1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-05 20:12:52 +00:00
Commit graph

5454 commits

Author SHA1 Message Date
Eelco Dolstra f13bd41384 switch-to-configuration: Restart sockets.target 2014-03-17 14:10:48 +01:00
Eelco Dolstra 0d506aa712 Provide a simple way to log into containers
On the host, you can run

  $ socat unix:<path-to-container>/var/lib/login.socket -,echo=0,raw

to get a login prompt.  So this allows logging in even if the
container has no SSH access enabled.

You can also do

  $ socat unix:<path-to-container>/var/lib/root-shell.socket -

to get a plain root shell.  (This socket is only accessible by root,
obviously.)  This makes it easy to execute commands in the container,
e.g.

  $ echo reboot | socat unix:<path-to-container>/var/lib/root-shell.socket -
2014-03-17 14:10:47 +01:00
Eelco Dolstra 1b6c01721d Revert "nixos-manual: show manual on tty8 by default"
This reverts commit b792394119.
Starting the manual on tty8 was intended as a convenience during
installation, not as a general purpose thing.  In fact, given that w3m
runs as root, this is highly insecure!
2014-03-17 12:45:57 +01:00
mornfall fe995cdedc Merge pull request #1775 from thoughtpolice/duo_unix
Duo Security module and uid/gid support for /etc files
2014-03-16 23:06:01 +01:00
Austin Seipp 29d46452dd nixos: add Duo Security module
This module adds the security.duosec attributes, which you can use to
enable simple two-factor authentication for NixOS logins.

The module currently provides PAM and SSH support, although the PAM unix
system configuration isn't automatically dealt with (although the
configuration is automatically built).

Enabling it is as easy as saying:

  security.duosec.ssh.enable = true;
  security.duosec.ikey       = "XXXXXXXX...";
  security.duosec.skey       = "XXXXXXXX...";
  security.duosec.host       = "api-XXXXXXX.duosecurity.com";
  security.duosec.group      = "duosec";

which will enforce two-factor authentication for SSH logins for users in
the 'duosec' group.

This requires uid/gid support in the environment.etc module.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-16 07:11:50 -05:00
Shea Levy 6cc0cc7ff6 Merge branch 'postgresql-user' of git://github.com/ocharles/nixpkgs
postgresql module: Use the default superuser username
2014-03-15 13:29:52 -04:00
Shea Levy 3f6a654d9c Merge branch 'zsh' of git://github.com/ttuegel/nixpkgs
zsh: don't clobber the environment of non-login shells
2014-03-15 13:11:38 -04:00
Bjørn Forsman f7006116b3 nixos/gpsd-service: add type declarations to options 2014-03-15 17:35:55 +01:00
Bjørn Forsman 28e5f72f05 nixos/gpsd-service: change from deprecated 'jobs' type to 'systemd'
This has the nice side-effect of making gpsd actually run!

Old behaviour (debugLevel=2):

  systemd[1]: gpsd.service holdoff time over, scheduling restart.
  systemd[1]: Stopping GPSD daemon...
  systemd[1]: Starting GPSD daemon...
  systemd[1]: gpsd.service start request repeated too quickly, refusing to start.
  systemd[1]: Failed to start GPSD daemon.
  systemd[1]: Unit gpsd.service entered failed state.

New behaviour (debugLevel=2):

  gpsd[945]: gpsd: launching (Version 2.95)
  systemd[1]: Started GPSD daemon.
  gpsd[945]: gpsd: listening on port 2947
  gpsd[945]: gpsd: running with effective group ID 27
  gpsd[945]: gpsd: running with effective user ID 23
  gpsd[945]: gpsd: stashing device /dev/ttyUSB0 at slot 0
2014-03-15 17:35:55 +01:00
ambrop7@gmail.com 49768ca8ff power-management: Don't enable acpid.
Running acpid along with systemd will cause double handling of acpi events.
2014-03-15 12:17:00 +01:00
Peter Simons abe9d80979 Merge pull request #1939 from wkennington/master.notbit
notbit: Add systemd service for a system daemon
2014-03-15 10:48:36 +01:00
William A. Kennington III a42e1d5494 notbit: Add systemd service for a system daemon 2014-03-15 04:36:15 -05:00
Peter Simons f1a30454f6 Merge pull request #1942 from thoughtpolice/fixups
Trivial fixes for my packages
2014-03-15 09:35:35 +01:00
Ricardo M. Correia bb188bbba7 nixos: Add ZFS auto-snapshotting module 2014-03-15 01:56:42 +01:00
Shea Levy 602cf8d78c Merge branch 'u/zfs-import' of git://github.com/wizeman/nixpkgs
zfs: Misc fixes
2014-03-14 19:40:34 -04:00
Shea Levy 0c12dd3ded Merge branch 'pkgs/systemd/journald_http_gateway' of git://github.com/offlinehacker/nixpkgs
systemd: python support & journal http gateway

Conflicts:
	nixos/modules/misc/ids.nix
2014-03-14 19:16:59 -04:00
Shea Levy 8502d84bd2 Merge branch 'nixos/network-interfaces/ipv6' of git://github.com/offlinehacker/nixpkgs
nixos/network-interfaces: add support for static ipv6 addresses
2014-03-14 18:54:59 -04:00
Shea Levy a0d574f19b firewall: Allow setting rate limits for pings 2014-03-14 14:55:30 -04:00
Shea Levy 50d144278d mysql module: Specify --basedir
Needed for mariadb and safe for mysql
2014-03-14 11:56:54 -04:00
Gergely Risko 2be35c3e99 OpenAFS client fixes
Make it stoppable.  Add support for crypt and dynroot-sparse.
2014-03-14 14:40:17 +01:00
Corey O'Connor 40de28afca remove users.jenkins config start on slave config.
Uses standard NixOS user config merging.
Work in progress: The slave config does not actually start the slave agent. This just configures a
jenkins user if required. Bare minimum to enable a nice jenkins SSH slave.
2014-03-13 13:01:50 -07:00
Corey O'Connor 292ece425e match systemd style and silent curl progress bar during startup check 2014-03-13 13:01:49 -07:00
Corey O'Connor 9b79d5b298 Add jenkins continuous integration server and user.
By default the jenkins server is executed under the user "jenkins". Which can be configured using
users.jenkins.* options. If a different user is requested by changing services.jenkins.user then
none of the users.jenkins options apply.

This patch does not include jenkins slave configuration. Some config options will probably change
when this is implemented.

Aspects like the user and environment are typically identical between slave and master. The service
configs are different. The design is for users.jenkins to cover the shared aspects while
services.jenkins and services.jenkins-slave cover the master and slave specific aspects,
respectively.

Another option would be to place everything under services.jenkins and have a config that selects
master vs slave.
2014-03-13 13:01:49 -07:00
Shea Levy 59a060523e Don't override the baseUnit's PATH by default 2014-03-12 20:03:14 -04:00
Rickard Nilsson 3ed3c60d0f New NixOS module: services.solr, for running a solr server 2014-03-13 00:32:59 +01:00
Eelco Dolstra e1984f029d autovt@.service really has to be a symlink 2014-03-13 00:19:10 +01:00
Domen Kožar df242d0d79 Merge pull request #1926 from tomberek/kippo_uid_fix
UID/GID fix for kippo
2014-03-12 23:34:39 +01:00
Rickard Nilsson 91e6d7411e winstone NixOS module: Make it possible to set systemd service name 2014-03-12 23:28:38 +01:00
Rickard Nilsson f24940330b New NixOS module: services.winstone, for running instances of the Winstone Java Servlet container 2014-03-12 23:14:09 +01:00
Eelco Dolstra b13a5d4cca Fix kmscon evaluation 2014-03-12 21:00:59 +01:00
Eelco Dolstra 09c14cd8aa switch-to-configuration: Don't try to start masked units 2014-03-12 18:52:11 +01:00
Eelco Dolstra f198c40608 Don't depend on the text of disabled units
This prevents pulling in unnecessary dependencies.
2014-03-12 18:52:11 +01:00
Eelco Dolstra 207c881df9 Don't include superfluous lines in generated units 2014-03-12 18:52:11 +01:00
Eelco Dolstra d412245601 getty@ and autovt@: Use the upstream units 2014-03-12 18:52:10 +01:00
Eelco Dolstra 691c0cd72e systemd: Allow customisation of upstream units
You can now say:

  systemd.services.foo.baseUnit = "${pkgs.foo}/.../foo.service";

This will cause NixOS' generated foo.service file to include
foo.service from the foo package.  You can then apply local
customization in the usual way:

  systemd.services.foo.serviceConfig.MemoryLimit = "512M";

Note however that overriding options in the original unit may not
work.  For instance, you cannot override ExecStart.

It's also possible to customize instances of template units:

  systemd.services."getty@tty4" =
    { baseUnit = "/etc/systemd/system/getty@.service";
      serviceConfig.MemoryLimit = "512M";
    };

This replaces the unit options linkTarget (which didn't allow
customisation) and extraConfig (which did allow customisation, but in
a non-standard way).
2014-03-12 18:52:10 +01:00
Eelco Dolstra 3358906395 apcupsd: Description -> description 2014-03-12 18:52:10 +01:00
Rickard Nilsson 4e23573138 phpfpm module: Make extraConfig and poolConfigs mergeable by switching option type to types.lines 2014-03-12 11:45:31 +01:00
Rickard Nilsson 562a8ca4a2 Add phpfpm NixOS service module 2014-03-12 11:38:50 +01:00
Domen Kozar 28069d6aad move windowManager.xbmc to desktopManager.xbmc 2014-03-12 09:20:59 +01:00
Thomas Bereknyei a2353866a8 UID/GID fix for kippo 2014-03-12 03:32:56 -04:00
Arseniy Seroka f7d5e83abb slim: remove duplicate code 2014-03-11 16:27:27 +04:00
Mathijs Kwik 42d7923752 Merge pull request #1911 from offlinehacker/nixos/couchdb/fix
nixos/couchdb: fix stopping of service, by making it non-forking, a few other improvments
2014-03-11 09:35:27 +01:00
Jaka Hudoklin 2297f31339 nixos/network-interfaces: do not try to enable or disable ipv6 in container 2014-03-10 12:39:22 +01:00
Jaka Hudoklin 993ef8287e nixos/couchdb: fix stopping of service, by making it non-forking, a few other improvments
Conflicts:
	nixos/modules/services/databases/couchdb.nix
2014-03-10 11:08:05 +01:00
Jaka Hudoklin cf65a62af4 nixos/elasticsearch: Make port an integer, add dataDir option, make pure 2014-03-10 11:04:48 +01:00
Jaka Hudoklin bd5c0c3bc7 nixos/statsd: change default host and port on graphite host and port 2014-03-10 11:02:48 +01:00
Jaka Hudoklin b21d95e1f8 nixos/graphite: Make pure, fix several bugs, add dataDir option 2014-03-10 10:59:26 +01:00
Domen Kozar f0b34fe8ff searx: refactor a bit 2014-03-09 18:57:17 +01:00
Matej Cotman 7e932ca4e2 searx: add module 2014-03-09 17:33:56 +01:00
Domen Kozar 8e1d765f61 nixos manual: make nixos options linkable 2014-03-08 19:34:28 +01:00
Domen Kožar bb7fe59b80 Merge pull request #1767 from the-kenny/fix-consoleKeyMap-type
i18n.consoleKeyMap: Accept string or path.
2014-03-08 18:04:55 +01:00
Austin Seipp 881bb235d9 nixos: tarsnap module documentation updates
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-08 08:00:56 -06:00
Ellis Whitehead 9af5d4731d typo: occured -> occurred 2014-03-07 19:39:55 +01:00
Domen Kozar 10787951ab tarsnap: mention getting started page 2014-03-07 15:37:09 +01:00
Austin Seipp 24cf6afa05 nixos: add Tarsnap backup service module
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-03-07 15:37:09 +01:00
Domen Kožar 068c0aa219 Merge pull request #1833 from coreyoconnor/fix-synaptics-config
correct tapButtons in synaptics config.
2014-03-07 13:10:31 +01:00
Shea Levy 4b28d9d934 Merge branch 'desktopmanager-fix' of git://github.com/pSub/nixpkgs
Use feh only as a fallback if the xserver is actually enabled.
2014-03-07 04:39:25 -05:00
Gergely Risko 322b7124a8 Allow ntpq locally 2014-03-06 11:54:02 +01:00
Eelco Dolstra 6572708d39 Always load the "configs" kernel module
We used to have the configuration of the kernel available in a
somewhat convenient place (/run/booted-system/kernel-modules/config)
but that has disappeared.  So instead just make /proc/configs.gz
available.  It only eats a few kilobytes.
2014-03-05 15:22:32 +01:00
Ricardo M. Correia 02e2431661 zfs: Don't look for devices only in /dev
If we don't give out a directory to 'zpool import', it will use libblkid
to automatically find all existing ZFS devices.
2014-03-04 12:58:11 +01:00
Pascal Wittmann c2fcf07f06 Use feh only as a fallback if the xserver is actually enabled.
Otherwise feh is installed even though no xserver is available.
2014-03-04 09:10:23 +01:00
Eelco Dolstra 6a9168ad06 Get rid of services.mesa.* message 2014-03-03 13:57:08 +01:00
Eelco Dolstra 497997cc38 Move generation of coverage reports from nixos/lib/testing to releaseTools
Also, turn some stdenv adapters into setup hooks.
2014-03-03 13:57:08 +01:00
Eelco Dolstra ad7c518e45 Sync /tmp/xchg to ensure that the coverage data is flushed 2014-03-03 13:57:08 +01:00
Vladimír Čunát d9cc648d6c Merge pull request #1791 from wizeman/u/nixos-gen
nixos-generate-config: improve filesystem generation
2014-03-02 11:27:43 +01:00
Shea Levy 1425fa5b3b Disable efi tests again
OVMF sucks
2014-03-01 09:51:28 -05:00
Eelco Dolstra 1d9cd24d0b Fix mysql-replication test 2014-02-28 16:18:31 +01:00
Eelco Dolstra da2a336a3c Remove tabs 2014-02-28 16:18:31 +01:00
Domen Kožar b792394119 nixos-manual: show manual on tty8 by default 2014-02-28 13:32:19 +01:00
Shea Levy 691f6c4c59 Fix mysql test evaluation 2014-02-28 06:16:57 -05:00
Domen Kožar e9f3199973 add gstreamer 1.0 setup-hook and use it where appropriate 2014-02-28 02:03:07 +01:00
Domen Kožar 4e957b075e Merge pull request #1841 from pSub/patch-1
Fixed link to the installation instructions
2014-02-27 15:08:32 +01:00
Pascal Wittmann 991b23c382 Added a static identifier to the installing nixos chapter 2014-02-27 14:56:13 +01:00
Domen Kožar ab0aae42a4 couchdb: remove redundant customConfigFile 2014-02-27 14:34:19 +01:00
Domen Kožar d6a3cada9b couchdb: stricter types 2014-02-27 14:33:50 +01:00
Domen Kožar 9d55a4c513 couchdb: add ids 2014-02-27 14:33:30 +01:00
Rok Garbas 0bebcd7d1f folders of pidFile and uriFile should be writable by couchdb user/group 2014-02-27 13:34:11 +01:00
Rok Garbas 55cff93f04 couchdb(nixos): removing whitespace and line that was commented 2014-02-27 13:34:11 +01:00
Rok Garbas 62438c09f7 update couchdb to 1.5.0(current latest) and add service for it 2014-02-27 13:34:11 +01:00
Domen Kožar 97a0dd9eb9 nixos: set all package options to have type package 2014-02-27 13:22:29 +01:00
Shea Levy f7c04b1e6b mediawiki: Don't rewrite /images if uploads are enabled 2014-02-27 07:17:10 -05:00
Shea Levy 1e7300ad67 mediawiki rewrite rules only needed with no urlPrefix 2014-02-27 07:17:10 -05:00
Shea Levy 32470621d5 Restart keys.target on reconfiguration 2014-02-26 13:35:04 -05:00
Shea Levy 69b6b939ef rename.nix: Handle renaming of a whole set of options
mkIf was pushed down, making the obsoleted argument unconditionally evaluated

