From 099712f78dad5bbd2bc7279cf0cfe67f2a25803b Mon Sep 17 00:00:00 2001 From: Gaëtan André Date: Wed, 9 Dec 2015 15:50:18 +0100 Subject: nixos-manual: fix incomplete container doc --- nixos/doc/manual/administration/declarative-containers.xml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'nixos/doc') diff --git a/nixos/doc/manual/administration/declarative-containers.xml b/nixos/doc/manual/administration/declarative-containers.xml index 228c45b0c1fe..253be80b9c4d 100644 --- a/nixos/doc/manual/administration/declarative-containers.xml +++ b/nixos/doc/manual/administration/declarative-containers.xml @@ -22,8 +22,10 @@ containers.database = If you run nixos-rebuild switch, the container will -be built and started. If the container was already running, it will be -updated in place, without rebooting. +be built. If the container was already running, it will be +updated in place, without rebooting. Container can be configured to +start automatically by setting autoStart = true +in its configuration. By default, declarative containers share the network namespace of the host, meaning that they can listen on (privileged) @@ -41,13 +43,15 @@ containers.database = This gives the container a private virtual Ethernet interface with IP address 192.168.100.11, which is hooked up to a virtual Ethernet interface on the host with IP address -192.168.100.10. (See the next section for details +192.168.100.10. (See the next section for details on container networking.) To disable the container, just remove it from configuration.nix and run nixos-rebuild switch. Note that this will not delete the root directory of -the container in /var/lib/containers. +the container in /var/lib/containers. Containers can be +destroyed using the imperative method: nixos-container destroy + foo. Declarative containers can be started and stopped using the corresponding systemd service, e.g. systemctl start -- cgit 1.4.1 From b8495e4a0485cc9421d8a19dd6a32c0dfdb55bfb Mon Sep 17 00:00:00 2001 From: Gaëtan André Date: Wed, 9 Dec 2015 21:01:47 +0100 Subject: nixos-manual: develop autoStart option for containers --- nixos/doc/manual/administration/declarative-containers.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'nixos/doc') diff --git a/nixos/doc/manual/administration/declarative-containers.xml b/nixos/doc/manual/administration/declarative-containers.xml index 253be80b9c4d..dccc8b0cb0d8 100644 --- a/nixos/doc/manual/administration/declarative-containers.xml +++ b/nixos/doc/manual/administration/declarative-containers.xml @@ -24,7 +24,7 @@ containers.database = If you run nixos-rebuild switch, the container will be built. If the container was already running, it will be updated in place, without rebooting. Container can be configured to -start automatically by setting autoStart = true +start automatically by setting containers.database.autoStart = true in its configuration. By default, declarative containers share the network namespace -- cgit 1.4.1 From 94ad6e44448db1037deec9134eb64f050668c3fa Mon Sep 17 00:00:00 2001 From: Gaëtan André Date: Thu, 10 Dec 2015 19:17:06 +0100 Subject: nixos-manual: fix grammar --- nixos/doc/manual/administration/declarative-containers.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'nixos/doc') diff --git a/nixos/doc/manual/administration/declarative-containers.xml b/nixos/doc/manual/administration/declarative-containers.xml index dccc8b0cb0d8..f3f65edcec2a 100644 --- a/nixos/doc/manual/administration/declarative-containers.xml +++ b/nixos/doc/manual/administration/declarative-containers.xml @@ -23,7 +23,7 @@ containers.database = If you run nixos-rebuild switch, the container will be built. If the container was already running, it will be -updated in place, without rebooting. Container can be configured to +updated in place, without rebooting. The container can be configured to start automatically by setting containers.database.autoStart = true in its configuration. -- cgit 1.4.1 From 1685b9d06ebe93eaaed478bde02db813fc39e4b2 Mon Sep 17 00:00:00 2001 From: Franz Pletz Date: Sat, 12 Dec 2015 16:06:24 +0100 Subject: nixos/acme: Add module documentation --- nixos/doc/manual/configuration/configuration.xml | 1 + nixos/doc/manual/default.nix | 1 + nixos/modules/security/acme.nix | 129 ++++++++++++----------- nixos/modules/security/acme.xml | 69 ++++++++++++ 4 files changed, 138 insertions(+), 62 deletions(-) create mode 100644 nixos/modules/security/acme.xml (limited to 'nixos/doc') diff --git a/nixos/doc/manual/configuration/configuration.xml