Florian Klink
c1a6e60335
Merge pull request #85598 from danderson/tailscale-fix-cachedir
...
nixos/tailscale: set a CacheDir in the systemd unit.
2020-04-21 22:38:32 +02:00
Florian Klink
6ba4ef6580
Merge pull request #85708 from Beskhue/fix-documentation
...
nixos/phpfpm: fix erroneous pools example
2020-04-21 22:16:15 +02:00
Florian Klink
91e3358f62
Merge pull request #85692 from nh2/systemd-update-default-rate-limit
...
journald service: Increase default rate limit 1000 -> 10000.
2020-04-21 21:06:48 +02:00
Thomas Churchman
8880957042
nixos/phpfpm: fix erroneous pools example
2020-04-21 20:59:52 +02:00
worldofpeace
9b20a24d4d
Merge pull request #85643 from petabyteboy/feature/generate-config
...
nixos/tools: adapt for renamed console options
2020-04-21 12:50:55 -04:00
Niklas Hambüchen
d16d34732c
journald service: Increase default rate limit 1000 -> 10000.
...
Follows the upstream change of this default:
https://github.com/systemd/systemd/pull/8660
2020-04-21 18:29:03 +02:00
Dominik Xaver Hörl
0412bde942
treewide: add bool type to enable options, or make use of mkEnableOption
...
Add missing type information to manually specified enable options or replace them by mkEnableOption where appropriate.
2020-04-21 08:55:36 +02:00
Milan Pässler
d19089e1e7
nixos/tools: adapt for renamed console options
2020-04-21 02:07:53 +02:00
David Anderson
cee5ddbb28
nixos/tailscale: set a CacheDir in the systemd unit.
...
Fixes a bug where tailscaled drops some files into / when CacheDir
is unset.
Signed-off-by: David Anderson <dave@natulte.net>
2020-04-20 15:35:55 -07:00
Marek Mahut
60100a7c92
Merge pull request #83769 from dadada/nixos/dokuwiki-multi-server
...
nixos/dokuwiki: add support for multi-site, additional plugins and templates
2020-04-20 19:39:48 +02:00
Eelco Dolstra
f76d7b5e41
Merge pull request #85620 from matthewbauer/use-modulesPath-for-nixos-generate-config
...
nixos/nixos-generate-config.pl: use modulesPath instead of <nixpkgs>
2020-04-20 17:25:17 +02:00
Matthew Bauer
c45295d47e
nixos/nixos-generate-config.pl: use modulesPath instead of <nixpkgs>
...
For imports, it is better to use ‘modulesPath’ than rely on <nixpkgs>
being correctly set. Some users may not have <nixpkgs> set correctly.
In addition, when ‘pure-eval=true’, <nixpkgs> is unset.
2020-04-20 09:57:17 -05:00
Léo Gaspard
203955fa0c
Merge pull request #82714 from delroth/s3tc
...
libtxc_dxtn{,_s2tc}: remove from nixpkgs + hardware.opengl options
2020-04-20 13:41:47 +02:00
Jörg Thalheim
2f0ee4bd0b
Merge pull request #85371 from Mic92/tmpfiles
2020-04-20 10:32:58 +01:00
adisbladis
ab37d7e7ea
nixos-containers: Add support for custom nixpkgs argument
2020-04-20 07:33:46 +01:00
Pierre Bourdon
1b89bffcf4
libtxc_dxtn{,_s2tc}: remove from nixpkgs + hardware.opengl options
...
Context: discussion in https://github.com/NixOS/nixpkgs/pull/82630
Mesa has been supporting S3TC natively without requiring these libraries
since the S3TC patent expired in December 2017.
2020-04-20 03:19:41 +02:00
Florian Klink
a88d17bc69
Merge pull request #83301 from evils/tuptime
...
