1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-20 04:48:10 +00:00
Commit graph

1778 commits

Author SHA1 Message Date
Maximilian Bosch 3944aa051c
nixos/nextcloud: write config to additional config file
One of the main problems of the Nextcloud module is that it's currently
not possible to alter e.g. database configuration after the initial
setup as it's written by their imperative installer to a file.

After some research[1] it turned out that it's possible to override all values
with an additional config file. The documentation has been
slightly updated to remain up-to-date, but the warnings should
remain there as the imperative configuration is still used and may cause
unwanted side-effects.

Also simplified the postgresql test which uses `ensure{Databases,Users}` to
configure the database.

Fixes #49783

[1] https://github.com/NixOS/nixpkgs/issues/49783#issuecomment-483063922
2019-07-22 18:29:52 +02:00
WilliButz 77ccb1fe6a
nixos/tests/prometheus-exporters: replace 'with lib;'
Replace 'with lib;' by explicit function imports.
2019-07-22 16:41:10 +02:00
WilliButz 01ee2ee2ba
nixos/test: fix prometheus-{bind,varnish}-exporter tests 2019-07-22 16:41:09 +02:00
Nikolay Amiantov 5f4288d49d boot tests: don't use globbing
Turns out I broke all the boot tests except netboot.

Instead of relying on build-time search for .iso we can use a proper attribute.
2019-07-22 14:44:53 +03:00
Andrew Childs d2144755a4 nixos-test-driver: allow configuration of net frontend and backend
When IPXE tests were added, an option was added for configuring only
the frontend, and the backend configuration was dropped entirely. This
caused most installer tests to fail.
2019-07-22 13:44:27 +03:00
Franz Pletz 376b5fd000
Merge pull request #64463 from Ma27/graylog-test
nixos/graylog: minor fixes, add test
2019-07-21 20:53:39 +00:00
Aaron Andersen 44565adda5
Merge pull request #60436 from nbardiuk/master
nixos/tiddlywiki: init
2019-07-21 16:39:42 -04:00
Maximilian Bosch 543ef567d9
prometheus-wireguard-exporter: 2.0.1 -> 3.0.0
Two new releases are available:
* https://github.com/MindFlavor/prometheus_wireguard_exporter/releases/tag/3.0.0
* https://github.com/MindFlavor/prometheus_wireguard_exporter/releases/tag/2.0.2

The main new feature is that the exporter exposes all allowed ips and
subnets.
2019-07-21 21:39:48 +02:00
Symphorien Gibol 4cab05598c os-prober.tests: make the test stricter
os-prober should be able to probe unmounted filesystems
2019-07-21 15:40:06 +02:00
Samuel Dionne-Riel 56836c31ad nixos/tests: drop tomcat connector test
The httpd subservice was dropped in #64052.
2019-07-20 15:19:45 -04:00
Nazarii Bardiuk 976928daa2
nixos/tiddlywiki: init
Service that runs TiddlyWiki nodejs server
2019-07-16 23:12:16 +01:00
Aaron Andersen ee1231890d
Merge pull request #64810 from WilliButz/grafana-extend-test
nixos/tests: extend grafana test, nixos/grafana: use group grafana instead of nogroup
2019-07-15 20:43:36 -04:00
Nikolay Amiantov b392c5ab4d
Merge pull request #64815 from abbradar/ipxe-efi
IPXE EFI netboot fix
2019-07-15 21:21:29 +03:00
Nikolay Amiantov a2e8be9fc3 boot tests: add UEFI PXE netboot testing
Generalize netboot testing and add tests for UEFI PXE netboot.
2019-07-15 19:34:19 +03:00
WilliButz b01b1fd62d
nixos/tests: extend grafana test
Also test configurations with postgresql and mariadb.
2019-07-15 18:33:26 +02:00
Linus Heckemann a935eff7fa
Merge pull request #62835 from lheckemann/ipv6-privacy-extensions
Ipv6 privacy extensions
2019-07-14 19:27:54 +02:00
Silvan Mosberger 5eac339829
nixos/redmine: add database.createLocally option (#63932)
nixos/redmine: add database.createLocally option
2019-07-14 16:22:37 +02:00
danbst 3b0534310c mass replace "flip map -> foreach"
See `foreach`-introduction commit.
```
rg 'flip map ' --files-with-matches | xargs sed -i 's/flip map /foreach /g'
```
2019-07-14 13:46:10 +03:00
Silvan Mosberger 2d7bce29d1
nixos/install-grub: include child configs in grub menu (#45345)
nixos/install-grub: include child configs in grub menu
2019-07-13 03:07:02 +02:00
Silvan Mosberger 5b8b5a694c
Merge pull request #64112 from davidtwco/deluge/users-groups-firewalls
nixos/deluge: add user/group/openFirewall opts and extraction packages to path
2019-07-12 20:26:55 +02:00
Aaron Andersen 6a1de5460b nixos/httpd: remove broken trac subservice 2019-07-11 19:19:27 -04:00
Venkateswara Rao Mandela bc68f85326 nixos/tests: add test for showing child configuration in grub menu
- Create a child configuration named "Work" with an extra config file.
- Name the default configuration as "Home" :-)
- Once the VM is setup, reboot and verify that it has booted into
default configuration.
- Reboot into the "Work" configuration via grub.
- Verify that we have booted into the "Work" configuration and that
the extra config file is present.

This test works for the simple grub configuration and simple UEFI
Grub configuration. UEFI Systemd is not included in the test.
2019-07-11 17:40:25 +05:30
Venkateswara Rao Mandela b08400a4d2 nixos/tests: installer: restructure simpleUefiGrub test data 2019-07-11 17:38:25 +05:30
Venkateswara Rao Mandela c400ab55d6 nixos/tests: installer: restructure simple test data 2019-07-11 17:38:25 +05:30
edef 4a633b5618
Merge pull request #64548 from NixOS/etcd-3.3.13
etcd: 3.3.1 -> 3.3.13
2019-07-10 17:11:44 +00:00
edef b3bce2cfa2 nixos/tests/etcd-cluster: be more lenient about member addition 2019-07-10 00:42:48 +00:00
edef 950d91cc9c nixos/tests: include the etcd-cluster test in all-tests.nix
We seem to have had this test for quite a while, but nothing seems to
reference it.
2019-07-09 23:46:57 +00:00
Maximilian Bosch 16d0b8dcbd
nixos/graylog: add test
Basic test which confirms new inputs can be created and that messages
can be sent to a UDP-GELF input using `netcat`.

This test requires 4GB of RAM to avoid issues due insufficient
memory (please refer to `nixos/tests/elk.nix` for a detailed explanation of
the issue) for elasticsearch.

Also it's ensured that elasticsearch has an open HTTP port for communication
when starting `graylog`. This is a workaround to ensure that all services
are started in proper order, even in test environments with less power.
However this shouldn't be implemented in the `nixos/graylog` module as
this might be harmful when using elasticsearch clusters that require e.g.
authentication and/or run on different servers.
2019-07-09 23:57:45 +02:00
Frederik Rietdijk 74c24385cb Merge master into staging-next 2019-07-09 15:46:00 +02:00
rnhmjoj 1738283e6e nixos/network-interfaces: make preferTempAddr=false work again 2019-07-09 08:08:45 +02:00
WilliButz d902420290
nixos/tests: add test for loki 2019-07-08 16:10:00 +02:00
Janne Heß 9e2a8f5023 nixos/icingaweb: Fix module path; Add test 2019-07-07 03:03:59 +02:00
Vladimír Čunát 0746c4dbb4
Merge branch 'master' into staging-next
There are several thousand rebuilds from master already.
Hydra nixpkgs: ?compare=1528940
2019-07-06 13:44:40 +02:00
Aaron Andersen aa05aad470 nixos/wordpress: create module to replace the httpd subservice 2019-07-03 11:47:33 -04:00
Frederik Rietdijk 25a77b7210 Merge staging-next into staging 2019-07-03 08:59:42 +02:00
Thorsten Weber b7907dc1ae fix mysql test after #63862 introduced non-functional initialScript 2019-07-03 00:35:35 +02:00
David Wood 9837facf21
nixos/deluge: user, group and web firewall opts.
This commit adds new options to the Deluge service:

