nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-02-14 16:14:50 +00:00
Code Issues Packages Projects Releases Wiki Activity
222,179 Commits 204 Branches 125 Tags 6.9 GiB
f9fbc9b118
Commit Graph

13668 Commits

Author SHA1 Message Date
Léo Gaspard
203955fa0c
Merge pull request #82714 from delroth/s3tc 
libtxc_dxtn{,_s2tc}: remove from nixpkgs + hardware.opengl options
 2020-04-20 13:41:47 +02:00
Jörg Thalheim
2f0ee4bd0b
Merge pull request #85371 from Mic92/tmpfiles 2020-04-20 10:32:58 +01:00
adisbladis
ab37d7e7ea
nixos-containers: Add support for custom nixpkgs argument 2020-04-20 07:33:46 +01:00
Pierre Bourdon
1b89bffcf4
libtxc_dxtn{,_s2tc}: remove from nixpkgs + hardware.opengl options 
Context: discussion in https://github.com/NixOS/nixpkgs/pull/82630

Mesa has been supporting S3TC natively without requiring these libraries
since the S3TC patent expired in December 2017.
 2020-04-20 03:19:41 +02:00
Florian Klink
a88d17bc69
Merge pull request #83301 from evils/tuptime 
Tuptime: Init Package, Module and Test
 2020-04-19 23:38:53 +02:00
worldofpeace
f882896cc8
Merge pull request #73934 from flokli/nixos-test-port-cockroachdb 
nixosTests.cockroachdb: port to python
 2020-04-19 16:30:45 -04:00
Yegor Timoshenko
6f1165a0cb
Merge pull request #84522 from emilazy/add-linux-hardened-patches 
linux_*_hardened: use linux-hardened patch set
 2020-04-19 20:01:35 +03:00
Michael Weiss
0e4417f118
Revert "nixos: Introduce nix.buildLocation option" 
This reverts commit 5291925fd2.
Reason: This started to cause severe regressions, see:
- https://github.com/NixOS/nixpkgs/issues/85552
- https://github.com/NixOS/nixpkgs/pull/83166#pullrequestreview-395960588
Fixes #85552.
 2020-04-19 15:16:08 +02:00
Jörg Thalheim
35eb7793a3
Merge pull request #83166 from avnik/nix-build-location 2020-04-18 18:37:15 +01:00
Alexander V. Nikolaev
5291925fd2 nixos: Introduce nix.buildLocation option 
Allow to specify where package build will happens.
It helps big packages (like browsers) not to overflow tmpfs.
 2020-04-18 20:31:04 +03:00
worldofpeace
996ae856b6
Merge pull request #85365 from immae/fix_acme_postrun 
nixos/acme: Fix postRun in acme certificate being ran at every run
 2020-04-18 13:16:16 -04:00
Alyssa Ross
1b0d8015fe nixos/rss2email: globally install rss2email 
For man pages.
 2020-04-18 14:16:00 +00:00
Pavol Rusnak
fadcfc3ea4
treewide: per RFC45, remove more unquoted URLs 2020-04-18 14:04:37 +02:00
Milan Pässler
16a4332d60 nixos/deluge: support 2.x 2020-04-18 02:00:04 +02:00
Ismaël Bouya
8e88b8dce2
nixos/acme: Fix postRun in acme certificate being ran at every run 2020-04-17 22:16:50 +02:00
Emily
b0d5032ee4 nixos/hardened: add emily to maintainers 2020-04-17 16:13:39 +01:00
Emily
ad9bfe2254 nixos/hardened: enable user namespaces for root 
linux-hardened sets kernel.unprivileged_userns_clone=0 by default; see
anthraxx/linux-hardened@104f44058f.

This allows the Nix sandbox to function while reducing the attack
surface posed by user namespaces, which allow unprivileged code to
exercise lots of root-only code paths and have lead to privilege
escalation vulnerabilities in the past.

We can safely leave user namespaces on for privileged users, as root
already has root privileges, but if you're not running builds on your
machine and really want to minimize the kernel attack surface then you
can set security.allowUserNamespaces to false.

