diff options
Diffstat (limited to 'nixos')
602 files changed, 10257 insertions, 4011 deletions
diff --git a/nixos/default.nix b/nixos/default.nix index 45da78e9261cc..c11872f1441ab 100644 --- a/nixos/default.nix +++ b/nixos/default.nix @@ -22,6 +22,11 @@ let [ configuration ./modules/virtualisation/qemu-vm.nix { virtualisation.useBootLoader = true; } + ({ config, ... }: { + virtualisation.useEFIBoot = + config.boot.loader.systemd-boot.enable || + config.boot.loader.efi.canTouchEfiVariables; + }) ]; }).config; diff --git a/nixos/doc/manual/configuration/linux-kernel.xml b/nixos/doc/manual/configuration/linux-kernel.xml index dbdcc94149548..529ac1b1cd468 100644 --- a/nixos/doc/manual/configuration/linux-kernel.xml +++ b/nixos/doc/manual/configuration/linux-kernel.xml @@ -87,7 +87,7 @@ nixpkgs.config.packageOverrides = pkgs: You can edit the config with this snippet (by default <command>make menuconfig</command> won't work out of the box on nixos): <screen><![CDATA[ - nix-shell -E 'with import <nixpkgs> {}; kernelToOverride.overrideAttrs (o: {nativeBuildInputs=o.nativeBuildInputs ++ [ pkgconfig ncurses ];})' + nix-shell -E 'with import <nixpkgs> {}; kernelToOverride.overrideAttrs (o: {nativeBuildInputs=o.nativeBuildInputs ++ [ pkg-config ncurses ];})' ]]></screen> or you can let nixpkgs generate the configuration. Nixpkgs generates it via answering the interactive kernel utility <command>make config</command>. The diff --git a/nixos/doc/manual/configuration/profiles/hardened.xml b/nixos/doc/manual/configuration/profiles/hardened.xml index dc83fc837e2a3..4a51754cc7ae2 100644 --- a/nixos/doc/manual/configuration/profiles/hardened.xml +++ b/nixos/doc/manual/configuration/profiles/hardened.xml @@ -7,7 +7,7 @@ <para> A profile with most (vanilla) hardening options enabled by default, - potentially at the cost of features and performance. + potentially at the cost of stability, features and performance. </para> <para> @@ -21,4 +21,12 @@ xlink:href="https://github.com/nixos/nixpkgs/tree/master/nixos/modules/profiles/hardened.nix"> profile source</literal> for further detail on which settings are altered. </para> + <warning> + <para> + This profile enables options that are known to affect system + stability. If you experience any stability issues when using the + profile, try disabling it. If you report an issue and use this + profile, always mention that you do. + </para> + </warning> </section> diff --git a/nixos/doc/manual/configuration/profiles/qemu-guest.xml b/nixos/doc/manual/configuration/profiles/qemu-guest.xml index 5d055c45d2d83..3ed97b94b5100 100644 --- a/nixos/doc/manual/configuration/profiles/qemu-guest.xml +++ b/nixos/doc/manual/configuration/profiles/qemu-guest.xml @@ -11,8 +11,7 @@ </para> <para> - It makes virtio modules available on the initrd, sets the system time from - the hardware clock to work around a bug in qemu-kvm, and - <link linkend="opt-security.rngd.enable">enables rngd</link>. + It makes virtio modules available on the initrd and sets the system time from + the hardware clock to work around a bug in qemu-kvm. </para> </section> diff --git a/nixos/doc/manual/configuration/x-windows.xml b/nixos/doc/manual/configuration/x-windows.xml index b33f6cf82b527..dd879702d7dc0 100644 --- a/nixos/doc/manual/configuration/x-windows.xml +++ b/nixos/doc/manual/configuration/x-windows.xml @@ -186,7 +186,7 @@ The driver has many options (see <xref linkend="ch-options"/>). For instance, the following disables tap-to-click behavior: <programlisting> -<xref linkend="opt-services.xserver.libinput.tapping"/> = false; +<xref linkend="opt-services.xserver.libinput.touchpad.tapping"/> = false; </programlisting> Note: the use of <literal>services.xserver.synaptics</literal> is deprecated since NixOS 17.09. diff --git a/nixos/doc/manual/contributing-to-this-manual.xml b/nixos/doc/manual/contributing-to-this-manual.xml index 935dd66bc141c..137e04bb313b3 100644 --- a/nixos/doc/manual/contributing-to-this-manual.xml +++ b/nixos/doc/manual/contributing-to-this-manual.xml @@ -1,7 +1,7 @@ <chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="chap-contributing"> - <title>Contributing to this documentation</title> + <title>Contributing to this manual</title> <para> The DocBook sources of NixOS' manual are in the <filename xlink:href="https://github.com/NixOS/nixpkgs/tree/master/nixos/doc/manual"> diff --git a/nixos/doc/manual/installation/installing-virtualbox-guest.xml b/nixos/doc/manual/installation/installing-virtualbox-guest.xml index 1cffeed480790..4957b700946ef 100644 --- a/nixos/doc/manual/installation/installing-virtualbox-guest.xml +++ b/nixos/doc/manual/installation/installing-virtualbox-guest.xml @@ -83,7 +83,7 @@ VirtualBox settings (Machine / Settings / Shared Folders, then click on the "Add" icon). Add the following to the <literal>/etc/nixos/configuration.nix</literal> to auto-mount them. If you do - not add <literal>"nofail"</literal>, the system will no boot properly. The + not add <literal>"nofail"</literal>, the system will not boot properly. The same goes for disabling <literal>rngd</literal> which is normally used to get randomness but this does not work in virtual machines. </para> diff --git a/nixos/doc/manual/preface.xml b/nixos/doc/manual/preface.xml index 6ac9ae7e7861d..0f7db6ef1a826 100644 --- a/nixos/doc/manual/preface.xml +++ b/nixos/doc/manual/preface.xml @@ -21,7 +21,11 @@ xlink:href="https://discourse.nixos.org">Discourse</literal> or on the <link xlink:href="irc://irc.freenode.net/#nixos"> - <literal>#nixos</literal> channel on Freenode</link>. Bugs should be + <literal>#nixos</literal> channel on Freenode</link>, or + consider + <link + xlink:href="#chap-contributing"> + contributing to this manual</link>. Bugs should be reported in <link xlink:href="https://github.com/NixOS/nixpkgs/issues">NixOS’ diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml index 87f1228561949..4206f44f6c77a 100644 --- a/nixos/doc/manual/release-notes/rl-2003.xml +++ b/nixos/doc/manual/release-notes/rl-2003.xml @@ -45,6 +45,15 @@ </listitem> <listitem> <para> + Grub is updated to 2.04, adding support for booting from F2FS filesystems and + Btrfs volumes using zstd compression. Note that some users have been unable +to boot after upgrading to 2.04 - for more information, please see <link +xlink:href="https://github.com/NixOS/nixpkgs/issues/61718#issuecomment-617618503">this + discussion</link>. + </para> + </listitem> + <listitem> + <para> Postgresql for NixOS service now defaults to v11. </para> </listitem> @@ -650,7 +659,7 @@ See https://github.com/NixOS/nixpkgs/pull/71684 for details. <listitem> <para> <literal>boot.extraTTYs</literal> renamed to - <link linkend="opt-console.extraTTYs">console.extraTTYs</link> + <literal>console.extraTTYs</literal>. </para> </listitem> </itemizedlist> diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml index afb09d7c5d262..0b1d0d509d783 100644 --- a/nixos/doc/manual/release-notes/rl-2009.xml +++ b/nixos/doc/manual/release-notes/rl-2009.xml @@ -1343,6 +1343,20 @@ CREATE ROLE postgres LOGIN SUPERUSER; It was chosen to do this as it has a usability breaking issue (see issue <link xlink:href="https://github.com/NixOS/nixpkgs/issues/98819">#98819</link>) that makes it unsuitable to be a default app. </para> + <note> + <para> + Issue <link + xlink:href="https://github.com/NixOS/nixpkgs/issues/98819">#98819</link> + is now fixed and <package>gnome3.epiphany</package> is once + again installed by default. + </para> + </note> + </listitem> + <listitem> + <para> + If you want to manage the configuration of <package>wpa_supplicant</package> outside of NixOS you must ensure that none of <xref linkend="opt-networking.wireless.networks" />, <xref linkend="opt-networking.wireless.extraConfig" /> or <xref linkend="opt-networking.wireless.userControlled.enable" /> is being used or <literal>true</literal>. + Using any of those options will cause <package>wpa_supplicant</package> to be started with a NixOS generated configuration file instead of your own. + </para> </listitem> </itemizedlist> </section> diff --git a/nixos/doc/manual/release-notes/rl-2103.xml b/nixos/doc/manual/release-notes/rl-2103.xml index 96061e9ca5972..e5c93f5c51385 100644 --- a/nixos/doc/manual/release-notes/rl-2103.xml +++ b/nixos/doc/manual/release-notes/rl-2103.xml @@ -26,6 +26,19 @@ <listitem> <para>GNOME desktop environment was upgraded to 3.38, see its <link xlink:href="https://help.gnome.org/misc/release-notes/3.38/">release notes</link>.</para> </listitem> + <listitem> + <para> + <link xlink:href="https://www.gnuradio.org/">GNURadio</link> 3.8 was + <link xlink:href="https://github.com/NixOS/nixpkgs/issues/82263">finnally</link> + packaged, along with a rewrite to the Nix expressions, allowing users to + override the features upstream supports selecting to compile or not to. + Additionally, the attribute <code>gnuradio</code> and <code>gnuradio3_7</code> + now point to an externally wrapped by default derivations, that allow you to + also add `extraPythonPackages` to the Python interpreter used by GNURadio. + Missing environmental variables needed for operational GUI were also added + (<link xlink:href="https://github.com/NixOS/nixpkgs/issues/75478">#7547</link>). + </para> + </listitem> </itemizedlist> </section> @@ -95,6 +108,15 @@ </para> </listitem> <listitem> + <para> + The <varname>networking.wireless.iwd</varname> module now installs + the upstream-provided 80-iwd.link file, which sets the NamePolicy= + for all wlan devices to "keep kernel", to avoid race conditions + between iwd and networkd. If you don't want this, you can set + <literal>systemd.network.links."80-iwd" = lib.mkForce {}</literal>. + </para> + </listitem> + <listitem> <para> <literal>rubyMinimal</literal> was removed due to being unused and unusable. The default ruby interpreter includes JIT support, which makes @@ -156,6 +178,38 @@ </para> </listitem> <listitem> + <para> + xfsprogs was update from 4.19 to 5.10. It now enables reflink support by default on filesystem creation. + Support for reflinks was added with an experimental status to kernel 4.9 and deemed stable in kernel 4.16. + If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than those, you need to format them + with <literal>mkfs.xfs -m reflink=0</literal>. + </para> + </listitem> + <listitem> + <para> + The uWSGI server is now built with POSIX capabilities. As a consequence, + root is no longer required in emperor mode and the service defaults to + running as the unprivileged <literal>uwsgi</literal> user. Any additional + capability can be added via the new option + <xref linkend="opt-services.uwsgi.capabilities"/>. + The previous behaviour can be restored by setting: +<programlisting> + <xref linkend="opt-services.uwsgi.user"/> = "root"; + <xref linkend="opt-services.uwsgi.group"/> = "root"; + <xref linkend="opt-services.uwsgi.instance"/> = + { + uid = "uwsgi"; + gid = "uwsgi"; + }; +</programlisting> + </para> + <para> + Another incompatibility from the previous release is that vassals running under a + different user or group need to use <literal>immediate-{uid,gid}</literal> + instead of the usual <literal>uid,gid</literal> options. + </para> + </listitem> + <listitem> <para> <package>btc1</package> has been abandoned upstream, and removed. </para> @@ -204,6 +258,22 @@ </listitem> <listitem> <para> + MariaDB has been updated to 10.5. + Before you upgrade, it would be best to take a backup of your database and read + <link xlink:href="https://mariadb.com/kb/en/upgrading-from-mariadb-104-to-mariadb-105/#incompatible-changes-between-104-and-105"> + Incompatible Changes Between 10.4 and 10.5</link>. + After the upgrade you will need to run <literal>mysql_upgrade</literal>. + </para> + </listitem> + <listitem> + <para> + The TokuDB storage engine dropped in <package>mariadb</package> 10.5 and removed in <package>mariadb</package> 10.6. + It is recommended to switch to RocksDB. See also <link xlink:href="https://mariadb.com/kb/en/tokudb/">TokuDB</link> and + <link xlink:href="https://jira.mariadb.org/browse/MDEV-19780">MDEV-19780: Remove the TokuDB storage engine</link>. + </para> + </listitem> + <listitem> + <para> The <literal>openldap</literal> module now has support for OLC-style configuration, users of the <literal>configDir</literal> option may wish to migrate. If you continue to use <literal>configDir</literal>, ensure that @@ -252,6 +322,150 @@ located in <literal>/run/rspamd</literal> instead of <literal>/run</literal>. </para> </listitem> + <listitem> + <para> + Enabling the Tor client no longer silently also enables and + configures Privoxy, and the + <varname>services.tor.client.privoxy.enable</varname> option has + been removed. To enable Privoxy, and to configure it to use + Tor's faster port, use the following configuration: + </para> + <programlisting> + <xref linkend="opt-services.privoxy.enable" /> = true; + <xref linkend="opt-services.privoxy.enableTor" /> = true; + </programlisting> + </listitem> + <listitem> + <para> + The <literal>services.tor</literal> module has a new exhaustively typed <xref linkend="opt-services.tor.settings" /> option following RFC 0042; backward compatibility with old options has been preserved when aliasing was possible. + The corresponding systemd service has been hardened, + but there is a chance that the service still requires more permissions, + so please report any related trouble on the bugtracker. + Onion services v3 are now supported in <xref linkend="opt-services.tor.relay.onionServices" />. + A new <xref linkend="opt-services.tor.openFirewall" /> option as been introduced for allowing connections on all the TCP ports configured. + </para> + </listitem> + <listitem> + <para> + The options <literal>services.slurm.dbdserver.storagePass</literal> + and <literal>services.slurm.dbdserver.configFile</literal> have been removed. + Use <literal>services.slurm.dbdserver.storagePassFile</literal> instead to provide the database password. + Extra config options can be given via the option <literal>services.slurm.dbdserver.extraConfig</literal>. The actual configuration file is created on the fly on startup of the service. + This avoids that the password gets exposed in the nix store. + </para> + </listitem> + <listitem> + <para> + The <literal>wafHook</literal> hook does not wrap Python anymore. + Packages depending on <literal>wafHook</literal> need to include any Python into their <literal>nativeBuildInputs</literal>. + </para> + </listitem> + <listitem> + <para> + Starting with version 1.7.0, the project formerly named <literal>CodiMD</literal> + is now named <literal>HedgeDoc</literal>. + New installations will no longer use the old name for users, state directories and such, this needs to be considered when moving state to a more recent NixOS installation. + Based on <xref linkend="opt-system.stateVersion" />, existing installations will continue to work. + </para> + </listitem> + <listitem> + <para> + The <package>fish-foreign-env</package> package has been replaced with + <package>fishPlugins.foreign-env</package>, in which the fish + functions have been relocated to the + <literal>vendor_functions.d</literal> directory to be loaded automatically. + </para> + </listitem> + <listitem> + <para> + The prometheus json exporter is now managed by the prometheus community. Together with additional features + some backwards incompatibilities were introduced. + Most importantly the exporter no longer accepts a fixed command-line parameter to specify the URL of the + endpoint serving JSON. It now expects this URL to be passed as an URL parameter, when scraping the exporter's + <literal>/probe</literal> endpoint. + In the prometheus scrape configuration the scrape target might look like this: + <programlisting> +http://some.json-exporter.host:7979/probe?target=https://example.com/some/json/endpoint + </programlisting> + </para> + <para> + Existing configuration for the exporter needs to be updated, but can partially be re-used. + Documentation is available in the upstream repository and a small example for NixOS is available + in the corresponding NixOS test. + </para> + <para> + These changes also affect <xref linkend="opt-services.prometheus.exporters.rspamd.enable" />, which is + just a preconfigured instance of the json exporter. + </para> + <para> + For more information, take a look at the <link xlink:href="https://github.com/prometheus-community/json_exporter"> + official documentation</link> of the json_exporter. + </para> + </listitem> + <listitem> + <para> + Androidenv was updated, removing the <literal>includeDocs</literal> and <literal>lldbVersions</literal> + arguments. Docs only covered a single version of the Android SDK, LLDB is now bundled with the NDK, + and both are no longer available to download from the Android package repositories. Additionally, since + the package lists have been updated, some older versions of Android packages may not be bundled. If you + depend on older versions of Android packages, we recommend overriding the repo. + </para> + <para> + Android packages are now loaded from a repo.json file created by parsing Android repo XML files. The arguments + <literal>repoJson</literal> and <literal>repoXmls</literal> have been added to allow overriding the built-in + androidenv repo.json with your own. Additionally, license files are now written to allow compatibility + with Gradle-based tools, and the <literal>extraLicenses</literal> argument has been added to accept more + SDK licenses if your project requires it. See the androidenv documentation for more details. + </para> + </listitem> + <listitem> + <para> + The attribute <varname>mpi</varname> is now consistently used to + provide a default, system-wide MPI implementation. + The default implementation is openmpi, which has been used before by + all derivations affects by this change. + Note that all packages that have used <varname>mpi ? null</varname> in the input + for optional MPI builds, have been changed to the boolean input paramater + <varname>useMpi</varname> to enable building with MPI. + + Building all packages with <varname>mpich</varname> instead + of the default <varname>openmpi</varname> can now be achived like this: + <programlisting> +self: super: +{ + mpi = super.mpich; +} + </programlisting> + </para> + </listitem> + <listitem> + <para> + The Searx module has been updated with the ability to configure the + service declaratively and uWSGI integration. + The option <literal>services.searx.configFile</literal> has been renamed + to <xref linkend="opt-services.searx.settingsFile"/> for consistency with + the new <xref linkend="opt-services.searx.settings"/>. In addition, the + <literal>searx</literal> uid and gid reservations have been removed + since they were not necessary: the service is now running with a + dynamically allocated uid. + </para> + </listitem> + <listitem> + <para> + The libinput module has been updated with the ability to configure mouse and touchpad settings separately. + The options in <literal>services.xserver.libinput</literal> have been renamed to <literal>services.xserver.libinput.touchpad</literal>, + while there is a new <literal>services.xserver.libinput.mouse</literal> for mouse related configuration. + </para> + <para> + Since touchpad options no longer apply to all devices, you may want to replicate your touchpad configuration in + mouse section. + </para> + </listitem> + <listitem> + <para> + ALSA OSS emulation (<varname>sound.enableOSSEmulation</varname>) is now disabled by default. + </para> + </listitem> </itemizedlist> </section> @@ -265,6 +479,27 @@ <itemizedlist> <listitem> <para> + <literal>stdenv.lib</literal> has been deprecated and will break + eval in 21.11. Please use <literal>pkgs.lib</literal> instead. + See <link xlink:href="https://github.com/NixOS/nixpkgs/issues/108938">#108938</link> + for details. + </para> + </listitem> + <listitem> + <para> + The Mailman NixOS module (<literal>services.mailman</literal>) has a new + option <xref linkend="opt-services.mailman.enablePostfix" />, defaulting + to true, that controls integration with Postfix. + </para> + <para> + If this option is disabled, default MTA config becomes not set and you + should set the options in <literal>services.mailman.settings.mta</literal> + according to the desired configuration as described in + <link xlink:href="https://mailman.readthedocs.io/en/latest/src/mailman/docs/mta.html">Mailman documentation</link>. + </para> + </listitem> + <listitem> + <para> The default-version of <literal>nextcloud</literal> is <package>nextcloud20</package>. Please note that it's <emphasis>not</emphasis> possible to upgrade <literal>nextcloud</literal> across multiple major versions! This means that it's e.g. not possible to upgrade @@ -346,6 +581,13 @@ </listitem> <listitem> <para> + The <literal>services.dnscrypt-proxy2</literal> module now takes the upstream's example configuration and updates it with the user's settings. + + An option has been added to restore the old behaviour if you prefer to declare the configuration from scratch. + </para> + </listitem> + <listitem> + <para> NixOS now defaults to the unified cgroup hierarchy (cgroupsv2). See the <link xlink:href="https://www.redhat.com/sysadmin/fedora-31-control-group-v2">Fedora Article for 31</link> for details on why this is desirable, and how it impacts containers. @@ -357,6 +599,79 @@ and rebooting. </para> </listitem> + <listitem> + <para> + PulseAudio was upgraded to 14.0, with changes to the handling of default sinks. + See its <link xlink:href="https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/14.0/">release notes</link>. + </para> + + <para> + GNOME users may wish to delete their <literal>~/.config/pulse</literal> due to the changes to stream routing + logic. See <link xlink:href="https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/832">PulseAudio bug 832</link> + for more information. + </para> + </listitem> + <listitem> + <para> + The <package>zookeeper</package> package does not provide + <literal>zooInspector.sh</literal> anymore, as that "contrib" has + been dropped from upstream releases. + </para> + </listitem> + <listitem> + <para> + In the ACME module, the data used to build the hash for the account + directory has changed to accomodate new features to reduce account + rate limit issues. This will trigger new account creation on the first + rebuild following this update. No issues are expected to arise from this, + thanks to the new account creation handling. + </para> + </listitem> + <listitem> + <para> + <xref linkend="opt-users.users._name_.createHome" /> now always ensures home directory permissions to be <literal>0700</literal>. + Permissions had previously been ignored for already existing home directories, possibly leaving them readable by others. + The option's description was incorrect regarding ownership management and has been simplified greatly. + </para> + </listitem> + <listitem> + <para> + The GNOME desktop manager once again installs <package>gnome3.epiphany</package> by default. + </para> + </listitem> + <listitem> + <para> + NixOS now generates empty <literal>/etc/netgroup</literal>. + <literal>/etc/netgroup</literal> defines network-wide groups and may affect to setups using NIS. + </para> + </listitem> + <listitem> + <para> + Platforms, like <varname>stdenv.hostPlatform</varname>, no longer have a <varname>platform</varname> attribute. + It has been (mostly) flattoned away: + </para> + <itemizedlist> + <listitem><para><varname>platform.gcc</varname> is now <varname>gcc</varname></para></listitem> + <listitem><para><literal>platform.kernel*</literal> is now <literal>linux-kernel.*</literal></para></listitem> + </itemizedlist> + <para> + Additionally, <varname>platform.kernelArch</varname> moved to the top level as <varname>linuxArch</varname> to match the other <literal>*Arch</literal> variables. + </para> + <para> + The <varname>platform</varname> grouping of these things never meant anything, and was just a historial/implementation artifact that was overdue removal. + </para> + </listitem> + <listitem> + <para> + <varname>services.restic</varname> now uses a dedicated cache directory for every backup defined in <varname>services.restic.backups</varname>. The old global cache directory, <literal>/root/.cache/restic</literal>, is now unused and can be removed to free up disk space. + </para> + </listitem> + <listitem> + <para> + <literal>isync</literal>: The <literal>isync</literal> compatibility wrapper was removed and the Master/Slave + terminology has been deprecated and should be replaced with Far/Near in the configuration file. + </para> + </listitem> </itemizedlist> </section> </section> diff --git a/nixos/lib/make-disk-image.nix b/nixos/lib/make-disk-image.nix index 0ad0cf1fef5af..023d0791a5c7d 100644 --- a/nixos/lib/make-disk-image.nix +++ b/nixos/lib/make-disk-image.nix @@ -18,9 +18,13 @@ bootSize ? "256M" , # The files and directories to be placed in the target file system. - # This is a list of attribute sets {source, target} where `source' - # is the file system object (regular file or directory) to be - # grafted in the file system at path `target'. + # This is a list of attribute sets {source, target, mode, user, group} where + # `source' is the file system object (regular file or directory) to be + # grafted in the file system at path `target', `mode' is a string containing + # the permissions that will be set (ex. "755"), `user' and `group' are the + # user and group name that will be set as owner of the files. + # `mode', `user', and `group' are optional. + # When setting one of `user' or `group', the other needs to be set too. contents ? [] , # Type of partition table to use; either "legacy", "efi", or "none". @@ -60,6 +64,11 @@ assert partitionTableType == "legacy" || partitionTableType == "legacy+gpt" || partitionTableType == "efi" || partitionTableType == "hybrid" || partitionTableType == "none"; # We use -E offset=X below, which is only supported by e2fsprogs assert partitionTableType != "none" -> fsType == "ext4"; +# Either both or none of {user,group} need to be set +assert lib.all + (attrs: ((attrs.user or null) == null) + == ((attrs.group or null) == null)) + contents; with lib; @@ -148,6 +157,9 @@ let format' = format; in let # !!! should use XML. sources = map (x: x.source) contents; targets = map (x: x.target) contents; + modes = map (x: x.mode or "''") contents; + users = map (x: x.user or "''") contents; + groups = map (x: x.group or "''") contents; closureInfo = pkgs.closureInfo { rootPaths = [ config.system.build.toplevel channelSources ]; }; @@ -174,22 +186,33 @@ let format' = format; in let set -f sources_=(${concatStringsSep " " sources}) targets_=(${concatStringsSep " " targets}) + modes_=(${concatStringsSep " " modes}) set +f for ((i = 0; i < ''${#targets_[@]}; i++)); do source="''${sources_[$i]}" target="''${targets_[$i]}" + mode="''${modes_[$i]}" + if [ -n "$mode" ]; then + rsync_chmod_flags="--chmod=$mode" + else + rsync_chmod_flags="" + fi + # Unfortunately cptofs only supports modes, not ownership, so we can't use + # rsync's --chown option. Instead, we change the ownerships in the + # VM script with chown. + rsync_flags="-a --no-o --no-g $rsync_chmod_flags" if [[ "$source" =~ '*' ]]; then # If the source name contains '*', perform globbing. mkdir -p $root/$target for fn in $source; do - rsync -a --no-o --no-g "$fn" $root/$target/ + rsync $rsync_flags "$fn" $root/$target/ done else mkdir -p $root/$(dirname $target) if ! [ -e $root/$target ]; then - rsync -a --no-o --no-g $source $root/$target + rsync $rsync_flags $source $root/$target else echo "duplicate entry $target -> $source" exit 1 @@ -234,7 +257,8 @@ let format' = format; in let ''} echo "copying staging root to image..." - cptofs -p ${optionalString (partitionTableType != "none") "-P ${rootPartition}"} -t ${fsType} -i $diskImage $root/* / + cptofs -p ${optionalString (partitionTableType != "none") "-P ${rootPartition}"} -t ${fsType} -i $diskImage $root/* / || + (echo >&2 "ERROR: cptofs failed. diskSize might be too small for closure."; exit 1) ''; in pkgs.vmTools.runInLinuxVM ( pkgs.runCommand name @@ -284,6 +308,21 @@ in pkgs.vmTools.runInLinuxVM ( # The above scripts will generate a random machine-id and we don't want to bake a single ID into all our images rm -f $mountPoint/etc/machine-id + # Set the ownerships of the contents. The modes are set in preVM. + # No globbing on targets, so no need to set -f + targets_=(${concatStringsSep " " targets}) + users_=(${concatStringsSep " " users}) + groups_=(${concatStringsSep " " groups}) + for ((i = 0; i < ''${#targets_[@]}; i++)); do + target="''${targets_[$i]}" + user="''${users_[$i]}" + group="''${groups_[$i]}" + if [ -n "$user$group" ]; then + # We have to nixos-enter since we need to use the user and group of the VM + nixos-enter --root $mountPoint -- chown -R "$user:$group" "$target" + fi + done + umount -R /mnt # Make sure resize2fs works. Note that resize2fs has stricter criteria for resizing than a normal diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix index 13abfb9a111d4..6192be1cd0532 100644 --- a/nixos/lib/testing-python.nix +++ b/nixos/lib/testing-python.nix @@ -67,6 +67,8 @@ rec { LOGFILE=/dev/null tests='exec(os.environ["testScript"])' ${driver}/bin/nixos-test-driver ''; + + passthru = driver.passthru; }; @@ -76,6 +78,7 @@ rec { , name ? "unnamed" # Skip linting (mainly intended for faster dev cycles) , skipLint ? false + , passthru ? {} , ... } @ t: let @@ -137,7 +140,7 @@ rec { testScript = testScript'; preferLocalBuild = true; testName = name; - passthru = { + passthru = passthru // { inherit nodes; }; } diff --git a/nixos/maintainers/scripts/ec2/create-amis.sh b/nixos/maintainers/scripts/ec2/create-amis.sh index ec2eb53667901..691d7fcfcba44 100755 --- a/nixos/maintainers/scripts/ec2/create-amis.sh +++ b/nixos/maintainers/scripts/ec2/create-amis.sh @@ -219,7 +219,7 @@ upload_image() { log "Registering snapshot $snapshot_id as AMI" local block_device_mappings=( - "DeviceName=/dev/xvda,Ebs={SnapshotId=$snapshot_id,VolumeSize=$image_logical_gigabytes,DeleteOnTermination=true,VolumeType=gp2}" + "DeviceName=/dev/xvda,Ebs={SnapshotId=$snapshot_id,VolumeSize=$image_logical_gigabytes,DeleteOnTermination=true,VolumeType=gp3}" ) local extra_flags=( diff --git a/nixos/modules/config/console.nix b/nixos/modules/config/console.nix index f662ed62d31dc..1339227f1e022 100644 --- a/nixos/modules/config/console.nix +++ b/nixos/modules/config/console.nix @@ -83,27 +83,13 @@ in packages = mkOption { type = types.listOf types.package; default = with pkgs.kbdKeymaps; [ dvp neo ]; - defaultText = ''with pkgs.kbdKeymaps; [ dvp neo ]''; + defaultText = "with pkgs.kbdKeymaps; [ dvp neo ]"; description = '' List of additional packages that provide console fonts, keymaps and other resources for virtual consoles use. ''; }; - extraTTYs = mkOption { - default = []; - type = types.listOf types.str; - example = ["tty8" "tty9"]; - description = '' - TTY (virtual console) devices, in addition to the consoles on - which mingetty and syslogd run, that must be initialised. - Only useful if you have some program that you want to run on - some fixed console. For example, the NixOS installation CD - opens the manual in a web browser on console 7, so it sets - <option>console.extraTTYs</option> to <literal>["tty7"]</literal>. - ''; - }; - useXkbConfig = mkOption { type = types.bool; default = false; @@ -159,7 +145,8 @@ in ''; systemd.services.systemd-vconsole-setup = - { before = [ "display-manager.service" ]; + { + before = optional config.services.xserver.enable "display-manager.service"; after = [ "systemd-udev-settle.service" ]; restartTriggers = [ vconsoleConf consoleEnv ]; }; @@ -199,5 +186,9 @@ in (mkRenamedOptionModule [ "i18n" "consoleUseXkbConfig" ] [ "console" "useXkbConfig" ]) (mkRenamedOptionModule [ "boot" "earlyVconsoleSetup" ] [ "console" "earlySetup" ]) (mkRenamedOptionModule [ "boot" "extraTTYs" ] [ "console" "extraTTYs" ]) + (mkRemovedOptionModule [ "console" "extraTTYs" ] '' + Since NixOS switched to systemd (circa 2012), TTYs have been spawned on + demand, so there is no need to configure them manually. + '') ]; } diff --git a/nixos/modules/config/fonts/fontconfig.nix b/nixos/modules/config/fonts/fontconfig.nix index 5b681ca59464d..6e7b8c4b88a20 100644 --- a/nixos/modules/config/fonts/fontconfig.nix +++ b/nixos/modules/config/fonts/fontconfig.nix @@ -436,7 +436,7 @@ in useEmbeddedBitmaps = mkOption { type = types.bool; default = false; - description = ''Use embedded bitmaps in fonts like Calibri.''; + description = "Use embedded bitmaps in fonts like Calibri."; }; }; diff --git a/nixos/modules/config/gnu.nix b/nixos/modules/config/gnu.nix index 93d1309701902..255d9741ba714 100644 --- a/nixos/modules/config/gnu.nix +++ b/nixos/modules/config/gnu.nix @@ -1,11 +1,9 @@ { config, lib, pkgs, ... }: -with lib; - { options = { - gnu = mkOption { - type = types.bool; + gnu = lib.mkOption { + type = lib.types.bool; default = false; description = '' When enabled, GNU software is chosen by default whenever a there is @@ -15,7 +13,7 @@ with lib; }; }; - config = mkIf config.gnu { + config = lib.mkIf config.gnu { environment.systemPackages = with pkgs; # TODO: Adjust `requiredPackages' from `system-path.nix'. @@ -26,7 +24,7 @@ with lib; nano zile texinfo # for the stand-alone Info reader ] - ++ stdenv.lib.optional (!stdenv.isAarch32) grub2; + ++ lib.optional (!stdenv.isAarch32) grub2; # GNU GRUB, where available. diff --git a/nixos/modules/config/i18n.nix b/nixos/modules/config/i18n.nix index feb76581a720f..991b449d80b55 100644 --- a/nixos/modules/config/i18n.nix +++ b/nixos/modules/config/i18n.nix @@ -84,7 +84,7 @@ with lib; environment.etc."locale.conf".source = pkgs.writeText "locale.conf" '' LANG=${config.i18n.defaultLocale} - ${concatStringsSep "\n" (mapAttrsToList (n: v: ''${n}=${v}'') config.i18n.extraLocaleSettings)} + ${concatStringsSep "\n" (mapAttrsToList (n: v: "${n}=${v}") config.i18n.extraLocaleSettings)} ''; }; diff --git a/nixos/modules/config/ldap.nix b/nixos/modules/config/ldap.nix index 1a5dbcd4e26ba..35813c168fd85 100644 --- a/nixos/modules/config/ldap.nix +++ b/nixos/modules/config/ldap.nix @@ -59,30 +59,28 @@ in users.ldap = { - enable = mkOption { - type = types.bool; - default = false; - description = "Whether to enable authentication against an LDAP server."; - }; + enable = mkEnableOption "authentication against an LDAP server"; loginPam = mkOption { type = types.bool; default = true; - description = "Whether to include authentication against LDAP in login PAM"; + description = "Whether to include authentication against LDAP in login PAM."; }; nsswitch = mkOption { type = types.bool; default = true; - description = "Whether to include lookup against LDAP in NSS"; + description = "Whether to include lookup against LDAP in NSS."; }; server = mkOption { + type = types.str; example = "ldap://ldap.example.org/"; description = "The URL of the LDAP server."; }; base = mkOption { + type = types.str; example = "dc=example,dc=org"; description = "The distinguished name of the search base."; }; @@ -129,7 +127,7 @@ in type = types.lines; description = '' Extra configuration options that will be added verbatim at - the end of the nslcd configuration file (nslcd.conf). + the end of the nslcd configuration file (<literal>nslcd.conf(5)</literal>). '' ; } ; @@ -180,7 +178,7 @@ in description = '' Specifies the time limit (in seconds) to use when connecting to the directory server. This is distinct from the time limit - specified in <literal>users.ldap.timeLimit</literal> and affects + specified in <option>users.ldap.timeLimit</option> and affects the initial server connection only. ''; }; @@ -197,7 +195,7 @@ in actually contact the directory server, and it is possible that a malformed configuration file will trigger reconnection. If <literal>soft</literal> is specified, then - <literal>nss_ldap</literal> will return immediately on server + <package>nss_ldap</package> will return immediately on server failure. All hard reconnect policies block with exponential backoff before retrying. ''; @@ -209,10 +207,10 @@ in type = types.lines; description = '' Extra configuration options that will be added verbatim at - the end of the ldap configuration file (ldap.conf). - If <literal>users.ldap.daemon</literal> is enabled, this + the end of the ldap configuration file (<literal>ldap.conf(5)</literal>). + If <option>users.ldap.daemon</option> is enabled, this configuration will not be used. In that case, use - <literal>users.ldap.daemon.extraConfig</literal> instead. + <option>users.ldap.daemon.extraConfig</option> instead. '' ; }; @@ -240,9 +238,9 @@ in ''; }; - system.nssModules = singleton ( + system.nssModules = mkIf cfg.nsswitch (singleton ( if cfg.daemon.enable then nss_pam_ldapd else nss_ldap - ); + )); system.nssDatabases.group = optional cfg.nsswitch "ldap"; system.nssDatabases.passwd = optional cfg.nsswitch "ldap"; @@ -276,7 +274,12 @@ in } >"$conf" mv -fT "$conf" /run/nslcd/nslcd.conf ''; - restartTriggers = [ "/run/nslcd/nslcd.conf" ]; + + restartTriggers = [ + nslcdConfig + cfg.bind.passwordFile + cfg.daemon.rootpwmodpwFile + ]; serviceConfig = { ExecStart = "${nslcdWrapped}/bin/nslcd"; diff --git a/nixos/modules/config/networking.nix b/nixos/modules/config/networking.nix index 4cb7d81c99729..dba8977e482c1 100644 --- a/nixos/modules/config/networking.nix +++ b/nixos/modules/config/networking.nix @@ -58,6 +58,7 @@ in "2.nixos.pool.ntp.org" "3.nixos.pool.ntp.org" ]; + type = types.listOf types.str; description = '' The set of NTP servers from which to synchronise. ''; @@ -193,6 +194,9 @@ in cat ${escapeShellArgs cfg.hostFiles} > $out ''; + # /etc/netgroup: Network-wide groups. + netgroup.text = mkDefault ""; + # /etc/host.conf: resolver configuration file "host.conf".text = '' multi on diff --git a/nixos/modules/config/pulseaudio.nix b/nixos/modules/config/pulseaudio.nix index a77524d75d8dc..c0e90a8c26e6c 100644 --- a/nixos/modules/config/pulseaudio.nix +++ b/nixos/modules/config/pulseaudio.nix @@ -183,7 +183,7 @@ in { config = mkOption { type = types.attrsOf types.unspecified; default = {}; - description = ''Config of the pulse daemon. See <literal>man pulse-daemon.conf</literal>.''; + description = "Config of the pulse daemon. See <literal>man pulse-daemon.conf</literal>."; example = literalExample ''{ realtime-scheduling = "yes"; }''; }; }; diff --git a/nixos/modules/config/system-path.nix b/nixos/modules/config/system-path.nix index 27d1cef849bc0..aee7a041d043e 100644 --- a/nixos/modules/config/system-path.nix +++ b/nixos/modules/config/system-path.nix @@ -144,6 +144,7 @@ in "/share/kservicetypes5" "/share/kxmlgui5" "/share/systemd" + "/share/thumbnailers" ]; system.path = pkgs.buildEnv { diff --git a/nixos/modules/config/update-users-groups.pl b/nixos/modules/config/update-users-groups.pl index fd3affae899cc..44040217b0271 100644 --- a/nixos/modules/config/update-users-groups.pl +++ b/nixos/modules/config/update-users-groups.pl @@ -209,10 +209,11 @@ foreach my $u (@{$spec->{users}}) { } } - # Create a home directory. + # Ensure home directory incl. ownership and permissions. if ($u->{createHome}) { make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home}; chown $u->{uid}, $u->{gid}, $u->{home}; + chmod 0700, $u->{home}; } if (defined $u->{passwordFile}) { @@ -226,6 +227,15 @@ foreach my $u (@{$spec->{users}}) { $u->{hashedPassword} = hashPassword($u->{password}); } + if (!defined $u->{shell}) { + if (defined $existing) { + $u->{shell} = $existing->{shell}; + } else { + warn "warning: no declarative or previous shell for ‘$name’, setting shell to nologin\n"; + $u->{shell} = "/run/current-system/sw/bin/nologin"; + } + } + $u->{fakePassword} = $existing->{fakePassword} // "x"; $usersOut{$name} = $u; diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix index 72285fe631dac..5b3e9a8ceb7f4 100644 --- a/nixos/modules/config/users-groups.nix +++ b/nixos/modules/config/users-groups.nix @@ -153,7 +153,7 @@ let }; shell = mkOption { - type = types.either types.shellPackage types.path; + type = types.nullOr (types.either types.shellPackage types.path); default = pkgs.shadow; defaultText = "pkgs.shadow"; example = literalExample "pkgs.bashInteractive"; @@ -198,10 +198,8 @@ let type = types.bool; default = false; description = '' - If true, the home directory will be created automatically. If this - option is true and the home directory already exists but is not - owned by the user, directory owner and group will be changed to - match the user. + Whether to create the home directory and ensure ownership as well as + permissions to match the user. ''; }; @@ -366,7 +364,7 @@ let count = mkOption { type = types.int; default = 1; - description = ''Count of subordinate user ids''; + description = "Count of subordinate user ids"; }; }; }; @@ -383,7 +381,7 @@ let count = mkOption { type = types.int; default = 1; - description = ''Count of subordinate group ids''; + description = "Count of subordinate group ids"; }; }; }; diff --git a/nixos/modules/config/xdg/portal.nix b/nixos/modules/config/xdg/portal.nix index 3c7cd729c60a6..80ec3126ca546 100644 --- a/nixos/modules/config/xdg/portal.nix +++ b/nixos/modules/config/xdg/portal.nix @@ -62,7 +62,7 @@ with lib; services.dbus.packages = packages; systemd.packages = packages; - environment.variables = { + environment.sessionVariables = { GTK_USE_PORTAL = mkIf cfg.gtkUsePortal "1"; XDG_DESKTOP_PORTAL_DIR = "${joinedPortals}/share/xdg-desktop-portal/portals"; }; diff --git a/nixos/modules/hardware/all-firmware.nix b/nixos/modules/hardware/all-firmware.nix index b07edb0f6acdf..8cf3e5633dc71 100644 --- a/nixos/modules/hardware/all-firmware.nix +++ b/nixos/modules/hardware/all-firmware.nix @@ -48,6 +48,7 @@ in { rtl8192su-firmware rt5677-firmware rtl8723bs-firmware + rtl8761b-firmware rtlwifi_new-firmware zd1211fw alsa-firmware diff --git a/nixos/modules/hardware/device-tree.nix b/nixos/modules/hardware/device-tree.nix index e0ab37bca63a5..4aa1d6369d1bb 100644 --- a/nixos/modules/hardware/device-tree.nix +++ b/nixos/modules/hardware/device-tree.nix @@ -68,11 +68,11 @@ let patchShebangs scripts/* substituteInPlace scripts/Makefile.lib \ --replace 'DTC_FLAGS += $(DTC_FLAGS_$(basetarget))' 'DTC_FLAGS += $(DTC_FLAGS_$(basetarget)) -@' - make ${pkgs.stdenv.hostPlatform.platform.kernelBaseConfig} ARCH="${pkgs.stdenv.hostPlatform.platform.kernelArch}" - make dtbs ARCH="${pkgs.stdenv.hostPlatform.platform.kernelArch}" + make ${pkgs.stdenv.hostPlatform.linux-kernel.baseConfig} ARCH="${pkgs.stdenv.hostPlatform.linuxArch}" + make dtbs ARCH="${pkgs.stdenv.hostPlatform.linuxArch}" ''; installPhase = '' - make dtbs_install INSTALL_DTBS_PATH=$out/dtbs ARCH="${pkgs.stdenv.hostPlatform.platform.kernelArch}" + make dtbs_install INSTALL_DTBS_PATH=$out/dtbs ARCH="${pkgs.stdenv.hostPlatform.linuxArch}" ''; }; @@ -115,7 +115,7 @@ in options = { hardware.deviceTree = { enable = mkOption { - default = pkgs.stdenv.hostPlatform.platform.kernelDTB or false; + default = pkgs.stdenv.hostPlatform.linux-kernel.DTB or false; type = types.bool; description = '' Build device tree files. These are used to describe the diff --git a/nixos/modules/hardware/keyboard/zsa.nix b/nixos/modules/hardware/keyboard/zsa.nix new file mode 100644 index 0000000000000..5cb09e5af499f --- /dev/null +++ b/nixos/modules/hardware/keyboard/zsa.nix @@ -0,0 +1,27 @@ +{ config, lib, pkgs, ... }: + +let + inherit (lib) mkOption mkIf types; + cfg = config.hardware.keyboard.zsa; +in +{ + # TODO: make group configurable like in https://github.com/NixOS/nixpkgs/blob/0b2b4b8c4e729535a61db56468809c5c2d3d175c/pkgs/tools/security/nitrokey-app/udev-rules.nix ? + options.hardware.keyboard.zsa = { + enable = mkOption { + type = types.bool; + default = false; + description = '' + Enables udev rules for keyboards from ZSA like the ErgoDox EZ, Planck EZ and Moonlander Mark I. + You need it when you want to flash a new configuration on the keyboard + or use their live training in the browser. + Access to the keyboard is granted to users in the "plugdev" group. + You may want to install the wally-cli package. + ''; + }; + }; + + config = mkIf cfg.enable { + services.udev.packages = [ pkgs.zsa-udev-rules ]; + users.groups.plugdev = {}; + }; +} diff --git a/nixos/modules/hardware/network/ath-user-regd.nix b/nixos/modules/hardware/network/ath-user-regd.nix new file mode 100644 index 0000000000000..b5ade5ed50105 --- /dev/null +++ b/nixos/modules/hardware/network/ath-user-regd.nix @@ -0,0 +1,31 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + kernelVersion = config.boot.kernelPackages.kernel.version; + linuxKernelMinVersion = "5.8"; + kernelPatch = pkgs.kernelPatches.ath_regd_optional // { + extraConfig = '' + ATH_USER_REGD y + ''; + }; +in +{ + options.networking.wireless.athUserRegulatoryDomain = mkOption { + default = false; + type = types.bool; + description = '' + If enabled, sets the ATH_USER_REGD kernel config switch to true to + disable the enforcement of EEPROM regulatory restrictions for ath + drivers. Requires at least Linux ${linuxKernelMinVersion}. + ''; + }; + + config = mkIf config.networking.wireless.athUserRegulatoryDomain { + assertions = singleton { + assertion = lessThan 0 (builtins.compareVersions kernelVersion linuxKernelMinVersion); + message = "ATH_USER_REGD patch for kernels older than ${linuxKernelMinVersion} not ported yet!"; + }; + boot.kernelPatches = [ kernelPatch ]; + }; +} diff --git a/nixos/modules/hardware/nitrokey.nix b/nixos/modules/hardware/nitrokey.nix index 02e4c3f46f8d2..baa07203118c6 100644 --- a/nixos/modules/hardware/nitrokey.nix +++ b/nixos/modules/hardware/nitrokey.nix @@ -19,23 +19,9 @@ in nitrokey-app package, depending on your device and needs. ''; }; - - group = mkOption { - type = types.str; - default = "nitrokey"; - example = "wheel"; - description = '' - Grant access to Nitrokey devices to users in this group. - ''; - }; }; config = mkIf cfg.enable { - services.udev.packages = [ - (pkgs.nitrokey-udev-rules.override (attrs: - { inherit (cfg) group; } - )) - ]; - users.groups.