Commit Graph

33 Commits

Author SHA1 Message Date
pennae
8a79dfd94a nixos/config: invariant option docs MD conversions 2022-07-24 13:01:18 +02:00
Sandro
6df0dae4f9
Merge pull request #118387 from raboof/document-how-to-disable-nss
Improved error message on disabling NSS modules when disabling nscd
2022-04-16 22:55:40 +02:00
Florian Klink
c1536f5c78 nixos/systemd: fix NSS database ordering
- The order of NSS (host) modules has been brought in line with upstream
  recommendations:

  - The `myhostname` module is placed before the `resolve` (optional) and `dns`
    entries, but after `file` (to allow overriding via `/etc/hosts` /
    `networking.extraHosts`, and prevent ISPs with catchall-DNS resolvers from
    hijacking `.localhost` domains)
  - The `mymachines` module, which provides hostname resolution for local
    containers (registered with `systemd-machined`) is placed to the front, to
    make sure its mappings are preferred over other resolvers.
  - If systemd-networkd is enabled, the `resolve` module is placed before
    `files` and `myhostname`, as it provides the same logic internally, with
    caching.
  - The `mdns(_minimal)` module has been updated to the new priorities.

  If you use your own NSS host modules, make sure to update your priorities
  according to these rules:

  - NSS modules which should be queried before `resolved` DNS resolution should
    use mkBefore.
  - NSS modules which should be queried after `resolved`, `files` and
    `myhostname`, but before `dns` should use the default priority
  - NSS modules which should come after `dns` should use mkAfter.
2021-07-17 23:55:35 +02:00
Arnout Engelen
5610ff5ba1
Improved error message on disabling NSS modules when disabling nscd
Move the hint from a comment to the error message, and provide a clearer
example of how to achieve it.
2021-04-03 18:20:11 +02:00
Florian Klink
23ba506113 nixos/nsswitch: improve error message
Show the config option triggering the assertion, so people don't
necessary lookup the nixpkgs source code.
2020-05-11 16:14:51 +02:00
Florian Klink
1df38e2a1d nixos/nsswitch: update comment next to assertion 2020-05-11 16:14:51 +02:00
Florian Klink
1fb6c37597 nixos/samba: move nss database configuration into samba module 2020-05-11 16:14:50 +02:00
Florian Klink
fd21793de6 nixos/avahi: move nss database configuration into avahi module 2020-05-11 16:14:50 +02:00
Florian Klink
4f9c8ef791 nixos/ldap: move nss database configuration into ldap module
now that passwdArray and shadowArray aren't used anymore, these can be
folded.
2020-05-11 16:14:50 +02:00
Florian Klink
c0995d22ee nixos/systemd: move NSS module logic to systemd module
We keep the conditional on only adding if nscd is enabled for now.
2020-05-05 15:59:30 +02:00
Florian Klink
7426bec45e nixos/systemd/resolved: add resolve to nss hosts database if enabled
We keep the "only add the nss module if nscd is enabled" logic for now.

The assertion never was triggered, so it can be removed.
2020-05-05 15:59:30 +02:00
Florian Klink
4b71b6f8fa nixos/google-oslogin: Move nsswitch config into the module
Motivation: #86350
2020-04-30 17:51:13 +02:00
Janne Heß
edddc7c82a
nixos/sss: Move nsswitch config into the module 2020-04-28 17:02:46 +02:00
Janne Heß
bc2a4b341a
nixos/nsswitch: Make databases more configurable
Instead of hardcoding all nss modules that are added into nsswitch,
there are now options exposed.
This allows users to add own nss modules (I had this issue with
winbindd, for example).
Also, nss modules could be moved to their NixOS modules which would
make the nsswitch module slimmer.

As the lists are now handled by the modules system, we can use mkOrder
to ensure a proper order as well as mkForce to override one specific
database type instead of the entire file.
2020-04-26 03:16:57 +02:00
Daiderd Jordan
11cd761dbf
nixos/nsswitch: add option to configure nssHosts
Enables adding or overriding the default nsswitch hosts in a generic
way for packages without a nixos module.
2019-02-22 23:00:24 +01:00
Florian Klink
04f3562fc4 config.nsswitch: load cache_oslogin and oslogin nss modules if config.security.googleOsLogin.enable is set 2018-12-21 17:52:37 +01:00
volth
2e979e8ceb [bot] nixos/*: remove unused arguments in lambdas 2018-07-20 20:56:59 +00:00
Jan Malakhovski
302c170e1c nixos: replace optionals -> optional in nsswitch 2018-03-30 06:44:18 +00:00
Jason A. Donenfeld
f6d8a96993 nsswitch: use [NOTFOUND=return] for mdns
Commit 987aac7 and issue #18183 were intended to fix support for other
things, but in the process, changed mdns_minimal to use the wrong return
setting, resulting in permanent failures in early boot, affecting things
like issue #30459.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-10-16 15:11:58 +02:00
Peter Hoeg
72a64ea4f1 nsswitch: add systemd module
In order for DynamicUser = true to work in services, we need the
nss-systemd module to be able to resolve the user and group names
generated dynamically.
2017-08-03 10:51:06 +08:00
Florian Jacob
e370e97f3d nsswitch: only add modules to nsswitch.conf if they can be loaded 2017-06-30 02:44:23 +02:00
Florian Jacob
7410b0c82c nsswitch: add assertions for enabled nscd 2017-06-30 02:44:22 +02:00
Florian Jacob
63fa3e7c62 nsswitch: fix typo specifying nss-resolve module
this had the effect of not being able to load nss-resolve
and falling back to dns module in all cases.
2017-06-30 02:40:49 +02:00
Jörg Thalheim
323f28d40e
nsswitch: use libnss_resolve if resolved is enabled 2017-05-24 01:10:36 +01:00
Alexander Kahl
61d125b842 sssd: init at 1.14.2
perlPackages.TextWrapI18N: init at 0.06
perlPackages.Po4a: init at 0.47
jade: init at 1.2.1
ding-libs: init at 0.6.0

Switch nscd to no-caching mode if SSSD is enabled.

abbradar: disable jade parallel building.

Closes #21150
2017-01-04 03:07:20 +03:00
Peter Hoeg
987aac7794
/etc/hosts and /etc/nsswitch.conf cleanups
fixes #18183
2016-12-17 16:01:35 +01:00
Jörg Thalheim
3b763fef44 nssModules: include correct systemd output
fixes libnss_myhost, libnss_mymachines, libnss_resolve are located here
2016-12-15 20:23:16 +01:00
Markus Mueller
07c44b81c3 ldap: Add option for NSS integration 2016-08-23 21:12:51 +02:00
Eelco Dolstra
93902ea108 nsswitch.conf: Omit ldap unless ldap is enabled
This prevents programs from trying to find nss_ldap.
2015-02-25 14:31:13 +01:00
Eelco Dolstra
d73025a5fe Enable systemd's mymachines NSS module
It makes every local container registered with machined resolvable.
2014-08-24 17:10:19 +02:00
Eelco Dolstra
29027fd1e1 Rewrite ‘with pkgs.lib’ -> ‘with lib’
Using pkgs.lib on the spine of module evaluation is problematic
because the pkgs argument depends on the result of module
evaluation. To prevent an infinite recursion, pkgs and some of the
modules are evaluated twice, which is inefficient. Using ‘with lib’
prevents this problem.
2014-04-14 16:26:48 +02:00
Eelco Dolstra
d5047faede Remove uses of the "merge" option attribute
It's redundant because you can (and should) specify an option type, or
an apply function.
2013-10-28 22:45:56 +01:00
Eelco Dolstra
5c1f8cbc70 Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00