3
0
Fork 0
forked from mirrors/nixpkgs
Commit graph

12371 commits

Author SHA1 Message Date
Yurii Matsiuk 0806c2602a
Update nixos/modules/services/networking/teleport.nix
Co-authored-by: pennae <82953136+pennae@users.noreply.github.com>
2022-01-11 10:39:00 +01:00
Yurii Matsiuk d811a6ea73
nixos/teleport: init 2022-01-11 10:11:17 +01:00
misuzu 768d0d6098 nixos/netdata: expose /etc/netdata 2022-01-10 23:56:57 +02:00
misuzu 9e6145c73b nixos/netdata: add configDir option
This option makes the complete netdata configuration directory available for
modification. The default configuration is merged with changes
defined in the configDir option.

Co-authored-by: Michael Raitza <spacefrogg-github@meterriblecrew.net>
2022-01-10 23:56:53 +02:00
Nikolay Amiantov b451eca621 nscd service: fix ordering and start automatically
During working on #150837 I discovered that `google-oslogin` test
started failing, and so did some of my development machines. Turns out
it was because nscd doesn't start by default; rather it's wanted by
NSS lookup targets, which are not always fired up.

To quote from section on systemd.special(7) on `nss-user-lookup.target`:

> All services which provide parts of the user/group database should be
> ordered before this target, and pull it in.

Following this advice and comparing our unit to official `sssd.service`
unit (which is a similar service), we now pull NSS lookup targets from
the service, while starting it with `multi-user.target`.
2022-01-10 22:45:12 +03:00
Martin Weinelt c61a33bc8b
Merge pull request #129559 from fortuneteller2k/thelounge 2022-01-10 11:46:46 +01:00
Aaron Andersen 03c291e6a3
Merge pull request #153987 from jakubgs/init/mtr-exporter
mtr-exporter: init at 0.1.0 (3ce854a5)
2022-01-09 22:34:30 -05:00
fortuneteller2k 38e1dbd942 nixos/thelounge: private -> public
Co-authored-by: Winter <78392041+winterqt@users.noreply.github.com>
2022-01-10 11:28:41 +08:00
legendofmiracles d9b2a764b0
Merge pull request #148541 from legendofmiracles/final-asf 2022-01-09 20:45:13 -06:00
legendofmiracles 7d1d2fe2f8
ArchiSteamFarm: 5.2.0.10 -> 5.2.1.5; ASF-ui: update 2022-01-09 20:26:03 -06:00
Martin Weinelt 24999924b4
Merge pull request #153038 from winterqt/thelounge-plugins 2022-01-10 00:59:33 +01:00
Sandro 8928525bd8
Merge pull request #154124 from Mic92/ddclient 2022-01-09 21:43:19 +01:00
Sandro a85f163c46
Merge pull request #103946 from lopsided98/sshd-trigger-limit 2022-01-09 21:37:28 +01:00
Bernardo Meurer 63c1c30753
nixos/roon-server: open TCP ports 9330-9332 in firewall
During the bump to 1.8-880 these became necessary, debugging took place
in the [relevant PR][1].

[1]: https://github.com/NixOS/nixpkgs/pull/152251
2022-01-09 16:40:27 -03:00
Winter 0028d75b1c nixos/thelounge: add winter to maintainers 2022-01-09 13:12:41 -05:00
Winter fe20f479e9 nixos/thelounge: add plugins option 2022-01-09 13:12:41 -05:00
Jan Tojnar 67879a9353
Merge pull request #153398 from jtojnar/tracker-subcommands
nixos/tracker: Define env var so it can find miners’ subcommands
2022-01-09 16:09:35 +01:00
Jakub Sokołowski 7d988867ff
mtr-exporter: init at 0.1.0 (3ce854a5)
This is a useful utility for monitoring network performance over time
using a combination of MTR and Prometheus. Also adding a service definition.

Signed-off-by: Jakub Sokołowski <jakub@status.im>
2022-01-09 13:57:06 +01:00
Jörg Thalheim 51967ca77a nixos/ddclient: better default for nsupdate 2022-01-09 13:38:41 +01:00
Jörg Thalheim 2febc7dd79 nixos/ddclient: don't store config world-readable 2022-01-09 11:30:40 +01:00
Vladimír Čunát d856f24d3c
Merge #151019: amdgpu-pro: 17.40 -> 21.30 2022-01-09 11:27:18 +01:00
Nikolay Amiantov e8daaa85d4
Merge pull request #153589 from abbradar/uwsgi-fixes
uWSGI configuration generation fixes
2022-01-09 09:49:05 +03:00
Frank Doepper 0098575c86
nixos/frr: init
- old quagga service and test adapted to frr

Co-Authored-By: Martin Weinelt <hexa@darmstadt.ccc.de>
2022-01-09 04:12:55 +01:00
Sandro 8aeafc25c9
Merge pull request #154054 from SuperSandro2000/prometheus-bearer-token 2022-01-09 01:48:43 +01:00
Ben Wolsieffer f5e0f2932e sshd: disable trigger limit for systemd socket
When startWhenNeeded is enabled, a brute force attack on sshd will cause
systemd to shut down the socket, locking out all SSH access to the machine.
Setting TriggerLimitIntervalSec to 0 disables this behavior.
2022-01-08 19:48:37 -05:00
Sandro Jäckel 39ce4ddd85
nixos/prometheus: fix usage of bearer_token 2022-01-08 22:56:51 +01:00
Winter b52607f43b nixos/acme: ensure web servers using certs can access them 2022-01-08 15:05:34 -05:00
Robert Hensing 32356ce11b
Merge pull request #153867 from astro/stunnel
stunnel: allow servers to connect to other hosts
2022-01-08 20:49:48 +01:00
Florian Klink 982de405d7
Merge pull request #153901 from flokli/sniproxy-logdir
nixos/sniproxy: remove unused logDir option
2022-01-08 20:07:57 +01:00
Thomas Dy 97864e984d nixos/kubernetes: actually set containerd to use systemd cgroups
The correct configuration is listed in the kubernetes documentation
https://kubernetes.io/docs/setup/production-environment/container-runtimes/#containerd-systemd