${cfg.group} = {}; + services.udev.packages = [ pkgs.nitrokey-udev-rules ]; }; } diff --git a/nixos/modules/hardware/opentabletdriver.nix b/nixos/modules/hardware/opentabletdriver.nix new file mode 100644 index 0000000000000..295e23e6164fa --- /dev/null +++ b/nixos/modules/hardware/opentabletdriver.nix @@ -0,0 +1,69 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.hardware.opentabletdriver; +in +{ + meta.maintainers = with lib.maintainers; [ thiagokokada ]; + + options = { + hardware.opentabletdriver = { + enable = mkOption { + default = false; + type = types.bool; + description = '' + Enable OpenTabletDriver udev rules, user service and blacklist kernel + modules known to conflict with OpenTabletDriver. + ''; + }; + + blacklistedKernelModules = mkOption { + type = types.listOf types.str; + default = [ "hid-uclogic" "wacom" ]; + description = '' + Blacklist of kernel modules known to conflict with OpenTabletDriver. + ''; + }; + + package = mkOption { + type = types.package; + default = pkgs.opentabletdriver; + defaultText = "pkgs.opentabletdriver"; + description = '' + OpenTabletDriver derivation to use. + ''; + }; + + daemon = { + enable = mkOption { + default = true; + type = types.bool; + description = '' + Whether to start OpenTabletDriver daemon as a systemd user service. + ''; + }; + }; + }; + }; + + config = mkIf cfg.enable { + environment.systemPackages = [ cfg.package ]; + + services.udev.packages = [ cfg.package ]; + + boot.blacklistedKernelModules = cfg.blacklistedKernelModules; + + systemd.user.services.opentabletdriver = with pkgs; mkIf cfg.daemon.enable { + description = "Open source, cross-platform, user-mode tablet driver"; + wantedBy = [ "graphical-session.target" ]; + partOf = [ "graphical-session.target" ]; + + serviceConfig = { + Type = "simple"; + ExecStart = "${cfg.package}/bin/otd-daemon -c ${cfg.package}/lib/OpenTabletDriver/Configurations"; + Restart = "on-failure"; + }; + }; + }; +} diff --git a/nixos/modules/hardware/sensor/hddtemp.nix b/nixos/modules/hardware/sensor/hddtemp.nix new file mode 100644 index 0000000000000..df3f75e229a2f --- /dev/null +++ b/nixos/modules/hardware/sensor/hddtemp.nix @@ -0,0 +1,81 @@ +{ config, lib, pkgs, ... }: +let + inherit (lib) mkIf mkOption types; + + cfg = config.hardware.sensor.hddtemp; + + wrapper = pkgs.writeShellScript "hddtemp-wrapper" '' + set -eEuo pipefail + + file=/var/lib/hddtemp/hddtemp.db + + drives=(${toString (map (e: ''$(realpath ${lib.escapeShellArg e}) '') cfg.drives)}) + + cp ${pkgs.hddtemp}/share/hddtemp/hddtemp.db $file + ${lib.concatMapStringsSep "\n" (e: "echo ${lib.escapeShellArg e} >> $file") cfg.dbEntries} + + exec ${pkgs.hddtemp}/bin/hddtemp ${lib.escapeShellArgs cfg.extraArgs} \ + --daemon \ + --unit=${cfg.unit} \ + --file=$file \ + ''${drives[@]} + ''; + +in +{ + meta.maintainers = with lib.maintainers; [ peterhoeg ]; + + ###### interface + + options = { + hardware.sensor.hddtemp = { + enable = mkOption { + description = '' + Enable this option to support HDD/SSD temperature sensors. + ''; + type = types.bool; + default = false; + }; + + drives = mkOption { + description = "List of drives to monitor. If you pass /dev/disk/by-path/* entries the symlinks will be resolved as hddtemp doesn't like names with colons."; + type = types.listOf types.str; + }; + + unit = mkOption { + description = "Celcius or Fahrenheit"; + type = types.enum [ "C" "F" ]; + default = "C"; + }; + + dbEntries = mkOption { + description = "Additional DB entries"; + type = types.listOf types.str; + default = [ ]; + }; + + extraArgs = mkOption { + description = "Additional arguments passed to the daemon."; + type = types.listOf types.str; + default = [ ]; + }; + }; + }; + + ###### implementation + + config = mkIf cfg.enable { + systemd.services.hddtemp = { + description = "HDD/SSD temperature"; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "forking"; + ExecStart = wrapper; + StateDirectory = "hddtemp"; + PrivateTmp = true; + ProtectHome = "tmpfs"; + ProtectSystem = "strict"; + }; + }; + }; +} diff --git a/nixos/modules/hardware/video/bumblebee.nix b/nixos/modules/hardware/video/bumblebee.nix index 2278c7b406117..b6af4f80445ab 100644 --- a/nixos/modules/hardware/video/bumblebee.nix +++ b/nixos/modules/hardware/video/bumblebee.nix @@ -40,7 +40,7 @@ in default = "wheel"; example = "video"; type = types.str; - description = ''Group for bumblebee socket''; + description = "Group for bumblebee socket"; }; connectDisplay = mkOption { diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix index d1cf7d05c1b8e..97accc7b99a03 100644 --- a/nixos/modules/hardware/video/nvidia.nix +++ b/nixos/modules/hardware/video/nvidia.nix @@ -5,36 +5,17 @@ with lib; let - - drivers = config.services.xserver.videoDrivers; - - # FIXME: should introduce an option like - # ‘hardware.video.nvidia.package’ for overriding the default NVIDIA - # driver. - nvidiaForKernel = kernelPackages: - if elem "nvidia" drivers then - kernelPackages.nvidia_x11 - else if elem "nvidiaBeta" drivers then - kernelPackages.nvidia_x11_beta - else if elem "nvidiaVulkanBeta" drivers then - kernelPackages.nvidia_x11_vulkan_beta - else if elem "nvidiaLegacy304" drivers then - kernelPackages.nvidia_x11_legacy304 - else if elem "nvidiaLegacy340" drivers then - kernelPackages.nvidia_x11_legacy340 - else if elem "nvidiaLegacy390" drivers then - kernelPackages.nvidia_x11_legacy390 - else null; - - nvidia_x11 = nvidiaForKernel config.boot.kernelPackages; - nvidia_libs32 = - if versionOlder nvidia_x11.version "391" then - ((nvidiaForKernel pkgs.pkgsi686Linux.linuxPackages).override { libsOnly = true; kernel = null; }).out - else - (nvidiaForKernel config.boot.kernelPackages).lib32; + nvidia_x11 = let + drivers = config.services.xserver.videoDrivers; + isDeprecated = str: (hasPrefix "nvidia" str) && (str != "nvidia"); + hasDeprecated = drivers: any isDeprecated drivers; + in if (hasDeprecated drivers) then + throw '' + Selecting an nvidia driver has been modified for NixOS 19.03. The version is now set using `hardware.nvidia.package`. + '' + else if (elem "nvidia" drivers) then cfg.package else null; enabled = nvidia_x11 != null; - cfg = config.hardware.nvidia; pCfg = cfg.prime; @@ -63,6 +44,15 @@ in ''; }; + hardware.nvidia.powerManagement.finegrained = mkOption { + type = types.bool; + default = false; + description = '' + Experimental power management of PRIME offload. For more information, see + the NVIDIA docs, chapter 22. PCI-Express runtime power management. + ''; + }; + hardware.nvidia.modesetting.enable = mkOption { type = types.bool; default = false; @@ -96,6 +86,16 @@ in ''; }; + hardware.nvidia.prime.amdgpuBusId = mkOption { + type = types.str; + default = ""; + example = "PCI:4:0:0"; + description = '' + Bus ID of the AMD APU. You can find it using lspci; for example if lspci + shows the AMD APU at "04:00.0", set this option to "PCI:4:0:0". + ''; + }; + hardware.nvidia.prime.sync.enable = mkOption { type = types.bool; default = false; @@ -151,9 +151,22 @@ in GPUs stay awake even during headless mode. ''; }; + + hardware.nvidia.package = lib.mkOption { + type = lib.types.package; + default = config.boot.kernelPackages.nvidiaPackages.stable; + defaultText = "config.boot.kernelPackages.nvidiaPackages.stable"; + description = '' + The NVIDIA X11 derivation to use. + ''; + example = "config.boot.kernelPackages.nvidiaPackages.legacy340"; + }; }; - config = mkIf enabled { + config = let + igpuDriver = if pCfg.intelBusId != "" then "modesetting" else "amdgpu"; + igpuBusId = if pCfg.intelBusId != "" then pCfg.intelBusId else pCfg.amdgpuBusId; + in mkIf enabled { assertions = [ { assertion = with config.services.xserver.displayManager; gdm.nvidiaWayland -> cfg.modesetting.enable; @@ -161,7 +174,13 @@ in } { - assertion = primeEnabled -> pCfg.nvidiaBusId != "" && pCfg.intelBusId != ""; + assertion = primeEnabled -> pCfg.intelBusId == "" || pCfg.amdgpuBusId == ""; + message = '' + You cannot configure both an Intel iGPU and an AMD APU. Pick the one corresponding to your processor. + ''; + } + { + assertion = primeEnabled -> pCfg.nvidiaBusId != "" && (pCfg.intelBusId != "" || pCfg.amdgpuBusId != ""); message = '' When NVIDIA PRIME is enabled, the GPU bus IDs must configured. ''; @@ -174,6 +193,14 @@ in assertion = !(syncCfg.enable && offloadCfg.enable); message = "Only one NVIDIA PRIME solution may be used at a time."; } + { + assertion = !(syncCfg.enable && cfg.powerManagement.finegrained); + message = "Sync precludes powering down the NVIDIA GPU."; + } + { + assertion = cfg.powerManagement.enable -> offloadCfg.enable; + message = "Fine-grained power management requires offload to be enabled."; + } ]; # If Optimus/PRIME is enabled, we: @@ -183,18 +210,22 @@ in # "nvidia" driver, in order to allow the X server to start without any outputs. # - Add a separate Device section for the Intel GPU, using the "modesetting" # driver and with the configured BusID. + # - OR add a separate Device section for the AMD APU, using the "amdgpu" + # driver and with the configures BusID. # - Reference that Device section from the ServerLayout section as an inactive # device. # - Configure the display manager to run specific `xrandr` commands which will - # configure/enable displays connected to the Intel GPU. + # configure/enable displays connected to the Intel iGPU / AMD APU. services.xserver.useGlamor = mkDefault offloadCfg.enable; - services.xserver.drivers = optional primeEnabled { - name = "modesetting"; + services.xserver.drivers = let + in optional primeEnabled { + name = igpuDriver; display = offloadCfg.enable; + modules = optional (igpuDriver == "amdgpu") [ pkgs.xorg.xf86videoamdgpu ]; deviceSection = '' - BusID "${pCfg.intelBusId}" + BusID "${igpuBusId}" ${optionalString syncCfg.enable ''Option "AccelMethod" "none"''} ''; } ++ singleton { @@ -205,6 +236,7 @@ in '' BusID "${pCfg.nvidiaBusId}" ${optionalString syncCfg.allowExternalGpu "Option \"AllowExternalGpus\""} + ${optionalString cfg.powerManagement.finegrained "Option \"NVreg_DynamicPowerManagement=0x02\""} ''; screenSection = '' @@ -214,14 +246,14 @@ in }; services.xserver.serverLayoutSection = optionalString syncCfg.enable '' - Inactive "Device-modesetting[0]" + Inactive "Device-${igpuDriver}[0]" '' + optionalString offloadCfg.enable '' Option "AllowNVIDIAGPUScreens" ''; services.xserver.displayManager.setupCommands = optionalString syncCfg.enable '' # Added by nvidia configuration module for Optimus/PRIME. - ${pkgs.xorg.xrandr}/bin/xrandr --setprovideroutputsource modesetting NVIDIA-0 + ${pkgs.xorg.xrandr}/bin/xrandr --setprovideroutputsource ${igpuDriver} NVIDIA-0 ${pkgs.xorg.xrandr}/bin/xrandr --auto ''; @@ -230,9 +262,9 @@ in }; hardware.opengl.package = mkIf (!offloadCfg.enable) nvidia_x11.out; - hardware.opengl.package32 = mkIf (!offloadCfg.enable) nvidia_libs32; + hardware.opengl.package32 = mkIf (!offloadCfg.enable) nvidia_x11.lib32; hardware.opengl.extraPackages = optional offloadCfg.enable nvidia_x11.out; - hardware.opengl.extraPackages32 = optional offloadCfg.enable nvidia_libs32; + hardware.opengl.extraPackages32 = optional offloadCfg.enable nvidia_x11.lib32; environment.systemPackages = [ nvidia_x11.bin nvidia_x11.settings ] ++ optionals nvidiaPersistencedEnabled [ nvidia_x11.persistenced ]; @@ -292,16 +324,37 @@ in boot.kernelParams = optional (offloadCfg.enable || cfg.modesetting.enable) "nvidia-drm.modeset=1" ++ optional cfg.powerManagement.enable "nvidia.NVreg_PreserveVideoMemoryAllocations=1"; - # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded. services.udev.extraRules = '' + # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded. KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c $$(grep nvidia-frontend /proc/devices | cut -d \ -f 1) 255'" KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c $$(grep nvidia-frontend /proc/devices | cut -d \ -f 1) 254'" KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia%n c $$(grep nvidia-frontend /proc/devices | cut -d \ -f 1) %n'" KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm c $$(grep nvidia-uvm /proc/devices | cut -d \ -f 1) 0'" KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \ -f 1) 0'" + '' + optionalString cfg.powerManagement.finegrained '' + # Remove NVIDIA USB xHCI Host Controller devices, if present + ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c0330", ATTR{remove}="1" + + # Remove NVIDIA USB Type-C UCSI devices, if present + ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c8000", ATTR{remove}="1" + + # Remove NVIDIA Audio devices, if present + ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x040300", ATTR{remove}="1" + + # Enable runtime PM for NVIDIA VGA/3D controller devices on driver bind + ACTION=="bind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030000", TEST=="power/control", ATTR{power/control}="auto" + ACTION=="bind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030200", TEST=="power/control", ATTR{power/control}="auto" + + # Disable runtime PM for NVIDIA VGA/3D controller devices on driver unbind + ACTION=="unbind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030000", TEST=="power/control", ATTR{power/control}="on" + ACTION=="unbind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030200", TEST=="power/control", ATTR{power/control}="on" ''; + boot.extraModprobeConfig = mkIf cfg.powerManagement.finegrained '' + options nvidia "NVreg_DynamicPowerManagement=0x02" + ''; + boot.blacklistedKernelModules = [ "nouveau" "nvidiafb" ]; services.acpid.enable = true; diff --git a/nixos/modules/hardware/video/switcheroo-control.nix b/nixos/modules/hardware/video/switcheroo-control.nix new file mode 100644 index 0000000000000..199adb2ad8f52 --- /dev/null +++ b/nixos/modules/hardware/video/switcheroo-control.nix @@ -0,0 +1,18 @@ +{ config, pkgs, lib, ... }: + +with lib; +let + pkg = [ pkgs.switcheroo-control ]; + cfg = config.services.switcherooControl; +in { + options.services.switcherooControl = { + enable = mkEnableOption "switcheroo-control, a D-Bus service to check the availability of dual-GPU"; + }; + + config = mkIf cfg.enable { + services.dbus.packages = pkg; + environment.systemPackages = pkg; + systemd.packages = pkg; + systemd.targets.multi-user.wants = [ "switcheroo-control.service" ]; + }; +} diff --git a/nixos/modules/i18n/input-method/default.nix b/nixos/modules/i18n/input-method/default.nix index 0d6dd3399bfce..4649f9b862a5a 100644 --- a/nixos/modules/i18n/input-method/default.nix +++ b/nixos/modules/i18n/input-method/default.nix @@ -29,7 +29,7 @@ in options.i18n = { inputMethod = { enabled = mkOption { - type = types.nullOr (types.enum [ "ibus" "fcitx" "nabi" "uim" "hime" ]); + type = types.nullOr (types.enum [ "ibus" "fcitx" "fcitx5" "nabi" "uim" "hime" ]); default = null; example = "fcitx"; description = '' @@ -42,6 +42,7 @@ in <itemizedlist> <listitem><para>ibus: The intelligent input bus, extra input engines can be added using <literal>i18n.inputMethod.ibus.engines</literal>.</para></listitem> <listitem><para>fcitx: A customizable lightweight input method, extra input engines can be added using <literal>i18n.inputMethod.fcitx.engines</literal>.</para></listitem> + <listitem><para>fcitx5: The next generation of fcitx, addons (including engines, dictionaries, skins) can be added using <literal>i18n.inputMethod.fcitx5.addons</literal>.</para></listitem> <listitem><para>nabi: A Korean input method based on XIM. Nabi doesn't support Qt 5.</para></listitem> <listitem><para>uim: The universal input method, is a library with a XIM bridge. uim mainly support Chinese, Japanese and Korean.</para></listitem> <listitem><para>hime: An extremely easy-to-use input method framework.</para></listitem> diff --git a/nixos/modules/i18n/input-method/fcitx5.nix b/nixos/modules/i18n/input-method/fcitx5.nix new file mode 100644 index 0000000000000..44962d202fe16 --- /dev/null +++ b/nixos/modules/i18n/input-method/fcitx5.nix @@ -0,0 +1,33 @@ +{ config, pkgs, lib, ... }: + +with lib; + +let + im = config.i18n.inputMethod; + cfg = im.fcitx5; + fcitx5Package = pkgs.fcitx5-with-addons.override { inherit (cfg) addons; }; +in + { + options = { + i18n.inputMethod.fcitx5 = { + addons = mkOption { + type = with types; listOf package; + default = []; + example = with pkgs; [ fcitx5-rime ]; + description = '' + Enabled Fcitx5 addons. + ''; + }; + }; + }; + + config = mkIf (im.enabled == "fcitx5") { + i18n.inputMethod.package = fcitx5Package; + + environment.variables = { + GTK_IM_MODULE = "fcitx"; + QT_IM_MODULE = "fcitx"; + XMODIFIERS = "@im=fcitx"; + }; + }; + } diff --git a/nixos/modules/i18n/input-method/ibus.nix b/nixos/modules/i18n/input-method/ibus.nix index cf24ecf586316..1aaa5a952bea2 100644 --- a/nixos/modules/i18n/input-method/ibus.nix +++ b/nixos/modules/i18n/input-method/ibus.nix @@ -48,7 +48,7 @@ in panel = mkOption { type = with types; nullOr path; default = null; - example = literalExample "''${pkgs.plasma5.plasma-desktop}/lib/libexec/kimpanel-ibus-panel"; + example = literalExample "''${pkgs.plasma5Packages.plasma-desktop}/lib/libexec/kimpanel-ibus-panel"; description = "Replace the IBus panel with another panel."; }; }; diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix index 405fbfa10dbfd..1418420afcd98 100644 --- a/nixos/modules/installer/cd-dvd/iso-image.nix +++ b/nixos/modules/installer/cd-dvd/iso-image.nix @@ -143,6 +143,13 @@ let LINUX /boot/${config.system.boot.loader.kernelFile} APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} loglevel=7 INITRD /boot/${config.system.boot.loader.initrdFile} + + # A variant to boot with a serial console enabled + LABEL boot-serial + MENU LABEL NixOS ${config.system.nixos.label}${config.isoImage.appendToMenuLabel} (serial console=ttyS0,115200n8) + LINUX /boot/${config.system.boot.loader.kernelFile} + APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} console=ttyS0,115200n8 + INITRD /boot/${config.system.boot.loader.initrdFile} ''; isolinuxMemtest86Entry = '' @@ -418,7 +425,12 @@ in }; isoImage.squashfsCompression = mkOption { - default = "xz -Xdict-size 100%"; + default = with pkgs.stdenv.targetPlatform; "xz -Xdict-size 100% " + + lib.optionalString (isx86_32 || isx86_64) "-Xbcj x86" + # Untested but should also reduce size for these platforms + + lib.optionalString (isAarch32 || isAarch64) "-Xbcj arm" + + lib.optionalString (isPowerPC) "-Xbcj powerpc" + + lib.optionalString (isSparc) "-Xbcj sparc"; description = '' Compression settings to use for the squashfs nix store. ''; diff --git a/nixos/modules/installer/cd-dvd/sd-image-aarch64.nix b/nixos/modules/installer/cd-dvd/sd-image-aarch64.nix index bef6cd2fb5a22..e4ec2d6240d02 100644 --- a/nixos/modules/installer/cd-dvd/sd-image-aarch64.nix +++ b/nixos/modules/installer/cd-dvd/sd-image-aarch64.nix @@ -17,8 +17,7 @@ # The serial ports listed here are: # - ttyS0: for Tegra (Jetson TX1) # - ttyAMA0: for QEMU's -machine virt - # Also increase the amount of CMA to ensure the virtual console on the RPi3 works. - boot.kernelParams = ["cma=32M" "console=ttyS0,115200n8" "console=ttyAMA0,115200n8" "console=tty0"]; + boot.kernelParams = ["console=ttyS0,115200n8" "console=ttyAMA0,115200n8" "console=tty0"]; boot.initrd.availableKernelModules = [ # Allows early (earlier) modesetting for the Raspberry Pi @@ -30,13 +29,25 @@ sdImage = { populateFirmwareCommands = let configTxt = pkgs.writeText "config.txt" '' + [pi3] kernel=u-boot-rpi3.bin + [pi4] + kernel=u-boot-rpi4.bin + enable_gic=1 + armstub=armstub8-gic.bin + + # Otherwise the resolution will be weird in most cases, compared to + # what the pi3 firmware does by default. + disable_overscan=1 + + [all] # Boot in 64-bit mode. - arm_control=0x200 + arm_64bit=1 - # U-Boot used to need this to work, regardless of whether UART is actually used or not. - # TODO: check when/if this can be removed. + # U-Boot needs this to work, regardless of whether UART is actually used or not. + # Look in arch/arm/mach-bcm283x/Kconfig in the U-Boot tree to see if this is still + # a requirement in the future. enable_uart=1 # Prevent the firmware from smashing the framebuffer setup done by the mainline kernel @@ -45,8 +56,17 @@ ''; in '' (cd ${pkgs.raspberrypifw}/share/raspberrypi/boot && cp bootcode.bin fixup*.dat start*.elf $NIX_BUILD_TOP/firmware/) - cp ${pkgs.ubootRaspberryPi3_64bit}/u-boot.bin firmware/u-boot-rpi3.bin + + # Add the config cp ${configTxt} firmware/config.txt + + # Add pi3 specific files + cp ${pkgs.ubootRaspberryPi3_64bit}/u-boot.bin firmware/u-boot-rpi3.bin + + # Add pi4 specific files + cp ${pkgs.ubootRaspberryPi4_64bit}/u-boot.bin firmware/u-boot-rpi4.bin + cp ${pkgs.raspberrypi-armstubs}/armstub8-gic.bin firmware/armstub8-gic.bin + cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2711-rpi-4-b.dtb firmware/ ''; populateRootCommands = '' mkdir -p ./files/boot diff --git a/nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix b/nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix index 87545e8420308..5bdec7de86e8a 100644 --- a/nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix +++ b/nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix @@ -3,36 +3,6 @@ { config, lib, pkgs, ... }: { - imports = [ - ../../profiles/base.nix - ../../profiles/installation-device.nix - ./sd-image.nix - ]; - - boot.loader.grub.enable = false; - boot.loader.raspberryPi.enable = true; - boot.loader.raspberryPi.version = 4; + imports = [ ./sd-image-aarch64.nix ]; boot.kernelPackages = pkgs.linuxPackages_rpi4; - - boot.consoleLogLevel = lib.mkDefault 7; - - sdImage = { - firmwareSize = 128; - firmwarePartitionName = "NIXOS_BOOT"; - # This is a hack to avoid replicating config.txt from boot.loader.raspberryPi - populateFirmwareCommands = - "${config.system.build.installBootLoader} ${config.system.build.toplevel} -d ./firmware"; - # As the boot process is done entirely in the firmware partition. - populateRootCommands = ""; - }; - - fileSystems."/boot/firmware" = { - # This effectively "renames" the attrsOf entry set in sd-image.nix - mountPoint = "/boot"; - neededForBoot = true; - }; - - # the installation media is also the installation target, - # so we don't want to provide the installation configuration.nix. - installer.cloneConfig = false; } diff --git a/nixos/modules/installer/cd-dvd/sd-image.nix b/nixos/modules/installer/cd-dvd/sd-image.nix index d9799aa69c957..b811ae07eb033 100644 --- a/nixos/modules/installer/cd-dvd/sd-image.nix +++ b/nixos/modules/installer/cd-dvd/sd-image.nix @@ -223,9 +223,10 @@ in # Figure out device names for the boot device and root filesystem. rootPart=$(${pkgs.util-linux}/bin/findmnt -n -o SOURCE /) bootDevice=$(lsblk -npo PKNAME $rootPart) + partNum=$(lsblk -npo MAJ:MIN $rootPart | ${pkgs.gawk}/bin/awk -F: '{print $2}') # Resize the root partition and the filesystem to fit the disk - echo ",+," | sfdisk -N2 --no-reread $bootDevice + echo ",+," | sfdisk -N$partNum --no-reread $bootDevice ${pkgs.parted}/bin/partprobe ${pkgs.e2fsprogs}/bin/resize2fs $rootPart diff --git a/nixos/modules/installer/cd-dvd/system-tarball-fuloong2f.nix b/nixos/modules/installer/cd-dvd/system-tarball-fuloong2f.nix index 6d4ba96dba0c1..8159576a62ac7 100644 --- a/nixos/modules/installer/cd-dvd/system-tarball-fuloong2f.nix +++ b/nixos/modules/installer/cd-dvd/system-tarball-fuloong2f.nix @@ -104,7 +104,7 @@ in ''; # Some more help text. - services.mingetty.helpLine = + services.getty.helpLine = '' Log in as "root" with an empty password. ${ diff --git a/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix b/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix index 0e67ae7de6980..95579f3ca06d2 100644 --- a/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix +++ b/nixos/modules/installer/cd-dvd/system-tarball-sheevaplug.nix @@ -122,7 +122,7 @@ in device = "/dev/something"; }; - services.mingetty = { + services.getty = { # Some more help text. helpLine = '' Log in as "root" with an empty password. ${ diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix index 95eba86bcb654..fa074fdfcc6ea 100644 --- a/nixos/modules/installer/netboot/netboot.nix +++ b/nixos/modules/installer/netboot/netboot.nix @@ -88,7 +88,7 @@ with lib; system.build.netbootIpxeScript = pkgs.writeTextDir "netboot.ipxe" '' #!ipxe - kernel ${pkgs.stdenv.hostPlatform.platform.kernelTarget} init=${config.system.build.toplevel}/init initrd=initrd ${toString config.boot.kernelParams} + kernel ${pkgs.stdenv.hostPlatform.linux-kernel.target} init=${config.system.build.toplevel}/init initrd=initrd ${toString config.boot.kernelParams} initrd initrd boot ''; diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix index 699fb555615be..6b1f54beee2ea 100644 --- a/nixos/modules/installer/tools/nix-fallback-paths.nix +++ b/nixos/modules/installer/tools/nix-fallback-paths.nix @@ -1,6 +1,6 @@ { - x86_64-linux = "/nix/store/fwak7l5jjl0py4wldsqjbv7p7rdzql0b-nix-2.3.9"; - i686-linux = "/nix/store/jlqrx9zw3vkwcczndaar5ban1j8g519z-nix-2.3.9"; - aarch64-linux = "/nix/store/kzvpzlm12185hw27l5znrprgvcja54d0-nix-2.3.9"; - x86_64-darwin = "/nix/store/kanh3awpf370pxfnjfvkh2m343wr3hj0-nix-2.3.9"; + x86_64-linux = "/nix/store/iwfs2bfcy7lqwhri94p2i6jc87ih55zk-nix-2.3.10"; + i686-linux = "/nix/store/a3ccfvy9i5n418d5v0bir330kbcz3vj8-nix-2.3.10"; + aarch64-linux = "/nix/store/bh5g6cv7bv35iz853d3xv2sphn51ybmb-nix-2.3.10"; + x86_64-darwin = "/nix/store/8c98r6zlwn2d40qm7jnnrr2rdlqviszr-nix-2.3.10"; } diff --git a/nixos/modules/installer/tools/nixos-enter.sh b/nixos/modules/installer/tools/nixos-enter.sh index c72ef6e9c28b3..450d776181489 100644 --- a/nixos/modules/installer/tools/nixos-enter.sh +++ b/nixos/modules/installer/tools/nixos-enter.sh @@ -69,6 +69,9 @@ mount --rbind /sys "$mountPoint/sys" # Run the activation script. Set $LOCALE_ARCHIVE to supress some Perl locale warnings. LOCALE_ARCHIVE="$system/sw/lib/locale/locale-archive" chroot "$mountPoint" "$system/activate" 1>&2 || true + + # Create /tmp + chroot "$mountPoint" systemd-tmpfiles --create --remove --exclude-prefix=/dev 1>&2 || true ) exec chroot "$mountPoint" "${command[@]}" diff --git a/nixos/modules/installer/tools/nixos-option/default.nix b/nixos/modules/installer/tools/nixos-option/default.nix index 753fd92c7bbf6..72eec3a383634 100644 --- a/nixos/modules/installer/tools/nixos-option/default.nix +++ b/nixos/modules/installer/tools/nixos-option/default.nix @@ -1,11 +1,11 @@ -{lib, stdenv, boost, cmake, pkgconfig, nix, ... }: +{lib, stdenv, boost, cmake, pkg-config, nix, ... }: stdenv.mkDerivation rec { name = "nixos-option"; src = ./.; - nativeBuildInputs = [ cmake pkgconfig ]; + nativeBuildInputs = [ cmake pkg-config ]; buildInputs = [ boost nix ]; - meta = { - license = stdenv.lib.licenses.lgpl2Plus; - maintainers = with lib.maintainers; [ chkno ]; + meta = with lib; { + license = licenses.lgpl2Plus; + maintainers = with maintainers; [ chkno ]; }; } diff --git a/nixos/modules/installer/tools/nixos-rebuild.sh b/nixos/modules/installer/tools/nixos-rebuild.sh deleted file mode 100644 index e452e24d263d0..0000000000000 --- a/nixos/modules/installer/tools/nixos-rebuild.sh +++ /dev/null @@ -1,506 +0,0 @@ -#! @runtimeShell@ - -if [ -x "@runtimeShell@" ]; then export SHELL="@runtimeShell@"; fi; - -set -e -set -o pipefail - -export PATH=@path@:$PATH - -showSyntax() { - exec man nixos-rebuild - exit 1 -} - - -# Parse the command line. -origArgs=("$@") -extraBuildFlags=() -lockFlags=() -flakeFlags=() -action= -buildNix=1 -fast= -rollback= -upgrade= -upgrade_all= -repair= -profile=/nix/var/nix/profiles/system -buildHost= -targetHost= -maybeSudo=() - -while [ "$#" -gt 0 ]; do - i="$1"; shift 1 - case "$i" in - --help) - showSyntax - ;; - switch|boot|test|build|edit|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader) - if [ "$i" = dry-run ]; then i=dry-build; fi - action="$i" - ;; - --install-grub) - echo "$0: --install-grub deprecated, use --install-bootloader instead" >&2 - export NIXOS_INSTALL_BOOTLOADER=1 - ;; - --install-bootloader) - export NIXOS_INSTALL_BOOTLOADER=1 - ;; - --no-build-nix) - buildNix= - ;; - --rollback) - rollback=1 - ;; - --upgrade) - upgrade=1 - ;; - --upgrade-all) - upgrade=1 - upgrade_all=1 - ;; - --repair) - repair=1 - extraBuildFlags+=("$i") - ;; - --max-jobs|-j|--cores|-I|--builders) - j="$1"; shift 1 - extraBuildFlags+=("$i" "$j") - ;; - --show-trace|--keep-failed|-K|--keep-going|-k|--verbose|-v|-vv|-vvv|-vvvv|-vvvvv|--fallback|--repair|--no-build-output|-Q|-j*|-L|--refresh|--no-net|--impure) - extraBuildFlags+=("$i") - ;; - --option) - j="$1"; shift 1 - k="$1"; shift 1 - extraBuildFlags+=("$i" "$j" "$k") - ;; - --fast) - buildNix= - fast=1 - extraBuildFlags+=(--show-trace) - ;; - --profile-name|-p) - if [ -z "$1" ]; then - echo "$0: ‘--profile-name’ requires an argument" - exit 1 - fi - if [ "$1" != system ]; then - profile="/nix/var/nix/profiles/system-profiles/$1" - mkdir -p -m 0755 "$(dirname "$profile")" - fi - shift 1 - ;; - --build-host|h) - buildHost="$1" - shift 1 - ;; - --target-host|t) - targetHost="$1" - shift 1 - ;; - --use-remote-sudo) - maybeSudo=(sudo --) - ;; - --flake) - flake="$1" - flakeFlags=(--experimental-features 'nix-command flakes') - shift 1 - ;; - --recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file) - lockFlags+=("$i") - ;; - --update-input) - j="$1"; shift 1 - lockFlags+=("$i" "$j") - ;; - --override-input) - j="$1"; shift 1 - k="$1"; shift 1 - lockFlags+=("$i" "$j" "$k") - ;; - *) - echo "$0: unknown option \`$i'" - exit 1 - ;; - esac -done - -if [ -n "$SUDO_USER" ]; then - maybeSudo=(sudo --) -fi - -if [ -z "$buildHost" -a -n "$targetHost" ]; then - buildHost="$targetHost" -fi -if [ "$targetHost" = localhost ]; then - targetHost= -fi -if [ "$buildHost" = localhost ]; then - buildHost= -fi - -buildHostCmd() { - if [ -z "$buildHost" ]; then - "$@" - elif [ -n "$remoteNix" ]; then - ssh $SSHOPTS "$buildHost" env PATH="$remoteNix:$PATH" "${maybeSudo[@]}" "$@" - else - ssh $SSHOPTS "$buildHost" "${maybeSudo[@]}" "$@" - fi -} - -targetHostCmd() { - if [ -z "$targetHost" ]; then - "${maybeSudo[@]}" "$@" - else - ssh $SSHOPTS "$targetHost" "${maybeSudo[@]}" "$@" - fi -} - -copyToTarget() { - if ! [ "$targetHost" = "$buildHost" ]; then - if [ -z "$targetHost" ]; then - NIX_SSHOPTS=$SSHOPTS nix-copy-closure --from "$buildHost" "$1" - elif [ -z "$buildHost" ]; then - NIX_SSHOPTS=$SSHOPTS nix-copy-closure --to "$targetHost" "$1" - else - buildHostCmd nix-copy-closure --to "$targetHost" "$1" - fi - fi -} - -nixBuild() { - if [ -z "$buildHost" ]; then - nix-build "$@" - else - local instArgs=() - local buildArgs=() - - while [ "$#" -gt 0 ]; do - local i="$1"; shift 1 - case "$i" in - -o) - local out="$1"; shift 1 - buildArgs+=("--add-root" "$out" "--indirect") - ;; - -A) - local j="$1"; shift 1 - instArgs+=("$i" "$j") - ;; - -I) # We don't want this in buildArgs - shift 1 - ;; - --no-out-link) # We don't want this in buildArgs - ;; - "<"*) # nix paths - instArgs+=("$i") - ;; - *) - buildArgs+=("$i") - ;; - esac - done - - local drv="$(nix-instantiate "${instArgs[@]}" "${extraBuildFlags[@]}")" - if [ -a "$drv" ]; then - NIX_SSHOPTS=$SSHOPTS nix-copy-closure --to "$buildHost" "$drv" - buildHostCmd nix-store -r "$drv" "${buildArgs[@]}" - else - echo "nix-instantiate failed" - exit 1 - fi - fi -} - - -if [ -z "$action" ]; then showSyntax; fi - -# Only run shell scripts from the Nixpkgs tree if the action is -# "switch", "boot", or "test". With other actions (such as "build"), -# the user may reasonably expect that no code from the Nixpkgs tree is -# executed, so it's safe to run nixos-rebuild against a potentially -# untrusted tree. -canRun= -if [ "$action" = switch -o "$action" = boot -o "$action" = test ]; then - canRun=1 -fi - - -# If ‘--upgrade’ or `--upgrade-all` is given, -# run ‘nix-channel --update nixos’. -if [[ -n $upgrade && -z $_NIXOS_REBUILD_REEXEC && -z $flake ]]; then - # If --upgrade-all is passed, or there are other channels that - # contain a file called ".update-on-nixos-rebuild", update them as - # well. Also upgrade the nixos channel. - - for channelpath in /nix/var/nix/profiles/per-user/root/channels/*; do - channel_name=$(basename "$channelpath") - - if [[ "$channel_name" == "nixos" ]]; then - nix-channel --update "$channel_name" - elif [ -e "$channelpath/.update-on-nixos-rebuild" ]; then - nix-channel --update "$channel_name" - elif [[ -n $upgrade_all ]] ; then - nix-channel --update "$channel_name" - fi - done -fi - -# Make sure that we use the Nix package we depend on, not something -# else from the PATH for nix-{env,instantiate,build}. This is -# important, because NixOS defaults the architecture of the rebuilt -# system to the architecture of the nix-* binaries used. So if on an -# amd64 system the user has an i686 Nix package in her PATH, then we -# would silently downgrade the whole system to be i686 NixOS on the -# next reboot. -if [ -z "$_NIXOS_REBUILD_REEXEC" ]; then - export PATH=@nix@/bin:$PATH -fi - -# Use /etc/nixos/flake.nix if it exists. It can be a symlink to the -# actual flake. -if [[ -z $flake && -e /etc/nixos/flake.nix ]]; then - flake="$(dirname "$(readlink -f /etc/nixos/flake.nix)")" -fi - -# Re-execute nixos-rebuild from the Nixpkgs tree. -# FIXME: get nixos-rebuild from $flake. -if [[ -z $_NIXOS_REBUILD_REEXEC && -n $canRun && -z $fast && -z $flake ]]; then - if p=$(nix-build --no-out-link --expr 'with import <nixpkgs/nixos> {}; config.system.build.nixos-rebuild' "${extraBuildFlags[@]}"); then - export _NIXOS_REBUILD_REEXEC=1 - exec $p/bin/nixos-rebuild "${origArgs[@]}" - exit 1 - fi -fi - -# For convenience, use the hostname as the default configuration to -# build from the flake. -if [[ -n $flake ]]; then - if [[ $flake =~ ^(.*)\#([^\#\"]*)$ ]]; then - flake="${BASH_REMATCH[1]}" - flakeAttr="${BASH_REMATCH[2]}" - fi - if [[ -z $flakeAttr ]]; then - read -r hostname < /proc/sys/kernel/hostname - if [[ -z $hostname ]]; then - hostname=default - fi - flakeAttr="nixosConfigurations.\"$hostname\"" - else - flakeAttr="nixosConfigurations.\"$flakeAttr\"" - fi -fi - -# Resolve the flake. -if [[ -n $flake ]]; then - flake=$(nix "${flakeFlags[@]}" flake info --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url) -fi - -# Find configuration.nix and open editor instead of building. -if [ "$action" = edit ]; then - if [[ -z $flake ]]; then - NIXOS_CONFIG=${NIXOS_CONFIG:-$(nix-instantiate --find-file nixos-config)} - if [[ -d $NIXOS_CONFIG ]]; then - NIXOS_CONFIG=$NIXOS_CONFIG/default.nix - fi - exec ${EDITOR:-nano} "$NIXOS_CONFIG" - else - exec nix "${flakeFlags[@]}" edit "${lockFlags[@]}" -- "$flake#$flakeAttr" - fi - exit 1 -fi - - -tmpDir=$(mktemp -t -d nixos-rebuild.XXXXXX) -SSHOPTS="$NIX_SSHOPTS -o ControlMaster=auto -o ControlPath=$tmpDir/ssh-%n -o ControlPersist=60" - -cleanup() { - for ctrl in "$tmpDir"/ssh-*; do - ssh -o ControlPath="$ctrl" -O exit dummyhost 2>/dev/null || true - done - rm -rf "$tmpDir" -} -trap cleanup EXIT - - - -# If the Nix daemon is running, then use it. This allows us to use -# the latest Nix from Nixpkgs (below) for expression evaluation, while -# still using the old Nix (via the daemon) for actual store access. -# This matters if the new Nix in Nixpkgs has a schema change. It -# would upgrade the schema, which should only happen once we actually -# switch to the new configuration. -# If --repair is given, don't try to use the Nix daemon, because the -# flag can only be used directly. -if [ -z "$repair" ] && systemctl show nix-daemon.socket nix-daemon.service | grep -q ActiveState=active; then - export NIX_REMOTE=${NIX_REMOTE-daemon} -fi - - -# First build Nix, since NixOS may require a newer version than the -# current one. -if [ -n "$rollback" -o "$action" = dry-build ]; then - buildNix= -fi - -nixSystem() { - machine="$(uname -m)" - if [[ "$machine" =~ i.86 ]]; then - machine=i686 - fi - echo $machine-linux -} - -prebuiltNix() { - machine="$1" - if [ "$machine" = x86_64 ]; then - echo @nix_x86_64_linux@ - elif [[ "$machine" =~ i.86 ]]; then - echo @nix_i686_linux@ - else - echo "$0: unsupported platform" - exit 1 - fi -} - -remotePATH= - -if [[ -n $buildNix && -z $flake ]]; then - echo "building Nix..." >&2 - nixDrv= - if ! nixDrv="$(nix-instantiate '<nixpkgs/nixos>' --add-root $tmpDir/nix.drv --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then - if ! nixDrv="$(nix-instantiate '<nixpkgs>' --add-root $tmpDir/nix.drv --indirect -A nix "${extraBuildFlags[@]}")"; then - if ! nixStorePath="$(nix-instantiate --eval '<nixpkgs/nixos/modules/installer/tools/nix-fallback-paths.nix>' -A $(nixSystem) | sed -e 's/^"//' -e 's/"$//')"; then - nixStorePath="$(prebuiltNix "$(uname -m)")" - fi - if ! nix-store -r $nixStorePath --add-root $tmpDir/nix --indirect \ - --option extra-binary-caches https://cache.nixos.org/; then - echo "warning: don't know how to get latest Nix" >&2 - fi - # Older version of nix-store -r don't support --add-root. - [ -e $tmpDir/nix ] || ln -sf $nixStorePath $tmpDir/nix - if [ -n "$buildHost" ]; then - remoteNixStorePath="$(prebuiltNix "$(buildHostCmd uname -m)")" - remoteNix="$remoteNixStorePath/bin" - if ! buildHostCmd nix-store -r $remoteNixStorePath \ - --option extra-binary-caches https://cache.nixos.org/ >/dev/null; then - remoteNix= - echo "warning: don't know how to get latest Nix" >&2 - fi - fi - fi - fi - if [ -a "$nixDrv" ]; then - nix-store -r "$nixDrv"'!'"out" --add-root $tmpDir/nix --indirect >/dev/null - if [ -n "$buildHost" ]; then - nix-copy-closure --to "$buildHost" "$nixDrv" - # The nix build produces multiple outputs, we add them all to the remote path - for p in $(buildHostCmd nix-store -r "$(readlink "$nixDrv")" "${buildArgs[@]}"); do - remoteNix="$remoteNix${remoteNix:+:}$p/bin" - done - fi - fi - PATH="$tmpDir/nix/bin:$PATH" -fi - - -# Update the version suffix if we're building from Git (so that -# nixos-version shows something useful). -if [[ -n $canRun && -z $flake ]]; then - if nixpkgs=$(nix-instantiate --find-file nixpkgs "${extraBuildFlags[@]}"); then - suffix=$($SHELL $nixpkgs/nixos/modules/installer/tools/get-version-suffix "${extraBuildFlags[@]}" || true) - if [ -n "$suffix" ]; then - echo -n "$suffix" > "$nixpkgs/.version-suffix" || true - fi - fi -fi - - -if [ "$action" = dry-build ]; then - extraBuildFlags+=(--dry-run) -fi - - -# Either upgrade the configuration in the system profile (for "switch" -# or "boot"), or just build it and create a symlink "result" in the -# current directory (for "build" and "test"). -if [ -z "$rollback" ]; then - echo "building the system configuration..." >&2 - if [ "$action" = switch -o "$action" = boot ]; then - if [[ -z $flake ]]; then - pathToConfig="$(nixBuild '<nixpkgs/nixos>' --no-out-link -A system "${extraBuildFlags[@]}")" - else - outLink=$tmpDir/result - nix "${flakeFlags[@]}" build "$flake#$flakeAttr.config.system.build.toplevel" \ - "${extraBuildFlags[@]}" "${lockFlags[@]}" --out-link $outLink - pathToConfig="$(readlink -f $outLink)" - fi - copyToTarget "$pathToConfig" - targetHostCmd nix-env -p "$profile" --set "$pathToConfig" - elif [ "$action" = test -o "$action" = build -o "$action" = dry-build -o "$action" = dry-activate ]; then - if [[ -z $flake ]]; then - pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")" - else - nix "${flakeFlags[@]}" build "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}" - pathToConfig="$(readlink -f ./result)" - fi - elif [ "$action" = build-vm ]; then - if [[ -z $flake ]]; then - pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")" - else - nix "${flakeFlags[@]}" build "$flake#$flakeAttr.config.system.build.vm" \ - "${extraBuildFlags[@]}" "${lockFlags[@]}" - pathToConfig="$(readlink -f ./result)" - fi - elif [ "$action" = build-vm-with-bootloader ]; then - if [[ -z $flake ]]; then - pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")" - else - nix "${flakeFlags[@]}" build "$flake#$flakeAttr.config.system.build.vmWithBootLoader" \ - "${extraBuildFlags[@]}" "${lockFlags[@]}" - pathToConfig="$(readlink -f ./result)" - fi - else - showSyntax - fi - # Copy build to target host if we haven't already done it - if ! [ "$action" = switch -o "$action" = boot ]; then - copyToTarget "$pathToConfig" - fi -else # [ -n "$rollback" ] - if [ "$action" = switch -o "$action" = boot ]; then - targetHostCmd nix-env --rollback -p "$profile" - pathToConfig="$profile" - elif [ "$action" = test -o "$action" = build ]; then - systemNumber=$( - targetHostCmd nix-env -p "$profile" --list-generations | - sed -n '/current/ {g; p;}; s/ *\([0-9]*\).*/\1/; h' - ) - pathToConfig="$profile"-${systemNumber}-link - if [ -z "$targetHost" ]; then - ln -sT "$pathToConfig" ./result - fi - else - showSyntax - fi -fi - - -# If we're not just building, then make the new configuration the boot -# default and/or activate it now. -if [ "$action" = switch -o "$action" = boot -o "$action" = test -o "$action" = dry-activate ]; then - if ! targetHostCmd $pathToConfig/bin/switch-to-configuration "$action"; then - echo "warning: error(s) occurred while switching to the new configuration" >&2 - exit 1 - fi -fi - - -if [ "$action" = build-vm ]; then - cat >&2 <<EOF - -Done. The virtual machine can be started by running $(echo $pathToConfig/bin/run-*-vm) -EOF -fi diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix index 0582812f92d24..ada5f57485612 100644 --- a/nixos/modules/installer/tools/tools.nix +++ b/nixos/modules/installer/tools/tools.nix @@ -28,17 +28,7 @@ let ]; }; - nixos-rebuild = - let fallback = import ./nix-fallback-paths.nix; in - makeProg { - name = "nixos-rebuild"; - src = ./nixos-rebuild.sh; - inherit (pkgs) runtimeShell; - nix = config.nix.package.out; - nix_x86_64_linux = fallback.x86_64-linux; - nix_i686_linux = fallback.i686-linux; - path = makeBinPath [ pkgs.jq ]; - }; + nixos-rebuild = pkgs.nixos-rebuild.override { nix = config.nix.package.out; }; nixos-generate-config = makeProg { name = "nixos-generate-config"; diff --git a/nixos/modules/misc/crashdump.nix b/nixos/modules/misc/crashdump.nix index 3c47e79d05128..11dec37b3fae1 100644 --- a/nixos/modules/misc/crashdump.nix +++ b/nixos/modules/misc/crashdump.nix @@ -26,6 +26,7 @@ in }; reservedMemory = mkOption { default = "128M"; + type = types.str; description = '' The amount of memory reserved for the crashdump kernel. If you choose a too high value, dmesg will mention diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix index bc43cc33b5d43..d81d6c6cb9b8c 100644 --- a/nixos/modules/misc/documentation.nix +++ b/nixos/modules/misc/documentation.nix @@ -217,7 +217,7 @@ in manualCache = pkgs.runCommandLocal "man-cache" { } '' echo "MANDB_MAP ${manualPages}/share/man $out" > man.conf - ${pkgs.man-db}/bin/mandb -C man.conf -psc + ${pkgs.man-db}/bin/mandb -C man.conf -psc >/dev/null 2>&1 ''; in '' @@ -261,7 +261,7 @@ in ++ optionals cfg.doc.enable ([ manual.manualHTML nixos-help ] ++ optionals config.services.xserver.enable [ pkgs.nixos-icons ]); - services.mingetty.helpLine = mkIf cfg.doc.enable ( + services.getty.helpLine = mkIf cfg.doc.enable ( "\nRun 'nixos-help' for the NixOS manual." ); }) diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix index cf0198d7b93d0..a0f5ce72f339b 100644 --- a/nixos/modules/misc/ids.nix +++ b/nixos/modules/misc/ids.nix @@ -71,7 +71,7 @@ in #utmp = 29; # unused # ddclient = 30; # converted to DynamicUser = true davfs2 = 31; - #disnix = 33; # unused + #disnix = 33; # module removed osgi = 34; tor = 35; cups = 36; @@ -143,7 +143,7 @@ in nix-ssh = 104; dictd = 105; couchdb = 106; - searx = 107; + #searx = 107; # dynamically allocated as of 2020-10-27 kippo = 108; jenkins = 109; systemd-journal-gateway = 110; @@ -387,7 +387,7 @@ in utmp = 29; # ddclient = 30; # converted to DynamicUser = true davfs2 = 31; - disnix = 33; + #disnix = 33; # module removed osgi = 34; tor = 35; #cups = 36; # unused @@ -457,7 +457,7 @@ in #nix-ssh = 104; # unused dictd = 105; couchdb = 106; - searx = 107; + #searx = 107; # dynamically allocated as of 2020-10-27 kippo = 108; jenkins = 109; systemd-journal-gateway = 110; diff --git a/nixos/modules/misc/locate.nix b/nixos/modules/misc/locate.nix index 92aa3be0a3667..1d2bc8c72813c 100644 --- a/nixos/modules/misc/locate.nix +++ b/nixos/modules/misc/locate.nix @@ -73,7 +73,72 @@ in { pruneFS = mkOption { type = listOf str; - default = ["afs" "anon_inodefs" "auto" "autofs" "bdev" "binfmt" "binfmt_misc" "cgroup" "cifs" "coda" "configfs" "cramfs" "cpuset" "debugfs" "devfs" "devpts" "devtmpfs" "ecryptfs" "eventpollfs" "exofs" "futexfs" "ftpfs" "fuse" "fusectl" "gfs" "gfs2" "hostfs" "hugetlbfs" "inotifyfs" "iso9660" "jffs2" "lustre" "misc" "mqueue" "ncpfs" "nnpfs" "ocfs" "ocfs2" "pipefs" "proc" "ramfs" "rpc_pipefs" "securityfs" "selinuxfs" "sfs" "shfs" "smbfs" "sockfs" "spufs" "nfs" "NFS" "nfs4" "nfsd" "sshfs" "subfs" "supermount" "sysfs" "tmpfs" "ubifs" "udf" "usbfs" "vboxsf" "vperfctrfs" ]; + default = [ + "afs" + "anon_inodefs" + "auto" + "autofs" + "bdev" + "binfmt" + "binfmt_misc" + "cgroup" + "cifs" + "coda" + "configfs" + "cramfs" + "cpuset" + "debugfs" + "devfs" + "devpts" + "devtmpfs" + "ecryptfs" + "eventpollfs" + "exofs" + "futexfs" + "ftpfs" + "fuse" + "fusectl" + "fuse.sshfs" + "gfs" + "gfs2" + "hostfs" + "hugetlbfs" + "inotifyfs" + "iso9660" + "jffs2" + "lustre" + "misc" + "mqueue" + "ncpfs" + "nnpfs" + "ocfs" + "ocfs2" + "pipefs" + "proc" + "ramfs" + "rpc_pipefs" + "securityfs" + "selinuxfs" + "sfs" + "shfs" + "smbfs" + "sockfs" + "spufs" + "nfs" + "NFS" + "nfs4" + "nfsd" + "sshfs" + "subfs" + "supermount" + "sysfs" + "tmpfs" + "ubifs" + "udf" + "usbfs" + "vboxsf" + "vperfctrfs" + ]; description = '' Which filesystem types to exclude from indexing ''; @@ -150,7 +215,7 @@ in { '' else '' exec ${cfg.locate}/bin/updatedb \ - ${optionalString (cfg.localuser != null && ! isMLocate) ''--localuser=${cfg.localuser}''} \ + ${optionalString (cfg.localuser != null && ! isMLocate) "--localuser=${cfg.localuser}"} \ --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags} ''; environment = optionalAttrs (!isMLocate) { diff --git a/nixos/modules/misc/nixpkgs.nix b/nixos/modules/misc/nixpkgs.nix index 25ac94b8e0f65..8160bfef4a3cb 100644 --- a/nixos/modules/misc/nixpkgs.nix +++ b/nixos/modules/misc/nixpkgs.nix @@ -73,7 +73,7 @@ in } ''; type = pkgsType; - example = literalExample ''import <nixpkgs> {}''; + example = literalExample "import <nixpkgs> {}"; description = '' If set, the pkgs argument to all NixOS modules is the value of this option, extended with <code>nixpkgs.overlays</code>, if diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index df8e5e1dd699f..acd5ad9de2e77 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -46,11 +46,14 @@ ./hardware/cpu/intel-microcode.nix ./hardware/digitalbitbox.nix ./hardware/device-tree.nix + ./hardware/sensor/hddtemp.nix ./hardware/sensor/iio.nix + ./hardware/keyboard/zsa.nix ./hardware/ksm.nix ./hardware/ledger.nix ./hardware/logitech.nix ./hardware/mcelog.nix + ./hardware/network/ath-user-regd.nix ./hardware/network/b43.nix ./hardware/network/intel-2200bg.nix ./hardware/nitrokey.nix @@ -65,6 +68,7 @@ ./hardware/tuxedo-keyboard.nix ./hardware/usb-wwan.nix ./hardware/onlykey.nix + ./hardware/opentabletdriver.nix ./hardware/wooting.nix ./hardware/uinput.nix ./hardware/video/amdgpu.nix @@ -80,6 +84,7 @@ ./hardware/xpadneo.nix ./i18n/input-method/default.nix ./i18n/input-method/fcitx.nix + ./i18n/input-method/fcitx5.nix ./i18n/input-method/hime.nix ./i18n/input-method/ibus.nix ./i18n/input-method/nabi.nix @@ -99,6 +104,7 @@ ./misc/version.nix ./misc/nixops-autoluks.nix ./programs/adb.nix + ./programs/appgate-sdp.nix ./programs/atop.nix ./programs/autojump.nix ./programs/bandwhich.nix @@ -140,6 +146,7 @@ ./programs/light.nix ./programs/mosh.nix ./programs/mininet.nix + ./programs/msmtp.nix ./programs/mtr.nix ./programs/nano.nix ./programs/neovim.nix @@ -164,12 +171,12 @@ ./programs/sway.nix ./programs/system-config-printer.nix ./programs/thefuck.nix + ./programs/tilp2.nix ./programs/tmux.nix ./programs/traceroute.nix ./programs/tsm-client.nix ./programs/udevil.nix ./programs/usbtop.nix - ./programs/venus.nix ./programs/vim.nix ./programs/wavemon.nix ./programs/waybar.nix @@ -223,6 +230,7 @@ ./services/audio/icecast.nix ./services/audio/liquidsoap.nix ./services/audio/mpd.nix + ./services/audio/mpdscribble.nix ./services/audio/mopidy.nix ./services/audio/roon-server.nix ./services/audio/slimserver.nix @@ -342,6 +350,7 @@ ./services/editors/emacs.nix ./services/editors/infinoted.nix ./services/games/factorio.nix + ./services/games/freeciv.nix ./services/games/minecraft-server.nix ./services/games/minetest-server.nix ./services/games/openarena.nix @@ -349,6 +358,7 @@ ./services/games/terraria.nix ./services/hardware/acpid.nix ./services/hardware/actkbd.nix + ./services/hardware/auto-cpufreq.nix ./services/hardware/bluetooth.nix ./services/hardware/bolt.nix ./services/hardware/brltty.nix @@ -442,12 +452,11 @@ ./services/misc/devmon.nix ./services/misc/dictd.nix ./services/misc/dwm-status.nix - ./services/misc/dysnomia.nix - ./services/misc/disnix.nix ./services/misc/docker-registry.nix ./services/misc/domoticz.nix ./services/misc/errbot.nix ./services/misc/etcd.nix + ./services/misc/etebase-server.nix ./services/misc/ethminer.nix ./services/misc/exhibitor.nix ./services/misc/felix.nix @@ -482,12 +491,14 @@ ./services/misc/mediatomb.nix ./services/misc/metabase.nix ./services/misc/mwlib.nix + ./services/misc/n8n.nix ./services/misc/nix-daemon.nix ./services/misc/nix-gc.nix ./services/misc/nix-optimise.nix ./services/misc/nix-ssh-serve.nix ./services/misc/novacomd.nix ./services/misc/nzbget.nix + ./services/misc/nzbhydra2.nix ./services/misc/octoprint.nix ./services/misc/osrm.nix ./services/misc/packagekit.nix @@ -536,6 +547,7 @@ ./services/monitoring/do-agent.nix ./services/monitoring/fusion-inventory.nix ./services/monitoring/grafana.nix + ./services/monitoring/grafana-image-renderer.nix ./services/monitoring/grafana-reporter.nix ./services/monitoring/graphite.nix ./services/monitoring/hdaps.nix @@ -599,6 +611,8 @@ ./services/networking/atftpd.nix ./services/networking/avahi-daemon.nix ./services/networking/babeld.nix + ./services/networking/bee.nix + ./services/networking/bee-clef.nix ./services/networking/biboumi.nix ./services/networking/bind.nix ./services/networking/bitcoind.nix @@ -624,6 +638,7 @@ ./services/networking/dnsdist.nix ./services/networking/dnsmasq.nix ./services/networking/ncdns.nix + ./services/networking/nomad.nix ./services/networking/ejabberd.nix ./services/networking/epmd.nix ./services/networking/ergo.nix @@ -653,6 +668,8 @@ ./services/networking/hylafax/default.nix ./services/networking/i2pd.nix ./services/networking/i2p.nix + ./services/networking/icecream/scheduler.nix + ./services/networking/icecream/daemon.nix ./services/networking/iodine.nix ./services/networking/iperf3.nix ./services/networking/ircd-hybrid/default.nix @@ -713,6 +730,7 @@ ./services/networking/owamp.nix ./services/networking/pdnsd.nix ./services/networking/pixiecore.nix + ./services/networking/pleroma.nix ./services/networking/polipo.nix ./services/networking/powerdns.nix ./services/networking/pdns-recursor.nix @@ -739,6 +757,7 @@ ./services/networking/skydns.nix ./services/networking/shadowsocks.nix ./services/networking/shairport-sync.nix + ./services/networking/shellhub-agent.nix ./services/networking/shorewall.nix ./services/networking/shorewall6.nix ./services/networking/shout.nix @@ -844,7 +863,7 @@ ./services/torrent/peerflix.nix ./services/torrent/rtorrent.nix ./services/torrent/transmission.nix - ./services/ttys/agetty.nix + ./services/ttys/getty.nix ./services/ttys/gpm.nix ./services/ttys/kmscon.nix ./services/wayland/cage.nix @@ -853,16 +872,17 @@ ./services/web-apps/atlassian/confluence.nix ./services/web-apps/atlassian/crowd.nix ./services/web-apps/atlassian/jira.nix - ./services/web-apps/codimd.nix ./services/web-apps/convos.nix ./services/web-apps/cryptpad.nix ./services/web-apps/documize.nix ./services/web-apps/dokuwiki.nix ./services/web-apps/engelsystem.nix - ./services/web-apps/frab.nix + ./services/web-apps/galene.nix ./services/web-apps/gerrit.nix ./services/web-apps/gotify-server.nix ./services/web-apps/grocy.nix + ./services/web-apps/hedgedoc.nix + ./services/web-apps/hledger-web.nix ./services/web-apps/icingaweb2/icingaweb2.nix ./services/web-apps/icingaweb2/module-monitoring.nix ./services/web-apps/ihatemoney @@ -876,6 +896,7 @@ ./services/web-apps/moodle.nix ./services/web-apps/nextcloud.nix ./services/web-apps/nexus.nix + ./services/web-apps/plantuml-server.nix ./services/web-apps/pgpkeyserver-lite.nix ./services/web-apps/matomo.nix ./services/web-apps/moinmoin.nix @@ -888,6 +909,7 @@ ./services/web-apps/selfoss.nix ./services/web-apps/shiori.nix ./services/web-apps/virtlyst.nix + ./services/web-apps/whitebophir.nix ./services/web-apps/wordpress.nix ./services/web-apps/youtrack.nix ./services/web-apps/zabbix.nix @@ -943,6 +965,7 @@ ./services/x11/urxvtd.nix ./services/x11/window-managers/awesome.nix ./services/x11/window-managers/default.nix + ./services/x11/window-managers/clfswm.nix ./services/x11/window-managers/fluxbox.nix ./services/x11/window-managers/icewm.nix ./services/x11/window-managers/bspwm.nix diff --git a/nixos/modules/profiles/all-hardware.nix b/nixos/modules/profiles/all-hardware.nix index 19f821ae17f39..d460c52dbefd4 100644 --- a/nixos/modules/profiles/all-hardware.nix +++ b/nixos/modules/profiles/all-hardware.nix @@ -3,8 +3,10 @@ # enabled in the initrd. Its primary use is in the NixOS installation # CDs. -{ ... }: - +{ pkgs, lib,... }: +let + platform = pkgs.stdenv.hostPlatform; +in { # The initrd has to contain any module that might be necessary for @@ -42,7 +44,10 @@ "virtio_net" "virtio_pci" "virtio_blk" "virtio_scsi" "virtio_balloon" "virtio_console" # VMware support. - "mptspi" "vmw_balloon" "vmwgfx" "vmw_vmci" "vmw_vsock_vmci_transport" "vmxnet3" "vsock" + "mptspi" "vmxnet3" "vsock" + ] ++ lib.optional platform.isx86 "vmw_balloon" + ++ lib.optionals (!platform.isAarch64) [ # not sure where else they're missing + "vmw_vmci" "vmwgfx" "vmw_vsock_vmci_transport" # Hyper-V support. "hv_storvsc" diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix index 42ed62b063044..680fa40b91195 100644 --- a/nixos/modules/profiles/hardened.nix +++ b/nixos/modules/profiles/hardened.nix @@ -1,5 +1,10 @@ # A profile with most (vanilla) hardening options enabled by default, -# potentially at the cost of features and performance. +# potentially at the cost of stability, features and performance. +# +# This profile enables options that are known to affect system +# stability. If you experience any stability issues when using the +# profile, try disabling it. If you report an issue and use this +# profile, always mention that you do. { config, lib, pkgs, ... }: diff --git a/nixos/modules/profiles/installation-device.nix b/nixos/modules/profiles/installation-device.nix index e68ea1b08776a..7dc493fb495da 100644 --- a/nixos/modules/profiles/installation-device.nix +++ b/nixos/modules/profiles/installation-device.nix @@ -45,10 +45,10 @@ with lib; }; # Automatically log in at the virtual consoles. - services.mingetty.autologinUser = "nixos"; + services.getty.autologinUser = "nixos"; # Some more help text. - services.mingetty.helpLine = '' + services.getty.helpLine = '' The "nixos" and "root" accounts have empty passwords. An ssh daemon is running. You then must set a password diff --git a/nixos/modules/profiles/qemu-guest.nix b/nixos/modules/profiles/qemu-guest.nix index 0ea70107f7178..d4335edfcf2d3 100644 --- a/nixos/modules/profiles/qemu-guest.nix +++ b/nixos/modules/profiles/qemu-guest.nix @@ -1,7 +1,7 @@ # Common configuration for virtual machines running under QEMU (using # virtio). -{ lib, ... }: +{ ... }: { boot.initrd.availableKernelModules = [ "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "9p" "9pnet_virtio" ]; @@ -14,6 +14,4 @@ # to the *boot time* of the host). hwclock -s ''; - - security.rngd.enable = lib.mkDefault false; } diff --git a/nixos/modules/programs/appgate-sdp.nix b/nixos/modules/programs/appgate-sdp.nix new file mode 100644 index 0000000000000..1dec4ecf9eccb --- /dev/null +++ b/nixos/modules/programs/appgate-sdp.nix @@ -0,0 +1,23 @@ +{ config, pkgs, lib, ... }: + +with lib; + +{ + options = { + programs.appgate-sdp = { + enable = mkEnableOption + "AppGate SDP VPN client"; + }; + }; + + config = mkIf config.programs.appgate-sdp.enable { + boot.kernelModules = [ "tun" ]; + environment.systemPackages = [ pkgs.appgate-sdp ]; + services.dbus.packages = [ pkgs.appgate-sdp ]; + systemd = { + packages = [ pkgs.appgate-sdp ]; + # https://github.com/NixOS/nixpkgs/issues/81138 + services.appgatedriver.wantedBy = [ "multi-user.target" ]; + }; + }; +} diff --git a/nixos/modules/programs/captive-browser.nix b/nixos/modules/programs/captive-browser.nix index 26db167507271..4d59ea8d0fd81 100644 --- a/nixos/modules/programs/captive-browser.nix +++ b/nixos/modules/programs/captive-browser.nix @@ -27,14 +27,14 @@ in # the options below are the same as in "captive-browser.toml" browser = mkOption { type = types.str; - default = concatStringsSep " " [ ''${pkgs.chromium}/bin/chromium'' - ''--user-data-dir=''${XDG_DATA_HOME:-$HOME/.local/share}/chromium-captive'' + default = concatStringsSep " " [ "${pkgs.chromium}/bin/chromium" + "--user-data-dir=\${XDG_DATA_HOME:-$HOME/.local/share}/chromium-captive" ''--proxy-server="socks5://$PROXY"'' ''--host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE localhost"'' - ''--no-first-run'' - ''--new-window'' - ''--incognito'' - ''http://cache.nixos.org/'' + "--no-first-run" + "--new-window" + "--incognito" + "http://cache.nixos.org/" ]; description = '' The shell (/bin/sh) command executed once the proxy starts. @@ -62,7 +62,7 @@ in socks5-addr = mkOption { type = types.str; default = "localhost:1666"; - description = ''the listen address for the SOCKS5 proxy server''; + description = "the listen address for the SOCKS5 proxy server"; }; bindInterface = mkOption { diff --git a/nixos/modules/programs/cdemu.nix b/nixos/modules/programs/cdemu.nix index a59cd93cadfc0..142e293424057 100644 --- a/nixos/modules/programs/cdemu.nix +++ b/nixos/modules/programs/cdemu.nix @@ -16,18 +16,21 @@ in { ''; }; group = mkOption { + type = types.str; default = "cdrom"; description = '' Group that users must be in to use <command>cdemu</command>. ''; }; gui = mkOption { + type = types.bool; default = true; description = '' Whether to install the <command>cdemu</command> GUI (gCDEmu). ''; }; image-analyzer = mkOption { + type = types.bool; default = true; description = '' Whether to install the image analyzer. diff --git a/nixos/modules/programs/command-not-found/command-not-found.nix b/nixos/modules/programs/command-not-found/command-not-found.nix index 656c255fcb185..d8394bf73a2e8 100644 --- a/nixos/modules/programs/command-not-found/command-not-found.nix +++ b/nixos/modules/programs/command-not-found/command-not-found.nix @@ -80,6 +80,8 @@ in # Retry the command if we just installed it. if [ $? = 126 ]; then "$@" + else + return 127 fi else # Indicate than there was an error so ZSH falls back to its default handler diff --git a/nixos/modules/programs/command-not-found/command-not-found.pl b/nixos/modules/programs/command-not-found/command-not-found.pl index ab7aa204653cd..7515dd975c316 100644 --- a/nixos/modules/programs/command-not-found/command-not-found.pl +++ b/nixos/modules/programs/command-not-found/command-not-found.pl @@ -27,8 +27,8 @@ if (!defined $res || scalar @$res == 0) { my $package = @$res[0]->{package}; if ($ENV{"NIX_AUTO_INSTALL"} // "") { print STDERR <<EOF; -The program ‘$program’ is currently not installed. It is provided by -the package ‘$package’, which I will now install for you. +The program '$program' is currently not installed. It is provided by +the package '$package', which I will now install for you. EOF ; exit 126 if system("nix-env", "-iA", "nixos.$package") == 0; @@ -36,16 +36,17 @@ EOF exec("nix-shell", "-p", $package, "--run", shell_quote("exec", @ARGV)); } else { print STDERR <<EOF; -The program ‘$program’ is currently not installed. You can install it by typing: - nix-env -iA nixos.$package +The program '$program' is not in your PATH. You can make it available in an +ephemeral shell by typing: + nix-shell -p $package EOF } } else { print STDERR <<EOF; -The program ‘$program’ is currently not installed. It is provided by -several packages. You can install it by typing one of the following: +The program '$program' is not in your PATH. It is provided by several packages. +You can make it available in an ephemeral shell by typing one of the following: EOF - print STDERR " nix-env -iA nixos.$_->{package}\n" foreach @$res; + print STDERR " nix-shell -p $_->{package}\n" foreach @$res; } exit 127; diff --git a/nixos/modules/programs/firejail.nix b/nixos/modules/programs/firejail.nix index 484f9eb444060..ad4ef1a39459d 100644 --- a/nixos/modules/programs/firejail.nix +++ b/nixos/modules/programs/firejail.nix @@ -11,10 +11,20 @@ let } '' mkdir -p $out/bin - ${lib.concatStringsSep "\n" (lib.mapAttrsToList (command: binary: '' + ${lib.concatStringsSep "\n" (lib.mapAttrsToList (command: value: + let + opts = if builtins.isAttrs value + then value + else { executable = value; profile = null; extraArgs = []; }; + args = lib.escapeShellArgs ( + (optional (opts.profile != null) "--profile=${toString opts.profile}") + ++ opts.extraArgs + ); + in + '' cat <<_EOF >$out/bin/${command} #! ${pkgs.runtimeShell} -e - exec /run/wrappers/bin/firejail ${binary} "\$@" + exec /run/wrappers/bin/firejail ${args} -- ${toString opts.executable} "\$@" _EOF chmod 0755 $out/bin/${command} '') cfg.wrappedBinaries)} @@ -25,12 +35,38 @@ in { enable = mkEnableOption "firejail"; wrappedBinaries = mkOption { - type = types.attrsOf types.path; + type = types.attrsOf (types.either types.path (types.submodule { + options = { + executable = mkOption { + type = types.path; + description = "Executable to run sandboxed"; + example = literalExample "''${lib.getBin pkgs.firefox}/bin/firefox"; + }; + profile = mkOption { + type = types.nullOr types.path; + default = null; + description = "Profile to use"; + example = literalExample "''${pkgs.firejail}/etc/firejail/firefox.profile"; + }; + extraArgs = mkOption { + type = types.listOf types.str; + default = []; + description = "Extra arguments to pass to firejail"; + example = [ "--private=~/.firejail_home" ]; + }; + }; + })); default = {}; example = literalExample '' { - firefox = "''${lib.getBin pkgs.firefox}/bin/firefox"; - mpv = "''${lib.getBin pkgs.mpv}/bin/mpv"; + firefox = { + executable = "''${lib.getBin pkgs.firefox}/bin/firefox"; + profile = "''${pkgs.firejail}/etc/firejail/firefox.profile"; + }; + mpv = { + executable = "''${lib.getBin pkgs.mpv}/bin/mpv"; + profile = "''${pkgs.firejail}/etc/firejail/mpv.profile"; + }; } ''; description = '' diff --git a/nixos/modules/programs/fish.nix b/nixos/modules/programs/fish.nix index 39b92edf2ac2e..392f06eb93326 100644 --- a/nixos/modules/programs/fish.nix +++ b/nixos/modules/programs/fish.nix @@ -13,6 +13,27 @@ let (filterAttrs (k: v: v != null) cfg.shellAliases) ); + envShellInit = pkgs.writeText "shellInit" cfge.shellInit; + + envLoginShellInit = pkgs.writeText "loginShellInit" cfge.loginShellInit; + + envInteractiveShellInit = pkgs.writeText "interactiveShellInit" cfge.interactiveShellInit; + + sourceEnv = file: + if cfg.useBabelfish then + "source /etc/fish/${file}.fish" + else + '' + set fish_function_path ${pkgs.fishPlugins.foreign-env}/share/fish/vendor_functions.d $fish_function_path + fenv source /etc/fish/foreign-env/${file} > /dev/null + set -e fish_function_path[1] + ''; + + babelfishTranslate = path: name: + pkgs.runCommand "${name}.fish" { + nativeBuildInputs = [ pkgs.babelfish ]; + } "${pkgs.babelfish}/bin/babelfish < ${path} > $out;"; + in { @@ -29,6 +50,15 @@ in type = types.bool; }; + useBabelfish = mkOption { + type = types.bool; + default = false; + description = '' + If enabled, the configured environment will be translated to native fish using <link xlink:href="https://github.com/bouk/babelfish">babelfish</link>. + Otherwise, <link xlink:href="https://github.com/oh-my-fish/plugin-foreign-env">foreign-env</link> will be used. + ''; + }; + vendor.config.enable = mkOption { type = types.bool; default = true; @@ -103,74 +133,154 @@ in programs.fish.shellAliases = mapAttrs (name: mkDefault) cfge.shellAliases; # Required for man completions - documentation.man.generateCaches = true; - - environment.etc."fish/foreign-env/shellInit".text = cfge.shellInit; - environment.etc."fish/foreign-env/loginShellInit".text = cfge.loginShellInit; - environment.etc."fish/foreign-env/interactiveShellInit".text = cfge.interactiveShellInit; - - environment.etc."fish/nixos-env-preinit.fish".text = '' - # This happens before $__fish_datadir/config.fish sets fish_function_path, so it is currently - # unset. We set it and then completely erase it, leaving its configuration to $__fish_datadir/config.fish - set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $__fish_datadir/functions - - # source the NixOS environment config - if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ] - fenv source ${config.system.build.setEnvironment} - end - - # clear fish_function_path so that it will be correctly set when we return to $__fish_datadir/config.fish - set -e fish_function_path - ''; - - environment.etc."fish/config.fish".text = '' - # /etc/fish/config.fish: DO NOT EDIT -- this file has been generated automatically. - - # if we haven't sourced the general config, do it - if not set -q __fish_nixos_general_config_sourced - set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $fish_function_path - fenv source /etc/fish/foreign-env/shellInit > /dev/null - set -e fish_function_path[1] - - ${cfg.shellInit} - - # and leave a note so we don't source this config section again from - # this very shell (children will source the general config anew) - set -g __fish_nixos_general_config_sourced 1 - end - - # if we haven't sourced the login config, do it - status --is-login; and not set -q __fish_nixos_login_config_sourced - and begin - set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $fish_function_path - fenv source /etc/fish/foreign-env/loginShellInit > /dev/null - set -e fish_function_path[1] - - ${cfg.loginShellInit} - - # and leave a note so we don't source this config section again from - # this very shell (children will source the general config anew) - set -g __fish_nixos_login_config_sourced 1 - end - - # if we haven't sourced the interactive config, do it - status --is-interactive; and not set -q __fish_nixos_interactive_config_sourced - and begin - ${fishAliases} - - set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $fish_function_path - fenv source /etc/fish/foreign-env/interactiveShellInit > /dev/null - set -e fish_function_path[1] - - ${cfg.promptInit} - ${cfg.interactiveShellInit} - - # and leave a note so we don't source this config section again from - # this very shell (children will source the general config anew, - # allowing configuration changes in, e.g, aliases, to propagate) - set -g __fish_nixos_interactive_config_sourced 1 - end - ''; + documentation.man.generateCaches = lib.mkDefault true; + + environment = mkMerge [ + (mkIf cfg.useBabelfish + { + etc."fish/setEnvironment.fish".source = babelfishTranslate config.system.build.setEnvironment "setEnvironment"; + etc."fish/shellInit.fish".source = babelfishTranslate envShellInit "shellInit"; + etc."fish/loginShellInit.fish".source = babelfishTranslate envLoginShellInit "loginShellInit"; + etc."fish/interactiveShellInit.fish".source = babelfishTranslate envInteractiveShellInit "interactiveShellInit"; + }) + + (mkIf (!cfg.useBabelfish) + { + etc."fish/foreign-env/shellInit".source = envShellInit; + etc."fish/foreign-env/loginShellInit".source = envLoginShellInit; + etc."fish/foreign-env/interactiveShellInit".source = envInteractiveShellInit; + }) + + { + etc."fish/nixos-env-preinit.fish".text = + if cfg.useBabelfish + then '' + # source the NixOS environment config + if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ] + source /etc/fish/setEnvironment.fish + end + '' + else '' + # This happens before $__fish_datadir/config.fish sets fish_function_path, so it is currently + # unset. We set it and then completely erase it, leaving its configuration to $__fish_datadir/config.fish + set fish_function_path ${pkgs.fishPlugins.foreign-env}/share/fish/vendor_functions.d $__fish_datadir/functions + + # source the NixOS environment config + if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ] + fenv source ${config.system.build.setEnvironment} + end + + # clear fish_function_path so that it will be correctly set when we return to $__fish_datadir/config.fish + set -e fish_function_path + ''; + } + + { + etc."fish/config.fish".text = '' + # /etc/fish/config.fish: DO NOT EDIT -- this file has been generated automatically. + + # if we haven't sourced the general config, do it + if not set -q __fish_nixos_general_config_sourced + ${sourceEnv "shellInit"} + + ${cfg.shellInit} + + # and leave a note so we don't source this config section again from + # this very shell (children will source the general config anew) + set -g __fish_nixos_general_config_sourced 1 + end + + # if we haven't sourced the login config, do it + status --is-login; and not set -q __fish_nixos_login_config_sourced + and begin + ${sourceEnv "loginShellInit"} + + ${cfg.loginShellInit} + + # and leave a note so we don't source this config section again from + # this very shell (children will source the general config anew) + set -g __fish_nixos_login_config_sourced 1 + end + + # if we haven't sourced the interactive config, do it + status --is-interactive; and not set -q __fish_nixos_interactive_config_sourced + and begin + ${fishAliases} + + ${sourceEnv "interactiveShellInit"} + + ${cfg.promptInit} + ${cfg.interactiveShellInit} + + # and leave a note so we don't source this config section again from + # this very shell (children will source the general config anew, + # allowing configuration changes in, e.g, aliases, to propagate) + set -g __fish_nixos_interactive_config_sourced 1 + end + ''; + } + + { + etc."fish/generated_completions".source = + let + patchedGenerator = pkgs.stdenv.mkDerivation { + name = "fish_patched-completion-generator"; + srcs = [ + "${pkgs.fish}/share/fish/tools/create_manpage_completions.py" + "${pkgs.fish}/share/fish/tools/deroff.py" + ]; + unpackCmd = "cp $curSrc $(basename $curSrc)"; + sourceRoot = "."; + patches = [ ./fish_completion-generator.patch ]; # to prevent collisions of identical completion files + dontBuild = true; + installPhase = '' + mkdir -p $out + cp * $out/ + ''; + preferLocalBuild = true; + allowSubstitutes = false; + }; + generateCompletions = package: pkgs.runCommand + "${package.name}_fish-completions" + ( + { + inherit package; + preferLocalBuild = true; + allowSubstitutes = false; + } + // optionalAttrs (package ? meta.priority) { meta.priority = package.meta.priority; } + ) + '' + mkdir -p $out + if [ -d $package/share/man ]; then + find $package/share/man -type f | xargs ${pkgs.python3.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null + fi + ''; + in + pkgs.buildEnv { + name = "system_fish-completions"; + ignoreCollisions = true; + paths = map generateCompletions config.environment.systemPackages; + }; + } + + # include programs that bring their own completions + { + pathsToLink = [] + ++ optional cfg.vendor.config.enable "/share/fish/vendor_conf.d" + ++ optional cfg.vendor.completions.enable "/share/fish/vendor_completions.d" + ++ optional cfg.vendor.functions.enable "/share/fish/vendor_functions.d"; + } + + { systemPackages = [ pkgs.fish ]; } + + { + shells = [ + "/run/current-system/sw/bin/fish" + "${pkgs.fish}/bin/fish" + ]; + } + ]; programs.fish.interactiveShellInit = '' # add completions generated by NixOS to $fish_complete_path @@ -187,61 +297,6 @@ in end ''; - environment.etc."fish/generated_completions".source = - let - patchedGenerator = pkgs.stdenv.mkDerivation { - name = "fish_patched-completion-generator"; - srcs = [ - "${pkgs.fish}/share/fish/tools/create_manpage_completions.py" - "${pkgs.fish}/share/fish/tools/deroff.py" - ]; - unpackCmd = "cp $curSrc $(basename $curSrc)"; - sourceRoot = "."; - patches = [ ./fish_completion-generator.patch ]; # to prevent collisions of identical completion files - dontBuild = true; - installPhase = '' - mkdir -p $out - cp * $out/ - ''; - preferLocalBuild = true; - allowSubstitutes = false; - }; - generateCompletions = package: pkgs.runCommand - "${package.name}_fish-completions" - ( - { - inherit package; - preferLocalBuild = true; - allowSubstitutes = false; - } - // optionalAttrs (package ? meta.priority) { meta.priority = package.meta.priority; } - ) - '' - mkdir -p $out - if [ -d $package/share/man ]; then - find $package/share/man -type f | xargs ${pkgs.python3.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null - fi - ''; - in - pkgs.buildEnv { - name = "system_fish-completions"; - ignoreCollisions = true; - paths = map generateCompletions config.environment.systemPackages; - }; - - # include programs that bring their own completions - environment.pathsToLink = [] - ++ optional cfg.vendor.config.enable "/share/fish/vendor_conf.d" - ++ optional cfg.vendor.completions.enable "/share/fish/vendor_completions.d" - ++ optional cfg.vendor.functions.enable "/share/fish/vendor_functions.d"; - - environment.systemPackages = [ pkgs.fish ]; - - environment.shells = [ - "/run/current-system/sw/bin/fish" - "${pkgs.fish}/bin/fish" - ]; - }; } diff --git a/nixos/modules/programs/msmtp.nix b/nixos/modules/programs/msmtp.nix new file mode 100644 index 0000000000000..217060e6b3b32 --- /dev/null +++ b/nixos/modules/programs/msmtp.nix @@ -0,0 +1,104 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.programs.msmtp; + +in { + meta.maintainers = with maintainers; [ pacien ]; + + options = { + programs.msmtp = { + enable = mkEnableOption "msmtp - an SMTP client"; + + setSendmail = mkOption { + type = types.bool; + default = true; + description = '' + Whether to set the system sendmail to msmtp's. + ''; + }; + + defaults = mkOption { + type = types.attrs; + default = {}; + example = { + aliases = "/etc/aliases"; + port = 587; + tls = true; + }; + description = '' + Default values applied to all accounts. + See msmtp(1) for the available options. + ''; + }; + + accounts = mkOption { + type = with types; attrsOf attrs; + default = {}; + example = { + "default" = { + host = "smtp.example"; + auth = true; + user = "someone"; + passwordeval = "cat /secrets/password.txt"; + }; + }; + description = '' + Named accounts and their respective configurations. + The special name "default" allows a default account to be defined. + See msmtp(1) for the available options. + + Use `programs.msmtp.extraConfig` instead of this attribute set-based + option if ordered account inheritance is needed. + + It is advised to use the `passwordeval` setting to read the password + from a secret file to avoid having it written in the world-readable + nix store. The password file must end with a newline (`\n`). + ''; + }; + + extraConfig = mkOption { + type = types.lines; + default = ""; + description = '' + Extra lines to add to the msmtp configuration verbatim. + See msmtp(1) for the syntax and available options. + ''; + }; + }; + }; + + config = mkIf cfg.enable { + environment.systemPackages = [ pkgs.msmtp ]; + + services.mail.sendmailSetuidWrapper = mkIf cfg.setSendmail { + program = "sendmail"; + source = "${pkgs.msmtp}/bin/sendmail"; + setuid = false; + setgid = false; + }; + + environment.etc."msmtprc".text = let + mkValueString = v: + if v == true then "on" + else if v == false then "off" + else generators.mkValueStringDefault {} v; + mkKeyValueString = k: v: "${k} ${mkValueString v}"; + mkInnerSectionString = + attrs: concatStringsSep "\n" (mapAttrsToList mkKeyValueString attrs); + mkAccountString = name: attrs: '' + account ${name} + ${mkInnerSectionString attrs} + ''; + in '' + defaults + ${mkInnerSectionString cfg.defaults} + + ${concatStringsSep "\n" (mapAttrsToList mkAccountString cfg.accounts)} + + ${cfg.extraConfig} + ''; + }; +} diff --git a/nixos/modules/programs/ssh.nix b/nixos/modules/programs/ssh.nix index 40af4d0ff5aeb..d4a7769bbd6d6 100644 --- a/nixos/modules/programs/ssh.nix +++ b/nixos/modules/programs/ssh.nix @@ -36,7 +36,7 @@ in askPassword = mkOption { type = types.str; default = "${pkgs.x11_ssh_askpass}/libexec/x11-ssh-askpass"; - description = ''Program used by SSH to ask for passwords.''; + description = "Program used by SSH to ask for passwords."; }; forwardX11 = mkOption { diff --git a/nixos/modules/programs/ssmtp.nix b/nixos/modules/programs/ssmtp.nix index 1f49ddc91bb38..8039763faccc9 100644 --- a/nixos/modules/programs/ssmtp.nix +++ b/nixos/modules/programs/ssmtp.nix @@ -162,15 +162,16 @@ in (mkIf (cfg.authPassFile != null) { AuthPassFile = cfg.authPassFile; }) ]; - environment.etc."ssmtp/ssmtp.conf".source = - let - toStr = value: + # careful here: ssmtp REQUIRES all config lines to end with a newline char! + environment.etc."ssmtp/ssmtp.conf".text = with generators; toKeyValue { + mkKeyValue = mkKeyValueDefault { + mkValueString = value: if value == true then "YES" else if value == false then "NO" - else builtins.toString value + else mkValueStringDefault {} value ; - in - pkgs.writeText "ssmtp.conf" (concatStringsSep "\n" (mapAttrsToList (key: value: "${key}=${toStr value}") cfg.settings)); + } "="; + } cfg.settings; environment.systemPackages = [pkgs.ssmtp]; diff --git a/nixos/modules/programs/tilp2.nix b/nixos/modules/programs/tilp2.nix new file mode 100644 index 0000000000000..da9e32e3e6c6d --- /dev/null +++ b/nixos/modules/programs/tilp2.nix @@ -0,0 +1,28 @@ +{ config, pkgs, lib, ... }: + +with lib; + +let + cfg = config.programs.tilp2; + +in { + options.programs.tilp2 = { + enable = mkOption { + type = types.bool; + default = false; + description = '' + Enable tilp2 and udev rules for supported calculators. + ''; + }; + }; + + config = mkIf cfg.enable { + services.udev.packages = [ + pkgs.libticables2 + ]; + + environment.systemPackages = [ + pkgs.tilp2 + ]; + }; +} diff --git a/nixos/modules/programs/venus.nix b/nixos/modules/programs/venus.nix deleted file mode 100644 index 58faf38777d06..0000000000000 --- a/nixos/modules/programs/venus.nix +++ /dev/null @@ -1,173 +0,0 @@ -{ config, lib, pkgs, ... }: - -with lib; -let - cfg = config.services.venus; - - configFile = pkgs.writeText "venus.ini" - '' - [Planet] - name = ${cfg.name} - link = ${cfg.link} - owner_name = ${cfg.ownerName} - owner_email = ${cfg.ownerEmail} - output_theme = ${cfg.cacheDirectory}/theme - output_dir = ${cfg.outputDirectory} - cache_directory = ${cfg.cacheDirectory} - items_per_page = ${toString cfg.itemsPerPage} - ${(concatStringsSep "\n\n" - (map ({ name, feedUrl, homepageUrl }: - '' - [${feedUrl}] - name = ${name} - link = ${homepageUrl} - '') cfg.feeds))} - ''; - -in -{ - - options = { - services.venus = { - enable = mkOption { - default = false; - type = types.bool; - description = '' - Planet Venus is an awesome ‘river of news’ feed reader. It downloads - news feeds published by web sites and aggregates their content - together into a single combined feed, latest news first. - ''; - }; - - dates = mkOption { - default = "*:0/15"; - type = types.str; - description = '' - Specification (in the format described by - <citerefentry><refentrytitle>systemd.time</refentrytitle> - <manvolnum>7</manvolnum></citerefentry>) of the time at - which the Venus will collect feeds. - ''; - }; - - user = mkOption { - default = "root"; - type = types.str; - description = '' - User for running venus script. - ''; - }; - - group = mkOption { - default = "root"; - type = types.str; - description = '' - Group for running venus script. - ''; - }; - - name = mkOption { - default = "NixOS Planet"; - type = types.str; - description = '' - Your planet's name. - ''; - }; - - link = mkOption { - default = "https://planet.nixos.org"; - type = types.str; - description = '' - Link to the main page. - ''; - }; - - ownerName = mkOption { - default = "Rok Garbas"; - type = types.str; - description = '' - Your name. - ''; - }; - - ownerEmail = mkOption { - default = "some@example.com"; - type = types.str; - description = '' - Your e-mail address. - ''; - }; - - outputTheme = mkOption { - default = "${pkgs.venus}/themes/classic_fancy"; - type = types.path; - description = '' - Directory containing a config.ini file which is merged with this one. - This is typically used to specify templating and bill of material - information. - ''; - }; - - outputDirectory = mkOption { - type = types.path; - description = '' - Directory to place output files. - ''; - }; - - cacheDirectory = mkOption { - default = "/var/cache/venus"; - type = types.path; - description = '' - Where cached feeds are stored. - ''; - }; - - itemsPerPage = mkOption { - default = 15; - type = types.int; - description = '' - How many items to put on each page. - ''; - }; - - feeds = mkOption { - default = []; - example = [ - { - name = "Rok Garbas"; - feedUrl= "http://url/to/rss/feed.xml"; - homepageUrl = "http://garbas.si"; - } - ]; - description = '' - List of feeds. - ''; - }; - - }; - }; - - config = mkIf cfg.enable { - - system.activationScripts.venus = - '' - mkdir -p ${cfg.outputDirectory} - chown ${cfg.user}:${cfg.group} ${cfg.outputDirectory} -R - rm -rf ${cfg.cacheDirectory}/theme - mkdir -p ${cfg.cacheDirectory}/theme - cp -R ${cfg.outputTheme}/* ${cfg.cacheDirectory}/theme - chown ${cfg.user}:${cfg.group} ${cfg.cacheDirectory} -R - ''; - - systemd.services.venus = - { description = "Planet Venus Feed Reader"; - path = [ pkgs.venus ]; - script = "exec venus-planet ${configFile}"; - serviceConfig.User = "${cfg.user}"; - serviceConfig.Group = "${cfg.group}"; - startAt = cfg.dates; - }; - - }; -} diff --git a/nixos/modules/programs/xss-lock.nix b/nixos/modules/programs/xss-lock.nix index 83ed713864079..ceb7259b3d779 100644 --- a/nixos/modules/programs/xss-lock.nix +++ b/nixos/modules/programs/xss-lock.nix @@ -11,7 +11,7 @@ in lockerCommand = mkOption { default = "${pkgs.i3lock}/bin/i3lock"; - example = literalExample ''''${pkgs.i3lock-fancy}/bin/i3lock-fancy''; + example = literalExample "\${pkgs.i3lock-fancy}/bin/i3lock-fancy"; type = types.separatedString " "; description = "Locker to be used with xsslock"; }; diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix index a87db475e012d..1dd8b48d76b59 100644 --- a/nixos/modules/rename.nix +++ b/nixos/modules/rename.nix @@ -32,6 +32,7 @@ with lib; (mkRemovedOptionModule ["services" "cgmanager" "enable"] "cgmanager was deprecated by lxc and therefore removed from nixpkgs.") (mkRemovedOptionModule [ "services" "osquery" ] "The osquery module has been removed") (mkRemovedOptionModule [ "services" "fourStore" ] "The fourStore module has been removed") + (mkRemovedOptionModule [ "services" "frab" ] "The frab module has been removed") (mkRemovedOptionModule [ "services" "fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed") (mkRemovedOptionModule [ "services" "mathics" ] "The Mathics module has been removed") (mkRemovedOptionModule [ "programs" "way-cooler" ] ("way-cooler is abandoned by its author: " + @@ -69,6 +70,7 @@ with lib; '') (mkRemovedOptionModule [ "services" "seeks" ] "") + (mkRemovedOptionModule [ "services" "venus" ] "The corresponding package was removed from nixpkgs.") # Do NOT add any option renames here, see top of the file ]; diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix index 47f6bead7c3ed..c33a92580d4cd 100644 --- a/nixos/modules/security/acme.nix +++ b/nixos/modules/security/acme.nix @@ -7,6 +7,11 @@ let numCerts = length (builtins.attrNames cfg.certs); _24hSecs = 60 * 60 * 24; + # Used to make unique paths for each cert/account config set + mkHash = with builtins; val: substring 0 20 (hashString "sha256" val); + mkAccountHash = acmeServer: data: mkHash "${toString acmeServer} ${data.keyType} ${data.email}"; + accountDirRoot = "/var/lib/acme/.lego/accounts/"; + # There are many services required to make cert renewals work. # They all follow a common structure: # - They inherit this commonServiceConfig @@ -19,7 +24,7 @@ let Type = "oneshot"; User = "acme"; Group = mkDefault "acme"; - UMask = 0027; + UMask = 0023; StateDirectoryMode = 750; ProtectSystem = "full"; PrivateTmp = true; @@ -54,23 +59,35 @@ let ''; }; - # Previously, all certs were owned by whatever user was configured in - # config.security.acme.certs.<cert>.user. Now everything is owned by and - # run by the acme user. - userMigrationService = { - description = "Fix owner and group of all ACME certificates"; - - script = with builtins; concatStringsSep "\n" (mapAttrsToList (cert: data: '' - for fixpath in /var/lib/acme/${escapeShellArg cert} /var/lib/acme/.lego/${escapeShellArg cert}; do + # Ensures that directories which are shared across all certs + # exist and have the correct user and group, since group + # is configurable on a per-cert basis. + userMigrationService = let + script = with builtins; '' + chown -R acme .lego/accounts + '' + (concatStringsSep "\n" (mapAttrsToList (cert: data: '' + for fixpath in ${escapeShellArg cert} .lego/${escapeShellArg cert}; do if [ -d "$fixpath" ]; then chmod -R u=rwX,g=rX,o= "$fixpath" chown -R acme:${data.group} "$fixpath" fi done - '') certConfigs); + '') certConfigs)); + in { + description = "Fix owner and group of all ACME certificates"; - # We don't want this to run every time a renewal happens - serviceConfig.RemainAfterExit = true; + serviceConfig = commonServiceConfig // { + # We don't want this to run every time a renewal happens + RemainAfterExit = true; + + # These StateDirectory entries negate the need for tmpfiles + StateDirectory = [ "acme" "acme/.lego" "acme/.lego/accounts" ]; + StateDirectoryMode = 755; + WorkingDirectory = "/var/lib/acme"; + + # Run the start script as root + ExecStart = "+" + (pkgs.writeShellScript "acme-fixperms" script); + }; }; certToConfig = cert: data: let @@ -101,11 +118,10 @@ let ${toString acmeServer} ${toString data.dnsProvider} ${toString data.ocspMustStaple} ${data.keyType} ''; - mkHash = with builtins; val: substring 0 20 (hashString "sha256" val); certDir = mkHash hashData; domainHash = mkHash "${concatStringsSep " " extraDomains} ${data.domain}"; - othersHash = mkHash "${toString acmeServer} ${data.keyType}"; - accountDir = "/var/lib/acme/.lego/accounts/" + othersHash; + accountHash = (mkAccountHash acmeServer data); + accountDir = accountDirRoot + accountHash; protocolOpts = if useDns then ( [ "--dns" data.dnsProvider ] @@ -142,9 +158,8 @@ let ); in { - inherit accountDir selfsignedDeps; + inherit accountHash cert selfsignedDeps; - webroot = data.webroot; group = data.group; renewTimer = { @@ -184,7 +199,10 @@ let StateDirectory = "acme/${cert}"; - BindPaths = "/var/lib/acme/.minica:/tmp/ca /var/lib/acme/${cert}:/tmp/${keyName}"; + BindPaths = [ + "/var/lib/acme/.minica:/tmp/ca" + "/var/lib/acme/${cert}:/tmp/${keyName}" + ]; }; # Working directory will be /tmp @@ -222,16 +240,22 @@ let serviceConfig = commonServiceConfig // { Group = data.group; - # AccountDir dir will be created by tmpfiles to ensure correct permissions - # And to avoid deletion during systemctl clean - # acme/.lego/${cert} is listed so that it is deleted during systemctl clean - StateDirectory = "acme/${cert} acme/.lego/${cert} acme/.lego/${cert}/${certDir}"; + # Keep in mind that these directories will be deleted if the user runs + # systemctl clean --what=state + # acme/.lego/${cert} is listed for this reason. + StateDirectory = [ + "acme/${cert}" + "acme/.lego/${cert}" + "acme/.lego/${cert}/${certDir}" + "acme/.lego/accounts/${accountHash}" + ]; # Needs to be space separated, but can't use a multiline string because that'll include newlines - BindPaths = - "${accountDir}:/tmp/accounts " + - "/var/lib/acme/${cert}:/tmp/out " + - "/var/lib/acme/.lego/${cert}/${certDir}:/tmp/certificates "; + BindPaths = [ + "${accountDir}:/tmp/accounts" + "/var/lib/acme/${cert}:/tmp/out" + "/var/lib/acme/.lego/${cert}/${certDir}:/tmp/certificates" + ]; # Only try loading the credentialsFile if the dns challenge is enabled EnvironmentFile = mkIf useDns data.credentialsFile; @@ -248,12 +272,18 @@ let # Working directory will be /tmp script = '' - set -euo pipefail + set -euxo pipefail + + ${optionalString (data.webroot != null) '' + # Ensure the webroot exists + mkdir -p '${data.webroot}/.well-known/acme-challenge' + chown 'acme:${data.group}' ${data.webroot}/{.well-known,.well-known/acme-challenge} + ''} echo '${domainHash}' > domainhash.txt # Check if we can renew - if [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' ]; then + if [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(ls -1 accounts)" ]; then # When domains are updated, there's no need to do a full # Lego run, but it's likely renew won't work if days is too low. @@ -316,7 +346,7 @@ let webroot = mkOption { type = types.nullOr types.str; default = null; - example = "/var/lib/acme/acme-challenges"; + example = "/var/lib/acme/acme-challenge"; description = '' Where the webroot of the HTTP vhost is located. <filename>.well-known/acme-challenge/</filename> directory @@ -549,12 +579,12 @@ in { example = literalExample '' { "example.com" = { - webroot = "/var/www/challenges/"; + webroot = "/var/lib/acme/acme-challenge/"; email = "foo@example.com"; extraDomainNames = [ "www.example.com" "foo.example.com" ]; }; "bar.example.com" = { - webroot = "/var/www/challenges/"; + webroot = "/var/lib/acme/acme-challenge/"; email = "bar@example.com"; }; } @@ -663,21 +693,33 @@ in { systemd.timers = mapAttrs' (cert: conf: nameValuePair "acme-${cert}" conf.renewTimer) certConfigs; - # .lego and .lego/accounts specified to fix any incorrect permissions - systemd.tmpfiles.rules = [ - "d /var/lib/acme/.lego - acme acme" - "d /var/lib/acme/.lego/accounts - acme acme" - ] ++ (unique (concatMap (conf: [ - "d ${conf.accountDir} - acme acme" - ] ++ (optional (conf.webroot != null) "d ${conf.webroot}/.well-known/acme-challenge - acme ${conf.group}") - ) (attrValues certConfigs))); - - # Create some targets which can be depended on to be "active" after cert renewals - systemd.targets = mapAttrs' (cert: conf: nameValuePair "acme-finished-${cert}" { - wantedBy = [ "default.target" ]; - requires = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps; - after = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps; - }) certConfigs; + systemd.targets = let + # Create some targets which can be depended on to be "active" after cert renewals + finishedTargets = mapAttrs' (cert: conf: nameValuePair "acme-finished-${cert}" { + wantedBy = [ "default.target" ]; + requires = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps; + after = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps; + }) certConfigs; + + # Create targets to limit the number of simultaneous account creations + # How it works: + # - Pick a "leader" cert service, which will be in charge of creating the account, + # and run first (requires + after) + # - Make all other cert services sharing the same account wait for the leader to + # finish before starting (requiredBy + before). + # Using a target here is fine - account creation is a one time event. Even if + # systemd clean --what=state is used to delete the account, so long as the user + # then runs one of the cert services, there won't be any issues. + accountTargets = mapAttrs' (hash: confs: let + leader = "acme-${(builtins.head confs).cert}.service"; + dependantServices = map (conf: "acme-${conf.cert}.service") (builtins.tail confs); + in nameValuePair "acme-account-${hash}" { + requiredBy = dependantServices; + before = dependantServices; + requires = [ leader ]; + after = [ leader ]; + }) (groupBy (conf: conf.accountHash) (attrValues certConfigs)); + in finishedTargets // accountTargets; }) ]; diff --git a/nixos/modules/security/acme.xml b/nixos/modules/security/acme.xml index 17e94bc12fb21..a78ff05f2eaad 100644 --- a/nixos/modules/security/acme.xml +++ b/nixos/modules/security/acme.xml @@ -115,15 +115,18 @@ services.nginx = { <programlisting> <xref linkend="opt-security.acme.acceptTerms" /> = true; <xref linkend="opt-security.acme.email" /> = "admin+acme@example.com"; + +# /var/lib/acme/.challenges must be writable by the ACME user +# and readable by the Nginx user. The easiest way to achieve +# this is to add the Nginx user to the ACME group. +<link linkend="opt-users.users._name_.extraGroups">users.users.nginx.extraGroups</link> = [ "acme" ]; + services.nginx = { <link linkend="opt-services.nginx.enable">enable</link> = true; <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = { "acmechallenge.example.com" = { # Catchall vhost, will redirect users to HTTPS for all vhosts <link linkend="opt-services.nginx.virtualHosts._name_.serverAliases">serverAliases</link> = [ "*.example.com" ]; - # /var/lib/acme/.challenges must be writable by the ACME user - # and readable by the Nginx user. - # By default, this is the case. locations."