Tuptime: Init Package, Module and Test
2020-04-19 23:38:53 +02:00
worldofpeace
f882896cc8
Merge pull request #73934 from flokli/nixos-test-port-cockroachdb
...
nixosTests.cockroachdb: port to python
2020-04-19 16:30:45 -04:00
Yegor Timoshenko
6f1165a0cb
Merge pull request #84522 from emilazy/add-linux-hardened-patches
...
linux_*_hardened: use linux-hardened patch set
2020-04-19 20:01:35 +03:00
Michael Weiss
0e4417f118
Revert "nixos: Introduce nix.buildLocation option"
...
This reverts commit 5291925fd2486175e781669412fa5a525da7602a.
Reason: This started to cause severe regressions, see:
- https://github.com/NixOS/nixpkgs/issues/85552
- https://github.com/NixOS/nixpkgs/pull/83166#pullrequestreview-395960588
Fixes #85552 .
2020-04-19 15:16:08 +02:00
dadada
2d86cca35e
nixos/dokuwiki: change default of aclFile and usersFile
...
`aclFile` and `usersFile` will be set to a default value if `aclUse` is
specified and aclFile is not overriden by `acl`.
2020-04-18 23:37:19 +02:00
dadada
9460fb5788
nixos/dokuwiki: modify usersFile and aclFile
...
Use types.str instead of types.path to exclude private information from
the derivation.
Add a warinig about the contents of acl beeing included in the nix
store.
2020-04-18 23:37:19 +02:00
dadada
2b67a89f29
nixos/dokuwiki: dokuwiki user
2020-04-18 23:37:19 +02:00
dadada
2e699f1db1
nixos/dokuwiki: add option disableActions
2020-04-18 23:37:18 +02:00
dadada
a58dc30d34
nixos/dokuwiki: set default value for usersFile
...
If usersFile is not set, a file is created along the stateDir that can
hold the users and supports dynamically adding users using the web GUI.
2020-04-18 23:37:18 +02:00
dadada
0228046eec
nixos/dokuwiki: add assertion for usersFile
2020-04-18 23:37:18 +02:00
dadada
af6a7a0486
nixos/dokuwiki: add plugins and templates options
...
Adds support for additional plugins and templates similarly to how
wordpress.nix does it.
Plugins and templates need to be packaged as in the example.
2020-04-18 23:37:18 +02:00
dadada
71baf4801c
nixos/dokuwiki: refactor
2020-04-18 23:37:18 +02:00
dadada
dc7ed06615
nixos/dokuwiki: add <name?> option
...
Enables multi-site configurations.
This break compatibility with prior configurations that expect options
for a single dokuwiki instance in `services.dokuwiki`.
2020-04-18 23:37:18 +02:00
Jörg Thalheim
35eb7793a3
Merge pull request #83166 from avnik/nix-build-location
2020-04-18 18:37:15 +01:00
Alexander V. Nikolaev
5291925fd2
nixos: Introduce nix.buildLocation option
...
Allow to specify where package build will happens.
It helps big packages (like browsers) not to overflow tmpfs.
2020-04-18 20:31:04 +03:00
worldofpeace
996ae856b6
Merge pull request #85365 from immae/fix_acme_postrun
...
nixos/acme: Fix postRun in acme certificate being ran at every run
2020-04-18 13:16:16 -04:00
Alyssa Ross
1b0d8015fe
nixos/rss2email: globally install rss2email
...
For man pages.
2020-04-18 14:16:00 +00:00
Pavol Rusnak
fadcfc3ea4
treewide: per RFC45, remove more unquoted URLs
2020-04-18 14:04:37 +02:00
Milan Pässler
16a4332d60
nixos/deluge: support 2.x
2020-04-18 02:00:04 +02:00
Ismaël Bouya
8e88b8dce2
nixos/acme: Fix postRun in acme certificate being ran at every run
2020-04-17 22:16:50 +02:00
Emily
b0d5032ee4
nixos/hardened: add emily to maintainers
2020-04-17 16:13:39 +01:00
Emily
ad9bfe2254
nixos/hardened: enable user namespaces for root
...
linux-hardened sets kernel.unprivileged_userns_clone=0 by default; see
anthraxx/linux-hardened@104f44058f .