- Allow configuration of the user/group which runs the deluged daemon.
- Allow configuration of the user/group which runs the deluge web
  daemon.
- Allow opening firewall for the deluge web daemon.
2019-07-02 22:26:34 +01:00
worldofpeace 3f4a353737 treewide: use dontUnpack 2019-07-01 04:23:51 -04:00
Aaron Andersen d9193f9eda nixos/mysql: secure access to database in one of the nixos tests 2019-06-30 22:01:02 -04:00
Aaron Andersen e702468f6b nixos/redmine: add database.createLocally option 2019-06-30 07:24:18 -04:00
Peter Hoeg bab2a01ce8 nixos/mosquitto: make the tests run 2019-06-24 13:59:53 +08:00
Frederik Rietdijk 7adbdd9758 Merge master into staging-next 2019-06-16 09:04:24 +02:00
Jan Tojnar c96ee919cf
flatpak-builder: 1.0.6 -> 1.0.7 (#62413)
flatpak-builder: 1.0.6 -> 1.0.7
2019-06-16 01:39:09 +02:00
Jan Tojnar ccc6ffe2dc
flatpak-builder: add installed tests 2019-06-16 01:22:12 +02:00
Frederik Rietdijk 395da1280e
Merge pull request #63100 from aanderse/phabricator-remove
drop unmaintained phabricator package, service, and httpd subservice
2019-06-15 13:08:48 +02:00
Frederik Rietdijk 31f22a5bb3 Merge staging-next into staging 2019-06-15 08:43:33 +02:00
Vladimír Čunát 788261a1a9
Merge branch 'master' into staging-next
Brings in Haskell rebuild.
Hydra nixpkgs: ?compare=1525186
2019-06-14 17:47:23 +02:00
Aaron Andersen b2ce867a91 phabricator: remove unreferenced test 2019-06-13 17:09:02 -04:00
Daniel Schaefer 8e5ba87b36 nixos/cassandra: Test remote auth only on v3.11+
Below that it works but only when supplying a custom password file with
restricted permissions (i.e. outside the nix-store). We can't do that
using an absolute path in the tests.
2019-06-13 04:36:41 +02:00
Daniel Schaefer 7d646f2605 nixos/cassandra: Test jmxRoles 2019-06-13 04:36:41 +02:00
Daniel Schaefer 3162f45388 nixos/cassandra: Test maxHeapSize 2019-06-13 04:36:41 +02:00
Daniel Schaefer 2368345052 nixos/cassandra: Set test VM IPs statically 2019-06-13 04:36:41 +02:00
Daniel Schaefer 545ac1820f nixos/cassandra: Test seedAddresses 2019-06-13 04:36:41 +02:00
Daniel Schaefer 2d014f4448 nixos/cassandra: Test clusterName 2019-06-13 04:36:41 +02:00
Daniel Schaefer 4c880fd742 nixos/cassandra: Use ipAddress and capital letters 2019-06-13 04:36:41 +02:00
Daniel Schaefer 2bcca9271a nixos/cassandra: Reenable tests 2019-06-13 04:36:41 +02:00
Daniel Schaefer 6778ee1862 nixos/cassandra: Fix test by listening on IP
Seems like you can't have a node as its own seed when it's listening on
an interface instead of an IP. At least the way it was done in the
test doesn't work and I can't figure out any other way than to just
listen on the IP address instead.
2019-06-13 04:36:41 +02:00
Maximilian Bosch 401360e15b
Merge pull request #61923 from aanderse/gitea
nixos/gitea: make use of declarative features where applicable
2019-06-13 01:01:18 +02:00
Frederik Rietdijk 7953a65269 Merge staging-next into staging 2019-06-12 09:24:00 +02:00
Frederik Rietdijk 7184efb40a Merge master into staging-next 2019-06-12 09:22:07 +02:00
Franz Pletz 9b2ee2c057
Merge pull request #62838 from mayflower/fix/cryptsetup-kernel-crypto
cryptsetup: enable kernel crypto api support again
2019-06-12 05:05:38 +00:00
Robin Gloster 68c30f0d9b
Merge pull request #62153 from WilliButz/avahi-refactor
avahi: set service directory and refactor module
2019-06-11 14:04:33 +00:00
Aaron Andersen 615f8b8982 nixos/gitea: utilize mysql|postgresql.ensureDatabases & ensureUsers to provision databases 2019-06-10 20:32:28 -04:00
symphorien d1ac443cca
nixos/tests/os-prober.nix: fix typo
Co-Authored-By: Léo Gaspard <github@leo.gaspard.ninja>
2019-06-09 19:18:30 +00:00
Symphorien Gibol 9a69fab1e3 nixos/tests/os-prober.nix: apply review suggestions 2019-06-09 21:16:53 +02:00
symphorien 04c9866b6e
nixos/tests/os-prober.nix: apply review suggestions
Co-Authored-By: Léo Gaspard <github@leo.gaspard.ninja>
2019-06-09 19:12:07 +00:00
symphorien f452d640f0
nixos/tests/os-prober.nix: apply review suggestions
Co-Authored-By: Léo Gaspard <github@leo.gaspard.ninja>
2019-06-09 19:11:47 +00:00
Symphorien Gibol 9e06a61cf0 mention the os-prober test in pkgs.os-prober.passthru.tests 2019-06-09 20:26:05 +02:00
Symphorien Gibol 52184a7a62 nixos/tests: add a test for os-prober 2019-06-09 19:05:30 +02:00
Frederik Rietdijk d3afcac771 Merge master into staging-next 2019-06-09 12:28:52 +02:00
Franz Pletz c51786bd5d
nixos/tests: fix luksroot installer test name
Both tests were previously called "luksroot-luks2".
2019-06-08 12:14:03 +02:00
Daiderd Jordan 9b52ff5335
Merge pull request #62133 from LnL7/nixos-uwsgi
nixos: add test for uwsgi
2019-06-08 11:25:51 +02:00
lewo 0e28092a56
Merge pull request #62773 from danieldk/docker-shared-layer-test
nixos/tests/docker-tools: check layer sharing with buildLayeredImage
2019-06-08 09:01:11 +02:00
Linus Heckemann 26317b02ae nixos/network-interfaces: always apply privacy extensions
Fixes #56306
2019-06-07 21:43:29 +02:00
Franz Pletz 3827343aec
Merge pull request #62452 from Ma27/package-wireguard-prometheus-exporter
prometheus-wireguard-exporter: init at 2.0.1
2019-06-07 16:50:39 +00:00
Maximilian Bosch bf09e6a14e
prometheus-wireguard-exporter: init at 2.0.1
This is a simple exporter which exports the information
provided by `wg show all dump` to prometheus.

Co-authored-by: Franz Pletz <fpletz@fnordicwalking.de>
2019-06-07 17:40:44 +02:00
Daniël de Kok 3b0d5b5ed3 nixos/tests/docker-tools: check layer sharing with buildLayeredImage
Adapted from grahamc's blog post on layered Docker images in Nix:

https://grahamc.com/blog/nix-and-layered-docker-images
2019-06-06 15:03:08 +02:00
markuskowa 0bf6841a21
Merge pull request #62570 from r-ryantm/auto-update/slurm
slurm: 18.08.7.1 -> 19.05.0.1
2019-06-05 14:46:41 +02:00
Markus Kowalewski fcde305932
nixos/slurm: fix test
The entry slurmdbd seems to be delayed.
Increasing the waiting time make the test more reliable.
2019-06-05 14:14:46 +02:00
Vladimír Čunát c0ccf42c69
Merge branch 'staging-next' into staging 2019-06-05 11:12:34 +02:00
Brice Waegeneire 2fa256bd55 nixos/deluge: add authFile, config & port options 2019-06-04 18:08:11 +02:00
WilliButz dbf4be4642
nixos/tests/avahi: add test for extra service definitions 2019-06-04 02:09:59 +02:00
Vladimír Čunát ee86a325dd
Merge branch 'staging-next' into staging
Conflicts (simple):
	nixos/doc/manual/release-notes/rl-1909.xml
2019-06-03 22:34:49 +02:00
Andreas Rammhold 024a383d64
nixos/systemd: migrate systemd-timesync state when required
Somewhen between systemd v239 and v242 upstream decided to no longer run
a few system services with `DyanmicUser=1` but failed to provide a
migration path for all the state those services left behind.

For the case of systemd-timesync the state has to be moved from
/var/lib/private/systemd/timesync to /var/lib/systemd/timesync if
/var/lib/systemd/timesync is currently a symlink.

We only do this if the stateVersion is still below 19.09 to avoid
starting to have an ever growing activation script for (then) ancient
systemd migrations that are no longer required.

See https://github.com/systemd/systemd/issues/12131 for details about
the missing migration path and related discussion.
2019-06-03 15:05:19 +02:00
Florian Klink bc71b6eaf6
nixosTests.containers-imperative: add tmpfiles test
(cherry picked from commit 92600a90e248aa27f2aedcce4ad309f987a390df)
2019-06-03 15:05:18 +02:00
Andreas Rammhold 4743ad7392
nixos/tests/radicale: be a bit more permissive when matching logs
With the systemd update to v242 five lines are not longer sufficient to
verify that the storage was verified. In order to reduce future test
failures increasing it to 10 lines sounds like a sane amount.
2019-06-03 15:05:14 +02:00
Matthew Bauer f21b846afe
Merge pull request #57752 from aanderse/limesurvey
limesurvey: 2.05_plus_141210 -> 3.17.1+190408, init module
2019-06-01 17:31:15 -04:00
WilliButz 7884354c0f
nixos/tests/prometheus-exporters: split into single tests
Generates a set of tests, rather than one large test for all exporters.
2019-05-31 22:02:56 +02:00
Arian van Putten cbc45b5981 nixos: Make nesting.children work in NixOS tests
We differentiate between modules and baseModules in  the
VM builder for NixOS tests. This way, nesting.children, eventhough
it doesn't inherit from parent, still has enough config to
actually complete the test. Otherwise, the qemu modules
would not be loaded, for example, and a nesting.children
statement would not evaluate.
2019-05-29 12:50:49 +02:00
Aaron Andersen 73e175a6ce nixos/limesurvey: add basic nixos test 2019-05-28 23:02:38 -04:00
Daiderd Jordan 8ce93e26b0
nixos: add test for uwsgi 2019-05-27 23:03:22 +02:00
Arian van Putten a48047a755 nixos: Add test that demonstrates how to use nesting.clone
This is actually very useful. Allows you to test switch-to-configuration

nesting.children is still currently still broken as it will throw
away 'too much' of the config, including the modules that make
nixos tests work in the first place. But that's something for
another time.
2019-05-26 00:37:13 +02:00
phile314-fh 62d4c2b34a mongodb: Add authentication support
* nixos/mongodb: Add authentication support

* nixos/mongodb: Add initial script option

* nixos/mongodb: Make initial root password configurable

* nixos/mongodb: Start only on loopback interface for setup procedure

* nixos/mongodb: Test auth/initial script

* nixos/mongodb: Code formatting

Co-Authored-By: Lassulus <github@lassul.us>
2019-05-25 18:09:30 +09:00
Franz Pletz 5fa8cd257a
Merge pull request #51206 from krebs/xmonad-config
xmonad service: add .config option
2019-05-24 18:37:55 +00:00
Silvan Mosberger f631167557
Merge pull request #58702 from florianjacob/fix-mysql
nixos/mysql: fix typing-induced bugs
2019-05-24 19:51:54 +02:00
Florian Klink 5695696664 nixosTests.signal-desktop: add test 2019-05-23 00:56:46 +02:00
Renaud 42c0ce80e6
Merge pull request #61610 from worldofpeace/init/graphene
graphene: init at 1.8.6
2019-05-22 17:26:46 +02:00
Malte Brandy 49f05a1760
nixos/nextcloud: Add options services.nextcloud.autoUpdateApps
nixos/nextcloud: Add documentation for nextcloud app installation and updates

nixos/nextcloud: Enable autoUpdateApps in nextcloud test

nixos/nextcloud: Fix typo in nixos/modules/services/web-apps/nextcloud.xml

Co-Authored-By: Florian Klink <flokli@flokli.de>

nixos/nextcloud: Escape html in option description

nixos/nextcloud: Fix autoUpdateApps URL in documentation.

Co-Authored-By: Florian Klink <flokli@flokli.de>
2019-05-21 13:24:23 +02:00
Florian Klink cd96b50d90
nixos/postgresql: add ensureDatabases & ensureUsers options (#56720)
nixos/postgresql: add ensureDatabases & ensureUsers options
2019-05-20 10:58:48 +02:00
lassulus a3e7e1bbc8 nixos/syncthing: add options for declarative device/folder config 2019-05-20 17:56:17 +09:00
Aaron Andersen b5a0c38e55
Merge pull request #59401 from mguentner/mxisd_1_3
mxisd: 1.2.0 -> 1.4.3
2019-05-19 07:00:47 -04:00
Maximilian Güntner e2c58c19c4
tests: add mxisd to all-tests 2019-05-18 22:18:01 +02:00
worldofpeace cc7c76f206 nixosTests.graphene: init 2019-05-16 21:29:17 -04:00
Bas van Dijk 240ae5eb87
Merge pull request #61604 from basvandijk/tinydns-nixos-test
nixos: add test for tinydns
2019-05-17 01:48:40 +02:00
Bas van Dijk 71fdb69314 nixos: add test for tinydns 2019-05-16 23:46:17 +02:00
Aaron Andersen ed6ccd1b27
Merge pull request #61363 from aanderse/miniupnpc
miniupnpc_2: 2.1 -> 2.1.20190408, miniupnpd: 2.1 -> 2.1.20190502
2019-05-15 20:56:59 -04:00
lewo 42ee7cdf9d
Merge pull request #61089 from nlewo/pr-fix-layer-order
dockerTools: Fix Docker layers order
2019-05-13 15:27:43 +02:00
Joachim F b4a43a278b
Merge pull request #60187 from joachifm/feat/configurable-malloc
nixos: configurable system-wide malloc
2019-05-12 15:18:07 +00:00
Joachim F 428ddf0619
Merge pull request #61306 from joachifm/feat/fix-apparmor-boot-linux_5_1
Fix apparmor boot on linux 5.1
2019-05-12 15:17:38 +00:00
Aaron Andersen 496d9f97e6 nixos/miniupnpd: update test to use pkgs.miniupnpc_2 2019-05-12 07:53:30 -04:00
Maximilian Bosch fa2c6dc3c2
Merge pull request #61311 from turboMaCk/xss-lock-locker-options
xss-lock: improve locker options passing
2019-05-12 11:07:54 +02:00
Maximilian Bosch d27431b362
nixos/xss-lock: add testcase for lockerCommand with several CLI options. 2019-05-12 03:22:29 +02:00
Joachim Fasting 92d41f83fd
nixos/tests/hardened: check that apparmor is properly loaded 2019-05-11 18:21:44 +02:00
kolaente 29d35a9ddb maintainers: add kolaente 2019-05-11 02:01:08 +02:00
Bas van Dijk 4b7aea9e8c
Merge pull request #61237 from basvandijk/journalbeat-fixes
NixOS: support journalbeat >= 6
2019-05-10 18:44:44 +02:00
Bas van Dijk 477c552c7d nixos/journalbeat: support journalbeat >= 6 & add test 2019-05-10 15:41:41 +02:00
Ambroz Bizjak 5bec9dc65b virtualbox: 5.2.28 -> 6.0.6
Quite some fixing was needed to get this to work.