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-26 10:06:28 -05:00
Shea Levy efb18d9aa5 D'oh 2014-02-26 08:49:21 -05:00
Shea Levy c9f9835dda Document mysql changes 2014-02-26 07:56:59 -05:00
Shea Levy 1ce6fff4e2 Merge mysql55 module into mysql
This also removes the default for services.mysql.package, as this should
not generally be updated automatically if we change the mysql attribute
2014-02-26 07:54:12 -05:00
Shea Levy 793328e1ee Mediawiki: Add some needed rewrites 2014-02-25 09:13:40 -05:00
Shea Levy 0d4a9e3aa6 Allow httpd subservices to set the document root
Only the main service OR one of the subservices can set the document
root. This is used by mediawiki when it is hosted at the root of the
vhost.
2014-02-25 07:44:45 -05:00
Corey O'Connor 20567eba1f correct tapButtons in synaptics config. Dont rely on the X11 input settings to take the last option. 2014-02-24 16:03:47 -08:00
Rickard Nilsson d5211b0e0e Make initialRootPassword overrideable in all virtualisation modules, not just virtualbox. 2014-02-24 18:05:26 +01:00
Austin Seipp dc700e0925 etc: uid/gid support for copied files
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-02-23 18:00:47 -06:00
Austin Seipp fc9022bea1 firewall: add support for TCP/UDP port ranges
This is useful for packages like mosh, which use a wide UDP port range
by default for incoming connections.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-02-22 18:19:22 +01:00
Petr Rockai f21abed131 nixos: Assign uid/gid to dictd's service user. 2014-02-22 12:00:08 +01:00
Shea Levy 95a77ea39f Unconditionally add ssh to nix-daemon's path for the ssh substitituer 2014-02-20 14:17:30 -05:00
Shea Levy 17f88453f6 Don't complain if HOME isn't writable 2014-02-20 13:40:56 -05:00
Shea Levy fefc0d9917 Add module to enable the server for the ssh substituter 2014-02-20 13:40:51 -05:00
Shea Levy 2b92e90f91 opensmtpd: Add sendmail to systemPackages 2014-02-20 06:17:15 -05:00
Ricardo M. Correia a146fdab80 nixos-generate-config: Don't generate filesystem options
We don't want to hardcode configuration options that the current kernel chose
for us when mounting the filesystem, since the defaults can change in the
future.
2014-02-19 17:18:50 +01:00
Ricardo M. Correia cea9a1a242 nixos-generate-config: Don't generate /var/lib/nfs/rpc_pipefs filesystem
It's automatically mounted if the system has support for NFS.
2014-02-19 17:18:49 +01:00
Domen Kožar ad0732313d gnome3: typo 2014-02-19 16:53:08 +01:00
Domen Kožar 746c42d10f gnome3: add some default core packages to be installed 2014-02-19 16:38:42 +01:00
Domen Kožar 189273af38 add gnome3.vino 2014-02-19 16:38:41 +01:00
Eelco Dolstra c7aedd5805 Add missing file 2014-02-19 10:38:44 +01:00
Pascal Wittmann ff7e234fb4 Removed obsolete option services.xserver.videoDriver 2014-02-18 23:13:00 +01:00
Pascal Wittmann 516cdc25a4 Renamed obsolete option services.xserver.videoDrivers to hardware.opengl.videoDrivers 2014-02-18 23:11:49 +01:00
Eelco Dolstra ca70ccb5c1 Start of 14.02 release notes 2014-02-18 19:13:07 +01:00
Eelco Dolstra d2aa2ac494 memtest.nix: Use toString 2014-02-18 19:13:07 +01:00
Moritz Ulrich 958df8b9d1 i18n.consoleKeyMap: Accept string or path.
i18n.consoleKeyMap maps to KEYMAP=... in vconsole.conf and `loadkeymap'
in stage1. Both of these accept paths to a keymap file in addition to
a string containing the name of the keymap.

With this commit, it's possible to use your own keymap via:

i18n.consoleKeyMap = ./path/to/something.kmap
2014-02-17 20:46:33 +01:00
Domen Kožar 4b201b27bf gnome3: correctly place GIO_EXTRA_MODULES 2014-02-17 00:24:13 +01:00
Domen Kožar e24b01f615 desktop-manager.gnome3: add dconf support 2014-02-16 21:37:18 +01:00
Domen Kožar 0b5d523b84 redshift: default to string type for option brightness 2014-02-16 14:22:49 +01:00
Shea Levy abf901484c Allow directly setting hashedPassword for root 2014-02-16 07:33:07 -05:00
Petr Rockai 01d7e79eaf nixos: Make serial agetty's bitrates configurable. 2014-02-15 12:57:27 +01:00
Petr Rockai 42ce480a52 nixos: Try harder to get LVM-hosted filesystems up in stage1. 2014-02-15 12:57:17 +01:00
Domen Kožar 77750efc7e Merge pull request #1739 from ttonelli/master
Improvements to RedShift service
2014-02-15 10:33:45 +01:00
Thiago Tonelli Bartolomei 2dcf933817 adding wantedBy graphical.target 2014-02-14 09:48:19 -05:00
Shea Levy 48b8118f2c virtualbox-image.nix: initialRootPassword setting should be easily overrideable 2014-02-14 09:06:26 -05:00
Oliver Charles 2ea7c90839 postgresql module: Use the default superuser username
PostgreSQL defaults to having 'postgres' as the superuser. NixOS should
use this default name to provide a less surprising result to people who
enable services.postgres.
2014-02-13 18:52:59 +00:00
Shea Levy c8f1a6ac1e Revert "Add nixosSubmodule option type"
Moving recent types work to a separate branch for now

This reverts commit ca1c5cfa8f.
2014-02-13 12:10:50 -05:00
Shea Levy 220654e205 Revert "Add heterogeneousAttrsOf option type"
Moving recent types work to a separate branch for now

This reverts commit 3f70dabad3.
2014-02-13 12:10:50 -05:00
Rickard Nilsson fc90a739ba networkmanager module: No need to start ModemManager explicitly, done by NM 2014-02-13 18:05:04 +01:00
Thiago Tonelli Bartolomei b5d17fe873 - adding brightness options
- setting options to be uniq
- using proper systemd exec service
2014-02-13 11:11:14 -05:00
Domen Kožar 85d38d1436 nginx: add appendConfig option with types.lines 2014-02-12 19:13:36 +01:00
Domen Kožar a49fbca134 Merge pull request #1730 from pSub/logcheck-uid
nixos: add uid for logcheck and only create a user for the default user
2014-02-12 16:10:35 +01:00
Shea Levy 8e97e38677 Reenable efi tests 2014-02-12 07:13:37 -05:00
Oliver Charles 625b42838a NetworkManager: Fix aliases and dependencies
There are two fixes in this commit.

Firstly, I am creating proper symlinks for the Alias= definitions in the
.service files. This achieves the same result as `systemctl enable`, and
I think is preferred over `mv`.

Secondly, `networkmanager-init` now wants `NetworkManager.service`,
along with `ModemManager.service`. ModemManager does not depend on
NetworkManager (according to `systemctl list-dependencies ModemManager`),
thus NetworkManager never got started on boot.
2014-02-12 11:32:49 +00:00
Shea Levy 3f70dabad3 Add heterogeneousAttrsOf option type
It is parameterized by a function that takes a name and evaluates to the
option type for the attribute of that name. Together with
submoduleWithExtraArgs, this subsumes nixosSubmodule.
2014-02-11 14:59:24 -05:00
Shea Levy ca1c5cfa8f Add nixosSubmodule option type
Since NixOS modules expect special arguments, use a hack to provide them
2014-02-11 14:21:34 -05:00
Eelco Dolstra 9c616e3bf4 Remove /etc/ca-bundle.crt
Applications should use /etc/ssl/certs/ca-bundle.crt instead.
2014-02-11 17:13:36 +01:00
Pascal Wittmann 884190a238 nixos: add uid for logcheck and only create a user for the default user 2014-02-11 14:19:06 +01:00
Rob Vermaas 61eae53709 Add all AWS regions to EBS AMI creation script. 2014-02-11 13:26:46 +01:00
Shea Levy 4ab5646417 Add a keys group with read access to /run/keys
This allows processes running as unprivileged users access to keys they might need
2014-02-11 07:00:10 -05:00
Michael Raskin 91b5aa7e10 Add some packages needed by some generic HP PCL drivers 2014-02-11 01:34:19 +04:00
Michael Raskin 4c9c7f6ba4 Add an option to change vsftpd anonymos write umask. 2014-02-11 01:34:19 +04:00
Shea Levy 80cc2697b1 user-groups: Sidestep all password escaping issues
Now passwords are written to a file first
2014-02-10 10:12:34 -05:00
Thomas Tuegel 3dc6168b31 Properly escape passwords sent to chpasswd
The mutableUsers feature uses `chpasswd` to set users passwords.
Passwords and their hashes were being piped into the program using
double quotes ("") to escape. This causes any `$` characters to be
expanded as shell variables. This is a serious problem because all the
password hash methods besides DES use multiple `$` in the hashes. Single
quotes ('') should be used instead to prevent shell variable expansion.
2014-02-10 08:16:22 -06:00
Shea Levy 6a8cc9ab11 mediawiki: Fix some references to /bin/bash 2014-02-10 09:14:30 -05:00
Shea Levy 42df6fcee9 mediawiki: Run update script after initializing the database 2014-02-10 08:56:16 -05:00
Shea Levy 258c7536be Force a rebuild 2014-02-09 11:59:02 -05:00
Tomasz Kontusz fe38031168 Upgrade bumblebee and add nixos module
* Bump bumblebee to 3.2.1
 * Remove config.patch - options it added can be passed to ./configure now
 * Remove the provided xorg.conf
   Provided xorg.conf was causing problems for some users,
   and Bumblebee provides its own default configuration anyway.
 * Make secondary X11 log to /var/log/X.bumblebee.log
 * Add a module for bumblebee
2014-02-09 15:09:41 +01:00
Bjørn Forsman 48851fa749 nixos/memtest: use docbook formatting
Without this the HTML manual and manpage is quite unreadable (newlines
are squashed so it doesn't look like a list anymore).

(Unfortunately, this makes the source unreadable.)
2014-02-09 13:56:09 +01:00
Ricardo M. Correia cba2444d11 nixos/memtest: Allow user to specify memtest86 boot parameters 2014-02-09 13:55:37 +01:00
Domen Kožar 028379be28 nixos: add most basic gnome3 test and take a screenshot 2014-02-08 21:47:39 +01:00
Domen Kožar ee14f8da9a remove references to isSystemUser and fix eval of tested job 2014-02-08 21:10:00 +01:00
Shea Levy dea562b6b9 services.mesa -> hardware.opengl
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-08 14:45:37 -05:00
Domen Kožar b17edbac57 ModemManager: 0.5.4.0 -> 0.7.991 2014-02-08 20:17:00 +01:00
Petr Rockai 12315a278c Merge branch 'yubikey' of git://github.com/Calrama/nixpkgs 2014-02-08 16:01:22 +01:00
Moritz Maxeiner 09f9af17b4 Update to the Yubikey PBA
Security-relevant changes:
 * No (salted) passphrase hash send to the yubikey, only hash of the salt (as it was in the original implementation).
 * Derive $k_luks with PBKDF2 from the yubikey $response (as the PBKDF2 salt) and the passphrase $k_user
   (as the PBKDF2 password), so that if two-factor authentication is enabled
   (a) a USB-MITM attack on the yubikey itself is not enough to break the system
   (b) the potentially low-entropy $k_user is better protected against brute-force attacks
 * Instead of using uuidgen, gather the salt (previously random uuid / uuid_r) directly from /dev/random.
 * Length of the new salt in byte added as the parameter "saltLength", defaults to 16 byte.
   Note: Length of the challenge is 64 byte, so saltLength > 64 may have no benefit over saltLengh = 64.
 * Length of $k_luks derived with PBKDF2 in byte added as the parameter "keyLength", defaults to 64 byte.
   Example: For a luks device with a 512-bit key, keyLength should be 64.
 * Increase of the PBKDF2 iteration count per successful authentication added as the
   parameter "iterationStep", defaults to 0.