This allows the Nix sandbox to function while reducing the attack
surface posed by user namespaces, which allow unprivileged code to
exercise lots of root-only code paths and have lead to privilege
escalation vulnerabilities in the past.
We can safely leave user namespaces on for privileged users, as root
already has root privileges, but if you're not running builds on your
machine and really want to minimize the kernel attack surface then you
can set security.allowUserNamespaces to false.
Note that Chrome's sandbox requires either unprivileged CLONE_NEWUSER or
setuid, and Firefox's silently reduces the security level if it isn't
allowed (see about:support), so desktop users may want to set:
boot.kernel.sysctl."kernel.unprivileged_userns_clone" = true;
2020-04-17 16:13:39 +01:00
Emily
84f258bf09
nixos/hardened: don't set vm.unprivileged_userfaultfd
...
Upstreamed in anthraxx/linux-hardened@a712392b88 .
2020-04-17 16:13:39 +01:00
Emily
cc28d51237
nixos/hardened: don't set vm.mmap_min_addr
...
Upstreamed in anthraxx/linux-hardened@f1fe0a64dd .
2020-04-17 16:13:39 +01:00
Emily
46d12cca56
nixos/hardened: don't set vm.mmap_rnd{,_compat}_bits
...
Upstreamed in anthraxx/linux-hardened@ae6d85f437 .
2020-04-17 16:13:39 +01:00
Emily
af4f57b2c4
nixos/hardened: don't set net.core.bpf_jit_harden
...
Upstreamed in anthraxx/linux-hardened@82e384401d .
2020-04-17 16:13:39 +01:00
Emily
71bbd876b7
nixos/hardened: don't set kernel.unprivileged_bpf_disabled
...
Upstreamed in anthraxx/linux-hardened@1a3e0c2830 .
2020-04-17 16:13:39 +01:00
Emily
9da578a78f
nixos/hardened: don't set kernel.dmesg_restrict
...
Upstreamed in anthraxx/linux-hardened@e3d3f13ffb .
2020-04-17 16:13:39 +01:00
Emily
cf1bce6a7a
nixos/hardened: don't set vsyscall=none
...
Upstreamed in anthraxx/linux-hardened@d300b0fdad .
2020-04-17 16:13:39 +01:00
Emily
3b32cd2a5b
nixos/hardened: don't set slab_nomerge
...
Upstreamed in anthraxx/linux-hardened@df29f9248c .
2020-04-17 16:13:39 +01:00
Euan Kemp
bc138f407f
nixos/k3s: add initial k3s service
...
* nixos/k3s: simplify config expression
* nixos/k3s: add config assertions and trim unneeded bits
* nixos/k3s: add a test that k3s works; minor module improvements
This is a single-node test. Eventually we should also have a multi-node
test to verify the agent bit works, but that one's more involved.
* nixos/k3s: add option description
* nixos/k3s: add defaults for token/serveraddr
Now that the assertion enforces their presence, we dont' need to use the typesystem for it.
* nixos/k3s: remove unneeded sudo in test
* nixos/k3s: add to test list
2020-04-17 16:39:54 +02:00
adisbladis
5340ebe085
mopidy: Create a mopidyPackages set
...
This is to avoid mixing python versions in the same plugin closure.
2020-04-17 12:39:03 +01:00
Yegor Timoshenko
8262ecd369
Merge pull request #85004 from emilazy/add-initrd-secrets-path-assertion
...
nixos/stage-1: check secret paths before copying
2020-04-16 17:42:40 +03:00
worldofpeace
b61999e4ad
Merge pull request #85332 from arianvp/revert-acme
...
Revert "nixos/acme: Fix allowKeysForGroup not applying immediately"
2020-04-16 08:43:36 -04:00