The correct option can also be seen in `containerd config default`
2022-01-08 17:29:32 +10:00
pennae 2d356a1969 nixos/kubernetes: move all k8s docs out of the sandbox
otherwise the manual won't build.

ideally they'll move back into the sandbox at some point, but we're
obviously not qualified to put them there.
2022-01-08 17:13:27 +10:00
pennae 635376d3af Revert "nixos/kubernetes: make lib option internal and readonly"
This reverts commit 7e28421e17.
2022-01-08 17:13:27 +10:00
Jan Tojnar 283c47bc45
Merge pull request #150548 from K900/wireplumber
wireplumber: init, add NixOS module
2022-01-08 06:11:59 +01:00
Jan Tojnar 0c4ccc29ce
Merge pull request #153840 from bobby285271/gsd
nixos/gnome-settings-daemon: pick up correct .wants directories
2022-01-08 06:07:14 +01:00
Bobby Rong 84ad67f7c6
nixos/gnome-settings-daemon: pick up correct .wants directories
In https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/merge_requests/153
the user target names for GSD components has been renamed for example
from `gsd-a11y-settings.target` to `org.gnome.SettingsDaemon.A11ySettings.target`,
and nowadays `gsd-*.target` are just symbolic links of `/dev/null` and will be
removed in the future.

At the same time, as mentioned in d27212d466,
we are adding `systemd.user.targets.<name>.wants` stuff here only because
systemd.packages doesn't pick the .wants directories. Nowadays those GSD components
are managed in `/etc/systemd/user/gnome-session@gnome.target.d/gnome.session.conf`
so it should be safe to remove them.

In this commit we also try to pick up those new .wants directories, see also
https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/blob/41.0/plugins/meson.build#L57

Result of `cd /nix/store/iqzy2a6wn9bq9hqx7pqx0a153s5xlnwp-gnome-settings-daemon-41.0; find | grep wants`:

```
./share/systemd/user/gnome-session-x11-services-ready.target.wants
./share/systemd/user/gnome-session-x11-services-ready.target.wants/org.gnome.SettingsDaemon.XSettings.service
./share/systemd/user/gnome-session-x11-services.target.wants
./share/systemd/user/gnome-session-x11-services.target.wants/org.gnome.SettingsDaemon.XSettings.service
```

Result of `cd /nix/store/armzljlnsvc1gn0nq0bncb9lf8fy32zy-gnome-settings-daemon-3.34.0; find | grep wants`:

```
./lib/systemd/user/gnome-session-initialized.target.wants
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-a11y-settings.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-color.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-datetime.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-power.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-housekeeping.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-keyboard.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-media-keys.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-screensaver-proxy.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-sharing.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-sound.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-smartcard.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-wacom.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-print-notifications.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-rfkill.target
./lib/systemd/user/gnome-session-initialized.target.wants/gsd-wwan.target
./lib/systemd/user/gnome-session-x11-services.target.wants
./lib/systemd/user/gnome-session-x11-services.target.wants/gsd-xsettings.target
```
2022-01-08 10:19:02 +08:00
Florian Klink 6a75955c21 nixos/sniproxy: remove unused logDir option
This never configured where SNI should log to, as it's up to the user to
provide the full sniproxy config (which can be configured to log to a
file).

This option only produced a ExecStartPre script that created the folder.