b/nixos/doc/manual/configuration/configuration.xml index afffd60bc485..1e488b59343e 100644 --- a/nixos/doc/manual/configuration/configuration.xml +++ b/nixos/doc/manual/configuration/configuration.xml @@ -26,6 +26,7 @@ effect after you run nixos-rebuild. + diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix index 844cba57cd85..bd558dac971d 100644 --- a/nixos/doc/manual/default.nix +++ b/nixos/doc/manual/default.nix @@ -55,6 +55,7 @@ let cp -prd $sources/* . # */ chmod -R u+w . cp ${../../modules/services/databases/postgresql.xml} configuration/postgresql.xml + cp ${../../modules/security/acme.xml} configuration/acme.xml cp ${../../modules/misc/nixos.xml} configuration/nixos.xml ln -s ${optionsDocBook} options-db.xml echo "${version}" > version diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix index 37de46cb1a53..8f3a2ee073bb 100644 --- a/nixos/modules/security/acme.nix +++ b/nixos/modules/security/acme.nix @@ -131,67 +131,72 @@ in }; ###### implementation - config = mkIf (cfg.certs != { }) { - - systemd.services = flip mapAttrs' cfg.certs (cert: data: - let - cpath = "${cfg.directory}/${cert}"; - cmdline = [ "-v" "-d" cert "--default_root" data.webroot "--valid_min" cfg.validMin ] - ++ optionals (data.email != null) [ "--email" data.email ] - ++ concatMap (p: [ "-f" p ]) data.plugins - ++ concatLists (mapAttrsToList (name: root: [ "-d" (if root == null then name else "${name}:${root}")]) data.extraDomains); - - in nameValuePair - ("acme-${cert}") - ({ - description = "ACME cert renewal for ${cert} using simp_le"; - after = [ "network.target" ]; - serviceConfig = { - Type = "oneshot"; - SuccessExitStatus = [ "0" "1" ]; - PermissionsStartOnly = true; - User = data.user; - Group = data.group; - PrivateTmp = true; - }; - path = [ pkgs.simp_le ]; - preStart = '' - mkdir -p '${cfg.directory}' - if [ ! -d '${cpath}' ]; then - mkdir -m 700 '${cpath}' - chown '${data.user}:${data.group}' '${cpath}' - fi - ''; - script = '' - cd '${cpath}' - set +e - simp_le ${concatMapStringsSep " " (arg: escapeShellArg (toString arg)) cmdline} - EXITCODE=$? - set -e - echo "$EXITCODE" > /tmp/lastExitCode - exit "$EXITCODE" - ''; - postStop = '' - if [ -e /tmp/lastExitCode ] && [ "$(cat /tmp/lastExitCode)" = "0" ]; then - echo "Executing postRun hook..." - ${data.postRun} - fi - ''; - }) - ); - - systemd.timers = flip mapAttrs' cfg.certs (cert: data: nameValuePair - ("acme-${cert}") - ({ - description = "timer for ACME cert renewal of ${cert}"; - wantedBy = [ "timers.target" ]; - timerConfig = { - OnCalendar = cfg.renewInterval; - Unit = "acme-simp_le-${cert}.service"; - }; - }) - ); - - }; + config = mkMerge [ + (mkIf (cfg.certs != { }) { + + systemd.services = flip mapAttrs' cfg.certs (cert: data: + let + cpath = "${cfg.directory}/${cert}"; + cmdline = [ "-v" "-d" cert "--default_root" data.webroot "--valid_min" cfg.validMin ] + ++ optionals (data.email != null) [ "--email" data.email ] + ++ concatMap (p: [ "-f" p ]) data.plugins + ++ concatLists (mapAttrsToList (name: root: [ "-d" (if root == null then name else "${name}:${root}")]) data.extraDomains); + + in nameValuePair + ("acme-${cert}") + ({ + description = "ACME cert renewal for ${cert} using simp_le"; + after = [ "network.target" ]; + serviceConfig = { + Type = "oneshot"; + SuccessExitStatus = [ "0" "1" ]; + PermissionsStartOnly = true; + User = data.user; + Group = data.group; + PrivateTmp = true; + }; + path = [ pkgs.simp_le ]; + preStart = '' + mkdir -p '${cfg.directory}' + if [ ! -d '${cpath}' ]; then + mkdir -m 700 '${cpath}' + chown '${data.user}:${data.group}' '${cpath}' + fi + ''; + script = '' + cd '${cpath}' + set +e + simp_le ${concatMapStringsSep " " (arg: escapeShellArg (toString arg)) cmdline} + EXITCODE=$? + set -e + echo "$EXITCODE" > /tmp/lastExitCode + exit "$EXITCODE" + ''; + postStop = '' + if [ -e /tmp/lastExitCode ] && [ "$(cat /tmp/lastExitCode)" = "0" ]; then + echo "Executing postRun hook..." + ${data.postRun} + fi + ''; + }) + ); + + systemd.timers = flip mapAttrs' cfg.certs (cert: data: nameValuePair + ("acme-${cert}") + ({ + description = "timer for ACME cert renewal of ${cert}"; + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = cfg.renewInterval; + Unit = "acme-simp_le-${cert}.service"; + }; + }) + ); + }) + + { meta.maintainers = with lib.maintainers; [ abbradar fpletz globin ]; + meta.doc = ./acme.xml; + } + ]; } diff --git a/nixos/modules/security/acme.xml b/nixos/modules/security/acme.xml new file mode 100644 index 000000000000..e32fa72c9393 --- /dev/null +++ b/nixos/modules/security/acme.xml @@ -0,0 +1,69 @@ + + +SSL/TLS Certificates with ACME + +NixOS supports automatic domain validation & certificate +retrieval and renewal using the ACME protocol. This is currently only +implemented by and for Let's Encrypt. The alternative ACME client +simp_le is used under the hood. + +
