2
0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-01-10 06:55:10 +00:00
Commit Graph

25317 Commits

Author SHA1 Message Date
Domen Kožar
42994be64b nixos: add cachix-agent service 2022-01-18 10:26:47 +01:00
Artturi
78ff70f529
Merge pull request from Artturin/ananicymod1 2022-01-18 10:49:13 +02:00
github-actions[bot]
3dc95a4459
Merge master into staging-next 2022-01-18 06:01:20 +00:00
ivanbrennan
a3ea1bc599 nixos/xmonad: enableConfiguredRecompile
Commit 9a5b5d9fe8 added Haskell
dependencies (GHC and packages) to the xmonad binary's environment even
if xmonad had been preconfigured (via the "config" option). The intent
was to enable one-off recompiling using a local config file (e.g.
~/.config/xmonad/xmonad.hs), so the user can get quick feedback while
developing their config.

While this works, it may not be a common use-case, and it requires some
careful crafting in xmonad.hs itself. On top of that, it significantly
increases the size of the closure.

Given all that, commit b69d9d3c23 removed
GHC and packages from the binary's environment.

But there are still those among us who want to be able to recompile from
a preconfigured xmonad, so let's provide a way to opt-into configured
recompilation.
2022-01-18 00:04:15 -05:00
Zane van Iperen
f533a6d2bd
nixos/modules/syncthing: add 22000/udp to firewall 2022-01-18 11:40:06 +10:00
piegames
71358dd070
Merge pull request : nixos/heisenbridge: Improve hardening 2022-01-18 01:30:12 +01:00
github-actions[bot]
b456d67c98
Merge master into staging-next 2022-01-18 00:01:41 +00:00
InternetUnexplorer
ecda6429f2 nixos/nix-serve: add openFirewall option 2022-01-17 15:14:02 -08:00
Bernardo Meurer
eaf7be02b9
Merge pull request from helsinki-systems/feat/redo-restart-by-activation-script 2022-01-17 21:11:09 +00:00
Martin Weinelt
e5b47c5c21
Merge pull request from pennae/mosquitto-startup 2022-01-17 21:29:37 +01:00
pennae
dc101d9fef nixos/mosquitto: wait for network-online.target, not network.target
network.target is reached earlier, but with much fewer services
available. DNS is likely to be not functional before
network-online.target, so waiting for that seems better for that reason
alone. the existing backends for network-online.target all seem to do
reasonable things (wait until all links are in *some* stable state), so
we shouldn't lose anything from waiting.
2022-01-17 20:58:50 +01:00
legendofmiracles
59a07c683a
Merge pull request from CRTified/fix-154775-adguardhome-settings 2022-01-17 12:45:24 -06:00
Janne Heß
2cf157c781
nixos/switch-to-configuration: Rework activation script restarts
This removes `/run/nixos/activation-reload-list` (which we will need in
the future when reworking the reload logic) and makes
`/run/nixos/activation-restart-list` honor `restartIfChanged` and
`reloadIfChanged`. This way activation scripts don't have to bother with
choosing between reloading and restarting.
2022-01-17 17:57:23 +01:00
Frederik Rietdijk
4d125692e5 Merge master into staging-next 2022-01-17 16:10:06 +01:00
Felix Buehler
91dfaa5453 nixos/borgbackup: start remote backup only if network is available 2022-01-17 15:42:39 +01:00
blargg
697198834c nixos/borgbackup: Add a persistentTimer option.
Persistent starts the backup service on power on if it was missed while
the system was powered down, for example.
2022-01-17 15:42:37 +01:00
Spencer Janssen
ed5883c1b6 zrepl: 0.4.0 -> 0.5.0 2022-01-17 15:35:45 +01:00
github-actions[bot]
0eee7ee8c8
Merge master into staging-next 2022-01-17 12:01:25 +00:00
talyz
95430e31f5
nixos/keycloak: Reformat the code with nixpkgs-fmt 2022-01-17 12:47:53 +01:00
talyz
21b1de2bcd
nixos/keycloak: Inherit library functions and builtins
Instead of referencing all library functions through `lib.` and
builtins through `builtins.` at every invocation, inherit them into
the appropriate scope.
2022-01-17 12:42:30 +01:00
Yarny0
f6dca95c5d tsm-client: add test derivation and a module test
The tsm-client needs a tsm-server to do anything useful.
Without a server, automated tests can just
check diagnostic outputs for plausibility.