Other changes:
 * Add optional grace period before trying to find the yubikey, defaults to 2 seconds.

Full overview of the yubikey authentication process:

  (1) Read $salt and $iterations from unencrypted device (UD).
  (2) Calculate the $challenge from the $salt with a hash function.
      Chosen instantiation: SHA-512($salt).
  (3) Challenge the yubikey with the $challenge and receive the $response.
  (4) Repeat three times:
    (a) Prompt for the passphrase $k_user.
    (b) Derive the key $k_luks for the luks device with a key derivation function from $k_user and $response.
        Chosen instantiation: PBKDF2(HMAC-SHA-512, $k_user, $response, $iterations, keyLength).
    (c) Try to open the luks device with $k_luks and escape loop (4) only on success.
  (5) Proceed only if luks device was opened successfully, fail otherwise.

  (6) Gather $new_salt from a cryptographically secure pseudorandom number generator
      Chosen instantiation: /dev/random
  (7) Calculate the $new_challenge from the $new_salt with the same hash function as (2).
  (8) Challenge the yubikey with the $new_challenge and receive the $new_response.
  (9) Derive the new key $new_k_luks for the luks device in the same manner as in (4) (b),
      but with more iterations as given by iterationStep.
 (10) Try to change the luks device's key $k_luks to $new_k_luks.
 (11) If (10) was successful, write the $new_salt and the $new_iterations to the UD.
      Note: $new_iterations = $iterations + iterationStep

Known (software) attack vectors:

 * A MITM attack on the keyboard can recover $k_user. This, combined with a USB-MITM
   attack on the yubikey for the $response (1) or the $new_response (2) will result in
   (1) $k_luks being recovered,
   (2) $new_k_luks being recovered.
 * Any attacker with access to the RAM state of stage-1 at mid- or post-authentication
   can recover $k_user, $k_luks, and  $new_k_luks
 * If an attacker has recovered $response or $new_response, he can perform a brute-force
   attack on $k_user with it without the Yubikey needing to be present (using cryptsetup's
   "luksOpen --verify-passphrase" oracle. He could even make a copy of the luks device's
   luks header and run the brute-force attack without further access to the system.
 * A USB-MITM attack on the yubikey will allow an attacker to attempt to brute-force
   the yubikey's internal key ("shared secret") without it needing to be present anymore.

Credits:

 * Florian Klien,
   for the original concept and the reference implementation over at
   https://github.com/flowolf/initramfs_ykfde
 * Anthony Thysse,
   for the reference implementation of accessing OpenSSL's PBKDF2 over at
   http://www.ict.griffith.edu.au/anthony/software/pbkdf2.c
2014-02-08 14:59:52 +01:00
Domen Kožar 5ffab7710d gnome3.gnome_control_center: build and fix runtime deps 2014-02-08 12:30:23 +01:00
Bjørn Forsman db12d783ff nixos: add uid/gid for munin
To be compatible with eb2f44c18c (Generate
/etc/passwd and /etc/group at build time). Without this you'll get this:

  $ nixos-rebuild build
  [...]
  user-thrown exception: The option `users.extraGroups.unnamed-9.1.gid' is used but not defined.
2014-02-07 23:08:15 +01:00
Shea Levy e058de1642 Add option to enforce uniqueness of uids/gids (on by default)
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-07 09:57:28 -05:00
Domen Kožar 506a030b91 gnome3: add missing files 2014-02-07 00:37:17 +01:00
Domen Kožar 65a28e8b73 Add gnome3 desktop manager. Very experimental.
Currently very basic gnome-shell launches on my laptop. Quite some
services won't start yet, most notable is gnome-control-center.

GTK3 apps still don't have theming applied and for example launching
chromium results in horrible red windows.
2014-02-07 00:31:29 +01:00
Domen Kožar 15fb296b43 xfce: partially add gtk3 support 2014-02-07 00:30:21 +01:00
Jaka Hudoklin 616b4b5b0e nixos/systemd: add journal http gateway support 2014-02-06 16:21:19 +01:00
Mathijs Kwik 951f37f3da services.xserver.videoDrivers -> services.mesa.videoDrivers 2014-02-06 10:01:08 +01:00
Vladimír Čunát 4284694439 nixos/mesa: don't create /run/opengl-driver-32 ...
... if on 64-bit and without 32-bit drivers.
Also assert against requesting 32-bit drivers on 32-bit machine.
2014-02-05 19:20:42 +01:00
Moritz Maxeiner 0a230b852d Add "vboxsf" to the kernel modules for VirtualBox Guest Additions 4.3.6 2014-02-05 18:38:03 +01:00
Rickard Nilsson 72ba2bf126 Add description to group.members option 2014-02-05 15:56:51 +01:00
Rickard Nilsson 0b92ad02c8 Re-introduce security.initialRootPassword, and add a new option users.extraUsers.<user>.hashedPassword 2014-02-05 15:56:51 +01:00
Rickard Nilsson 03ee174032 Only add shadow to system packages if users.mutableUsers is true 2014-02-05 15:56:51 +01:00
Rickard Nilsson eb2f44c18c Generate /etc/passwd and /etc/group at build time
This is a rather large commit that switches user/group creation from using
useradd/groupadd on activation to just generating the contents of /etc/passwd
and /etc/group, and then on activation merging the generated files with the
files that exist in the system. This makes the user activation process much
cleaner, in my opinion.

The users.extraUsers.<user>.uid and users.extraGroups.<group>.gid must all be
properly defined (if <user>.createUser is true, which it is by default). My
pull request adds a lot of uids/gids to config.ids to solve this problem for
existing nixos services, but there might be configurations that break because
this change. However, this will be discovered during the build.

Option changes introduced by this commit:

* Remove the options <user>.isSystemUser and <user>.isAlias since
they don't make sense when generating /etc/passwd statically.

* Add <group>.members as a complement to <user>.extraGroups.

* Add <user>.passwordFile for setting a user's password from an encrypted
(shadow-style) file.

* Add users.mutableUsers which is true by default. This means you can keep
managing your users as previously, by using useradd/groupadd manually. This is
accomplished by merging the generated passwd/group file with the existing files
in /etc on system activation. The merging of the files is simplistic. It just
looks at the user/group names. If a user/group exists both on the system and
in the generated files, the system entry will be kept un-changed and the
generated entries will be ignored. The merging itself is performed with the
help of vipw/vigr to properly lock the account files during edit.
If mutableUsers is set to false, the generated passwd and group files will not
be merged with the system files on activation. Instead they will simply replace
the system files, and overwrite any changes done on the running system. The
same logic holds for user password, if the <user>.password or
<user>.passwordFile options are used. If mutableUsers is false, password will
simply be replaced on activation. If true, the initial user passwords will be
set according to the configuration, but existing passwords will not be touched.

I have tested this on a couple of different systems and it seems to work fine
so far. If you think this is a good idea, please test it. This way of adding
local users has been discussed in issue #103 (and this commit solves that
issue).
2014-02-05 15:56:51 +01:00
Shea Levy bfc682ea37 Mount a ramfs on /run/keys for safe key storage for nixops
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-05 08:00:19 -05:00
Shea Levy 1e0352f801 Fix gummiboot builder
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-05 07:54:11 -05:00
Arseniy Seroka d573ea576f add normal theme support for slim and slimlock 2014-02-05 16:46:42 +04:00
Domen Kožar e1b206b4a9 clarify rename error messages 2014-02-04 16:33:01 +01:00
Shea Levy 741cc62f75 Force a rebuild.
Sigh.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-04 08:43:45 -05:00
Eelco Dolstra 9e7fe29e41 ntpd: Don't answer status queries
Workaround for CVE-2013-5211:

http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using
2014-02-03 23:44:11 +01:00
Shea Levy 5e72e36f95 gummiboot-builder.py: Remove old entries before adding new ones
Fixes #1483

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-03 17:41:31 -05:00
Shea Levy 448dc031ed Document EFI installation
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-03 17:05:23 -05:00
Shea Levy d6ef65cb6a Limit livecd label to 11 characters
vfat partition labels can only be 11 characters long

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-03 17:05:04 -05:00
Moritz Maxeiner 8e74e1fded Replace the current Yubikey PBA implementation with the previous one.
Rationale:
  * The main reason for choosing to implement the PBA in accordance
    with the Yubico documentation was to prevent a MITM-USB-attack
    successfully recovering the new LUKS key.
  * However, a MITM-USB-attacker can read user id and password when
    they were entered for PBA, which allows him to recover the new
    challenge after the PBA is complete, with which he can challenge
    the Yubikey, decrypt the new AES blob and recover the LUKS key.
  * Additionally, since the Yubikey shared secret is stored in the
    same AES blob, after such an attack not only is the LUKS device
    compromised, the Yubikey is as well, since the shared secret
    has also been recovered by the attacker.
  * Furthermore, with this method an attacker could also bruteforce
    the AES blob, if he has access to the unencrypted device, which
    would again compromise the Yubikey, should he be successful.
  * Finally, with this method, once the LUKS key has been recovered
    once, the encryption is permanently broken, while with the previous
    system, the LUKS key itself it changed at every successful boot,
    so recovering it once will not necessarily result in a permanent
    breakage and will also not compromise the Yubikey itself (since
    its secret is never stored anywhere but on the Yubikey itself).

Summary:
The current implementation opens up up vulnerability to brute-forcing
the AES blob, while retaining the current MITM-USB attack, additionally
making the consequences of this attack permanent and extending it to
the Yubikey itself.
2014-02-03 22:50:17 +01:00
Oliver Charles 0d18d39e98 switch-to-configuration.pl: Handle successful auto-restarts
switch-to-configuration.pl is currently hard-coded to assume that if a
unit is in the "auto-restart" state that something has gone wrong, but
this is not strictly true. For example, I run offlineimap as a oneshot
service restarting itself every minute (on success). NixOS currently
thinks that offlineimap has failed to start as it enters the
auto-restart state, because it doesn't consider why the unit failed.

This commit changes switch-to-configuration.pl to inspect the full
status of a unit in auto-restart state, and now only considers it failed
if the ExecMainStatus is non-zero.
2014-02-02 15:56:22 +01:00
Vladimír Čunát 4a55391f1f Merge #1645 and #1646: lightdm and -gtk-greeter update 2014-02-02 15:51:35 +01:00
Vladimír Čunát b5a32b3944 Merge #1618: use ubuntu module blacklists by default 2014-02-02 15:51:07 +01:00
Oliver Charles 41775167ac switch-to-configuration.pl: Interact via DBus
Currently switch-to-configuration.pl uses system() calls to interact
with DBus. This can be error prone, especially when we are parsing
output that could change. In this commit, almost all calls to the
systemctl binary have been replaced with equivalent operations via DBus.
2014-02-02 14:41:26 +00:00
Jaka Hudoklin b6e3cd7170 nixos/nscd: add option to change nscd config
[Bjørn Forsman <bjorn.forsman@gmail.com>:
 - use types.lines instead of types.string. The former joins strings
   with "\n" and the latter with "" (and is deprecated).
]
2014-02-02 15:31:55 +01:00
Eelco Dolstra 559f5be07d dhcpcd: Update to 6.2.1
Dhcpcd now has integration with udev, so it should no longer be a
problem if udev renames an interface while dhcpcd is running.
2014-02-02 11:28:45 +01:00
Moritz Maxeiner 4900d6561b Follow renaming of services.xserver.videoDrivers to services.mesa.videoDrivers for VirtualBox Guest 2014-02-02 02:43:11 +01:00
Arvin Moezzi 0602ef22de git-daemon service: fix typo in option (close #1659) 2014-02-01 11:56:56 +01:00
Thomas Tuegel 6a756af3e7 zsh: don't clobber the environment of non-login shells 2014-01-31 16:53:28 -06:00
Rob Vermaas 9b1bd84940 httpd: Respect original order of environment eval. 2014-01-31 21:18:24 +01:00
Rob Vermaas bfa56d7657 httpd: Only add PHPRC to environment of httpd when enablePHP is true. 2014-01-31 21:14:05 +01:00
Oliver Charles 32a08d0846 lightdm: Update to 1.8.6 2014-01-31 12:42:03 +00:00
Petr Rockai 2062abfd4f Merge branch 'yubikey' of git://github.com/Calrama/nixpkgs 2014-01-29 18:54:07 +01:00
Moritz Maxeiner 7bf94cadad Add library dependencies explicitly 2014-01-29 18:49:26 +01:00
Moritz Maxeiner e96f58ef5c Implement muli-user authentication for yubikey pba, i.e. multiple users can now share a single luks keyslot.
This is achieved by having multiple lines per storage file, one for each user (if the feature is enabled); each of these
lines has the same format as would be the case for the userless authentication, except that they are prepended with a
SHA-512 of the user's id.
2014-01-29 17:20:05 +01:00
Moritz Maxeiner 20cfaf0faa Change the crypt-storage file to be hex encoded instead of raw binary. To update from the previous configuration, convert your crypt-storage file from raw binary to hex. 2014-01-29 13:58:35 +01:00
aszlig 795941261a
nixos-generate-config: Fix reference to <nixos>.
IIUC, <nixos> is going to be deprecated someday in the future, and as
most of those references are already replaced I guess it's safe to
replace it here as well, as it is only relevant on new/updated
installations.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-01-29 13:23:30 +01:00
Moritz Maxeiner cce9712331 Enable two-factor authentication by default. Add proper descriptions to attributes. 2014-01-29 12:55:32 +01:00
Moritz Maxeiner 45b1ffb8db Cosmetic change to yubikey detection 2014-01-28 20:39:46 +01:00
Vladimír Čunát 5acaa980a5 pull module blacklist from Ubuntu and use it by default
People often have serious problems due to bogus modules like *fb.
2014-01-28 12:52:36 +01:00
Moritz Maxeiner 407a770161 Rewrite as a pre-boot authentication module (mostly) comforming to the design specification of
'YubiKey Integration for Full Disk Encryption Pre-Boot Authentication (Copyright) Yubico, 2011 Version: 1.1'.