Changes in VirtualBox and additions:

- VirtualBox is no longer officially supported on 32-bit hosts so i686-linux is removed from platforms
  for VirtualBox and the extension pack. 32-bit additions still work.

- There was a refactoring of kernel module makefiles and two resulting bugs affected us which had to be patched.
  These bugs were reported to the bug tracker (see comments near patches).

- The Qt5X11Extras makefile patch broke. Fixed it to apply again, making the libraries logic simpler
  and more correct (it just uses a different base path instead of always linking to Qt5X11Extras).

- Added a patch to remove "test1" and "test2" kernel messages due to forgotten debugging code.

- virtualbox-host NixOS module: the VirtualBoxVM executable should be setuid not VirtualBox.
  This matches how the official installer sets it up.

- Additions: replaced a for loop for installing kernel modules with just a "make install",
  which seems to work without any of the things done in the previous code.

- Additions: The package defined buildCommand which resulted in phases not running, including RUNPATH
  stripping in fixupPhase, and installPhase was defined which was not even run. Fixed this by
  refactoring using phases. Had to set dontStrip otherwise binaries were broken by stripping.
  The libdbus path had to be added later in fixupPhase because it is used via dlopen not directly linked.

- Additions: Added zlib and libc to patchelf, otherwise runtime library errors result from some binaries.
  For some reason the missing libc only manifested itself for mount.vboxsf when included in the initrd.

Changes in nixos/tests/virtualbox:

- Update the simple-gui test to send the right keys to start the VM. With VirtualBox 5
  it was enough to just send "return", but with 6 the Tools thing may be selected by
  default. Send "home" to reliably select Tools, "down" to move to the VM and "return"
  to start it.

- Disable the VirtualBox UART by default because it causes a crash due to a regression
  in VirtualBox (specific to software virtualization and serial port usage). It can
  still be enabled using an option but there is an assert that KVM nested virtualization
  is enabled, which works around the problem (see below).

- Add an option to enable nested KVM virtualization, allowing VirtualBox to use hardware
  virtualization. This works around the UART problem and also allows using 64-bit
  guests, but requires a kernel module parameter.

- Add an option to run 64-bit guests. Tested that the tests pass with that. As mentioned
  this requires KVM nested virtualization.
2019-05-09 23:36:57 +02:00
worldofpeace bb7e5566c7
Merge pull request #44086 from erikarvstedt/paperless
paperless: add package and service
2019-05-08 17:17:49 -04:00
Erik Arvstedt 80c3ddbad8
paperless service: init 2019-05-08 09:26:32 +02:00
Antoine Eiche 5ef1223f30 nixos/tests/docker-tools: verify order of layers in stacked images 2019-05-07 16:52:13 +02:00
Joachim Fasting 10d3a0e10b
nixos/tests/hardened: test hardened malloc 2019-05-07 13:45:42 +02:00
nyanloutre f82bfd5e80
nixos/jellyfin: add test to all-tests.nix 2019-05-01 11:57:34 +02:00
Minijackson ab9378980a
nixos/jellyfin: add simple test 2019-04-28 11:03:51 +02:00
Silvan Mosberger 77fb90d27e
Merge pull request #59731 from ajs124/ejabberd_test
ejabberd: refactor module, add test
2019-04-27 23:36:52 +02:00
Florian Klink 033882e0b7
Merge pull request #60019 from aanderse/nzbget
nzbget: fix broken service, as well as some improvements
2019-04-27 18:26:50 +02:00
Peter Hoeg eb6ce1c8a9
Merge pull request #60146 from peterhoeg/f/packagekit
nixos/packagekit: make it not error out + test
2019-04-26 14:19:46 +08:00
Aaron Andersen 5b76046db3 nixos/nzbget: fix broken service, add a nixos test, as well as some general improvements 2019-04-25 20:28:39 -04:00
Peter Hoeg ab15949f81 nixos/packagekit: add test 2019-04-24 22:31:36 +08:00
Peter Hoeg f81ddbf8e7
Merge pull request #60149 from peterhoeg/u/mosquitto_160
mosquitto: 1.5.8 -> 1.6 + nixos tests
2019-04-24 22:29:08 +08:00
Graham Christensen f57fc6c881
wireguard: add generatePrivateKeyFile option + test
Ideally, private keys never leave the host they're generated on - like
SSH. Setting generatePrivateKeyFile to true causes the PK to be
generate automatically.
2019-04-24 07:46:01 -04:00
Peter Hoeg c5af9fd4dd nixos/mosquitto: add test 2019-04-24 17:02:20 +08:00
Aaron Andersen c3f69d1373
Merge pull request #59381 from aanderse/automysqlbackup
automysqlinit: init at 3.0_rc6
2019-04-22 08:30:23 -04:00
ajs124 2b84c8d560 nixos/ejabberd: add basic test 2019-04-19 12:44:43 +02:00
Domen Kožar 9bc23f31d2
Merge pull request #48337 from transumption/201810/nginx-etag
nginx: if root is in Nix store, use path's hash as ETag
2019-04-18 16:41:49 +07:00
aszlig d533285224
nixos/tests/nginx: Add subtest for Nix ETag patch
This is to make sure that we get different ETag values whenever we
switch to a different store path but with the same file contents.

I've checked this against the old behaviour without the patch and it
fails as expected.

Signed-off-by: aszlig <aszlig@nix.build>
2019-04-18 09:41:13 +02:00
ajs124 e03932bbca xmpp-sendmessage: init script file, use in prosody test 2019-04-17 23:36:07 +02:00
Robin Gloster 7dc6e77bc2
Merge pull request #56789 from mayflower/upstream-k8s-refactor
nixos/kubernetes: stabilize cluster deployment/startup across machines
2019-04-17 16:37:58 +00:00
Bas van Dijk d1940beb3a nixos/prometheus/pushgateway: add module and test 2019-04-16 08:09:38 +02:00
Aaron Andersen 5f4df8e509 automysqlinit: init at 3.0_rc6 2019-04-15 21:51:55 -04:00
Bas van Dijk e5724e8e66
Merge pull request #59514 from basvandijk/elk-7.0.0
elk7: init at 7.0.0
2019-04-15 07:05:13 +02:00
Bas van Dijk 13352f28d2 elk7: init at 7.0.0
This adds the following new packages:

+ elasticsearch7
+ elasticsearch7-oss
+ logstash7
+ logstash7-oss
+ kibana7
+ kibana7-oss
+ filebeat7
+ heartbeat7
+ metricbeat7
+ packetbeat7
+ journalbeat7

The default major version of the ELK stack stays at 6. We should
probably set it to 7 in a next commit.
2019-04-14 21:39:46 +02:00
Sarah Brofeldt f839011719
Merge pull request #58512 from aanderse/solr
solr: init at 8.0.0
2019-04-14 11:16:28 +02:00
Joachim F 5dafbb2cb1
Merge pull request #56719 from bricewge/miniflux-service
miniflux: add service
2019-04-12 09:57:30 +00:00
Aaron Andersen ee7565af9d solr: init at 8.0.0 2019-04-10 20:12:41 -04:00
Jörg Thalheim 4d4f110ca5
Merge pull request #59181 from Izorkin/nginx-format
nixos/nginx: fix error in writeNginxConfig
2019-04-10 19:23:34 +01:00
Bas van Dijk 2f2e2971d6
Merge pull request #58255 from jbgi/prometheus2
Add Prometheus 2 service in parallel with 1.x version (continuation)
2019-04-09 14:14:18 +02:00
Bas van Dijk 7062a073e8 elk: 6.5.1 -> 6.7.1 2019-04-09 12:34:01 +02:00
Robin Gloster a58ab8fc05
Merge pull request #58398 from Ma27/package-documize
documize-community: init at 2.2.1
2019-04-08 22:34:11 +00:00
Maximilian Bosch acbb74ed18
documize-community: init at 2.2.1
Documize is an open-source alternative for wiki software like Confluence
based on Go and EmberJS. This patch adds the sources for the community
edition[1], for commercial their paid-plan[2] needs to be used.

For commercial use a derivation that bundles the commercial package and
contains a `$out/bin/documize` can be passed to
`services.documize.enable`.

The package compiles the Go sources, the build process also bundles the
pre-built frontend from `gui/public` into the binary.

The NixOS module generates a simple `systemd` unit which starts the
service as a dynamic user, database and a reverse proxy won't be
configured.

[1] https://www.documize.com/get-started/
[2] https://www.documize.com/pricing/
2019-04-08 23:54:57 +02:00
Izorkin 496a73d46d nixos/nginx: fix error in writeNginxConfig 2019-04-08 16:44:23 +03:00
Bas van Dijk 394970047e nixos/tests: register the prometheus2 test 2019-04-08 15:24:23 +02:00
Florian Klink 2457510db4
Merge pull request #51918 from bobvanderlinden/var-run
tree-wide: nixos: /var/run -> /run
2019-04-07 20:09:46 +02:00
aszlig 6fe989eaed
nixos/tests/acme: Use exact match in TOS location
Since the switch to check the nginx config with gixy in
59fac1a6d7, the ACME test doesn't build
anymore, because gixy reports the following false-positive (reindented):

  >> Problem: [alias_traversal] Path traversal via misconfigured alias.
  Severity: MEDIUM
  Description: Using alias in a prefixed location that doesn't ends with
               directory separator could lead to path traversal
               vulnerability.
  Additional info: https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md
  Pseudo config:

  server {
    server_name letsencrypt.org;

    location /documents/2017.11.15-LE-SA-v1.2.pdf {
      alias /nix/store/y4h5ryvnvxkajkmqxyxsk7qpv7bl3vq7-2017.11.15-LE-SA-v1.2.pdf;
    }
  }

The reason this is a false-positive is because the destination is not a
directory, so something like "/foo.pdf../other.txt" won't work here,
because the resulting path would be ".../destfile.pdf../other.txt".

Nevertheless it's a good idea to use the exact match operator (=), to
not only shut up gixy but also gain a bit of performance in lookup (not
that it would matter in our test).