The commit at hand adds two tests:

1.
The command line interface `dsmc` is called,
then it is verified that the program does

* report the correct client version,
* find its configuration file,
* report a connection error.

2.
To check the GUI (and the tsm-client nixos module), we add a
vm test which uses the module to install `tsm-client-withGui`.
To verify that the GUI's basic functionality is present,
we skip over all connection failure related error
messages and open the "Connection Information"
dialog from the main application window.
This dialog presents the node name and the client version;
both are verified by the test.

Note: Our `tsm-client` build recipe consists of two packages:
The "unwrapped" package and the final package.
This commit puts the unwrapped one into the final
package's `passthru` so that tests can access
the original version string that is needed to check
the client version reported by the application.
2022-01-17 12:09:27 +01:00
Yarny0
c2192ed77a nixos/tsm-{client,backup}: use new type nonEmptyStr
The module option type `nonEmptyStr` was introduced in commit

a3c5f0cba8

The tsm modules previously simply used
`strMatching ".+"` to prevent empty option strings,
but the new type is more thorough as
it also catches space-only strings.
2022-01-17 12:09:27 +01:00
Yarny0
c5effcaaea nixos/tsm-backup: enable most systemd sandboxing options
This enables some systemd sandboxing
options for the `tsm-backup.service`.
Those settings have been determined by expermentation.
This commit tries hard to protect the filesystem from
write access, but not to hide anything from read access,
so users can backup all files they choose to backup.
An exception are API filesystems (`/dev`, `/proc`, `/sys`):
As their "files" are not stored on persistent storage,
they are sandboxed away as much as possible.

Note that the service still has to run with root
privileges to reach files with limited access permissions.
The obvious alternative to use a dedicated user account and
the `CAP_DAC_READ_SEARCH` capability to permit system-wide
read access while blocking write access does not work.
Experiments have shown that `dsmc` verifies access permissions
for each file before attempting to open it for reading.
Hence `dsmc` refuses to copy files where the file permission
mode blocks read access -- even if process capabilities
would allow it to proceed irrespective of permissions.
2022-01-17 12:09:27 +01:00
Yarny0
3f6d1f5f60 nixos/tsm-{client,backup}: update links in module comments
IBM has changed the URL structures of their support web pages.
The commit at hand updates URLs in two comments
so they follow the new structure.
2022-01-17 12:09:27 +01:00
talyz
5010f4fff9
nixos/keycloak: Use LoadCredential to load secrets
Use systemd's LoadCredential mechanism to make the secret files
available to the service.

This gets rid of the privileged part of the ExecPreStart script which
only served to copy these files and assign the correct
permissions. There's been issues with this approach when used in
combination with DynamicUser, where sometimes the user isn't created
before the ExecPreStart script runs, causing the error

install: invalid user ‘keycloak’

This should fix that issue.

Unfortunately, all of the ExecPreStart script had to be moved to
ExecStart, since credentials aren't provided to ExecPreStart. See
https://github.com/systemd/systemd/issues/19604.
2022-01-17 11:46:51 +01:00
Timo Kaufmann
e3b041ac07
Merge pull request from midchildan/fix/noto-cjk
noto-fonts-cjk: add missing serif font
2022-01-17 11:23:40 +01:00
Ivan Kovnatsky
32c8a5de66
nixos/chromium: Add DefaultSearchProviderEnabled option
Without this option `DefaultSearchProviderSearchURL` and
`DefaultSearchProviderSuggestURL` are really wastefull as it does not
set search engine, at least for me.