Used binaries:
  * uuidgen - for generation of random sequence numbers
  * ykchalresp - for challenging a Yubikey
  * ykinfo - to check if a Yubikey is plugged in at boot (fallback to passphrase authentication otherwise)
  * openssl - for calculation of SHA-1, HMAC-SHA-1, as well as AES-256-CTR (de/en)cryption

Main differences to the specification mentioned above:
  * No user management (yet), only one password+yubikey per LUKS device
  * SHA-512 instead of CRC-16 for checksum

Main differences to the previous implementation:
  * Instead of changing the key slot of the LUKS device each boot,
    the actual key for the LUKS device will be encrypted itself
  * Since the response for the new challenge is now calculated
    locally with openssl, the MITM-USB-attack with which previously
    an attacker could obtain the new response (that was used as the new
    encryption key for the LUKS device) by listening to the
    Yubikey has ideally become useless (as long as uuidgen can
    successfuly generate new random sequence numbers).

Remarks:
  * This is not downwards compatible to the previous implementation
2014-01-28 04:02:51 +01:00
Rob Vermaas 4ccd60af00 Merge pull request #1178 from chexxor/fix-httpd-ssh
HTTPD: Check for SSL Cert value before building with SSL support.
2014-01-27 12:34:42 -08:00
Petr Rockai 66db1b3a64 nixos: Add a dictd service. 2014-01-25 16:35:02 +01:00
Aristid Breitkreuz 5d3d6b3799 support -Q in nixos-rebuild 2014-01-25 11:20:25 +01:00
Moritz Maxeiner 333f5caaf9 Implement authentication for a LUKS device with a yubikey (HMAC-SHA1); supports simple challenge-response and two-factor authentication 2014-01-25 03:33:09 +01:00
Thomas Tuegel 7b743fcaab networkmanager: load modules required for PPTP 2014-01-24 09:22:59 -06:00
Vladimír Čunát 12235ed36e remove .topmsg (close #1578) 2014-01-23 22:30:07 +01:00
Shea Levy 51de280c0a nixos X tests: wait for logind to link a session to the server
There seems to be some race causing failures if an X command gets in before slim starts the session

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-22 14:23:56 -05:00
Shea Levy d18bc25b95 Rename linuxManualConfig to buildLinux
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-21 20:05:55 -05:00
Shea Levy 30f7947031 Whitespace to force a build
Ugh

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-19 15:07:35 -05:00
Domen Kožar e5b6de80bb Merge pull request #1536 from Shados/service-haveged
Adds a service for haveged, the entropy daemon
2014-01-18 09:38:51 -08:00
Shea Levy d454e094ef kmscon: Don't re-run systemd-vconsole-setup after boot, and let tty1 wait for vconsole setup
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-18 11:17:49 -05:00
Shea Levy ca7805be94 systemd: Enable specifying extra config files for a unit
This will allow overriding package-provided units, or overriding only a
specific instance of a unit template.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-18 11:10:39 -05:00
Shea Levy 9c1d3bfa9f Whitespace to force a rebuild
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-17 12:15:49 -05:00
Shea Levy 7f15b0c132 Merge branch 'xprofile' of git://github.com/pSub/nixpkgs into master
Allow the user to execute commands at the beginning of the X session.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-17 09:28:19 -05:00
Alexei Robyn 6d80803e66 Adds a service for haveged, the entropy daemon
Includes configuration option for the threshold beneath which to refill
the entropy pool - defaults to 1024 bits as this is the number used in
other distro's existing service files I looked at.
2014-01-17 22:10:52 +11:00
Shea Levy babd66e8e6 Fix environment.etc setting
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 15:15:46 -05:00
Shea Levy 22c5c57043 Fix typo
Thanks to @bennofs for pointing it out

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 11:14:46 -05:00
Shea Levy fd97be3501 Don't restart kmscon VTs if the unit changes
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:52:08 -05:00
Shea Levy 646af581f5 Option description formatting
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:17:19 -05:00
Shea Levy 852c270035 nixos: Split mesa setup from xserver.nix
With kmscon, it is now possible to have a system without X that still
needs the mesa setup in /run/opengl-driver

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:17:19 -05:00
Shea Levy 48daf624c5 Add module to use kmscon instead of linux-console for VTs
This required some changes to systemd unit handling:

* Add an option to specify that a unit is just a symlink
* Allow specified units to overwrite systemd-provided ones
* Have gettys.target require autovt@1.service instead of getty@1.service

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:17:19 -05:00
Thomas Bereknyei 57e3feda74 Adds kippo SSH honeypot 2014-01-14 10:32:26 +00:00
Eelco Dolstra 6fb27abf33 Merge branch 'java' 2014-01-13 13:16:17 +01:00
Jaka Hudoklin 78d3180dbe xfce: add xfce screenshooter 2014-01-13 10:55:18 +00:00
Jaka Hudoklin ba1bbc2fa8 nixos/cgminer: fix restarts, set uid 2014-01-13 00:19:06 +01:00
Oliver Charles 422f2032ab services.postgresql: Hint to use mkForce for authentication
This fixes #1395
2014-01-11 22:01:21 +00:00
Rok Garbas e1f363350a connman-vpn and connman-vpn dbus servise should start after connman service 2014-01-11 21:17:17 +01:00
Matej Cotman 7d4d3536f7 connman: new packages ConnMan v1.20 and connman-ui 2014-01-11 20:22:53 +01:00
Eelco Dolstra c32d0180e4 Don't set $TZ
Now that Java is happy with our /etc/localtime, there is no reason to
set $TZ anymore.  (See 945849b86f, 279248f6c5, 1b5e860f65607b4cc7de4b6b5db95460cf144526.)

Fixes #1463.
2014-01-06 18:27:07 +01:00
Eelco Dolstra 1b5e860f65 Make /etc/localtime a direct symlink to the zoneinfo file
Some programs (notably the Java Runtime Environment) expect to be able
to extract the name of the time zone from the target of the
/etc/localtime symlink.  That doesn't work if /etc/localtime is a
symlink to /etc/static/localtime.  So make it a direct symlink.
2014-01-06 18:23:41 +01:00
Shea Levy b0000b29af gummiboot module: Don't use obsolete environment.nix option
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-05 15:53:39 -05:00
Shea Levy 886a675f79 Fix extra kernelDev reference
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-05 13:15:03 -05:00
Shea Levy 139f8949e6 Merge branch 'merge-kernel-builds' into upstream-master
This is a second attempt at unifying the generic and manual-config
kernel builds (see #412 for the last time).

The set of working kernel packages is a superset of those that work on
master, and as the only objection last time was the size of the $dev
closure and now both $out and $dev combined are 20M smaller than $out on
master (see message for ac2035287f), this
should be unobjectionable.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-05 07:13:19 -05:00
Shea Levy a589bfae17 Update and fix kernel packages to new kernel build
In most cases, this just meant changing kernelDev (now removed from
linuxPackagesFor) to kernel.dev. Some packages needed more work (though
whether that was because of my changes or because they were already
broken, I'm not sure). Specifics:

* psmouse-alps builds on 3.4 but not 3.10, as noted in the comments that
  were already there
* blcr builds on 3.4 but not 3.10, as noted in comments that were
  already there
* open-iscsi, ati-drivers, wis-go7007, and openafsClient don't build on
  3.4 or 3.10 on this branch or on master, so they're marked broken
* A version-specific kernelHeaders package was added

The following packages were removed:

* atheros/madwifi is superceded by official ath*k modules
* aufs is no longer used by any of our kernels
* broadcom-sta v6 (which was already packaged) replaces broadcom-sta
* exmap has not been updated since 2011 and doesn't build
* iscis-target has not been updated since 2010 and doesn't build
* iwlwifi is part of mainline now and doesn't build
* nivida-x11-legacy-96 hasn't been updated since 2008 and doesn't build

Everything not specifically mentioned above builds successfully on 3.10.
I haven't yet tested on 3.4, but will before opening a pull request.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-04 21:17:04 -05:00
Thomas Tuegel 6f768bf47c networkmanager: register PPTP service 2014-01-02 11:02:29 -06:00
Pascal Wittmann badb4753e4 Allow the user to execute commands at the beginning of the X session.
The difference between xsession and xprofile is that xsession is exec'd and xprofile is sourced.
So with xprofile all commands after sourcing will still be exectued. This allows for instance
autostarting of applications while configuring the start of a window manager via configuration.nix.
2014-01-02 11:38:44 +01:00
William A. Kennington III 38bc05158d network-interfaces: Add the ability to create bond devices
This patch adds support for the creations of new bond devices, aggregate
pipes of physical devices for extra throughput or failover.

Additionally, add better correction at the startup of a bridge
of vlan interface (delete old, stale interfaces).
2013-12-31 09:28:52 -06:00
Mathijs Kwik 3668970f7f Merge pull request #1430 from wkennington/mtu
network-interfaces: Add mtu setting support
2013-12-30 00:53:45 -08:00
William A. Kennington III c6ab810e37 network-interfaces: Add mtu setting support
Adds a setting to the network interface configuration for changing the
mtu for each specified interface.
2013-12-30 02:52:55 -06:00
Mathijs Kwik 9b056e1e3e Merge pull request #1431 from wkennington/vlan
network-interfaces: Add support for creating vlans
2013-12-30 00:40:02 -08:00
William A. Kennington III cabc0647d9 network-interfaces: Add support for creating vlans
This patch adds support for vlan creation at machine startup, so that we
can adjust interface settings for vlan devices using nix.
2013-12-29 21:54:24 -06:00
Moritz Ulrich 1f91c749f5 services.redshift: Start after display-manager.service.
Signed-off-by: Moritz Ulrich <moritz@tarn-vedra.de>
2013-12-29 21:19:19 +01:00
Moritz Ulrich 6934145c30 services.redshift: Enable auto-restart.
The redshift service stops working after some time (the program exits
after some hours/days). It looks like these exits are related to calls
to xrandr (for multiple displays) or suspend-to-ram.

Signed-off-by: Moritz Ulrich <moritz@tarn-vedra.de>
2013-12-29 21:19:19 +01:00
Georges Dubus 2ffab7ba6a Fixed a code typo in the documentation 2013-12-29 11:43:59 +01:00
Moritz Ulrich 5890215501 windowManager.xmonad: Make it configurable and extensible.
PR #1366
The previous windowManager.xmonad option only starts xmonad and
doesn't make ghc available. This assumes that the user has GHC with
access to the xmonad package in his PATH when using xmonad.

Xmonad in Nix is now patched to accept the XMONAD_{GHC,XMESSAGE}
environment variables which define the path to either ghc or xmessage.
These are set automatically when using xmonad through
windowManager.xmonad.

My (or specific: @aristidb and my) changes make it possible to use
Xmonad without adding GHC to any profile. This is useful if you want
to add a different GHC to your profile.

This commit introduces some options:

- xmonad.haskellPackages: Controls which Haskell package set & GHC set
  is used to (re)build Xmonad

- xmonad.extraPackages: Function returning a list of additional
  packages to make available to GHC when rebuilding Xmonad

- xmonad.enableContribExtras: Boolean option to build xmonadContrib
  and xmonadExtras.

Signed-off-by: Moritz Ulrich <moritz@tarn-vedra.de>
2013-12-28 09:29:53 +01:00
Vladimír Čunát b80d1c5923 Merge x-updates 2013-12-25 23:56:41 +01:00
Peter Simons 6bc4007e60 nixos: don't white-list port 8200 in the firewall when minidlna is enabled
If you want minidla to accept connections from the rest of the world, please
add

    networking.firewall.allowedTCPPorts = [ 8200 ];
    networking.firewall.allowedUDPPorts = [ 1900 ];

to /etc/nixos/configuration.nix.

See <http://lists.science.uu.nl/pipermail/nix-dev/2013-November/011997.html>
for the discussion that lead to this.
2013-12-23 21:32:13 +01:00
Peter Simons 7bb7ea52e9 nixos: don't white-list port 5900 in the firewall when x11vnc is enabled
If you want x11vnc to receive TCP connections from the rest of the world,
please add

    networking.firewall.allowedTCPPorts = [ 5900 ];

to /etc/nixos/configuration.nix.

See <http://lists.science.uu.nl/pipermail/nix-dev/2013-November/011997.html>
for the discussion that lead to this.
2013-12-23 21:30:10 +01:00
Peter Simons 19a79fc71d nixos: don't white-list port 631 in the firewall when CUPS is enabled
If you want CUPS to receive UDP printer announcements from the rest of the
world, please add

  networking.firewall.allowedUDPPorts = [ 631 ];

to /etc/nixos/configuration.nix.