Note that Chrome's sandbox requires either unprivileged CLONE_NEWUSER or
setuid, and Firefox's silently reduces the security level if it isn't
allowed (see about:support), so desktop users may want to set:

    boot.kernel.sysctl."kernel.unprivileged_userns_clone" = true;
 2020-04-17 16:13:39 +01:00
Emily
84f258bf09 nixos/hardened: don't set vm.unprivileged_userfaultfd 
Upstreamed in anthraxx/linux-hardened@a712392b88.
 2020-04-17 16:13:39 +01:00
Emily
cc28d51237 nixos/hardened: don't set vm.mmap_min_addr 
Upstreamed in anthraxx/linux-hardened@f1fe0a64dd.
 2020-04-17 16:13:39 +01:00
Emily
46d12cca56 nixos/hardened: don't set vm.mmap_rnd{,_compat}_bits 
Upstreamed in anthraxx/linux-hardened@ae6d85f437.
 2020-04-17 16:13:39 +01:00
Emily
af4f57b2c4 nixos/hardened: don't set net.core.bpf_jit_harden 
Upstreamed in anthraxx/linux-hardened@82e384401d.
 2020-04-17 16:13:39 +01:00
Emily
71bbd876b7 nixos/hardened: don't set kernel.unprivileged_bpf_disabled 
Upstreamed in anthraxx/linux-hardened@1a3e0c2830.
 2020-04-17 16:13:39 +01:00
Emily
9da578a78f nixos/hardened: don't set kernel.dmesg_restrict 
Upstreamed in anthraxx/linux-hardened@e3d3f13ffb.
 2020-04-17 16:13:39 +01:00
Emily
cf1bce6a7a nixos/hardened: don't set vsyscall=none 
Upstreamed in anthraxx/linux-hardened@d300b0fdad.
 2020-04-17 16:13:39 +01:00
Emily
3b32cd2a5b nixos/hardened: don't set slab_nomerge 
Upstreamed in anthraxx/linux-hardened@df29f9248c.
 2020-04-17 16:13:39 +01:00
Euan Kemp
bc138f407f
nixos/k3s: add initial k3s service 
* nixos/k3s: simplify config expression

* nixos/k3s: add config assertions and trim unneeded bits

* nixos/k3s: add a test that k3s works; minor module improvements

This is a single-node test. Eventually we should also have a multi-node
test to verify the agent bit works, but that one's more involved.

* nixos/k3s: add option description

* nixos/k3s: add defaults for token/serveraddr

Now that the assertion enforces their presence, we dont' need to use the typesystem for it.

* nixos/k3s: remove unneeded sudo in test

* nixos/k3s: add to test list
 2020-04-17 16:39:54 +02:00
adisbladis
5340ebe085
mopidy: Create a mopidyPackages set 
This is to avoid mixing python versions in the same plugin closure.
 2020-04-17 12:39:03 +01:00
Yegor Timoshenko
8262ecd369
Merge pull request #85004 from emilazy/add-initrd-secrets-path-assertion 
nixos/stage-1: check secret paths before copying
 2020-04-16 17:42:40 +03:00
worldofpeace
b61999e4ad
Merge pull request #85332 from arianvp/revert-acme 
Revert "nixos/acme: Fix allowKeysForGroup not applying immediately"
 2020-04-16 08:43:36 -04:00
Jörg Thalheim
4cc7c2e55a
tmpfiles: load user-defined entries first 
systemd-tmpfiles will load all files in lexicographic order and ignores rules
for the same path in later files with a warning Since we apply the default rules
provided by systemd, we should load user-defines rules first so users have a
chance to override defaults.
 2020-04-16 13:02:24 +01:00
Maximilian Bosch
74d6e86ec2
nixos/doc: fix database-setup example for matrix-synapse 
Closes #85327
 2020-04-16 11:38:15 +02:00
Arian van Putten
5c1c642939 Revert "nixos/acme: Fix allowKeysForGroup not applying immediately" 
This reverts commit 5532065d06.