Signed-off-by: aszlig <aszlig@nix.build>
2019-04-06 12:51:56 +02:00
Jeremy Apthorp e8b68dd4f4 miniflux: add service 2019-04-06 03:52:15 +02:00
Jörg Thalheim 4aeafc6b63
tests/pdns-recursor: use waitForOpenPort as port check
This should be safer w.r.t. race conditions.
2019-04-05 02:30:28 +01:00
Jörg Thalheim d8445c9925
tests/pdns-recursor: add 2019-04-04 19:42:49 +01:00
Franz Pletz ab574424a0
Merge pull request #57789 from Ma27/wireguard-test
nixos/wireguard: add test
2019-04-02 08:11:52 +00:00
Florian Jacob 14571f5ed0 nixos/mysql: fix initialScript option
which was wrongly specified as types.lines
Prevent it from getting copied to nix store as people might use it for
credentials, and make the tests cover it.
2019-04-01 21:08:47 +02:00
Florian Jacob 77978c1518 nixos/mysql: fix support for non-specified database schema
and increase test coverage to catch this
2019-04-01 20:01:29 +02:00
Simon Lackerbauer 88c31ae57c
nixos/openldap: add new options 2019-04-01 17:24:33 +02:00
Tim Steinbach 03389563a2
linux: Fix kernel-testing test 2019-04-01 10:04:54 -04:00
Tim Steinbach 5aef5c5931
kafka: Add test for 2.2
Also add back tests, don't seem broken anymore.

This is just fine:
nix-build ./nixos/release.nix -A tests.kafka.kafka_2_1.x86_64-linux -A tests.kafka.kafka_2_2.x86_64-linux
2019-04-01 08:39:25 -04:00
Tim Steinbach 3db50cc82f
linux: Add testing test 2019-04-01 08:31:36 -04:00
Peter Romfeld 364cbd088e minio: init at 4.0.13 2019-03-29 15:50:36 +01:00
aszlig dcf40f7c24
Merge pull request #57519 (systemd-confinement)
Currently if you want to properly chroot a systemd service, you could do
it using BindReadOnlyPaths=/nix/store or use a separate derivation which
gathers the runtime closure of the service you want to chroot. The
former is the easier method and there is also a method directly offered
by systemd, called ProtectSystem, which still leaves the whole store
accessible. The latter however is a bit more involved, because you need
to bind-mount each store path of the runtime closure of the service you
want to chroot.

This can be achieved using pkgs.closureInfo and a small derivation that
packs everything into a systemd unit, which later can be added to
systemd.packages.

However, this process is a bit tedious, so the changes here implement
this in a more generic way.

Now if you want to chroot a systemd service, all you need to do is:

  {
    systemd.services.myservice = {
      description = "My Shiny Service";
      wantedBy = [ "multi-user.target" ];

      confinement.enable = true;
      serviceConfig.ExecStart = "${pkgs.myservice}/bin/myservice";
    };
  }

If more than the dependencies for the ExecStart* and ExecStop* (which
btw. also includes script and {pre,post}Start) need to be in the chroot,
it can be specified using the confinement.packages option. By default
(which uses the full-apivfs confinement mode), a user namespace is set
up as well and /proc, /sys and /dev are mounted appropriately.

In addition - and by default - a /bin/sh executable is provided, which
is useful for most programs that use the system() C library call to
execute commands via shell.

Unfortunately, there are a few limitations at the moment. The first
being that DynamicUser doesn't work in conjunction with tmpfs, because
systemd seems to ignore the TemporaryFileSystem option if DynamicUser is
enabled. I started implementing a workaround to do this, but I decided
to not include it as part of this pull request, because it needs a lot
more testing to ensure it's consistent with the behaviour without
DynamicUser.

The second limitation/issue is that RootDirectoryStartOnly doesn't work
right now, because it only affects the RootDirectory option and doesn't
include/exclude the individual bind mounts or the tmpfs.

A quirk we do have right now is that systemd tries to create a /usr
directory within the chroot, which subsequently fails. Fortunately, this
is just an ugly error and not a hard failure.

The changes also come with a changelog entry for NixOS 19.03, which is
why I asked for a vote of the NixOS 19.03 stable maintainers whether to
include it (I admit it's a bit late a few days before official release,
sorry for that):

  @samueldr:

    Via pull request comment[1]:

      +1 for backporting as this only enhances the feature set of nixos,
      and does not (at a glance) change existing behaviours.

    Via IRC:

      new feature: -1, tests +1, we're at zero, self-contained, with no
      global effects without actively using it, +1, I think it's good

  @lheckemann:

    Via pull request comment[2]:

      I'm neutral on backporting. On the one hand, as @samueldr says,
      this doesn't change any existing functionality. On the other hand,
      it's a new feature and we're well past the feature freeze, which
      AFAIU is intended so that new, potentially buggy features aren't
      introduced in the "stabilisation period". It is a cool feature
      though? :)

A few other people on IRC didn't have opposition either against late
inclusion into NixOS 19.03:

  @edolstra:  "I'm not against it"
  @Infinisil: "+1 from me as well"
  @grahamc:   "IMO its up to the RMs"

So that makes +1 from @samueldr, 0 from @lheckemann, 0 from @edolstra
and +1 from @Infinisil (even though he's not a release manager) and no
opposition from anyone, which is the reason why I'm merging this right
now.

I also would like to thank @Infinisil, @edolstra and @danbst for their
reviews.

[1]: https://github.com/NixOS/nixpkgs/pull/57519#issuecomment-477322127
[2]: https://github.com/NixOS/nixpkgs/pull/57519#issuecomment-477548395
2019-03-29 04:37:53 +01:00
Maximilian Bosch 673c8193cd
Merge pull request #58489 from aanderse/mailcatcher
nixos/mailcatcher: fix test to be compatible with mailcatcher 7.x series
2019-03-29 04:01:02 +01:00
Silvan Mosberger 9d4a6cceb7
Merge pull request #57550 from florianjacob/typed-mysql-options
nixos/mysql: specify option types, add tests
2019-03-28 18:55:53 +01:00
lewo dc3ed336df
Merge pull request #58345 from xtruder/pkgs/dockerTools/pullImage/finalImageName
dockerTools: add finalImageName parameter for pullImage
2019-03-28 16:25:01 +01:00
Aaron Andersen 417da42c02 nixos/mailcatcher: fix test to be compatible with mailcatcher 7.x series 2019-03-28 11:15:20 -04:00
Florian Klink 6670b4c37d
Merge pull request #58419 from flokli/ldap-nslcd-startup
nixos/ldap: set proper User= and Group= for nslcd service
2019-03-28 14:30:14 +01:00
Florian Klink 8817bbefdb nixos/ldap: set proper User= and Group= for nslcd service
eb90d97009 broke nslcd, as /run/nslcd was
created/chowned as root user, while nslcd wants to do parts as nslcd
user.

This commit changes the nslcd to run with the proper uid/gid from the
start (through User= and Group=), so the RuntimeDirectory has proper
permissions, too.

In some cases, secrets are baked into nslcd's config file during startup
(so we don't want to provide it from the store).

This config file is normally hard-wired to /etc/nslcd.conf, but we don't
want to use PermissionsStartOnly anymore (#56265), and activation
scripts are ugly, so redirect /etc/nslcd.conf to /run/nslcd/nslcd.conf,
which now gets provisioned inside ExecStartPre=.

This change requires the files referenced to in
users.ldap.bind.passwordFile and users.ldap.daemon.rootpwmodpwFile to be
readable by the nslcd user (in the non-nslcd case, this was already the
case for users.ldap.bind.passwordFile)

fixes #57783
2019-03-28 13:08:47 +01:00
Aaron Andersen 7f3d0aee1c nixos/redmine: test configuration with postgresql as well as mysql 2019-03-27 21:21:17 -04:00
Aaron Andersen c99ea1c203 nixos/mailcatcher: add nixos test 2019-03-27 09:56:46 -04:00
Florian Klink 0a1451afe3 nixos/ldap: rename password file options properly
users.ldap.daemon.rootpwmodpw -> users.ldap.daemon.rootpwmodpwFile
users.ldap.bind.password -> users.ldap.bind.passwordFile

as users.ldap.daemon.rootpwmodpw never was part of a release, no
mkRenamedOptionModule is introduced.
2019-03-27 02:53:56 +01:00
Jaka Hudoklin 468df177c4
dockerTools: add finalImageName parameter for pullImage 2019-03-26 19:35:14 +01:00
Matthew Bauer 2924563f88
Merge pull request #57925 from rnhmjoj/ifnames-fix
nixos/tests/predictable-interfaces: fix failure on aarch64
2019-03-25 22:23:11 -04:00
Alberto Berti 1b6ce80c2b
Make it pass a minimal test 2019-03-25 14:36:44 +01:00
Benjamin Staffin c94005358c NixOS: Run Docker containers as declarative systemd services (#55179)
* WIP: Run Docker containers as declarative systemd services

* PR feedback round 1

* docker-containers: add environment, ports, user, workdir options

* docker-containers: log-driver, string->str, line wrapping

* ExecStart instead of script wrapper, %n for container name

* PR feedback: better description and example formatting

* Fix docbook formatting (oops)

* Use a list of strings for ports, expand documentation

* docker-continers: add a simple nixos test

* waitUntilSucceeds to avoid potential weird async issues

* Don't enable docker daemon unless we actually need it

* PR feedback: leave ExecReload undefined
2019-03-25 00:59:09 +02:00
Bob van der Linden 4c1af9b371
nixos/tests: nghttpx: /var/run -> /run 2019-03-24 21:15:35 +01:00
Bob van der Linden 09bff929df
nixos/tests: osquery: /var/run -> /run 2019-03-24 21:15:34 +01:00
Bob van der Linden 0cf1944c36
nixos/cups: /var/run -> /run 2019-03-24 21:15:30 +01:00
Robert Schütz 149f580412
home-assistant: 0.89.2 -> 0.90.1 (#58017)
https://www.home-assistant.io/blog/2019/03/20/release-90/
2019-03-24 19:45:35 +01:00
Dmitry Kalinkin 6f95ac3588
Merge pull request #57988 from lopsided98/buildbot-update
buildbot: 1.8.1 -> 2.1.0
2019-03-23 20:38:20 -04:00
Joachim F 94864bbd37
Merge pull request #57133 from markuskowa/upd-slurm
slurm: 18.08.5.2 -> 18.08.6.2
2019-03-23 06:17:58 +00:00
Ben Wolsieffer b2e11e0cdf buildbot: 1.8.1 -> 2.1.0 2019-03-22 18:43:15 -04:00
Vladimír Čunát 4c3ec0e325
nixos docs: run the formatting tool (no content change)
As documented in the docs themselves :-)
2019-03-22 14:44:11 +01:00
rnhmjoj 0279449209
nixos/tests/predictable-interfaces: fix failure on aarch64 2019-03-19 23:20:23 +01:00
aszlig 12efcc2dee
Merge overlayfs fix, LTS kernel bump and test
In Linux 4.19 there has been a major rework of the overlayfs
implementation and it now opens files in lowerdir with O_NOATIME, which
in turn caused issues in our VM tests because the process owner of QEMU
doesn't match the file owner of the lowerdir.

The crux here is that 9p propagates the O_NOATIME flag to the host and
the guest kernel has no way of verifying whether that flag will lead to
any problems beforehand.

There is ongoing work to possibly fix this in the kernel, but it will
take a while until there is a working patch and consensus.

So in order to bring our default kernel back to 4.19 and of course make
it possible to run newer kernels in VM tests, I'm merging a small QEMU
patch as an interim solution, which we can drop once we have a working
fix in the next round of stable kernels.