Prerequisites + +You need to have a running HTTP server for verification. The server must +have a webroot defined that can serve +.well-known/acme-challenge. This directory must be +writeable by the user that will run the ACME client. + +For instance, this generic snippet could be used for Nginx: + + +http { + server { + server_name _; + listen 80; + listen [::]:80; + + location /.well-known/acme-challenge { + root /var/www/challenges; + } + + location / { + return 301 https://$host$request_uri; + } + } +} + + + +
+ +
Configuring + +To enable ACME certificate retrieval & renewal for a certificate for +foo.example.com, add the following in your +configuration.nix: + + +security.acme.certs."foo.example.com" = { + webroot = "/var/www/challenges"; + email = "foo@example.com"; +}; + + + +The private key key.pem and certificate +fullchain.pem will be put into +/var/lib/acme/foo.example.com. The target directory can +be configured with the option security.acme.directory. + + +Refer to for all available configuration +options for the security.acme module. + +
+ + -- cgit 1.4.1 From acf320f691b6b813ff54a662bd72edd2743ee254 Mon Sep 17 00:00:00 2001 From: Vladimír Čunát Date: Thu, 17 Dec 2015 12:29:16 +0100 Subject: nixos release notes: mention enableCtrlAltBackspace /cc #11228. --- nixos/doc/manual/release-notes/rl-unstable.xml | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'nixos/doc') diff --git a/nixos/doc/manual/release-notes/rl-unstable.xml b/nixos/doc/manual/release-notes/rl-unstable.xml index cf6e4ace4139..03eed914e278 100644 --- a/nixos/doc/manual/release-notes/rl-unstable.xml +++ b/nixos/doc/manual/release-notes/rl-unstable.xml @@ -113,6 +113,14 @@ nginx.override { extra X11 options for nvidia and nouveau drivers, respectively. + + + The Ctrl+Alt+Backspace key combination + no longer kills the X server by default. + There's a new option + allowing to enable the combination again. + + -- cgit 1.4.1 From dd89ee1c3b02a638881476df43cddf2976e78c4c Mon Sep 17 00:00:00 2001 From: Thomas Tuegel Date: Thu, 17 Dec 2015 07:21:53 -0600 Subject: release-notes: note addition of ELPA and MELPA packages --- nixos/doc/manual/release-notes/rl-unstable.xml | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'nixos/doc') diff --git a/nixos/doc/manual/release-notes/rl-unstable.xml b/nixos/doc/manual/release-notes/rl-unstable.xml index 03eed914e278..1b8efe8770e4 100644 --- a/nixos/doc/manual/release-notes/rl-unstable.xml +++ b/nixos/doc/manual/release-notes/rl-unstable.xml @@ -121,6 +121,12 @@ nginx.override { allowing to enable the combination again. + + + emacsPackagesNg now contains all packages + from the ELPA, MELPA, and MELPA Stable repositories. + + -- cgit 1.4.1 From 0f52d33f96f82bb2e981bd98b88d849ef6523613 Mon Sep 17 00:00:00 2001 From: Drew Carey Buglione Date: Sat, 26 Dec 2015 12:36:19 -0600 Subject: nixos/manual: typo --- nixos/doc/manual/installation/installing.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'nixos/doc') diff --git a/nixos/doc/manual/installation/installing.xml b/nixos/doc/manual/installation/installing.xml index 6d734cd8caca..9aec57fb6d5a 100644 --- a/nixos/doc/manual/installation/installing.xml +++ b/nixos/doc/manual/installation/installing.xml @@ -35,7 +35,7 @@ systemctl stop network-manager. The NixOS installer doesn’t do any partitioning or - formatting yet, so you need to that yourself. Use the following + formatting yet, so you need to do that yourself. Use the following commands: -- cgit 1.4.1 From 5d682e515ebba4b395dd3557a3479c732bca112b Mon Sep 17 00:00:00 2001 From: Rodney Lorrimar Date: Sun, 27 Dec 2015 13:32:44 +0000 Subject: release-notes: add pump.io as a new service --- nixos/doc/manual/release-notes/rl-unstable.xml | 1 + 1 file changed, 1 insertion(+) (limited to 'nixos/doc') diff --git a/nixos/doc/manual/release-notes/rl-unstable.xml b/nixos/doc/manual/release-notes/rl-unstable.xml index 1b8efe8770e4..f74fff83b48b 100644 --- a/nixos/doc/manual/release-notes/rl-unstable.xml +++ b/nixos/doc/manual/release-notes/rl-unstable.xml @@ -30,6 +30,7 @@ nixos.path = ./nixpkgs-unstable-2015-12-06/nixos; services/monitoring/longview.nix + services/web-apps/pump.io.nix -- cgit 1.4.1