Commit Graph

6817 Commits

Author SHA1 Message Date
Ryan Lahfa
4242ecd871
Merge pull request #248372 from yaxitech/amd-sev-guest 2023-09-25 13:10:42 +02:00
Alyssa Ross
c5c30274a3 nixosTests.tinywl: fix by adding Mesa drivers
Required since upstream commit 49738406 ("render: don't fall back to
Pixman if we have a render node").
2023-09-25 13:04:20 +02:00
WilliButz
2d30a37d9f
Merge pull request #248925 from FugiMuffi/prometheus-sabnzbd-exporter
prometheus-sabnzbd-exporter: init at 0.1.70
2023-09-25 12:09:36 +02:00
Will Fancher
4bd4976b87
Merge pull request #251290 from Majiir/systemd-initrd-networking-features
nixos/network-interfaces-systemd: support `vlans`, `bridges` in systemd-initrd
2023-09-25 05:07:23 -04:00
Maximilian Bosch
9bd9e20e9a
Merge pull request #256090 from CRTified/sshd-validation-fix
nixos/sshd: Specify connection parameters for configuration validation
2023-09-24 14:12:46 +02:00
Martin Weinelt
1ff350f7b8
Merge pull request #81460 from vcunat/p/knot-nixConfig
nixos/knot: allow full configuration by nix values
2023-09-23 20:55:54 +02:00
Janne Heß
cc55ef9d55
Merge pull request #254993 from helsinki-systems/feat/stc-mount-improvements
nixos/switch-to-configuration: Mount improvements and a lot more test cases
2023-09-23 17:03:13 +02:00
Martin Weinelt
45e71a7a99
nixosTests.kea: use knot.settings for configuration 2023-09-23 10:04:02 +02:00
Martin Weinelt
8e93f353cc
nixosTests.knot: use settings format 2023-09-23 10:04:02 +02:00
Maciej Krüger
04e64fa716
nixosTests.sudo-rs: use sudo-rs
As the module was renamed, we need to use the new one
2023-09-22 15:14:14 +02:00
Janne Heß
358347e8b6
nixos/switchTest: Also test swap devices 2023-09-22 10:26:11 +02:00
Janne Heß
85c1c30fd9
nixos/switch-to-configuration: Never unmount / or /nix
Also adds a huge test for fstab handling
2023-09-22 10:26:10 +02:00
Nikolay Korotkiy
09846eacb2
Merge pull request #252001 from imincik/qgis-nixos-test
qgis: add nixos tests
2023-09-20 23:46:57 +04:00
Robert Schütz
728bae020d
Merge pull request #253687 from dotlambda/plausible-2.0.0
plausible: 1.4.4 -> 2.0.0
2023-09-20 19:28:09 +00:00
Robert Schütz
c4574a95c5 plausible: also install tracker 2023-09-20 09:07:28 -07:00
Maciej Krüger
61536e7a1f
nixosTests.sudo-rs: fix syntax 2023-09-20 13:58:08 +02:00
Maciej Krüger
922926cfbc
Merge pull request #253876 from nbraud/nixos/sudo-rs 2023-09-20 13:55:33 +02:00
Weijia Wang
0425ad73b3
Merge pull request #255549 from wegank/wordpress-bump
wordpress: 6.2.2 -> 6.3.1
2023-09-20 00:41:56 +02:00
Carl Richard Theodor Schneider
cd2dead42c nixos/tests/openssh: add Match config for validation test 2023-09-19 18:13:44 +02:00
Fabián Heredia Montiel
90040cd36a linux/hardened/patches/6.5: init at 6.5.3-hardened1 2023-09-19 07:09:14 +00:00
nicoo
7b5b3f5124 nixos/sudo: Add tests for sudo-rs too
Duplicated sudo's testsuite for now, as its maintainer does not with
to collaborate on testing effors; see #253876.

Environment-related tests were removed, as sudo-rs does not support
`(NO)SETENV` yet; see memorysafety/sudo-rs#760
2023-09-18 18:03:58 +00:00
Maximilian Bosch
e4f0f0977e
Merge pull request #241973 from 999eagle/feat/synapse-workers
nixos/synapse: add support for workers, cleanup
2023-09-18 19:54:20 +02:00
Sophie Tauchert
ca1ffe5869
nixos/synapse: move services.matrix-synapse.workers.config to services.matrix-synapse.workers 2023-09-18 08:24:37 +02:00
Sophie Tauchert
2edea7611b
nixos/synapse: document options better
Co-authored-by: Daniel Olsen <daniel.olsen99@gmail.com>
2023-09-18 08:24:36 +02:00
Sophie Tauchert
b20cbb12cd
nixos/synapse: add test for running synapse with workers
Co-authored-by: Daniel Olsen <daniel.olsen99@gmail.com>
2023-09-18 08:24:36 +02:00
Robert Scott
0834c95bd6 nixosTests.docker-tools: bump diskSize from 2048 -> 3072 2023-09-17 12:18:42 +01:00
zaldnoay
b53e5a6479 nixos/frp: add test and link to package 2023-09-17 14:37:19 +08:00
Jörg Thalheim
fd264ba8a2 nixos/zfs: fix tests on zfsUnstable 2023-09-17 05:58:38 +02:00
Weijia Wang
b4521212e4 wordpress: 6.2.2 -> 6.3.1 2023-09-17 00:02:26 +02:00
Vincent Haupert
f13bf0c0d4 nixos/amd.sev: add test 2023-09-15 15:38:49 +02:00
Pol Dellaiera
d30fde0977
Merge pull request #250735 from TheNeikos/fix/discourse
discourse: update 3.1.0.beta4 -> 3.1.0
2023-09-14 16:03:28 +02:00
Michele Guerini Rocco
607cb89351
Merge pull request #254512 from rnhmjoj/pr-anbox
anbox: always use postmarket OS images
2023-09-14 12:57:39 +02:00
Janne Heß
c3e6412260
nixos/switchTest: Also test restarting from aborted switches 2023-09-13 17:11:32 +02:00
Janne Heß
e0717ce857
nixos/switchTest: Also test systemd restarts 2023-09-13 17:04:54 +02:00
rnhmjoj
7d6ee8ce1e
nixos/tests/shadow: test hashedPasswordFile 2023-09-13 17:00:05 +02:00
Janne Heß
211e2d738b
nixos/switchTest: Also test init interface version 2023-09-13 16:56:01 +02:00
Janne Heß
d1c1335908
nixos/switch-to-configuration: Test more action things 2023-09-13 16:42:19 +02:00
Marcel Müller
52f22574ea nixosTests.discourse: Do not use deprecated field 2023-09-13 14:48:17 +02:00
Fabián Heredia Montiel
cc1fdc5376
Merge pull request #254181 from StillerHarpo/adguardhome
nixos/adguardhome: Fix openFirewall
2023-09-12 16:23:16 -05:00
Herwig Hochleitner
30bcc6c39d
Merge pull request #248310 from emilylange/nixos/gitea-forgejo-split
nixos/forgejo: fork from nixos/gitea (split)