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
2022-01-17 08:04:55 +02:00
github-actions[bot]
f0a71fe6f3
Merge master into staging-next 2022-01-17 06:01:22 +00:00
Morgan Jones
9db1fb4772 nixos/mattermost: update release notes 2022-01-16 22:34:37 -07:00
CRTified
f9bc03e3c7 nixos/adguardhome: add test 2022-01-17 01:39:27 +01:00
github-actions[bot]
a407424e1f
Merge master into staging-next 2022-01-17 00:01:45 +00:00
Ben Darwin
43047ec128
nixos/rstudio-server: add to 22.05 release notes 2022-01-17 10:26:24 +11:00
Justin Bedo
0fe0153003
nixos/rstudio-server: init 2022-01-17 10:24:38 +11:00
pennae
d893b16bf9
Merge pull request from winterqt/thelounge-test
nixos/thelounge: add test
2022-01-16 21:49:35 +00:00
pennae
e65df99e39
Merge pull request from ncfavier/fix-prosody-filer
nixos/prosody-filer: remove usage of literalExample
2022-01-16 21:36:40 +00:00
Winter
cf12e0e7ed nixos/thelounge: add test 2022-01-16 16:25:45 -05:00
Naïm Favier
bbfca6b6b9
nixos/prosody-filer: remove usage of literalExample 2022-01-16 22:10:47 +01:00
pennae
4a44a5f126
Merge pull request from winterqt/borgbackup-empty-archive-base-name
nixos/borgbackup: allow empty archive base name
2022-01-16 18:11:37 +00:00
github-actions[bot]
d1d6f982a8
Merge master into staging-next 2022-01-16 18:00:59 +00:00
Sandro
55c5f68771
Merge pull request from pasqui23/beesd 2022-01-16 18:08:54 +01:00
midchildan
bd8132ac62
noto-fonts-cjk: add missing serif font
Fixes 
2022-01-17 02:04:02 +09:00
Winter
2104608642 nixos/borgbackup: allow empty archive base name 2022-01-16 10:41:04 -05:00
github-actions[bot]
0173b359a6
Merge master into staging-next 2022-01-16 12:01:11 +00:00
Kim Lindberger
cdd600c430
Merge pull request from abbradar/keycloak-changes
keycloak: 15.1.0 -> 16.1.0 + module improvements
2022-01-16 11:27:29 +01:00
Nikolay Amiantov
97a0cf62f0 keycloak service: allow to set empty frontend URL
This together with extraConfig:

{
  "subsystem=undertow"."server=default-server"."http-listener=default"."proxy-address-forwarding" = true;
  "subsystem=undertow"."server=default-server"."https-listener=https"."proxy-address-forwarding" = true;
}

Allows to run Keycloak behind a reverse proxy that provides
X-Forwarded-* headers.
2022-01-16 11:41:50 +03:00
Nikolay Amiantov
84f70eefd1 keycloak service: add themes support
Custom themes can be packaged and then added using `themes` config
attribute.
2022-01-16 11:41:50 +03:00
Nikolay Amiantov
a42abe27c0 keycloak service: use 'attrsOf anything' for extraConfig 2022-01-16 11:25:44 +03:00
Nikolay Amiantov
827267a27f keycloak service: update HTTPS configuration
Keycloak 16.1.0 uses different way to configure HTTPS.
This requires us to order commands correctly, otherwise linked
objects will fail.
2022-01-16 11:25:44 +03:00
Nikolay Amiantov
3c7e78cc6a keycloak service: ordering for CLI script
Allow update commands in the script to be ordered using `mkOrder`.
If we encounter ordered sub-objects we sort them by priority.

To implement this we now explicitly pass current node in `recurse`,
which also allows us to clean up edge case for top-level node.

Also refactor `recurse` to avoid passing result text argument; we
weren't tail recursive before anyway.
2022-01-16 11:25:44 +03:00
Jörg Thalheim
d4846c4526
Merge pull request from Mic92/ddclient
nixos/ddclient: don't chown secrets until dynamicuser issue is resolved
2022-01-16 06:23:28 +00:00
github-actions[bot]
122cae786e
Merge master into staging-next 2022-01-16 06:01:16 +00:00
Martin Weinelt
369db3b2f3
mailpile, nixos/mailpile: drop
Still actively developed and yet stuck on python2. Also marked as
vulnerable and their issue tracker contains yet another security issue
reported in 2021/10 that the upstream hasn't acknowledged yet.

Mind blown.