See <http://lists.science.uu.nl/pipermail/nix-dev/2013-November/011997.html>
for the discussion that lead to this.
2013-12-23 21:27:07 +01:00
Vladimír Čunát 50ac037864 Merge master into x-updates 2013-12-23 19:27:14 +01:00
Lluís Batlle i Rossell 152da7671c nixos initrd: load atkbd, not xtkbd
I don't think anyone has a XT keyboard in a computer running nixos.
2013-12-23 09:01:45 +01:00
Vladimír Čunát 2b24f1349a Merge master into x-updates 2013-12-21 10:20:55 +01:00
Michael Raskin 997778c820 Make Ejabberd service work 2013-12-20 18:16:56 +04:00
Eelco Dolstra f5844f98ac mediawiki: Update to 1.20.8
CVE-2013-4567, CVE-2013-4568
2013-12-20 14:46:57 +01:00
Vladimír Čunát 4c5a71f777 Merge master into x-updates
Conflicts:
	pkgs/desktops/gnome-2/desktop/gvfs/default.nix
	pkgs/development/libraries/cogl/default.nix
	pkgs/development/libraries/libsoup/2.44.nix
2013-12-18 23:21:29 +01:00
Michael Raskin bdd1fea87b Merge pull request #1373 from offlinehacker/nixos/memcached/user_fix
memcached: set uid to make it work with #1076
2013-12-14 22:55:00 -08:00
Michael Raskin 654627fe4c Merge pull request #1362 from tomberek/ddclient_correction
Correct web-skip value to match behavior of checkip.dyndns.com
2013-12-14 22:51:44 -08:00
Michael Raskin 152f7666af Merge pull request #1340 from bjornfor/ntopng
Add ntopng package and nixos service module
2013-12-14 22:46:49 -08:00
David Virgilio 2f69aaf721 add herbstluftwm enable option 2013-12-14 14:45:33 +01:00
Jaka Hudoklin 24e2ef5126 memcached: set uid to make it work with #1076 2013-12-13 10:09:08 +01:00
Rob Vermaas 61d346eaaf Google Compute image: fix punctuation in description, give disk image proper name with version and revision. 2013-12-12 12:48:09 +01:00
Eelco Dolstra 8c2dd86fe2 Manual: Fix typo
Fixes #1363.
2013-12-12 10:38:13 +01:00
Thomas Bereknyei 6129be5a7a Correct web-skip value to match behavior of checkip.dyndns.com 2013-12-11 23:22:43 -05:00
Eelco Dolstra 14018c2de1 fail2ban: Fix preStart action
Creating /run/fail2ban didn't work since it didn't have write
permission to /run.  Now it does.

Reported by Thomas Bereknyei.
2013-12-11 21:16:58 +01:00
Rob Vermaas ee8a58a72f Remove a hardcoded SSH public key from the Google Compute image. 2013-12-11 16:18:12 +01:00
Rob Vermaas f7b256a221 Add initial configuration for Google Compute Engine 2013-12-11 15:32:27 +01:00
Vladimír Čunát 089da3ee5c Merge master into x-updates
Conflicts (simple):
	pkgs/top-level/all-packages.nix
2013-12-10 13:00:02 +01:00
Bjørn Forsman 9474fbae65 nixos: add ntopng service
ntopng is a high-speed web-based traffic analysis and flow collection
tool. Enable it by adding this to configuration.nix:

  services.ntopng.enable = true;

Open a browser at http://localhost:3000 and login with the default
username/password: admin/admin.
2013-12-09 21:35:01 +01:00
Bjørn Forsman 0856500f3e nixos/libvirtd-service: fix fail-to-start when no machines are configured
Don't fail to start the libvirtd service just because there are no files
that match the /etc/libvirt/qemu/*.xml pattern.
2013-12-09 19:41:44 +01:00
Vladimír Čunát 6690c97569 Merge branch 'master' into x-updates
Conflicts (just different styles, same semantics):
	pkgs/development/libraries/libusb1/default.nix
2013-12-07 14:17:16 +01:00
Bjørn Forsman ca26e75a73 nixos/avahi-service: small documentation update 2013-12-07 12:03:50 +01:00
Eelco Dolstra 7809134e29 postgresql: Fix shutdown
Postgres was taking a long time to shutdown.  This is because we were
sending SIGINT to all processes, apparently confusing the autovacuum
launcher.  Instead it should only be sent to the main process (which
takes care of shutting down the others).

The downside is that systemd will also send the final SIGKILL only to
the main process, so other processes in the cgroup may be left behind.
There should be an option for this...
2013-12-03 12:04:20 -05:00
Vladimír Čunát d09b722f77 Merge master into x-updates 2013-12-02 21:41:16 +01:00
Eelco Dolstra 09dd7f9afc Fix passing of kernel parameters
Broken in 9ee30cd9b5.  Reported by Arvin
Moezzi.
2013-12-02 11:56:58 -05:00
Eelco Dolstra 2cb492a847 cups: Allow users in the wheel group to do admin actions 2013-12-01 17:30:12 -05:00
Song Wenwu c4885173b6 systemd: add services.journald.extraConfig option 2013-11-30 22:42:01 +01:00
Domen Kožar 4da388351a Merge pull request #1292 from jozko/openldap-fixes
Added openldap user, group and configure service so its not running as root
2013-11-28 13:40:11 -08:00
Jozko Skrablin cb691265b6 Added openldap user, group and configure service so its not running as root. 2013-11-28 22:21:50 +01:00
Bjørn Forsman f52f9bf7cd nixos/libvirtd-service: fix for garbage collected emulator paths
libvirtd puts the full path of the emulator binary in the machine config
file. But this path can unfortunately be garbage collected while still
being used by the virtual machine. Then this happens:

Error starting domain: Cannot check QEMU binary /nix/store/z5c2xzk9x0pj6x511w0w4gy9xl5wljxy-qemu-1.5.2-x86-only/bin/qemu-kvm: No such file or directory

Fix by updating the emulator path on each service startup to something
valid (re-scan $PATH).
2013-11-27 23:09:57 +01:00
Eelco Dolstra 9ee30cd9b5 Add support for lightweight NixOS containers
You can now say:

  systemd.containers.foo.config =
    { services.openssh.enable = true;
      services.openssh.ports = [ 2022 ];
      users.extraUsers.root.openssh.authorizedKeys.keys = [ "ssh-dss ..." ];
    };

which defines a NixOS instance with the given configuration running
inside a lightweight container.

You can also manage the configuration of the container independently
from the host:

  systemd.containers.foo.path = "/nix/var/nix/profiles/containers/foo";

where "path" is a NixOS system profile.  It can be created/updated by
doing:

  $ nix-env --set -p /nix/var/nix/profiles/containers/foo \
      -f '<nixos>' -A system -I nixos-config=foo.nix

The container configuration (foo.nix) should define

  boot.isContainer = true;

to optimise away the building of a kernel and initrd.  This is done
automatically when using the "config" route.

On the host, a lightweight container appears as the service
"container-<name>.service".  The container is like a regular NixOS
(virtual) machine, except that it doesn't have its own kernel.  It has
its own root file system (by default /var/lib/containers/<name>), but
shares the Nix store of the host (as a read-only bind mount).  It also
has access to the network devices of the host.

Currently, if the configuration of the container changes, running
"nixos-rebuild switch" on the host will cause the container to be
rebooted.  In the future we may want to send some message to the
container so that it can activate the new container configuration
without rebooting.

Containers are not perfectly isolated yet.  In particular, the host's
/sys/fs/cgroup is mounted (writable!) in the guest.
2013-11-27 17:14:10 +01:00
Eelco Dolstra 57f145a7f8 When setting $NIX_REMOTE, check whether /nix/var/nix/db is writable
In NixOS containers, root doesn't have write permission to
/nix/var/nix/db, so it has to use the daemon.
2013-11-27 17:09:17 +01:00
Eelco Dolstra c6529ac9eb postgresql: Fix the port option
Also clarify the description of the enableTCPIP option.
2013-11-27 17:09:17 +01:00
Eelco Dolstra e8baaba044 Add a regression test for hostname / nss_myhostname
Issue #1248.
2013-11-26 18:52:34 +01:00
Eelco Dolstra 953f12995b nscd: Fix LD_LIBRARY_PATH
This ensures that nscd can find the NSS modules.

Fixes #1248.
2013-11-26 18:38:22 +01:00
Eelco Dolstra 14cd8bc248 Allow services to specify a pre-stop script 2013-11-26 18:24:55 +01:00
Eelco Dolstra 2b1f212494 Disable various services when running inside a container 2013-11-26 18:19:45 +01:00
Vladimír Čunát b5fba47147 Merge branch master into x-updates
Conflicts (not used, deleted):
	pkgs/desktops/xfce/common.nix
2013-11-23 10:22:26 +01:00
Rob Vermaas a383fe887f Make dd-agent services restart when killed. 2013-11-22 15:23:45 +01:00
William A. Kennington III f48af13c5a Add a nix module for AMD Hybrid Graphics 2013-11-20 11:27:28 -06:00
Eelco Dolstra 4df8a04f14 Don't include the code name in the EBS AMI name 2013-11-19 19:09:48 +01:00
Vladimír Čunát c33c2e68e4 xfce4notifyd: minor update, add to the default installation 2013-11-18 21:08:25 +01:00
Eelco Dolstra bc56bb7546 polkit: Add some examples 2013-11-18 18:04:17 +01:00
Eelco Dolstra 7ea47df0a4 polkit: Fix authenticating as a wheel user
In Javascript-based PolKit, "unix-user:0;unix-group:wheel" is not
valid; it should be a list "unix-user:0", "unix-group:wheel".
2013-11-18 18:04:17 +01:00
Eelco Dolstra 1ce709ee00 polkit: The rule file needs to end in .rules
Otherwise it's ignored.
2013-11-18 18:04:17 +01:00
Eelco Dolstra 886b9e27a6 httpd.nix: Support non-root operation 2013-11-18 18:04:17 +01:00
Eelco Dolstra 2b0aea1793 Allow running NixOS services outside of systemd
The attribute ‘config.systemd.services.<service-name>.runner’
generates a script that runs the service outside of systemd.  This is
useful for testing, and also allows NixOS services to be used outside
of NixOS.  For instance, given a configuration file foo.nix:

  { config, pkgs, ... }:

  { services.postgresql.enable = true;
    services.postgresql.package = pkgs.postgresql92;
    services.postgresql.dataDir = "/tmp/postgres";
  }

you can build and run PostgreSQL as follows:

  $ nix-build -A config.systemd.services.postgresql.runner -I nixos-config=./foo.nix
  $ ./result

This will run the service's ExecStartPre, ExecStart, ExecStartPost and
ExecStopPost commands in an appropriate environment.  It doesn't work
well yet for "forking" services, since it can't track the main
process.  It also doesn't work for services that assume they're always
executed by root.
2013-11-18 18:04:17 +01:00
Eelco Dolstra dc87f8e080 Check whether fileSystems defines the root FS 2013-11-18 18:04:16 +01:00
Eelco Dolstra 8951be2d80 Allow overrides to work for unit options 2013-11-18 18:04:16 +01:00
Eelco Dolstra 33cb0bbb4b Use types.lines for script/preStart/postStart/postStop 2013-11-18 18:04:16 +01:00
Eelco Dolstra 5620e69b5d Apply better type checking to unitConfig/serviceConfig/...
In particular, complain if two modules define the same systemd option.
2013-11-18 18:04:16 +01:00
Eelco Dolstra f8a034172a Fix broken Conflicts options 2013-11-18 18:04:16 +01:00
Eelco Dolstra 08a85c2152 Allow building/testing individual systemd units 2013-11-18 18:04:16 +01:00
Sergey Mironov d8b0c942a1 xfce: enable tumbler the thumbnail manager (close #1206) 2013-11-16 16:58:08 +01:00
Ricardo M. Correia 36a05c7b15 systemd: Add systemd.extraConfig option for /etc/systemd/system.conf 2013-11-16 16:50:59 +01:00
Ricardo M. Correia e0171ef026 systemd: Change services.logind.extraConfig type to types.lines 2013-11-16 16:50:59 +01:00
Shea Levy cc69da4314 Put /efi and /loader on the main livecd partition for efi booting with unetbootin
Fixes #248, mostly

Signed-off-by: Shea Levy <shea@shealevy.com>
2013-11-14 18:18:46 -05:00
Eelco Dolstra e815e4026a mediawiki: Update to 1.20.7 2013-11-13 17:33:58 +01:00
Jaka Hudoklin dd2dc699fa nixos/network-interfaces: add support for static ipv6 addresses 2013-11-13 13:10:07 +01:00
Rickard Nilsson 26d7598d46 networkmanager NixOS service: Make it possible to append or insert name servers in /etc/resolv.conf 2013-11-13 01:52:57 +01:00
Eelco Dolstra 4cada34b7f Properly handle unit names with dashes in them
We ended up with files in /etc/systemd/system called
"bigx2ddata.mount.wants" rather than "big\x2ddata.mount.wants".
2013-11-12 16:58:36 +01:00
Eelco Dolstra 785eaf2cea Add some primops to lib 2013-11-12 13:48:30 +01:00
Domen Kožar cee0f6c708 Merge pull request #1196 from bjornfor/capitalize-service-descriptions
nixos: capitalize a bunch of service descriptions
2013-11-12 01:25:18 -08:00
Eelco Dolstra 6441a9c1d0 Don't set the default channel to 13.10 when installing from master
Partial revert of 619a1f5614.
2013-11-11 11:26:15 +01:00
Alex Berg da654ed9a0 Check empty stringfor globalRedirect. It breaks RedirectPermanent. 2013-11-11 15:18:46 +08:00
Alex Berg df5f491893 Add HTTPD SSH assertion to check null cert/key. 2013-11-11 12:08:36 +08:00
Bjørn Forsman b9f5b880e7 nixos/libvirtd-service: fix for dnsmasq (dir perms 700 -> 755)
Fixes this:

Nov 09 16:18:54 nixos-laptop systemd[1]: Starting Libvirt Virtual Machine Management Daemon...
Nov 09 16:18:54 nixos-laptop dnsmasq[15809]: read /etc/hosts - 2 addresses
Nov 09 16:18:54 nixos-laptop dnsmasq[15809]: failed to load names from /var/lib/libvirt/dnsmasq/default.addnhosts: Permission denied
Nov 09 16:18:54 nixos-laptop dnsmasq[15809]: cannot read /var/lib/libvirt/dnsmasq/default.hostsfile: Permission denied
Nov 09 16:18:55 nixos-laptop systemd[1]: Started Libvirt Virtual Machine Management Daemon.

I don't understand the reason for the original 700 permission bits.
Apparently read-access is needed and Ubuntu also use 755 perms.

Use "chmod" instead of "mkdir -m" to set permissions because mkdir doesn't
modify permissions on existing directories.
2013-11-10 14:07:29 +01:00
Bjørn Forsman dc352536a8 nixos: capitalize a bunch of service descriptions
(systemd service descriptions that is, not service descriptions in "man
configuration.nix".)

Capitalizing each word in the description seems to be the accepted
standard.

