5 contained two pointless setuid wrappers: * kscreenlocker_greet was introduced when the kscreenlocker package dropped kcheckpass. However, this was actually replaced by making proper use of PAM (which finally calls its unix_chkpwd setuid binary). kscreenlocker_greet itself was never intended to be setuid. Fortunately, this is not exploitable, because QCoreApplication immediately aborts if it detects setuid. The wrapper is still incorrect and pointless, so remove it. * start_kdeinit can optionally use setuid root or setcap CAP_SYS_RESOURCE to reduce its OOM killer score. However, with systemd startup, start_kdeinit does not get used at all. So in this case, the setuid wrapper is pointless, and so is removed as well. Ideally, the case where systemd startup is not enabled would use a capability wrapper instead, but since systemd startup is the default in NixOS and kinit is deprecated upstream for KF6, I don't bother any more.
* | | | | | | | | | | | | | | | | Merge pull request #165298 from danielfullmer/gdm-bannerArtturi2023-09-21
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | |_|_|/ / / / / / / / / / / / / / |/| | | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | | | nixos/gdm: add banner optionDaniel Fullmer2023-09-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This exposes the banner message option in GDM. Some computing environments have compliance requirements which include displaying a message to the user before logon.
* | | | | | | | | | | | | | | | | nixos/glasgow: init hardware moduleRobert Gerus2023-09-21
| | | | | | | | | | | | | | | | |
* | | | | | | | | | | | | | | | | release-notes: mention networking.networkmanager.firewallBackendMaciej Krüger2023-09-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Co-authored-by: Florian Klink <flokli@flokli.de> Co-authored-by: Lin Jian <me@linj.tech>
* | | | | | | | | | | | | | | | | nixos/networkmanager: default firewallBackend to nftables, remove ↵Sandro Jäckel2023-09-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | firewallBackend Co-authored-by: Florian Klink <flokli@flokli.de> Co-authored-by: Lin Jian <me@linj.tech>
* | | | | | | | | | | | | | | | | nixos/networkmanager: cleanup, fix example renderingSandro Jäckel2023-09-21
| | | | | | | | | | | | | | | | |
* | | | | | | | | | | | | | | | | Merge pull request #256289 from Ma27/refactor-synapse-assertionsMartin Weinelt2023-09-21
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | |_|_|_|_|_|_|_|_|_|_|_|_|/ / / / |/| | | | | | | | | | | | | | | | nixos/matrix-synapse: refactor assertions for missing listener resources
| * | | | | | | | | | | | | | | | nixos/matrix-synapse: refactor assertions for missing listener resourcesMaximilian Bosch2023-09-20
| | |_|_|_|_|_|/ / / / / / / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While reviewing other changes related to synapse I rediscovered the `lib.findFirst (...) (lib.last resources)` hack to find a listener supporting the `client` resource. We decided to keep it that way for now a while ago to avoid scope-creep on the RFC42 refactoring[1]. I wanted to take care of that and forgot about it. Anyways, I'm pretty sure that this is bogus: to register a user, you need the `client` API and not a random listener which happens to be the last one in the list. Also, you need something which serves the `client` API to have the entire synapse<->messenger interaction working (whereas `federation` is for synapse<->synapse). So I decided to error out if no `client` listener is found. A listener serving `client` can be defined in either the main synapse process or one of its workers via `services.matrix-synapse.workers`[2]. However it's generally nicer to use assertions for that because then it's possible to display multiple configuration errors at once and one doesn't have to chase one `throw` after another. I decided to also error out when using the result from `findFirst` though because module assertions aren't thrown necessarily when you evaluate a single config attribute, e.g. `config.environment.systemPackages` which depends on an existing client listener because of `registerNewMatrixUser`[3]. While at it I realized that if `settings.instance_map` is wrongly configured, e.g. by settings.instance_map = mkForce { /* no `main` in here */ } an `attribute ... missing` error will be thrown while evaluating the worker assertion. [1] https://github.com/NixOS/nixpkgs/pull/158605#discussion_r815500487 [2] This also means that `registerNewMatrixUser` will still work if you offload the entire `client` traffic to a worker. [3] And getting a useful error message is way better for debugging in such a case than `value is null while a set was expected`.
* | | | | | | | | | | | | | | | nixos/prometheus: fix blackbox exporterhexchen2023-09-21
| | | | | | | | | | | | | | | |
* | | | | | | | | | | | | | | | Merge pull request #255556 from louib/allow_disabling_openssh_root_loginPierre Bourdon2023-09-21
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nixos/virtualisation: allow configuring openssh root login on GCE
| * | | | | | | | | | | | | | | | nixos/virtualisation: allow configuring openssh root login on GCElouib2023-09-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit makes the OpenSSH option `PermitRootLogin` available to be configured by other NixOS modules when using the Google Cloud Engine (GCE) NixOS image builder. Other options like `PasswordAuthentication` were already configurable, so I think it makes sense to make `PermitRootLogin` configurable as well is order to disable it completely, for example.
* | | | | | | | | | | | | | | | | Merge pull request #192593 from jlesquembre/test-driverArtturi2023-09-21
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \
| * | | | | | | | | | | | | | | | | nixos/tests: make wait_for timeouts configurableJosé Luis Lafuente2023-09-20
| |/ / / / / / / / / / / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While working on #192270, I noticed that only some wait_for_* helper functions make the timeout configurable. I think we should be able to customize it in all cases
* | | | | | | | | | | | | | | | | Merge pull request #251597 from wietsedv/calibre-webYorick2023-09-20
|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nixos/calibre-web: add package and enableKepubify options
| * | | | | | | | | | | | | | | | | nixos/calibre-web: add package and enableKepubify optionsWietse de Vries2023-08-27
| | | | | | | | | | | | | | | | | |
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-08-07 04:17:45 +0000