Commit Graph

3682 Commits

Author SHA1 Message Date
Izorkin
1293f046b5
nixos/dhcpcd: optimize exitHook 2024-02-16 10:12:52 +03:00
Vladimír Čunát
aaca7a186f
Merge #286596: nixos/knot: add support for XDP setups 2024-02-15 09:19:59 +01:00
Michele Guerini Rocco
cd02351ae0
Merge pull request #233017 from koenw/libreswan-StateDirectory
nixos/libreswan: Use StateDirectory to setup ipsec/nss
2024-02-14 14:36:43 +01:00
Michele Guerini Rocco
dc91f91987
Merge pull request #286393 from oddlama/fix-hostapd-utf8-ssid
nixos/hostapd: fix utf8Ssid setting not properly honored
2024-02-14 14:08:46 +01:00
Martin Weinelt
ec89463a61
nixos/knot: refactor
- Stop using `with lib`
- Drop `lib.mdDoc`
- Use `escaepSystemdExecArgs` for escaping
2024-02-13 13:44:32 +01:00
Martin Weinelt
d1d8dd3e55
nixos/knot: add support for XDP setups
The Express Data Path (XDP) is a way to circumvent the traditional Linux
networking stack and instead run an eBPF program on your NIC, that makes
the decision to provide Knot with certain packets. This is way faster
and more scalable but comes at the cost of reduced introspection.

Unfortunately the `knotc conf-check` command fails hard with missing
interfaces or IP addresses configured in `xdp.listen`, so we disable it
for now, once the `xdp` config section is set. We also promote the config
check condition to a proper option, so our conditions become public
documentation, and we allow users to deal with corner cases, that we have
not thought of yet.

We follow the pre-requisites documented in the Knot 3.3 manual, and set
up the required capabilities and allow the AF_XDP address family.

But on top of that, due to our strict hardening, we found two more
requirements, that were communicated upstream while debugging this.

- There is a requirement on AF_NETLINK, likely to query for and configure
  the relevant network interface
- Running eBPF programs requires access to the `bpf` syscall, which we
  deny through the `~@privileged` configuration.

In summary We now conditionally loosen the hardening of the unit once we
detect that an XDP configuration is wanted. And since we cannot
introspect arbitrary files from the `settingsFiles` option, we expose XDP
support through the `enableXDP` toggle option on the module.
2024-02-13 13:44:31 +01:00
Lin Jian
f3a93440fb
Merge pull request #285813 from jerrita/nft-precheck-flatten
nixos/nftables: add option for flattening rulesetFile
2024-02-11 10:41:17 +08:00
Peder Bergebakken Sundt
6f55f021df
Merge pull request #287304 from ambroisie/pyload-user-group
nixos/pyload: add user/group options
2024-02-10 14:59:23 +01:00
Peder Bergebakken Sundt
5caded32fe
Merge pull request #277189 from anpin/fix/cloudflared-service
cloudflared: fixed missing configuration options
2024-02-10 12:45:08 +01:00
Silvan Mosberger
11cd405226
Merge pull request #280322 from h7x4/add-hocon-format-generator
pkgs.formats: Add HOCON format generator
2024-02-10 03:07:51 +01:00
Silvan Mosberger
5de4385620
Merge pull request #285833 from 360ied/murmur-hardened
nixos/murmur: systemd service hardening
2024-02-10 02:48:46 +01:00
github-actions[bot]
b64b4f2d6a
Merge master into staging-next 2024-02-09 18:01:06 +00:00
Will Fancher
0cf1e24f32
Merge pull request #284627 from Trundle/nftables-ordering
nixos/nftables: remove default systemd dependencies
2024-02-09 12:29:24 -05:00
h7x4
39a779e269
treewide: use formats.hocon 2024-02-09 16:40:22 +01:00
Bruno BELANYI
c14f029dae nixos/pyload: add user/group options 2024-02-08 20:27:14 +00:00
github-actions[bot]
03dd2b9470
Merge master into staging-next 2024-02-07 12:01:11 +00:00
Sergei Trofimovich
275855d632 nixos: hostapd: drop unused crda package import 2024-02-06 22:45:01 +00:00
jerrita
e686847d20
nixos/nftables: add option for flattening rulesetFile
Co-authored-by: Lin Jian <me@linj.tech>
2024-02-05 11:27:16 +08:00
360ied
11cf6ab0dd nixos/murmur: systemd service hardening
Murmur provides an official systemd service file in their repo,
which contains various service hardening settings:

c4b5858d14/auxiliary_files/config_files/mumble-server.service.in (L7)

The service configuration in nixpkgs does not include these hardening settings.