Also shorten these descriptions:
 * "Munin node, the agent process" => "Munin Node"
 * "Planet Venus, an awesome ‘river of news’ feed reader" => "Planet Venus Feed Reader"
2013-11-09 20:45:50 +01:00
Vladimír Čunát 619a1f5614 changes proposed for 13-10 update
One feature change: polkit update 8d14c7ba
2013-11-09 18:41:42 +01:00
Jaka Hudoklin 673fc81337 nixos/graphite: fix storage dir for carbon 2013-11-09 17:36:05 +01:00
Vladimír Čunát 8d14c7baa6 polkit: major update 0.105 -> 0.112
- It now uses JavaScript for configuration (only),
  so I had to "convert" config for NetworkManager.
- I tested suspend/restart/(un)mount on KDE/Xfce,
  Phreedom tested NetworkManager config conversion.
2013-11-09 16:29:18 +01:00
Domen Kožar b3ea42462c Merge pull request #1182 from offlinehacker/nixos/mongodb/userfix
nixos/mongodb: set static uid to work with #1076
2013-11-08 12:56:00 -08:00
Domen Kožar a623cc96e3 Merge pull request #1066 from offlinehacker/nixos/logstash/update
nixos/logstash: update and simplify to be fully compatible with new version
2013-11-08 11:44:17 -08:00
Eelco Dolstra 065493284f Update the X11 terminal server module for systemd
Yay, we no longer need inetd!
2013-11-08 16:39:22 +01:00
Eelco Dolstra e62e15b2f9 Only run systemd-inhibit for local X11 sessions 2013-11-08 16:39:22 +01:00
Rob Vermaas 001550d5fe Adapt S3 ami creation script to new nixpkgs structure 2013-11-08 12:49:44 +01:00
Rob Vermaas e9921632ef Updating EC2 EBS HVM creation script.
* Use smaller instances to generate HVM images
* Use HVM base image that has 4 ephemeral disks in device mapping
* As grub is not on the base images anymore, install it first before copying parts of its contents
2013-11-08 12:49:44 +01:00
Rob Vermaas f3eccb26f7 Fix test deployment in EC2 creation script 2013-11-08 12:49:44 +01:00
Eelco Dolstra cc65b1015d vsftpd: Disable seccomp filtering on 64-bit
It worked on Linux 3.4 but fails with "500 OOPS: priv_sock_get_cmd"
since we updated the default kernel to 3.10.

http://hydra.nixos.org/build/6715359

https://bugzilla.redhat.com/show_bug.cgi?id=845980
https://bugzilla.novell.com/show_bug.cgi?id=786024
2013-11-07 16:38:57 +01:00
Eelco Dolstra 000962c3fb vsftpd: Run in the background and log to syslog (i.e. journal) 2013-11-07 16:38:57 +01:00
Eelco Dolstra 10e31f6de7 Clean up the vsftpd module a bit 2013-11-07 16:38:57 +01:00
Eelco Dolstra 8c9c3b628f Drop the new-kernel ISOs 2013-11-07 16:38:57 +01:00
Eelco Dolstra 0d5ec076d2 Use default kernel for EFI-related stuff 2013-11-07 16:38:56 +01:00
Eelco Dolstra 1e89c720e2 Manual: Port forwarding to VMs 2013-11-07 12:28:45 +01:00
Domen Kožar a46c71857d Merge pull request #1172 from zefhemel/patch-1
Removed unnecessary mkIf in elasticserach
2013-11-07 03:11:11 -08:00
Michael Raskin e8b347e6ae Merge pull request #1167 from grwlf/serverflags
Add serverFlagsSection option to the xserver config
2013-11-07 03:00:37 -08:00
Michael Raskin f8ddc0cbd4 Merge pull request #1099 from offlinehacker/nixos/nginx/package_change_support
nixos/nginx: allow to specify which package to use
2013-11-07 02:59:09 -08:00
Michael Raskin 0cfc45c3b9 Merge pull request #1164 from kirelagin/master
Make touchpad button mapping configurable
2013-11-07 02:49:44 -08:00
Jaka Hudoklin 50a2f3fdce nixos/mongodb: set static uid to work with #1076 2013-11-07 11:25:14 +01:00
Sander van der Burg d31b328d0a Updated Disnix service definition to support new development version and mongo databases 2013-11-07 10:54:53 +01:00
Alex Berg 0427e7fbf2 Check for SSL Cert value before building with SSL support. 2013-11-06 11:20:14 +08:00
Zef Hemel 8063382867 Removed unnecessary mkIf
The whole block is already wrapped in cfg.enable and this breaks some things.
2013-11-05 08:52:23 +01:00
Eelco Dolstra d9c13a73c2 gurobi: Remove
It's proprietary, non-redistributable software.
2013-11-05 00:07:24 +01:00
Eelco Dolstra 754704ea18 Allow packages to be marked as "broken" by setting meta.broken
The effect is that they won't show up in "nix-env -qa" anymore.
2013-11-04 21:11:00 +01:00
Domen Kožar a734f32fa1 Remove desktopManager.gnome
Gnome doesn't work at least since I started using NixOS half a year
ago, let's not give wrong impressions to newcomers. Packaging gnome3
is still something on horizon.
2013-11-04 18:12:38 +01:00
Peter Simons 87c3907c14 Merge pull request #1168 from grwlf/nixos-gnu-screen
Add GNU Screen program module
2013-11-04 08:06:59 -08:00
Sergey Mironov 8c1e14e6cc Add GNU Screen program module 2013-11-04 19:07:51 +04:00
Sergey Mironov 99914f8581 Add serverFlagsSection parameter to the xserver config 2013-11-04 18:54:13 +04:00
Moritz Ulrich 882c2b7278
fcron: Fix error when cron.mailto is null.
Signed-off-by: Moritz Ulrich <moritz@tarn-vedra.de>
2013-11-04 11:07:11 +00:00
Kirill Elagin fce38e454b Make touchpad button mapping configurable 2013-11-03 13:00:49 +04:00
Eelco Dolstra eab39f9dda venus.nix: Fix broken startAt option 2013-11-02 20:43:06 +01:00
Jaka Hudoklin 8b1ab6d912 nixos/logstash: add test 2013-11-01 17:18:57 +01:00
Jaka Hudoklin 1453be4740 nixos/logstash: add option examples 2013-11-01 17:15:54 +01:00
Jaka Hudoklin 10e61f53d8 nixos/logstash: update and simplify to be fully compatible with new version 2013-11-01 17:15:53 +01:00
Eelco Dolstra 9ef07d859b Include the NixOS version in the manual
In particular, this will make it clear what version of the manual is
shown at http://nixos.org/nixos/manual/.
2013-11-01 16:47:29 +01:00
Shea Levy cd9786eed2 Fold efi booting into the default livecd
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-11-01 11:29:36 -04:00
Eelco Dolstra 20093751ec Print a reminder to users to set or disable the root password 2013-11-01 15:04:21 +01:00
Eelco Dolstra 4ba7dfde5b Don't set an initial null root password for Amazon / VirtualBox images
A null password allows logging into local PAM services such as "login"
(agetty) and KDM.  That's not actually a security problem for EC2
machines, since they do not have "local" logins; for VirtualBox
machines, if you local access, you can do anything anyway.  But it's
better to be on the safe side and disable password-based logins for
root.
2013-11-01 15:04:21 +01:00
Rob Vermaas 561f56bd2a Next release will be 14.02 Baboon 2013-11-01 09:16:36 +01:00
Eelco Dolstra 9668294eeb Mark the value for nixpkgs.system as a default 2013-11-01 00:35:48 +01:00
Eelco Dolstra 444a4fb793 Loosen the type of SSH key files 2013-11-01 00:34:31 +01:00
Eelco Dolstra 6fda96ba10 Set the channel for this release 2013-10-31 23:01:54 +01:00
Eelco Dolstra 4d15ad22a2 Manual: Expand the Development chapter 2013-10-31 23:01:07 +01:00
Eelco Dolstra 8d09a99a3a Propagate the stableBranch argument 2013-10-31 22:04:26 +01:00
Eelco Dolstra 139ff6d52f Manual: Don't tell users to delete ~/.nix-defexpr/channels
That breaks nix-channel, obviously.
2013-10-31 20:52:40 +01:00
Eelco Dolstra 8e6abe49cd Manual tweaks 2013-10-31 18:49:04 +01:00
Eelco Dolstra 987641d6ed Fix mkForce example 2013-10-31 18:43:15 +01:00
Eelco Dolstra 599c32fdba Document the NixOS configuration syntax
...without telling people to read the Nix manual first.
2013-10-31 18:12:57 +01:00
Eelco Dolstra ca912c79d9 Manual: Document how to use NixOS channels 2013-10-31 14:38:29 +01:00
Eelco Dolstra ee438d6266 Manual: Mention other ways to get NixOS 2013-10-31 13:46:35 +01:00
Eelco Dolstra 4ccd9fdace Remove unused file 2013-10-31 13:28:29 +01:00
Eelco Dolstra c1159edc65 Remove remaining references to Upstart 2013-10-31 13:26:06 +01:00
Eelco Dolstra 456d8ec52b Clean up Synergy option descriptions a bit 2013-10-31 13:18:00 +01:00
Eelco Dolstra 7083607e12 Generate manual for i686-linux as well as x86_64-linux 2013-10-31 08:48:57 +01:00
Eelco Dolstra a840dae935 Improve description of the users.extraUsers.*.description option
Fixes NixOS/nixos#278.
2013-10-31 08:43:10 +01:00
Eelco Dolstra f3cdf9b477 Make update-mime-database less verbose 2013-10-30 18:47:44 +01:00
Eelco Dolstra 244cf195c8 Use the "assertions" option instead of mkAssert 2013-10-30 18:47:44 +01:00
Eelco Dolstra c7171b2c8f Comment out nixos-gui
It hasn't built in over 2 years.
2013-10-30 18:47:43 +01:00
Eelco Dolstra 7d5152964c Drop environment.x11Packages
It doesn't do anything useful compared to environment.systemPackages.
2013-10-30 18:47:43 +01:00
Eelco Dolstra 408b8b5725 Add lots of missing option types 2013-10-30 18:47:43 +01:00
Eelco Dolstra d882e19662 Shut up "failed to resume" warning if there is no resume device 2013-10-30 18:47:43 +01:00
Eelco Dolstra be5d3a59dd Clean up some option examples 2013-10-30 18:47:43 +01:00
Eelco Dolstra 70a2c54527 Strictly check the arguments to mkOption
And fix various instances of bad arguments.
2013-10-30 15:35:09 +01:00
Eelco Dolstra db2a9afb75 Remove obsolete xfceutils attribute 2013-10-30 15:35:09 +01:00
William A. Kennington III c2f35087d2 Add ZFS dependencies to the initrd so that the zpool command works.
Remove unneeded zfs mount, since zpool automatically mounts everything.

Close #1128.
2013-10-30 16:17:44 +02:00
Eelco Dolstra e3e3666e24 smartd.nix: Fix broken option type 2013-10-30 14:57:43 +01:00
Eelco Dolstra 800f9c2037 Show correct position info for errors in submodules
E.g.

  The unique option `fileSystems./.device' is defined multiple times, in `/etc/nixos/configuration.nix' and `/etc/nixos/foo.nix'.

This requires passing file/value tuples to the merge functions.
2013-10-30 14:57:43 +01:00
Eelco Dolstra 4680af6a93 Add some option types 2013-10-30 14:57:42 +01:00
Eelco Dolstra ac68d326b9 Manual: Fix -I flag 2013-10-30 14:57:42 +01:00
Eelco Dolstra 862e3dd977 Substitute "types.uniq types.string" -> "types.str" 2013-10-30 14:57:42 +01:00
Eelco Dolstra 972d9974c6 Decrease verbosity of VirtualBox image generation 2013-10-29 21:15:11 +01:00
Eelco Dolstra 1d104c792b Remove the dhclient module
It's no longer used by NixOS (replaced by dhcpcd).
2013-10-29 17:39:32 +01:00
Eelco Dolstra 0695b68c8c Manual: Render multi-line strings properly 2013-10-29 17:39:31 +01:00
Eelco Dolstra bfaa6b7352 Manual: Escape $ 2013-10-29 17:39:31 +01:00
Eelco Dolstra 60c4c468f1 Manual: Render strings containing special characters as indented strings 2013-10-29 17:39:31 +01:00
Eelco Dolstra b64f43cdbd Manual: Don't show "Default: none" 2013-10-29 17:39:31 +01:00
Eelco Dolstra 89b1dd8dde Fix environment.checkConfigurationOptions
This requires delaying the declaredness check until later, otherwise
we get an infinite recursion querying
environment.checkConfigurationOptions.
2013-10-29 16:18:23 +01:00
Eelco Dolstra c407db6316 Manual: Render null values 2013-10-29 16:18:23 +01:00
Rok Garbas 562b453b93 nixos: haproxy module 2013-10-29 15:55:25 +01:00
Eelco Dolstra 985f1f2d8a Give types to the Apache httpd options 2013-10-29 14:03:39 +01:00
Eelco Dolstra 473a870a64 nixos-rebuild build-vm: Ignore the user's LUKS devices 2013-10-29 13:31:01 +01:00
Eelco Dolstra 976355f63d Drop the EFI installer tests from the release-critical builds for now
They fail randomly due to a hard-coded 30-second timeout in udev
waiting for /dev/sda1 to appear:

  systemd-udevd[1151]: worker [1168] /devices/pci0000:00/0000:00:04.0/host2/target2:0:0/2:0:0:0/block/sda/sda1 timeout; kill it
  systemd-udevd[1151]: seq 1059 '/devices/pci0000:00/0000:00:04.0/host2/target2:0:0/2:0:0:0/block/sda/sda1' killed

Hopefully we can use virtio in the future for the EFI tests.

http://hydra.nixos.org/build/6695897
2013-10-29 13:14:30 +01:00
Eelco Dolstra adc1b38b85 Add a priority level for overrides in VM tests
Now that overriding fileSystems in qemu-vm.nix works again, it's
important that the VM tests that add additional file systems use the
same override priority.  Instead of using the same magic constant
everywhere, they can now use mkVMOverride.