/.well-known/acme-challenge" = { <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/lib/acme/.challenges"; }; @@ -134,6 +137,7 @@ services.nginx = { }; } # Alternative config for Apache +<link linkend="opt-users.users._name_.extraGroups">users.users.wwwrun.extraGroups</link> = [ "acme" ]; services.httpd = { <link linkend="opt-services.httpd.enable">enable = true;</link> <link linkend="opt-services.httpd.virtualHosts">virtualHosts</link> = { @@ -162,6 +166,9 @@ services.httpd = { <xref linkend="opt-security.acme.certs"/>."foo.example.com" = { <link linkend="opt-security.acme.certs._name_.webroot">webroot</link> = "/var/lib/acme/.challenges"; <link linkend="opt-security.acme.certs._name_.email">email</link> = "foo@example.com"; + # Ensure that the web server you use can read the generated certs + # Take a look at the <link linkend="opt-services.nginx.group">group</link> option for the web server you choose. + <link linkend="opt-security.acme.certs._name_.group">group</link> = "nginx"; # Since we have a wildcard vhost to handle port 80, # we can generate certs for anything! # Just make sure your DNS resolves them. @@ -257,10 +264,35 @@ chmod 400 /var/lib/secrets/certs.secret <para> Should you need to regenerate a particular certificate in a hurry, such as when a vulnerability is found in Let's Encrypt, there is now a convenient - mechanism for doing so. Running <literal>systemctl clean acme-example.com.service</literal> - will remove all certificate files for the given domain, allowing you to then - <literal>systemctl start acme-example.com.service</literal> to generate fresh - ones. + mechanism for doing so. Running + <literal>systemctl clean --what=state acme-example.com.service</literal> + will remove all certificate files and the account data for the given domain, + allowing you to then <literal>systemctl start acme-example.com.service</literal> + to generate fresh ones. </para> </section> + <section xml:id="module-security-acme-fix-jws"> + <title>Fixing JWS Verification error</title> + + <para> + It is possible that your account credentials file may become corrupt and need + to be regenerated. In this scenario lego will produce the error <literal>JWS verification error</literal>. + The solution is to simply delete the associated accounts file and + re-run the affected service(s). + </para> + +<programlisting> +# Find the accounts folder for the certificate +systemctl cat acme-example.com.service | grep -Po 'accounts/[^:]*' +export accountdir="$(!!)" +# Move this folder to some place else +mv /var/lib/acme/.lego/$accountdir{,.bak} +# Recreate the folder using systemd-tmpfiles +systemd-tmpfiles --create +# Get a new account and reissue certificates +# Note: Do this for all certs that share the same account email address +systemctl start acme-example.com.service +</programlisting> + + </section> </chapter> diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index a428103eaa963..103cf20501237 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -394,7 +394,7 @@ let ${optionalString cfg.requireWheel "auth required pam_wheel.so use_uid"} ${optionalString cfg.logFailures - "auth required pam_tally.so"} + "auth required pam_faillock.so"} ${optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth) "auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles}"} ${optionalString cfg.fprintAuth @@ -430,8 +430,8 @@ let ${optionalString cfg.pamMount "auth optional ${pkgs.pam_mount}/lib/security/pam_mount.so"} ${optionalString cfg.enableKwallet - ("auth optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" + - " kwalletd=${pkgs.kdeFrameworks.kwallet.bin}/bin/kwalletd5")} + ("auth optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so" + + " kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5")} ${optionalString cfg.enableGnomeKeyring "auth optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so"} ${optionalString cfg.gnupg.enable @@ -509,8 +509,8 @@ let ${optionalString (cfg.enableAppArmor && config.security.apparmor.enable) "session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug"} ${optionalString (cfg.enableKwallet) - ("session optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" + - " kwalletd=${pkgs.kdeFrameworks.kwallet.bin}/bin/kwalletd5")} + ("session optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so" + + " kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5")} ${optionalString (cfg.enableGnomeKeyring) "session optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start"} ${optionalString cfg.gnupg.enable diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix index de6213714ac3a..3cbf22fea7a96 100644 --- a/nixos/modules/security/wrappers/default.nix +++ b/nixos/modules/security/wrappers/default.nix @@ -10,16 +10,8 @@ let (n: v: (if v ? program then v else v // {program=n;})) wrappers); - securityWrapper = pkgs.stdenv.mkDerivation { - name = "security-wrapper"; - phases = [ "installPhase" "fixupPhase" ]; - buildInputs = [ pkgs.libcap pkgs.libcap_ng pkgs.linuxHeaders ]; - hardeningEnable = [ "pie" ]; - installPhase = '' - mkdir -p $out/bin - $CC -Wall -O2 -DWRAPPER_DIR=\"${parentWrapperDir}\" \ - -lcap-ng -lcap ${./wrapper.c} -o $out/bin/security-wrapper - ''; + securityWrapper = pkgs.callPackage ./wrapper.nix { + inherit parentWrapperDir; }; ###### Activation script for the setcap wrappers diff --git a/nixos/modules/security/wrappers/wrapper.c b/nixos/modules/security/wrappers/wrapper.c index 494e9e93ac222..529669facda87 100644 --- a/nixos/modules/security/wrappers/wrapper.c +++ b/nixos/modules/security/wrappers/wrapper.c @@ -4,15 +4,17 @@ #include <unistd.h> #include <sys/types.h> #include <sys/stat.h> +#include <sys/xattr.h> #include <fcntl.h> #include <dirent.h> #include <assert.h> #include <errno.h> #include <linux/capability.h> -#include <sys/capability.h> #include <sys/prctl.h> #include <limits.h> -#include <cap-ng.h> +#include <stdint.h> +#include <syscall.h> +#include <byteswap.h> // Make sure assertions are not compiled out, we use them to codify // invariants about this program and we want it to fail fast and @@ -23,182 +25,172 @@ extern char **environ; // The WRAPPER_DIR macro is supplied at compile time so that it cannot // be changed at runtime -static char * wrapperDir = WRAPPER_DIR; +static char *wrapper_dir = WRAPPER_DIR; // Wrapper debug variable name -static char * wrapperDebug = "WRAPPER_DEBUG"; - -// Update the capabilities of the running process to include the given -// capability in the Ambient set. -static void set_ambient_cap(cap_value_t cap) -{ - capng_get_caps_process(); - - if (capng_update(CAPNG_ADD, CAPNG_INHERITABLE, (unsigned long) cap)) - { - perror("cannot raise the capability into the Inheritable set\n"); - exit(1); +static char *wrapper_debug = "WRAPPER_DEBUG"; + +#define CAP_SETPCAP 8 + +#if __BYTE_ORDER == __BIG_ENDIAN +#define LE32_TO_H(x) bswap_32(x) +#else +#define LE32_TO_H(x) (x) +#endif + +int get_last_cap(unsigned *last_cap) { + FILE* file = fopen("/proc/sys/kernel/cap_last_cap", "r"); + if (file == NULL) { + int saved_errno = errno; + fprintf(stderr, "failed to open /proc/sys/kernel/cap_last_cap: %s\n", strerror(errno)); + return -saved_errno; } - - capng_apply(CAPNG_SELECT_CAPS); - - if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, (unsigned long) cap, 0, 0)) - { - perror("cannot raise the capability into the Ambient set\n"); - exit(1); + int res = fscanf(file, "%u", last_cap); + if (res == EOF) { + int saved_errno = errno; + fprintf(stderr, "could not read number from /proc/sys/kernel/cap_last_cap: %s\n", strerror(errno)); + return -saved_errno; } + fclose(file); + return 0; } // Given the path to this program, fetch its configured capability set // (as set by `setcap ... /path/to/file`) and raise those capabilities // into the Ambient set. -static int make_caps_ambient(const char *selfPath) -{ - cap_t caps = cap_get_file(selfPath); +static int make_caps_ambient(const char *self_path) { + struct vfs_ns_cap_data data = {}; + int r = getxattr(self_path, "security.capability", &data, sizeof(data)); + + if (r < 0) { + if (errno == ENODATA) { + // no capabilities set + return 0; + } + fprintf(stderr, "cannot get capabilities for %s: %s", self_path, strerror(errno)); + return 1; + } - if(!caps) - { - if(getenv(wrapperDebug)) - fprintf(stderr, "no caps set or could not retrieve the caps for this file, not doing anything..."); + size_t size; + uint32_t version = LE32_TO_H(data.magic_etc) & VFS_CAP_REVISION_MASK; + switch (version) { + case VFS_CAP_REVISION_1: + size = VFS_CAP_U32_1; + break; + case VFS_CAP_REVISION_2: + case VFS_CAP_REVISION_3: + size = VFS_CAP_U32_3; + break; + default: + fprintf(stderr, "BUG! Unsupported capability version 0x%x on %s. Report to NixOS bugtracker\n", version, self_path); + return 1; + } - return 1; + const struct __user_cap_header_struct header = { + .version = _LINUX_CAPABILITY_VERSION_3, + .pid = getpid(), + }; + struct __user_cap_data_struct user_data[2] = {}; + + for (size_t i = 0; i < size; i++) { + // merge inheritable & permitted into one + user_data[i].permitted = user_data[i].inheritable = + LE32_TO_H(data.data[i].inheritable) | LE32_TO_H(data.data[i].permitted); } - // We use `cap_to_text` and iteration over the tokenized result - // string because, as of libcap's current release, there is no - // facility for retrieving an array of `cap_value_t`'s that can be - // given to `prctl` in order to lift that capability into the - // Ambient set. - // - // Some discussion was had around shot-gunning all of the - // capabilities we know about into the Ambient set but that has a - // security smell and I deemed the risk of the current - // implementation crashing the program to be lower than the risk - // of a privilege escalation security hole being introduced by - // raising all capabilities, even ones we didn't intend for the - // program, into the Ambient set. - // - // `cap_t` which is returned by `cap_get_*` is an opaque type and - // even if we could retrieve the bitmasks (which, as far as I can - // tell we cannot) in order to get the `cap_value_t` - // representation for each capability we would have to take the - // total number of capabilities supported and iterate over the - // sequence of integers up-to that maximum total, testing each one - // against the bitmask ((bitmask >> n) & 1) to see if it's set and - // aggregating each "capability integer n" that is set in the - // bitmask. - // - // That, combined with the fact that we can't easily get the - // bitmask anyway seemed much more brittle than fetching the - // `cap_t`, transforming it into a textual representation, - // tokenizing the string, and using `cap_from_name` on the token - // to get the `cap_value_t` that we need for `prctl`. There is - // indeed risk involved if the output string format of - // `cap_to_text` ever changes but at this time the combination of - // factors involving the below list have led me to the conclusion - // that the best implementation at this time is reading then - // parsing with *lots of documentation* about why we're doing it - // this way. - // - // 1. No explicit API for fetching an array of `cap_value_t`'s or - // for transforming a `cap_t` into such a representation - // 2. The risk of a crash is lower than lifting all capabilities - // into the Ambient set - // 3. libcap is depended on heavily in the Linux ecosystem so - // there is a high chance that the output representation of - // `cap_to_text` will not change which reduces our risk that - // this parsing step will cause a crash - // - // The preferred method, should it ever be available in the - // future, would be to use libcap API's to transform the result - // from a `cap_get_*` into an array of `cap_value_t`'s that can - // then be given to prctl. - // - // - Parnell - ssize_t capLen; - char* capstr = cap_to_text(caps, &capLen); - cap_free(caps); - - // TODO: For now, we assume that cap_to_text always starts its - // result string with " =" and that the first capability is listed - // immediately after that. We should verify this. - assert(capLen >= 2); - capstr += 2; - - char* saveptr = NULL; - for(char* tok = strtok_r(capstr, ",", &saveptr); tok; tok = strtok_r(NULL, ",", &saveptr)) - { - cap_value_t capnum; - if (cap_from_name(tok, &capnum)) - { - if(getenv(wrapperDebug)) - fprintf(stderr, "cap_from_name failed, skipping: %s", tok); - } - else if (capnum == CAP_SETPCAP) - { - // Check for the cap_setpcap capability, we set this on the - // wrapper so it can elevate the capabilities to the Ambient - // set but we do not want to propagate it down into the - // wrapped program. - // - // TODO: what happens if that's the behavior you want - // though???? I'm preferring a strict vs. loose policy here. - if(getenv(wrapperDebug)) - fprintf(stderr, "cap_setpcap in set, skipping it\n"); - } - else - { - set_ambient_cap(capnum); - - if(getenv(wrapperDebug)) - fprintf(stderr, "raised %s into the Ambient capability set\n", tok); - } + if (syscall(SYS_capset, &header, &user_data) < 0) { + fprintf(stderr, "failed to inherit capabilities: %s", strerror(errno)); + return 1; + } + unsigned last_cap; + r = get_last_cap(&last_cap); + if (r < 0) { + return 1; + } + uint64_t set = user_data[0].permitted | (uint64_t)user_data[1].permitted << 32; + for (unsigned cap = 0; cap < last_cap; cap++) { + if (!(set & (1ULL << cap))) { + continue; + } + + // Check for the cap_setpcap capability, we set this on the + // wrapper so it can elevate the capabilities to the Ambient + // set but we do not want to propagate it down into the + // wrapped program. + // + // TODO: what happens if that's the behavior you want + // though???? I'm preferring a strict vs. loose policy here. + if (cap == CAP_SETPCAP) { + if(getenv(wrapper_debug)) { + fprintf(stderr, "cap_setpcap in set, skipping it\n"); + } + continue; + } + if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, (unsigned long) cap, 0, 0)) { + fprintf(stderr, "cannot raise the capability %d into the ambient set: %s\n", cap, strerror(errno)); + return 1; + } + if (getenv(wrapper_debug)) { + fprintf(stderr, "raised %d into the ambient capability set\n", cap); + } } - cap_free(capstr); return 0; } -int main(int argc, char * * argv) -{ - // I *think* it's safe to assume that a path from a symbolic link - // should safely fit within the PATH_MAX system limit. Though I'm - // not positive it's safe... - char selfPath[PATH_MAX]; - int selfPathSize = readlink("/proc/self/exe", selfPath, sizeof(selfPath)); - - assert(selfPathSize > 0); - - // Assert we have room for the zero byte, this ensures the path - // isn't being truncated because it's too big for the buffer. - // - // A better way to handle this might be to use something like the - // whereami library (https://github.com/gpakosz/whereami) or a - // loop that resizes the buffer and re-reads the link if the - // contents are being truncated. - assert(selfPathSize < sizeof(selfPath)); +int readlink_malloc(const char *p, char **ret) { + size_t l = FILENAME_MAX+1; + int r; + + for (;;) { + char *c = calloc(l, sizeof(char)); + if (!c) { + return -ENOMEM; + } + + ssize_t n = readlink(p, c, l-1); + if (n < 0) { + r = -errno; + free(c); + return r; + } + + if ((size_t) n < l-1) { + c[n] = 0; + *ret = c; + return 0; + } + + free(c); + l *= 2; + } +} - // Set the zero byte since readlink doesn't do that for us. - selfPath[selfPathSize] = '\0'; +int main(int argc, char **argv) { + char *self_path = NULL; + int self_path_size = readlink_malloc("/proc/self/exe", &self_path); + if (self_path_size < 0) { + fprintf(stderr, "cannot readlink /proc/self/exe: %s", strerror(-self_path_size)); + } // Make sure that we are being executed from the right location, - // i.e., `safeWrapperDir'. This is to prevent someone from creating + // i.e., `safe_wrapper_dir'. This is to prevent someone from creating // hard link `X' from some other location, along with a false // `X.real' file, to allow arbitrary programs from being executed // with elevated capabilities. - int len = strlen(wrapperDir); - if (len > 0 && '/' == wrapperDir[len - 1]) + int len = strlen(wrapper_dir); + if (len > 0 && '/' == wrapper_dir[len - 1]) --len; - assert(!strncmp(selfPath, wrapperDir, len)); - assert('/' == wrapperDir[0]); - assert('/' == selfPath[len]); + assert(!strncmp(self_path, wrapper_dir, len)); + assert('/' == wrapper_dir[0]); + assert('/' == self_path[len]); // Make *really* *really* sure that we were executed as - // `selfPath', and not, say, as some other setuid program. That + // `self_path', and not, say, as some other setuid program. That // is, our effective uid/gid should match the uid/gid of - // `selfPath'. + // `self_path'. struct stat st; - assert(lstat(selfPath, &st) != -1); + assert(lstat(self_path, &st) != -1); assert(!(st.st_mode & S_ISUID) || (st.st_uid == geteuid())); assert(!(st.st_mode & S_ISGID) || (st.st_gid == getegid())); @@ -207,33 +199,35 @@ int main(int argc, char * * argv) assert(!(st.st_mode & (S_IWGRP | S_IWOTH))); // Read the path of the real (wrapped) program from <self>.real. - char realFN[PATH_MAX + 10]; - int realFNSize = snprintf (realFN, sizeof(realFN), "%s.real", selfPath); - assert (realFNSize < sizeof(realFN)); + char real_fn[PATH_MAX + 10]; + int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path); + assert(real_fn_size < sizeof(real_fn)); - int fdSelf = open(realFN, O_RDONLY); - assert (fdSelf != -1); + int fd_self = open(real_fn, O_RDONLY); + assert(fd_self != -1); - char sourceProg[PATH_MAX]; - len = read(fdSelf, sourceProg, PATH_MAX); - assert (len != -1); - assert (len < sizeof(sourceProg)); - assert (len > 0); - sourceProg[len] = 0; + char source_prog[PATH_MAX]; + len = read(fd_self, source_prog, PATH_MAX); + assert(len != -1); + assert(len < sizeof(source_prog)); + assert(len > 0); + source_prog[len] = 0; - close(fdSelf); + close(fd_self); // Read the capabilities set on the wrapper and raise them in to - // the Ambient set so the program we're wrapping receives the + // the ambient set so the program we're wrapping receives the // capabilities too! - make_caps_ambient(selfPath); + if (make_caps_ambient(self_path) != 0) { + free(self_path); + return 1; + } + free(self_path); - execve(sourceProg, argv, environ); + execve(source_prog, argv, environ); fprintf(stderr, "%s: cannot run `%s': %s\n", - argv[0], sourceProg, strerror(errno)); + argv[0], source_prog, strerror(errno)); - exit(1); + return 1; } - - diff --git a/nixos/modules/security/wrappers/wrapper.nix b/nixos/modules/security/wrappers/wrapper.nix new file mode 100644 index 0000000000000..e3620fb222d2c --- /dev/null +++ b/nixos/modules/security/wrappers/wrapper.nix @@ -0,0 +1,21 @@ +{ stdenv, linuxHeaders, parentWrapperDir, debug ? false }: +# For testing: +# $ nix-build -E 'with import <nixpkgs> {}; pkgs.callPackage ./wrapper.nix { parentWrapperDir = "/run/wrappers"; debug = true; }' +stdenv.mkDerivation { + name = "security-wrapper"; + buildInputs = [ linuxHeaders ]; + dontUnpack = true; + hardeningEnable = [ "pie" ]; + CFLAGS = [ + ''-DWRAPPER_DIR="${parentWrapperDir}"'' + ] ++ (if debug then [ + "-Werror" "-Og" "-g" + ] else [ + "-Wall" "-O2" + ]); + dontStrip = debug; + installPhase = '' + mkdir -p $out/bin + $CC $CFLAGS ${./wrapper.c} -o $out/bin/security-wrapper + ''; +} diff --git a/nixos/modules/services/amqp/activemq/default.nix b/nixos/modules/services/amqp/activemq/default.nix index 160dbddcd487d..178b2f6e144bd 100644 --- a/nixos/modules/services/amqp/activemq/default.nix +++ b/nixos/modules/services/amqp/activemq/default.nix @@ -33,6 +33,7 @@ in { }; configurationDir = mkOption { default = "${activemq}/conf"; + type = types.str; description = '' The base directory for ActiveMQ's configuration. By default, this directory is searched for a file named activemq.xml, diff --git a/nixos/modules/services/audio/alsa.nix b/nixos/modules/services/audio/alsa.nix index 3fe76a1654010..aff3fe2ba42d4 100644 --- a/nixos/modules/services/audio/alsa.nix +++ b/nixos/modules/services/audio/alsa.nix @@ -32,7 +32,7 @@ in enableOSSEmulation = mkOption { type = types.bool; - default = true; + default = false; description = '' Whether to enable ALSA OSS emulation (with certain cards sound mixing may not work!). ''; diff --git a/nixos/modules/services/audio/mpd.nix b/nixos/modules/services/audio/mpd.nix index ba20b1b98d971..9f01e29dd0e98 100644 --- a/nixos/modules/services/audio/mpd.nix +++ b/nixos/modules/services/audio/mpd.nix @@ -10,6 +10,14 @@ let gid = config.ids.gids.mpd; cfg = config.services.mpd; + credentialsPlaceholder = (creds: + let + placeholders = (imap0 + (i: c: ''password "{{password-${toString i}}}@${concatStringsSep "," c.permissions}"'') + creds); + in + concatStringsSep "\n" placeholders); + mpdConf = pkgs.writeText "mpd.conf" '' # This file was automatically generated by NixOS. Edit mpd's configuration # via NixOS' configuration.nix, as this file will be rewritten upon mpd's @@ -32,6 +40,8 @@ let } ''} + ${optionalString (cfg.credentials != []) (credentialsPlaceholder cfg.credentials)} + ${cfg.extraConfig} ''; @@ -64,18 +74,24 @@ in { musicDirectory = mkOption { type = with types; either path (strMatching "(http|https|nfs|smb)://.+"); default = "${cfg.dataDir}/music"; - defaultText = ''''${dataDir}/music''; + defaultText = "\${dataDir}/music"; description = '' - The directory or NFS/SMB network share where mpd reads music from. + The directory or NFS/SMB network share where MPD reads music from. If left + as the default value this directory will automatically be created before + the MPD server starts, otherwise the sysadmin is responsible for ensuring + the directory exists with appropriate ownership and permissions. ''; }; playlistDirectory = mkOption { type = types.path; default = "${cfg.dataDir}/playlists"; - defaultText = ''''${dataDir}/playlists''; + defaultText = "\${dataDir}/playlists"; description = '' - The directory where mpd stores playlists. + The directory where MPD stores playlists. If left as the default value + this directory will automatically be created before the MPD server starts, + otherwise the sysadmin is responsible for ensuring the directory exists + with appropriate ownership and permissions. ''; }; @@ -94,8 +110,10 @@ in { type = types.path; default = "/var/lib/${name}"; description = '' - The directory where MPD stores its state, tag cache, - playlists etc. + The directory where MPD stores its state, tag cache, playlists etc. If + left as the default value this directory will automatically be created + before the MPD server starts, otherwise the sysadmin is responsible for + ensuring the directory exists with appropriate ownership and permissions. ''; }; @@ -137,23 +155,42 @@ in { dbFile = mkOption { type = types.nullOr types.str; default = "${cfg.dataDir}/tag_cache"; - defaultText = ''''${dataDir}/tag_cache''; + defaultText = "\${dataDir}/tag_cache"; description = '' The path to MPD's database. If set to <literal>null</literal> the parameter is omitted from the configuration. ''; }; - credentialsFile = mkOption { - type = types.path; + credentials = mkOption { + type = types.listOf (types.submodule { + options = { + passwordFile = mkOption { + type = types.path; + description = '' + Path to file containing the password. + ''; + }; + permissions = let + perms = ["read" "add" "control" "admin"]; + in mkOption { + type = types.listOf (types.enum perms); + default = [ "read" ]; + description = '' + List of permissions that are granted with this password. + Permissions can be "${concatStringsSep "\", \"" perms}". + ''; + }; + }; + }); description = '' - Path to a file to be merged with the settings during the service startup. - Useful to merge a file which is better kept out of the Nix store - because it contains sensible data like MPD's password. Example may look like this: - <literal>password "myMpdPassword@read,add,control,admin"</literal> + Credentials and permissions for accessing the mpd server. ''; - default = "/dev/null"; - example = "/var/lib/secrets/mpd.conf"; + default = []; + example = [ + {passwordFile = "/var/lib/secrets/mpd_readonly_password"; permissions = [ "read" ];} + {passwordFile = "/var/lib/secrets/mpd_admin_password"; permissions = ["read" "add" "control" "admin"];} + ]; }; fluidsynth = mkOption { @@ -185,44 +222,46 @@ in { }; }; - systemd.tmpfiles.rules = [ - "d '${cfg.dataDir}' - ${cfg.user} ${cfg.group} - -" - "d '${cfg.playlistDirectory}' - ${cfg.user} ${cfg.group} - -" - ]; - systemd.services.mpd = { after = [ "network.target" "sound.target" ]; description = "Music Player Daemon"; wantedBy = optional (!cfg.startWhenNeeded) "multi-user.target"; - serviceConfig = { - User = "${cfg.user}"; - ExecStart = "${pkgs.mpd}/bin/mpd --no-daemon /etc/mpd.conf"; - ExecStartPre = pkgs.writeScript "mpd-start-pre" '' - #!${pkgs.runtimeShell} - set -euo pipefail - cat ${mpdConf} ${cfg.credentialsFile} > /etc/mpd.conf - ''; - Type = "notify"; - LimitRTPRIO = 50; - LimitRTTIME = "infinity"; - ProtectSystem = true; - NoNewPrivileges = true; - ProtectKernelTunables = true; - ProtectControlGroups = true; - ProtectKernelModules = true; - RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX AF_NETLINK"; - RestrictNamespaces = true; - Restart = "always"; - }; - }; - environment.etc."mpd.conf" = { - mode = "0640"; - group = cfg.group; - user = cfg.user; - # To be modified by the service' ExecStartPre - text = '' - ''; + serviceConfig = mkMerge [ + { + User = "${cfg.user}"; + ExecStart = "${pkgs.mpd}/bin/mpd --no-daemon /run/mpd/mpd.conf"; + ExecStartPre = pkgs.writeShellScript "mpd-start-pre" '' + set -euo pipefail + install -m 600 ${mpdConf} /run/mpd/mpd.conf + ${optionalString (cfg.credentials != []) + "${pkgs.replace}/bin/replace-literal -fe ${ + concatStringsSep " -a " (imap0 (i: c: "\"{{password-${toString i}}}\" \"$(cat ${c.passwordFile})\"") cfg.credentials) + } /run/mpd/mpd.conf"} + ''; + RuntimeDirectory = "mpd"; + Type = "notify"; + LimitRTPRIO = 50; + LimitRTTIME = "infinity"; + ProtectSystem = true; + NoNewPrivileges = true; + ProtectKernelTunables = true; + ProtectControlGroups = true; + ProtectKernelModules = true; + RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX AF_NETLINK"; + RestrictNamespaces = true; + Restart = "always"; + } + (mkIf (cfg.dataDir == "/var/lib/${name}") { + StateDirectory = [ name ]; + }) + (mkIf (cfg.playlistDirectory == "/var/lib/${name}/playlists") { + StateDirectory = [ name "${name}/playlists" ]; + }) + (mkIf (cfg.musicDirectory == "/var/lib/${name}/music") { + StateDirectory = [ name "${name}/music" ]; + }) + ]; }; users.users = optionalAttrs (cfg.user == name) { diff --git a/nixos/modules/services/audio/mpdscribble.nix b/nixos/modules/services/audio/mpdscribble.nix new file mode 100644 index 0000000000000..642d8743935f1 --- /dev/null +++ b/nixos/modules/services/audio/mpdscribble.nix @@ -0,0 +1,202 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.mpdscribble; + mpdCfg = config.services.mpd; + + endpointUrls = { + "last.fm" = "http://post.audioscrobbler.com"; + "libre.fm" = "http://turtle.libre.fm"; + "jamendo" = "http://postaudioscrobbler.jamendo.com"; + "listenbrainz" = "http://proxy.listenbrainz.org"; + }; + + mkSection = secname: secCfg: '' + [${secname}] + url = ${secCfg.url} + username = ${secCfg.username} + password = {{${secname}_PASSWORD}} + journal = /var/lib/mpdscribble/${secname}.journal + ''; + + endpoints = concatStringsSep "\n" (mapAttrsToList mkSection cfg.endpoints); + cfgTemplate = pkgs.writeText "mpdscribble.conf" '' + ## This file was automatically genenrated by NixOS and will be overwritten. + ## Do not edit. Edit your NixOS configuration instead. + + ## mpdscribble - an audioscrobbler for the Music Player Daemon. + ## http://mpd.wikia.com/wiki/Client:mpdscribble + + # HTTP proxy URL. + ${optionalString (cfg.proxy != null) "proxy = ${cfg.proxy}"} + + # The location of the mpdscribble log file. The special value + # "syslog" makes mpdscribble use the local syslog daemon. On most + # systems, log messages will appear in /var/log/daemon.log then. + # "-" means log to stderr (the current terminal). + log = - + + # How verbose mpdscribble's logging should be. Default is 1. + verbose = ${toString cfg.verbose} + + # How often should mpdscribble save the journal file? [seconds] + journal_interval = ${toString cfg.journalInterval} + + # The host running MPD, possibly protected by a password + # ([PASSWORD@]HOSTNAME). + host = ${(optionalString (cfg.passwordFile != null) "{{MPD_PASSWORD}}@") + cfg.host} + + # The port that the MPD listens on and mpdscribble should try to + # connect to. + port = ${toString cfg.port} + + ${endpoints} + ''; + + cfgFile = "/run/mpdscribble/mpdscribble.conf"; + + replaceSecret = secretFile: placeholder: targetFile: + optionalString (secretFile != null) '' + ${pkgs.replace}/bin/replace-literal -ef ${placeholder} "$(cat ${secretFile})" ${targetFile}''; + + preStart = pkgs.writeShellScript "mpdscribble-pre-start" '' + cp -f "${cfgTemplate}" "${cfgFile}" + ${replaceSecret cfg.passwordFile "{{MPD_PASSWORD}}" cfgFile} + ${concatStringsSep "\n" (mapAttrsToList (secname: cfg: + replaceSecret cfg.passwordFile "{{${secname}_PASSWORD}}" cfgFile) + cfg.endpoints)} + ''; + + localMpd = (cfg.host == "localhost" || cfg.host == "127.0.0.1"); + +in { + ###### interface + + options.services.mpdscribble = { + + enable = mkEnableOption "mpdscribble"; + + proxy = mkOption { + default = null; + type = types.nullOr types.str; + description = '' + HTTP proxy URL. + ''; + }; + + verbose = mkOption { + default = 1; + type = types.int; + description = '' + Log level for the mpdscribble daemon. + ''; + }; + + journalInterval = mkOption { + default = 600; + example = 60; + type = types.int; + description = '' + How often should mpdscribble save the journal file? [seconds] + ''; + }; + + host = mkOption { + default = (if mpdCfg.network.listenAddress != "any" then + mpdCfg.network.listenAddress + else + "localhost"); + type = types.str; + description = '' + Host for the mpdscribble daemon to search for a mpd daemon on. + ''; + }; + + passwordFile = mkOption { + default = if localMpd then + (findFirst + (c: any (x: x == "read") c.permissions) + { passwordFile = null; } + mpdCfg.credentials).passwordFile + else + null; + type = types.nullOr types.str; + description = '' + File containing the password for the mpd daemon. + If there is a local mpd configured using <option>services.mpd.credentials</option> + the default is automatically set to a matching passwordFile of the local mpd. + ''; + }; + + port = mkOption { + default = mpdCfg.network.port; + type = types.port; + description = '' + Port for the mpdscribble daemon to search for a mpd daemon on. + ''; + }; + + endpoints = mkOption { + type = (let + endpoint = { name, ... }: { + options = { + url = mkOption { + type = types.str; + default = endpointUrls.${name} or ""; + description = + "The url endpoint where the scrobble API is listening."; + }; + username = mkOption { + type = types.str; + description = '' + Username for the scrobble service. + ''; + }; + passwordFile = mkOption { + type = types.nullOr types.str; + description = + "File containing the password, either as MD5SUM or cleartext."; + }; + }; + }; + in types.attrsOf (types.submodule endpoint)); + default = { }; + example = { + "last.fm" = { + username = "foo"; + passwordFile = "/run/secrets/lastfm_password"; + }; + }; + description = '' + Endpoints to scrobble to. + If the endpoint is one of "${ + concatStringsSep "\", \"" (attrNames endpointUrls) + }" the url is set automatically. + ''; + }; + + }; + + ###### implementation + + config = mkIf cfg.enable { + systemd.services.mpdscribble = { + after = [ "network.target" ] ++ (optional localMpd "mpd.service"); + description = "mpdscribble mpd scrobble client"; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + DynamicUser = true; + StateDirectory = "mpdscribble"; + RuntimeDirectory = "mpdscribble"; + RuntimeDirectoryMode = "700"; + # TODO use LoadCredential= instead of running preStart with full privileges? + ExecStartPre = "+${preStart}"; + ExecStart = + "${pkgs.mpdscribble}/bin/mpdscribble --no-daemon --conf ${cfgFile}"; + }; + }; + }; + +} diff --git a/nixos/modules/services/audio/snapserver.nix b/nixos/modules/services/audio/snapserver.nix index f614f0ba3e10c..0acaccfd3ca9c 100644 --- a/nixos/modules/services/audio/snapserver.nix +++ b/nixos/modules/services/audio/snapserver.nix @@ -198,13 +198,14 @@ in { type = with types; attrsOf (submodule { options = { location = mkOption { - type = types.path; + type = types.oneOf [ types.path types.str ]; description = '' - The location of the pipe. + The location of the pipe, file, Librespot/Airplay/process binary, or a TCP address. + Use an empty string for alsa. ''; }; type = mkOption { - type = types.enum [ "pipe" "file" "process" "spotify" "airplay" ]; + type = types.enum [ "pipe" "librespot" "airplay" "file" "process" "tcp" "alsa" "spotify" ]; default = "pipe"; description = '' The type of input stream. @@ -219,13 +220,21 @@ in { example = literalExample '' # for type == "pipe": { - mode = "listen"; + mode = "create"; }; # for type == "process": { params = "--param1 --param2"; logStderr = "true"; }; + # for type == "tcp": + { + mode = "client"; + } + # for type == "alsa": + { + device = "hw:0,0"; + } ''; }; inherit sampleFormat; @@ -255,6 +264,11 @@ in { config = mkIf cfg.enable { + # https://github.com/badaix/snapcast/blob/98ac8b2fb7305084376607b59173ce4097c620d8/server/streamreader/stream_manager.cpp#L85 + warnings = filter (w: w != "") (mapAttrsToList (k: v: if v.type == "spotify" then '' + services.snapserver.streams.${k}.type = "spotify" is deprecated, use services.snapserver.streams.${k}.type = "librespot" instead. + '' else "") cfg.streams); + systemd.services.snapserver = { after = [ "network.target" ]; description = "Snapserver"; @@ -272,7 +286,7 @@ in { ProtectKernelTunables = true; ProtectControlGroups = true; ProtectKernelModules = true; - RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX"; + RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX AF_NETLINK"; RestrictNamespaces = true; RuntimeDirectory = name; StateDirectory = name; diff --git a/nixos/modules/services/backup/bacula.nix b/nixos/modules/services/backup/bacula.nix index 3d69a69038a3c..cc8b77cbfbe8e 100644 --- a/nixos/modules/services/backup/bacula.nix +++ b/nixos/modules/services/backup/bacula.nix @@ -1,5 +1,6 @@ { config, lib, pkgs, ... }: + # TODO: test configuration when building nixexpr (use -t parameter) # TODO: support sqlite3 (it's deprecate?) and mysql @@ -111,6 +112,7 @@ let { options = { password = mkOption { + type = types.str; # TODO: required? description = '' Specifies the password that must be supplied for the default Bacula @@ -130,6 +132,7 @@ let }; monitor = mkOption { + type = types.enum [ "no" "yes" ]; default = "no"; example = "yes"; description = '' @@ -150,6 +153,7 @@ let { options = { changerDevice = mkOption { + type = types.str; description = '' The specified name-string must be the generic SCSI device name of the autochanger that corresponds to the normal read/write Archive Device @@ -168,6 +172,7 @@ let }; changerCommand = mkOption { + type = types.str; description = '' The name-string specifies an external program to be called that will automatically change volumes as required by Bacula. Normally, this @@ -190,12 +195,13 @@ let }; devices = mkOption { - description = '' - ''; + description = ""; + type = types.listOf types.str; }; extraAutochangerConfig = mkOption { default = ""; + type = types.lines; description = '' Extra configuration to be passed in Autochanger directive. ''; @@ -212,6 +218,7 @@ let options = { archiveDevice = mkOption { # TODO: required? + type = types.str; description = '' The specified name-string gives the system file name of the storage device managed by this storage daemon. This will usually be the @@ -228,6 +235,7 @@ let mediaType = mkOption { # TODO: required? + type = types.str; description = '' The specified name-string names the type of media supported by this device, for example, <literal>DLT7000</literal>. Media type names are @@ -265,6 +273,7 @@ let extraDeviceConfig = mkOption { default = ""; + type = types.lines; description = '' Extra configuration to be passed in Device directive. ''; @@ -293,6 +302,7 @@ in { name = mkOption { default = "${config.networking.hostName}-fd"; + type = types.str; description = '' The client name that must be used by the Director when connecting. Generally, it is a good idea to use a name related to the machine so @@ -321,6 +331,7 @@ in { extraClientConfig = mkOption { default = ""; + type = types.lines; description = '' Extra configuration to be passed in Client directive. ''; @@ -332,6 +343,7 @@ in { extraMessagesConfig = mkOption { default = ""; + type = types.lines; description = '' Extra configuration to be passed in Messages directive. ''; @@ -352,6 +364,7 @@ in { name = mkOption { default = "${config.networking.hostName}-sd"; + type = types.str; description = '' Specifies the Name of the Storage daemon. ''; @@ -392,6 +405,7 @@ in { extraStorageConfig = mkOption { default = ""; + type = types.lines; description = '' Extra configuration to be passed in Storage directive. ''; @@ -403,6 +417,7 @@ in { extraMessagesConfig = mkOption { default = ""; + type = types.lines; description = '' Extra configuration to be passed in Messages directive. ''; @@ -424,6 +439,7 @@ in { name = mkOption { default = "${config.networking.hostName}-dir"; + type = types.str; description = '' The director name used by the system administrator. This directive is required. @@ -445,6 +461,7 @@ in { password = mkOption { # TODO: required? + type = types.str; description = '' Specifies the password that must be supplied for a Director. ''; @@ -452,6 +469,7 @@ in { extraMessagesConfig = mkOption { default = ""; + type = types.lines; description = '' Extra configuration to be passed in Messages directive. ''; @@ -462,6 +480,7 @@ in { extraDirectorConfig = mkOption { default = ""; + type = types.lines; description = '' Extra configuration to be passed in Director directive. ''; diff --git a/nixos/modules/services/backup/mysql-backup.nix b/nixos/modules/services/backup/mysql-backup.nix index 31d606b141a8d..506ded5e9e8c4 100644 --- a/nixos/modules/services/backup/mysql-backup.nix +++ b/nixos/modules/services/backup/mysql-backup.nix @@ -48,6 +48,7 @@ in }; user = mkOption { + type = types.str; default = defaultUser; description = '' User to be used to perform backup. @@ -56,12 +57,14 @@ in databases = mkOption { default = []; + type = types.listOf types.str; description = '' List of database names to dump. ''; }; location = mkOption { + type = types.path; default = "/var/backup/mysql"; description = '' Location to put the gzipped MySQL database dumps. @@ -70,6 +73,7 @@ in singleTransaction = mkOption { default = false; + type = types.bool; description = '' Whether to create database dump in a single transaction ''; diff --git a/nixos/modules/services/backup/postgresql-backup.nix b/nixos/modules/services/backup/postgresql-backup.nix index 428861a7598a1..f4bd3aa447e5e 100644 --- a/nixos/modules/services/backup/postgresql-backup.nix +++ b/nixos/modules/services/backup/postgresql-backup.nix @@ -48,6 +48,7 @@ in { startAt = mkOption { default = "*-*-* 01:15:00"; + type = types.str; description = '' This option defines (see <literal>systemd.time</literal> for format) when the databases should be dumped. @@ -70,6 +71,7 @@ in { databases = mkOption { default = []; + type = types.listOf types.str; description = '' List of database names to dump. ''; @@ -77,6 +79,7 @@ in { location = mkOption { default = "/var/backup/postgresql"; + type = types.path; description = '' Location to put the gzipped PostgreSQL database dumps. ''; diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix index d869835bf07e6..573f0efa9da41 100644 --- a/nixos/modules/services/backup/restic.nix +++ b/nixos/modules/services/backup/restic.nix @@ -243,9 +243,11 @@ in restartIfChanged = false; serviceConfig = { Type = "oneshot"; - ExecStart = [ "${resticCmd} backup ${concatStringsSep " " backup.extraBackupArgs} ${backupPaths}" ] ++ pruneCmd; + ExecStart = [ "${resticCmd} backup --cache-dir=%C/restic-backups-${name} ${concatStringsSep " " backup.extraBackupArgs} ${backupPaths}" ] ++ pruneCmd; User = backup.user; RuntimeDirectory = "restic-backups-${name}"; + CacheDirectory = "restic-backups-${name}"; + CacheDirectoryMode = "0700"; } // optionalAttrs (backup.s3CredentialsFile != null) { EnvironmentFile = backup.s3CredentialsFile; }; diff --git a/nixos/modules/services/backup/tarsnap.nix b/nixos/modules/services/backup/tarsnap.nix index e1200731c2ca7..8187042b4b801 100644 --- a/nixos/modules/services/backup/tarsnap.nix +++ b/nixos/modules/services/backup/tarsnap.nix @@ -29,13 +29,7 @@ in options = { services.tarsnap = { - enable = mkOption { - type = types.bool; - default = false; - description = '' - Enable periodic tarsnap backups. - ''; - }; + enable = mkEnableOption "periodic tarsnap backups"; keyfile = mkOption { type = types.str; @@ -279,7 +273,8 @@ in Tarsnap archive configurations. Each attribute names an archive to be created at a given time interval, according to the options associated with it. When uploading to the tarsnap server, - archive names are suffixed by a 1 second resolution timestamp. + archive names are suffixed by a 1 second resolution timestamp, + with the format <literal>%Y%m%d%H%M%S</literal>. For each member of the set is created a timer which triggers the instanced <literal>tarsnap-archive-name</literal> service unit. You may use @@ -359,7 +354,7 @@ in script = let tarsnap = ''tarsnap --configfile "/etc/tarsnap/${name}.conf"''; - lastArchive = ''$(${tarsnap} --list-archives | sort | tail -1)''; + lastArchive = "$(${tarsnap} --list-archives | sort | tail -1)"; run = ''${tarsnap} -x -f "${lastArchive}" ${optionalString cfg.verbose "-v"}''; in if (cfg.cachedir != null) then '' diff --git a/nixos/modules/services/cluster/hadoop/default.nix b/nixos/modules/services/cluster/hadoop/default.nix index bfb73f6837159..41ac46e538e35 100644 --- a/nixos/modules/services/cluster/hadoop/default.nix +++ b/nixos/modules/services/cluster/hadoop/default.nix @@ -7,6 +7,7 @@ with lib; options.services.hadoop = { coreSite = mkOption { default = {}; + type = types.attrsOf types.anything; example = literalExample '' { "fs.defaultFS" = "hdfs://localhost"; @@ -17,6 +18,7 @@ with lib; hdfsSite = mkOption { default = {}; + type = types.attrsOf types.anything; example = literalExample '' { "dfs.nameservices" = "namenode1"; @@ -27,6 +29,7 @@ with lib; mapredSite = mkOption { default = {}; + type = types.attrsOf types.anything; example = literalExample '' { "mapreduce.map.cpu.vcores" = "1"; @@ -37,6 +40,7 @@ with lib; yarnSite = mkOption { default = {}; + type = types.attrsOf types.anything; example = literalExample '' { "yarn.resourcemanager.ha.id" = "resourcemanager1"; @@ -50,8 +54,7 @@ with lib; default = pkgs.hadoop; defaultText = "pkgs.hadoop"; example = literalExample "pkgs.hadoop"; - description = '' - ''; + description = ""; }; }; diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix index f0317fdbd160f..e62fbc94415ca 100644 --- a/nixos/modules/services/cluster/k3s/default.nix +++ b/nixos/modules/services/cluster/k3s/default.nix @@ -47,6 +47,7 @@ in extraFlags = mkOption { description = "Extra flags to pass to the k3s command."; + type = types.str; default = ""; example = "--no-deploy traefik --cluster-cidr 10.24.0.0/16"; }; diff --git a/nixos/modules/services/cluster/kubernetes/kubelet.nix b/nixos/modules/services/cluster/kubernetes/kubelet.nix index 2b6e45ba1b905..479027f1b2708 100644 --- a/nixos/modules/services/cluster/kubernetes/kubelet.nix +++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix @@ -241,7 +241,17 @@ in description = "Kubernetes Kubelet Service"; wantedBy = [ "kubernetes.target" ]; after = [ "network.target" "docker.service" "kube-apiserver.service" ]; - path = with pkgs; [ gitMinimal openssh docker util-linux iproute ethtool thin-provisioning-tools iptables socat ] ++ top.path; + path = with pkgs; [ + gitMinimal + openssh + docker + util-linux + iproute + ethtool + thin-provisioning-tools + iptables + socat + ] ++ lib.optional config.boot.zfs.enabled config.boot.zfs.package ++ top.path; preStart = '' ${concatMapStrings (img: '' echo "Seeding docker image: ${img}" diff --git a/nixos/modules/services/computing/slurm/slurm.nix b/nixos/modules/services/computing/slurm/slurm.nix index 705390a21d4ee..7363441e5387a 100644 --- a/nixos/modules/services/computing/slurm/slurm.nix +++ b/nixos/modules/services/computing/slurm/slurm.nix @@ -14,8 +14,8 @@ let ClusterName=${cfg.clusterName} StateSaveLocation=${cfg.stateSaveLocation} SlurmUser=${cfg.user} - ${optionalString (cfg.controlMachine != null) ''controlMachine=${cfg.controlMachine}''} - ${optionalString (cfg.controlAddr != null) ''controlAddr=${cfg.controlAddr}''} + ${optionalString (cfg.controlMachine != null) "controlMachine=${cfg.controlMachine}"} + ${optionalString (cfg.controlAddr != null) "controlAddr=${cfg.controlAddr}"} ${toString (map (x: "NodeName=${x}\n") cfg.nodeName)} ${toString (map (x: "PartitionName=${x}\n") cfg.partitionName)} PlugStackConfig=${plugStackConfig}/plugstack.conf @@ -25,7 +25,7 @@ let plugStackConfig = pkgs.writeTextDir "plugstack.conf" '' - ${optionalString cfg.enableSrunX11 ''optional ${pkgs.slurm-spank-x11}/lib/x11.so''} + ${optionalString cfg.enableSrunX11 "optional ${pkgs.slurm-spank-x11}/lib/x11.so"} ${cfg.extraPlugstackConfig} ''; @@ -34,13 +34,12 @@ let ${cfg.extraCgroupConfig} ''; - slurmdbdConf = pkgs.writeTextDir "slurmdbd.conf" + slurmdbdConf = pkgs.writeText "slurmdbd.conf" '' DbdHost=${cfg.dbdserver.dbdHost} SlurmUser=${cfg.user} StorageType=accounting_storage/mysql StorageUser=${cfg.dbdserver.storageUser} - ${optionalString (cfg.dbdserver.storagePass != null) "StoragePass=${cfg.dbdserver.storagePass}"} ${cfg.dbdserver.extraConfig} ''; @@ -95,26 +94,12 @@ in ''; }; - storagePass = mkOption { - type = types.nullOr types.str; + storagePassFile = mkOption { + type = with types; nullOr str; default = null; description = '' - Database password. Note that this password will be publicable - readable in the nix store. Use <option>configFile</option> - to store the and config file and password outside the nix store. - ''; - }; - - configFile = mkOption { - type = types.nullOr types.str; - default = null; - description = '' - Path to <literal>slurmdbd.conf</literal>. The password for the database connection - is stored in the config file. Use this option to specfify a path - outside the nix store. If this option is unset a configuration file - will be generated. See also: - <citerefentry><refentrytitle>slurmdbd.conf</refentrytitle> - <manvolnum>8</manvolnum></citerefentry>. + Path to file with database password. The content of this will be used to + create the password for the <literal>StoragePass</literal> option. ''; }; @@ -122,7 +107,9 @@ in type = types.lines; default = ""; description = '' - Extra configuration for <literal>slurmdbd.conf</literal> + Extra configuration for <literal>slurmdbd.conf</literal> See also: + <citerefentry><refentrytitle>slurmdbd.conf</refentrytitle> + <manvolnum>8</manvolnum></citerefentry>. ''; }; }; @@ -292,6 +279,16 @@ in }; + imports = [ + (mkRemovedOptionModule [ "services" "slurm" "dbdserver" "storagePass" ] '' + This option has been removed so that the database password is not exposed via the nix store. + Use services.slurm.dbdserver.storagePassFile to provide the database password. + '') + (mkRemovedOptionModule [ "services" "slurm" "dbdserver" "configFile" ] '' + This option has been removed. Use services.slurm.dbdserver.storagePassFile + and services.slurm.dbdserver.extraConfig instead. + '') + ]; ###### implementation @@ -386,23 +383,34 @@ in ''; }; - systemd.services.slurmdbd = mkIf (cfg.dbdserver.enable) { + systemd.services.slurmdbd = let + # slurm strips the last component off the path + configPath = "$RUNTIME_DIRECTORY/slurmdbd.conf"; + in mkIf (cfg.dbdserver.enable) { path = with pkgs; [ wrappedSlurm munge coreutils ]; wantedBy = [ "multi-user.target" ]; after = [ "network.target" "munged.service" "mysql.service" ]; requires = [ "munged.service" "mysql.service" ]; - # slurm strips the last component off the path - environment.SLURM_CONF = - if (cfg.dbdserver.configFile == null) then - "${slurmdbdConf}/slurm.conf" - else - cfg.dbdserver.configFile; + preStart = '' + cp ${slurmdbdConf} ${configPath} + chmod 600 ${configPath} + chown ${cfg.user} ${configPath} + ${optionalString (cfg.dbdserver.storagePassFile != null) '' + echo "StoragePass=$(cat ${cfg.dbdserver.storagePassFile})" \ + >> ${configPath} + ''} + ''; + + script = '' + export SLURM_CONF=${configPath} + exec ${cfg.package}/bin/slurmdbd -D + ''; serviceConfig = { - Type = "forking"; - ExecStart = "${cfg.package}/bin/slurmdbd"; + RuntimeDirectory = "slurmdbd"; + Type = "simple"; PIDFile = "/run/slurmdbd.pid"; ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; }; diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix index e1950b91382bd..a49f5f8100dc9 100644 --- a/nixos/modules/services/continuous-integration/buildbot/master.nix +++ b/nixos/modules/services/continuous-integration/buildbot/master.nix @@ -223,6 +223,7 @@ in { }; pythonPackages = mkOption { + type = types.functionTo (types.listOf types.package); default = pythonPackages: with pythonPackages; [ ]; defaultText = "pythonPackages: with pythonPackages; [ ]"; description = "Packages to add the to the PYTHONPATH of the buildbot process."; @@ -282,5 +283,5 @@ in { '') ]; - meta.maintainers = with lib.maintainers; [ nand0p mic92 ]; + meta.maintainers = with lib.maintainers; [ nand0p mic92 lopsided98 ]; } diff --git a/nixos/modules/services/continuous-integration/gitlab-runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner.nix index c358a5db77c2f..2c6d9530a6b86 100644 --- a/nixos/modules/services/continuous-integration/gitlab-runner.nix +++ b/nixos/modules/services/continuous-integration/gitlab-runner.nix @@ -66,10 +66,10 @@ let ++ optional service.debugTraceDisabled "--debug-trace-disabled" ++ map (e: "--env ${escapeShellArg e}") (mapAttrsToList (name: value: "${name}=${value}") service.environmentVariables) - ++ optionals (service.executor == "docker") ( + ++ optionals (hasPrefix "docker" service.executor) ( assert ( assertMsg (service.dockerImage != null) - "dockerImage option is required for docker executor (${name})"); + "dockerImage option is required for ${service.executor} executor (${name})"); [ "--docker-image ${service.dockerImage}" ] ++ optional service.dockerDisableCache "--docker-disable-cache" diff --git a/nixos/modules/services/continuous-integration/gocd-agent/default.nix b/nixos/modules/services/continuous-integration/gocd-agent/default.nix index 2e9e1c94857a0..8cae08bf1fa02 100644 --- a/nixos/modules/services/continuous-integration/gocd-agent/default.nix +++ b/nixos/modules/services/continuous-integration/gocd-agent/default.nix @@ -90,6 +90,7 @@ in { }; startupOptions = mkOption { + type = types.listOf types.str; default = [ "-Xms${cfg.initialJavaHeapSize}" "-Xmx${cfg.maxJavaHeapMemory}" @@ -105,6 +106,7 @@ in { extraOptions = mkOption { default = [ ]; + type = types.listOf types.str; example = [ "-X debug" "-Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5006" diff --git a/nixos/modules/services/continuous-integration/gocd-server/default.nix b/nixos/modules/services/continuous-integration/gocd-server/default.nix index 4fa41ac49edfc..4c829664a0a5c 100644 --- a/nixos/modules/services/continuous-integration/gocd-server/default.nix +++ b/nixos/modules/services/continuous-integration/gocd-server/default.nix @@ -27,6 +27,7 @@ in { extraGroups = mkOption { default = [ ]; + type = types.listOf types.str; example = [ "wheel" "docker" ]; description = '' List of extra groups that the "gocd-server" user should be a part of. @@ -92,6 +93,7 @@ in { }; startupOptions = mkOption { + type = types.listOf types.str; default = [ "-Xms${cfg.initialJavaHeapSize}" "-Xmx${cfg.maxJavaHeapMemory}" @@ -113,6 +115,7 @@ in { extraOptions = mkOption { default = [ ]; + type = types.listOf types.str; example = [ "-X debug" "-Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5005" diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix index 252ca17006da8..887a0cbf9a7ab 100644 --- a/nixos/modules/services/continuous-integration/hydra/default.nix +++ b/nixos/modules/services/continuous-integration/hydra/default.nix @@ -231,7 +231,7 @@ in users.users.hydra = { description = "Hydra"; group = "hydra"; - createHome = true; + # We don't enable `createHome` here because the creation of the home directory is handled by the hydra-init service below. home = baseDir; useDefaultShell = true; uid = config.ids.uids.hydra; diff --git a/nixos/modules/services/databases/couchdb.nix b/nixos/modules/services/databases/couchdb.nix index f385331e87823..c99a7529213d7 100644 --- a/nixos/modules/services/databases/couchdb.nix +++ b/nixos/modules/services/databases/couchdb.nix @@ -16,8 +16,7 @@ let [admins] ${cfg.adminUser} = ${cfg.adminPass} '' else - '' - '') + (if useVersion2 then + "") + (if useVersion2 then '' [chttpd] '' else diff --git a/nixos/modules/services/databases/firebird.nix b/nixos/modules/services/databases/firebird.nix index 95837aa1cea66..ed47f647edd36 100644 --- a/nixos/modules/services/databases/firebird.nix +++ b/nixos/modules/services/databases/firebird.nix @@ -59,6 +59,7 @@ in port = mkOption { default = "3050"; + type = types.port; description = '' Port Firebird uses. ''; @@ -66,6 +67,7 @@ in user = mkOption { default = "firebird"; + type = types.str; description = '' User account under which firebird runs. ''; @@ -73,6 +75,7 @@ in baseDir = mkOption { default = "/var/db/firebird"; # ubuntu is using /var/lib/firebird/2.1/data/.. ? + type = types.str; description = '' Location containing data/ and system/ directories. data/ stores the databases, system/ stores the password database security2.fdb. @@ -114,7 +117,7 @@ in serviceConfig.User = cfg.user; serviceConfig.LogsDirectory = "firebird"; serviceConfig.LogsDirectoryMode = "0700"; - serviceConfig.ExecStart = ''${firebird}/bin/fbserver -d''; + serviceConfig.ExecStart = "${firebird}/bin/fbserver -d"; # TODO think about shutdown }; diff --git a/nixos/modules/services/databases/memcached.nix b/nixos/modules/services/databases/memcached.nix index f54bb6cc9b180..ca7b20eb049af 100644 --- a/nixos/modules/services/databases/memcached.nix +++ b/nixos/modules/services/databases/memcached.nix @@ -17,39 +17,44 @@ in options = { services.memcached = { - enable = mkEnableOption "Memcached"; user = mkOption { + type = types.str; default = "memcached"; description = "The user to run Memcached as"; }; listen = mkOption { + type = types.str; default = "127.0.0.1"; - description = "The IP address to bind to"; + description = "The IP address to bind to."; }; port = mkOption { + type = types.port; default = 11211; - description = "The port to bind to"; + description = "The port to bind to."; }; enableUnixSocket = mkEnableOption "unix socket at /run/memcached/memcached.sock"; maxMemory = mkOption { + type = types.ints.unsigned; default = 64; description = "The maximum amount of memory to use for storage, in megabytes."; }; maxConnections = mkOption { + type = types.ints.unsigned; default = 1024; - description = "The maximum number of simultaneous connections"; + description = "The maximum number of simultaneous connections."; }; extraOptions = mkOption { + type = types.listOf types.str; default = []; - description = "A list of extra options that will be added as a suffix when running memcached"; + description = "A list of extra options that will be added as a suffix when running memcached."; }; }; diff --git a/nixos/modules/services/databases/mongodb.nix b/nixos/modules/services/databases/mongodb.nix index 4453a182990d1..db1e5fedf50d8 100644 --- a/nixos/modules/services/databases/mongodb.nix +++ b/nixos/modules/services/databases/mongodb.nix @@ -41,16 +41,19 @@ in }; user = mkOption { + type = types.str; default = "mongodb"; description = "User account under which MongoDB runs"; }; bind_ip = mkOption { + type = types.str; default = "127.0.0.1"; description = "IP to bind to"; }; quiet = mkOption { + type = types.bool; default = false; description = "quieter output"; }; @@ -68,16 +71,19 @@ in }; dbpath = mkOption { + type = types.str; default = "/var/db/mongodb"; description = "Location where MongoDB stores its files"; }; pidFile = mkOption { + type = types.str; default = "/run/mongodb.pid"; description = "Location of MongoDB pid file"; }; replSetName = mkOption { + type = types.str; default = ""; description = '' If this instance is part of a replica set, set its name here. @@ -86,6 +92,7 @@ in }; extraConfig = mkOption { + type = types.lines; default = ""; example = '' storage.journal.enabled: false @@ -176,7 +183,7 @@ in postStart = '' if test -e "${cfg.dbpath}/.first_startup"; then ${optionalString (cfg.initialScript != null) '' - ${mongodb}/bin/mongo -u root -p ${cfg.initialRootPassword} admin "${cfg.initialScript}" + ${mongodb}/bin/mongo ${optionalString (cfg.enableAuth) "-u root -p ${cfg.initialRootPassword}"} admin "${cfg.initialScript}" ''} rm -f "${cfg.dbpath}/.first_startup" fi diff --git a/nixos/modules/services/databases/neo4j.nix b/nixos/modules/services/databases/neo4j.nix index 09b453e758451..53760bb24c4a4 100644 --- a/nixos/modules/services/databases/neo4j.nix +++ b/nixos/modules/services/databases/neo4j.nix @@ -16,14 +16,14 @@ let ''} dbms.ssl.policy.${name}.client_auth=${conf.clientAuth} ${if length (splitString "/" conf.privateKey) > 1 then - ''dbms.ssl.policy.${name}.private_key=${conf.privateKey}'' + "dbms.ssl.policy.${name}.private_key=${conf.privateKey}" else - ''dbms.ssl.policy.${name}.private_key=${conf.baseDirectory}/${conf.privateKey}'' + "dbms.ssl.policy.${name}.private_key=${conf.baseDirectory}/${conf.privateKey}" } ${if length (splitString "/" conf.privateKey) > 1 then - ''dbms.ssl.policy.${name}.public_certificate=${conf.publicCertificate}'' + "dbms.ssl.policy.${name}.public_certificate=${conf.publicCertificate}" else - ''dbms.ssl.policy.${name}.public_certificate=${conf.baseDirectory}/${conf.publicCertificate}'' + "dbms.ssl.policy.${name}.public_certificate=${conf.baseDirectory}/${conf.publicCertificate}" } dbms.ssl.policy.${name}.revoked_dir=${conf.revokedDir} dbms.ssl.policy.${name}.tls_versions=${concatStringsSep "," conf.tlsVersions} diff --git a/nixos/modules/services/databases/openldap.nix b/nixos/modules/services/databases/openldap.nix index 94a5c573768b3..f0efc659cff74 100644 --- a/nixos/modules/services/databases/openldap.nix +++ b/nixos/modules/services/databases/openldap.nix @@ -244,7 +244,7 @@ in { }; }; - meta.maintainers = with lib.maintainters; [ mic92 kwohlfahrt ]; + meta.maintainers = with lib.maintainers; [ mic92 kwohlfahrt ]; config = mkIf cfg.enable { assertions = map (opt: { diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix index 6b8853ae390b9..117e63662258e 100644 --- a/nixos/modules/services/databases/redis.nix +++ b/nixos/modules/services/databases/redis.nix @@ -4,31 +4,16 @@ with lib; let cfg = config.services.redis; - redisBool = b: if b then "yes" else "no"; - condOption = name: value: if value != null then "${name} ${toString value}" else ""; - - redisConfig = pkgs.writeText "redis.conf" '' - port ${toString cfg.port} - ${condOption "bind" cfg.bind} - ${condOption "unixsocket" cfg.unixSocket} - daemonize no - supervised systemd - loglevel ${cfg.logLevel} - logfile ${cfg.logfile} - syslog-enabled ${redisBool cfg.syslog} - databases ${toString cfg.databases} - ${concatMapStrings (d: "save ${toString (builtins.elemAt d 0)} ${toString (builtins.elemAt d 1)}\n") cfg.save} - dbfilename dump.rdb - dir /var/lib/redis - ${if cfg.slaveOf != null then "slaveof ${cfg.slaveOf.ip} ${toString cfg.slaveOf.port}" else ""} - ${condOption "masterauth" cfg.masterAuth} - ${condOption "requirepass" cfg.requirePass} - appendOnly ${redisBool cfg.appendOnly} - appendfsync ${cfg.appendFsync} - slowlog-log-slower-than ${toString cfg.slowLogLogSlowerThan} - slowlog-max-len ${toString cfg.slowLogMaxLen} - ${cfg.extraConfig} - ''; + + mkValueString = value: + if value == true then "yes" + else if value == false then "no" + else generators.mkValueStringDefault { } value; + + redisConfig = pkgs.writeText "redis.conf" (generators.toKeyValue { + listsAsDuplicateKeys = true; + mkKeyValue = generators.mkKeyValueDefault { inherit mkValueString; } " "; + } cfg.settings); in { imports = [ @@ -37,6 +22,7 @@ in (mkRemovedOptionModule [ "services" "redis" "dbFilename" ] "The redis module now uses /var/lib/redis/dump.rdb as database dump location.") (mkRemovedOptionModule [ "services" "redis" "appendOnlyFilename" ] "This option was never used.") (mkRemovedOptionModule [ "services" "redis" "pidFile" ] "This option was removed.") + (mkRemovedOptionModule [ "services" "redis" "extraConfig" ] "Use services.redis.settings instead.") ]; ###### interface @@ -136,12 +122,29 @@ in }; slaveOf = mkOption { - default = null; # { ip, port } - description = "An attribute set with two attributes: ip and port to which this redis instance acts as a slave."; + type = with types; nullOr (submodule ({ ... }: { + options = { + ip = mkOption { + type = str; + description = "IP of the Redis master"; + example = "192.168.1.100"; + }; + + port = mkOption { + type = port; + description = "port of the Redis master"; + default = 6379; + }; + }; + })); + + default = null; + description = "IP and port to which this redis instance acts as a slave."; example = { ip = "192.168.1.100"; port = 6379; }; }; masterAuth = mkOption { + type = with types; nullOr str; default = null; description = ''If the master is password protected (using the requirePass configuration) it is possible to tell the slave to authenticate before starting the replication synchronization @@ -191,10 +194,20 @@ in description = "Maximum number of items to keep in slow log."; }; - extraConfig = mkOption { - type = types.lines; - default = ""; - description = "Extra configuration options for redis.conf."; + settings = mkOption { + type = with types; attrsOf (oneOf [ bool int str (listOf str) ]); + default = {}; + description = '' + Redis configuration. Refer to + <link xlink:href="https://redis.io/topics/config"/> + for details on supported values. + ''; + example = literalExample '' + { + unixsocketperm = "700"; + loadmodule = [ "/path/to/my_module.so" "/path/to/other_module.so" ]; + } + ''; }; }; @@ -225,6 +238,30 @@ in environment.systemPackages = [ cfg.package ]; + services.redis.settings = mkMerge [ + { + port = cfg.port; + daemonize = false; + supervised = "systemd"; + loglevel = cfg.logLevel; + logfile = cfg.logfile; + syslog-enabled = cfg.syslog; + databases = cfg.databases; + save = map (d: "${toString (builtins.elemAt d 0)} ${toString (builtins.elemAt d 1)}") cfg.save; + dbfilename = "dump.rdb"; + dir = "/var/lib/redis"; + appendOnly = cfg.appendOnly; + appendfsync = cfg.appendFsync; + slowlog-log-slower-than = cfg.slowLogLogSlowerThan; + slowlog-max-len = cfg.slowLogMaxLen; + } + (mkIf (cfg.bind != null) { bind = cfg.bind; }) + (mkIf (cfg.unixSocket != null) { unixsocket = cfg.unixSocket; }) + (mkIf (cfg.slaveOf != null) { slaveof = "${cfg.slaveOf.ip} ${cfg.slaveOf.port}"; }) + (mkIf (cfg.masterAuth != null) { masterauth = cfg.masterAuth; }) + (mkIf (cfg.requirePass != null) { requirepass = cfg.requirePass; }) + ]; + systemd.services.redis = { description = "Redis Server"; diff --git a/nixos/modules/services/databases/virtuoso.nix b/nixos/modules/services/databases/virtuoso.nix index 6eb09e0a58fcb..8b01622ecb039 100644 --- a/nixos/modules/services/databases/virtuoso.nix +++ b/nixos/modules/services/databases/virtuoso.nix @@ -16,28 +16,33 @@ with lib; enable = mkEnableOption "Virtuoso Opensource database server"; config = mkOption { + type = types.lines; default = ""; description = "Extra options to put into Virtuoso configuration file."; }; parameters = mkOption { + type = types.lines; default = ""; description = "Extra options to put into [Parameters] section of Virtuoso configuration file."; }; listenAddress = mkOption { + type = types.str; default = "1111"; example = "myserver:1323"; description = "ip:port or port to listen on."; }; httpListenAddress = mkOption { + type = types.nullOr types.str; default = null; example = "myserver:8080"; description = "ip:port or port for Virtuoso HTTP server to listen on."; }; dirsAllowed = mkOption { + type = types.nullOr types.str; # XXX Maybe use a list in the future? default = null; example = "/www, /home/"; description = "A list of directories Virtuoso is allowed to access"; diff --git a/nixos/modules/services/desktops/gnome3/evolution-data-server.nix b/nixos/modules/services/desktops/gnome3/evolution-data-server.nix index bd62d16f61ceb..749f12b86bc8a 100644 --- a/nixos/modules/services/desktops/gnome3/evolution-data-server.nix +++ b/nixos/modules/services/desktops/gnome3/evolution-data-server.nix @@ -15,31 +15,45 @@ with lib; options = { services.gnome3.evolution-data-server = { - - enable = mkOption { - type = types.bool; - default = false; - description = '' - Whether to enable Evolution Data Server, a collection of services for - storing addressbooks and calendars. - ''; + enable = mkEnableOption "Evolution Data Server, a collection of services for storing addressbooks and calendars."; + plugins = mkOption { + type = types.listOf types.package; + default = [ ]; + description = "Plugins for Evolution Data Server."; }; - }; + programs.evolution = { + enable = mkEnableOption "Evolution, a Personal information management application that provides integrated mail, calendaring and address book functionality."; + plugins = mkOption { + type = types.listOf types.package; + default = [ ]; + example = literalExample "[ pkgs.evolution-ews ]"; + description = "Plugins for Evolution."; + }; + }; }; - ###### implementation - config = mkIf config.services.gnome3.evolution-data-server.enable { - - environment.systemPackages = [ pkgs.gnome3.evolution-data-server ]; - - services.dbus.packages = [ pkgs.gnome3.evolution-data-server ]; - - systemd.packages = [ pkgs.gnome3.evolution-data-server ]; - - }; - + config = + let + bundle = pkgs.evolutionWithPlugins.override { inherit (config.services.gnome3.evolution-data-server) plugins; }; + in + mkMerge [ + (mkIf config.services.gnome3.evolution-data-server.enable { + environment.systemPackages = [ bundle ]; + + services.dbus.packages = [ bundle ]; + + systemd.packages = [ bundle ]; + }) + (mkIf config.programs.evolution.enable { + services.gnome3.evolution-data-server = { + enable = true; + plugins = [ pkgs.evolution ] ++ config.programs.evolution.plugins; + }; + services.gnome3.gnome-keyring.enable = true; + }) + ]; } diff --git a/nixos/modules/services/desktops/pipewire.nix b/nixos/modules/services/desktops/pipewire.nix index c4923cfd3f00c..134becf6b0c40 100644 --- a/nixos/modules/services/desktops/pipewire.nix +++ b/nixos/modules/services/desktops/pipewire.nix @@ -15,7 +15,7 @@ let # This doesn't work in general because of missing development information. jack-libs = pkgs.runCommand "jack-libs" {} '' mkdir -p "$out/lib" - ln -s "${pkgs.pipewire.jack}/lib" "$out/lib/pipewire" + ln -s "${cfg.package.jack}/lib" "$out/lib/pipewire" ''; in { @@ -28,6 +28,16 @@ in { services.pipewire = { enable = mkEnableOption "pipewire service"; + package = mkOption { + type = types.package; + default = pkgs.pipewire; + defaultText = "pkgs.pipewire"; + example = literalExample "pkgs.pipewire"; + description = '' + The pipewire derivation to use. + ''; + }; + socketActivation = mkOption { default = true; type = types.bool; @@ -36,6 +46,32 @@ in { ''; }; + extraConfig = mkOption { + type = types.lines; + default = ""; + description = '' + Literal string to append to /etc/pipewire/pipewire.conf. + ''; + }; + + sessionManager = mkOption { + type = types.nullOr types.string; + default = null; + example = literalExample ''"''${pipewire}/bin/pipewire-media-session"''; + description = '' + Path to the pipewire session manager executable. + ''; + }; + + sessionManagerArguments = mkOption { + type = types.listOf types.string; + default = []; + example = literalExample ''[ "-p" "bluez5.msbc-support=true" ]''; + description = '' + Arguments passed to the pipewire session manager. + ''; + }; + alsa = { enable = mkEnableOption "ALSA support"; support32Bit = mkEnableOption "32-bit ALSA support on 64-bit systems"; @@ -57,46 +93,91 @@ in { assertions = [ { assertion = cfg.pulse.enable -> !config.hardware.pulseaudio.enable; - message = "PipeWire based PulseAudio server emulation replaces PulseAudio"; + message = "PipeWire based PulseAudio server emulation replaces PulseAudio. This option requires `hardware.pulseaudio.enable` to be set to false"; } { assertion = cfg.jack.enable -> !config.services.jack.jackd.enable; - message = "PipeWire based JACK emulation doesn't use the JACK service"; + message = "PipeWire based JACK emulation doesn't use the JACK service. This option requires `services.jack.jackd.enable` to be set to false"; } ]; - environment.systemPackages = [ pkgs.pipewire ] + services.pipewire.sessionManager = mkDefault "${cfg.package}/bin/pipewire-media-session"; + + environment.systemPackages = [ cfg.package ] ++ lib.optional cfg.jack.enable jack-libs; - systemd.packages = [ pkgs.pipewire ] - ++ lib.optional cfg.pulse.enable pkgs.pipewire.pulse; + systemd.packages = [ cfg.package ] + ++ lib.optional cfg.pulse.enable cfg.package.pulse; # PipeWire depends on DBUS but doesn't list it. Without this booting # into a terminal results in the service crashing with an error. systemd.user.sockets.pipewire.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ]; systemd.user.sockets.pipewire-pulse.wantedBy = lib.mkIf (cfg.socketActivation && cfg.pulse.enable) ["sockets.target"]; systemd.user.services.pipewire.bindsTo = [ "dbus.service" ]; - services.udev.packages = [ pkgs.pipewire ]; + services.udev.packages = [ cfg.package ]; # If any paths are updated here they must also be updated in the package test. - sound.extraConfig = mkIf cfg.alsa.enable '' - pcm_type.pipewire { - libs.native = ${pkgs.pipewire.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ; - ${optionalString enable32BitAlsaPlugins - "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;"} - } - pcm.!default { - @func getenv - vars [ PCM ] - default "plug:pipewire" - playback_mode "-1" - capture_mode "-1" - } - ''; + environment.etc."alsa/conf.d/49-pipewire-modules.conf" = mkIf cfg.alsa.enable { + text = '' + pcm_type.pipewire { + libs.native = ${cfg.package.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ; + ${optionalString enable32BitAlsaPlugins + "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;"} + } + ctl_type.pipewire { + libs.native = ${cfg.package.lib}/lib/alsa-lib/libasound_module_ctl_pipewire.so ; + ${optionalString enable32BitAlsaPlugins + "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire.lib}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;"} + } + ''; + }; environment.etc."alsa/conf.d/50-pipewire.conf" = mkIf cfg.alsa.enable { - source = "${pkgs.pipewire}/share/alsa/alsa.conf.d/50-pipewire.conf"; + source = "${cfg.package}/share/alsa/alsa.conf.d/50-pipewire.conf"; + }; + environment.etc."alsa/conf.d/99-pipewire-default.conf" = mkIf cfg.alsa.enable { + source = "${cfg.package}/share/alsa/alsa.conf.d/99-pipewire-default.conf"; }; environment.sessionVariables.LD_LIBRARY_PATH = lib.optional cfg.jack.enable "/run/current-system/sw/lib/pipewire"; + + environment.etc."pipewire/pipewire.conf" = { + # Adapted from src/daemon/pipewire.conf.in + text = '' + set-prop link.max-buffers 16 # version < 3 clients can't handle more + + add-spa-lib audio.convert* audioconvert/libspa-audioconvert + add-spa-lib api.alsa.* alsa/libspa-alsa + add-spa-lib api.v4l2.* v4l2/libspa-v4l2 + add-spa-lib api.libcamera.* libcamera/libspa-libcamera + add-spa-lib api.bluez5.* bluez5/libspa-bluez5 + add-spa-lib api.vulkan.* vulkan/libspa-vulkan + add-spa-lib api.jack.* jack/libspa-jack + add-spa-lib support.* support/libspa-support + + load-module libpipewire-module-rtkit # rt.prio=20 rt.time.soft=200000 rt.time.hard=200000 + load-module libpipewire-module-protocol-native + load-module libpipewire-module-profiler + load-module libpipewire-module-metadata + load-module libpipewire-module-spa-device-factory + load-module libpipewire-module-spa-node-factory + load-module libpipewire-module-client-node + load-module libpipewire-module-client-device + load-module libpipewire-module-portal + load-module libpipewire-module-access + load-module libpipewire-module-adapter + load-module libpipewire-module-link-factory + load-module libpipewire-module-session-manager + + create-object spa-node-factory factory.name=support.node.driver node.name=Dummy priority.driver=8000 + + exec ${cfg.sessionManager} ${lib.concatStringsSep " " cfg.sessionManagerArguments} + + ${cfg.extraConfig} + ''; + }; + + environment.etc."pipewire/media-session.d/with-alsa" = mkIf cfg.alsa.enable { text = ""; }; + environment.etc."pipewire/media-session.d/with-pulseaudio" = mkIf cfg.pulse.enable { text = ""; }; + environment.etc."pipewire/media-session.d/with-jack" = mkIf cfg.jack.enable { text = ""; }; }; } diff --git a/nixos/modules/services/development/bloop.nix b/nixos/modules/services/development/bloop.nix index 226718a9e80ab..c1180a8bbdd46 100644 --- a/nixos/modules/services/development/bloop.nix +++ b/nixos/modules/services/development/bloop.nix @@ -44,7 +44,7 @@ in { }; serviceConfig = { Type = "simple"; - ExecStart = ''${pkgs.bloop}/bin/bloop server''; + ExecStart = "${pkgs.bloop}/bin/bloop server"; Restart = "always"; }; }; diff --git a/nixos/modules/services/development/hoogle.nix b/nixos/modules/services/development/hoogle.nix index cbf13f027de28..6d6c88b9b2aa9 100644 --- a/nixos/modules/services/development/hoogle.nix +++ b/nixos/modules/services/development/hoogle.nix @@ -25,6 +25,7 @@ in { }; packages = mkOption { + type = types.functionTo (types.listOf types.package); default = hp: []; defaultText = "hp: []"; example = "hp: with hp; [ text lens ]"; @@ -49,6 +50,11 @@ in { default = "https://hoogle.haskell.org"; }; + host = mkOption { + type = types.str; + description = "Set the host to bind on."; + default = "127.0.0.1"; + }; }; config = mkIf cfg.enable { @@ -59,7 +65,7 @@ in { serviceConfig = { Restart = "always"; - ExecStart = ''${hoogleEnv}/bin/hoogle server --local --port ${toString cfg.port} --home ${cfg.home}''; + ExecStart = ''${hoogleEnv}/bin/hoogle server --local --port ${toString cfg.port} --home ${cfg.home} --host ${cfg.host}''; DynamicUser = true; diff --git a/nixos/modules/services/editors/emacs.xml b/nixos/modules/services/editors/emacs.xml index 302aa1ed7c482..fd99ee9442c98 100644 --- a/nixos/modules/services/editors/emacs.xml +++ b/nixos/modules/services/editors/emacs.xml @@ -156,7 +156,7 @@ $ ./result/bin/emacs let myEmacs = pkgs.emacs; <co xml:id="ex-emacsNix-2" /> - emacsWithPackages = (pkgs.emacsPackagesGen myEmacs).emacsWithPackages; <co xml:id="ex-emacsNix-3" /> + emacsWithPackages = (pkgs.emacsPackagesFor myEmacs).emacsWithPackages; <co xml:id="ex-emacsNix-3" /> in emacsWithPackages (epkgs: (with epkgs.melpaStablePackages; [ <co xml:id="ex-emacsNix-4" /> magit # ; Integrate git <C-x g> @@ -254,10 +254,10 @@ in <example xml:id="module-services-emacs-querying-packages"> <title>Querying Emacs packages</title> <programlisting><![CDATA[ -nix-env -f "<nixpkgs>" -qaP -A emacsPackages.elpaPackages -nix-env -f "<nixpkgs>" -qaP -A emacsPackages.melpaPackages -nix-env -f "<nixpkgs>" -qaP -A emacsPackages.melpaStablePackages -nix-env -f "<nixpkgs>" -qaP -A emacsPackages.orgPackages +nix-env -f "<nixpkgs>" -qaP -A emacs.pkgs.elpaPackages +nix-env -f "<nixpkgs>" -qaP -A emacs.pkgs.melpaPackages +nix-env -f "<nixpkgs>" -qaP -A emacs.pkgs.melpaStablePackages +nix-env -f "<nixpkgs>" -qaP -A emacs.pkgs.orgPackages ]]></programlisting> </example> </para> diff --git a/nixos/modules/services/editors/infinoted.nix b/nixos/modules/services/editors/infinoted.nix index 8b997ccbf66e5..10d868b7f1618 100644 --- a/nixos/modules/services/editors/infinoted.nix +++ b/nixos/modules/services/editors/infinoted.nix @@ -141,14 +141,14 @@ in { install -o ${cfg.user} -g ${cfg.group} -m 0600 /dev/null /var/lib/infinoted/infinoted.conf cat >>/var/lib/infinoted/infinoted.conf <<EOF [infinoted] - ${optionalString (cfg.keyFile != null) ''key-file=${cfg.keyFile}''} - ${optionalString (cfg.certificateFile != null) ''certificate-file=${cfg.certificateFile}''} - ${optionalString (cfg.certificateChain != null) ''certificate-chain=${cfg.certificateChain}''} + ${optionalString (cfg.keyFile != null) "key-file=${cfg.keyFile}"} + ${optionalString (cfg.certificateFile != null) "certificate-file=${cfg.certificateFile}"} + ${optionalString (cfg.certificateChain != null) "certificate-chain=${cfg.certificateChain}"} port=${toString cfg.port} security-policy=${cfg.securityPolicy} root-directory=${cfg.rootDirectory} plugins=${concatStringsSep ";" cfg.plugins} - ${optionalString (cfg.passwordFile != null) ''password=$(head -n 1 ${cfg.passwordFile})''} + ${optionalString (cfg.passwordFile != null) "password=$(head -n 1 ${cfg.passwordFile})"} ${cfg.extraConfig} EOF diff --git a/nixos/modules/services/games/freeciv.nix b/nixos/modules/services/games/freeciv.nix new file mode 100644 index 0000000000000..4923891a61799 --- /dev/null +++ b/nixos/modules/services/games/freeciv.nix @@ -0,0 +1,187 @@ +{ config, lib, pkgs, ... }: +with lib; +let + cfg = config.services.freeciv; + inherit (config.users) groups; + rootDir = "/run/freeciv"; + argsFormat = { + type = with lib.types; let + valueType = nullOr (oneOf [ + bool int float str + (listOf valueType) + ]) // { + description = "freeciv-server params"; + }; + in valueType; + generate = name: value: + let mkParam = k: v: + if v == null then [] + else if isBool v then if v then [("--"+k)] else [] + else [("--"+k) v]; + mkParams = k: v: map (mkParam k) (if isList v then v else [v]); + in escapeShellArgs (concatLists (concatLists (mapAttrsToList mkParams value))); + }; +in +{ + options = { + services.freeciv = { + enable = mkEnableOption ''freeciv''; + settings = mkOption { + description = '' + Parameters of freeciv-server. + ''; + default = {}; + type = types.submodule { + freeformType = argsFormat.type; + options.Announce = mkOption { + type = types.enum ["IPv4" "IPv6" "none"]; + default = "none"; + description = "Announce game in LAN using given protocol."; + }; + options.auth = mkEnableOption "server authentication"; + options.Database = mkOption { + type = types.nullOr types.str; + apply = pkgs.writeText "auth.conf"; + default = '' + [fcdb] + backend="sqlite" + database="/var/lib/freeciv/auth.sqlite" + ''; + description = "Enable database connection with given configuration."; + }; + options.debug = mkOption { + type = types.ints.between 0 3; + default = 0; + description = "Set debug log level."; + }; + options.exit-on-end = mkEnableOption "exit instead of restarting when a game ends."; + options.Guests = mkEnableOption "guests to login if auth is enabled"; + options.Newusers = mkEnableOption "new users to login if auth is enabled"; + options.port = mkOption { + type = types.port; + default = 5556; + description = "Listen for clients on given port"; + }; + options.quitidle = mkOption { + type = types.nullOr types.int; + default = null; + description = "Quit if no players for given time in seconds."; + }; + options.read = mkOption { + type = types.lines; + apply = v: pkgs.writeTextDir "read.serv" v + "/read"; + default = '' + /fcdb lua sqlite_createdb() + ''; + description = "Startup script."; + }; + options.saves = mkOption { + type = types.nullOr types.str; + default = "/var/lib/freeciv/saves/"; + description = '' + Save games to given directory, + a sub-directory named after the starting date of the service + will me inserted to preserve older saves. + ''; + }; + }; + }; + openFirewall = mkEnableOption "opening the firewall for the port listening for clients"; + }; + }; + config = mkIf cfg.enable { + users.groups.freeciv = {}; + # Use with: + # journalctl -u freeciv.service -f -o cat & + # cat >/run/freeciv.stdin + # load saves/2020-11-14_05-22-27/freeciv-T0005-Y-3750-interrupted.sav.bz2 + systemd.sockets.freeciv = { + wantedBy = [ "sockets.target" ]; + socketConfig = { + ListenFIFO = "/run/freeciv.stdin"; + SocketGroup = groups.freeciv.name; + SocketMode = "660"; + RemoveOnStop = true; + }; + }; + systemd.services.freeciv = { + description = "Freeciv Service"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + environment.HOME = "/var/lib/freeciv"; + serviceConfig = { + Restart = "on-failure"; + RestartSec = "5s"; + StandardInput = "fd:freeciv.socket"; + StandardOutput = "journal"; + StandardError = "journal"; + ExecStart = pkgs.writeShellScript "freeciv-server" ('' + set -eux + savedir=$(date +%Y-%m-%d_%H-%M-%S) + '' + "${pkgs.freeciv}/bin/freeciv-server" + + " " + optionalString (cfg.settings.saves != null) + (concatStringsSep " " [ "--saves" "${escapeShellArg cfg.settings.saves}/$savedir" ]) + + " " + argsFormat.generate "freeciv-server" (cfg.settings // { saves = null; })); + DynamicUser = true; + # Create rootDir in the host's mount namespace. + RuntimeDirectory = [(baseNameOf rootDir)]; + RuntimeDirectoryMode = "755"; + StateDirectory = [ "freeciv" ]; + WorkingDirectory = "/var/lib/freeciv"; + # Avoid mounting rootDir in the own rootDir of ExecStart='s mount namespace. + InaccessiblePaths = ["-+${rootDir}"]; + # This is for BindPaths= and BindReadOnlyPaths= + # to allow traversal of directories they create in RootDirectory=. + UMask = "0066"; + RootDirectory = rootDir; + RootDirectoryStartOnly = true; + MountAPIVFS = true; + BindReadOnlyPaths = [ + builtins.storeDir + "/etc" + "/run" + ]; + # The following options are only for optimizing: + # systemd-analyze security freeciv + AmbientCapabilities = ""; + CapabilityBoundingSet = ""; + # ProtectClock= adds DeviceAllow=char-rtc r + DeviceAllow = ""; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateMounts = true; + PrivateNetwork = mkDefault false; + PrivateTmp = true; + PrivateUsers = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectSystem = "strict"; + RemoveIPC = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallFilter = [ + "@system-service" + # Groups in @system-service which do not contain a syscall listed by: + # perf stat -x, 2>perf.log -e 'syscalls:sys_enter_*' freeciv-server + # in tests, and seem likely not necessary for freeciv-server. + "~@aio" "~@chown" "~@ipc" "~@keyring" "~@memlock" + "~@resources" "~@setuid" "~@sync" "~@timer" + ]; + SystemCallArchitectures = "native"; + SystemCallErrorNumber = "EPERM"; + }; + }; + networking.firewall = mkIf cfg.openFirewall + { allowedTCPPorts = [ cfg.settings.port ]; }; + }; + meta.maintainers = with lib.maintainers; [ julm ]; +} diff --git a/nixos/modules/services/games/openarena.nix b/nixos/modules/services/games/openarena.nix index 8c014d78809b8..9c441e98b2068 100644 --- a/nixos/modules/services/games/openarena.nix +++ b/nixos/modules/services/games/openarena.nix @@ -19,7 +19,7 @@ in extraFlags = mkOption { type = types.listOf types.str; default = []; - description = ''Extra flags to pass to <command>oa_ded</command>''; + description = "Extra flags to pass to <command>oa_ded</command>"; example = [ "+set dedicated 2" "+set sv_hostname 'My NixOS OpenArena Server'" diff --git a/nixos/modules/services/hardware/auto-cpufreq.nix b/nixos/modules/services/hardware/auto-cpufreq.nix new file mode 100644 index 0000000000000..72c4eccaff72e --- /dev/null +++ b/nixos/modules/services/hardware/auto-cpufreq.nix @@ -0,0 +1,18 @@ +{ config, lib, pkgs, ... }: +with lib; +let + cfg = config.services.auto-cpufreq; +in { + options = { + services.auto-cpufreq = { + enable = mkEnableOption "auto-cpufreq daemon"; + }; + }; + + config = mkIf cfg.enable { + environment.systemPackages = [ pkgs.auto-cpufreq ]; + + systemd.packages = [ pkgs.auto-cpufreq ]; + systemd.services.auto-cpufreq.path = with pkgs; [ bash coreutils ]; + }; +} diff --git a/nixos/modules/services/hardware/sane_extra_backends/brscan4_etc_files.nix b/nixos/modules/services/hardware/sane_extra_backends/brscan4_etc_files.nix index ec0457bbd5830..556f6bbb419a2 100644 --- a/nixos/modules/services/hardware/sane_extra_backends/brscan4_etc_files.nix +++ b/nixos/modules/services/hardware/sane_extra_backends/brscan4_etc_files.nix @@ -19,18 +19,16 @@ nix-shell -E 'with import <nixpkgs> { }; brscan4-etc-files.override{netDevices=[ */ -with lib; - let addNetDev = nd: '' brsaneconfig4 -a \ name="${nd.name}" \ model="${nd.model}" \ - ${if (hasAttr "nodename" nd && nd.nodename != null) then + ${if (lib.hasAttr "nodename" nd && nd.nodename != null) then ''nodename="${nd.nodename}"'' else ''ip="${nd.ip}"''}''; - addAllNetDev = xs: concatStringsSep "\n" (map addNetDev xs); + addAllNetDev = xs: lib.concatStringsSep "\n" (map addNetDev xs); in stdenv.mkDerivation { @@ -61,11 +59,11 @@ stdenv.mkDerivation { dontStrip = true; dontPatchELF = true; - meta = { + meta = with lib; { description = "Brother brscan4 sane backend driver etc files"; homepage = "http://www.brother.com"; - platforms = stdenv.lib.platforms.linux; - license = stdenv.lib.licenses.unfree; - maintainers = with stdenv.lib.maintainers; [ jraygauthier ]; + platforms = platforms.linux; + license = licenses.unfree; + maintainers = with maintainers; [ jraygauthier ]; }; } diff --git a/nixos/modules/services/hardware/thermald.nix b/nixos/modules/services/hardware/thermald.nix index b7be0e89d0c66..aa936ac09d1d1 100644 --- a/nixos/modules/services/hardware/thermald.nix +++ b/nixos/modules/services/hardware/thermald.nix @@ -24,32 +24,30 @@ in { description = "the thermald manual configuration file."; }; - adaptive = mkOption { - type = types.bool; - default = false; - description = '' - Whether to enable adaptive mode, only working on kernel versions greater than 5.8. - Thermald will detect this itself, safe to enable on kernel versions below 5.8. - ''; + package = mkOption { + type = types.package; + default = pkgs.thermald; + defaultText = "pkgs.thermald"; + description = "Which thermald package to use."; }; }; }; ###### implementation config = mkIf cfg.enable { - services.dbus.packages = [ pkgs.thermald ]; + services.dbus.packages = [ cfg.package ]; systemd.services.thermald = { description = "Thermal Daemon Service"; wantedBy = [ "multi-user.target" ]; serviceConfig = { ExecStart = '' - ${pkgs.thermald}/sbin/thermald \ + ${cfg.package}/sbin/thermald \ --no-daemon \ ${optionalString cfg.debug "--loglevel=debug"} \ ${optionalString (cfg.configFile != null) "--config-file ${cfg.configFile}"} \ - ${optionalString cfg.adaptive "--adaptive"} \ - --dbus-enable + --dbus-enable \ + --adaptive ''; }; }; diff --git a/nixos/modules/services/hardware/throttled.nix b/nixos/modules/services/hardware/throttled.nix index 7617c4492d7c6..1905eb565c6dc 100644 --- a/nixos/modules/services/hardware/throttled.nix +++ b/nixos/modules/services/hardware/throttled.nix @@ -26,5 +26,11 @@ in { if cfg.extraConfig != "" then pkgs.writeText "lenovo_fix.conf" cfg.extraConfig else "${pkgs.throttled}/etc/lenovo_fix.conf"; + + # Kernel 5.9 spams warnings whenever userspace writes to CPU MSRs. + # See https://github.com/erpalma/throttled/issues/215 + boot.kernelParams = + optional (versionAtLeast config.boot.kernelPackages.kernel.version "5.9") + "msr.allow_writes=on"; }; } diff --git a/nixos/modules/services/hardware/trezord.nix b/nixos/modules/services/hardware/trezord.nix index 2594ac7437109..8c609bbf825b6 100644 --- a/nixos/modules/services/hardware/trezord.nix +++ b/nixos/modules/services/hardware/trezord.nix @@ -47,7 +47,7 @@ in { services.udev.packages = [ pkgs.trezor-udev-rules ]; systemd.services.trezord = { - description = "TREZOR Bridge"; + description = "Trezor Bridge"; after = [ "systemd-udev-settle.service" "network.target" ]; wantedBy = [ "multi-user.target" ]; path = []; diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix index a212adb7342dd..63027f7744dc9 100644 --- a/nixos/modules/services/hardware/udev.nix +++ b/nixos/modules/services/hardware/udev.nix @@ -205,7 +205,7 @@ in extraRules = mkOption { default = ""; example = '' - KERNEL=="eth*", ATTR{address}=="00:1D:60:B9:6D:4F", NAME="my_fast_network_card" + SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:1D:60:B9:6D:4F", KERNEL=="eth*", NAME="my_fast_network_card" ''; type = types.lines; description = '' diff --git a/nixos/modules/services/logging/logstash.nix b/nixos/modules/services/logging/logstash.nix index bf92425f998bb..a4fc315d080d7 100644 --- a/nixos/modules/services/logging/logstash.nix +++ b/nixos/modules/services/logging/logstash.nix @@ -100,7 +100,7 @@ in inputConfig = mkOption { type = types.lines; - default = ''generator { }''; + default = "generator { }"; description = "Logstash input configuration."; example = '' # Read from journal @@ -131,7 +131,7 @@ in outputConfig = mkOption { type = types.lines; - default = ''stdout { codec => rubydebug }''; + default = "stdout { codec => rubydebug }"; description = "Logstash output configuration."; example = '' redis { host => ["localhost"] data_type => "list" key => "logstash" codec => json } diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix index 5c61cfbebf6cd..832b496f31c96 100644 --- a/nixos/modules/services/mail/mailman.nix +++ b/nixos/modules/services/mail/mailman.nix @@ -38,7 +38,7 @@ let webSettingsJSON = pkgs.writeText "settings.json" (builtins.toJSON webSettings); # TODO: Should this be RFC42-ised so that users can set additional options without modifying the module? - mtaConfig = pkgs.writeText "mailman-postfix.cfg" '' + postfixMtaConfig = pkgs.writeText "mailman-postfix.cfg" '' [postfix] postmap_command: ${pkgs.postfix}/bin/postmap transport_file_type: hash @@ -81,7 +81,7 @@ in { enable = mkOption { type = types.bool; default = false; - description = "Enable Mailman on this host. Requires an active Postfix installation."; + description = "Enable Mailman on this host. Requires an active MTA on the host (e.g. Postfix)."; }; package = mkOption { @@ -92,6 +92,20 @@ in { description = "Mailman package to use"; }; + enablePostfix = mkOption { + type = types.bool; + default = true; + example = false; + description = '' + Enable Postfix integration. Requires an active Postfix installation. + + If you want to use another MTA, set this option to false and configure + settings in services.mailman.settings.mta. + + Refer to the Mailman manual for more info. + ''; + }; + siteOwner = mkOption { type = types.str; example = "postmaster@example.org"; @@ -182,7 +196,7 @@ in { pid_file = "/run/mailman/master.pid"; }; - mta.configuration = lib.mkDefault "${mtaConfig}"; + mta.configuration = lib.mkDefault (if cfg.enablePostfix then "${postfixMtaConfig}" else throw "When Mailman Postfix integration is disabled, set `services.mailman.settings.mta.configuration` to the path of the config file required to integrate with your MTA."); "archiver.hyperkitty" = lib.mkIf cfg.hyperkitty.enable { class = "mailman_hyperkitty.Archiver"; @@ -211,14 +225,22 @@ in { See <https://mailman.readthedocs.io/en/latest/src/mailman/docs/mta.html>. ''; }; - in [ + in (lib.optionals cfg.enablePostfix [ { assertion = postfix.enable; - message = "Mailman requires Postfix"; + message = '' + Mailman's default NixOS configuration requires Postfix to be enabled. + + If you want to use another MTA, set services.mailman.enablePostfix + to false and configure settings in services.mailman.settings.mta. + + Refer to <https://mailman.readthedocs.io/en/latest/src/mailman/docs/mta.html> + for more info. + ''; } (requirePostfixHash [ "relayDomains" ] "postfix_domains") (requirePostfixHash [ "config" "transport_maps" ] "postfix_lmtp") (requirePostfixHash [ "config" "local_recipient_maps" ] "postfix_lmtp") - ]; + ]); users.users.mailman = { description = "GNU Mailman"; @@ -275,7 +297,7 @@ in { ''; }) ]; - services.postfix = { + services.postfix = lib.mkIf cfg.enablePostfix { recipientDelimiter = "+"; # bake recipient addresses in mail envelopes via VERP config = { owner_request_special = "no"; # Mailman handles -owner addresses on its own @@ -345,7 +367,7 @@ in { mailman-web-setup = { description = "Prepare mailman-web files and database"; - before = [ "uwsgi.service" "mailman-uwsgi.service" ]; + before = [ "mailman-uwsgi.service" ]; requiredBy = [ "mailman-uwsgi.service" ]; restartTriggers = [ config.environment.etc."mailman3/settings.py".source ]; script = '' @@ -421,7 +443,7 @@ in { inherit startAt; restartTriggers = [ config.environment.etc."mailman3/settings.py".source ]; serviceConfig = { - ExecStart = "${pythonEnv}/bin/mailman-web runjobs minutely"; + ExecStart = "${pythonEnv}/bin/mailman-web runjobs ${name}"; User = cfg.webUser; Group = "mailman"; WorkingDirectory = "/var/lib/mailman-web"; diff --git a/nixos/modules/services/mail/mailman.xml b/nixos/modules/services/mail/mailman.xml index cbe50ed0b9179..8da491ccbe9f6 100644 --- a/nixos/modules/services/mail/mailman.xml +++ b/nixos/modules/services/mail/mailman.xml @@ -13,9 +13,9 @@ </para> <section xml:id="module-services-mailman-basic-usage"> - <title>Basic usage</title> + <title>Basic usage with Postfix</title> <para> - For a basic configuration, the following settings are suggested: + For a basic configuration with Postfix as the MTA, the following settings are suggested: <programlisting>{ config, ... }: { services.postfix = { enable = true; @@ -56,4 +56,39 @@ necessary, but outside the scope of the Mailman module. </para> </section> + <section xml:id="module-services-mailman-other-mtas"> + <title>Using with other MTAs</title> + <para> + Mailman also supports other MTA, though with a little bit more configuration. For example, to use Mailman with Exim, you can use the following settings: + <programlisting>{ config, ... }: { + services = { + mailman = { + enable = true; + siteOwner = "mailman@example.org"; + <link linkend="opt-services.mailman.enablePostfix">enablePostfix</link> = false; + settings.mta = { + incoming = "mailman.mta.exim4.LMTP"; + outgoing = "mailman.mta.deliver.deliver"; + lmtp_host = "localhost"; + lmtp_port = "8024"; + smtp_host = "localhost"; + smtp_port = "25"; + configuration = "python:mailman.config.exim4"; + }; + }; + exim = { + enable = true; + # You can configure Exim in a separate file to reduce configuration.nix clutter + config = builtins.readFile ./exim.conf; + }; + }; +}</programlisting> + </para> + <para> + The exim config needs some special additions to work with Mailman. Currently + NixOS can't manage Exim config with such granularity. Please refer to + <link xlink:href="https://mailman.readthedocs.io/en/latest/src/mailman/docs/mta.html">Mailman documentation</link> + for more info on configuring Mailman for working with Exim. + </para> + </section> </chapter> diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix index 319b3b638444f..63c0961b7568b 100644 --- a/nixos/modules/services/mail/postfix.nix +++ b/nixos/modules/services/mail/postfix.nix @@ -25,8 +25,6 @@ let clientRestrictions = concatStringsSep ", " (clientAccess ++ dnsBl); - smtpTlsSecurityLevel = if cfg.useDane then "dane" else "may"; - mainCf = let escape = replaceStrings ["$"] ["$$"]; mkList = items: "\n " + concatStringsSep ",\n " items; @@ -52,7 +50,7 @@ let }; type = mkOption { - type = types.enum [ "inet" "unix" "fifo" "pass" ]; + type = types.enum [ "inet" "unix" "unix-dgram" "fifo" "pass" ]; default = "unix"; example = "inet"; description = "The type of the service"; @@ -510,14 +508,6 @@ in ''; }; - useDane = mkOption { - type = types.bool; - default = false; - description = '' - Sets smtp_tls_security_level to "dane" rather than "may". See postconf(5) for details. - ''; - }; - sslCert = mkOption { type = types.str; default = ""; @@ -570,6 +560,7 @@ in transport = mkOption { default = ""; + type = types.lines; description = " Entries for the transport map, cf. man-page transport(8). "; @@ -583,6 +574,7 @@ in dnsBlacklistOverrides = mkOption { default = ""; + type = types.lines; description = "contents of check_client_access for overriding dnsBlacklists"; }; @@ -819,13 +811,13 @@ in // optionalAttrs cfg.enableHeaderChecks { header_checks = [ "regexp:/etc/postfix/header_checks" ]; } // optionalAttrs (cfg.tlsTrustedAuthorities != "") { smtp_tls_CAfile = cfg.tlsTrustedAuthorities; - smtp_tls_security_level = smtpTlsSecurityLevel; + smtp_tls_security_level = mkDefault "may"; } // optionalAttrs (cfg.sslCert != "") { smtp_tls_cert_file = cfg.sslCert; smtp_tls_key_file = cfg.sslKey; - smtp_tls_security_level = smtpTlsSecurityLevel; + smtp_tls_security_level = mkDefault "may"; smtpd_tls_cert_file = cfg.sslCert; smtpd_tls_key_file = cfg.sslKey; @@ -969,5 +961,9 @@ in imports = [ (mkRemovedOptionModule [ "services" "postfix" "sslCACert" ] "services.postfix.sslCACert was replaced by services.postfix.tlsTrustedAuthorities. In case you intend that your server should validate requested client certificates use services.postfix.extraConfig.") + + (mkChangedOptionModule [ "services" "postfix" "useDane" ] + [ "services" "postfix" "config" "smtp_tls_security_level" ] + (config: mkIf config.services.postfix.useDane "dane")) ]; } diff --git a/nixos/modules/services/mail/postgrey.nix b/nixos/modules/services/mail/postgrey.nix index 709f6b21aa0ad..7c206e3725e6b 100644 --- a/nixos/modules/services/mail/postgrey.nix +++ b/nixos/modules/services/mail/postgrey.nix @@ -163,7 +163,7 @@ in { systemd.services.postgrey = let bind-flag = if cfg.socket ? path then - ''--unix=${cfg.socket.path} --socketmode=${cfg.socket.mode}'' + "--unix=${cfg.socket.path} --socketmode=${cfg.socket.mode}" else ''--inet=${optionalString (cfg.socket.addr != null) (cfg.socket.addr + ":")}${toString cfg.socket.port}''; in { diff --git a/nixos/modules/services/misc/autofs.nix b/nixos/modules/services/misc/autofs.nix index 5e7c1e668288a..541f0d2db19f4 100644 --- a/nixos/modules/services/misc/autofs.nix +++ b/nixos/modules/services/misc/autofs.nix @@ -52,6 +52,7 @@ in }; timeout = mkOption { + type = types.int; default = 600; description = "Set the global minimum timeout, in seconds, until directories are unmounted"; }; diff --git a/nixos/modules/services/misc/cgminer.nix b/nixos/modules/services/misc/cgminer.nix index fa9c8c54509ea..662570f9451fe 100644 --- a/nixos/modules/services/misc/cgminer.nix +++ b/nixos/modules/services/misc/cgminer.nix @@ -41,12 +41,14 @@ in }; user = mkOption { + type = types.str; default = "cgminer"; description = "User account under which cgminer runs"; }; pools = mkOption { default = []; # Run benchmark + type = types.listOf (types.attrsOf types.str); description = "List of pools where to mine"; example = [{ url = "http://p2pool.org:9332"; @@ -57,6 +59,7 @@ in hardware = mkOption { default = []; # Run without options + type = types.listOf (types.attrsOf (types.either types.str types.int)); description= "List of config options for every GPU"; example = [ { @@ -83,6 +86,7 @@ in config = mkOption { default = {}; + type = (types.either types.bool types.int); description = "Additional config"; example = { auto-fan = true; @@ -120,7 +124,7 @@ in wantedBy = [ "multi-user.target" ]; environment = { - LD_LIBRARY_PATH = ''/run/opengl-driver/lib:/run/opengl-driver-32/lib''; + LD_LIBRARY_PATH = "/run/opengl-driver/lib:/run/opengl-driver-32/lib"; DISPLAY = ":${toString config.services.xserver.display}"; GPU_MAX_ALLOC_PERCENT = "100"; GPU_USE_SYNC_OBJECTS = "1"; diff --git a/nixos/modules/services/misc/dictd.nix b/nixos/modules/services/misc/dictd.nix index d175854d2d1ef..6e796a3a1fcec 100644 --- a/nixos/modules/services/misc/dictd.nix +++ b/nixos/modules/services/misc/dictd.nix @@ -27,7 +27,7 @@ in default = with pkgs.dictdDBs; [ wiktionary wordnet ]; defaultText = "with pkgs.dictdDBs; [ wiktionary wordnet ]"; example = literalExample "[ pkgs.dictdDBs.nld2eng ]"; - description = ''List of databases to make available.''; + description = "List of databases to make available."; }; }; diff --git a/nixos/modules/services/misc/disnix.nix b/nixos/modules/services/misc/disnix.nix deleted file mode 100644 index 41483d80a2ddb..0000000000000 --- a/nixos/modules/services/misc/disnix.nix +++ /dev/null @@ -1,98 +0,0 @@ -# Disnix server -{ config, lib, pkgs, ... }: - -with lib; - -let - - cfg = config.services.disnix; - -in - -{ - - ###### interface - - options = { - - services.disnix = { - - enable = mkEnableOption "Disnix"; - - enableMultiUser = mkOption { - type = types.bool; - default = true; - description = "Whether to support multi-user mode by enabling the Disnix D-Bus service"; - }; - - useWebServiceInterface = mkEnableOption "the DisnixWebService interface running on Apache Tomcat"; - - package = mkOption { - type = types.path; - description = "The Disnix package"; - default = pkgs.disnix; - defaultText = "pkgs.disnix"; - }; - - enableProfilePath = mkEnableOption "exposing the Disnix profiles in the system's PATH"; - - profiles = mkOption { - type = types.listOf types.string; - default = [ "default" ]; - example = [ "default" ]; - description = "Names of the Disnix profiles to expose in the system's PATH"; - }; - }; - - }; - - ###### implementation - - config = mkIf cfg.enable { - dysnomia.enable = true; - - environment.systemPackages = [ pkgs.disnix ] ++ optional cfg.useWebServiceInterface pkgs.DisnixWebService; - environment.variables.PATH = lib.optionals cfg.enableProfilePath (map (profileName: "/nix/var/nix/profiles/disnix/${profileName}/bin" ) cfg.profiles); - - services.dbus.enable = true; - services.dbus.packages = [ pkgs.disnix ]; - - services.tomcat.enable = cfg.useWebServiceInterface; - services.tomcat.extraGroups = [ "disnix" ]; - services.tomcat.javaOpts = "${optionalString cfg.useWebServiceInterface "-Djava.library.path=${pkgs.libmatthew_java}/lib/jni"} "; - services.tomcat.sharedLibs = optional cfg.useWebServiceInterface "${pkgs.DisnixWebService}/share/java/DisnixConnection.jar" - ++ optional cfg.useWebServiceInterface "${pkgs.dbus_java}/share/java/dbus.jar"; - services.tomcat.webapps = optional cfg.useWebServiceInterface pkgs.DisnixWebService; - - users.groups.disnix.gid = config.ids.gids.disnix; - - systemd.services = { - disnix = mkIf cfg.enableMultiUser { - description = "Disnix server"; - wants = [ "dysnomia.target" ]; - wantedBy = [ "multi-user.target" ]; - after = [ "dbus.service" ] - ++ optional config.services.httpd.enable "httpd.service" - ++ optional config.services.mysql.enable "mysql.service" - ++ optional config.services.postgresql.enable "postgresql.service" - ++ optional config.services.tomcat.enable "tomcat.service" - ++ optional config.services.svnserve.enable "svnserve.service" - ++ optional config.services.mongodb.enable "mongodb.service" - ++ optional config.services.influxdb.enable "influxdb.service"; - - restartIfChanged = false; - - path = [ config.nix.package cfg.package config.dysnomia.package "/run/current-system/sw" ]; - - environment = { - HOME = "/root"; - } - // (if config.environment.variables ? DYSNOMIA_CONTAINERS_PATH then { inherit (config.environment.variables) DYSNOMIA_CONTAINERS_PATH; } else {}) - // (if config.environment.variables ? DYSNOMIA_MODULES_PATH then { inherit (config.environment.variables) DYSNOMIA_MODULES_PATH; } else {}); - - serviceConfig.ExecStart = "${cfg.package}/bin/disnix-service"; - }; - - }; - }; -} diff --git a/nixos/modules/services/misc/dysnomia.nix b/nixos/modules/services/misc/dysnomia.nix deleted file mode 100644 index eb94791fbbfff..0000000000000 --- a/nixos/modules/services/misc/dysnomia.nix +++ /dev/null @@ -1,257 +0,0 @@ -{pkgs, lib, config, ...}: - -with lib; - -let - cfg = config.dysnomia; - - printProperties = properties: - concatMapStrings (propertyName: - let - property = properties.${propertyName}; - in - if isList property then "${propertyName}=(${lib.concatMapStrings (elem: "\"${toString elem}\" ") (properties.${propertyName})})\n" - else "${propertyName}=\"${toString property}\"\n" - ) (builtins.attrNames properties); - - properties = pkgs.stdenv.mkDerivation { - name = "dysnomia-properties"; - buildCommand = '' - cat > $out << "EOF" - ${printProperties cfg.properties} - EOF - ''; - }; - - containersDir = pkgs.stdenv.mkDerivation { - name = "dysnomia-containers"; - buildCommand = '' - mkdir -p $out - cd $out - - ${concatMapStrings (containerName: - let - containerProperties = cfg.containers.${containerName}; - in - '' - cat > ${containerName} <<EOF - ${printProperties containerProperties} - type=${containerName} - EOF - '' - ) (builtins.attrNames cfg.containers)} - ''; - }; - - linkMutableComponents = {containerName}: - '' - mkdir ${containerName} - - ${concatMapStrings (componentName: - let - component = cfg.components.${containerName}.${componentName}; - in - "ln -s ${component} ${containerName}/${componentName}\n" - ) (builtins.attrNames (cfg.components.${containerName} or {}))} - ''; - - componentsDir = pkgs.stdenv.mkDerivation { - name = "dysnomia-components"; - buildCommand = '' - mkdir -p $out - cd $out - - ${concatMapStrings (containerName: - linkMutableComponents { inherit containerName; } - ) (builtins.attrNames cfg.components)} - ''; - }; - - dysnomiaFlags = { - enableApacheWebApplication = config.services.httpd.enable; - enableAxis2WebService = config.services.tomcat.axis2.enable; - enableDockerContainer = config.virtualisation.docker.enable; - enableEjabberdDump = config.services.ejabberd.enable; - enableMySQLDatabase = config.services.mysql.enable; - enablePostgreSQLDatabase = config.services.postgresql.enable; - enableTomcatWebApplication = config.services.tomcat.enable; - enableMongoDatabase = config.services.mongodb.enable; - enableSubversionRepository = config.services.svnserve.enable; - enableInfluxDatabase = config.services.influxdb.enable; - }; -in -{ - options = { - dysnomia = { - - enable = mkOption { - type = types.bool; - default = false; - description = "Whether to enable Dysnomia"; - }; - - enableAuthentication = mkOption { - type = types.bool; - default = false; - description = "Whether to publish privacy-sensitive authentication credentials"; - }; - - package = mkOption { - type = types.path; - description = "The Dysnomia package"; - }; - - properties = mkOption { - description = "An attribute set in which each attribute represents a machine property. Optionally, these values can be shell substitutions."; - default = {}; - }; - - containers = mkOption { - description = "An attribute set in which each key represents a container and each value an attribute set providing its configuration properties"; - default = {}; - }; - - components = mkOption { - description = "An atttribute set in which each key represents a container and each value an attribute set in which each key represents a component and each value a derivation constructing its initial state"; - default = {}; - }; - - extraContainerProperties = mkOption { - description = "An attribute set providing additional container settings in addition to the default properties"; - default = {}; - }; - - extraContainerPaths = mkOption { - description = "A list of paths containing additional container configurations that are added to the search folders"; - default = []; - }; - - extraModulePaths = mkOption { - description = "A list of paths containing additional modules that are added to the search folders"; - default = []; - }; - - enableLegacyModules = mkOption { - type = types.bool; - default = true; - description = "Whether to enable Dysnomia legacy process and wrapper modules"; - }; - }; - }; - - config = mkIf cfg.enable { - - environment.etc = { - "dysnomia/containers" = { - source = containersDir; - }; - "dysnomia/components" = { - source = componentsDir; - }; - "dysnomia/properties" = { - source = properties; - }; - }; - - environment.variables = { - DYSNOMIA_STATEDIR = "/var/state/dysnomia-nixos"; - DYSNOMIA_CONTAINERS_PATH = "${lib.concatMapStrings (containerPath: "${containerPath}:") cfg.extraContainerPaths}/etc/dysnomia/containers"; - DYSNOMIA_MODULES_PATH = "${lib.concatMapStrings (modulePath: "${modulePath}:") cfg.extraModulePaths}/etc/dysnomia/modules"; - }; - - environment.systemPackages = [ cfg.package ]; - - dysnomia.package = pkgs.dysnomia.override (origArgs: dysnomiaFlags // lib.optionalAttrs (cfg.enableLegacyModules) { - enableLegacy = builtins.trace '' - WARNING: Dysnomia has been configured to use the legacy 'process' and 'wrapper' - modules for compatibility reasons! If you rely on these modules, consider - migrating to better alternatives. - - More information: https://raw.githubusercontent.com/svanderburg/dysnomia/f65a9a84827bcc4024d6b16527098b33b02e4054/README-legacy.md - - If you have migrated already or don't rely on these Dysnomia modules, you can - disable legacy mode with the following NixOS configuration option: - - dysnomia.enableLegacyModules = false; - - In a future version of Dysnomia (and NixOS) the legacy option will go away! - '' true; - }); - - dysnomia.properties = { - hostname = config.networking.hostName; - inherit (config.nixpkgs.localSystem) system; - - supportedTypes = [ - "echo" - "fileset" - "process" - "wrapper" - - # These are not base modules, but they are still enabled because they work with technology that are always enabled in NixOS - "systemd-unit" - "sysvinit-script" - "nixos-configuration" - ] - ++ optional (dysnomiaFlags.enableApacheWebApplication) "apache-webapplication" - ++ optional (dysnomiaFlags.enableAxis2WebService) "axis2-webservice" - ++ optional (dysnomiaFlags.enableDockerContainer) "docker-container" - ++ optional (dysnomiaFlags.enableEjabberdDump) "ejabberd-dump" - ++ optional (dysnomiaFlags.enableInfluxDatabase) "influx-database" - ++ optional (dysnomiaFlags.enableMySQLDatabase) "mysql-database" - ++ optional (dysnomiaFlags.enablePostgreSQLDatabase) "postgresql-database" - ++ optional (dysnomiaFlags.enableTomcatWebApplication) "tomcat-webapplication" - ++ optional (dysnomiaFlags.enableMongoDatabase) "mongo-database" - ++ optional (dysnomiaFlags.enableSubversionRepository) "subversion-repository"; - }; - - dysnomia.containers = lib.recursiveUpdate ({ - process = {}; - wrapper = {}; - } - // lib.optionalAttrs (config.services.httpd.enable) { apache-webapplication = { - documentRoot = config.services.httpd.virtualHosts.localhost.documentRoot; - }; } - // lib.optionalAttrs (config.services.tomcat.axis2.enable) { axis2-webservice = {}; } - // lib.optionalAttrs (config.services.ejabberd.enable) { ejabberd-dump = { - ejabberdUser = config.services.ejabberd.user; - }; } - // lib.optionalAttrs (config.services.mysql.enable) { mysql-database = { - mysqlPort = config.services.mysql.port; - mysqlSocket = "/run/mysqld/mysqld.sock"; - } // lib.optionalAttrs cfg.enableAuthentication { - mysqlUsername = "root"; - }; - } - // lib.optionalAttrs (config.services.postgresql.enable) { postgresql-database = { - } // lib.optionalAttrs (cfg.enableAuthentication) { - postgresqlUsername = "postgres"; - }; - } - // lib.optionalAttrs (config.services.tomcat.enable) { tomcat-webapplication = { - tomcatPort = 8080; - }; } - // lib.optionalAttrs (config.services.mongodb.enable) { mongo-database = {}; } - // lib.optionalAttrs (config.services.influxdb.enable) { - influx-database = { - influxdbUsername = config.services.influxdb.user; - influxdbDataDir = "${config.services.influxdb.dataDir}/data"; - influxdbMetaDir = "${config.services.influxdb.dataDir}/meta"; - }; - } - // lib.optionalAttrs (config.services.svnserve.enable) { subversion-repository = { - svnBaseDir = config.services.svnserve.svnBaseDir; - }; }) cfg.extraContainerProperties; - - system.activationScripts.dysnomia = '' - mkdir -p /etc/systemd-mutable/system - if [ ! -f /etc/systemd-mutable/system/dysnomia.target ] - then - ( echo "[Unit]" - echo "Description=Services that are activated and deactivated by Dysnomia" - echo "After=final.target" - ) > /etc/systemd-mutable/system/dysnomia.target - fi - ''; - }; -} diff --git a/nixos/modules/services/misc/etebase-server.nix b/nixos/modules/services/misc/etebase-server.nix new file mode 100644 index 0000000000000..d9d12698d79dc --- /dev/null +++ b/nixos/modules/services/misc/etebase-server.nix @@ -0,0 +1,205 @@ +{ config, pkgs, lib, ... }: + +with lib; + +let + cfg = config.services.etebase-server; + + pythonEnv = pkgs.python3.withPackages (ps: with ps; + [ etebase-server daphne ]); + + dbConfig = { + sqlite3 = '' + engine = django.db.backends.sqlite3 + name = ${cfg.dataDir}/db.sqlite3 + ''; + }; + + defaultConfigIni = toString (pkgs.writeText "etebase-server.ini" '' + [global] + debug = false + secret_file = ${if cfg.secretFile != null then cfg.secretFile else ""} + media_root = ${cfg.dataDir}/media + + [allowed_hosts] + allowed_host1 = ${cfg.host} + + [database] + ${dbConfig."${cfg.database.type}"} + ''); + + configIni = if cfg.customIni != null then cfg.customIni else defaultConfigIni; + + defaultUser = "etebase-server"; +in +{ + options = { + services.etebase-server = { + enable = mkOption { + type = types.bool; + default = false; + example = true; + description = '' + Whether to enable the Etebase server. + + Once enabled you need to create an admin user using the + shell command <literal>etebase-server createsuperuser</literal>. + Then you can login and create accounts on your-etebase-server.com/admin + ''; + }; + + secretFile = mkOption { + default = null; + type = with types; nullOr str; + description = '' + The path to a file containing the secret + used as django's SECRET_KEY. + ''; + }; + + dataDir = mkOption { + type = types.str; + default = "/var/lib/etebase-server"; + description = "Directory to store the Etebase server data."; + }; + + port = mkOption { + type = with types; nullOr port; + default = 8001; + description = "Port to listen on."; + }; + + openFirewall = mkOption { + type = types.bool; + default = false; + description = '' + Whether to open ports in the firewall for the server. + ''; + }; + + host = mkOption { + type = types.str; + default = "0.0.0.0"; + example = "localhost"; + description = '' + Host to listen on. + ''; + }; + + unixSocket = mkOption { + type = with types; nullOr str; + default = null; + description = "The path to the socket to bind to."; + example = "/run/etebase-server/etebase-server.sock"; + }; + + database = { + type = mkOption { + type = types.enum [ "sqlite3" ]; + default = "sqlite3"; + description = '' + Database engine to use. + Currently only sqlite3 is supported. + Other options can be configured using <literal>extraConfig</literal>. + ''; + }; + }; + + customIni = mkOption { + type = with types; nullOr str; + default = null; + description = '' + Custom etebase-server.ini. + + See <literal>etebase-src/etebase-server.ini.example</literal> for available options. + + Setting this option overrides the default config which is generated from the options + <literal>secretFile</literal>, <literal>host</literal> and <literal>database</literal>. + ''; + example = literalExample '' + [global] + debug = false + secret_file = /path/to/secret + media_root = /path/to/media + + [allowed_hosts] + allowed_host1 = example.com + + [database] + engine = django.db.backends.sqlite3 + name = db.sqlite3 + ''; + }; + + user = mkOption { + type = types.str; + default = defaultUser; + description = "User under which Etebase server runs."; + }; + }; + }; + + config = mkIf cfg.enable { + + environment.systemPackages = with pkgs; [ + (runCommand "etebase-server" { + buildInputs = [ makeWrapper ]; + } '' + makeWrapper ${pythonEnv}/bin/etebase-server \ + $out/bin/etebase-server \ + --run "cd ${cfg.dataDir}" \ + --prefix ETEBASE_EASY_CONFIG_PATH : "${configIni}" + '') + ]; + + systemd.tmpfiles.rules = [ + "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -" + ]; + + systemd.services.etebase-server = { + description = "An Etebase (EteSync 2.0) server"; + after = [ "network.target" "systemd-tmpfiles-setup.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + User = cfg.user; + Restart = "always"; + WorkingDirectory = cfg.dataDir; + }; + environment = { + PYTHONPATH="${pythonEnv}/${pkgs.python3.sitePackages}"; + ETEBASE_EASY_CONFIG_PATH="${configIni}"; + }; + preStart = '' + # Auto-migrate on first run or if the package has changed + versionFile="${cfg.dataDir}/src-version" + if [[ $(cat "$versionFile" 2>/dev/null) != ${pkgs.etebase-server} ]]; then + ${pythonEnv}/bin/etebase-server migrate + echo ${pkgs.etebase-server} > "$versionFile" + fi + ''; + script = + let + networking = if cfg.unixSocket != null + then "-u ${cfg.unixSocket}" + else "-b 0.0.0.0 -p ${toString cfg.port}"; + in '' + cd "${pythonEnv}/lib/etebase-server"; + ${pythonEnv}/bin/daphne ${networking} \ + etebase_server.asgi:application + ''; + }; + + users = optionalAttrs (cfg.user == defaultUser) { + users.${defaultUser} = { + group = defaultUser; + home = cfg.dataDir; + }; + + groups.${defaultUser} = {}; + }; + + networking.firewall = mkIf cfg.openFirewall { + allowedTCPPorts = [ cfg.port ]; + }; + }; +} diff --git a/nixos/modules/services/misc/exhibitor.nix b/nixos/modules/services/misc/exhibitor.nix index f8c79f892da36..28c98edf47afe 100644 --- a/nixos/modules/services/misc/exhibitor.nix +++ b/nixos/modules/services/misc/exhibitor.nix @@ -185,7 +185,7 @@ in }; zkExtraCfg = mkOption { type = types.str; - default = ''initLimit=5&syncLimit=2&tickTime=2000''; + default = "initLimit=5&syncLimit=2&tickTime=2000"; description = '' Extra options to pass into Zookeeper ''; diff --git a/nixos/modules/services/misc/felix.nix b/nixos/modules/services/misc/felix.nix index 21740c8c0b725..8d438bb9eb197 100644 --- a/nixos/modules/services/misc/felix.nix +++ b/nixos/modules/services/misc/felix.nix @@ -27,11 +27,13 @@ in }; user = mkOption { + type = types.str; default = "osgi"; description = "User account under which Apache Felix runs."; }; group = mkOption { + type = types.str; default = "osgi"; description = "Group account under which Apache Felix runs."; }; diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix index af80e99746bef..434e2d2429b5b 100644 --- a/nixos/modules/services/misc/gitea.nix +++ b/nixos/modules/services/misc/gitea.nix @@ -349,7 +349,7 @@ in { DOMAIN = cfg.domain; STATIC_ROOT_PATH = cfg.staticRootPath; - LFS_JWT_SECRET = "#jwtsecret#"; + LFS_JWT_SECRET = "#lfsjwtsecret#"; ROOT_URL = cfg.rootUrl; } (mkIf cfg.enableUnixSocket { @@ -381,6 +381,7 @@ in security = { SECRET_KEY = "#secretkey#"; + INTERNAL_TOKEN = "#internaltoken#"; INSTALL_LOCK = true; }; @@ -396,6 +397,10 @@ in mailer = mkIf (cfg.mailerPasswordFile != null) { PASSWD = "#mailerpass#"; }; + + oauth2 = { + JWT_SECRET = "#oauth2jwtsecret#"; + }; }; services.postgresql = optionalAttrs (usePostgresql && cfg.database.createDatabase) { @@ -453,12 +458,22 @@ in description = "gitea"; after = [ "network.target" ] ++ lib.optional usePostgresql "postgresql.service" ++ lib.optional useMysql "mysql.service"; wantedBy = [ "multi-user.target" ]; - path = [ gitea pkgs.gitAndTools.git ]; - + path = [ gitea pkgs.git ]; + + # In older versions the secret naming for JWT was kind of confusing. + # The file jwt_secret hold the value for LFS_JWT_SECRET and JWT_SECRET + # wasn't persistant at all. + # To fix that, there is now the file oauth2_jwt_secret containing the + # values for JWT_SECRET and the file jwt_secret gets renamed to + # lfs_jwt_secret. + # We have to consider this to stay compatible with older installations. preStart = let runConfig = "${cfg.stateDir}/custom/conf/app.ini"; secretKey = "${cfg.stateDir}/custom/conf/secret_key"; - jwtSecret = "${cfg.stateDir}/custom/conf/jwt_secret"; + oauth2JwtSecret = "${cfg.stateDir}/custom/conf/oauth2_jwt_secret"; + oldLfsJwtSecret = "${cfg.stateDir}/custom/conf/jwt_secret"; # old file for LFS_JWT_SECRET + lfsJwtSecret = "${cfg.stateDir}/custom/conf/lfs_jwt_secret"; # new file for LFS_JWT_SECRET + internalToken = "${cfg.stateDir}/custom/conf/internal_token"; in '' # copy custom configuration and generate a random secret key if needed ${optionalString (cfg.useWizard == false) '' @@ -468,24 +483,41 @@ in ${gitea}/bin/gitea generate secret SECRET_KEY > ${secretKey} fi - if [ ! -e ${jwtSecret} ]; then - ${gitea}/bin/gitea generate secret LFS_JWT_SECRET > ${jwtSecret} + # Migrate LFS_JWT_SECRET filename + if [[ -e ${oldLfsJwtSecret} && ! -e ${lfsJwtSecret} ]]; then + mv ${oldLfsJwtSecret} ${lfsJwtSecret} + fi + + if [ ! -e ${oauth2JwtSecret} ]; then + ${gitea}/bin/gitea generate secret JWT_SECRET > ${oauth2JwtSecret} + fi + + if [ ! -e ${lfsJwtSecret} ]; then + ${gitea}/bin/gitea generate secret LFS_JWT_SECRET > ${lfsJwtSecret} + fi + + if [ ! -e ${internalToken} ]; then + ${gitea}/bin/gitea generate secret INTERNAL_TOKEN > ${internalToken} fi - KEY="$(head -n1 ${secretKey})" + SECRETKEY="$(head -n1 ${secretKey})" DBPASS="$(head -n1 ${cfg.database.passwordFile})" - JWTSECRET="$(head -n1 ${jwtSecret})" + OAUTH2JWTSECRET="$(head -n1 ${oauth2JwtSecret})" + LFSJWTSECRET="$(head -n1 ${lfsJwtSecret})" + INTERNALTOKEN="$(head -n1 ${internalToken})" ${if (cfg.mailerPasswordFile == null) then '' MAILERPASSWORD="#mailerpass#" '' else '' MAILERPASSWORD="$(head -n1 ${cfg.mailerPasswordFile} || :)" ''} - sed -e "s,#secretkey#,$KEY,g" \ + sed -e "s,#secretkey#,$SECRETKEY,g" \ -e "s,#dbpass#,$DBPASS,g" \ - -e "s,#jwtsecret#,$JWTSECRET,g" \ + -e "s,#oauth2jwtsecret#,$OAUTH2JWTSECRET,g" \ + -e "s,#lfsjwtsecret#,$LFSJWTSECRET,g" \ + -e "s,#internaltoken#,$INTERNALTOKEN,g" \ -e "s,#mailerpass#,$MAILERPASSWORD,g" \ -i ${runConfig} - chmod 640 ${runConfig} ${secretKey} ${jwtSecret} + chmod 640 ${runConfig} ${secretKey} ${oauth2JwtSecret} ${lfsJwtSecret} ${internalToken} ''} # update all hooks' binary paths @@ -565,8 +597,7 @@ in users.groups.gitea = {}; warnings = - optional (cfg.database.password != "") '' - config.services.gitea.database.password will be stored as plaintext in the Nix store. Use database.passwordFile instead.'' ++ + optional (cfg.database.password != "") "config.services.gitea.database.password will be stored as plaintext in the Nix store. Use database.passwordFile instead." ++ optional (cfg.extraConfig != null) '' services.gitea.`extraConfig` is deprecated, please use services.gitea.`settings`. ''; @@ -605,5 +636,5 @@ in timerConfig.OnCalendar = cfg.dump.interval; }; }; - meta.maintainers = with lib.maintainers; [ srhb ]; + meta.maintainers = with lib.maintainers; [ srhb ma27 ]; } diff --git a/nixos/modules/services/misc/gitit.nix b/nixos/modules/services/misc/gitit.nix index 1ec030549f98e..f09565283f3c1 100644 --- a/nixos/modules/services/misc/gitit.nix +++ b/nixos/modules/services/misc/gitit.nix @@ -42,6 +42,7 @@ let }; extraPackages = mkOption { + type = types.functionTo (types.listOf types.package); default = self: []; example = literalExample '' haskellPackages: [ diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix index 3ee7a81dc3753..de4d1bf1987a1 100644 --- a/nixos/modules/services/misc/gitlab.nix +++ b/nixos/modules/services/misc/gitlab.nix @@ -44,6 +44,9 @@ let [gitlab-shell] dir = "${cfg.packages.gitlab-shell}" + [hooks] + custom_hooks_dir = "${cfg.statePath}/custom_hooks" + [gitlab] secret_file = "${cfg.statePath}/gitlab_shell_secret" url = "http+unix://${pathUrlQuote gitlabSocket}" @@ -65,7 +68,6 @@ let repos_path = "${cfg.statePath}/repositories"; secret_file = "${cfg.statePath}/gitlab_shell_secret"; log_file = "${cfg.statePath}/log/gitlab-shell.log"; - custom_hooks_dir = "${cfg.statePath}/custom_hooks"; redis = { bin = "${pkgs.redis}/bin/redis-cli"; host = "127.0.0.1"; @@ -734,7 +736,7 @@ in { environment = gitlabEnv; path = with pkgs; [ postgresqlPackage - gitAndTools.git + git ruby openssh nodejs @@ -762,7 +764,7 @@ in { path = with pkgs; [ openssh procps # See https://gitlab.com/gitlab-org/gitaly/issues/1562 - gitAndTools.git + git cfg.packages.gitaly.rubyEnv cfg.packages.gitaly.rubyEnv.wrappedRuby gzip @@ -804,7 +806,7 @@ in { wantedBy = [ "multi-user.target" ]; path = with pkgs; [ exiftool - gitAndTools.git + git gnutar gzip openssh @@ -852,7 +854,7 @@ in { environment = gitlabEnv; path = with pkgs; [ postgresqlPackage - gitAndTools.git + git openssh nodejs procps diff --git a/nixos/modules/services/misc/gitolite.nix b/nixos/modules/services/misc/gitolite.nix index 59cbdac319c8b..190ea9212d2aa 100644 --- a/nixos/modules/services/misc/gitolite.nix +++ b/nixos/modules/services/misc/gitolite.nix @@ -227,6 +227,6 @@ in }; environment.systemPackages = [ pkgs.gitolite pkgs.git ] - ++ optional cfg.enableGitAnnex pkgs.gitAndTools.git-annex; + ++ optional cfg.enableGitAnnex pkgs.git-annex; }); } diff --git a/nixos/modules/services/misc/ihaskell.nix b/nixos/modules/services/misc/ihaskell.nix index 684a242d7385b..c7332b87803a9 100644 --- a/nixos/modules/services/misc/ihaskell.nix +++ b/nixos/modules/services/misc/ihaskell.nix @@ -21,6 +21,7 @@ in }; extraPackages = mkOption { + type = types.functionTo (types.listOf types.package); default = self: []; example = literalExample '' haskellPackages: [ diff --git a/nixos/modules/services/misc/matrix-appservice-discord.nix b/nixos/modules/services/misc/matrix-appservice-discord.nix index 49c41ff637a8f..71d1227f4ff72 100644 --- a/nixos/modules/services/misc/matrix-appservice-discord.nix +++ b/nixos/modules/services/misc/matrix-appservice-discord.nix @@ -5,7 +5,7 @@ with lib; let dataDir = "/var/lib/matrix-appservice-discord"; registrationFile = "${dataDir}/discord-registration.yaml"; - appDir = "${pkgs.matrix-appservice-discord}/lib/node_modules/matrix-appservice-discord"; + appDir = "${pkgs.matrix-appservice-discord}/${pkgs.matrix-appservice-discord.passthru.nodeAppDir}"; cfg = config.services.matrix-appservice-discord; # TODO: switch to configGen.json once RFC42 is implemented settingsFile = pkgs.writeText "matrix-appservice-discord-settings.json" (builtins.toJSON cfg.settings); @@ -22,12 +22,6 @@ in { default = { database = { filename = "${dataDir}/discord.db"; - - # TODO: remove those old config keys once the following issues are solved: - # * https://github.com/Half-Shot/matrix-appservice-discord/issues/490 - # * https://github.com/Half-Shot/matrix-appservice-discord/issues/498 - userStorePath = "${dataDir}/user-store.db"; - roomStorePath = "${dataDir}/room-store.db"; }; # empty values necessary for registration file generation diff --git a/nixos/modules/services/misc/matrix-synapse.nix b/nixos/modules/services/misc/matrix-synapse.nix index 3abb9b7d69c88..8e3fa60206c2d 100644 --- a/nixos/modules/services/misc/matrix-synapse.nix +++ b/nixos/modules/services/misc/matrix-synapse.nix @@ -504,8 +504,7 @@ in { report_stats = mkOption { type = types.bool; default = false; - description = '' - ''; + description = ""; }; servers = mkOption { type = types.attrsOf (types.attrsOf types.str); diff --git a/nixos/modules/services/misc/matrix-synapse.xml b/nixos/modules/services/misc/matrix-synapse.xml index fbfa838b168bf..358b631eb485b 100644 --- a/nixos/modules/services/misc/matrix-synapse.xml +++ b/nixos/modules/services/misc/matrix-synapse.xml @@ -69,6 +69,9 @@ in { # i.e. to delegate from the host being accessible as ${config.networking.domain} # to another host actually running the Matrix homeserver. "${config.networking.domain}" = { + <link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link> = true; + <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true; + <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.extraConfig">locations."= /.well-known/matrix/server".extraConfig</link> = let # use 443 instead of the default 8448 port to unite @@ -203,7 +206,7 @@ Success! <link linkend="opt-services.nginx.virtualHosts._name_.root">root</link> = pkgs.element-web.override { conf = { default_server_config."m.homeserver" = { - "base_url" = "${config.networking.domain}"; + "base_url" = "https://${fqdn}"; "server_name" = "${fqdn}"; }; }; diff --git a/nixos/modules/services/misc/n8n.nix b/nixos/modules/services/misc/n8n.nix new file mode 100644 index 0000000000000..516d0f70ef0b8 --- /dev/null +++ b/nixos/modules/services/misc/n8n.nix @@ -0,0 +1,78 @@ +{ config, pkgs, lib, ... }: + +with lib; + +let + cfg = config.services.n8n; + format = pkgs.formats.json {}; + configFile = format.generate "n8n.json" cfg.settings; +in +{ + options.services.n8n = { + + enable = mkEnableOption "n8n server"; + + openFirewall = mkOption { + type = types.bool; + default = false; + description = "Open ports in the firewall for the n8n web interface."; + }; + + settings = mkOption { + type = format.type; + default = {}; + description = '' + Configuration for n8n, see <link xlink:href="https://docs.n8n.io/reference/configuration.html"/> + for supported values. + ''; + }; + + }; + + config = mkIf cfg.enable { + services.n8n.settings = { + # We use this to open the firewall, so we need to know about the default at eval time + port = lib.mkDefault 5678; + }; + + systemd.services.n8n = { + description = "N8N service"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + environment = { + # This folder must be writeable as the application is storing + # its data in it, so the StateDirectory is a good choice + N8N_USER_FOLDER = "/var/lib/n8n"; + N8N_CONFIG_FILES = "${configFile}"; + }; + serviceConfig = { + Type = "simple"; + ExecStart = "${pkgs.n8n}/bin/n8n"; + Restart = "on-failure"; + StateDirectory = "n8n"; + + # Basic Hardening + NoNewPrivileges = "yes"; + PrivateTmp = "yes"; + PrivateDevices = "yes"; + DevicePolicy = "closed"; + DynamicUser = "true"; + ProtectSystem = "strict"; + ProtectHome = "read-only"; + ProtectControlGroups = "yes"; + ProtectKernelModules = "yes"; + ProtectKernelTunables = "yes"; + RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK"; + RestrictNamespaces = "yes"; + RestrictRealtime = "yes"; + RestrictSUIDSGID = "yes"; + MemoryDenyWriteExecute = "yes"; + LockPersonality = "yes"; + }; + }; + + networking.firewall = mkIf cfg.openFirewall { + allowedTCPPorts = [ cfg.settings.port ]; + }; + }; +} diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix index 0eeff31d6c4d4..64bdbf159d511 100644 --- a/nixos/modules/services/misc/nix-daemon.nix +++ b/nixos/modules/services/misc/nix-daemon.nix @@ -587,10 +587,10 @@ in nix.systemFeatures = mkDefault ( [ "nixos-test" "benchmark" "big-parallel" "kvm" ] ++ - optionals (pkgs.hostPlatform.platform ? gcc.arch) ( - # a builder can run code for `platform.gcc.arch` and inferior architectures - [ "gccarch-${pkgs.hostPlatform.platform.gcc.arch}" ] ++ - map (x: "gccarch-${x}") lib.systems.architectures.inferiors.${pkgs.hostPlatform.platform.gcc.arch} + optionals (pkgs.hostPlatform ? gcc.arch) ( + # a builder can run code for `gcc.arch` and inferior architectures + [ "gccarch-${pkgs.hostPlatform.gcc.arch}" ] ++ + map (x: "gccarch-${x}") lib.systems.architectures.inferiors.${pkgs.hostPlatform.gcc.arch} ) ); diff --git a/nixos/modules/services/misc/nzbhydra2.nix b/nixos/modules/services/misc/nzbhydra2.nix new file mode 100644 index 0000000000000..c396b4b8f6e94 --- /dev/null +++ b/nixos/modules/services/misc/nzbhydra2.nix @@ -0,0 +1,78 @@ +{ config, pkgs, lib, ... }: + +with lib; + +let cfg = config.services.nzbhydra2; + +in { + options = { + services.nzbhydra2 = { + enable = mkEnableOption "NZBHydra2"; + + dataDir = mkOption { + type = types.str; + default = "/var/lib/nzbhydra2"; + description = "The directory where NZBHydra2 stores its data files."; + }; + + openFirewall = mkOption { + type = types.bool; + default = false; + description = + "Open ports in the firewall for the NZBHydra2 web interface."; + }; + + package = mkOption { + type = types.package; + default = pkgs.nzbhydra2; + defaultText = "pkgs.nzbhydra2"; + description = "NZBHydra2 package to use."; + }; + }; + }; + + config = mkIf cfg.enable { + systemd.tmpfiles.rules = + [ "d '${cfg.dataDir}' 0700 nzbhydra2 nzbhydra2 - -" ]; + + systemd.services.nzbhydra2 = { + description = "NZBHydra2"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + Type = "simple"; + User = "nzbhydra2"; + Group = "nzbhydra2"; + ExecStart = + "${cfg.package}/bin/nzbhydra2 --nobrowser --datafolder '${cfg.dataDir}'"; + Restart = "on-failure"; + # Hardening + NoNewPrivileges = true; + PrivateTmp = true; + PrivateDevices = true; + DevicePolicy = "closed"; + ProtectSystem = "strict"; + ReadWritePaths = cfg.dataDir; + ProtectHome = "read-only"; + ProtectControlGroups = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + RestrictAddressFamilies ="AF_UNIX AF_INET AF_INET6 AF_NETLINK"; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + LockPersonality = true; + }; + }; + + networking.firewall = mkIf cfg.openFirewall { allowedTCPPorts = [ 5076 ]; }; + + users.users.nzbhydra2 = { + group = "nzbhydra2"; + isSystemUser = true; + }; + + users.groups.nzbhydra2 = {}; + }; +} diff --git a/nixos/modules/services/misc/octoprint.nix b/nixos/modules/services/misc/octoprint.nix index a69e650730508..5a64946f9f63d 100644 --- a/nixos/modules/services/misc/octoprint.nix +++ b/nixos/modules/services/misc/octoprint.nix @@ -66,6 +66,7 @@ in }; plugins = mkOption { + type = types.functionTo (types.listOf types.package); default = plugins: []; defaultText = "plugins: []"; example = literalExample "plugins: with plugins; [ themeify stlviewer ]"; diff --git a/nixos/modules/services/misc/pykms.nix b/nixos/modules/services/misc/pykms.nix index d6aeae48ccb62..2f752bcc7ed6b 100644 --- a/nixos/modules/services/misc/pykms.nix +++ b/nixos/modules/services/misc/pykms.nix @@ -1,12 +1,12 @@ { config, lib, pkgs, ... }: with lib; - let cfg = config.services.pykms; libDir = "/var/lib/pykms"; -in { +in +{ meta.maintainers = with lib.maintainers; [ peterhoeg ]; imports = [ @@ -46,14 +46,14 @@ in { }; logLevel = mkOption { - type = types.enum [ "CRITICAL" "ERROR" "WARNING" "INFO" "DEBUG" "MINI" ]; + type = types.enum [ "CRITICAL" "ERROR" "WARNING" "INFO" "DEBUG" "MININFO" ]; default = "INFO"; description = "How much to log"; }; extraArgs = mkOption { type = types.listOf types.str; - default = []; + default = [ ]; description = "Additional arguments"; }; }; @@ -74,8 +74,9 @@ in { ExecStartPre = "${getBin pykms}/libexec/create_pykms_db.sh ${libDir}/clients.db"; ExecStart = lib.concatStringsSep " " ([ "${getBin pykms}/bin/server" - "--logfile STDOUT" - "--loglevel ${cfg.logLevel}" + "--logfile=STDOUT" + "--loglevel=${cfg.logLevel}" + "--sqlite=${libDir}/clients.db" ] ++ cfg.extraArgs ++ [ cfg.listenAddress (toString cfg.port) diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix index 1313bdaccc49a..8b53eb471db69 100644 --- a/nixos/modules/services/misc/redmine.nix +++ b/nixos/modules/services/misc/redmine.nix @@ -230,7 +230,7 @@ in production = { scm_subversion_command = "${pkgs.subversion}/bin/svn"; scm_mercurial_command = "${pkgs.mercurial}/bin/hg"; - scm_git_command = "${pkgs.gitAndTools.git}/bin/git"; + scm_git_command = "${pkgs.git}/bin/git"; scm_cvs_command = "${pkgs.cvs}/bin/cvs"; scm_bazaar_command = "${pkgs.breezy}/bin/bzr"; scm_darcs_command = "${pkgs.darcs}/bin/darcs"; @@ -299,7 +299,7 @@ in breezy cvs darcs - gitAndTools.git + git mercurial subversion ]; diff --git a/nixos/modules/services/misc/rippled.nix b/nixos/modules/services/misc/rippled.nix index ef34e3a779f01..2fce3b9dc94c7 100644 --- a/nixos/modules/services/misc/rippled.nix +++ b/nixos/modules/services/misc/rippled.nix @@ -389,6 +389,7 @@ in extraConfig = mkOption { default = ""; + type = types.lines; description = '' Extra lines to be added verbatim to the rippled.cfg configuration file. ''; diff --git a/nixos/modules/services/misc/snapper.nix b/nixos/modules/services/misc/snapper.nix index 3560d08520b76..a821b9b6bf652 100644 --- a/nixos/modules/services/misc/snapper.nix +++ b/nixos/modules/services/misc/snapper.nix @@ -48,6 +48,8 @@ in subvolume = "/home"; extraConfig = '' ALLOW_USERS="alice" + TIMELINE_CREATE=yes + TIMELINE_CLEANUP=yes ''; }; }; diff --git a/nixos/modules/services/misc/svnserve.nix b/nixos/modules/services/misc/svnserve.nix index f70e3ca7fef0a..5fa262ca3b945 100644 --- a/nixos/modules/services/misc/svnserve.nix +++ b/nixos/modules/services/misc/svnserve.nix @@ -24,6 +24,7 @@ in }; svnBaseDir = mkOption { + type = types.str; default = "/repos"; description = "Base directory from which Subversion repositories are accessed."; }; diff --git a/nixos/modules/services/misc/synergy.nix b/nixos/modules/services/misc/synergy.nix index 5b7cf3ac46c3c..7990a9f6f4cec 100644 --- a/nixos/modules/services/misc/synergy.nix +++ b/nixos/modules/services/misc/synergy.nix @@ -23,12 +23,14 @@ in screenName = mkOption { default = ""; + type = types.str; description = '' Use the given name instead of the hostname to identify ourselves to the server. ''; }; serverAddress = mkOption { + type = types.str; description = '' The server address is of the form: [hostname][:port]. The hostname must be the address or hostname of the server. The @@ -46,10 +48,12 @@ in enable = mkEnableOption "the Synergy server (send keyboard and mouse events)"; configFile = mkOption { + type = types.path; default = "/etc/synergy-server.conf"; description = "The Synergy server configuration file."; }; screenName = mkOption { + type = types.str; default = ""; description = '' Use the given name instead of the hostname to identify @@ -57,6 +61,7 @@ in ''; }; address = mkOption { + type = types.str; default = ""; description = "Address on which to listen for clients."; }; diff --git a/nixos/modules/services/misc/weechat.nix b/nixos/modules/services/misc/weechat.nix index c6ff540ea12f4..b71250f62e0f3 100644 --- a/nixos/modules/services/misc/weechat.nix +++ b/nixos/modules/services/misc/weechat.nix @@ -20,6 +20,7 @@ in type = types.str; }; binary = mkOption { + type = types.path; description = "Binary to execute (by default \${weechat}/bin/weechat)."; example = literalExample '' ''${pkgs.weechat}/bin/weechat-headless diff --git a/nixos/modules/services/misc/zigbee2mqtt.nix b/nixos/modules/services/misc/zigbee2mqtt.nix index 0957920f1a097..cd987eb76c76c 100644 --- a/nixos/modules/services/misc/zigbee2mqtt.nix +++ b/nixos/modules/services/misc/zigbee2mqtt.nix @@ -70,6 +70,7 @@ in description = "Zigbee2mqtt Service"; wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; + environment.ZIGBEE2MQTT_DATA = cfg.dataDir; serviceConfig = { ExecStart = "${cfg.package}/bin/zigbee2mqtt"; User = "zigbee2mqtt"; diff --git a/nixos/modules/services/misc/zookeeper.nix b/nixos/modules/services/misc/zookeeper.nix index f6af7c75ebae9..1d12e81a9eca8 100644 --- a/nixos/modules/services/misc/zookeeper.nix +++ b/nixos/modules/services/misc/zookeeper.nix @@ -76,6 +76,7 @@ in { default = '' zookeeper.root.logger=INFO, CONSOLE log4j.rootLogger=INFO, CONSOLE + log4j.logger.org.apache.zookeeper.audit.Log4jAuditLogger=INFO, CONSOLE log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout log4j.appender.CONSOLE.layout.ConversionPattern=[myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n @@ -128,11 +129,10 @@ in { description = "Zookeeper Daemon"; wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; - environment = { ZOOCFGDIR = configDir; }; serviceConfig = { ExecStart = '' ${pkgs.jre}/bin/java \ - -cp "${cfg.package}/lib/*:${cfg.package}/${cfg.package.name}.jar:${configDir}" \ + -cp "${cfg.package}/lib/*:${configDir}" \ ${escapeShellArgs cfg.extraCmdLineOptions} \ -Dzookeeper.datadir.autocreate=false \ ${optionalString cfg.preferIPv4 "-Djava.net.preferIPv4Stack=true"} \ @@ -143,6 +143,7 @@ in { }; preStart = '' echo "${toString cfg.id}" > ${cfg.dataDir}/myid + mkdir -p ${cfg.dataDir}/version-2 ''; }; diff --git a/nixos/modules/services/monitoring/apcupsd.nix b/nixos/modules/services/monitoring/apcupsd.nix index 75218aa1d46b0..1dccbc93edf84 100644 --- a/nixos/modules/services/monitoring/apcupsd.nix +++ b/nixos/modules/services/monitoring/apcupsd.nix @@ -104,7 +104,7 @@ in hooks = mkOption { default = {}; example = { - doshutdown = ''# shell commands to notify that the computer is shutting down''; + doshutdown = "# shell commands to notify that the computer is shutting down"; }; type = types.attrsOf types.lines; description = '' diff --git a/nixos/modules/services/monitoring/grafana-image-renderer.nix b/nixos/modules/services/monitoring/grafana-image-renderer.nix new file mode 100644 index 0000000000000..b8b95d846c6af --- /dev/null +++ b/nixos/modules/services/monitoring/grafana-image-renderer.nix @@ -0,0 +1,150 @@ +{ lib, pkgs, config, ... }: + +with lib; + +let + cfg = config.services.grafana-image-renderer; + + format = pkgs.formats.json { }; + + configFile = format.generate "grafana-image-renderer-config.json" cfg.settings; +in { + options.services.grafana-image-renderer = { + enable = mkEnableOption "grafana-image-renderer"; + + chromium = mkOption { + type = types.package; + description = '' + The chromium to use for image rendering. + ''; + }; + + verbose = mkEnableOption "verbosity for the service"; + + provisionGrafana = mkEnableOption "Grafana configuration for grafana-image-renderer"; + + settings = mkOption { + type = types.submodule { + freeformType = format.type; + + options = { + service = { + port = mkOption { + type = types.port; + default = 8081; + description = '' + The TCP port to use for the rendering server. + ''; + }; + logging.level = mkOption { + type = types.enum [ "error" "warning" "info" "debug" ]; + default = "info"; + description = '' + The log-level of the <filename>grafana-image-renderer.service</filename>-unit. + ''; + }; + }; + rendering = { + width = mkOption { + default = 1000; + type = types.ints.positive; + description = '' + Width of the PNG used to display the alerting graph. + ''; + }; + height = mkOption { + default = 500; + type = types.ints.positive; + description = '' + Height of the PNG used to display the alerting graph. + ''; + }; + mode = mkOption { + default = "default"; + type = types.enum [ "default" "reusable" "clustered" ]; + description = '' + Rendering mode of <package>grafana-image-renderer</package>: + <itemizedlist> + <listitem><para><literal>default:</literal> Creates on browser-instance + per rendering request.</para></listitem> + <listitem><para><literal>reusable:</literal> One browser instance + will be started and reused for each rendering request.