This commit adds the hardening settings to the murmur service in nixpkgs.
This drops the `systemd-analyze security` score of murmur.service from 9.2 (UNSAFE) to 2.1 (OK).
2024-02-04 21:23:34 -05:00
oddlama
b7f29692c0
nixos/hostapd: fix utf8Ssid setting not properly honored 2024-02-05 00:52:08 +01:00
Martin Weinelt
27fa02d0f1
Merge remote-tracking branch 'origin/staging-next' into staging
Conflicts:
-	pkgs/development/compilers/llvm/10/clang/default.nix
- pkgs/development/compilers/llvm/8/clang/default.nix
2024-02-01 12:25:11 +01:00
Andreas Stührk
fc6c92faf3 nixos/nftables: remove default systemd dependencies
With DefaultDependencies enabled, systemd adds "After=basic.target" to
service units. `basic.target` has a dependency on `sockets.target`, so
the `nftables` has (amongst others) the following order constraints:

* Before=network-pre.target
* After=sockets.target

Those constraints are often unsatisfiable. For example, `systemd-networkd`
has a dependency `After=network-pre.target`. When a socket unit now uses
`BindToDevice=` on a device managed by `networkd`, a timeout occurs
because `networkd` waits for `network-pre.target`, but
`network-pre.target` depends (through nftables) on `sockets.target`, but
the device to bind the socket to is never brought up, as this would
happen through `networkd`.