http://hydra.nixos.org/build/6695561
2013-10-29 13:14:30 +01:00
Eelco Dolstra f0b7b0af12 wpa_supplicant.nix: Add option types 2013-10-29 13:14:30 +01:00
Rok Garbas 38df1d24c4 nixos: zope2 service: adding clientHome option 2013-10-29 12:53:08 +01:00
Eelco Dolstra 98ae32286f Fix evaluation error in the tomcat test 2013-10-29 01:26:51 +01:00
Eelco Dolstra 738a6c173a Don't copy Nix expressions to the store while processing Apache subservices 2013-10-29 01:20:33 +01:00
Eelco Dolstra 760d0a00dc Fix mkOverride call 2013-10-29 01:15:17 +01:00
Eelco Dolstra 3115addf4c Fix nixos-option
In particular, it no longer produces an "infinite recursion" error
when run with no arguments.
2013-10-28 22:45:58 +01:00
Eelco Dolstra c9dad37f01 Remove obsolete function addDefaultOptionValues 2013-10-28 22:45:58 +01:00
Eelco Dolstra f8a9eb9f00 Implement services.httpd.virtualHosts using the module system 2013-10-28 22:45:58 +01:00
Eelco Dolstra 30a36f9a80 Remove remaining uses of mkOverrideTemplate 2013-10-28 22:45:58 +01:00
Eelco Dolstra 621f4c42f5 Disable the OpenStack (Nova) module
This hasn't been worked on in over two years, so we shouldn't give the
impression that it works.
2013-10-28 22:45:58 +01:00
Eelco Dolstra 73f32d0375 Show precise error messages in option merge failures
For instance, if time.timeZone is defined multiple times, you now get
the error message:

  error: user-thrown exception: The unique option `time.timeZone' is defined multiple times, in `/etc/nixos/configurations/misc/eelco/x11vnc.nix' and `/etc/nixos/configuration.nix'.

while previously you got:

  error: user-thrown exception: Multiple definitions of string. Only one is allowed for this option.

and only an inspection of the stack trace gave a clue as to what
option caused the problem.
2013-10-28 22:45:57 +01:00
Eelco Dolstra dbefab9cf4 Do not allow multiple definitions of IP addresses etc. within an interface 2013-10-28 22:45:57 +01:00
Eelco Dolstra 92ef9d6b46 nixos-rebuild: Ignore failure from get-version-suffix 2013-10-28 22:45:57 +01:00
Eelco Dolstra 657c8d9ea7 Hack to work around the lack of isPath 2013-10-28 22:45:57 +01:00
Eelco Dolstra e28ea1239f Fix evaluation of environment.variables 2013-10-28 22:45:57 +01:00
Eelco Dolstra 9a8516438e Fix NixOps evaluation 2013-10-28 22:45:57 +01:00
Eelco Dolstra 259f7a93b1 Rename environment.nix -> nix.package 2013-10-28 22:45:57 +01:00
Eelco Dolstra d5047faede Remove uses of the "merge" option attribute
It's redundant because you can (and should) specify an option type, or
an apply function.
2013-10-28 22:45:56 +01:00
Eelco Dolstra f4a418761b Check for undeclared options 2013-10-28 22:45:56 +01:00
Eelco Dolstra a40583e7e4 Fix bogus mkOption types
Among others, systemd unit options were not being type-checked because
of this.  mkOption should really check its arguments better...
2013-10-28 22:45:56 +01:00
Eelco Dolstra 1408ac51a4 Add missing types 2013-10-28 22:45:56 +01:00
Eelco Dolstra 89bd18b3af Fix manual generation 2013-10-28 22:45:56 +01:00
Eelco Dolstra 7cf0e0bda8 Manual: Fix bad \" characters 2013-10-28 22:45:56 +01:00
Eelco Dolstra 4b1a9dd00b Remove uses of mkFixStrictness
mkFixStrictness is no longer needed, woohoo!
2013-10-28 22:45:55 +01:00
Eelco Dolstra 0e333688ce Big cleanup of the NixOS module system
The major changes are:

* The evaluation is now driven by the declared options.  In
  particular, this fixes the long-standing problem with lack of
  laziness of disabled option definitions.  Thus, a configuration like

    config = mkIf false {
      environment.systemPackages = throw "bla";
    };

  will now evaluate without throwing an error.  This also improves
  performance since we're not evaluating unused option definitions.

* The implementation of properties is greatly simplified.

* There is a new type constructor "submodule" that replaces
  "optionSet".  Unlike "optionSet", "submodule" gets its option
  declarations as an argument, making it more like "listOf" and other
  type constructors.  A typical use is:

    foo = mkOption {
      type = type.attrsOf (type.submodule (
        { config, ... }:
        { bar = mkOption { ... };
          xyzzy = mkOption { ... };
        }));
    };

  Existing uses of "optionSet" are automatically mapped to
  "submodule".

* Modules are now checked for unsupported attributes: you get an error
  if a module contains an attribute other than "config", "options" or
  "imports".

* The new implementation is faster and uses much less memory.
2013-10-28 22:45:55 +01:00
Eelco Dolstra f4dadc5df8 rename.nix: Don't use the extraConfigs feature 2013-10-28 22:45:55 +01:00
Eelco Dolstra 2cc37c17d9 openvpn.nix: Improve types 2013-10-28 22:45:55 +01:00
Eelco Dolstra 5b8c4d2a7d Get rid of the only use of mkNotdef 2013-10-28 22:45:54 +01:00
Eelco Dolstra 335422f7be Get rid of the only use of mkDefaultValue 2013-10-28 22:45:54 +01:00
Eelco Dolstra 41c8f9598e Remove dead code 2013-10-28 22:45:54 +01:00
Jaka Hudoklin d28a9619a1 nixos/redis: log to syslog by default 2013-10-28 18:18:24 +01:00
Jaka Hudoklin b20c08d2cb nixos/redis: user set uid, make it compatible #1076 2013-10-28 18:18:13 +01:00
Jaka Hudoklin c1ad189295 nixos/graphite: limit amount of log message defaults 2013-10-28 17:09:53 +01:00
Jaka Hudoklin 0229f45cf3 nixos/graphite: graphite requires pidfile set for startup 2013-10-28 17:08:33 +01:00
Michael Raskin 3022fff7db Adding Quantum Minigolf game 2013-10-28 00:09:46 +04:00
Evgeny Egorochkin 5580abd60a nixos manual: fix references to obsolete nixos repository 2013-10-27 08:53:47 +02:00
Evgeny Egorochkin 9cb699f587 nixos manual: replace /etc/nixos/nixos which no longer exists with more generic and more
correct /path/to/nixpkgs/nixos
2013-10-27 08:39:32 +02:00
Eelco Dolstra f79a7359b0 firebird.nix: Fix a misplaced } that causes "users" to be outside "config" 2013-10-25 15:52:52 +02:00
Eelco Dolstra 72ca782044 Fix an assertion set in the wrong place 2013-10-25 15:47:30 +02:00
Eelco Dolstra 22db003f91 Add the NixOS manpages to the channel 2013-10-25 00:06:24 +02:00
Eelco Dolstra b5cfb8c120 Put the manual in the NixOS channel 2013-10-24 20:06:02 +02:00
Eelco Dolstra 20150b1cee Ensure that the manual job gets build with the right revision info 2013-10-24 19:58:34 +02:00
Eelco Dolstra d5af9bc583 Simplify manual generation 2013-10-24 19:56:16 +02:00
Eelco Dolstra 373c14614b Put the NixOS channel in an option 2013-10-24 15:09:00 +02:00
Jaka Hudoklin ad3a0dd8fb nixos/libvirtd: fix remote ssh managment by adding netcat-openbsd in system packages
Virsh/virt-manager uses ssh to connect to master, there it expects openbsd netcat(which
has support for unix sockets) to be avalible, to make a tunnel.

Close #1087.
2013-10-24 11:01:43 +03:00
Eelco Dolstra 49e73ea117 nixos-generate-config: Don't suggest setting fileSystems in configuration.nix
It's already set in hardware-configuration.nix so this just confuses
people.

Also get rid of boot.initrd.kernelModules, since
hardware-configuration.nix is supposed to figure that out as well.
2013-10-24 05:28:37 +02:00
Eelco Dolstra d49f141a79 Manual: When building from the channel, link to the exact Git revision 2013-10-24 02:03:10 +02:00
Eelco Dolstra c4149c7b56 Fix evaluation error in the ISOs 2013-10-24 02:03:10 +02:00
Eelco Dolstra a3777ba4f9 Remove dependencies on the Nixpkgs location 2013-10-23 20:08:23 +02:00
Eelco Dolstra 8166b12f0c Manual: Check that we don't depend on the Nixpkgs location 2013-10-23 20:08:23 +02:00
Eelco Dolstra fad83a9560 Allow literalExample in subexpressions of examples 2013-10-23 20:08:22 +02:00
Eelco Dolstra 0def73f390 Manual: Don't depend on the absolute path of modules
This ensures that the manual has the same store path regardless of the
directory in which Nixpkgs is stored, and thus can be fetched from the
channel.
2013-10-23 20:08:22 +02:00
Eelco Dolstra caf18545a4 Do show aliases in the manual. 2013-10-23 20:08:22 +02:00
Eelco Dolstra b218c02a3c rename.nix: Don't use splitString
It's very slow.
2013-10-23 20:08:22 +02:00
Eelco Dolstra 8f4c5b05d5 Add a way to define obsolete options that have no replacement 2013-10-23 20:08:22 +02:00
Eelco Dolstra b5d5afd99a Allow modules to define warnings to be shown during evaluation 2013-10-23 20:08:22 +02:00
Eelco Dolstra 0ec10c57df Fix style 2013-10-23 20:08:21 +02:00
Eelco Dolstra ec0911ce7f Manual: Don't show obsolete/deprecated options 2013-10-23 20:08:21 +02:00
Eelco Dolstra 29014a47fb Allow options to be marked as "internal"
This means they're not for end users.  Currently they're filtered from
the manual, but we could include them in a separate section.
2013-10-23 20:08:21 +02:00
Eelco Dolstra e29b51bfb1 Improve option description 2013-10-23 20:08:21 +02:00
Eelco Dolstra 441dcd68d8 Get rid of special-casing of system.path in the manual generation 2013-10-23 20:08:21 +02:00
aszlig 19b00be0a0
nixos-rebuild: Drop references to <nixos>.
Commit 31203732b3 dropped the reference to
<nixos> from NIX_PATH (nixos/modules/programs/environment.nix) and thus
prevents systems that are not using channels from rebuilding.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2013-10-23 17:16:17 +02:00
aszlig f182fdf6ed
nixos-generate-config: Add --show-hardware-config.
So, we get the old behaviour of nixos-hardware-scane if we run the
following command:

nixos-generate-config --no-filesystems --show-hardware-config

This allows to use scripts in order to fetch NixOS specific hardware
information, without the need to duplicate code elsewhere.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2013-10-23 17:16:17 +02:00
aszlig e2c546ce4a
nixos-generate-config: Remove unnecessary spaces.
The attributes swapDevices and imports add a space character after the
eqals sign, which is unnecessary. I know, I'm a pedantic douche bag but
it hurts my eyes.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2013-10-23 17:16:16 +02:00
aszlig a546069ad3
nixos-generate-config: Add --no-filesystems flag.
This is to get back the old behavior of nixos-hardware-scan, which
didn't include fileSystems and swapDevices.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2013-10-23 17:16:16 +02:00
Domen Kožar 03e1178f80 munin: fix documentation links 2013-10-23 13:54:46 +02:00
Domen Kožar 897329fc47 Merge pull request #1106 from ocharles/redshift
services.redshift: New service
2013-10-22 01:33:08 -07:00
Oliver Charles d792544802 services.redshift: New service 2013-10-22 09:03:06 +01:00
Marc Weber 6cb91c33d0 Firebird service:
* simplify directory layout
 * clean up option descriptions
 * let the user override Firebird package
 * create firebird user
 * clarify TODO comment

Close  # 1061.
2013-10-21 20:33:11 +03:00
Evgeny Egorochkin d2f612b1b6 postgresql.authMethod: remove unimplemented option.
close #1104.
2013-10-21 19:26:26 +03:00
Evgeny Egorochkin 4732f59226 xserver.s3tcSupport: fix typo, improve description. 2013-10-21 19:11:17 +03:00
Eelco Dolstra 65277727e8 nix-gc: Revert to "script" instead of ExecStart
There is an assumption that cfg.options can contain shell code, so
ExecStart doesn't work here.
2013-10-21 11:22:27 +02:00
Eelco Dolstra 375c395d12 Manual: Update installation section 2013-10-21 10:50:08 +02:00
Jaka Hudoklin c7429711b8 nixos/nginx: allow to specify which package to use
This enables to override which plugins to include with nginx by allowing to change
nginx package. I also removed webdav option in nginx nixos module, because you
can now specify this by overriding nginx package.
2013-10-20 22:52:02 +02:00
Domen Kožar aeff0028bf munin: add test and fix a bug 2013-10-20 21:16:24 +02:00
Michael Raskin f88aa22706 Allow non-SSL connections to vsftpd by default to let tests not specify certificate 2013-10-20 21:16:12 +04:00
Michael Raskin a0bbc3e838 Add apparently missing option to vsftpd configuration 2013-10-20 20:39:37 +04:00
Michael Raskin 9b6f7c14ec Merge pull request #1060 from MarcWeber/submit/vsftpd
small vsftpd improvements
2013-10-20 08:58:21 -07:00
Domen Kožar c1b9775821 Merge pull request #1090 from NixOS/munin-rework
munin: refactor package and add nixos service
2013-10-20 08:10:28 -07:00
Domen Kožar 9230ae6522 munin: refactor package and add nixos service 2013-10-20 15:08:07 +02:00
Rok Garbas af0e2ccf45 zope2 service... indentation fix 2013-10-20 01:35:09 +02:00
aszlig 1fc7d6ddb2
nixos/tests: Temporarily deactivate nixpart tests.
Those tests are flapping and redundant to some degree, as two
configurations are tested in NixOps as well. So, let's deactivate them
until the 1.0 release of nixpart, which has a more general approach for
automatically partitioning NixOS installations.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2013-10-19 23:34:20 +02:00
Evgeny Egorochkin 89854548e7 Add services.xserver.s3tcSupport option 2013-10-19 00:40:45 +03:00
Eelco Dolstra 2087f8dec3 Remove unused manual file 2013-10-18 13:45:18 +02:00
Eelco Dolstra 8c047d4f2c Test whether PAM resource limits work 2013-10-17 15:37:08 +02:00
Eelco Dolstra ff74d78c9d Allow PAM resource limits to be integers 2013-10-17 15:36:59 +02:00
Eelco Dolstra af8fc748dd Fix PAM resource limits 2013-10-17 15:26:48 +02:00
Eelco Dolstra b19d8e0fcd Remove obsolete pre-systemd compat stuff 2013-10-17 14:57:20 +02:00
Eelco Dolstra 5f14933c33 Don't enable acpid for VirtualBox guests
It's no longer needed for ACPI shutdown, since logind handles this
now.
2013-10-17 14:41:58 +02:00
Eelco Dolstra ad0568e64a mkEnableOption: Add a period at the end of the description 2013-10-17 14:29:51 +02:00
Eelco Dolstra 04690da3bd Rename newOptionAttrSetToDocList -> optionAttrSetToDocList 2013-10-17 14:09:05 +02:00
Eelco Dolstra 82ad8c5ce0 Make manual generation not depend on the user's configuration
Previously changing the value of certain options in configuration.nix
would cause the manual to be regenerated, because some option defaults
depend on the configuration.  This is undesirable because rebuilding
the manual is kind of slow.  So now the manual reflects an empty
configuration.