As far as I can tell setting RemainAfterExit=true here completely breaks
certificate renewal, which is really bad!

the sytemd timer will activate the service unit every OnCalendar=,
however with RemainAfterExit=true the service is already active! So the
timer doesn't rerun the service!

The commit also broke the actual tests, (As it broke activation too)
but this was fixed later in https://github.com/NixOS/nixpkgs/pull/76052
I wrongly assumed that PR fixed renewal too, which it didn't!

testing renewals is hard, as we need to sleep in tests.
 2020-04-16 10:37:04 +02:00
Maximilian Bosch
2d55f9c01a
Merge pull request #84266 from Ma27/nspawn-overrides 
nixos/systemd-nspawn: disallow multiple packages with `.nspawn`-units
 2020-04-16 00:24:33 +02:00
Maximilian Bosch
70ecf83c33
Merge pull request #82339 from Ma27/captive-browser-xdg 
nixos/captive-browser: set chromium's data-dir to a XDG-compliant location
 2020-04-16 00:06:12 +02:00
Maximilian Bosch
dca0b71876
Merge pull request #85162 from Ma27/build-vms-file-loc 
nixos/build-vms: propagate file location
 2020-04-15 17:42:12 +02:00
Michele Guerini Rocco
da232ea497
Merge pull request #78129 from flyfloh/airsonic-vhost 
airsonic: fix virtualHost option
 2020-04-15 09:18:28 +02:00
Matthew Bauer
57e20c5d87
Merge pull request #83362 from bachp/boinc 
nixos/boinc: simplify setup of boinc service
 2020-04-14 15:55:54 -04:00
Maximilian Bosch
57087ea280
Merge pull request #85165 from mayflower/alertmanager-clustering 
prometheus/alertmanager: implement HA clustering support
 2020-04-14 16:13:34 +02:00
worldofpeace
6304c9af48
Merge pull request #85222 from mayflower/libinput-manual-ref 
nixos/libinput: refer to libinput manual
 2020-04-14 09:42:55 -04:00
worldofpeace
e4c5e68fca
Merge pull request #84255 from prikhi/lightdm-mini-greeter-040 
lightdm-mini-greeter: 0.3.4 -> 0.4.0
 2020-04-14 08:38:23 -04:00
Linus Heckemann
9953a26be1 nixos/libinput: refer to libinput manual 2020-04-14 14:31:49 +02:00
Sander van der Burg
0ffb720e8c nixos/dysnomia: fix documentRoot property 2020-04-14 14:31:13 +02:00
Michele Guerini Rocco
86d71ddbed
Merge pull request #85170 from flokli/networking-virtual 
nixos/networking: fix setting MAC Address and MTU in networkd, fix tests
 2020-04-14 14:20:49 +02:00
Jörg Thalheim
fd438d5f09
Merge pull request #85185 from m1cr0man/legoaccounts 
acme: share accounts between certificates
 2020-04-14 13:12:57 +01:00
Jaka Hudoklin
de6891ffd0
Merge pull request #83930 from xtruder/nixos/virtualisation/hyperv-image 
modules/virtualisation: add hyperv-image
 2020-04-14 03:27:22 +00:00
Lucas Savva
827d5e6b44
acme: share accounts between certificates 
There are strict rate limits on account creation for Let's Encrypt
certificates. It is important to reuse credentails when possible.
 2020-04-14 00:15:16 +01:00
Florian Klink
532528190b nixos/networking: move network-link-${i.name} to scripted networking 
The unit sets MTU and MAC Address even with networkd enabled, which
isn't necessary anymore, as networkd handles this by itself.
 2020-04-13 22:03:35 +02:00
Florian Klink
ca391c8a4f nixos/networking: add assertion catching setting mac addresses on tun devices 
Setting a MAC Address on a tun interface isn't supported, and invoking
the corresponding command fails.
 2020-04-13 22:03:35 +02:00
Florian Klink
cddc7a28b8 nixos/networking: fix setting .macAddress and .mtu with networkd 
This needs to be set in the .linkConfig of a .network
 2020-04-13 22:03:35 +02:00
Robin Gloster
e484ca3d9b
alertmanager: implement HA clustering support 2020-04-13 18:39:51 +02:00