This is fixed by removing the implicit dependency on `basic.target`.
2024-01-31 23:26:05 +01:00
Peder Bergebakken Sundt
19159ced3e
Merge pull request #249523 from greizgh/seafile-10
Seafile 10
2024-01-31 17:13:54 +01:00
Peder Bergebakken Sundt
9118823ed3
Merge pull request #226532 from SuperSandro2000/dhcpcd
dhcpcd: change files after patching; nixos/dhcpcd: link dhcpcd.conf to /etc/ to fix dhcpcd -k
2024-01-31 16:43:54 +01:00
Yureka
a6c64fbd39
nixos/strongswan-swanctl: add includes option for secrets (#284742) 2024-01-30 12:47:33 +01:00
h7x4
ba5f81a6b6
Merge pull request #276547 from ambroisie/pyload-module
nixos/pyload: init module
2024-01-30 12:29:46 +01:00
Franz Pletz
3432be07e4
Merge pull request #278555 from leona-ya/kresd-port-only-regex 2024-01-30 00:41:53 +01:00
Sandro Jäckel
1af95a24c1
nixos/dhcpcd: link dhcpcd.conf to /etc/ to fix dhcpcd -k 2024-01-27 18:12:55 +01:00
Thomas Gerbet
117fd19a77
Merge pull request #276306 from ambroisie/aria2-rpc-secret-file
nixos/aria2: implement 'rpcSecretFile'
2024-01-27 00:46:56 +01:00
maxine
642317d03f
Merge pull request #283618 from SuperSandro2000/tailscale-resoleconf
nixos/tailscale: make resolvconf package depending on enablement of module
2024-01-26 22:41:14 +01:00
Lassulus
da25b2382d
Merge pull request #280373 from h7x4/treewide-use-new-tmpfiles-api
treewide: use new tmpfiles API
2024-01-26 10:47:18 +01:00
Robert Schütz
8433938f9b
Merge pull request #283617 from SuperSandro2000/headscale
nixos/headscale: install package system wide
2024-01-25 13:40:29 -08:00
Bruno BELANYI
d3a1465196 nixos/aria2: implement 'rpcSecretFile'
Since this is supposed to be a secret, use a file path as an input
instead of making it part of the expression, which would expose it in
the nix store.
2024-01-25 21:36:21 +00:00
Ryan Lahfa
6fe2736c6f
Merge pull request #246055 from Tom-Hubrecht/netbird
nixos/netbird: Allow running multiple netbird networks in parallel
2024-01-25 20:08:58 +01:00
rnhmjoj
1a1b91b3b9
nixos/dnsdist: add options for dnscrypt 2024-01-25 18:25:40 +01:00
Tom Hubrecht
c2d822e6b0 nixos/netbird: Allow running multiple netbird networks in parallel 2024-01-25 17:25:59 +01:00
Sandro Jäckel
922351ec86
nixos/tailscale: make resolvconf package depending on enablement of module
If resolvconf is not enabled, trying to use it always fails because
/etc/resolvconf.conf contains an `exit 1`.
2024-01-25 15:50:36 +01:00
Sandro Jäckel
9f395dae71
nixos/headscale: install package system wide
this is required to confirm nodes and generally manage everything
2024-01-24 23:00:54 +01:00
Vladimír Čunát
7f979aeb86
nixos/knot: allow specifying the clear section
It was added in 3.3.4.  I'm not sure if it will be useful with NixOS
services, but I added it in the usual way anyway.
2024-01-24 10:33:55 +01:00
h7x4
f5d513c573
treewide: use new tmpfiles api 2024-01-24 05:13:17 +01:00
Bruno BELANYI
70d0a6e547 nixos/pyload: init 2024-01-23 15:04:44 +00:00
Ryan Lahfa
5b14fea3d6
Merge pull request #280405 from RaitoBezarius/keepalived-unicast
nixos/networking/keepalived: do not emit `unicastPeers` when there are none
2024-01-22 22:43:29 +01:00
Raito Bezarius
08c9562995 keepalived: add myself as a maintainer
I will use this for a while, so… let's keep it tidy.
2024-01-22 21:56:04 +01:00
h7x4
5f5210aa20
Merge pull request #281606 from MarcelCoding/bird-no-auto-restart
nixos/bird2: add option to disable auto reload
2024-01-22 01:24:37 +01:00
Jade Lovelace
fe474ed61a nixos: fix remaining services for network-online dep fix 2024-01-19 00:11:34 -08:00
Jade Lovelace
1b514b3e10 fix: rxe under network-online.target change [UNSURE IF CORRECT] 2024-01-19 00:11:34 -08:00
Jade Lovelace
c80398e5d2 nixos/ircd-hybrid: fix evaluation error 2024-01-19 00:11:34 -08:00
Jade Lovelace
6c5ab28fce nixos: fix a bunch of services missing dep on network-online.target
This was done by generating a truly hilarious configuration:

rg 'services\.[^.]+\.enable\t' opts-tags | cut -f1 > allonconfig.nix

The following were not tested due to other evaluation errors. They
should probably be manually audited.
services.amule
services.castopod
services.ceph
services.chatgpt-retrieval-plugin
services.clamsmtp
services.clight
services.dante
services.dex
services.discourse
services.dwm-status
services.engelsystem
services.foundationdb
services.frigate
services.frp
services.grocy
services.guacamole-client
services.hedgedoc
services.home-assistant
services.honk
services.imaginary
services.jitsi-meet
services.kerberos_server
services.limesurvey
services.mastodon
services.mediawiki
services.mobilizon
services.moodle
services.mosquitto
services.nextcloud
services.nullmailer
services.patroni
services.pfix-srsd
services.pgpkeyserver-lite
services.postfixadmin
services.roundcube
services.schleuder
services.self-deploy
services.slskd
services.spacecookie
services.statsd
services.step-ca
services.sympa
services.tsmBackup
services.vdirsyncer
services.vikunja
services.yandex-disk
services.zabbixWeb
2024-01-19 00:11:34 -08:00
Jade Lovelace
ce602cc0aa nixos/kea: also want network-online.target 2024-01-18 16:28:42 -08:00
Adithya Nair
8b5644684e
nixos/frp: use toml configFile
According to upstream, the INI configuration file is deprecated and
TOML/YAML/JSON is recommended.
Link: https://github.com/fatedier/frp/tree/dev#configuration-files
2024-01-18 21:37:40 +05:30