close https://github.com/NixOS/nixpkgs/issues/244866
2023-09-12 22:10:01 +02:00
nicoo
c7423cd734 noto-fonts-emoji → noto-fonts-color-emoji
Clarify that the monochrome font is not included, per #221181.

The new name is also coherent with the name of the font,
according to `fontconfig`: Noto Color Emoji.
2023-09-12 12:38:07 +00:00
Mario Rodas
23e69f92c8
Merge pull request #254324 from marsam/update-postgis
postgresqlPackages.postgis: 3.3.3 -> 3.4.0
2023-09-12 00:15:32 -05:00
datafoo
ade414b6c7 nixos/acme: rename option credentialsFile to environmentFile 2023-09-11 16:34:20 +00:00
rnhmjoj
705b998b83
anbox: always use postmarket OS images 2023-09-11 08:09:37 +02:00
Christian Theune
0e1a8027d1 nixos/swraid: fix regression for old initrd and add test coverage 2023-09-10 17:16:33 +02:00
Christian Theune
7f341bb450 nixos/swraid: fix monitor service 2023-09-10 15:34:11 +02:00
Pierre Bourdon
bfdf28becf
Merge pull request #251770 from robryk/suidwrapapparm
nixos/security/wrappers: simplifications and a fix for #98863 (respin of #199599)
2023-09-10 09:51:36 +02:00
Oliver Schmidt
e362fe9c6d security/acme: limit concurrent certificate generations
fixes #232505

Implements the new option `security.acme.maxConcurrentRenewals` to limit
the number of certificate generation (or renewal) jobs that can run in
parallel. This avoids overloading the system resources with many
certificates or running into acme registry rate limits and network
timeouts.

Architecture considerations:
- simplicity, lightweight: Concerns have been voiced about making this
  already rather complex module even more convoluted. Additionally,
  locking solutions shall not significantly increase performance and
  footprint of individual job runs.
  To accomodate these concerns, this solution is implemented purely in
  Nix, bash, and using the light-weight `flock` util. To reduce
  complexity, jobs are already assigned their lockfile slot at system
  build time instead of dynamic locking and retrying. This comes at the
  cost of not always maxing out the permitted concurrency at runtime.
- no stale locks: Limiting concurrency via locking mechanism is usually
  approached with semaphores. Unfortunately, both SysV as well as
  POSIX-Semaphores are *not* released when the process currently locking
  them is SIGKILLed. This poses the danger of stale locks staying around
  and certificate renewal being blocked from running altogether.
  `flock` locks though are released when the process holding the file
  descriptor of the lock file is KILLed or terminated.
- lockfile generation: Lock files could either be created at build time
  in the Nix store or at script runtime in a idempotent manner.
  While the latter would be simpler to achieve, we might exceed the number
  of permitted concurrent runs during a system switch: Already running
  jobs are still locked on the existing lock files, while jobs started
  after the system switch will acquire locks on freshly created files,
  not being blocked by the still running services.
  For this reason, locks are generated and managed at runtime in the
  shared state directory `/var/lib/locks/`.

nixos/security/acme: move locks to /run

also, move over permission and directory management to systemd-tmpfiles

nixos/security/acme: fix some linter remarks in my code

there are some remarks left for existing code, not touching that

nixos/security/acme: redesign script locking flow

- get rid of subshell
- provide function for wrapping scripts in a locked environment

nixos/acme: improve visibility of blocking on locks

nixos/acme: add smoke test for concurrency limitation

heavily inspired by m1cr0man

nixos/acme: release notes entry on new concurrency limits

nixos/acme: cleanup, clarifications
2023-09-09 20:13:18 +02:00
ajs124
0a3aa06b53
Merge pull request #253739 from mweinelt/firefox-102-removal
firefox-esr-102-unwrapped: remove
2023-09-09 19:25:42 +02:00
Janik
eda85eb31d
Merge pull request #251062 from ajs124/restic-wrapper-script 2023-09-09 19:11:33 +02:00