Now we already had Linux 4.19 set as the default kernel, but that was
subsequently reverted in 048c36ccaa
because the patch we have used was the revert of the commit I bisected a
while ago.

This patch broke overlayfs in other ways, so I'm also merging in a VM
test by @bachp, which only tests whether overlayfs is working, just to
be on the safe side that something like this won't happen in the future.

Even though this change could be considered a moderate mass-rebuild at
least for GNU/Linux, I'm merging this to master, mainly to give us some
time to get it into the current 19.03 release branch (and subsequent
testing window) once we got no new breaking builds from Hydra.

Cc: @samueldr, @lheckemann

Fixes: https://github.com/NixOS/nixpkgs/issues/54509
Fixes: https://github.com/NixOS/nixpkgs/issues/48828
Merges: https://github.com/NixOS/nixpkgs/pull/57641
Merges: https://github.com/NixOS/nixpkgs/pull/54508
2019-03-19 00:15:51 +01:00
worldofpeace 5e7623aefc nixos/tests/colord: init 2019-03-18 08:05:42 -04:00
Maximilian Bosch 0c4e9e397e
nixos/wireguard: add test
After working on the last wireguard bump (#57534), we figured that it's
probably a good idea to have a basic test which confirms that a simple
VPN with wireguard still works.

This test starts two peers with a `wg0` network interface and adds a v4
and a v6 route that goes through `wg0`.
2019-03-18 00:22:23 +01:00
Vladimír Čunát 3aecf21239
Merge #56922: nixos/knot: init basic service + tests 2019-03-16 09:17:15 +01:00
Florian Jacob 3d8090458c nixos/mysql: expand tests to mariadb and ensureUsers / ensureDatabases 2019-03-15 16:32:36 +01:00
Pascal Bach a8307b9f39 nixos/overlayfs: add test 2019-03-15 15:15:32 +01:00
aszlig 9e9af4f9c0
nixos/confinement: Allow to include the full unit
From @edolstra at [1]:

  BTW we probably should take the closure of the whole unit rather than
  just the exec commands, to handle things like Environment variables.

With this commit, there is now a "fullUnit" option, which can be enabled
to include the full closure of the service unit into the chroot.

However, I did not enable this by default, because I do disagree here
and *especially* things like environment variables or environment files
shouldn't be in the closure of the chroot.

For example if you have something like:

  { pkgs, ... }:

  {
    systemd.services.foobar = {
      serviceConfig.EnvironmentFile = ${pkgs.writeText "secrets" ''
        user=admin
        password=abcdefg
      '';
    };
  }

We really do not want the *file* to end up in the chroot, but rather
just the environment variables to be exported.

Another thing is that this makes it less predictable what actually will
end up in the chroot, because we have a "globalEnvironment" option that
will get merged in as well, so users adding stuff to that option will
also make it available in confined units.

I also added a big fat warning about that in the description of the
fullUnit option.

[1]: https://github.com/NixOS/nixpkgs/pull/57519#issuecomment-472855704

Signed-off-by: aszlig <aszlig@nix.build>
2019-03-14 20:04:33 +01:00
aszlig 46f7dd436f
nixos/confinement: Allow to configure /bin/sh
Another thing requested by @edolstra in [1]:

  We should not provide a different /bin/sh in the chroot, that's just
  asking for confusion and random shell script breakage. It should be
  the same shell (i.e. bash) as in a regular environment.

While I personally would even go as far to even have a very restricted
shell that is not even a shell and basically *only* allows "/bin/sh -c"
with only *very* minimal parsing of shell syntax, I do agree that people
expect /bin/sh to be bash (or the one configured by environment.binsh)
on NixOS.

So this should make both others and me happy in that I could just use
confinement.binSh = "${pkgs.dash}/bin/dash" for the services I confine.

[1]: https://github.com/NixOS/nixpkgs/pull/57519#issuecomment-472855704

Signed-off-by: aszlig <aszlig@nix.build>
2019-03-14 19:14:05 +01:00
aszlig 0ba48f46da
nixos/systemd-chroot: Rename chroot to confinement
Quoting @edolstra from [1]:

  I don't really like the name "chroot", something like "confine[ment]"
  or "restrict" seems better. Conceptually we're not providing a
  completely different filesystem tree but a restricted view of the same
  tree.

I already used "confinement" as a sub-option and I do agree that
"chroot" sounds a bit too specific (especially because not *only* chroot
is involved).

So this changes the module name and its option to use "confinement"
instead of "chroot" and also renames the "chroot.confinement" to
"confinement.mode".

[1]: https://github.com/NixOS/nixpkgs/pull/57519#issuecomment-472855704

Signed-off-by: aszlig <aszlig@nix.build>
2019-03-14 19:14:03 +01:00
aszlig ac64ce9945
nixos: Add 'chroot' options to systemd.services
Currently, if you want to properly chroot a systemd service, you could
do it using BindReadOnlyPaths=/nix/store (which is not what I'd call
"properly", because the whole store is still accessible) or use a
separate derivation that gathers the runtime closure of the service you
want to chroot. The former is the easier method and there is also a
method directly offered by systemd, called ProtectSystem, which still
leaves the whole store accessible. The latter however is a bit more
involved, because you need to bind-mount each store path of the runtime
closure of the service you want to chroot.

This can be achieved using pkgs.closureInfo and a small derivation that
packs everything into a systemd unit, which later can be added to
systemd.packages. That's also what I did several times[1][2] in the
past.

However, this process got a bit tedious, so I decided that it would be
generally useful for NixOS, so this very implementation was born.

Now if you want to chroot a systemd service, all you need to do is:

  {
    systemd.services.yourservice = {
      description = "My Shiny Service";
      wantedBy = [ "multi-user.target" ];

      chroot.enable = true;
      serviceConfig.ExecStart = "${pkgs.myservice}/bin/myservice";
    };
  }

If more than the dependencies for the ExecStart* and ExecStop* (which
btw. also includes "script" and {pre,post}Start) need to be in the
chroot, it can be specified using the chroot.packages option. By
default (which uses the "full-apivfs"[3] confinement mode), a user
namespace is set up as well and /proc, /sys and /dev are mounted
appropriately.

In addition - and by default - a /bin/sh executable is provided as well,
which is useful for most programs that use the system() C library call
to execute commands via shell. The shell providing /bin/sh is dash
instead of the default in NixOS (which is bash), because it's way more
lightweight and after all we're chrooting because we want to lower the
attack surface and it should be only used for "/bin/sh -c something".

Prior to submitting this here, I did a first implementation of this
outside[4] of nixpkgs, which duplicated the "pathSafeName" functionality
from systemd-lib.nix, just because it's only a single line.

However, I decided to just re-use the one from systemd here and
subsequently made it available when importing systemd-lib.nix, so that
the systemd-chroot implementation also benefits from fixes to that
functionality (which is now a proper function).

Unfortunately, we do have a few limitations as well. The first being
that DynamicUser doesn't work in conjunction with tmpfs, because it
already sets up a tmpfs in a different path and simply ignores the one
we define. We could probably solve this by detecting it and try to
bind-mount our paths to that different path whenever DynamicUser is
enabled.

The second limitation/issue is that RootDirectoryStartOnly doesn't work
right now, because it only affects the RootDirectory option and not the
individual bind mounts or our tmpfs. It would be helpful if systemd
would have a way to disable specific bind mounts as well or at least
have some way to ignore failures for the bind mounts/tmpfs setup.

Another quirk we do have right now is that systemd tries to create a
/usr directory within the chroot, which subsequently fails. Fortunately,
this is just an ugly error and not a hard failure.

[1]: https://github.com/headcounter/shabitica/blob/3bb01728a0237ad5e7/default.nix#L43-L62
[2]: https://github.com/aszlig/avonc/blob/dedf29e092481a33dc/nextcloud.nix#L103-L124
[3]: The reason this is called "full-apivfs" instead of just "full" is
     to make room for a *real* "full" confinement mode, which is more
     restrictive even.
[4]: https://github.com/aszlig/avonc/blob/92a20bece4df54625e/systemd-chroot.nix

Signed-off-by: aszlig <aszlig@nix.build>
2019-03-14 19:14:01 +01:00
Martin Weinelt a978d3dcd2
nixos/knot: init 2019-03-14 01:28:53 +01:00
Jascha Geerds ffedc3e4a9 misc: Remove myself from list of maintainers
Unfortunately I don't have the time anymore to maintain those
packages.
2019-03-12 23:50:52 +01:00
Johan Thomsen 968d3c9c05 nixos/gitlab: improved test to check download of repository archives 2019-03-12 15:04:45 +00:00
Markus Kowalewski 62ea707e31
nixos/tests: make slurm test more reliable 2019-03-09 22:31:40 +01:00
Andreas Rammhold 219b247e5b
Merge pull request #56607 from andir/cryptsetup-2.1
cryptsetup: 2.0.6 -> 2.1.0
2019-03-06 16:55:26 +01:00
Antoine Eiche af23d1e2e7 nixos/test/docker-tools: fix Nix image digest 2019-03-06 09:26:33 +01:00
Christian Albrecht 62f03750e4
nixos/kubernetes: Stabilize services startup across machines
by adding targets and curl wait loops to services to ensure services
are not started before their depended services are reachable.

Extra targets cfssl-online.target and kube-apiserver-online.target
syncronize starts across machines and node-online.target ensures
docker is restarted and ready to deploy containers on after flannel
has discussed the network cidr with apiserver.

Since flannel needs to be started before addon-manager to configure
the docker interface, it has to have its own rbac bootstrap service.

The curl wait loops within the other services exists to ensure that when
starting the service it is able to do its work immediately without
clobbering the log about failing conditions.

By ensuring kubernetes.target is only reached after starting the
cluster it can be used in the tests as a wait condition.

In kube-certmgr-bootstrap mkdir is needed for it to not fail to start.

The following is the relevant part of systemctl list-dependencies

default.target
● ├─certmgr.service
● ├─cfssl.service
● ├─docker.service
● ├─etcd.service
● ├─flannel.service
● ├─kubernetes.target
● │ ├─kube-addon-manager.service
● │ ├─kube-proxy.service
● │ ├─kube-apiserver-online.target
● │ │ ├─flannel-rbac-bootstrap.service
● │ │ ├─kube-apiserver-online.service
● │ │ ├─kube-apiserver.service
● │ │ ├─kube-controller-manager.service
● │ │ └─kube-scheduler.service
● │ └─node-online.target
● │   ├─node-online.service
● │   ├─flannel.target
● │   │ ├─flannel.service
● │   │ └─mk-docker-opts.service
● │   └─kubelet.target
● │     └─kubelet.service
● ├─network-online.target
● │ └─cfssl-online.target
● │   ├─certmgr.service
● │   ├─cfssl-online.service
● │   └─kube-certmgr-bootstrap.service
2019-03-03 19:39:02 +01:00
Christian Albrecht f9e2f76a59
nixos/kubernetes: Add systemd path units
to protect services from crashing and clobbering the logs when
certificates are not in place yet and make sure services are activated
when certificates are ready.