The downside is that this requires another call to fixMergeModules,
which adds about 14% to evaluation time.  Probably worth it.
2013-10-17 13:43:40 +02:00
Eelco Dolstra b33657df03 grub: Make assertion lazier 2013-10-17 13:30:49 +02:00
Eelco Dolstra 4836a75fe0 Make more tests release-critical 2013-10-17 12:20:07 +02:00
Eelco Dolstra 84d4358635 Fix compatibility with Nix < 1.6
Nix 1.6 (accidentally) changed the semantics of strings like
"${path}/bla", so this happened to work on 1.6 but not before.
2013-10-16 23:07:47 +02:00
Shea Levy 418fa3bb33 D'oh
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-16 16:01:27 -04:00
Shea Levy 6171f13ed5 Add gurobi to the system packages if the configuration specifies a license
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-16 11:26:39 -04:00
Shea Levy 715bee3a0a Add gurobi client module
Not yet tested, no license yet

Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-16 11:23:58 -04:00
Shea Levy a5a13c4e43 Add gurobi token server service
Not yet tested, I don't have a license yet

Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-16 11:02:05 -04:00
Eelco Dolstra b3debdc046 Fix test evaluation 2013-10-16 12:47:11 +02:00
Eelco Dolstra 756ca94e0c Really fix the EFI installer test
http://hydra.nixos.org/build/6497361
2013-10-16 12:16:34 +02:00
Eelco Dolstra ee72a0c386 Disable the trac test
It's been failing since forever.
2013-10-16 11:49:10 +02:00
Eelco Dolstra 6dafee8d67 Fix runInMachine
It requires a writable /nix/store to store the build result.  Also,
wait until we've reached multi-user.target before doing the build, and
do a sync at the end to ensure all data to $out is properly written.

http://hydra.nixos.org/build/6496716
2013-10-16 11:37:38 +02:00
Eelco Dolstra e0db0aaa4d Rename /etc/nix.machines to /etc/nix/machines
Since we have a /etc/nix directory, we should use it and not pollute
/etc.
2013-10-16 10:57:25 +02:00
Eelco Dolstra 16cd8b039b Remove nix.manualNixMachines
Suggested by Marc Weber.  Fixes #1059.

Generate /etc/nix.machines only if buildMachines is not empty.  Thus,
if you want to manage /etc/nix.machines in some other way, you can set
nix.distributedBuilds to true but not set nix.buildMachines.
2013-10-16 10:53:23 +02:00
Eelco Dolstra 7c7bfa817a fail2ban: Update to 0.8.10
Also fix random start failures due to a race between the fail2ban
server and the postStart script.
2013-10-16 10:03:43 +02:00
Domen Kožar c9acee7ee0 Merge pull request #1073 from offlinehacker/nixos/graphite/fix_carbon
nixos/graphite: carbon, use syslog for logging
2013-10-15 14:59:51 -07:00
Eelco Dolstra 8485487727 Get rid of <nixpkgs> 2013-10-15 17:52:02 +02:00
Eelco Dolstra ceb8ab7ffa Really fix use of NixOps with the merged Nixpkgs/NixOS tree
Note that there is a subtle difference in Nix that causes
nixos-rebuild to work and NixOps to fail:

  $ nix-instantiate '<nixos>' -A config.system.nixosVersion --eval-only
  "13.10pre34915.50f4822"

  $ nix-instantiate '<nixos/default.nix>' -A config.system.nixosVersion --eval-only
  error: opening file `/nix/var/nix/profiles/per-user/root/channels/nixos/.version': No such file or directory

Fixes NixOS/nixops#145.
2013-10-15 17:50:09 +02:00
Eelco Dolstra bbe265e8c2 slim: Only enable if the X server is enabled
http://hydra.nixos.org/build/6494972

Disabling slim revealed that services.xserver.displayManager.job had
an incorrect type, so fixed that as well.
2013-10-15 17:24:33 +02:00
Eelco Dolstra ae74b0ae58 sshd: Remove the usePAM option
Sshd *must* use PAM because we depend on it for proper session
management.  The original goal of this option (disabling password
logins) can also be implemented by removing pam_auth authentication
from sshd's PAM service.
2013-10-15 15:05:49 +02:00
Eelco Dolstra a2c820c678 Turn security.pam.services into an attribute set
That is, you can say

  security.pam.services.sshd = { options... };

instead of

  security.pam.services = [ { name = "sshd"; options... } ];

making it easier to override PAM settings from other modules.
2013-10-15 14:47:51 +02:00
Eelco Dolstra 3f2c0bf9bd slim: Fix session handling 2013-10-15 13:41:03 +02:00
Eelco Dolstra 5b702be29f Add support for slimlock, slim's simple screen locker 2013-10-15 13:23:40 +02:00
Eelco Dolstra 873662b8ad slim: Work around broken PAM session handling
Previously logging in via SLiM more than once didn't work because SLiM
doesn't clean up its PAM session properly (that is, in a child rather
than in the parent).  Thus the slim process becomes part of the user
session's cgroup, among other things.  This patch causes SLiM to exit
after the session has finished, after which systemd will restart
display-manager.service.

Fixes NixOS/nixops#137.
2013-10-15 13:23:40 +02:00
Shea Levy 50f4822888 Fix efi installer test
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-14 16:02:29 -04:00
Domen Kožar 30933abb97 add prey: Proven tracking software that helps you find, lock and recover your devices when stolen or missing 2013-10-14 11:57:48 +02:00
Jaka Hudoklin 63539b2844 nixos/graphite: carbon, use syslog for logging
Twisted provides option to log with syslog, this enables nicer logging.
Imagine what happens in a case of exception. If logs are written to stdout,
traceback won't be merged thus giving ugly logs. This commit fixes that.
This is also one of the official ways of starting carbon, so no worries.
2013-10-13 23:18:22 +02:00
Eelco Dolstra 903c5d4df9 Test nixos-option 2013-10-13 22:36:04 +02:00
Eelco Dolstra de7083a495 Fix the misc test
http://hydra.nixos.org/build/6480163
2013-10-13 22:17:12 +02:00
Eelco Dolstra 647b0f5f5c Update the installer tests for nixos-generate-config 2013-10-13 17:35:57 +02:00
Eelco Dolstra 3e001244e4 Load the xfs kernel module on demand 2013-10-13 17:35:57 +02:00
Eelco Dolstra 9b8847eb91 Document nixos-install 2013-10-13 17:35:57 +02:00
Eelco Dolstra 00f380dee5 Document nixos-generate-config 2013-10-13 17:35:57 +02:00
Eelco Dolstra ca3725bfc9 nixos-generate-config: Add --root option
If this option is given, nixos-generate-config will write the
configuration to /etc/nixos under the given root, and only emit
fileSystems attributes for filesystems under the given root directory.

The typically use case is at installation time, where you can say:

  $ nixos-generate-config --root /mnt

which will create /mnt/etc/nixos/{configuration.nix,hardware-configuration.nix}.

Also add a --force flag to force overwriting configuration.nix.
2013-10-13 17:35:56 +02:00
Eelco Dolstra 3875dcdfeb nixos-generate-config: Emit boot.initrd.availableKernelModules instead of kerneLmodules 2013-10-13 17:35:56 +02:00
Eelco Dolstra 57804f44ec nixos-generate-config: Skip FUSE filesystems
I don't know how to recover that a FUSE filesystem is (say) ntfs-3g.
2013-10-13 17:35:56 +02:00
Eelco Dolstra 984921e657 nixos-generate-config: Emit fileSystems automatically 2013-10-13 17:35:56 +02:00
Eelco Dolstra 677d9882b0 nixos-generate-config: Generate swapDevices 2013-10-13 17:35:56 +02:00
Eelco Dolstra 440fe8f05d Use read_file from File::Slurp 2013-10-13 17:35:56 +02:00
Eelco Dolstra ac13bd2575 Merge "nixos-option --install" into nixos-generate-config
Having configuration.nix generation hidden underneath nixos-option
never made sense, also given that there was another command to
generate part of the configuration (nixos-hardware-scan).  Now
nixos-generate-config produces both configuration.nix and
hardware-configuration.nix.  The latter is overwritten while the
former is not.
2013-10-13 17:35:55 +02:00
Eelco Dolstra 0f550596c9 Typo 2013-10-13 17:35:55 +02:00
Eelco Dolstra fd0fd49d36 nixos-generate-config: Write to /etc/nixos/hardware.nix rather than stdout 2013-10-13 17:35:55 +02:00
Eelco Dolstra 3ed41735b8 Rename nixos-hardware-scan to nixos-generate-config 2013-10-13 17:35:55 +02:00
Eelco Dolstra 4b28f28028 Remove unused file 2013-10-13 17:35:55 +02:00
Eelco Dolstra f42d494355 Refactor variable names 2013-10-13 17:35:55 +02:00
Eelco Dolstra 57ec8424e4 Drop <services> from $NIX_PATH 2013-10-13 17:35:55 +02:00
Eelco Dolstra ef72fcc2aa Map --help flag to "man <command>" for more NixOS commands 2013-10-13 17:35:55 +02:00
Eelco Dolstra a042d91290 nixos-rebuild: Document --profile-name 2013-10-13 17:35:54 +02:00
Eelco Dolstra f1a03addae nixos-rebuild: Let --help invoke "man nixos-rebuild" 2013-10-13 17:35:54 +02:00
Eelco Dolstra 2be774ccfa Set .version-suffix properly when building from Git 2013-10-13 17:35:54 +02:00
Domen Kožar e28ddcfbec Merge pull request #1063 from offlinehacker/nixos/graphite/listen_defaults_fix
nixos: graphite, listen on localhost by default
2013-10-12 12:23:34 -07:00
Domen Kožar a8dd839c1f Merge pull request #1067 from offlinehacker/nixos/statsd/mgmt_ip_port
nixos/statsd: Add support to specify managment ip/port
2013-10-12 12:23:11 -07:00
Domen Kožar 15608f6df6 Merge pull request #1068 from offlinehacker/nixos/elasticsearch/logfix
nixos/elasticsearch: change loglevel from DEBUG to INFO
2013-10-12 12:22:53 -07:00
Jaka Hudoklin fd0d2872a4 nixos/elasticsearch: change loglevel from DEBUG to INFO 2013-10-12 12:43:33 +02:00
Jaka Hudoklin 285f447c49 nixos/statsd: Add support to specify managment ip/port 2013-10-12 12:37:52 +02:00
Jaka Hudoklin 677ecf4868 nixos/graphite: listen on localhost by default 2013-10-12 12:34:26 +02:00
Marc Weber 4683774277 experimental/vsftpd
vsftpd improvements:
- intorduce one declarative list of options
- make docummentation strings more understandable and add missing options
  such as SSL/TLS support
- Use environment.etc."vsftpd".text because I can't think about any
  reason why a shell script should be used.
  That code was written in 2009.
2013-10-12 01:05:13 +02:00
Eelco Dolstra a2600b7bc3 Terrible backward compatibility hack 2013-10-11 13:36:09 +02:00
Domen Kožar cf3e36a3b9 bash: place interactiveShellInit at the end to be able to override existing settings 2013-10-11 11:55:58 +02:00
Shea Levy a63b4dc555 Remove old efi boot stub bootloader
Signed-off-by: Shea Levy <shea@shealevy.com>
2013-10-10 10:54:35 -04:00
Eelco Dolstra a5357e80cd Tweak the version string
It's now "<yy>.<mm>pre<commit-count>.<short-hash>"
(e.g. "13.10pre5678.gfedcba") for the unstable branch, and
"<yy>.<mm>.<commit-count>.<short-hash>" (e.g. "13.10.5678.gfedcba")
for stable branches.
2013-10-10 13:28:22 +02:00
Eelco Dolstra a7824368c2 Fix setting of .version-suffix 2013-10-10 13:28:22 +02:00
Eelco Dolstra 95c98166ec Merge .gitignore files 2013-10-10 13:28:22 +02:00
Eelco Dolstra c8628e0989 nixos-checkout: Only fetch the Nixpkgs repo 2013-10-10 13:28:22 +02:00
Eelco Dolstra 31203732b3 Update the release expressions and the channel generators 2013-10-10 13:28:22 +02:00
Eelco Dolstra 041da5a6f9 Unify the Nixpkgs and NixOS version numbers 2013-10-10 13:28:22 +02:00
Eelco Dolstra 5c1f8cbc70 Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00