Let's use LogsDirectory to create it. In case users want to use another
directory for logs, they can override LogsDirectory or set their own
ExecStartPre script.
2022-01-07 22:40:12 +01:00
Astro 422c5a5db5 stunnel: allow servers to connect to other hosts 2022-01-07 17:54:01 +01:00
K900 4909a15582 nixos/wireplumber: init
This is extremely basic for now, but we can add more stuff later
2022-01-07 17:34:28 +03:00
Aaron Andersen 2e95239bd1
Merge pull request #153729 from aanderse/nixos/caddy
nixos/caddy: add globalConfig option
2022-01-07 08:35:07 -05:00
Aaron Andersen 5dc2454267
Merge pull request #153706 from ymarkus/bookstack-module
nixos/bookstack: fix setup service
2022-01-06 15:09:27 -05:00
Artturin be9c5fe4b7 nixos/ananicy: apply cgroup workaround if v2 is enabled 2022-01-06 21:55:42 +02:00
Aaron Andersen ea0d11e503
Merge pull request #153745 from mohe2015/wordpress-no-directory-indexes
nixos/wordpress: Disable directory indexes
2022-01-06 13:12:54 -05:00
Moritz Hedtke bb358d6566
nixos/wordpress: Disable directory indexes
Fixes #151159
Confirmed using path http://localhost/wp-includes/
2022-01-06 18:04:19 +01:00
Aaron Andersen 45477f7ce5 nixos/caddy: add globalConfig option 2022-01-06 09:25:58 -05:00
Yannick Markus 7f2bc1d736
nixos/bookstack: fix setup service 2022-01-06 11:56:43 +01:00
Martin Weinelt 9b708d814b
Merge pull request #153625 from Mic92/tinc 2022-01-06 00:42:57 +01:00
Jörg Thalheim 989238ec03
Merge pull request #153426 from 4z3/systemwide-pipewire
nixos/pipewire: add systemWide option
2022-01-05 21:33:07 +00:00
legendofmiracles 86f45c7c6f
ArchiSteamFarm: 5.2.0.9 -> 5.2.0.10; ASF-ui: update 2022-01-05 14:09:24 -06:00
legendofmiracles bf30cd48ed
nixos/archisteamfarm: init 2022-01-05 14:09:23 -06:00
José Romildo Malaquias 75e9b9b058
Merge pull request #153472 from romildo/upd.ecrire
enlightenment.ecrire: init at 0.2.0
2022-01-05 16:00:50 -03:00
Jörg Thalheim db2953eb19 nixos/tinc: add mic92 maintainer 2022-01-05 19:29:01 +01:00
Vladimír Čunát 180213a0ac
nixos/kresd: fix IPv6 scope syntax
The systemd syntax is suprising to me, but I suppose it's worth being
compatible as people might be sharing it with other modules.
Our regexp is lenient on IPv6 address part, so this is actually
backwards compatible (i.e. you can put the scope at either place).
2022-01-05 15:58:27 +01:00
Nikolay Amiantov 2be5e93ecc uwsgi service: deduplicate plugins list
Duplicates can lead to unnecessary `uwsgi` rebuilds and conflicts.
2022-01-05 14:18:59 +03:00
Nikolay Amiantov 4be78f0dd3 uwsgi service: redefine PATH envvar
Previously if user had `PATH` variable set we would define several
`PATH` variables and trigger a conflict.
2022-01-05 14:18:59 +03:00
Aaron Andersen 6b1102d94b
Merge pull request #152029 from CRTified/adguard-settings
nixos/adguardhome: Add settings option
2022-01-04 19:19:18 -05:00
Robert Hensing 70d27303da
Merge pull request #149532 from pennae/split-docs-build
nixos/*: split docs build
2022-01-04 22:33:23 +01:00
Jan Tojnar dafaecb3b9 nixos/gvfs: fix libmtp udev package path for realz
bin is the primary output so the previous attempt at fixing this
(2d7fc66c79)
was a no-op.
2022-01-04 19:22:05 +01:00
tv 7678a5848c nixos/pipewire: add systemWide option 2022-01-04 16:07:07 +01:00
José Romildo 676ffe1f39 nixos/enlightenment: add ecrire to system packages 2022-01-04 09:52:56 -03:00
Jörg Thalheim 0432195a4b
Merge pull request #153314 from Mic92/prometheus
prometheus: add authorization section
2022-01-04 08:34:51 +00:00
Jan Tojnar 3c1b474e44 nixos/tracker: Define env var so it can find miners’ subcommands
tracker looks in its directory tree for executable files
to make available as subcommands. Users expect to find subcommands
from tracker-miners package but that fails as they are in different
tree. We also cannot change the lookup path since tracker-miners
also depends on a library from tracker package.

Until we can break the dependency cycle on package level:

   tracker -> tracker-miners -> tracker-sparql (tracker)

we need to work around it. I chose to set an environment
variable that overrides the subcommands lookup to a tree
symlinking files from both packages in GNOME NixOS module.

https://gitlab.gnome.org/GNOME/tracker/-/issues/341
Fixes: https://github.com/NixOS/nixpkgs/issues/153378
2022-01-03 22:25:03 +01:00
Aaron Andersen 3440425750
Merge pull request #152455 from erdnaxe/minecraft_hardening
nixos/minecraft-server: systemd unit hardening
2022-01-03 12:24:05 -05:00
Aaron Andersen bf607abf73
Merge pull request #152223 from ju1m/logrotate
nixos/logrotate: enable multiple paths per entry
2022-01-03 12:11:12 -05:00
piegames ae040631c9
Merge pull request #142758: Add Heisenbridge module 2022-01-03 18:05:55 +01:00
piegames 4d69ad4b1f nixos/heisenbridge: Init 2022-01-03 15:40:40 +01:00
Philipp 3d47865f7f nixos/matrix-conduit: init 2022-01-03 15:36:56 +01:00
Jörg Thalheim fd0a6311a7 prometheus: add authorization section 2022-01-03 12:04:08 +01:00
Robert Schütz c020d0af17
Merge pull request #153151 from mweinelt/python2-removals
Remove applications that depend on python2Packages
2022-01-03 09:43:43 +00:00
Aneesh Agrawal 8729e8e261 nixos/restic-rest-server: Autocreate empty .htpasswd if needed for service boot
When `privateRepos = true`, the service will not start if the `.htpasswd` does not exist.
Use `systemd-tmpfiles` to autocreate an (empty) file to ensure the service can boot
before actual `htpasswd` contents are registered.

This is safe as restic-rest-server will deny all entry if the file is empty.
2022-01-02 21:13:07 -05:00
Naïm Favier ec150abd1a
Revert "nixos/nginx: disable rejectSSL activation when https is disabled"
This reverts commit 2f66ac01e9.
2022-01-02 21:01:29 +01:00
pennae 1301bdb185 nixos/make-options-doc: turn relatedPackages into links
link to search.nixos.org instead of pulling package metadata out of pkgs. this
lets us cache docs of a few more modules and provides easier access to package
info from the HTML manual, but makes the manpage slightly less useful since
package description are no longer rendered.
2022-01-02 19:46:13 +01:00
pennae fc614c37c6 nixos/documentation: split options doc build
most modules can be evaluated for their documentation in a very
restricted environment that doesn't include all of nixpkgs. this
evaluation can then be cached and reused for subsequent builds, merging
only documentation that has changed into the cached set. since nixos
ships with a large number of modules of which only a few are used in any
given config this can save evaluation a huge percentage of nixos
options available in any given config.

