2
0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-27 08:04:14 +00:00
Commit Graph

18413 Commits

Author SHA1 Message Date
Evan Stoll
a31736120c nixos/lorri: add package option 2020-09-07 15:46:15 +02:00
Vladimír Čunát
85afe9cbe9
nixos/tests/installer: increase RAM in the VM
1G apparently isn't sufficient anymore, at least in swraid case:
https://hydra.nixos.org/build/126561574
2020-09-07 15:43:37 +02:00
Vladimír Čunát
c1c85b9bad
Merge : 'staging-next' branch
This is the last planned iteration before forking 20.09.
2020-09-07 15:43:36 +02:00
WilliButz
5d51096839
nixos/prometheus-exporters: fix default firewall filter
Instead of always using the default port of one exporter for its default
firewall filter, the port from the current service configuration is used.
2020-09-07 10:28:36 +02:00
worldofpeace
dd2727773a Revert "nixos/qemu-vm: support nix run"
This reverts commit 02590c9620.

02590c9620 (commitcomment-42078853)
2020-09-06 19:45:10 -04:00
Maximilian Bosch
cac5339531
nixos/doc/borgbackup: correct install instructions for vorta
No need to fiddle around with `flatpack` to get `vorta`, a graphical
desktop-client for `borgbackup` running as it's available in `nixpkgs`.
2020-09-06 22:44:37 +02:00
Silvan Mosberger
f822080b05
Merge pull request from teto/ssh_banner
services.openssh: add banner item
2020-09-06 22:15:25 +02:00
Matthieu Coudron
1835fc455b services.openssh: add banner
Add the possibility to setup a banner.

Co-authored-by: Silvan Mosberger <github@infinisil.com>
2020-09-06 21:32:20 +02:00
Jörg Thalheim
d9ccdd860c
Merge pull request from bbigras/sssd-ldap
nixos/tests/sssd-ldap: init
2020-09-06 20:29:36 +01:00
worldofpeace
02590c9620 nixos/qemu-vm: support nix run 2020-09-06 14:57:51 -04:00
Florian Klink
d7046947e5
Merge pull request from m1cr0man/master
Restructure acme module
2020-09-06 18:26:22 +02:00
Frederik Rietdijk
d362c0e54e Merge master into staging-next 2020-09-06 18:14:23 +02:00
Peter Hoeg
6e22c6ea6a
Merge pull request from peterhoeg/m/phpfpm
nixos/phpfpm: always restart service on failure
2020-09-06 21:41:38 +08:00
Florian Klink
569fdb2c35
Merge pull request from helsinki-systems/feat/gitlab-mailroom
nixos/gitlab: Support incoming mail
2020-09-06 15:34:02 +02:00
Peter Hoeg
5483b1e216
Merge pull request from peterhoeg/m/fscache
nixos/cachefilesd: don't set up manually
2020-09-06 10:23:32 +08:00
Jan Tojnar
f0cb5c6a15
Revert "nixos/fontconfig: fix 50-user.conf handling"
This reverts commit 8425726f86.

This should have been reverted in https://github.com/NixOS/nixpkgs/pull/95358
but I forgot about it.
2020-09-06 02:56:31 +02:00
Lucas Savva
34b5c5c1a4
nixos/acme: More features and fixes
- Allow for key reuse when domains are the only thing that
  were changed.
- Fixed systemd service failure when preliminarySelfsigned
  was set to false
2020-09-06 01:28:19 +01:00
Evan Stoll
854a229ae5
nixos/terraria: allow dataDir to be configured ()
* nixos/terraria: allow dataDir to be configured

add dataDir option to terraria module

* Update nixos/modules/services/games/terraria.nix

Co-authored-by: WORLDofPEACE <worldofpeace@protonmail.ch>

Co-authored-by: WORLDofPEACE <worldofpeace@protonmail.ch>
2020-09-05 16:37:52 -04:00
Lassulus
964606d40f
Merge pull request from doronbehar/module/syncthing
nixos/syncthing: add ignoreDelete folder option
2020-09-05 22:05:04 +02:00
WORLDofPEACE
d0972c9637
Merge pull request from ju1m/nixos-install
nixos-install: add support for flakes
2020-09-05 15:31:14 -04:00
Vladimír Čunát
6eea644749
nixos/tests/installer swraid: increase partition size
We apparently didn't fit anymore.  I don't think this test is meant
to (also) check closure size.