To prevent errors similar to "kube-controller-manager.path: Failed to
enter waiting state: Too many open files"
fs.inotify.max_user_instances has to be increased.
2019-03-03 19:34:57 +01:00
Andreas Rammhold 839a37fdd2
nixos/tests/installer: add cryptsetup tests for LUKS format 2 & default format 2019-03-02 13:56:52 +01:00
hyperfekt 3731835efc nixos/fish: generate autocompletions from man pages 2019-02-27 12:23:48 +01:00
xeji 0a63b6528b
Merge pull request #55547 from delroth/fix-warnings
Fix 3 warnings in nixos/tests
2019-02-25 16:01:42 +01:00
Nikita Uvarov 131e31cd1b
sshd: fix startWhenNeeded and listenAddresses combination
Previously, if startWhenNeeded was set, listenAddresses option was
ignored and daemon was listening on all interfaces.
Fixes #56325.
2019-02-25 00:51:58 +01:00
Aaron Andersen c5ddcfe69f nixos/beanstalkd: update test to use python3 instead of python2 2019-02-22 15:00:20 -05:00
Florian Friesdorf fbef5ab82f Remove myself as maintainer from packages
I'm currently not maintaining any packages.
2019-02-22 16:14:13 +01:00
aanderse e5405f9ae8 nixos/beanstalkd: new service for existing package (#55953) 2019-02-22 14:10:02 +01:00
Robert Schütz 3382d93982 home-assistant-cli: 0.5.0 -> 0.6.0 2019-02-21 14:03:35 +01:00
Johan Thomsen 6045068f6c
nixos/kubernetes: (test) Fix race-condition in test cases. docker load might fail due to dockerd restarting 2019-02-20 21:08:57 +01:00
Johan Thomsen 466beb0214
nixos/kubernetes: let flannel use kubernetes as storage backend
+ isolate etcd on the master node by letting it listen only on loopback
+ enabling kubelet on master and taint master with NoSchedule

The reason for the latter is that flannel requires all nodes to be "registered"
in the cluster in order to setup the cluster network. This means that the
kubelet is needed even at nodes on which we don't plan to schedule anything.
2019-02-20 21:08:56 +01:00
Johan Thomsen e2380e79e1
nixos/kubernetes: major module refactor
- All kubernetes components have been seperated into different files
- All TLS-enabled ports have been deprecated and disabled by default
- EasyCert option added to support automatic cluster PKI-bootstrap
- RBAC has been enforced for all cluster components by default
- NixOS kubernetes test cases make use of easyCerts to setup PKI
2019-02-20 21:08:01 +01:00
Frederik Rietdijk 6fe10d2779 Merge master into staging-next 2019-02-16 09:29:54 +01:00
Jaka Hudoklin 5ae048071d
Merge pull request #55649 from johanot/flannel-with-kubernetes-backend
nixos/flannel: add kubernetes as storage backend (and fix test)
2019-02-15 19:55:56 +01:00
Samuel Dionne-Riel 98419a0f64 nixos/tests/switch-test: Ensures the test fails on failure (#55744)
The `| tee` invocation always masked the return value of the
switch-to-configuration test.

```
~ $ false | tee && echo "oh no"
oh no
```

The added wrapper script will still output everything to stderr, while
passing failures to the test harness.
2019-02-14 22:55:16 +01:00
Silvan Mosberger b1bda29f5c
Merge pull request #55517 from florianjacob/cups-fix-ssl-dir
nixos/cups: Fix Unable to encrypt connection:
2019-02-14 21:19:57 +01:00
Florian Jacob 33b3272692 nixos/cups: Fix Unable to encrypt connection:
Unable to create server credentials
by creating /var/lib/cups/ssl directory.
2019-02-14 20:43:26 +01:00
Frederik Rietdijk 7257dedd7c Merge master into staging-next 2019-02-13 12:33:29 +01:00
Johan Thomsen adc9da6178 nixos/flannel: fix flannel nixos test, add test to all-tests.nix 2019-02-12 18:26:39 +01:00
Florian Klink e6df4dfe59
Merge pull request #54800 from nlewo/nova
Remove cloud-init from the Openstack image configuration
2019-02-11 22:23:32 +01:00
Antoine Eiche ff31014687 nixos/tests/ec2: reuse ssh keys from ssh-keys.nix 2019-02-11 20:58:45 +01:00
Antoine Eiche d190b204f0 Rename novaImage to openstackImage
People don't necessary know `nova` is related to Openstack (it is a
component of Openstack). So, it is more explicit to call it
`openstackImage`.
2019-02-11 20:58:44 +01:00
Pierre Bourdon c0829a0859
nixos/tests/gitea: fix eval warnings
trace: warning: config.services.gitea.database.password will be stored as plaintext
        in the Nix store. Use database.passwordFile instead.

(Arguably, this shouldn't be a warning at all. But making it happy is
easier than having a debate on the value of this warning.)
2019-02-11 03:13:03 +01:00
Pierre Bourdon f90a60a33c
nixos/tests/ndppd: fix eval warnings
trace: warning: The options services.ndppd.interface and services.ndppd.network will probably be removed soon,
please use services.ndppd.proxies.<interface>.rules.<network> instead.
2019-02-11 03:12:56 +01:00
Pierre Bourdon 4b959cd354
nixos/tests/rspamd: fix eval warnings
trace: warning: The option `services.rspamd.bindUISocket' defined in `<unknown-file>' has been renamed to `services.rspamd.workers.controller.bindSockets'.
trace: warning: The option `services.rspamd.bindSocket' defined in `<unknown-file>' has been renamed to `services.rspamd.workers.normal.bindSockets'.
trace: warning: The option `services.rspamd.workers.”rspamd_proxy".type` defined in `<unknown-file>' has enum value `proxy` which has been renamed to `rspamd_proxy`
2019-02-11 02:59:55 +01:00
Matthew Bauer 5c09d977c7 Merge remote-tracking branch 'origin/master' into staging 2019-02-09 12:14:06 -05:00
Ryan Mulligan d2904c8fbd
Merge pull request #53442 from erictapen/osrm-test
nixos/tests: add osrm-backend test
2019-02-08 06:46:57 -08:00
Maximilian Bosch 6fb825b057 nixos/roundcube: add package option
With this option it's possible to specify a custom expression for
`roundcube`, i.e. a roundcube environment with third-party plugins as
shown in the testcase.
2019-02-08 13:35:09 +00:00
lewo 15e43d59cf
Merge pull request #55101 from lopsided98/hydra-update
hydra: 2018-08-07 -> 2019-02-01
2019-02-07 17:59:46 +01:00
Léo Gaspard a59a9a7e60
Merge branch 'pr-55320'
* pr-55320:
  nixos/release-notes: mention breaking changes with matrix-synapse update
  nixos/matrix-synapse: reload service with SIGHUP
  nixos/tests/matrix-synapse: generate ca and certificates
  nixos/matrix-synapse: use python to launch synapse
  pythonPackages.pymacaroons-pynacl: remove unmaintained fork
  matrix-synapse: 0.34.1.1 -> 0.99.0
  pythonPackages.pymacaroons: init at 0.13.0
2019-02-07 17:12:04 +01:00
Maximilian Bosch 1649b4899f
nixos/hydra: enhance test for multiple Nix versions
Hydra should support multiple Nix versions (and currently contains fixes
to work with Nix 2.0 and higher).

Further Nix versions can be added to the `hydraPkgs` expression in the
test case which lists all supported Nix versions for Hydra.
2019-02-07 16:39:35 +01:00
nyanloutre 4a5f1bb9bc nixos/tests/matrix-synapse: generate ca and certificates 2019-02-06 16:21:07 +01:00
Peter Hoeg 7003a28916
Merge pull request #54541 from dotlambda/home-assistant-0.86
home-assistant: 0.85.1 -> 0.86.4
2019-02-06 09:02:28 +08:00
Silvan Mosberger dfce20e4e3
Merge pull request #51980 from ToxicFrog/munin-plugins
nixos/munin: New options (and some bugfixes) for service configuration
2019-02-05 19:35:03 +01:00
Florian Klink 400aa7b86a minio: add test to nixos/tests/all-tests.nix 2019-02-05 17:38:34 +01:00
aanderse b8a9c3fbfd redmine: 3.4.8 -> 4.0.1 (#55234)
* redmine: 3.4.8 -> 4.0.1

* nixos/redmine: update nixos test to run against both redmine 3.x and 4.x series

* nixos/redmine: default new installs from 19.03 onward to redmine 4.x series, while keeping existing installs on redmine 3.x series

* nixos/redmine: add comment about default redmine package to 19.03 release notes

* redmine: add aandersea as a maintainer
2019-02-05 11:51:33 +00:00
Ben Kelly 0c3208a8e4 nixos/munin: add disabledPlugins option
This is just a set of globs to remove from the active plugins directory
after autoconfiguration is complete.

I also removed the hard-coded disabling of "diskstats", since it seems
to work just fine now.
2019-02-04 20:17:26 -05:00
Maximilian Bosch 5a3a543078
Merge pull request #55122 from elseym/ndppd-module
ndppd module: refactor and fix
2019-02-04 21:51:00 +01:00
Pierre Bourdon a8da72b012
nixos/tests/postgresql: fix regression from #55106 2019-02-04 03:56:43 +01:00
Maximilian Bosch a29294cb95
nixos/ndppd: register test 2019-02-03 16:47:01 +01:00
Franz Pletz f1b91b5726
nixos/tests: add ndppd test 2019-02-03 13:21:07 +01:00
Robert Schütz f85453f060 nixos/home-assistant: add configWritable option 2019-02-03 13:08:11 +01:00
Danylo Hlynskyi bd0bb9e497
postgresql test: fix (#55106)
Commit https://github.com/NixOS/nixpkgs/pull/55097 didn't modify all usages of postgresql/default.nix.

Also, replaced "random" pg with pg11. Random pg was always pg10.
2019-02-03 13:03:53 +02:00
Florian Klink e84a23c5f7 neo4j: add neo4j test 2019-02-01 16:01:08 +01:00
Vladimír Čunát 8ba516664b
Merge branch 'staging-next' into staging 2019-02-01 09:42:53 +01:00
Jan Tojnar 65e6d80ecd
Merge pull request #53425 from dtzWill/update/fwupd-1.2.3
fwupd: 1.2.1 -> 1.2.3

Co-authored-by: Jan Tojnar <jtojnar@gmail.com>
2019-01-31 23:22:38 +01:00
Florian Klink d3c2ed21d0
Merge pull request #53762 from ju1m/nslcd
Improving integration of `nslcd`, PAM and `openldap`.
2019-01-30 19:34:40 +01:00
Robert Schütz 5acb21453f
Merge pull request #54904 from dotlambda/home-assistant-cli-0.4.2
home-assistant-cli: 0.3.0 -> 0.4.2
2019-01-30 09:18:24 +01:00
Robert Schütz cfd556fd4a home-assistant-cli: 0.3.0 -> 0.4.2 2019-01-29 23:57:12 +01:00
Pierre Bourdon 20b1febace
nixos/tests: add nginx-sso basic functionality test 2019-01-29 19:54:14 +01:00
Wael Nasreddine f072cfe1eb
nixos/pam: refactor U2F, docs about u2f_keys path (#54756)
* change enableU2F option to u2f.* set
* add few u2f options (not all) to customize pam-u2f module
* document default u2f_keys locations

Co-authored-by: Tomasz Czyż <tomasz.czyz@gmail.com>
Co-authored-by: Arda Xi <arda@ardaxi.com>
2019-01-29 08:45:26 -08:00
Robert Schütz f908f6c982 nixos/home-assistant: don't run json2yaml at every start 2019-01-29 08:56:51 +01:00
Robert Schütz 7cc7c5374c nixos/home-assistant: add lovelaceConfig option 2019-01-29 08:56:51 +01:00
Antoine Eiche 849460f878 nova-image: add amazon-init module to the nova image
This allows the VM to provide a `configuration.nix` file to the VM.