in tests of this caching, despite having to copy most of nixos/, saves
about 80% of the time needed to build the system manual, or about two
second on the machine used for testing. build time for a full system
config shrank from 9.4s to 7.4s, while turning documentation off
entirely shortened the build to 7.1s.
2022-01-02 19:46:13 +01:00
Aaron Andersen 1b4bdf523a
Merge pull request #146795 from Madouura/dev/tetrd
tetrd: init at 1.0.4
2022-01-02 11:53:03 -05:00
Sandro 46056f6c36
Merge pull request #122460 from ju1m/croc 2022-01-02 15:56:58 +01:00
Martin Weinelt 15f577daaa
couchpotato, nixos/couchpotato: remove
Using python2 and abadoned upstream in 2020, last release in 2015.
2022-01-02 13:38:11 +01:00
Bobby Rong b38cf64f82
Merge pull request #152140 from yesbox/i2pd
nixos/i2pd: add module package option
2022-01-02 09:00:35 +08:00
Martin Weinelt b8149a7f04
Merge pull request #152907 from dotlambda/python2-remove 2022-01-02 01:33:57 +01:00
Madoura e16074e889
nixos/tetrd: init 2022-01-01 17:43:37 -06:00
Jesper Geertsen Jonsson 9268da6b04 nixos/i2pd: add module package option 2022-01-01 23:16:40 +01:00
Aaron Andersen 34c283deda
Merge pull request #150846 from onny/maddy
nixos/maddy: Better description, user and group handling
2022-01-01 15:05:42 -05:00
Matt Christ c355b2729c nixos/bind: configurable "forward" setting
Sometimes it is preferable to configure forwarding only for bind
instead of relying on direct lookups.

This patch makes it possible to configure the forward setting to
either "first" (the default) or "only".
2022-01-01 08:33:51 -06:00
José Romildo a31ae59bb2 lumina.lumina: lumina-checkpass is postponned by upstream 2022-01-01 10:12:31 -03:00
Morgan Jones 38ee2de29d nixos/mattermost: update service for 6.0+ 2021-12-31 23:49:00 -05:00
Morgan Jones c37cb3b243 nixos/mattermost: silence startup warnings from chmod/chown; improve API 2021-12-31 23:49:00 -05:00
Morgan Jones 7cf6855c7f nixos/mattermost: Simplify plugin derivation build, improve startup perf 2021-12-31 23:49:00 -05:00
Morgan Jones 73fc80e0d7 nixos/mattermost: Support declarative Mattermost plugins 2021-12-31 23:49:00 -05:00
Morgan Jones 174b340406 nixos/mattermost: add preferNixConfig option and tests
One use case for Mattermost configuration is doing a "mostly
mutable" configuration where NixOS module options take priority
over Mattermost's config JSON.

Add a preferNixConfig option that prefers configured Nix options
over what's configured in Mattermost config if mutableConfig is set.

Remove the reliance on readFile (it's flake incompatible) and use
jq instead.

Merge Mattermost configs together on Mattermost startup, depending
on configured module options.

Write tests for mutable, mostly mutable, and immutable configurations.
2021-12-31 23:49:00 -05:00
Martin Weinelt 5ecf13007d
nixos/mwlib: remove
Built upon python2 only dependencies that were marked broken since 2019.
2022-01-01 02:09:11 +01:00
Robert Schütz f8b4cf08fe
syncserver, nixos/syncserver: remove
They have been broken for multiple releases.
2022-01-01 02:09:10 +01:00
Robert Schütz a859ef91f0
trac, nixos/trac: remove
They have been broken for multiple releases.
2022-01-01 02:09:09 +01:00
Martin Weinelt 5dd90167ce nixos/moinmoin, nixos/tests/moinmoin, python2Packages.moinmoin: remove
Stuck on python2 and the NixOS test has been failing for 6 months.
2021-12-31 16:39:24 -08:00
Jean-Philippe Cugnet 40fb59cfc3
nixos/elasticsearch: fix postStart to allow non-localhost listenAddress
Before this fix, if the listenAddress is set to something else than 127.0.0.1,
the service fails to detect that Elasticsearch has properly started and stop.
2021-12-30 19:03:35 +01:00
Vladimír Čunát 0e5dab9db7
Revert "nixos/dhcpd: switch to DynamicUser" 2021-12-30 14:22:08 +01:00
Jonas Heinrich 71c423671b nixos/maddy: Better description, user and group handling 2021-12-30 14:17:00 +01:00
zowoq 45dbb95515 nixos/kubernetes: remove dashboard 2021-12-30 18:51:03 +10:00
pasqui23 4aaa2ba5e6
nixos/beesd: avoid royal we
Co-authored-by: Charles Duffy <charles@dyfis.net>
2021-12-30 01:20:04 +00:00
Aaron Andersen 4ceea6850a
Merge pull request #152043 from Lyndeno/duplicati-dataDir
nixos/duplicati: Add dataDir to service
2021-12-29 15:05:01 -05:00
pennae 55daffc1c9 nixos/sourcehut: add missing defaultText, escape antiquotations 2021-12-29 20:12:03 +01:00
pennae 3dbb117aa5 nixos/aesmd: add missing defaultText 2021-12-29 20:12:03 +01:00
pennae bf58a90d09 nixos/xrdp: add missing defaultText 2021-12-29 20:12:02 +01:00
pennae 55863f14ce nixos/couchdb: add missing defaultText 2021-12-29 20:12:02 +01:00
pennae 7e28421e17 nixos/kubernetes: make lib option internal and readonly
this set almost certainly shouldn't be touched by users, nor listed in
the manual. make it internal and use it only through the option path to
make clear that this should not be modified.
2021-12-29 20:12:02 +01:00
pennae abef4b10b6 nixos/kubernetes: add missing defaultText to expression default 2021-12-29 19:57:55 +01:00
Yureka 407d75ae11 nixos/mautrix-telegram: run alembic only if available 2021-12-29 19:28:24 +01:00
Lyndon Sanche c7008f8fdf
nixos/duplicati: Add dataDir to service
Other services such as minecraft-server and plex allow configuration of
the dataDir option, allowing the files stored by each service to be in a
custom location.