Note: as of this commit, the test is blocked by a fontconfig problem,
so I tested with that merge temporarily reverted.
2020-09-05 19:29:38 +02:00
Florian Klink
98d6b55fdc nixos/testing: remove remaining coverage-data logic
This isn't used anymore as per
https://github.com/NixOS/nixpkgs/pull/72354#discussion_r451031449.
2020-09-05 16:07:59 +02:00
lewo
d65002aff5
Merge pull request from tnias/nixos_opendkim_20200717
nixos/opendkim: systemd sandbox
2020-09-05 08:46:19 +02:00
Lucas Savva
f57824c915
nixos/acme: Update docs, use assert more effectively 2020-09-05 01:06:29 +01:00
Jan Tojnar
4f0f26771e
Merge pull request from jtojnar/global-fontconfig 2020-09-05 00:19:38 +02:00
Lucas Savva
67a5d660cb
nixos/acme: Run postRun script as root 2020-09-04 19:34:10 +01:00
Frederik Rietdijk
af81d39b87 Merge staging-next into staging 2020-09-04 20:03:30 +02:00
Jan Tojnar
951efe41e1 fixup! nixos/doc/releases: update the docs as promised 2020-09-04 10:59:06 -07:00
worldofpeace
f2e98e8b36 fixup! nixos/doc/releases: update the docs as promised 2020-09-04 10:59:06 -07:00
worldofpeace
d9c33b2ea4 nixos/doc/releases: update the docs as promised
This goes through a recent example of 19.09 (because the workflow
should be everchanging, so our example needs to be recent).
Lots of changes, just read idk.
2020-09-04 10:59:06 -07:00
Florian Klink
176d5e090a
Merge pull request from andersk/cryptception-1
cryptsetup, lvm2, systemd: Break cyclic dependency at a different point
2020-09-04 19:12:53 +02:00
Jan Tojnar
7ecabdc22b
Merge pull request from jtojnar/fc-dtd-urn
treewide: use URN for fontconfig DTD
2020-09-04 17:12:29 +02:00
Peter Hoeg
6ef2152b5d nixos/cachefilesd: don't set up manually
Use our available infrastructure instead of manually handling setup.
2020-09-04 16:11:55 +08:00
Bruno Bigras
64ce52713c nixos/tests/sssd-ldap: init 2020-09-04 01:51:42 -04:00
Julien Moutinho
b03c506178 nixos-install: add support for flakes 2020-09-04 06:56:09 +02:00
Julien Moutinho
c6a3a0f4f5 nixos-rebuild: do not depend on nix.conf to activate flakes 2020-09-04 06:56:09 +02:00
Lucas Savva
1b6cfd9796
nixos/acme: Fix race condition, dont be smart with keys
Attempting to reuse keys on a basis different to the cert (AKA,
storing the key in a directory with a hashed name different to
the cert it is associated with) was ineffective since when
"lego run" is used it will ALWAYS generate a new key. This causes
issues when you revert changes since your "reused" key will not
be the one associated with the old cert. As such, I tore out the
whole keyDir implementation.

As for the race condition, checking the mtime of the cert file
was not sufficient to detect changes. In testing, selfsigned
and full certs could be generated/installed within 1 second of
each other. cmp is now used instead.

Also, I removed the nginx/httpd reload waiters in favour of
simple retry logic for the curl-based tests
2020-09-04 01:09:43 +01:00
Anders Kaseorg
f4b2c9dfe7 cryptsetup, lvm2, systemd: Break cyclic dependency at a different point
The cyclic dependency of systemd → cryptsetup → lvm2 → udev=systemd
needs to be broken somewhere.  The previous strategy of building
cryptsetup with an lvm2 built without udev () caused the
installer.luksroot test to fail.  Instead, build lvm2 with a udev built
without cryptsetup.

Fixes .

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
2020-09-03 12:35:56 -07:00
Janne Heß
8cf4ec8b97
nixos/systemd: Don't use apply for $PATH
When not using apply, other modules can use $PATH as a list instead of
getting a colon-separated list to each /bin directory.
2020-09-03 20:27:55 +02:00
Philipp Bartsch
c46dd4e221 nixos/doc: add opendkim changes to release notes 2020-09-03 18:03:28 +02:00
Philipp Bartsch
47928442a8 nixos/opendkim: add keyPath to ReadWritePaths 2020-09-03 17:54:16 +02:00
Philipp Bartsch
118f341723 nixos/opendkim: add systemd service sandbox 2020-09-03 17:54:15 +02:00
Daniël de Kok
7b73713a98 programs.zsh: remove unnecessary with 2020-09-03 08:42:24 +02:00
Jörg Thalheim
02a2649220
Merge pull request from heinic/krb5-lists 2020-09-03 07:31:22 +01:00
Jan Tojnar
6dd3b54ccc
treewide: use URN for fontconfig DTD
To match upstream change:

9c46ef4aac
2020-09-03 06:39:00 +02:00
WORLDofPEACE
8739e4235e
Merge pull request from jtojnar/gpaste-session-path
nixos/gpaste: return sessionPath
2020-09-02 15:43:53 -04:00
Lucas Savva
61dbf4bf89
nixos/acme: Add proper nginx/httpd config reload checks
Testing of certs failed randomly when the web server was still
returning old certs even after the reload was "complete". This was
because the reload commands send process signals and do not wait
for the worker processes to restart. This commit adds log watchers
which wait for the worker processes to be restarted.
2020-09-02 19:25:30 +01:00
Lucas Savva
982c5a1f0e
nixos/acme: Restructure module
- Use an acme user and group, allow group override only
- Use hashes to determine when certs actually need to regenerate
- Avoid running lego more than necessary
- Harden permissions
- Support "systemctl clean" for cert regeneration
- Support reuse of keys between some configuration changes
- Permissions fix services solves for previously root owned certs
- Add a note about multiple account creation and emails
- Migrate extraDomains to a list
- Deprecate user option
- Use minica for self-signed certs
- Rewrite all tests

I thought of a few more cases where things may go wrong,
and added tests to cover them. In particular, the web server
reload services were depending on the target - which stays alive,
meaning that the renewal timer wouldn't be triggering a reload
and old certs would stay on the web servers.

I encountered some problems ensuring that the reload took place
without accidently triggering it as part of the test. The sync
commands I added ended up being essential and I'm not sure why,
it seems like either node.succeed ends too early or there's an
oddity of the vm's filesystem I'm not aware of.

- Fix duplicate systemd rules on reload services

Since useACMEHost is not unique to every vhost, if one cert
was reused many times it would create duplicate entries in
${server}-config-reload.service for wants, before and
ConditionPathExists
2020-09-02 19:22:43 +01:00
Félix Baylac-Jacqué
09c383c17a
Merge pull request from ju1m/biboumi
nixos/biboumi: init
2020-09-02 17:43:27 +02:00
WORLDofPEACE
31008a8f15
Merge pull request from jtojnar/drop-strigi
strigi: drop
2020-09-02 08:53:24 -04:00