Closes: , , 
2022-01-16 02:36:20 +01:00
Martin Weinelt
84926ba4c8
Merge pull request from piegamesde/rename-resort 2022-01-16 02:34:28 +01:00
Anderson Torres
ce6fd0d857
Merge pull request from starcraft66/polymc
polymc: init at 1.0.4

polymc substitutes multimc.
2022-01-15 22:18:26 -03:00
piegames
1f71224fe8 nixos/modules/rename: Sort alphabetically
This was a mess previously
2022-01-16 02:11:06 +01:00
Bernardo Meurer
4fa2647449
Merge pull request from mweinelt/kernel-disable-unpriv-ebpf
linux: enable BPF_UNPRIV_DEFAULT_OFF on 5.10 and later
2022-01-16 00:46:51 +00:00
Bernardo Meurer
7b0e7dcb39
Merge pull request from rapenne-s/thermald_no_net
thermald: disable network access
2022-01-16 00:36:11 +00:00
github-actions[bot]
f8fb795136
Merge master into staging-next 2022-01-16 00:01:52 +00:00
Jan Tojnar
5cd5fb71bc
Merge pull request from ncfavier/gdm-test
nixosTests.gnome: add autologin delay to catch GDM failures
2022-01-16 00:24:03 +01:00
Tristan Gosselin-Hane
155f315319 multimc: document replacement 2022-01-15 18:09:27 -05:00
Martin Weinelt
3ee206291a
linux: enable BPF_UNPRIV_DEFAULT_OFF between 5.10 and 5.15
Disable unprivileged access to BPF syscalls to prevent denial of service
and privilege escalation via

a) potential speculative execution side-channel-attacks on unmitigated
hardware[0]

or

b) unvalidated memory access in ringbuffer helper functions[1].

Fixes: CVE-2021-4204, CVE-2022-23222

[0] https://ebpf.io/summit-2021-slides/eBPF_Summit_2021-Keynote-Daniel_Borkmann-BPF_and_Spectre.pdf
[1] https://www.openwall.com/lists/oss-security/2022/01/13/1
2022-01-15 23:44:19 +01:00
Maximilian Bosch
0a223c8d50
Merge pull request from qowoz/ecc-ignore
nixos/tests/systemd-networkd-vrf: move disabled check inline
2022-01-15 23:22:56 +01:00
Solene Rapenne
f3516813d8 thermald: disable network access
Use systemd PrivateNetwork feature to prevent thermald daemon to have
network capabilities.
2022-01-15 19:33:06 +01:00
github-actions[bot]
ed9751296d
Merge master into staging-next 2022-01-15 18:01:07 +00:00
Jonas Heinrich
75d417c267
nixos/dokuwiki: Drop deprecated old interface () 2022-01-16 02:38:20 +09:00
Jörg Thalheim
e91ed60026
Merge pull request from Lassulus/ergochat
ergochat: init at 2.9.1 (+ module/test)
2022-01-15 12:15:46 +00:00
github-actions[bot]
6d8719a23d
Merge master into staging-next 2022-01-15 12:01:13 +00:00
Ninjatrappeur
b47203b28f
Merge pull request from andir/prosody-security 2022-01-15 10:13:33 +01:00
0x4A6F
3cbdd13b11
Merge pull request from matthiasbeyer/add-timetagger
Add timetagger
2022-01-15 09:52:21 +01:00
Matthias Beyer
65aaf4e22d Add timetagger to release notes
Why the f*** would anyone ever add generated stuff to a git repository,
where the sources for the generated stuff AND the scripts to generate
them are in the repository?