The test doesn't work in sandbox because it needs Internet (however it
works interactively).
2019-01-28 14:44:41 +01:00
Florian Klink 38be383a6f
Merge pull request #53419 from uvNikita/containers/fix-bridge
nixos/containers: add bridge without address specified
2019-01-28 12:39:13 +01:00
Antoine Eiche 2858b35100 nova-image: use wget instead of cloud-init (via EC2 API)
The Openstack metadata service exposes the EC2 API. We use the
existing `ec2.nix` module to configure the hostname and ssh keys of an
Openstack Instance.

A test checks the ssh server is well configured.

This is mainly to reduce the size of the image (700MB). Also,
declarative features provided by cloud-init are not really useful
since we would prefer to use our `configuration.nix` file instead.
2019-01-28 11:59:18 +01:00
Jan Tojnar dd06999e32
fwupd: fix installed tests 2019-01-28 00:15:00 +01:00
Will Dietz 55fa570046
fwupd: blacklist test plugin by default
Don't add the testing "webcam" device,
which is unexpected to see when querying
what devices fwupd believes exist :).

Won't change behavior for anyone defining
the blacklistPlugin option already,
but doesn't seem worth making more complicated.
2019-01-27 21:26:42 +01:00
Matthew Bauer 92f0f8dd68 Merge remote-tracking branch 'NixOS/master' into staging 2019-01-27 00:01:13 -05:00
Jörg Thalheim ba34ffc665
Merge pull request #54619 from Mic92/remove-wkennington
treewide: remove wkennington as maintainer
2019-01-26 23:37:27 +00:00
Danylo Hlynskyi 4fb8bc8238
postgresql: cleanup postgis (#54396)
postgis: cleanup

Another part of https://github.com/NixOS/nixpkgs/pull/38698, though I did cleanup even more.
Moving docs to separate output should save another 30MB.

I did pin poppler to 0.61 just to be sure GDAL doesn't break again next
time poppler changes internal APIs.
2019-01-26 21:15:43 +02:00
Danylo Hlynskyi 8e985dced0
postgresql: reorganize package and its extensions (#54319)
* postgresql: reorganize package and it's extensions

Extracts some useful parts of https://github.com/NixOS/nixpkgs/pull/38698,
in particular, it's vision that postgresql plugins should be namespaced.
2019-01-26 19:46:57 +02:00
Jörg Thalheim b5c1deca8a
treewide: remove wkennington as maintainer
He prefers to contribute to his own nixpkgs fork triton.
Since he is still marked as maintainer in many packages
this leaves the wrong impression he still maintains those.
2019-01-26 10:05:32 +00:00
Elis Hirwing 3df02c6c03
nixos/jackett: Add test for jackett to ensure startup 2019-01-25 07:12:41 +01:00
Elis Hirwing eb356ef3f8
nixos/lidarr: Add test for lidarr to ensure startup 2019-01-25 07:12:08 +01:00
Elis Hirwing ddcb2c473d
nixos/radarr: Add test for radarr to ensure startup 2019-01-25 07:11:28 +01:00
Elis Hirwing 8be2345baf
nixos/sonarr: Add test for sonarr to ensure startup 2019-01-25 07:10:40 +01:00
Justin Humm 694c351cc3
nixos/tests: add osrm-backend test 2019-01-25 00:43:34 +01:00
worldofpeace 4abc6ff9e8 nixos/tests/all-tests.nix: add pantheon 2019-01-24 17:33:05 -05:00
worldofpeace 78da8d668b pantheon: init a 5.0 2019-01-24 20:54:14 +00:00
Silvan Mosberger d9f39b7252
Merge pull request #54310 from Mic92/postgresq-backup
nixos/postgresqlBackup: add backupAll option
2019-01-23 21:40:39 +01:00
Jörg Thalheim ecd1129dee
nixos/telegraf: add test 2019-01-21 11:37:20 +00:00
Jörg Thalheim 1af4f366ca
nixos/postgresqlBackup: add backupAll option
For large setups it is useful to list all databases explicit
(for example if temporary databases are also present) and store them in extra
files.
For smaller setups it is more convenient to just backup all databases at once,
because it is easy to forget to update configuration when adding/renaming
databases. pg_dumpall also has the advantage that it backups users/passwords.

As a result the module becomes easier to use because it is sufficient
in the default case to just set one option (services.postgresqlBackup.enable).
2019-01-19 11:41:06 +00:00
Julien Moutinho 65cfba23af nixos/tests: test LDAP password changing through nslcd
NOTE: slapd.conf is deprecated, hence use cn=config.
2019-01-18 05:13:42 +01:00
Vladyslav M 95a0e24381
Merge pull request #53952 from Ma27/improve-gitea-module
nixos/gitea: minor fixes
2019-01-15 23:55:16 +02:00
Maximilian Bosch ad3a50e25b
nixos/gitea: add option to disable registration
Although this can be added to `extraOptions` I figured that it makes
sense to add an option to explicitly promote this feature in our
documentation since most of the self-hosted gitea instances won't be
intended for common use I guess.

Also added a notice that this should be added after the initial deploy
as you have to register yourself using that feature unless the install
wizard is used.
2019-01-14 16:04:02 +01:00
elseym 8a8bf886b5
nixos/containers: explicitly set link up on host for extraVeths 2019-01-13 11:27:39 +01:00
Piotr Bogdan cfc281f571 nixos/tests/kerberos: fix evaluation 2019-01-11 04:36:51 +00:00
Maximilian Bosch 44a80294f7
Merge pull request #53746 from zaninime/patch-1
nexus: 3.12.1 -> 3.14.0-04
2019-01-10 23:01:26 +01:00
Maximilian Bosch edcd1494f7
nixos/nexus: increase disk size of VM test to 8GB
Nexus increased their default minimum disk space requirement to 4GB:

```
com.orientechnologies.orient.core.exception.OLowDiskSpaceException: Error occurred while executing a
write operation to database 'OSystem' due to limited free space on the disk (1823 MB). The database
is now working in read-only mode. Please close the database (or stop OrientDB), make room on your hard
drive and then reopen the database. The minimal required space is 4096 MB. Required space is now
set to 4096MB (you can change it by setting parameter storage.diskCache.diskFreeSpaceLimit) .
server# [   72.560866] zqnav3mg7m6ixvdcacgj7p5ibijpibx5-unit-script-nexus-start[627]:   DB name="OSystem"
```

Including the rest on the VM 8GB should be the most suitable solution.
As the installer test also takes 8GB of disk size this should still be
in an acceptable range.
2019-01-10 22:44:26 +01:00
lewo 7612a6add4
Merge pull request #52870 from xtruder/pkgs/dockerTools/buildLayeredImage/extraCommands
dockerTools: allow to pass extraCommands, uid and gid to buildLayered image
2019-01-10 19:00:19 +01:00
Jaka Hudoklin 954cda5c9d
dockerTools: allow to pass extraCommands, uid and gid to buildLayeredImage 2019-01-10 16:02:23 +01:00
Nikita Uvarov 53013ead39
nixos/containers: add bridge without address specified
According to systemd-nspawn(1), --network-bridge implies --network-veth,
and --port option is supported only when private networking is enabled.
Fixes #52417.
2019-01-07 14:21:17 +01:00
Joachim Fasting e6538caa48
nixos/tests: re-enable hardened test
Has been okay since 62623b60d5
2019-01-06 14:08:20 +01:00
Joachim Fasting 39c30a33c1
nixos/tests/hardened: test loading out-of-tree-modules 2019-01-06 13:19:28 +01:00
Frederik Rietdijk e5381cdece Merge master into staging-next 2019-01-06 09:36:23 +01:00
Jörg Thalheim 2614c8a6c5
nixos/xss-lock: specify a default locker
Having a default locker is less error-prone and more convenient.
Incorrect values might leave the machine vulnerable since there is no
fallback.
2019-01-05 16:42:30 +01:00
Frederik Rietdijk 9618abe87c Merge master into staging-next 2019-01-04 21:13:19 +01:00
Jean-Philippe Braun 4f99f8d2cb nixos/prometheus-bind-exporter: add module 2019-01-03 21:14:21 +01:00
Frederik Rietdijk 10afccf145 Merge staging-next into staging 2018-12-27 18:11:34 +01:00
Joachim Fasting 84fb8820db
nixos/security/misc: factor out protectKernelImage
Introduces the option security.protectKernelImage that is intended to control
various mitigations to protect the integrity of the running kernel
image (i.e., prevent replacing it without rebooting).

This makes sense as a dedicated module as it is otherwise somewhat difficult
to override for hardened profile users who want e.g., hibernation to work.
2018-12-27 15:00:47 +01:00
Jan Tojnar ef935fa101
Merge branch 'master' into staging 2018-12-24 15:02:29 +01:00
Florian Klink 0f46188ca1 nixos/tests: add google-oslogin test 2018-12-21 17:52:37 +01:00
Maximilian Bosch 87ebc2ad0b
Merge pull request #52345 from r-ryantm/auto-update/clickhouse
clickhouse: 18.14.9 -> 18.14.18
2018-12-20 18:48:37 +01:00
Maximilian Bosch 64d05bbdd2
clickhouse: fix module and package runtime
Although the package itself builds fine, the module fails because it
tries to log into a non-existant file in `/var/log` which breaks the
service. Patching to default config to log to stdout by default fixes
the issue. Additionally this is the better solution as NixOS heavily
relies on systemd (and thus journald) for logging.

Also, the runtime relies on `/etc/localtime` to start, as it's not
required by the module system we set UTC as sensitive default when using
the module.

To ensure that the service's basic functionality is available, a simple
NixOS test has been added.
2018-12-20 13:03:41 +01:00
Robert Schütz 52b1973283 home-assistant-cli: init at 0.3.0 2018-12-19 15:54:28 +01:00
Frederik Rietdijk 9ab61ab8e2 Merge staging-next into staging 2018-12-19 09:00:36 +01:00
Franz Pletz 58db4c1a7e
Revert "nixos/tests: add clamav test"
This reverts commit 6433f3b13b.