</para></listitem> + <listitem><para><literal>clustered:</literal> allows to precisely + configure how many browser-instances are supposed to be used. The values + for that mode can be declared in <literal>rendering.clustering</literal>. + </para></listitem> + </itemizedlist> + ''; + }; + args = mkOption { + type = types.listOf types.str; + default = [ "--no-sandbox" ]; + description = '' + List of CLI flags passed to <package>chromium</package>. + ''; + }; + }; + }; + }; + + default = {}; + + description = '' + Configuration attributes for <package>grafana-image-renderer</package>. + + See <link xlink:href="https://github.com/grafana/grafana-image-renderer/blob/ce1f81438e5f69c7fd7c73ce08bab624c4c92e25/default.json" /> + for supported values. + ''; + }; + }; + + config = mkIf cfg.enable { + assertions = [ + { assertion = cfg.provisionGrafana -> config.services.grafana.enable; + message = '' + To provision a Grafana instance to use grafana-image-renderer, + `services.grafana.enable` must be set to `true`! + ''; + } + ]; + + services.grafana.extraOptions = mkIf cfg.provisionGrafana { + RENDERING_SERVER_URL = "http://localhost:${toString cfg.settings.service.port}/render"; + RENDERING_CALLBACK_URL = "http://localhost:${toString config.services.grafana.port}"; + }; + + services.grafana-image-renderer.chromium = mkDefault pkgs.chromium; + + services.grafana-image-renderer.settings = { + rendering = mapAttrs (const mkDefault) { + chromeBin = "${cfg.chromium}/bin/chromium"; + verboseLogging = cfg.verbose; + timezone = config.time.timeZone; + }; + + service = { + logging.level = mkIf cfg.verbose (mkDefault "debug"); + metrics.enabled = mkDefault false; + }; + }; + + systemd.services.grafana-image-renderer = { + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + description = " A Grafana backend plugin that handles rendering of panels & dashboards to PNGs using headless browser (Chromium/Chrome)"; + + environment = { + PUPPETEER_SKIP_CHROMIUM_DOWNLOAD = "true"; + }; + + serviceConfig = { + DynamicUser = true; + PrivateTmp = true; + ExecStart = "${pkgs.grafana-image-renderer}/bin/grafana-image-renderer server --config=${configFile}"; + Restart = "always"; + }; + }; + }; + + meta.maintainers = with maintainers; [ ma27 ]; +} diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix index b0c81a46d4d81..c8515c4b8988c 100644 --- a/nixos/modules/services/monitoring/grafana.nix +++ b/nixos/modules/services/monitoring/grafana.nix @@ -5,10 +5,11 @@ with lib; let cfg = config.services.grafana; opt = options.services.grafana; + declarativePlugins = pkgs.linkFarm "grafana-plugins" (builtins.map (pkg: { name = pkg.pname; path = pkg; }) cfg.declarativePlugins); envOptions = { PATHS_DATA = cfg.dataDir; - PATHS_PLUGINS = "${cfg.dataDir}/plugins"; + PATHS_PLUGINS = if builtins.isNull cfg.declarativePlugins then "${cfg.dataDir}/plugins" else declarativePlugins; PATHS_LOGS = "${cfg.dataDir}/log"; SERVER_PROTOCOL = cfg.protocol; @@ -260,6 +261,12 @@ in { defaultText = "pkgs.grafana"; type = types.package; }; + declarativePlugins = mkOption { + type = with types; nullOr (listOf path); + default = null; + description = "If non-null, then a list of packages containing Grafana plugins to install. If set, plugins cannot be manually installed."; + example = literalExample "with pkgs.grafanaPlugins; [ grafana-piechart-panel ]"; + }; dataDir = mkOption { description = "Data directory."; diff --git a/nixos/modules/services/monitoring/graphite.nix b/nixos/modules/services/monitoring/graphite.nix index 64d9d61950da1..9213748d3c9a1 100644 --- a/nixos/modules/services/monitoring/graphite.nix +++ b/nixos/modules/services/monitoring/graphite.nix @@ -25,10 +25,10 @@ let graphiteApiConfig = pkgs.writeText "graphite-api.yaml" '' search_index: ${dataDir}/index - ${optionalString (config.time.timeZone != null) ''time_zone: ${config.time.timeZone}''} - ${optionalString (cfg.api.finders != []) ''finders:''} + ${optionalString (config.time.timeZone != null) "time_zone: ${config.time.timeZone}"} + ${optionalString (cfg.api.finders != []) "finders:"} ${concatMapStringsSep "\n" (f: " - " + f.moduleName) cfg.api.finders} - ${optionalString (cfg.api.functions != []) ''functions:''} + ${optionalString (cfg.api.functions != []) "functions:"} ${concatMapStringsSep "\n" (f: " - " + f) cfg.api.functions} ${cfg.api.extraConfig} ''; diff --git a/nixos/modules/services/monitoring/incron.nix b/nixos/modules/services/monitoring/incron.nix index 1789fd9f20514..dc97af58562e7 100644 --- a/nixos/modules/services/monitoring/incron.nix +++ b/nixos/modules/services/monitoring/incron.nix @@ -67,7 +67,7 @@ in config = mkIf cfg.enable { warnings = optional (cfg.allow != null && cfg.deny != null) - ''If `services.incron.allow` is set then `services.incron.deny` will be ignored.''; + "If `services.incron.allow` is set then `services.incron.deny` will be ignored."; environment.systemPackages = [ pkgs.incron ]; diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix index db51fdbd2c617..d5b679097b309 100644 --- a/nixos/modules/services/monitoring/netdata.nix +++ b/nixos/modules/services/monitoring/netdata.nix @@ -77,6 +77,7 @@ in { ''; }; extraPackages = mkOption { + type = types.functionTo (types.listOf types.package); default = ps: []; defaultText = "ps: []"; example = literalExample '' diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix index 72428957109c6..9103a6f932dbb 100644 --- a/nixos/modules/services/monitoring/prometheus/default.nix +++ b/nixos/modules/services/monitoring/prometheus/default.nix @@ -32,6 +32,8 @@ let (pkgs.writeText "prometheus.rules" (concatStringsSep "\n" cfg.rules)) ]); scrape_configs = filterValidPrometheus cfg.scrapeConfigs; + remote_write = filterValidPrometheus cfg.remoteWrite; + remote_read = filterValidPrometheus cfg.remoteRead; alerting = { inherit (cfg) alertmanagers; }; @@ -101,6 +103,157 @@ let }; }; + promTypes.remote_read = types.submodule { + options = { + url = mkOption { + type = types.str; + description = '' + ServerName extension to indicate the name of the server. + http://tools.ietf.org/html/rfc4366#section-3.1 + ''; + }; + name = mkOpt types.string '' + Name of the remote read config, which if specified must be unique among remote read configs. + The name will be used in metrics and logging in place of a generated value to help users distinguish between + remote read configs. + ''; + required_matchers = mkOpt (types.attrsOf types.str) '' + An optional list of equality matchers which have to be + present in a selector to query the remote read endpoint. + ''; + remote_timeout = mkOpt types.str '' + Timeout for requests to the remote read endpoint. + ''; + read_recent = mkOpt types.bool '' + Whether reads should be made for queries for time ranges that + the local storage should have complete data for. + ''; + basic_auth = mkOpt (types.submodule { + options = { + username = mkOption { + type = types.str; + description = '' + HTTP username + ''; + }; + password = mkOpt types.str "HTTP password"; + password_file = mkOpt types.str "HTTP password file"; + }; + }) '' + Sets the `Authorization` header on every remote read request with the + configured username and password. + password and password_file are mutually exclusive. + ''; + bearer_token = mkOpt types.str '' + Sets the `Authorization` header on every remote read request with + the configured bearer token. It is mutually exclusive with `bearer_token_file`. + ''; + bearer_token_file = mkOpt types.str '' + Sets the `Authorization` header on every remote read request with the bearer token + read from the configured file. It is mutually exclusive with `bearer_token`. + ''; + tls_config = mkOpt promTypes.tls_config '' + Configures the remote read request's TLS settings. + ''; + proxy_url = mkOpt types.str "Optional Proxy URL."; + }; + }; + + promTypes.remote_write = types.submodule { + options = { + url = mkOption { + type = types.str; + description = '' + ServerName extension to indicate the name of the server. + http://tools.ietf.org/html/rfc4366#section-3.1 + ''; + }; + remote_timeout = mkOpt types.str '' + Timeout for requests to the remote write endpoint. + ''; + write_relabel_configs = mkOpt (types.listOf promTypes.relabel_config) '' + List of remote write relabel configurations. + ''; + name = mkOpt types.string '' + Name of the remote write config, which if specified must be unique among remote write configs. + The name will be used in metrics and logging in place of a generated value to help users distinguish between + remote write configs. + ''; + basic_auth = mkOpt (types.submodule { + options = { + username = mkOption { + type = types.str; + description = '' + HTTP username + ''; + }; + password = mkOpt types.str "HTTP password"; + password_file = mkOpt types.str "HTTP password file"; + }; + }) '' + Sets the `Authorization` header on every remote write request with the + configured username and password. + password and password_file are mutually exclusive. + ''; + bearer_token = mkOpt types.str '' + Sets the `Authorization` header on every remote write request with + the configured bearer token. It is mutually exclusive with `bearer_token_file`. + ''; + bearer_token_file = mkOpt types.str '' + Sets the `Authorization` header on every remote write request with the bearer token + read from the configured file. It is mutually exclusive with `bearer_token`. + ''; + tls_config = mkOpt promTypes.tls_config '' + Configures the remote write request's TLS settings. + ''; + proxy_url = mkOpt types.str "Optional Proxy URL."; + queue_config = mkOpt (types.submodule { + options = { + capacity = mkOpt types.int '' + Number of samples to buffer per shard before we block reading of more + samples from the WAL. It is recommended to have enough capacity in each + shard to buffer several requests to keep throughput up while processing + occasional slow remote requests. + ''; + max_shards = mkOpt types.int '' + Maximum number of shards, i.e. amount of concurrency. + ''; + min_shards = mkOpt types.int '' + Minimum number of shards, i.e. amount of concurrency. + ''; + max_samples_per_send = mkOpt types.int '' + Maximum number of samples per send. + ''; + batch_send_deadline = mkOpt types.str '' + Maximum time a sample will wait in buffer. + ''; + min_backoff = mkOpt types.str '' + Initial retry delay. Gets doubled for every retry. + ''; + max_backoff = mkOpt types.str '' + Maximum retry delay. + ''; + }; + }) '' + Configures the queue used to write to remote storage. + ''; + metadata_config = mkOpt (types.submodule { + options = { + send = mkOpt types.bool '' + Whether metric metadata is sent to remote storage or not. + ''; + send_interval = mkOpt types.str '' + How frequently metric metadata is sent to remote storage. + ''; + }; + }) '' + Configures the sending of series metadata to remote storage. + Metadata configuration is subject to change at any point + or be removed in future releases. + ''; + }; + }; + promTypes.scrape_config = types.submodule { options = { job_name = mkOption { @@ -217,6 +370,14 @@ let List of file service discovery configurations. ''; + gce_sd_configs = mkOpt (types.listOf promTypes.gce_sd_config) '' + List of Google Compute Engine service discovery configurations. + + See <link + xlink:href="https://prometheus.io/docs/prometheus/latest/configuration/configuration/#gce_sd_config">the + relevant Prometheus configuration docs</link> for more detail. + ''; + static_configs = mkOpt (types.listOf promTypes.static_config) '' List of labeled target groups for this job. ''; @@ -402,6 +563,52 @@ let }; }; + promTypes.gce_sd_config = types.submodule { + options = { + # Use `mkOption` instead of `mkOpt` for project and zone because they are + # required configuration values for `gce_sd_config`. + project = mkOption { + type = types.str; + description = '' + The GCP Project. + ''; + }; + + zone = mkOption { + type = types.str; + description = '' + The zone of the scrape targets. If you need multiple zones use multiple + gce_sd_configs. + ''; + }; + + filter = mkOpt types.str '' + Filter can be used optionally to filter the instance list by other + criteria Syntax of this filter string is described here in the filter + query parameter section: <link + xlink:href="https://cloud.google.com/compute/docs/reference/latest/instances/list" + />. + ''; + + refresh_interval = mkDefOpt types.str "60s" '' + Refresh interval to re-read the cloud instance list. + ''; + + port = mkDefOpt types.port "80" '' + The port to scrape metrics from. If using the public IP address, this + must instead be specified in the relabeling rule. + ''; + + tag_separator = mkDefOpt types.str "," '' + The tag separator used to separate concatenated GCE instance network tags. + + See the GCP documentation on network tags for more information: <link + xlink:href="https://cloud.google.com/vpc/docs/add-remove-network-tags" + /> + ''; + }; + }; + promTypes.relabel_config = types.submodule { options = { source_labels = mkOpt (types.listOf types.str) '' @@ -432,10 +639,10 @@ let regular expression matches. ''; - action = mkDefOpt (types.enum ["replace" "keep" "drop"]) "replace" '' + action = + mkDefOpt (types.enum ["replace" "keep" "drop" "hashmod" "labelmap" "labeldrop" "labelkeep"]) "replace" '' Action to perform based on regex matching. ''; - }; }; @@ -580,6 +787,24 @@ in { ''; }; + remoteRead = mkOption { + type = types.listOf promTypes.remote_read; + default = []; + description = '' + Parameters of the endpoints to query from. + See <link xlink:href="https://prometheus.io/docs/prometheus/latest/configuration/configuration/#remote_read">the official documentation</link> for more information. + ''; + }; + + remoteWrite = mkOption { + type = types.listOf promTypes.remote_write; + default = []; + description = '' + Parameters of the endpoints to send samples to. + See <link xlink:href="https://prometheus.io/docs/prometheus/latest/configuration/configuration/#remote_write">the official documentation</link> for more information. + ''; + }; + rules = mkOption { type = types.listOf types.str; default = []; diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix index 995afca96ff81..1fd85c66f843d 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters.nix @@ -23,6 +23,7 @@ let exporterOpts = genAttrs [ "apcupsd" "bind" + "bird" "blackbox" "collectd" "dnsmasq" @@ -37,14 +38,17 @@ let "modemmanager" "nextcloud" "nginx" + "nginxlog" "node" "openvpn" "postfix" "postgres" + "py-air-control" "redis" "rspamd" "rtl_433" "snmp" + "smokeping" "sql" "surfboard" "tor" @@ -232,8 +236,6 @@ in services.prometheus.exporters.minio.minioAddress = mkDefault "http://localhost:9000"; services.prometheus.exporters.minio.minioAccessKey = mkDefault config.services.minio.accessKey; services.prometheus.exporters.minio.minioAccessSecret = mkDefault config.services.minio.secretKey; - })] ++ [(mkIf config.services.rspamd.enable { - services.prometheus.exporters.rspamd.url = mkDefault "http://localhost:11334/stat"; })] ++ [(mkIf config.services.prometheus.exporters.rtl_433.enable { hardware.rtl-sdr.enable = mkDefault true; })] ++ [(mkIf config.services.nginx.enable { diff --git a/nixos/modules/services/monitoring/prometheus/exporters/bird.nix b/nixos/modules/services/monitoring/prometheus/exporters/bird.nix new file mode 100644 index 0000000000000..d8a526eafcea9 --- /dev/null +++ b/nixos/modules/services/monitoring/prometheus/exporters/bird.nix @@ -0,0 +1,46 @@ +{ config, lib, pkgs, options }: + +with lib; + +let + cfg = config.services.prometheus.exporters.bird; +in +{ + port = 9324; + extraOpts = { + birdVersion = mkOption { + type = types.enum [ 1 2 ]; + default = 2; + description = '' + Specifies whether BIRD1 or BIRD2 is in use. + ''; + }; + birdSocket = mkOption { + type = types.path; + default = "/var/run/bird.ctl"; + description = '' + Path to BIRD2 (or BIRD1 v4) socket. + ''; + }; + newMetricFormat = mkOption { + type = types.bool; + default = true; + description = '' + Enable the new more-generic metric format. + ''; + }; + }; + serviceOpts = { + serviceConfig = { + SupplementaryGroups = singleton (if cfg.birdVersion == 1 then "bird" else "bird2"); + ExecStart = '' + ${pkgs.prometheus-bird-exporter}/bin/bird_exporter \ + -web.listen-address ${cfg.listenAddress}:${toString cfg.port} \ + -bird.socket ${cfg.birdSocket} \ + -bird.v2=${if cfg.birdVersion == 2 then "true" else "false"} \ + -format.new=${if cfg.newMetricFormat then "true" else "false"} \ + ${concatStringsSep " \\\n " cfg.extraFlags} + ''; + }; + }; +} diff --git a/nixos/modules/services/monitoring/prometheus/exporters/collectd.nix b/nixos/modules/services/monitoring/prometheus/exporters/collectd.nix index 972104630275b..a3b2b92bc3479 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters/collectd.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters/collectd.nix @@ -20,7 +20,7 @@ in port = mkOption { type = types.int; default = 25826; - description = ''Network address on which to accept collectd binary network packets.''; + description = "Network address on which to accept collectd binary network packets."; }; listenAddress = mkOption { diff --git a/nixos/modules/services/monitoring/prometheus/exporters/json.nix b/nixos/modules/services/monitoring/prometheus/exporters/json.nix index bd0026b55f721..1800da69a2558 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters/json.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters/json.nix @@ -8,28 +8,36 @@ in { port = 7979; extraOpts = { - url = mkOption { - type = types.str; - description = '' - URL to scrape JSON from. - ''; - }; configFile = mkOption { type = types.path; description = '' Path to configuration file. ''; }; - listenAddress = {}; # not used }; serviceOpts = { serviceConfig = { ExecStart = '' - ${pkgs.prometheus-json-exporter}/bin/prometheus-json-exporter \ - --port ${toString cfg.port} \ - ${cfg.url} ${escapeShellArg cfg.configFile} \ + ${pkgs.prometheus-json-exporter}/bin/json_exporter \ + --config.file ${escapeShellArg cfg.configFile} \ + --web.listen-address="${cfg.listenAddress}:${toString cfg.port}" \ ${concatStringsSep " \\\n " cfg.extraFlags} ''; }; }; + imports = [ + (mkRemovedOptionModule [ "url" ] '' + This option was removed. The URL of the endpoint serving JSON + must now be provided to the exporter by prometheus via the url + parameter `target'. + + In prometheus a scrape URL would look like this: + + http://some.json-exporter.host:7979/probe?target=https://example.com/some/json/endpoint + + For more information, take a look at the official documentation + (https://github.com/prometheus-community/json_exporter) of the json_exporter. + '') + ({ options.warnings = options.warnings; options.assertions = options.assertions; }) + ]; } diff --git a/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix b/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix index aee6bd5e66cea..ce7125bf5a838 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix @@ -46,11 +46,11 @@ in DynamicUser = false; ExecStart = '' ${pkgs.prometheus-nextcloud-exporter}/bin/nextcloud-exporter \ - -a ${cfg.listenAddress}:${toString cfg.port} \ - -u ${cfg.username} \ - -t ${cfg.timeout} \ - -l ${cfg.url} \ - -p ${escapeShellArg "@${cfg.passwordFile}"} \ + --addr ${cfg.listenAddress}:${toString cfg.port} \ + --username ${cfg.username} \ + --timeout ${cfg.timeout} \ + --server ${cfg.url} \ + --password ${escapeShellArg "@${cfg.passwordFile}"} \ ${concatStringsSep " \\\n " cfg.extraFlags} ''; }; diff --git a/nixos/modules/services/monitoring/prometheus/exporters/nginxlog.nix b/nixos/modules/services/monitoring/prometheus/exporters/nginxlog.nix new file mode 100644 index 0000000000000..8c1f552d58a7c --- /dev/null +++ b/nixos/modules/services/monitoring/prometheus/exporters/nginxlog.nix @@ -0,0 +1,51 @@ +{ config, lib, pkgs, options }: + +with lib; + +let + cfg = config.services.prometheus.exporters.nginxlog; +in { + port = 9117; + extraOpts = { + settings = mkOption { + type = types.attrs; + default = {}; + description = '' + All settings of nginxlog expressed as an Nix attrset. + + Check the official documentation for the corresponding YAML + settings that can all be used here: https://github.com/martin-helmich/prometheus-nginxlog-exporter + + The `listen` object is already generated by `port`, `listenAddress` and `metricsEndpoint` and + will be merged with the value of `settings` before writting it as JSON. + ''; + }; + + metricsEndpoint = mkOption { + type = types.str; + default = "/metrics"; + description = '' + Path under which to expose metrics. + ''; + }; + }; + + serviceOpts = let + listenConfig = { + listen = { + port = cfg.port; + address = cfg.listenAddress; + metrics_endpoint = cfg.metricsEndpoint; + }; + }; + completeConfig = pkgs.writeText "nginxlog-exporter.yaml" (builtins.toJSON (lib.recursiveUpdate listenConfig cfg.settings)); + in { + serviceConfig = { + ExecStart = '' + ${pkgs.prometheus-nginxlog-exporter}/bin/prometheus-nginxlog-exporter -config-file ${completeConfig} + ''; + Restart="always"; + ProtectSystem="full"; + }; + }; +} diff --git a/nixos/modules/services/monitoring/prometheus/exporters/py-air-control.nix b/nixos/modules/services/monitoring/prometheus/exporters/py-air-control.nix new file mode 100644 index 0000000000000..d9ab99221d9d8 --- /dev/null +++ b/nixos/modules/services/monitoring/prometheus/exporters/py-air-control.nix @@ -0,0 +1,53 @@ +{ config, lib, pkgs, options }: + +with lib; + +let + cfg = config.services.prometheus.exporters.py-air-control; + + workingDir = "/var/lib/${cfg.stateDir}"; + +in +{ + port = 9896; + extraOpts = { + deviceHostname = mkOption { + type = types.str; + example = "192.168.1.123"; + description = '' + The hostname of the air purification device from which to scrape the metrics. + ''; + }; + protocol = mkOption { + type = types.str; + default = "http"; + description = '' + The protocol to use when communicating with the air purification device. + Available: [http, coap, plain_coap] + ''; + }; + stateDir = mkOption { + type = types.str; + default = "prometheus-py-air-control-exporter"; + description = '' + Directory below <literal>/var/lib</literal> to store runtime data. + This directory will be created automatically using systemd's StateDirectory mechanism. + ''; + }; + }; + serviceOpts = { + serviceConfig = { + DynamicUser = false; + StateDirectory = cfg.stateDir; + WorkingDirectory = workingDir; + ExecStart = '' + ${pkgs.python3Packages.py-air-control-exporter}/bin/py-air-control-exporter \ + --host ${cfg.deviceHostname} \ + --protocol ${cfg.protocol} \ + --listen-port ${toString cfg.port} \ + --listen-address ${cfg.listenAddress} + ''; + Environment = [ "HOME=${workingDir}" ]; + }; + }; +} diff --git a/nixos/modules/services/monitoring/prometheus/exporters/rspamd.nix b/nixos/modules/services/monitoring/prometheus/exporters/rspamd.nix index 1f02ae2072499..78fe120e4d932 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters/rspamd.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters/rspamd.nix @@ -10,64 +10,55 @@ let echo '${builtins.toJSON conf}' | ${pkgs.buildPackages.jq}/bin/jq '.' > $out ''; - generateConfig = extraLabels: (map (path: { - name = "rspamd_${replaceStrings [ "." " " ] [ "_" "_" ] path}"; - path = "$.${path}"; - labels = extraLabels; - }) [ - "actions.'add header'" - "actions.'no action'" - "actions.'rewrite subject'" - "actions.'soft reject'" - "actions.greylist" - "actions.reject" - "bytes_allocated" - "chunks_allocated" - "chunks_freed" - "chunks_oversized" - "connections" - "control_connections" - "ham_count" - "learned" - "pools_allocated" - "pools_freed" - "read_only" - "scanned" - "shared_chunks_allocated" - "spam_count" - "total_learns" - ]) ++ [{ - name = "rspamd_statfiles"; - type = "object"; - path = "$.statfiles[*]"; - labels = recursiveUpdate { - symbol = "$.symbol"; - type = "$.type"; - } extraLabels; - values = { - revision = "$.revision"; - size = "$.size"; - total = "$.total"; - used = "$.used"; - languages = "$.languages"; - users = "$.users"; - }; - }]; + generateConfig = extraLabels: { + metrics = (map (path: { + name = "rspamd_${replaceStrings [ "." " " ] [ "_" "_" ] path}"; + path = "$.${path}"; + labels = extraLabels; + }) [ + "actions.'add header'" + "actions.'no action'" + "actions.'rewrite subject'" + "actions.'soft reject'" + "actions.greylist" + "actions.reject" + "bytes_allocated" + "chunks_allocated" + "chunks_freed" + "chunks_oversized" + "connections" + "control_connections" + "ham_count" + "learned" + "pools_allocated" + "pools_freed" + "read_only" + "scanned" + "shared_chunks_allocated" + "spam_count" + "total_learns" + ]) ++ [{ + name = "rspamd_statfiles"; + type = "object"; + path = "$.statfiles[*]"; + labels = recursiveUpdate { + symbol = "$.symbol"; + type = "$.type"; + } extraLabels; + values = { + revision = "$.revision"; + size = "$.size"; + total = "$.total"; + used = "$.used"; + languages = "$.languages"; + users = "$.users"; + }; + }]; + }; in { port = 7980; extraOpts = { - listenAddress = {}; # not used - - url = mkOption { - type = types.str; - description = '' - URL to the rspamd metrics endpoint. - Defaults to http://localhost:11334/stat when - <option>services.rspamd.enable</option> is true. - ''; - }; - extraLabels = mkOption { type = types.attrsOf types.str; default = { @@ -84,9 +75,25 @@ in }; }; serviceOpts.serviceConfig.ExecStart = '' - ${pkgs.prometheus-json-exporter}/bin/prometheus-json-exporter \ - --port ${toString cfg.port} \ - ${cfg.url} ${prettyJSON (generateConfig cfg.extraLabels)} \ + ${pkgs.prometheus-json-exporter}/bin/json_exporter \ + --config.file ${prettyJSON (generateConfig cfg.extraLabels)} \ + --web.listen-address "${cfg.listenAddress}:${toString cfg.port}" \ ${concatStringsSep " \\\n " cfg.extraFlags} ''; + + imports = [ + (mkRemovedOptionModule [ "url" ] '' + This option was removed. The URL of the rspamd metrics endpoint + must now be provided to the exporter by prometheus via the url + parameter `target'. + + In prometheus a scrape URL would look like this: + + http://some.rspamd-exporter.host:7980/probe?target=http://some.rspamd.host:11334/stat + + For more information, take a look at the official documentation + (https://github.com/prometheus-community/json_exporter) of the json_exporter. + '') + ({ options.warnings = options.warnings; options.assertions = options.assertions; }) + ]; } diff --git a/nixos/modules/services/monitoring/prometheus/exporters/smokeping.nix b/nixos/modules/services/monitoring/prometheus/exporters/smokeping.nix new file mode 100644 index 0000000000000..0a7bb9c27be28 --- /dev/null +++ b/nixos/modules/services/monitoring/prometheus/exporters/smokeping.nix @@ -0,0 +1,60 @@ +{ config, lib, pkgs, options }: + +with lib; + +let + cfg = config.services.prometheus.exporters.smokeping; + goDuration = types.mkOptionType { + name = "goDuration"; + description = "Go duration (https://golang.org/pkg/time/#ParseDuration)"; + check = x: types.str.check x && builtins.match "(-?[0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+" x != null; + inherit (types.str) merge; + }; +in +{ + port = 9374; + extraOpts = { + telemetryPath = mkOption { + type = types.str; + default = "/metrics"; + description = '' + Path under which to expose metrics. + ''; + }; + pingInterval = mkOption { + type = goDuration; + default = "1s"; + description = '' + Interval between pings. + ''; + }; + buckets = mkOption { + type = types.commas; + default = "5e-05,0.0001,0.0002,0.0004,0.0008,0.0016,0.0032,0.0064,0.0128,0.0256,0.0512,0.1024,0.2048,0.4096,0.8192,1.6384,3.2768,6.5536,13.1072,26.2144"; + description = '' + List of buckets to use for the response duration histogram. + ''; + }; + hosts = mkOption { + type = with types; listOf str; + description = '' + List of endpoints to probe. + ''; + }; + }; + serviceOpts = { + serviceConfig = { + AmbientCapabilities = [ "CAP_NET_RAW" ]; + ExecStart = '' + ${pkgs.prometheus-smokeping-prober}/bin/smokeping_prober \ + --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \ + --web.telemetry-path ${cfg.telemetryPath} \ + --buckets ${cfg.buckets} \ + --ping.interval ${cfg.pingInterval} \ + --privileged \ + ${concatStringsSep " \\\n " cfg.extraFlags} \ + ${concatStringsSep " " cfg.hosts} + ''; + }; + }; +} diff --git a/nixos/modules/services/monitoring/telegraf.nix b/nixos/modules/services/monitoring/telegraf.nix index b341a9005c2a4..bc30ca3b77cfd 100644 --- a/nixos/modules/services/monitoring/telegraf.nix +++ b/nixos/modules/services/monitoring/telegraf.nix @@ -69,7 +69,7 @@ in { umask 077 ${pkgs.envsubst}/bin/envsubst -i "${configFile}" > /var/run/telegraf/config.toml ''); - ExecStart=''${cfg.package}/bin/telegraf -config ${finalConfigFile}''; + ExecStart="${cfg.package}/bin/telegraf -config ${finalConfigFile}"; ExecReload="${pkgs.coreutils}/bin/kill -HUP $MAINPID"; RuntimeDirectory = "telegraf"; User = "telegraf"; diff --git a/nixos/modules/services/monitoring/thanos.nix b/nixos/modules/services/monitoring/thanos.nix index 52dab28cf72ff..474ea4b250546 100644 --- a/nixos/modules/services/monitoring/thanos.nix +++ b/nixos/modules/services/monitoring/thanos.nix @@ -12,7 +12,7 @@ let }; optionToArgs = opt: v : optional (v != null) ''--${opt}="${toString v}"''; - flagToArgs = opt: v : optional v ''--${opt}''; + flagToArgs = opt: v : optional v "--${opt}"; listToArgs = opt: vs : map (v: ''--${opt}="${v}"'') vs; attrsToArgs = opt: kvs: mapAttrsToList (k: v: ''--${opt}=${k}=\"${v}\"'') kvs; @@ -67,7 +67,7 @@ let preferLocalBuild = true; json = builtins.toFile "${name}.json" (builtins.toJSON attrs); nativeBuildInputs = [ pkgs.remarshal ]; - } ''json2yaml -i $json -o $out''; + } "json2yaml -i $json -o $out"; thanos = cmd: "${cfg.package}/bin/thanos ${cmd}" + (let args = cfg.${cmd}.arguments; diff --git a/nixos/modules/services/monitoring/ups.nix b/nixos/modules/services/monitoring/ups.nix index a45e806d4ad86..ae5097c54424c 100644 --- a/nixos/modules/services/monitoring/ups.nix +++ b/nixos/modules/services/monitoring/ups.nix @@ -205,7 +205,7 @@ in after = [ "upsd.service" ]; wantedBy = [ "multi-user.target" ]; # TODO: replace 'root' by another username. - script = ''${pkgs.nut}/bin/upsdrvctl -u root start''; + script = "${pkgs.nut}/bin/upsdrvctl -u root start"; serviceConfig = { Type = "oneshot"; RemainAfterExit = true; diff --git a/nixos/modules/services/network-filesystems/ceph.nix b/nixos/modules/services/network-filesystems/ceph.nix index f2dc740fd88e9..632c3fb1059db 100644 --- a/nixos/modules/services/network-filesystems/ceph.nix +++ b/nixos/modules/services/network-filesystems/ceph.nix @@ -48,7 +48,7 @@ let ExecStart = ''${ceph.out}/bin/${if daemonType == "rgw" then "radosgw" else "ceph-${daemonType}"} \ -f --cluster ${clusterName} --id ${daemonId}''; } // optionalAttrs (daemonType == "osd") { - ExecStartPre = ''${ceph.lib}/libexec/ceph/ceph-osd-prestart.sh --id ${daemonId} --cluster ${clusterName}''; + ExecStartPre = "${ceph.lib}/libexec/ceph/ceph-osd-prestart.sh --id ${daemonId} --cluster ${clusterName}"; RestartSec = "20s"; PrivateDevices = "no"; # osd needs disk access } // optionalAttrs ( daemonType == "mon") { @@ -353,7 +353,7 @@ in ]; warnings = optional (cfg.global.monInitialMembers == null) - ''Not setting up a list of members in monInitialMembers requires that you set the host variable for each mon daemon or else the cluster won't function''; + "Not setting up a list of members in monInitialMembers requires that you set the host variable for each mon daemon or else the cluster won't function"; environment.etc."ceph/ceph.conf".text = let # Merge the extraConfig set for mgr daemons, as mgr don't have their own section diff --git a/nixos/modules/services/network-filesystems/netatalk.nix b/nixos/modules/services/network-filesystems/netatalk.nix index ca9d32311f5f3..33e851210bc6f 100644 --- a/nixos/modules/services/network-filesystems/netatalk.nix +++ b/nixos/modules/services/network-filesystems/netatalk.nix @@ -46,6 +46,7 @@ in enable = mkEnableOption "the Netatalk AFP fileserver"; port = mkOption { + type = types.port; default = 548; description = "TCP port to be used for AFP."; }; @@ -68,6 +69,7 @@ in }; path = mkOption { + type = types.str; default = ""; example = "afp-data"; description = "Share not the whole user home but this subdirectory path."; @@ -75,6 +77,7 @@ in basedirRegex = mkOption { example = "/home"; + type = types.str; description = "Regex which matches the parent directory of the user homes."; }; diff --git a/nixos/modules/services/network-filesystems/openafs/server.nix b/nixos/modules/services/network-filesystems/openafs/server.nix index d782f78216563..4fce650b01336 100644 --- a/nixos/modules/services/network-filesystems/openafs/server.nix +++ b/nixos/modules/services/network-filesystems/openafs/server.nix @@ -61,6 +61,7 @@ in { }; advertisedAddresses = mkOption { + type = types.listOf types.str; default = []; description = "List of IP addresses this server is advertised under. See NetInfo(5)"; }; diff --git a/nixos/modules/services/network-filesystems/rsyncd.nix b/nixos/modules/services/network-filesystems/rsyncd.nix index 9f1263ddff56f..edac86eb0e30d 100644 --- a/nixos/modules/services/network-filesystems/rsyncd.nix +++ b/nixos/modules/services/network-filesystems/rsyncd.nix @@ -46,6 +46,13 @@ in { ''; }; + socketActivated = mkOption { + default = false; + type = types.bool; + description = + "If enabled Rsync will be socket-activated rather than run persistently."; + }; + }; }; @@ -63,12 +70,55 @@ in { services.rsyncd.settings.global.port = toString cfg.port; - systemd.services.rsyncd = { - description = "Rsync daemon"; - wantedBy = [ "multi-user.target" ]; - serviceConfig.ExecStart = - "${pkgs.rsync}/bin/rsync --daemon --no-detach --config=${configFile}"; + systemd = let + serviceConfigSecurity = { + ProtectSystem = "full"; + PrivateDevices = "on"; + NoNewPrivileges = "on"; + }; + in { + services.rsync = { + enable = !cfg.socketActivated; + aliases = [ "rsyncd" ]; + + description = "fast remote file copy program daemon"; + after = [ "network.target" ]; + documentation = [ "man:rsync(1)" "man:rsyncd.conf(5)" ]; + + serviceConfig = serviceConfigSecurity // { + ExecStart = + "${pkgs.rsync}/bin/rsync --daemon --no-detach --config=${configFile}"; + RestartSec = 1; + }; + + wantedBy = [ "multi-user.target" ]; + }; + + services."rsync@" = { + description = "fast remote file copy program daemon"; + after = [ "network.target" ]; + + serviceConfig = serviceConfigSecurity // { + ExecStart = "${pkgs.rsync}/bin/rsync --daemon --config=${configFile}"; + StandardInput = "socket"; + StandardOutput = "inherit"; + StandardError = "journal"; + }; + }; + + sockets.rsync = { + enable = cfg.socketActivated; + + description = "socket for fast remote file copy program daemon"; + conflicts = [ "rsync.service" ]; + + listenStreams = [ (toString cfg.port) ]; + socketConfig.Accept = true; + + wantedBy = [ "sockets.target" ]; + }; }; + }; meta.maintainers = with lib.maintainers; [ ehmry ]; diff --git a/nixos/modules/services/network-filesystems/samba-wsdd.nix b/nixos/modules/services/network-filesystems/samba-wsdd.nix index 004d07064afd4..c68039c79e2b7 100644 --- a/nixos/modules/services/network-filesystems/samba-wsdd.nix +++ b/nixos/modules/services/network-filesystems/samba-wsdd.nix @@ -108,7 +108,7 @@ in { ProtectKernelModules = true; ProtectKernelLogs = true; ProtectControlGroups = true; - RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; + RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" ]; RestrictNamespaces = true; LockPersonality = true; MemoryDenyWriteExecute = true; diff --git a/nixos/modules/services/network-filesystems/xtreemfs.nix b/nixos/modules/services/network-filesystems/xtreemfs.nix index 27a9fe847c581..6cc8a05ee00b0 100644 --- a/nixos/modules/services/network-filesystems/xtreemfs.nix +++ b/nixos/modules/services/network-filesystems/xtreemfs.nix @@ -92,6 +92,7 @@ in enable = mkEnableOption "XtreemFS"; homeDir = mkOption { + type = types.path; default = "/var/lib/xtreemfs"; description = '' XtreemFS home dir for the xtreemfs user. @@ -109,6 +110,7 @@ in uuid = mkOption { example = "eacb6bab-f444-4ebf-a06a-3f72d7465e40"; + type = types.str; description = '' Must be set to a unique identifier, preferably a UUID according to RFC 4122. UUIDs can be generated with `uuidgen` command, found in @@ -117,11 +119,13 @@ in }; port = mkOption { default = 32638; + type = types.port; description = '' The port to listen on for incoming connections (TCP). ''; }; address = mkOption { + type = types.str; example = "127.0.0.1"; default = ""; description = '' @@ -131,12 +135,14 @@ in }; httpPort = mkOption { default = 30638; + type = types.port; description = '' Specifies the listen port for the HTTP service that returns the status page. ''; }; syncMode = mkOption { + type = types.enum [ "ASYNC" "SYNC_WRITE_METADATA" "SYNC_WRITE" "FDATASYNC" "ASYNC" ]; default = "FSYNC"; example = "FDATASYNC"; description = '' @@ -229,6 +235,7 @@ in uuid = mkOption { example = "eacb6bab-f444-4ebf-a06a-3f72d7465e41"; + type = types.str; description = '' Must be set to a unique identifier, preferably a UUID according to RFC 4122. UUIDs can be generated with `uuidgen` command, found in @@ -237,12 +244,14 @@ in }; port = mkOption { default = 32636; + type = types.port; description = '' The port to listen on for incoming connections (TCP). ''; }; address = mkOption { example = "127.0.0.1"; + type = types.str; default = ""; description = '' If specified, it defines the interface to listen on. If not @@ -251,6 +260,7 @@ in }; httpPort = mkOption { default = 30636; + type = types.port; description = '' Specifies the listen port for the HTTP service that returns the status page. @@ -258,6 +268,7 @@ in }; syncMode = mkOption { default = "FSYNC"; + type = types.enum [ "ASYNC" "SYNC_WRITE_METADATA" "SYNC_WRITE" "FDATASYNC" "ASYNC" ]; example = "FDATASYNC"; description = '' The sync mode influences how operations are committed to the disk @@ -367,6 +378,7 @@ in uuid = mkOption { example = "eacb6bab-f444-4ebf-a06a-3f72d7465e42"; + type = types.str; description = '' Must be set to a unique identifier, preferably a UUID according to RFC 4122. UUIDs can be generated with `uuidgen` command, found in @@ -375,12 +387,14 @@ in }; port = mkOption { default = 32640; + type = types.port; description = '' The port to listen on for incoming connections (TCP and UDP). ''; }; address = mkOption { example = "127.0.0.1"; + type = types.str; default = ""; description = '' If specified, it defines the interface to listen on. If not @@ -389,6 +403,7 @@ in }; httpPort = mkOption { default = 30640; + type = types.port; description = '' Specifies the listen port for the HTTP service that returns the status page. diff --git a/nixos/modules/services/network-filesystems/yandex-disk.nix b/nixos/modules/services/network-filesystems/yandex-disk.nix index cc73f13bf77ac..a5b1f9d4ab630 100644 --- a/nixos/modules/services/network-filesystems/yandex-disk.nix +++ b/nixos/modules/services/network-filesystems/yandex-disk.nix @@ -46,12 +46,14 @@ in user = mkOption { default = null; + type = types.nullOr types.str; description = '' The user the yandex-disk daemon should run as. ''; }; directory = mkOption { + type = types.path; default = "/home/Yandex.Disk"; description = "The directory to use for Yandex.Disk storage"; }; diff --git a/nixos/modules/services/networking/amuled.nix b/nixos/modules/services/networking/amuled.nix index 1128ee2c3e614..39320643dd5e1 100644 --- a/nixos/modules/services/networking/amuled.nix +++ b/nixos/modules/services/networking/amuled.nix @@ -24,13 +24,15 @@ in }; dataDir = mkOption { - default = ''/home/${user}/''; + type = types.str; + default = "/home/${user}/"; description = '' The directory holding configuration, incoming and temporary files. ''; }; user = mkOption { + type = types.nullOr types.str; default = null; description = '' The user the AMule daemon should run as. diff --git a/nixos/modules/services/networking/babeld.nix b/nixos/modules/services/networking/babeld.nix index 90395dbd3c54c..272c58ecd7ffb 100644 --- a/nixos/modules/services/networking/babeld.nix +++ b/nixos/modules/services/networking/babeld.nix @@ -69,6 +69,7 @@ in extraConfig = mkOption { default = ""; + type = types.lines; description = '' Options that will be copied to babeld.conf. See <citerefentry><refentrytitle>babeld</refentrytitle><manvolnum>8</manvolnum></citerefentry> for details. diff --git a/nixos/modules/services/networking/bee-clef.nix b/nixos/modules/services/networking/bee-clef.nix new file mode 100644 index 0000000000000..719714b289827 --- /dev/null +++ b/nixos/modules/services/networking/bee-clef.nix @@ -0,0 +1,107 @@ +{ config, lib, pkgs, ... }: + +# NOTE for now nothing is installed into /etc/bee-clef/. the config files are used as read-only from the nix store. + +with lib; +let + cfg = config.services.bee-clef; +in { + meta = { + maintainers = with maintainers; [ attila-lendvai ]; + }; + + ### interface + + options = { + services.bee-clef = { + enable = mkEnableOption "clef external signer instance for Ethereum Swarm Bee"; + + dataDir = mkOption { + type = types.nullOr types.str; + default = "/var/lib/bee-clef"; + description = '' + Data dir for bee-clef. Beware that some helper scripts may not work when changed! + The service itself should work fine, though. + ''; + }; + + passwordFile = mkOption { + type = types.nullOr types.str; + default = "/var/lib/bee-clef/password"; + description = "Password file for bee-clef."; + }; + + user = mkOption { + type = types.str; + default = "bee-clef"; + description = '' + User the bee-clef daemon should execute under. + ''; + }; + + group = mkOption { + type = types.str; + default = "bee-clef"; + description = '' + Group the bee-clef daemon should execute under. + ''; + }; + }; + }; + + ### implementation + + config = mkIf cfg.enable { + # if we ever want to have rules.js under /etc/bee-clef/ + # environment.etc."bee-clef/rules.js".source = ${pkgs.bee-clef}/rules.js + + systemd.packages = [ pkgs.bee-clef ]; # include the upstream bee-clef.service file + + systemd.tmpfiles.rules = [ + "d '${cfg.dataDir}/' 0750 ${cfg.user} ${cfg.group}" + "d '${cfg.dataDir}/keystore' 0700 ${cfg.user} ${cfg.group}" + ]; + + systemd.services.bee-clef = { + path = [ + # these are needed for the ensure-clef-account script + pkgs.coreutils + pkgs.gnused + pkgs.gawk + ]; + + wantedBy = [ "bee.service" "multi-user.target" ]; + + serviceConfig = { + User = cfg.user; + Group = cfg.group; + ExecStartPre = ''${pkgs.bee-clef}/share/bee-clef/ensure-clef-account "${cfg.dataDir}" "${pkgs.bee-clef}/share/bee-clef/"''; + ExecStart = [ + "" # this hides/overrides what's in the original entry + "${pkgs.bee-clef}/share/bee-clef/bee-clef-service start" + ]; + ExecStop = [ + "" # this hides/overrides what's in the original entry + "${pkgs.bee-clef}/share/bee-clef/bee-clef-service stop" + ]; + Environment = [ + "CONFIGDIR=${cfg.dataDir}" + "PASSWORD_FILE=${cfg.passwordFile}" + ]; + }; + }; + + users.users = optionalAttrs (cfg.user == "bee-clef") { + bee-clef = { + group = cfg.group; + home = cfg.dataDir; + isSystemUser = true; + description = "Daemon user for the bee-clef service"; + }; + }; + + users.groups = optionalAttrs (cfg.group == "bee-clef") { + bee-clef = {}; + }; + }; +} diff --git a/nixos/modules/services/networking/bee.nix b/nixos/modules/services/networking/bee.nix new file mode 100644 index 0000000000000..8a77ce23ab4d6 --- /dev/null +++ b/nixos/modules/services/networking/bee.nix @@ -0,0 +1,149 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.services.bee; + format = pkgs.formats.yaml {}; + configFile = format.generate "bee.yaml" cfg.settings; +in { + meta = { + # doc = ./bee.xml; + maintainers = with maintainers; [ attila-lendvai ]; + }; + + ### interface + + options = { + services.bee = { + enable = mkEnableOption "Ethereum Swarm Bee"; + + package = mkOption { + type = types.package; + default = pkgs.bee; + defaultText = "pkgs.bee"; + example = "pkgs.bee-unstable"; + description = "The package providing the bee binary for the service."; + }; + + settings = mkOption { + type = format.type; + description = '' + Ethereum Swarm Bee configuration. Refer to + <link xlink:href="https://gateway.ethswarm.org/bzz/docs.swarm.eth/docs/installation/configuration/"/> + for details on supported values. + ''; + }; + + daemonNiceLevel = mkOption { + type = types.int; + default = 0; + description = '' + Daemon process priority for bee. + 0 is the default Unix process priority, 19 is the lowest. + ''; + }; + + user = mkOption { + type = types.str; + default = "bee"; + description = '' + User the bee binary should execute under. + ''; + }; + + group = mkOption { + type = types.str; + default = "bee"; + description = '' + Group the bee binary should execute under. + ''; + }; + }; + }; + + ### implementation + + config = mkIf cfg.enable { + assertions = [ + { assertion = (hasAttr "password" cfg.settings) != true; + message = '' + `services.bee.settings.password` is insecure. Use `services.bee.settings.password-file` or `systemd.services.bee.serviceConfig.EnvironmentFile` instead. + ''; + } + { assertion = (hasAttr "swap-endpoint" cfg.settings) || (cfg.settings.swap-enable or true == false); + message = '' + In a swap-enabled network a working Ethereum blockchain node is required. You must specify one using `services.bee.settings.swap-endpoint`, or disable `services.bee.settings.swap-enable` = false. + ''; + } + ]; + + warnings = optional (! config.services.bee-clef.enable) "The bee service requires an external signer. Consider setting `config.services.bee-clef.enable` = true"; + + services.bee.settings = { + data-dir = lib.mkDefault "/var/lib/bee"; + password-file = lib.mkDefault "/var/lib/bee/password"; + clef-signer-enable = lib.mkDefault true; + clef-signer-endpoint = lib.mkDefault "/var/lib/bee-clef/clef.ipc"; + swap-endpoint = lib.mkDefault "https://rpc.slock.it/goerli"; + }; + + systemd.packages = [ cfg.package ]; # include the upstream bee.service file + + systemd.tmpfiles.rules = [ + "d '${cfg.settings.data-dir}' 0750 ${cfg.user} ${cfg.group}" + ]; + + systemd.services.bee = { + requires = optional config.services.bee-clef.enable + "bee-clef.service"; + + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + Nice = cfg.daemonNiceLevel; + User = cfg.user; + Group = cfg.group; + ExecStart = [ + "" # this hides/overrides what's in the original entry + "${cfg.package}/bin/bee --config=${configFile} start" + ]; + }; + + preStart = with cfg.settings; '' + if ! test -f ${password-file}; then + < /dev/urandom tr -dc _A-Z-a-z-0-9 2> /dev/null | head -c32 > ${password-file} + chmod 0600 ${password-file} + echo "Initialized ${password-file} from /dev/urandom" + fi + if [ ! -f ${data-dir}/keys/libp2p.key ]; then + ${cfg.package}/bin/bee init --config=${configFile} >/dev/null + echo " +Logs: journalctl -f -u bee.service + +Bee has SWAP enabled by default and it needs ethereum endpoint to operate. +It is recommended to use external signer with bee. +Check documentation for more info: +- SWAP