Co-authored-by: Aaron Andersen <aaron@fosslib.net>
2021-12-29 08:35:41 -07:00
tomberek 94cb489156
Merge pull request #133984 from ju1m/sourcehut
nixos/sourcehut: updates, fixes, hardening
2021-12-28 22:29:36 -05:00
Julien Moutinho 42da4f78d8 nixos/sourcehut: add more tests 2021-12-28 22:18:45 -05:00
Julien Moutinho e1549f5df9 nixos/sourcehut: fix links to gitsrht-update-hook 2021-12-28 22:18:44 -05:00
Julien Moutinho ac2a39ac75 nixos/sourcehut: fix post-update-script 2021-12-28 22:18:44 -05:00
Julien Moutinho 96e103cfe3 nixos/sourcehut: fix OnCalendar 2021-12-28 22:18:44 -05:00
Julien Moutinho 8ed7fd0f3a nixos/sourcehut: full rewrite, with fixes and hardening 2021-12-28 22:18:40 -05:00
Julien Moutinho f7ff512d6d nixos/logrotate: rotate login/logout logs by default 2021-12-29 02:07:02 +01:00
Julien Moutinho c2fd94a61c nixos/logrotate: enable multiple paths per entry 2021-12-28 21:23:46 +01:00
Alexandre Iooss 650945df31
nixos/minecraft-server: systemd unit hardening
Does not set MemoryDenyWriteExecute as OpenJDK need to mark memory page as
executable. Does not set ProcSubset as /proc/cpuinfo and /proc/meminfo
are needed.
2021-12-28 13:49:14 +01:00
Martin Weinelt eb51af35ad
Merge pull request #152311 from arachnist/kea-fixes 2021-12-27 22:01:32 +01:00
CRTified 24b8c37281 nixos/adguardhome: Add settings option
This commit introduces `services.adguardhome.settings` and
`services.adguardhome.mutableSettings`.

The first option allows declarative configuration of
AdGuard Home, while the second one controls whether changes
made in the web interface are kept between service restarts.

Co-authored-by: Aaron Andersen <aaron@fosslib.net>
2021-12-27 20:03:52 +01:00
Nikolay Amiantov 9027a59f7a influxdb2 service: don't use dynamic user
It breaks something inside of influxdb2, which results in flurry of errors like these:

> ts=2021-12-21T18:19:35.513910Z lvl=info msg="Write failed" log_id=0YZYwvV0000 service=storage-engine service=write shard=50 error="[shard 50] unlinkat ./L1-00000055.tsi: read-only file system"

I believe this is somehow caused by a mount namespace that systemd creates for
the service, but I didn't investigate this deeper.
2021-12-27 20:31:27 +03:00
Michele Guerini Rocco 3a7d97bff2
Merge pull request #139873 from rnhmjoj/dhcpd
nixos/dhcpd: switch to DynamicUser
2021-12-27 18:07:16 +01:00
Martin Weinelt 99e8065d4c
Merge pull request #147784 from m1cr0man/acme 2021-12-27 17:37:39 +01:00
Bobby Rong c2b7c98814
Merge pull request #151678 from kouyk/thinkfan-typo
thinkfan: fix typo in level
2021-12-27 17:35:59 +08:00
Robert Gerus 6faa7ad3fc nixos/kea: fixes for the systemd units
Fix a typo in the kea-dhcp-ddns-server unit definition, and add a
KEA_LOCKFILE_DIR environment variable without which kea daemons try to
access a lockfile under /var/run/kea path, which is prevented by
systemd's ProtectSystem (or one of the other Protect*) mechanism.
kea-dhcp-ddns-server doesn't react to updates from dhcp4 server at all
without it.
2021-12-27 04:41:20 +01:00
Bernardo Meurer 2d7fc66c79
nixos/gvfs: fix libmtp udev package path
As pointed out by @sigprof[1] my bump of libmtp silently broke this, as I
moved the udev files out of the bin output of the pkg.

[1]: https://github.com/NixOS/nixpkgs/pull/144290#discussion_r775266642
2021-12-26 20:05:14 -03:00
Pasquale 5c294275b4
nixos/beesd: requres mount for the mount point specified 2021-12-26 20:52:03 +01:00
Lucas Savva 8d01b0862d
nixos/acme: Update documentation
- Added defaultText for all inheritable options.
- Add docs on using new defaults option to configure
  DNS validation for all domains.
- Update DNS docs to show using a service to configure
  rfc2136 instead of manual steps.
2021-12-26 16:49:55 +00:00
Lucas Savva 377c6bcefc
nixos/acme: Add defaults and inheritDefaults option
Allows configuring many default settings for certificates,
all of which can still be overridden on a per-cert basis.
Some options have been moved into .defaults from security.acme,
namely email, server, validMinDays and renewInterval. These
changes will not break existing configurations thanks to
mkChangedOptionModule.