Fixes #52446.
2018-12-17 19:24:44 +01:00
Jan Tojnar aead6e12f9
Merge remote-tracking branch 'upstream/master' into staging 2018-12-16 22:55:06 +01:00
Florian Klink a9eae44ee5 gitlab: run test with 4096 bits if on 64bit, else the the maximum for 32bit 2018-12-16 19:47:35 +01:00
Franz Pletz 6433f3b13b
nixos/tests: add clamav test 2018-12-16 19:04:07 +01:00
Florian Klink 91c65721f7 owncloud: remove server
pkgs.owncloud still pointed to owncloud 7.0.15 (from May 13 2016)

Last owncloud server update in nixpkgs was in Jun 2016.
At the same time Nextcloud forked away from it, indicating users
switched over to that.

cc @matej (original maintainer)
2018-12-16 15:05:53 +01:00
Johan Thomsen d2048b0d7e nixos/kubernetes: don't enable all alpha feature gates for the test cases 2018-12-16 13:41:48 +01:00
lassulus 3eefc0b909 xmonad service: add .config option 2018-12-15 14:50:20 +01:00
Renaud 562b7a7702
Merge pull request #51922 from hedning/fix-xmonad-test
nixos/tests/xmonad: fix terminal title
2018-12-13 14:02:23 +01:00
Sarah Brofeldt 7a57774158
Merge pull request #51938 from johanot/nixos-kubernetes-test-fix
nixos/kubernetes: fix import path of default nixpkgs
2018-12-13 13:05:25 +01:00
Tor Hedin Brønner d776b224da nixos/tests/xmonad: fix terminal title
bash now sets a different title.
2018-12-12 21:30:47 +01:00
Johan Thomsen 1a00b86334 nixos/kubernetes: fix import path of default nixpkgs 2018-12-12 21:30:32 +01:00
Arian van Putten eb88005130 nixos/systemd: Add a regression test for #50273 2018-12-12 15:35:39 +01:00
Kai Wohlfahrt 337bc20e5f kerberos: Add tests/kerberos to release.nix 2018-12-11 13:33:10 +00:00
Kai Wohlfahrt ade842f51a kerberos: move user binaries to default output
The intention of the previous change was to move krb5-config to .dev (it
gives the locations of headers), but it grabbed all of the user-facing
binaries too. This puts them back.
2018-12-11 13:33:10 +00:00
Kai Wohlfahrt d752677b1b kerberos: explicitly install krb5Full.dev for tests
This contains all of the user binaries as of 13e6a5c.
2018-12-11 13:33:10 +00:00
Kai Wohlfahrt 6cca9c0f9f kerberos-server: add kerberos option
Allow switching out kerberos server implementation.

Sharing config is probably sensible, but implementation is different enough to
be worth splitting into two files. Not sure this is the correct way to split an
implementation, but it works for now.

Uses the switch from config.krb5 to select implementation.
2018-12-11 13:33:10 +00:00
markuskowa 9fba490258
Merge pull request #50862 from markuskowa/fix-slurm-module
nixos/slurm: set slurmd KillMode and add extraConfigPaths
2018-12-11 00:45:47 +01:00
Tor Hedin Brønner 59d1fb6151
Merge pull request #44497 from hedning/gnome-upstream-wayland
Add gnome wayland support
2018-12-10 16:53:27 +01:00
Vladimír Čunát 3946d83a3c
nixos tests: disable kafka for now
They consistently fail since openjdk bump with some out-of-space errors.
That's not a problem by itself, but each test instance ties a build slot
for many hours and consequently they also delay channels as those wait
for all builds to finish.

Feel free to re-enable when fixed, of course.
2018-12-10 13:19:00 +01:00
Tor Hedin Brønner 75e223bf7a nixos/tests/gnome3-gdm: port to wayland
The test now runs wayland, which means we can no longer use X11 style testing.
Instead we get gnome shell to execute javascript through its dbus interface.
2018-12-10 10:36:25 +01:00
Tor Hedin Brønner 116c16d9e2 nixos/tests/gnome3: select X11 gnome shell explicitely
This isn't strictly necessary yet as LightDM doesn't read the wayland sessions,
but there's no harm in being explicit.
2018-12-10 10:36:25 +01:00
markuskowa c362f98ba0
Merge pull request #51791 from dotlambda/borgbackup-1.1.8
borgbackup: 1.1.7 -> 1.1.8
2018-12-09 22:34:02 +01:00
Tor Hedin Brønner 80fdafb373 nixos/tests/gnome3: fix terminal title
The tests passes, but that's just because a race condition where the window is
titled `Terminal` long enough.
2018-12-09 19:27:06 +01:00
Tor Hedin Brønner 373be8207a nixos/tests/i3wm: fix terminal title
Probably due to #51678 which makes bash set the terminal title.
2018-12-09 18:29:51 +01:00
Robert Schütz 3cbf18f32b nixos/tests/borgbackup: test borg mount 2018-12-09 18:17:27 +01:00
Markus Kowalewski 8eee1ec2a9
tests/slurm: wait for open DBD port
This makes tests more reliable. It seems
that waitForUnit(slurmdbd.service) is not sufficient
on some systems.
2018-12-09 13:36:53 +01:00
lewo f7e67be1dc
Merge pull request #51528 from grahamc/buildImage-on-layered-image
dockertools buildImage: support new-style image specs
2018-12-07 09:44:58 +01:00
aszlig 776f084cf1
nixos/tests: Fix wrong arch in runInMachine test
Since 83b27f60ce, the tests were moved
into all-tests.nix and some of the tooling has changed so that
subattributes of test expressions are now recursively evaluated until a
derivation with a .test attribute has been found.

Unfortunately this isn't the case for all of the tests and the
runInMachine doesn't use the makeTest function other tests are using but
instead uses runInMachine, which doesn't generate a .test attribute.

Whener a .test attribute wasn't found by the new handleTest function, it
recurses down again until there is no value left that is an attribute
set and subsequently returns its unchanged value. This however has the
drawback that instead of getting different attributes for each
architecture we only get the last architecture in the supportedSystems
list.

In the case of the release.nix, the last architecture in
supportedSystems is "aarch64-linux", so the runInMachine test is always
built on that architecture.

In order to work around this, I changed runInMachine to emit a .test
attribute so that it looks to handleTest like it was a test created via
makeTest.

Signed-off-by: aszlig <aszlig@nix.build>
2018-12-07 05:56:53 +01:00
Robert Schütz b63bb15612 home-assistant: 0.82.1 -> 0.83.3 2018-12-06 14:59:27 +01:00
Graham Christensen c88337c9ac
dockerTools.buildImage: support using a layered image in fromImage
Docker images used to be, essentially, a linked list of layers. Each
layer would have a tarball and a json document pointing to its parent,
and the image pointed to the top layer:

    imageA  ----> layerA
                    |
                    v
                  layerB
                    |
                    v
                  layerC

The current image spec changed this format to where the Image defined
the order and set of layers:

    imageA  ---> layerA
            |--> layerB
            `--> layerC

For backwards compatibility, docker produces images which follow both
specs: layers point to parents, and images also point to the entire
list:

    imageA  ---> layerA
            |      |
            |      v
            |--> layerB
            |      |
            |      v
            `--> layerC

This is nice for tooling which supported the older version and never
updated to support the newer format.

Our `buildImage` code only supported the old version, so in order for
`buildImage` to properly generate an image based on another image
with `fromImage`, the parent image's layers must fully support the old
mechanism.

This is not a problem in general, but is a problem with
`buildLayeredImage`.

`buildLayeredImage` creates images with newer image spec, because
individual store paths don't have a guaranteed parent layer. Including
a specific parent ID in the layer's json makes the output less likely
to cache hit when published or pulled.

This means until now, `buildLayeredImage` could not be the input to
`buildImage`.

The changes in this PR change `buildImage` to only use the layer's
manifest when locating parent IDs. This does break buildImage on
extremely old Docker images, though I do wonder how many of these
exist.

This work has been sponsored by Target.
2018-12-05 14:25:54 -05:00
Florian Klink 5c82aa8854 pkgsi686Linux.nixosTests.gitlab: fix 32 bit tests
GitLab 11.5.1 dropped the dependency to posix_spawn, which is broken on
32bit. (See https://gitlab.com/gitlab-org/gitlab-ce/issues/53525)

The only part missing is decreasing virtualisation.memorySize to
something that a 32 bit qemu still executes.

The maximum seems to be 2047, and tests passed with that value for me.
2018-12-05 10:47:18 +01:00
Tim Steinbach 16f42b3694 kafka: Add 2.1 2018-12-05 00:06:07 +00:00
Tim Steinbach 7c5d43f4f5 kafka: Add test for 2.0 2018-12-05 00:06:07 +00:00
Silvan Mosberger 4afae70e2b
Merge pull request #48423 from charles-dyfis-net/bees
bees: init at 0.6.1; nixos/modules: services.bees init
2018-12-02 18:38:47 +01:00
John Boehr 4226ddc034 nixos/cockroachdb: create new service
This also includes a full end-to-end CockroachDB clustering test to
ensure everything basically works. However, this test is not currently
enabled by default, though it can be run manually. See the included
comments in the test for more information.

Closes #51306. Closes #38665.

Co-authored-by: Austin Seipp <aseipp@pobox.com>
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2018-12-01 19:07:49 -06:00
Charles Duffy f50bfe267a
nixos.tests.bees: init 2018-11-29 20:27:47 -06:00
Robin Gloster 1262a5ca97
roundcube: apply code review suggestions 2018-11-28 18:53:37 +01:00
Robin Gloster 9ace7f6409
roundcube: clean-up and add test 2018-11-28 18:52:10 +01:00
Florian Klink 2c2ab68672
Merge pull request #50962 from flokli/gitlab-updater
gitlab: 11.4.4 -> 11.5.0
2018-11-26 18:47:14 +01:00
Silvan Mosberger b5f4f228d6
Merge pull request #51012 from griff/rspamd-proxy-type
nixos/rspamd: Allow worker type to be proxy again
2018-11-25 21:07:42 +01:00
Brian Olsen 0d753af661
nixos/rspamd: Allow worker type to be proxy again
When reworking the rspamd workers I disallowed `proxy` as a type and
instead used `rspamd_proxy` which is the correct name for that worker
type. That change breaks peoples existing config and so I have made this
commit which allows `proxy` as a worker type again but makes it behave
as `rspamd_proxy` and prints a warning if you use it.
2018-11-25 16:03:34 +01:00
Franz Pletz c1d760f0bf
Merge pull request #50469 from mguentner/mxisd
mxisd: init at 1.2.0 plus service with test
2018-11-25 13:26:05 +00:00
Maximilian Güntner efae5d43ef
modules: add mxisd with test 2018-11-25 14:24:10 +01:00
Joachim Fasting 6a7f02d89d
nixos/hardened: restrict access to nix daemon 2018-11-24 16:06:21 +01:00
Joachim Fasting 62623b60d5
nixos/tests/hardened: fix build by disabling nix.useSandbox 2018-11-24 16:06:18 +01:00
Michael Raskin 5e159d463b
Merge pull request #49228 from Ekleog/rss2email-module
rss2email module: init
2018-11-23 22:30:29 +00:00
Andreas Rammhold 51c3082119 nixos/prometheus: require one alertmanager configuration parameter
This commit adds an assertion that checks that either `configFile` or
`configuration` is configured for alertmanager. The alertmanager config
can not be an empty attributeset. The check executed with `amtool` fails
before the service even has the chance to start. We should probably not
allow a broken alertmanager configuration anyway.

This also introduces a test for alertmanager configuration that piggy
backs on the existing prometheus tests.
2018-11-23 19:45:17 +01:00
Florian Klink 6870eafe72 gitlab tests: enable recommendedProxySettings, test redirection works as it should
The nixos test is a bit misleading, as the given nginx configuration
would always cause gitlab to redirect to localhost, which is clearly not
what you want in a production setup.

Instead we now enable services.nginx.recommendedProxySettings,
curl against http://gitlab, and assure we get redirected to that same
hostname, too.
2018-11-23 19:44:45 +01:00
Markus Kowalewski 0ed4fc606a
nixos/slurm: add recommended mysql settings 2018-11-22 13:21:37 +01:00