Commit graph

15798 commits

Author SHA1 Message Date
Graham Christensen ebb644a980
Merge pull request #76585 from serokell/mkaito/amazon-userdata-multiple-channels
virtualization/amazon-init: log multiple nix channels, fix nix path.
2020-01-22 19:02:44 -05:00
Maximilian Bosch 2d9e51adc3
Merge pull request #77532 from symphorien/roundcube
nixos/roundcube: security improvements
2020-01-22 21:58:25 +01:00
Matt Layher 50c661c447 nixos/corerad: update test for new configuration 2020-01-22 01:19:35 -08:00
Florian Klink dea2d64c35
Merge pull request #78134 from NinjaTrappeur/nin-harden-syncthing
nixos/syncthing.nix: Sandbox the systemd service.
2020-01-21 22:30:04 +01:00
Florian Klink a3d67f417e
Merge pull request #77665 from zaninime/ifxfrm
systemd-networkd: add configuration for XFRM interfaces
2020-01-21 22:14:53 +01:00
Florian Klink 0daae2e08c nixos/buildkite: drop user option (#78160)
* nixos/buildkite: drop user option

This reverts 8c6b1c3eaa.

Turns out, buildkite-agent has logic to write .ssh/known_hosts files and
only really works when $HOME and the user homedir are in sync.

On top of that, we provision ssh keys in /var/lib/buildkite-agent, which
doesn't work if that other users' homedir points elsewhere (we can cheat
by setting $HOME, but then getent and $HOME provide conflicting
results).

So after all, it's better to only run the system-wide buildkite agent as
the "buildkite-agent" user only - if one wants to run buildkite as
different users, systemd user services might be a better fit.

* nixosTests.buildkite-agent: add node with separate user and no ssh key
2020-01-21 13:21:57 +00:00
zimbatm ab10bac1b1
nixos-rebuild: fix the maybeSudo usage
* properly expand the command using arrays instead of strings
* also handle sudo on the localhost
2020-01-21 13:17:38 +01:00
zimbatm 93204f1d8a
nixos/matterbridge: fix package access
was broken by 4371ecb8a6 due to the
switch to buildGoModule
2020-01-21 13:17:18 +01:00
zimbatm b54c60b689
nixos/zerotierone: simplify the unit
There is no need to stop/start the unit when the machine is online or
offline.

This should fix the shutdown locking issues.

nixos zerotier: sometimes it doesn't shutdown
2020-01-21 13:14:38 +01:00
Jörg Thalheim 71c19d3efa
Merge pull request #76537 from Izorkin/unit
unit: 1.13.0 -> 1.14.0
2020-01-21 11:39:41 +00:00
worldofpeace 348e48fdcc
Merge pull request #78004 from worldofpeace/mtrack-remove
nixos/multitouch: remove (properly known as mtrack)
2020-01-20 17:07:59 -05:00
Silvan Mosberger 3929a0fbca
nixos/traceroute: init (#77953)
nixos/traceroute: init
2020-01-20 22:32:33 +01:00
worldofpeace afe27e517b nixos/multitouch: remove
On numerous occasions I have seen users mistake this
module as libinput because it being called "multitouch"
and them being unaware that the actually module they want
is libinput. They then run into several decrepit bugs due
to the completely out-of-date nature of the underlying package.
The underlying package hasn't been changed to an up-to-date
fork in a period of 8 years. I don't consider this to be production quality.
However, I'm not opposed for the module being readded to NixOS
with new packaging, and a better name.
2020-01-20 16:09:29 -05:00
Félix Baylac-Jacqué ff8f2928ee
nixos/syncthing.nix: Sandbox the systemd service.
Using systemd sandboxing features to harden the syncthing service.
2020-01-20 21:48:48 +01:00
zimbatm e20de6b57a
Merge pull request #78045 from flokli/buildkite-agent-user-runtime-test
nixos/buildkite: add option to configure user, add nix-required packages to runtime, add test
2020-01-20 13:50:10 +00:00
Florian Klink 4b73d3c444 nixos/buildkite: make privateSshKeyPath optional
When only cloning public repos, or when the ssh key is provided by
different means, we don't need to manage it here.
2020-01-20 11:10:56 +01:00
Florian Klink a208e6eb99 nixosTests.buildkite: add test 2020-01-20 10:30:24 +01:00
Florian Klink 70308a7daf nixos/buildkite-agent: add gnutar, gzip and git to runtimePackages
These are required for nix to do builtins.fetchTarball and
builtins.fetchGit, so most likely we want them to be around.
2020-01-20 10:30:24 +01:00
Florian Klink 7838f00824 nixos/buildkite: stop using deprecated option 2020-01-20 10:30:22 +01:00
Alexey Lebedeff ed16f830b0 rabbitmq: make all dependencies explicit
Some things were provided by default, some by systemd unit and some
were just miraculously working. This turns them into explicit
dependencies of the package itself, making everything properly
overrideable.