With this, it is also now possible to configure DNS-01 with
web servers whose virtualHosts utilise enableACME. The only
requirement is you set `acmeRoot = null` for each vhost.

The test suite has been revamped to cover these additions
and also to generally make it easier to maintain. Test config
for apache and nginx has been fully standardised, and it
is now much easier to add a new web server if it follows
the same configuration patterns as those two. I have also
optimised the use of switch-to-configuration which should
speed up testing.
2021-12-26 16:44:10 +00:00
Aaron Andersen 9ec14cd78d
Merge pull request #151255 from aanderse/nixos/mysql-cleanup
nixos/mysql: module cleanup
2021-12-25 17:04:35 -05:00
Aaron Andersen baa0e61569
Merge pull request #147973 from aanderse/nixos/caddy
nixos/caddy: introduce several new options
2021-12-25 17:01:54 -05:00
Emery Hemingway 02cb654a4d nixos/stubby: reduce to a settings-style configuration
Extract the example configuration from the package to provide a
working example.

Remove pkgs.stubby from `environment.systemPackages`.
2021-12-25 12:07:06 +01:00
7c6f434c b0f154fd44
Merge pull request #147027 from Izorkin/update-nginx-ktls
nginxMainline: enable ktls support
2021-12-24 10:23:17 +00:00
Maximilian Bosch 3d91acc39a
Merge pull request #151481 from Ma27/privacyidea-uwsgi-buffer-size
nixos/privacyidea: increase buffer-size of uwsgi from 4096 to 8192
2021-12-24 10:21:24 +01:00
Bobby Rong 7378b39d1d
Merge pull request #149704 from squalus/nginx-prometheus-exporter-fix
nixos/prometheus-nginx-exporter: fix argument syntax
2021-12-23 10:27:16 +08:00
Guillaume Girol d96a3994cc nixos/collectd: validate config file syntax at build time 2021-12-23 00:08:43 +01:00
Aaron Andersen d621ad09a8 nixos/mysql: minor cleanup and formatting 2021-12-22 08:57:18 -05:00
Aaron Andersen a96f6ef187 nixos/mysql: remove services.mysql.bind and services.mysql.port in favor of services.mysql.settings 2021-12-22 08:57:14 -05:00
Steven Kou 73050d70fc
thinkfan: fix typo in level
One of the valid values for the fan speed is "level disengaged",
however, it is represented as "level disengage" and does not match
what thinkfan expects.
2021-12-22 04:00:19 +08:00
David McFarland 2f846e69c4 nixos/xserver: set correct LD_LIBRARY_PATH for opengl driver
This got broken by 370d3af0c4.  Previously
it was setting /run/opengl-driver/lib.  `driverLink` is missing the
/lib.
2021-12-21 10:56:12 -04:00
Aaron Andersen 81a67a3353 nixos/caddy: introduce several new options 2021-12-20 20:00:42 -05:00
Maximilian Bosch 8f9f754271
nixos/privacyidea: increase buffer-size of uwsgi from 4096 to 8192
When accessing the Audit log, I get an HTTP 502 when the frontend
requests `/audit` and I get the following error in my `nginx`-log:

    Dec 20 22:12:48 ldap nginx[336]: 2021/12/20 22:12:48 [error] 336#336: *8421 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 10.237.0.1, server: _, request: "GET /audit/?action=**&action_detail=**&administrator=**&client=**&date=**&duration=**&info=**&page=1&page_size=10&policies=**&privacyidea_server=**&realm=**&resolver=**&serial=**&sortorder=desc&startdate=**&success=**&tokentype=**&user=** HTTP/1.1", upstream: "uwsgi://unix:/run/privacyidea/socket:", host: "ldap.ist.nicht-so.sexy", referrer: "https://ldap.ist.nicht-so.sexy/"

This is because of an "invalid request block size"-error according to
`journalctl -u privacyidea.service`:

    Dec 20 22:12:48 ldap uwsgi[10721]: invalid request block size: 4245 (max 4096)...skip

Increasing the buffer to 8192 fixes the problem for me.
2021-12-21 00:51:45 +01:00
Graham Christensen 3907d19260 services.prometheus.exporters.fastly: add a smoke test 2021-12-20 10:57:31 -05:00
Graham Christensen 1753f97e13 services.prometheus.exporters.fastly: fixup broken module config 2021-12-20 10:29:13 -05:00
Franz Pletz d5b0e12d9b
Merge pull request #147516 from pennae/dhcpcd
dhcpcd: 8.1.4 -> 9.4.1, module updates, enable privsep
2021-12-20 14:44:58 +01:00
pennae 971adf24eb nixos/dhcpcd: set RuntimeDirectory 2021-12-20 10:53:13 +01:00
Aaron Andersen 76457da532 nixos/mysql: remove services.mysql.extraOptions in favor of services.mysql.settings 2021-12-18 21:01:48 -05:00
Aaron Andersen f1d1d319ae nixos/mysql: update user and group descriptions 2021-12-18 21:01:48 -05:00
Aaron Andersen c7cac1bdc0 nixos/mysql: use systemd StateDirectory to provision the data directory 2021-12-18 21:01:42 -05:00
0x4A6F 0b738b87db
Merge pull request #151145 from zhaofengli/unifi5-log4j-new-mitigation
unifi5: Follow new mitigation guidelines
2021-12-18 13:00:28 +01:00
Bobby Rong c9ec5a228d
Merge pull request #151153 from bobby285271/pantheon
Pantheon updates 2021-12-17
2021-12-18 14:01:54 +08:00
Bobby Rong 62103c4e41
pantheon.xdg-desktop-portal-pantheon: move to pkgs/desktop/pantheon
Only used by Pantheon AFAIK.
2021-12-18 11:35:55 +08:00
Aaron Andersen eeef6e1341
Merge pull request #151144 from Sohalt/spacenavd-syslog
nixos/spacenavd: remove syslog.target
2021-12-17 21:47:23 -05:00
sohalt 9718fc1211 nixos/spacenavd: remove syslog.target 2021-12-18 00:59:48 +01:00
Zhaofeng Li a4bcad541e unifi5: Follow new mitigation guidelines
Simply disabling lookups isn't enough, and the JndiLookup class must be
removed:

https://web.archive.org/web/20211217085954/https://logging.apache.org/log4j/2.x/security.html
2021-12-17 15:55:13 -08:00
pennae 64bbe28843 nixos/unifi: rename openPorts to openFirewall
openFirewall is the much more common name for an option with this
effect. since the default was `true` all along, renaming it doesn't hurt
much and only improves consistency with other modules.
2021-12-17 21:30:52 +01:00
pennae 2000a1edcd nixos/unifi: add deprecation warning for openPorts
modules are discouraged from opening ports in the firewall unless
explicitly told to do so. add a deprecation notice for this in unifi.
2021-12-17 21:30:52 +01:00
ajs124 e6188c00f0
Merge pull request #149387 from sumnerevans/matrix-synapse-1.49
matrix-synapse: 1.48.0 -> 1.49.0
2021-12-17 19:51:34 +00:00
Franz Pletz 0cb8669638
dhcpcd: use dhcpcd as privsep user 2021-12-17 19:23:00 +01:00
Graham Christensen 06edb74413
Merge pull request #148785 from pennae/more-option-doc-staticizing
treewide: more defaultText for options
2021-12-17 11:14:08 -05:00
Flakebi 368b22d09b powerdns-admin: fix and add module
- Add the migrations directory to the package
- Add postgres support to the package
- Add a service for powerdns-admin

Co-authored-by: Zhaofeng Li <hello@zhaofeng.li>
2021-12-17 10:33:40 +01:00
Bobby Rong 94144484c2
Merge pull request #148164 from veehaitch/nixos-github-runner-148024-v2
nixos/github-runner: refactor tokens handling
2021-12-17 16:28:21 +08:00
Alyssa Ross de27156be0 nixos/cage: log to journal
Previously, cage would log to the TTY it was running on top of, so log
messages were basically lost.
2021-12-16 23:55:15 +00:00
Nikolay Amiantov fe97584f15
Merge pull request #147679 from danderson/danderson/influx-update
influxdb2: 2.0.8 -> 2.1.1
2021-12-17 02:41:41 +03:00
Martin Weinelt 8086f8658e
Merge pull request #151029 from andir/snapcast-bind 2021-12-16 23:52:05 +01:00
Andreas Rammhold c9c93b0add
nixos/snapserver: use the correct bind address arguments
Snapserver expects the arguments `--tcp.bind_to_address` and
`--http.bind_to_address` instead of the `--tcp.address` (and http
equivalent) versions.

This caused the process to listen on `0.0.0.0` (for TCP and HTTP
sockets) regardless of the configuration value. It also never listend on
the IPv6 address `::` as our module system made the user believe.

This commit fixes the above issue and ensures that (at least for the TCP
socket) that our default `::` does indeed allow connections via IPv6
(to localhost aka ::1).
2021-12-16 23:27:56 +01:00
David Anderson 492f791f9d influxdb2: use the new server derivation in the nixos module. 2021-12-16 12:10:09 -08:00
Kim Lindberger ebaa226853
elk7: 7.11.1 -> 7.16.1, 6.8.3 -> 6.8.21 + add filebeat module and tests (#150879)
* elk7: 7.11.1 -> 7.16.1

* nixosTests.elk: Improve reliability and compatibility with ELK 7.x

- Use comparisons in jq instead of grepping
- Match for `.hits.total.value` if version >= 7, otherwise it always
  passes
- Make curl fail if requests fails

* nixos/filebeat: Add initial module and test

Filebeat is an open source file harvester, mostly used to fetch logs
files and feed them into logstash.

This module can be used instead of journalbeat if used with
`filebeat7` and configured with the `journald` input.

* python3Packages.parsedmarc.tests: Fix breakage

- Don't use the deprecated elasticsearch7-oss package
- Improve jq query robustness and add tracing

* rl-2205: Note the addition of the filebeat service

* elk6: 6.8.3 -> 6.8.21

The latest version includes a fix for CVE-2021-44228.