Signed-off-by: Matthias Beyer <mail@beyermatthias.de>
2022-01-15 09:08:52 +01:00
Matthias Beyer
1f10b0434f timetagger: Make enable option with mkOption
Signed-off-by: Matthias Beyer <mail@beyermatthias.de>
2022-01-15 09:07:54 +01:00
Matthias Beyer
a24dc8d2ef timetagger: Use default value for package option
Signed-off-by: Matthias Beyer <mail@beyermatthias.de>
Suggested-by: Aaron Andersen <aaron@fosslib.net>
2022-01-15 09:07:52 +01:00
Matthias Beyer
f3eaf66882 Add service module for timetagger
Signed-off-by: Matthias Beyer <mail@beyermatthias.de>
2022-01-15 09:07:52 +01:00
Jörg Thalheim
63971d1fda nixos/ddclient: don't chown secrets until dynamicuser issue is resolved
revert if https://github.com/NixOS/nixpkgs/pull/154928 or a similar fix gets applied
2022-01-15 07:21:05 +01:00
github-actions[bot]
2e421aaac4
Merge master into staging-next 2022-01-15 00:01:36 +00:00
Michael Weiss
297cb6514f
Merge pull request from primeos/nixos-tests-tinywl
nixos/tests/tinywl: init
2022-01-14 23:45:54 +01:00
lassulus
6b55249a5d nixos/tests/ergochat: init 2022-01-14 23:33:23 +01:00
lassulus
eaf8890a6c nixos/ergochat: init 2022-01-14 23:33:23 +01:00
Andreas Rammhold
4369bebd9a
nixos/tests: remove broken prosody-mysql test
The test has been broken for some time and the test errors are
non-obvious. None of the current maintainers know how to fix it so it is
better to get rid of it then to keep a continously failing test.
2022-01-14 22:26:16 +01:00
Robert Hensing
8a552994d8 nixos/build-vm.nix: Fix docs eval
Quick fix. Might be possible to provide `extendModules`?
2022-01-14 19:17:11 +01:00
github-actions[bot]
d5e672b839
Merge master into staging-next 2022-01-14 18:01:18 +00:00
Robert Hensing
2bf5958169
Merge pull request from hercules-ci/nixos-cleanup-vmWithBootLoader
nixos: turn vmWithBootLoader into option (`nixos-rebuild build-vm`)
2022-01-14 18:49:27 +01:00
Dmitry Kalinkin
a56da82f7a
Merge branch 'master' into staging-next
Conflicts:
	pkgs/development/python-modules/restfly/default.nix
2022-01-13 21:39:05 -05:00
CRTified
cbbabaddf9 nixos/adguardhome: Fix by checking for settings 2022-01-14 01:54:41 +01:00
piegames
d9172e7a1a fixup! nixos/heisenbridge: Improve hardening 2022-01-13 23:33:23 +01:00
Jörg Thalheim
dfdf225a98
Merge pull request from veehaitch/sgx-compat-udev
nixos/intel-sgx: add option for Intel SGX DCAP compatibility
2022-01-13 14:55:08 +00:00
piegames
4b165e7675 nixos/heisenbridge: Fix/improve enable option description
See https://github.com/NixOS/nixpkgs/pull/154831#discussion_r783858597 for context
2022-01-13 13:28:31 +01:00
piegames
854a65fd47 nixos/heisenbridge: Improve hardening
Systemd score is "1.6 OK 🙂"
2022-01-13 13:28:03 +01:00
github-actions[bot]
a6928c74cc
Merge master into staging-next 2022-01-13 12:01:29 +00:00
adisbladis
4271f3728e
Merge pull request from adisbladis/heisenbridge-modules-list
nixos/heisenbridge: Add to modules-list.nix
2022-01-13 23:21:53 +12:00
Michele Guerini Rocco
d516b7f14f
Merge pull request from rnhmjoj/pr-mpd-units
nixos/mpd: use upstream units
2022-01-13 10:33:58 +01:00
Daniel Thwaites
7dc24c0923
nixos/starship: use expect for testing
Accidentally reverted this while fixing merge conflicts on .
2022-01-13 07:56:52 +00:00
pennae
466cb747c8
Merge pull request from Enzime/systemd-boot-extra-entries
nixos/systemd-boot: Add `extraEntries` and `extraFiles` options
2022-01-13 07:15:05 +00:00
adisbladis
72908cb5a8 services.heisenbridge: Don't use lt/gt signs in mkEnableOption
It breaks the XML manual generation.
2022-01-13 13:38:24 +12:00
adisbladis
191ba295e6 nixos/heisenbridge: Add to modules-list.nix
It seems to have been forgotten in .
2022-01-13 13:30:41 +12:00
github-actions[bot]
a8b75d6f2f
Merge master into staging-next 2022-01-13 00:01:59 +00:00
zowoq
9917a5cf11 nixos/tests/systemd-networkd-vrf: move disabled check inline 2022-01-13 09:21:38 +10:00
0x4A6F
1e0d877e1d
Merge pull request from mweinelt/frr
frr: init at 8.1; libyang: init at 2.0.112
2022-01-12 20:51:12 +01:00
github-actions[bot]
7def368b6f
Merge master into staging-next 2022-01-12 18:01:16 +00:00
Daniel Thwaites
f366ae6429
nixos/starship: add a test 2022-01-12 15:47:15 +00:00