+ providing glibcLocales fixes elixir compile warnings

+ providing systemd dependency allows rabbit to use systemctl for unit
  activation check instead of falling back to sleep. This was seen as
  a warning during startup.
2020-01-19 23:24:27 +01:00
Florian Klink 764aba4c1b
Merge pull request #77587 from singron/fix-shared
test-driver.py: Share the shared dir between VMs
2020-01-19 22:07:31 +01:00
Florian Klink 8c6b1c3eaa nixos/buildkite-agent: add "user" option
This allows buildkite-agent to run as another user.

It'll still run builds from /var/lib/buildkite-agent and setup things in
there.
2020-01-19 21:21:15 +01:00
Florian Klink 5ed3474ca5
Merge pull request #77540 from singron/fix-certmgr-test
nixos/tests/certmgr: Fix file permissions
2020-01-19 19:50:41 +01:00
Eric Culp 6795a4002c test-driver.py: Use /tmp/shared for copy_from_vm
The docstring says it uses a directory shared among all vms, although
that doesn't seem necessary for the functionality. However, it does need
to be consistent between the guest and host.
2020-01-19 10:33:46 -08:00
Florian Klink eba10dcbcb
Merge pull request #77950 from flokli/buildkite-3
nixos/buildkite-agent: move to v3
2020-01-19 14:23:49 +01:00
Florian Klink b32b29963f
Merge pull request #78018 from rnhmjoj/typo
nixos/unclutter: fix old typo
2020-01-19 14:19:32 +01:00
rnhmjoj bac3e6841b
nixos/unclutter: fix old typo 2020-01-19 10:09:12 +01:00
Antonio Nuno Monteiro e2c11ad3c0 nixos/kubernetes: allow configuring cfssl API server SANs 2020-01-18 23:39:21 -08:00
Jan Tojnar 0a65c2b7e9
Merge pull request #77960 from jtojnar/declarative-check-modules
nixos/doc: suggest checking options for declarative package mgmt
2020-01-19 02:57:36 +01:00
worldofpeace 765afd38fa
Merge pull request #76985 from Elyhaka/gdm_hides_gnome
gdm: refactor to properly handle wayland sessions
2020-01-18 20:39:07 -05:00
worldofpeace c6022f7abf nixos/gnome3: add gnome-shell to systemd.packages
This actually gets added via xdg.portal having gnome-shell.
However, that could change and it still for sure should be here.
2020-01-18 20:26:45 -05:00
worldofpeace ffcfb80781
Merge pull request #77690 from gnidorah/way-cooler
way-cooler: Remove
2020-01-18 14:50:41 -05:00
Matthias Beyer 29bb16a9cd way-cooler: Remove
As of 2020-01-09, way-cooler is officially dead:

    http://way-cooler.org/blog/2020/01/09/way-cooler-post-mortem.html

hence, remove the package and the module.