* nixos/journalbeat: Add a loose dependency on elasticsearch

Avoid unnecssary back-off when elasticsearch is running on the same
host.
2021-12-17 00:20:52 +09:00
Nikolay Amiantov 759f4afc65
tarsnap service: fix escaping (#150802) 2021-12-16 16:53:59 +03:00
Nikolay Amiantov 497d334c14 youtrack service: restart on failure 2021-12-15 01:40:00 +03:00
Sumner Evans c0a6554847
matrix-synapse: 1.48.0 -> 1.49.0 2021-12-14 10:34:41 -07:00
ajs124 84ce6a6286
Merge pull request #149868 from lostnet/couchopts
couchdb3: add vm.args option and fix pkgs.couchdb reference
2021-12-14 10:48:56 +00:00
Julien Moutinho 7475554372 nixos/redis: enable multiple instances of redis-server 2021-12-13 14:42:19 -05:00
Maximilian Bosch bedca751c5
Merge pull request #150527 from malte-christian/master
nixos/nextcloud: update warning for MariaDB >= 10.6
2021-12-13 15:21:16 +01:00
Jörg Thalheim afa3c99cd5
Merge pull request #148593 from veehaitch/sgx-psw
sgx-psw: init package and module
2021-12-13 14:16:26 +00:00
Malte 7c43256291 nixos/nextcloud: update warning for MariaDB >= 10.6 2021-12-13 13:25:21 +01:00
maralorn b243326a02
Merge pull request #149013 from Ma27/postgres-docs
nixos/postgresql: improve docs on how to upgrade
2021-12-12 15:55:37 +01:00
Martin Weinelt 37527494b6
Merge pull request #150329 from zhaofengli/unifi-6.5.54 2021-12-12 14:10:10 +01:00
markuskowa 5d99afe652
Merge pull request #150311 from bachp/glusterfs-syslog-target
nixos/glusterfs: remove syslog.target from services
2021-12-12 12:42:53 +01:00
Zhaofeng Li e992604bf0 nixos/unifi: Apply log4j2 mitigation 2021-12-12 01:48:58 -08:00
Bobby Rong ebb5bd223c
Merge pull request #150372 from bobby285271/pantheon
pantheon.appcenter: re-add patch for disable packagekit backend
2021-12-12 13:30:53 +08:00
Bobby Rong c65f6852e4
Revert "nixos/pantheon: mention latest appcenter changes in manual"
This reverts commit d49d9a24b7.
2021-12-12 12:45:31 +08:00
Bobby Rong 1eef9ae2d1
Revert "nixos/pantheon: cleanup FAQ section"
This reverts commit cd58f44937.
2021-12-12 12:45:10 +08:00
Pascal Bach 51e80b4ded
Merge pull request #149723 from pingiun/patch-5
eternal-terminal: remove syslog.target from service
2021-12-11 22:45:22 +01:00
Pascal Bach 98a81a3152
Merge pull request #149733 from lunik1/adguard-syslog
nixos/adguardhome: remove syslog.target from service
2021-12-11 22:45:08 +01:00
Pascal Bach e6217908a3 nixos/glusterfs: remove syslog.target from services 2021-12-11 22:43:02 +01:00
Guillaume Girol 57f7f3a87b
Merge pull request #148696 from MasseR/master
Fix the syntax error on tt-rss config file
2021-12-11 20:57:15 +00:00
spacefrogg fe44db8271
openafsServer: remove dependency on syslog.target (#150294)
syslog.target has been deprecated and removed
2021-12-11 14:46:23 -05:00
erdnaxe cf504b2330
nixos/nitter: remove syslog.target from service (#150224) 2021-12-11 14:45:54 -05:00
Dmitry Kalinkin 462d8e1bec
Merge pull request #150200 from sbruder/invidious-remove-syslog
nixos/invidious: remove syslog.target from service
2021-12-11 14:45:38 -05:00
Ryan Mulligan c84ba61d73
Merge pull request #149860 from 1000teslas/xrdp-conf
nixos/xrdp: add confDir option
2021-12-11 10:45:53 -08:00
Maximilian Bosch 2deb8c0fc5
nixos/postgresql: improve docs on how to upgrade
* It's IMHO a slight overkill to deploy an additional container even if
  it's never supposed to be running. Also, the currently suggested
  approach wouldn't use the default state-directory for the new version.
* Explain the structure of the state-directories and where the
  version-numbers are actually coming from.
* Mention `./analyze_new_cluster.sh` & `./delete_old_cluster.sh`.
2021-12-11 18:22:31 +01:00
Mats Rauhala 0eaecd60cb tt-rss-module handle situations without any password 2021-12-11 15:02:27 +02:00
Mats Rauhala de16da59f2 Fix the syntax error on tt-rss config file 2021-12-11 15:02:27 +02:00
Simon Bruder 35ed694793
nixos/invidious: remove syslog.target from service
It has been removed from systemd, see #149721.
2021-12-11 08:28:20 +01:00
Jörg Thalheim 096156aa50
Merge pull request #150003 from evils/rasdaemon
nixos/rasdaemon: remove syslog.target dependency
2021-12-10 11:31:21 +00:00
Mikael 4c39a29128
modules/nix-daemon: Amend daemon(CPU|IO)Sched(Policy|Class) description (#147497)
Suggest appropriate values for various types of systems and add some
formatting.
2021-12-10 11:30:51 +01:00
Lara c2b79874a7
nixos/jitsi-videobridge: Mitigate CVE-2021-44228 (#150021)
This commit mitigates a remote code execution vulnerability in the log4j
library.
2021-12-10 11:16:20 +01:00
Vincent Haupert 0b5c9f81e2 nixos/aesmd: add module
Co-authored-by: Alex Zero <joseph@marsden.space>
2021-12-10 10:18:31 +01:00
0x4A6F c28b4458d7
Merge pull request #147797 from romildo/upd.xfce
maintainers: add xfce team
2021-12-10 09:23:20 +01:00
Evils b22f50135c nixos/rasdaemon: remove syslog.target dependency
this was copied from upstream's unit file
but only used when the daemon runs in background mode
  --foreground is used unconditionally in this module
2021-12-10 08:18:05 +01:00
Kevin Tran 1906561f8d
Update nixos/modules/services/networking/xrdp.nix
Co-authored-by: Ryan Mulligan <ryan@ryantm.com>
2021-12-10 09:08:45 +11:00
Will a6196bc8b2 couchdb3: add vm.args and fix pkgs.couchdb reference 2021-12-09 14:55:01 +00:00
1000teslas 9c478c1995 nixos/xrdp: add confDir option 2021-12-10 00:56:21 +11:00