Signed-off-by: Matthias Beyer <mail@beyermatthias.de>

docs/release-notes: remove way-cooler

way-cooler: show warnings about removal

Apply suggestions from code review

Co-Authored-By: worldofpeace <worldofpeace@protonmail.ch>

way-cooler: add suggestion by @Infinisil
2020-01-18 18:25:01 +03:00
Symphorien Gibol b5d692e123 nixos/roundcube: provide path to mime.types file
fixes this warning:
WARNING: Mimetype to file extension mapping doesn't work properly!
2020-01-18 16:12:50 +01:00
Symphorien Gibol b6e6bec57c nixos/roundcube: don't use the default and insecure des_key
The php installer creates a random one, but we bypass it, so we have
to create one ourselves.

This should be backward compatible as encryption is used for session
cookies only: users at the time of the upgrade will be logged out but
nothing more.

259b7fa065/config/config.inc.php.sample (L73)
2020-01-18 16:12:50 +01:00
Symphorien Gibol 52cf727a53 nixos/roundcube: do not write passwords to the store nor run php as root
If the database is local, use postgres peer authentication.
Otherwise, use a password file.

Leave database initialisation to postgresql.ensure*.
Leave /var/lib/roundcube creation to systemd.
Run php upgrade script as unpriviledged user.
2020-01-18 15:27:45 +01:00
Elyhaka d18ac2bca1 gdm: refactor to properly handle wayland sessions 2020-01-18 10:56:11 +01:00
Jan Tojnar 6b3c3c817a
nixos/doc: suggest checking options for declarative package mgmt
Some programs might not work without systemd services registered or do not work at full capacity without NixOS module.
2020-01-18 02:17:36 +01:00
Florian Klink b9182529b4 nixos/buildkite: add release notes 2020-01-17 23:11:26 +01:00
Florian Klink 63c310c07e nixos/buildkite-agent: change option meta-data into tags attrset
This is called tags in the buildkite 3.
2020-01-17 23:11:26 +01:00
volth d5d1293fe3 nixos/traceroute: init 2020-01-17 21:28:54 +00:00
worldofpeace b3c8534911
Merge pull request #77294 from worldofpeace/systemd-packages-duplicates
nixos/systemd-lib: don't fail on systemd.packages duplicates
2020-01-17 13:16:59 -05:00
Yorick van Pelt e1ad9d1685 nixos/buildkite-agent: add a shell attribute to specify the shell being used
This gets passed to BUILDKITE_SHELL, which will specify the shell being
used to executes script in.

Defaults to `${pkgs.bash}/bin/bash -e -c`, matching how buildkite
behaves on other distros.
2020-01-17 18:40:11 +01:00
Florian Klink 99d0f4c380 nixos/buildkite-agent: tweak TimeoutStopSec and KillMode
This improves behaviour when the service is being stopped.
2020-01-17 18:40:11 +01:00
Florian Klink 9237767277 nixos/buildkite-agent: actually use services.buildkite-agent.package
We were currently just using pkgs.buildkite-agent, no matter what was
configured in services.buildkite-agent.package
2020-01-17 18:40:11 +01:00
Florian Klink c154dd5101 nixos/buildkite-agent: stop deploying public keys, make ssh private key optional.
SSH public keys aren't needed to clone private repos, and if we only
need to configure a single attribute, there's no need for the "openssh"
attrset anymore.
2020-01-17 18:40:11 +01:00
Florian Klink ed0b5b6133
Merge pull request #77662 from marijanp/verbose-python-test-driver
nixos/test: added verbose output for failed tests
2020-01-17 13:50:49 +01:00
Matt Layher 5089214a3d nixos/corerad: init 2020-01-16 12:38:36 -08:00
Maximilian Bosch d77b68e487
nixos/liboping: add module
This creates setcap wrappers for oping and noping to allow unprivileged
users to use those as well.
2020-01-16 18:09:35 +01:00
Aaron Andersen fc1bee555e
Merge pull request #75602 from vanyaklimenko/nginx-gitweb-more-options
nixos/nginx/gitweb: add some (crucial) options
2020-01-15 21:16:24 -05:00