https://docs.ethswarm.org/docs/installation/manual#swap-bandwidth-incentives +- External signer https://docs.ethswarm.org/docs/installation/bee-clef + +After you finish configuration run 'sudo bee-get-addr'." + fi + ''; + }; + + users.users = optionalAttrs (cfg.user == "bee") { + bee = { + group = cfg.group; + home = cfg.settings.data-dir; + isSystemUser = true; + description = "Daemon user for Ethereum Swarm Bee"; + extraGroups = optional config.services.bee-clef.enable + config.services.bee-clef.group; + }; + }; + + users.groups = optionalAttrs (cfg.group == "bee") { + bee = {}; + }; + }; +} diff --git a/nixos/modules/services/networking/bind.nix b/nixos/modules/services/networking/bind.nix index faad886357590..e507e8ce9eebc 100644 --- a/nixos/modules/services/networking/bind.nix +++ b/nixos/modules/services/networking/bind.nix @@ -8,6 +8,35 @@ let bindUser = "named"; + bindZoneOptions = { + name = mkOption { + type = types.str; + description = "Name of the zone."; + }; + master = mkOption { + description = "Master=false means slave server"; + type = types.bool; + }; + file = mkOption { + type = types.either types.str types.path; + description = "Zone file resource records contain columns of data, separated by whitespace, that define the record."; + }; + masters = mkOption { + type = types.listOf types.str; + description = "List of servers for inclusion in stub and secondary zones."; + }; + slaves = mkOption { + type = types.listOf types.str; + description = "Addresses who may request zone transfers."; + default = []; + }; + extraConfig = mkOption { + type = types.str; + description = "Extra zone config to be appended at the end of the zone section."; + default = ""; + }; + }; + confFile = pkgs.writeText "named.conf" '' include "/etc/bind/rndc.key"; @@ -72,6 +101,7 @@ in cacheNetworks = mkOption { default = ["127.0.0.0/24"]; + type = types.listOf types.str; description = " What networks are allowed to use us as a resolver. Note that this is for recursive queries -- all networks are @@ -83,6 +113,7 @@ in blockedNetworks = mkOption { default = []; + type = types.listOf types.str; description = " What networks are just blocked. "; @@ -90,6 +121,7 @@ in ipv4Only = mkOption { default = false; + type = types.bool; description = " Only use ipv4, even if the host supports ipv6. "; @@ -97,6 +129,7 @@ in forwarders = mkOption { default = config.networking.nameservers; + type = types.listOf types.str; description = " List of servers we should forward requests to. "; @@ -120,10 +153,9 @@ in zones = mkOption { default = []; + type = types.listOf (types.submodule [ { options = bindZoneOptions; } ]); description = " List of zones we claim authority over. - master=false means slave server; slaves means addresses - who may request zone transfer. "; example = [{ name = "example.com"; diff --git a/nixos/modules/services/networking/bitlbee.nix b/nixos/modules/services/networking/bitlbee.nix index 9ebf382fce42f..59ad9e5468631 100644 --- a/nixos/modules/services/networking/bitlbee.nix +++ b/nixos/modules/services/networking/bitlbee.nix @@ -58,6 +58,7 @@ in }; interface = mkOption { + type = types.str; default = "127.0.0.1"; description = '' The interface the BitlBee deamon will be listening to. If `127.0.0.1', @@ -68,6 +69,7 @@ in portNumber = mkOption { default = 6667; + type = types.int; description = '' Number of the port BitlBee will be listening to. ''; @@ -142,6 +144,7 @@ in extraSettings = mkOption { default = ""; + type = types.lines; description = '' Will be inserted in the Settings section of the config file. ''; @@ -149,6 +152,7 @@ in extraDefaults = mkOption { default = ""; + type = types.lines; description = '' Will be inserted in the Default section of the config file. ''; diff --git a/nixos/modules/services/networking/cntlm.nix b/nixos/modules/services/networking/cntlm.nix index 5b5068e43d7c1..eea28e12ce0ea 100644 --- a/nixos/modules/services/networking/cntlm.nix +++ b/nixos/modules/services/networking/cntlm.nix @@ -36,19 +36,21 @@ in enable = mkEnableOption "cntlm, which starts a local proxy"; username = mkOption { + type = types.str; description = '' Proxy account name, without the possibility to include domain name ('at' sign is interpreted literally). ''; }; domain = mkOption { - description = ''Proxy account domain/workgroup name.''; + type = types.str; + description = "Proxy account domain/workgroup name."; }; password = mkOption { default = "/etc/cntlm.password"; type = types.str; - description = ''Proxy account password. Note: use chmod 0600 on /etc/cntlm.password for security.''; + description = "Proxy account password. Note: use chmod 0600 on /etc/cntlm.password for security."; }; netbios_hostname = mkOption { @@ -60,6 +62,7 @@ in }; proxy = mkOption { + type = types.listOf types.str; description = '' A list of NTLM/NTLMv2 authenticating HTTP proxies. @@ -75,11 +78,13 @@ in A list of domains where the proxy is skipped. ''; default = []; + type = types.listOf types.str; example = [ "*.example.com" "example.com" ]; }; port = mkOption { default = [3128]; + type = types.listOf types.port; description = "Specifies on which ports the cntlm daemon listens."; }; diff --git a/nixos/modules/services/networking/connman.nix b/nixos/modules/services/networking/connman.nix index 6ccc2dffb2676..11f66b05df12c 100644 --- a/nixos/modules/services/networking/connman.nix +++ b/nixos/modules/services/networking/connman.nix @@ -42,8 +42,7 @@ in { extraConfig = mkOption { type = types.lines; - default = '' - ''; + default = ""; description = '' Configuration lines appended to the generated connman configuration file. ''; diff --git a/nixos/modules/services/networking/consul.nix b/nixos/modules/services/networking/consul.nix index f7d2afead06ca..bfaea4e167c27 100644 --- a/nixos/modules/services/networking/consul.nix +++ b/nixos/modules/services/networking/consul.nix @@ -99,6 +99,7 @@ in extraConfig = mkOption { default = { }; + type = types.attrsOf types.anything; description = '' Extra configuration options which are serialized to json and added to the config.json file. diff --git a/nixos/modules/services/networking/corerad.nix b/nixos/modules/services/networking/corerad.nix index d90a5923bc62e..4acdd1d69cc49 100644 --- a/nixos/modules/services/networking/corerad.nix +++ b/nixos/modules/services/networking/corerad.nix @@ -4,13 +4,7 @@ with lib; let cfg = config.services.corerad; - - writeTOML = name: x: - pkgs.runCommandNoCCLocal name { - passAsFile = ["config"]; - config = builtins.toJSON x; - buildInputs = [ pkgs.go-toml ]; - } "jsontoml < $configPath > $out"; + settingsFormat = pkgs.formats.toml {}; in { meta.maintainers = with maintainers; [ mdlayher ]; @@ -19,7 +13,7 @@ in { enable = mkEnableOption "CoreRAD IPv6 NDP RA daemon"; settings = mkOption { - type = types.uniq types.attrs; + type = settingsFormat.type; example = literalExample '' { interfaces = [ @@ -64,7 +58,7 @@ in { config = mkIf cfg.enable { # Prefer the config file over settings if both are set. - services.corerad.configFile = mkDefault (writeTOML "corerad.toml" cfg.settings); + services.corerad.configFile = mkDefault (settingsFormat.generate "corerad.toml" cfg.settings); systemd.services.corerad = { description = "CoreRAD IPv6 NDP RA daemon"; diff --git a/nixos/modules/services/networking/dnscrypt-proxy2.nix b/nixos/modules/services/networking/dnscrypt-proxy2.nix index dda61212216ce..ff8a2ab307746 100644 --- a/nixos/modules/services/networking/dnscrypt-proxy2.nix +++ b/nixos/modules/services/networking/dnscrypt-proxy2.nix @@ -27,6 +27,16 @@ in default = {}; }; + upstreamDefaults = mkOption { + description = '' + Whether to base the config declared in <literal>services.dnscrypt-proxy2.settings</literal> on the upstream example config (<link xlink:href="https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml"/>) + + Disable this if you want to declare your dnscrypt config from scratch. + ''; + type = types.bool; + default = true; + }; + configFile = mkOption { description = '' Path to TOML config file. See: <link xlink:href="https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml"/> @@ -38,7 +48,13 @@ in json = builtins.toJSON cfg.settings; passAsFile = [ "json" ]; } '' - ${pkgs.remarshal}/bin/json2toml < $jsonPath > $out + ${if cfg.upstreamDefaults then '' + ${pkgs.remarshal}/bin/toml2json ${pkgs.dnscrypt-proxy2.src}/dnscrypt-proxy/example-dnscrypt-proxy.toml > example.json + ${pkgs.jq}/bin/jq --slurp add example.json $jsonPath > config.json # merges the two + '' else '' + cp $jsonPath config.json + ''} + ${pkgs.remarshal}/bin/json2toml < config.json > $out ''; defaultText = literalExample "TOML file generated from services.dnscrypt-proxy2.settings"; }; diff --git a/nixos/modules/services/networking/dnscrypt-wrapper.nix b/nixos/modules/services/networking/dnscrypt-wrapper.nix index ee7e9b0454ded..89360f4bf3732 100644 --- a/nixos/modules/services/networking/dnscrypt-wrapper.nix +++ b/nixos/modules/services/networking/dnscrypt-wrapper.nix @@ -83,7 +83,7 @@ let # correctly implement key rotation of dnscrypt-wrapper ephemeral keys. dnscrypt-proxy1 = pkgs.callPackage ({ stdenv, fetchFromGitHub, autoreconfHook - , pkgconfig, libsodium, ldns, openssl, systemd }: + , pkg-config, libsodium, ldns, openssl, systemd }: stdenv.mkDerivation rec { pname = "dnscrypt-proxy"; @@ -98,7 +98,7 @@ let configureFlags = optional stdenv.isLinux "--with-systemd"; - nativeBuildInputs = [ autoreconfHook pkgconfig ]; + nativeBuildInputs = [ autoreconfHook pkg-config ]; # <ldns/ldns.h> depends on <openssl/ssl.h> buildInputs = [ libsodium openssl.dev ldns ] ++ optional stdenv.isLinux systemd; diff --git a/nixos/modules/services/networking/dnsdist.nix b/nixos/modules/services/networking/dnsdist.nix index 05c2bdef83e70..3584915d0aa3a 100644 --- a/nixos/modules/services/networking/dnsdist.nix +++ b/nixos/modules/services/networking/dnsdist.nix @@ -26,8 +26,7 @@ in { extraConfig = mkOption { type = types.lines; - default = '' - ''; + default = ""; description = '' Extra lines to be added verbatim to dnsdist.conf. ''; diff --git a/nixos/modules/services/networking/flashpolicyd.nix b/nixos/modules/services/networking/flashpolicyd.nix index 7f25083307c72..d3ac78430ca34 100644 --- a/nixos/modules/services/networking/flashpolicyd.nix +++ b/nixos/modules/services/networking/flashpolicyd.nix @@ -50,6 +50,7 @@ in }; policy = mkOption { + type = types.lines; default = '' <?xml version="1.0"?> diff --git a/nixos/modules/services/networking/gateone.nix b/nixos/modules/services/networking/gateone.nix index 56f2ba21a125b..3e3a3c1aa94d4 100644 --- a/nixos/modules/services/networking/gateone.nix +++ b/nixos/modules/services/networking/gateone.nix @@ -10,12 +10,12 @@ options = { pidDir = mkOption { default = "/run/gateone"; type = types.path; - description = ''Path of pid files for GateOne.''; + description = "Path of pid files for GateOne."; }; settingsDir = mkOption { default = "/var/lib/gateone"; type = types.path; - description = ''Path of configuration files for GateOne.''; + description = "Path of configuration files for GateOne."; }; }; }; diff --git a/nixos/modules/services/networking/gogoclient.nix b/nixos/modules/services/networking/gogoclient.nix index 99455b183144a..1205321818b97 100644 --- a/nixos/modules/services/networking/gogoclient.nix +++ b/nixos/modules/services/networking/gogoclient.nix @@ -28,6 +28,7 @@ in username = mkOption { default = ""; + type = types.str; description = '' Your Gateway6 login name, if any. ''; @@ -42,6 +43,7 @@ in }; server = mkOption { + type = types.str; default = "anonymous.freenet6.net"; example = "broker.freenet6.net"; description = "The Gateway6 server to be used."; diff --git a/nixos/modules/services/networking/gvpe.nix b/nixos/modules/services/networking/gvpe.nix index 92e87cd4640d0..b851facf1e320 100644 --- a/nixos/modules/services/networking/gvpe.nix +++ b/nixos/modules/services/networking/gvpe.nix @@ -3,7 +3,7 @@ {config, pkgs, lib, ...}: let - inherit (lib) mkOption mkIf; + inherit (lib) mkOption mkIf types; cfg = config.services.gvpe; @@ -46,12 +46,14 @@ in nodename = mkOption { default = null; + type = types.nullOr types.str; description ='' GVPE node name ''; }; configText = mkOption { default = null; + type = types.nullOr types.lines; example = '' tcp-port = 655 udp-port = 655 @@ -72,6 +74,7 @@ in }; configFile = mkOption { default = null; + type = types.nullOr types.path; example = "/root/my-gvpe-conf"; description = '' GVPE config file, if already present @@ -79,12 +82,14 @@ in }; ipAddress = mkOption { default = null; + type = types.nullOr types.str; description = '' IP address to assign to GVPE interface ''; }; subnet = mkOption { default = null; + type = types.nullOr types.str; example = "10.0.0.0/8"; description = '' IP subnet assigned to GVPE network @@ -92,6 +97,7 @@ in }; customIFSetup = mkOption { default = ""; + type = types.lines; description = '' Additional commands to apply in ifup script ''; diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix index 5d73038363a94..f719ff59cc7f0 100644 --- a/nixos/modules/services/networking/hostapd.nix +++ b/nixos/modules/services/networking/hostapd.nix @@ -20,8 +20,8 @@ let ssid=${cfg.ssid} hw_mode=${cfg.hwMode} channel=${toString cfg.channel} - ${optionalString (cfg.countryCode != null) ''country_code=${cfg.countryCode}''} - ${optionalString (cfg.countryCode != null) ''ieee80211d=1''} + ${optionalString (cfg.countryCode != null) "country_code=${cfg.countryCode}"} + ${optionalString (cfg.countryCode != null) "ieee80211d=1"} # logging (debug level) logger_syslog=-1 @@ -68,6 +68,7 @@ in interface = mkOption { default = ""; example = "wlp2s0"; + type = types.str; description = '' The interfaces <command>hostapd</command> will use. ''; diff --git a/nixos/modules/services/networking/hylafax/modem-default.nix b/nixos/modules/services/networking/hylafax/modem-default.nix index 7529b5b0aafdd..707b82092829a 100644 --- a/nixos/modules/services/networking/hylafax/modem-default.nix +++ b/nixos/modules/services/networking/hylafax/modem-default.nix @@ -5,7 +5,7 @@ { TagLineFont = "etc/LiberationSans-25.pcf"; - TagLineLocale = ''en_US.UTF-8''; + TagLineLocale = "en_US.UTF-8"; AdminGroup = "root"; # groups that can change server config AnswerRotary = "fax"; # don't accept anything else but faxes @@ -16,7 +16,7 @@ SessionTracing = "0x78701"; UUCPLockDir = "/var/lock"; - SendPageCmd = ''${pkgs.coreutils}/bin/false''; # prevent pager transmit - SendUUCPCmd = ''${pkgs.coreutils}/bin/false''; # prevent UUCP transmit + SendPageCmd = "${pkgs.coreutils}/bin/false"; # prevent pager transmit + SendUUCPCmd = "${pkgs.coreutils}/bin/false"; # prevent UUCP transmit } diff --git a/nixos/modules/services/networking/hylafax/options.nix b/nixos/modules/services/networking/hylafax/options.nix index 9e28d09dffca5..7f18c0d39ab4d 100644 --- a/nixos/modules/services/networking/hylafax/options.nix +++ b/nixos/modules/services/networking/hylafax/options.nix @@ -85,8 +85,8 @@ let # Otherwise, we use `false` to provoke # an error if hylafax tries to use it. c.sendmailPath = mkMerge [ - (mkIfDefault noWrapper ''${pkgs.coreutils}/bin/false'') - (mkIfDefault (!noWrapper) ''${wrapperDir}/${program}'') + (mkIfDefault noWrapper "${pkgs.coreutils}/bin/false") + (mkIfDefault (!noWrapper) "${wrapperDir}/${program}") ]; importDefaultConfig = file: lib.attrsets.mapAttrs @@ -121,7 +121,7 @@ in options.services.hylafax = { - enable = mkEnableOption ''HylaFAX server''; + enable = mkEnableOption "HylaFAX server"; autostart = mkOption { type = bool; @@ -139,28 +139,28 @@ in type = nullOr str1; default = null; example = "49"; - description = ''Country code for server and all modems.''; + description = "Country code for server and all modems."; }; areaCode = mkOption { type = nullOr str1; default = null; example = "30"; - description = ''Area code for server and all modems.''; + description = "Area code for server and all modems."; }; longDistancePrefix = mkOption { type = nullOr str; default = null; example = "0"; - description = ''Long distance prefix for server and all modems.''; + description = "Long distance prefix for server and all modems."; }; internationalPrefix = mkOption { type = nullOr str; default = null; example = "00"; - description = ''International prefix for server and all modems.''; + description = "International prefix for server and all modems."; }; spoolAreaPath = mkOption { @@ -267,7 +267,7 @@ in spoolExtraInit = mkOption { type = lines; default = ""; - example = ''chmod 0755 . # everyone may read my faxes''; + example = "chmod 0755 . # everyone may read my faxes"; description = '' Additional shell code that is executed within the spooling area directory right after its setup. @@ -345,7 +345,7 @@ in faxqclean.doneqMinutes = mkOption { type = int1; default = 15; - example = literalExample ''24*60''; + example = literalExample "24*60"; description = '' Set the job age threshold (in minutes) that controls how long @@ -355,7 +355,7 @@ in faxqclean.docqMinutes = mkOption { type = int1; default = 60; - example = literalExample ''24*60''; + example = literalExample "24*60"; description = '' Set the document age threshold (in minutes) that controls how long diff --git a/nixos/modules/services/networking/hylafax/systemd.nix b/nixos/modules/services/networking/hylafax/systemd.nix index b9b9b9dca4f0a..f63f7c97ad1ca 100644 --- a/nixos/modules/services/networking/hylafax/systemd.nix +++ b/nixos/modules/services/networking/hylafax/systemd.nix @@ -16,12 +16,12 @@ let mkLines = conf: (lib.concatLists (lib.flip lib.mapAttrsToList conf - (k: map (v: ''${k}: ${v}'') + (k: map (v: "${k}: ${v}") ))); include = mkLines { Include = conf.Include or []; }; other = mkLines ( conf // { Include = []; } ); in - pkgs.writeText ''hylafax-config${name}'' + pkgs.writeText "hylafax-config${name}" (concatStringsSep "\n" (include ++ other)); globalConfigPath = mkConfigFile "" cfg.faxqConfig; @@ -29,7 +29,7 @@ let modemConfigPath = let mkModemConfigFile = { config, name, ... }: - mkConfigFile ''.${name}'' + mkConfigFile ".${name}" (cfg.commonModemConfig // config); mkLine = { name, type, ... }@modem: '' # check if modem config file exists: @@ -81,7 +81,7 @@ let description = "HylaFAX queue manager sendq watch"; documentation = [ "man:faxq(8)" "man:sendq(5)" ]; wantedBy = [ "multi-user.target" ]; - pathConfig.PathExistsGlob = [ ''${cfg.spoolAreaPath}/sendq/q*'' ]; + pathConfig.PathExistsGlob = [ "${cfg.spoolAreaPath}/sendq/q*" ]; }; timers = mkMerge [ @@ -134,7 +134,7 @@ let exit 1 fi ''; - serviceConfig.ExecStop = ''${setupSpoolScript}''; + serviceConfig.ExecStop = "${setupSpoolScript}"; serviceConfig.RemainAfterExit = true; serviceConfig.Type = "oneshot"; unitConfig.RequiresMountsFor = [ cfg.spoolAreaPath ]; @@ -145,7 +145,7 @@ let documentation = [ "man:faxq(8)" ]; requires = [ "hylafax-spool.service" ]; after = [ "hylafax-spool.service" ]; - wants = mapModems ( { name, ... }: ''hylafax-faxgetty@${name}.service'' ); + wants = mapModems ( { name, ... }: "hylafax-faxgetty@${name}.service" ); wantedBy = mkIf cfg.autostart [ "multi-user.target" ]; serviceConfig.Type = "forking"; serviceConfig.ExecStart = ''${pkgs.hylafaxplus}/spool/bin/faxq -q "${cfg.spoolAreaPath}"''; @@ -155,7 +155,7 @@ let # stopped will always yield a failed send attempt: # The fax service is started when the job is created with # `sendfax`, but modems need some time to initialize. - serviceConfig.ExecStartPost = [ ''${waitFaxqScript}'' ]; + serviceConfig.ExecStartPost = [ "${waitFaxqScript}" ]; # faxquit fails if the pipe is already gone # (e.g. the service is already stopping) serviceConfig.ExecStop = ''-${pkgs.hylafaxplus}/spool/bin/faxquit -q "${cfg.spoolAreaPath}"''; @@ -186,7 +186,7 @@ let wantedBy = mkIf cfg.faxcron.enable.spoolInit requires; startAt = mkIf (cfg.faxcron.enable.frequency!=null) cfg.faxcron.enable.frequency; serviceConfig.ExecStart = concatStringsSep " " [ - ''${pkgs.hylafaxplus}/spool/bin/faxcron'' + "${pkgs.hylafaxplus}/spool/bin/faxcron" ''-q "${cfg.spoolAreaPath}"'' ''-info ${toString cfg.faxcron.infoDays}'' ''-log ${toString cfg.faxcron.logDays}'' @@ -202,18 +202,18 @@ let wantedBy = mkIf cfg.faxqclean.enable.spoolInit requires; startAt = mkIf (cfg.faxqclean.enable.frequency!=null) cfg.faxqclean.enable.frequency; serviceConfig.ExecStart = concatStringsSep " " [ - ''${pkgs.hylafaxplus}/spool/bin/faxqclean'' + "${pkgs.hylafaxplus}/spool/bin/faxqclean" ''-q "${cfg.spoolAreaPath}"'' - ''-v'' - (optionalString (cfg.faxqclean.archiving!="never") ''-a'') - (optionalString (cfg.faxqclean.archiving=="always") ''-A'') + "-v" + (optionalString (cfg.faxqclean.archiving!="never") "-a") + (optionalString (cfg.faxqclean.archiving=="always") "-A") ''-j ${toString (cfg.faxqclean.doneqMinutes*60)}'' ''-d ${toString (cfg.faxqclean.docqMinutes*60)}'' ]; }; mkFaxgettyService = { name, ... }: - lib.nameValuePair ''hylafax-faxgetty@${name}'' rec { + lib.nameValuePair "hylafax-faxgetty@${name}" rec { description = "HylaFAX faxgetty for %I"; documentation = [ "man:faxgetty(8)" ]; bindsTo = [ "dev-%i.device" ]; @@ -221,7 +221,7 @@ let after = bindsTo ++ requires; before = [ "hylafax-faxq.service" "getty.target" ]; unitConfig.StopWhenUnneeded = true; - unitConfig.AssertFileNotEmpty = ''${cfg.spoolAreaPath}/etc/config.%I''; + unitConfig.AssertFileNotEmpty = "${cfg.spoolAreaPath}/etc/config.%I"; serviceConfig.UtmpIdentifier = "%I"; serviceConfig.TTYPath = "/dev/%I"; serviceConfig.Restart = "always"; diff --git a/nixos/modules/services/networking/icecream/daemon.nix b/nixos/modules/services/networking/icecream/daemon.nix new file mode 100644 index 0000000000000..2975696f9c243 --- /dev/null +++ b/nixos/modules/services/networking/icecream/daemon.nix @@ -0,0 +1,155 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.icecream.daemon; +in { + + ###### interface + + options = { + + services.icecream.daemon = { + + enable = mkEnableOption "Icecream Daemon"; + + openFirewall = mkOption { + type = types.bool; + description = '' + Whether to automatically open receive port in the firewall. + ''; + }; + + openBroadcast = mkOption { + type = types.bool; + description = '' + Whether to automatically open the firewall for scheduler discovery. + ''; + }; + + cacheLimit = mkOption { + type = types.ints.u16; + default = 256; + description = '' + Maximum size in Megabytes of cache used to store compile environments of compile clients. + ''; + }; + + netName = mkOption { + type = types.str; + default = "ICECREAM"; + description = '' + Network name to connect to. A scheduler with the same name needs to be running. + ''; + }; + + noRemote = mkOption { + type = types.bool; + default = false; + description = '' + Prevent jobs from other nodes being scheduled on this daemon. + ''; + }; + + schedulerHost = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Explicit scheduler hostname, useful in firewalled environments. + + Uses scheduler autodiscovery via broadcast if set to null. + ''; + }; + + maxProcesses = mkOption { + type = types.nullOr types.ints.u16; + default = null; + description = '' + Maximum number of compile jobs started in parallel for this daemon. + + Uses the number of CPUs if set to null. + ''; + }; + + nice = mkOption { + type = types.int; + default = 5; + description = '' + The level of niceness to use. + ''; + }; + + hostname = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Hostname of the daemon in the icecream infrastructure. + + Uses the hostname retrieved via uname if set to null. + ''; + }; + + user = mkOption { + type = types.str; + default = "icecc"; + description = '' + User to run the icecream daemon as. Set to root to enable receive of + remote compile environments. + ''; + }; + + package = mkOption { + default = pkgs.icecream; + defaultText = "pkgs.icecream"; + type = types.package; + description = "Icecream package to use."; + }; + + extraArgs = mkOption { + type = types.listOf types.str; + default = []; + description = "Additional command line parameters."; + example = [ "-v" ]; + }; + }; + }; + + ###### implementation + + config = mkIf cfg.enable { + networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ 10245 ]; + networking.firewall.allowedUDPPorts = mkIf cfg.openBroadcast [ 8765 ]; + + systemd.services.icecc-daemon = { + description = "Icecream compile daemon"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + ExecStart = escapeShellArgs ([ + "${getBin cfg.package}/bin/iceccd" + "-b" "$STATE_DIRECTORY" + "-u" "icecc" + (toString cfg.nice) + ] + ++ optionals (cfg.schedulerHost != null) ["-s" cfg.schedulerHost] + ++ optionals (cfg.netName != null) [ "-n" cfg.netName ] + ++ optionals (cfg.cacheLimit != null) [ "--cache-limit" (toString cfg.cacheLimit) ] + ++ optionals (cfg.maxProcesses != null) [ "-m" (toString cfg.maxProcesses) ] + ++ optionals (cfg.hostname != null) [ "-N" (cfg.hostname) ] + ++ optional cfg.noRemote "--no-remote" + ++ cfg.extraArgs); + DynamicUser = true; + User = "icecc"; + Group = "icecc"; + StateDirectory = "icecc"; + RuntimeDirectory = "icecc"; + AmbientCapabilities = "CAP_SYS_CHROOT"; + CapabilityBoundingSet = "CAP_SYS_CHROOT"; + }; + }; + }; + + meta.maintainers = with lib.maintainers; [ emantor ]; +} diff --git a/nixos/modules/services/networking/icecream/scheduler.nix b/nixos/modules/services/networking/icecream/scheduler.nix new file mode 100644 index 0000000000000..4ccbf27015d7c --- /dev/null +++ b/nixos/modules/services/networking/icecream/scheduler.nix @@ -0,0 +1,101 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.icecream.scheduler; +in { + + ###### interface + + options = { + + services.icecream.scheduler = { + enable = mkEnableOption "Icecream Scheduler"; + + netName = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Network name for the icecream scheduler. + + Uses the default ICECREAM if null. + ''; + }; + + port = mkOption { + type = types.port; + default = 8765; + description = '' + Server port to listen for icecream daemon requests. + ''; + }; + + openFirewall = mkOption { + type = types.bool; + description = '' + Whether to automatically open the daemon port in the firewall. + ''; + }; + + openTelnet = mkOption { + type = types.bool; + default = false; + description = '' + Whether to open the telnet TCP port on 8766. + ''; + }; + + persistentClientConnection = mkOption { + type = types.bool; + default = false; + description = '' + Whether to prevent clients from connecting to a better scheduler. + ''; + }; + + package = mkOption { + default = pkgs.icecream; + defaultText = "pkgs.icecream"; + type = types.package; + description = "Icecream package to use."; + }; + + extraArgs = mkOption { + type = types.listOf types.str; + default = []; + description = "Additional command line parameters"; + example = [ "-v" ]; + }; + }; + }; + + ###### implementation + + config = mkIf cfg.enable { + networking.firewall.allowedTCPPorts = mkMerge [ + (mkIf cfg.openFirewall [ cfg.port ]) + (mkIf cfg.openTelnet [ 8766 ]) + ]; + + systemd.services.icecc-scheduler = { + description = "Icecream scheduling server"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + ExecStart = escapeShellArgs ([ + "${getBin cfg.package}/bin/icecc-scheduler" + "-p" (toString cfg.port) + ] + ++ optionals (cfg.netName != null) [ "-n" (toString cfg.netName) ] + ++ optional cfg.persistentClientConnection "-r" + ++ cfg.extraArgs); + + DynamicUser = true; + }; + }; + }; + + meta.maintainers = with lib.maintainers; [ emantor ]; +} diff --git a/nixos/modules/services/networking/ircd-hybrid/default.nix b/nixos/modules/services/networking/ircd-hybrid/default.nix index 91d0bf437d693..0781159b6ee73 100644 --- a/nixos/modules/services/networking/ircd-hybrid/default.nix +++ b/nixos/modules/services/networking/ircd-hybrid/default.nix @@ -40,6 +40,7 @@ in serverName = mkOption { default = "hades.arpa"; + type = types.str; description = " IRCD server name. "; @@ -47,6 +48,7 @@ in sid = mkOption { default = "0NL"; + type = types.str; description = " IRCD server unique ID in a net of servers. "; @@ -54,6 +56,7 @@ in description = mkOption { default = "Hybrid-7 IRC server."; + type = types.str; description = " IRCD server description. "; @@ -62,6 +65,7 @@ in rsaKey = mkOption { default = null; example = literalExample "/root/certificates/irc.key"; + type = types.nullOr types.path; description = " IRCD server RSA key. "; @@ -70,6 +74,7 @@ in certificate = mkOption { default = null; example = literalExample "/root/certificates/irc.pem"; + type = types.nullOr types.path; description = " IRCD server SSL certificate. There are some limitations - read manual. "; @@ -77,6 +82,7 @@ in adminEmail = mkOption { default = "<bit-bucket@example.com>"; + type = types.str; example = "<name@domain.tld>"; description = " IRCD server administrator e-mail. @@ -86,6 +92,7 @@ in extraIPs = mkOption { default = []; example = ["127.0.0.1"]; + type = types.listOf types.str; description = " Extra IP's to bind. "; @@ -93,6 +100,7 @@ in extraPort = mkOption { default = "7117"; + type = types.str; description = " Extra port to avoid filtering. "; diff --git a/nixos/modules/services/networking/iwd.nix b/nixos/modules/services/networking/iwd.nix index 6be67a8b96f4d..99e5e78badd28 100644 --- a/nixos/modules/services/networking/iwd.nix +++ b/nixos/modules/services/networking/iwd.nix @@ -22,6 +22,11 @@ in { systemd.packages = [ pkgs.iwd ]; + systemd.network.links."80-iwd" = { + matchConfig.Type = "wlan"; + linkConfig.NamePolicy = "keep kernel"; + }; + systemd.services.iwd.wantedBy = [ "multi-user.target" ]; }; diff --git a/nixos/modules/services/networking/kippo.nix b/nixos/modules/services/networking/kippo.nix index 553415a2f3297..6fedb0a270f4c 100644 --- a/nixos/modules/services/networking/kippo.nix +++ b/nixos/modules/services/networking/kippo.nix @@ -17,37 +17,37 @@ in enable = mkOption { default = false; type = types.bool; - description = ''Enable the kippo honeypot ssh server.''; + description = "Enable the kippo honeypot ssh server."; }; port = mkOption { default = 2222; type = types.int; - description = ''TCP port number for kippo to bind to.''; + description = "TCP port number for kippo to bind to."; }; hostname = mkOption { default = "nas3"; type = types.str; - description = ''Hostname for kippo to present to SSH login''; + description = "Hostname for kippo to present to SSH login"; }; varPath = mkOption { default = "/var/lib/kippo"; type = types.path; - description = ''Path of read/write files needed for operation and configuration.''; + description = "Path of read/write files needed for operation and configuration."; }; logPath = mkOption { default = "/var/log/kippo"; type = types.path; - description = ''Path of log files needed for operation and configuration.''; + description = "Path of log files needed for operation and configuration."; }; pidPath = mkOption { default = "/run/kippo"; type = types.path; - description = ''Path of pid files needed for operation.''; + description = "Path of pid files needed for operation."; }; extraConfig = mkOption { default = ""; type = types.lines; - description = ''Extra verbatim configuration added to the end of kippo.cfg.''; + description = "Extra verbatim configuration added to the end of kippo.cfg."; }; }; diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix index 6f1c4c48b430a..074830fc3521e 100644 --- a/nixos/modules/services/networking/kresd.nix +++ b/nixos/modules/services/networking/kresd.nix @@ -135,6 +135,8 @@ in { CacheDirectory = "knot-resolver"; CacheDirectoryMode = "0770"; }; + # We don't mind running stop phase from wrong version. It seems less racy. + systemd.services."kresd@".stopIfChanged = false; # Try cleaning up the previously default location of cache file. # Note that /var/cache/* should always be safe to remove. diff --git a/nixos/modules/services/networking/mailpile.nix b/nixos/modules/services/networking/mailpile.nix index b79ee11d17db2..4673a2580b602 100644 --- a/nixos/modules/services/networking/mailpile.nix +++ b/nixos/modules/services/networking/mailpile.nix @@ -21,11 +21,13 @@ in enable = mkEnableOption "Mailpile the mail client"; hostname = mkOption { + type = types.str; default = "localhost"; description = "Listen to this hostname or ip."; }; port = mkOption { - default = "33411"; + type = types.port; + default = 33411; description = "Listen on this port."; }; }; diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix index c6e5649ec4798..b03630208df83 100644 --- a/nixos/modules/services/networking/murmur.nix +++ b/nixos/modules/services/networking/murmur.nix @@ -109,6 +109,13 @@ in description = "Host to bind to. Defaults binding on all addresses."; }; + package = mkOption { + type = types.package; + default = pkgs.murmur; + defaultText = "pkgs.murmur"; + description = "Overridable attribute of the murmur package to use."; + }; + password = mkOption { type = types.str; default = ""; @@ -299,7 +306,7 @@ in Type = if forking then "forking" else "simple"; PIDFile = mkIf forking "/run/murmur/murmurd.pid"; EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile; - ExecStart = "${pkgs.murmur}/bin/murmurd -ini /run/murmur/murmurd.ini"; + ExecStart = "${cfg.package}/bin/murmurd -ini /run/murmur/murmurd.ini"; Restart = "always"; RuntimeDirectory = "murmur"; RuntimeDirectoryMode = "0700"; diff --git a/nixos/modules/services/networking/nomad.nix b/nixos/modules/services/networking/nomad.nix new file mode 100644 index 0000000000000..9f1b443b89bc0 --- /dev/null +++ b/nixos/modules/services/networking/nomad.nix @@ -0,0 +1,165 @@ +{ config, lib, pkgs, ... }: +with lib; +let + cfg = config.services.nomad; + format = pkgs.formats.json { }; +in +{ + ##### interface + options = { + services.nomad = { + enable = mkEnableOption "Nomad, a distributed, highly available, datacenter-aware scheduler"; + + package = mkOption { + type = types.package; + default = pkgs.nomad; + defaultText = "pkgs.nomad"; + description = '' + The package used for the Nomad agent and CLI. + ''; + }; + + extraPackages = mkOption { + type = types.listOf types.package; + default = [ ]; + description = '' + Extra packages to add to <envar>PATH</envar> for the Nomad agent process. + ''; + example = literalExample '' + with pkgs; [ cni-plugins ] + ''; + }; + + dropPrivileges = mkOption { + type = types.bool; + default = true; + description = '' + Whether the nomad agent should be run as a non-root nomad user. + ''; + }; + + enableDocker = mkOption { + type = types.bool; + default = true; + description = '' + Enable Docker support. Needed for Nomad's docker driver. + + Note that the docker group membership is effectively equivalent + to being root, see https://github.com/moby/moby/issues/9976. + ''; + }; + + extraSettingsPaths = mkOption { + type = types.listOf types.path; + default = []; + description = '' + Additional settings paths used to configure nomad. These can be files or directories. + ''; + example = literalExample '' + [ "/etc/nomad-mutable.json" "/run/keys/nomad-with-secrets.json" "/etc/nomad/config.d" ] + ''; + }; + + settings = mkOption { + type = format.type; + default = {}; + description = '' + Configuration for Nomad. See the <link xlink:href="https://www.nomadproject.io/docs/configuration">documentation</link> + for supported values. + + Notes about <literal>data_dir</literal>: + + If <literal>data_dir</literal> is set to a value other than the + default value of <literal>"/var/lib/nomad"</literal> it is the Nomad + cluster manager's responsibility to make sure that this directory + exists and has the appropriate permissions. + + Additionally, if <literal>dropPrivileges</literal> is + <literal>true</literal> then <literal>data_dir</literal> + <emphasis>cannot</emphasis> be customized. Setting + <literal>dropPrivileges</literal> to <literal>true</literal> enables + the <literal>DynamicUser</literal> feature of systemd which directly + manages and operates on <literal>StateDirectory</literal>. + ''; + example = literalExample '' + { + # A minimal config example: + server = { + enabled = true; + bootstrap_expect = 1; # for demo; no fault tolerance + }; + client = { + enabled = true; + }; + } + ''; + }; + }; + }; + + ##### implementation + config = mkIf cfg.enable { + services.nomad.settings = { + # Agrees with `StateDirectory = "nomad"` set below. + data_dir = mkDefault "/var/lib/nomad"; + }; + + environment = { + etc."nomad.json".source = format.generate "nomad.json" cfg.settings; + systemPackages = [ cfg.package ]; + }; + + systemd.services.nomad = { + description = "Nomad"; + wantedBy = [ "multi-user.target" ]; + wants = [ "network-online.target" ]; + after = [ "network-online.target" ]; + restartTriggers = [ config.environment.etc."nomad.json".source ]; + + path = cfg.extraPackages ++ (with pkgs; [ + # Client mode requires at least the following: + coreutils + iproute + iptables + ]); + + serviceConfig = mkMerge [ + { + DynamicUser = cfg.dropPrivileges; + ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; + ExecStart = "${cfg.package}/bin/nomad agent -config=/etc/nomad.json" + + concatMapStrings (path: " -config=${path}") cfg.extraSettingsPaths; + KillMode = "process"; + KillSignal = "SIGINT"; + LimitNOFILE = 65536; + LimitNPROC = "infinity"; + OOMScoreAdjust = -1000; + Restart = "on-failure"; + RestartSec = 2; + TasksMax = "infinity"; + } + (mkIf cfg.enableDocker { + SupplementaryGroups = "docker"; # space-separated string + }) + (mkIf (cfg.settings.data_dir == "/var/lib/nomad") { + StateDirectory = "nomad"; + }) + ]; + + unitConfig = { + StartLimitIntervalSec = 10; + StartLimitBurst = 3; + }; + }; + + assertions = [ + { + assertion = cfg.dropPrivileges -> cfg.settings.data_dir == "/var/lib/nomad"; + message = "settings.data_dir must be equal to \"/var/lib/nomad\" if dropPrivileges is true"; + } + ]; + + # Docker support requires the Docker daemon to be running. + virtualisation.docker.enable = mkIf cfg.enableDocker true; + }; +} diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix index e6fa48daf46cd..96c6444c23a12 100644 --- a/nixos/modules/services/networking/ntp/chrony.nix +++ b/nixos/modules/services/networking/ntp/chrony.nix @@ -4,13 +4,14 @@ with lib; let cfg = config.services.chrony; + chronyPkg = cfg.package; - stateDir = "/var/lib/chrony"; + stateDir = cfg.directory; driftFile = "${stateDir}/chrony.drift"; keyFile = "${stateDir}/chrony.keys"; configFile = pkgs.writeText "chrony.conf" '' - ${concatMapStringsSep "\n" (server: "server " + server + " iburst") cfg.servers} + ${concatMapStringsSep "\n" (server: "server " + server + " " + cfg.serverOption + optionalString (cfg.enableNTS) " nts") cfg.servers} ${optionalString (cfg.initstepslew.enabled && (cfg.servers != [])) @@ -19,6 +20,7 @@ let driftfile ${driftFile} keyfile ${keyFile} + ${optionalString (cfg.enableNTS) "ntsdumpdir ${stateDir}"} ${optionalString (!config.time.hardwareClockInLocalTime) "rtconutc"} @@ -39,14 +41,48 @@ in ''; }; + package = mkOption { + type = types.package; + default = pkgs.chrony; + defaultText = "pkgs.chrony"; + description = '' + Which chrony package to use. + ''; + }; + servers = mkOption { default = config.networking.timeServers; + type = types.listOf types.str; description = '' The set of NTP servers from which to synchronise. ''; }; + serverOption = mkOption { + default = "iburst"; + type = types.enum [ "iburst" "offline" ]; + description = '' + Set option for server directives. + + Use "iburst" to rapidly poll on startup. Recommended if your machine + is consistently online. + + Use "offline" to prevent polling on startup. Recommended if your + machine boots offline or is otherwise frequently offline. + ''; + }; + + enableNTS = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable Network Time Security authentication. + Make sure it is supported by your selected NTP server(s). + ''; + }; + initstepslew = mkOption { + type = types.attrsOf (types.either types.bool types.int); default = { enabled = true; threshold = 1000; # by default, same threshold as 'ntpd -g' (1000s) @@ -58,6 +94,12 @@ in ''; }; + directory = mkOption { + type = types.str; + default = "/var/lib/chrony"; + description = "Directory where chrony state is stored."; + }; + extraConfig = mkOption { type = types.lines; default = ""; @@ -79,7 +121,7 @@ in config = mkIf cfg.enable { meta.maintainers = with lib.maintainers; [ thoughtpolice ]; - environment.systemPackages = [ pkgs.chrony ]; + environment.systemPackages = [ chronyPkg ]; users.groups.chrony.gid = config.ids.gids.chrony; @@ -109,12 +151,12 @@ in after = [ "network.target" ]; conflicts = [ "ntpd.service" "systemd-timesyncd.service" ]; - path = [ pkgs.chrony ]; + path = [ chronyPkg ]; unitConfig.ConditionCapability = "CAP_SYS_TIME"; serviceConfig = { Type = "simple"; - ExecStart = "${pkgs.chrony}/bin/chronyd ${chronyFlags}"; + ExecStart = "${chronyPkg}/bin/chronyd ${chronyFlags}"; ProtectHome = "yes"; ProtectSystem = "full"; diff --git a/nixos/modules/services/networking/ntp/ntpd.nix b/nixos/modules/services/networking/ntp/ntpd.nix index 51398851adc6d..861b0db01a489 100644 --- a/nixos/modules/services/networking/ntp/ntpd.nix +++ b/nixos/modules/services/networking/ntp/ntpd.nix @@ -79,6 +79,7 @@ in servers = mkOption { default = config.networking.timeServers; + type = types.listOf types.str; description = '' The set of NTP servers from which to synchronise. ''; diff --git a/nixos/modules/services/networking/owamp.nix b/nixos/modules/services/networking/owamp.nix index 637ed618b8938..baf64347b099d 100644 --- a/nixos/modules/services/networking/owamp.nix +++ b/nixos/modules/services/networking/owamp.nix @@ -10,7 +10,7 @@ in ###### interface options = { - services.owamp.enable = mkEnableOption ''Enable OWAMP server''; + services.owamp.enable = mkEnableOption "Enable OWAMP server"; }; diff --git a/nixos/modules/services/networking/pleroma.nix b/nixos/modules/services/networking/pleroma.nix new file mode 100644 index 0000000000000..9b2bf9f61244c --- /dev/null +++ b/nixos/modules/services/networking/pleroma.nix @@ -0,0 +1,140 @@ +{ config, options, lib, pkgs, stdenv, ... }: +let + cfg = config.services.pleroma; +in { + options = { + services.pleroma = with lib; { + enable = mkEnableOption "pleroma"; + + package = mkOption { + type = types.package; + default = pkgs.pleroma-otp; + description = "Pleroma package to use."; + }; + + user = mkOption { + type = types.str; + default = "pleroma"; + description = "User account under which pleroma runs."; + }; + + group = mkOption { + type = types.str; + default = "pleroma"; + description = "Group account under which pleroma runs."; + }; + + stateDir = mkOption { + type = types.str; + default = "/var/lib/pleroma"; + readOnly = true; + description = "Directory where the pleroma service will save the uploads and static files."; + }; + + configs = mkOption { + type = with types; listOf str; + description = '' + Pleroma public configuration. + + This list gets appended from left to + right into /etc/pleroma/config.exs. Elixir evaluates its + configuration imperatively, meaning you can override a + setting by appending a new str to this NixOS option list. + + <emphasis>DO NOT STORE ANY PLEROMA SECRET + HERE</emphasis>, use + <link linkend="opt-services.pleroma.secretConfigFile">services.pleroma.secretConfigFile</link> + instead. + + This setting is going to be stored in a file part of + the Nix store. The Nix store being world-readable, it's not + the right place to store any secret + + Have a look to Pleroma section in the NixOS manual for more + informations. + ''; + }; + + secretConfigFile = mkOption { + type = types.str; + default = "/var/lib/pleroma/secrets.exs"; + description = '' + Path to the file containing your secret pleroma configuration. + + <emphasis>DO NOT POINT THIS OPTION TO THE NIX + STORE</emphasis>, the store being world-readable, it'll + compromise all your secrets. + ''; + }; + }; + }; + + config = lib.mkIf cfg.enable { + users = { + users."${cfg.user}" = { + description = "Pleroma user"; + home = cfg.stateDir; + extraGroups = [ cfg.group ]; + }; + groups."${cfg.group}" = {}; + }; + + environment.systemPackages = [ cfg.package ]; + + environment.etc."/pleroma/config.exs".text = '' + ${lib.concatMapStrings (x: "${x}") cfg.configs} + + # The lau/tzdata library is trying to download the latest + # timezone database in the OTP priv directory by default. + # This directory being in the store, it's read-only. + # Setting that up to a more appropriate location. + config :tzdata, :data_dir, "/var/lib/pleroma/elixir_tzdata_data" + + import_config "${cfg.secretConfigFile}" + ''; + + systemd.services.pleroma = { + description = "Pleroma social network"; + after = [ "network-online.target" "postgresql.service" ]; + wantedBy = [ "multi-user.target" ]; + restartTriggers = [ config.environment.etc."/pleroma/config.exs".source ]; + serviceConfig = { + User = cfg.user; + Group = cfg.group; + Type = "exec"; + WorkingDirectory = "~"; + StateDirectory = "pleroma pleroma/static pleroma/uploads"; + StateDirectoryMode = "700"; + + # Checking the conf file is there then running the database + # migration before each service start, just in case there are + # some pending ones. + # + # It's sub-optimal as we'll always run this, even if pleroma + # has not been updated. But the no-op process is pretty fast. + # Better be safe than sorry migration-wise. + ExecStartPre = + let preScript = pkgs.writers.writeBashBin "pleromaStartPre" + "${cfg.package}/bin/pleroma_ctl migrate"; + in "${preScript}/bin/pleromaStartPre"; + + ExecStart = "${cfg.package}/bin/pleroma start"; + ExecStop = "${cfg.package}/bin/pleroma stop"; + ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; + + # Systemd sandboxing directives. + # Taken from the upstream contrib systemd service at + # pleroma/installation/pleroma.service + PrivateTmp = true; + ProtectHome = true; + ProtectSystem = "full"; + PrivateDevices = false; + NoNewPrivileges = true; + CapabilityBoundingSet = "~CAP_SYS_ADMIN"; + }; + }; + + }; + meta.maintainers = with lib.maintainers; [ ninjatrappeur ]; + meta.doc = ./pleroma.xml; +} diff --git a/nixos/modules/services/networking/pleroma.xml b/nixos/modules/services/networking/pleroma.xml new file mode 100644 index 0000000000000..9ab0be3d947c8 --- /dev/null +++ b/nixos/modules/services/networking/pleroma.xml @@ -0,0 +1,132 @@ +<chapter xmlns="http://docbook.org/ns/docbook" + xmlns:xlink="http://www.w3.org/1999/xlink" + xmlns:xi="http://www.w3.org/2001/XInclude" + version="5.0" + xml:id="module-services-pleroma"> + <title>Pleroma</title> + <para><link xlink:href="https://pleroma.social/">Pleroma</link> is a lightweight activity pub server.</para> + <section xml:id="module-services-pleroma-getting-started"> + <title>Quick Start</title> + <para>To get quickly started, you can use this sample NixOS configuration and adapt it to your use case.</para> + <para><programlisting> + { + security.acme = { + email = "root@tld"; + acceptTerms = true; + certs = { + "social.tld.com" = { + webroot = "/var/www/social.tld.com"; + email = "root@tld"; + group = "nginx"; + }; + }; + }; + services = { + pleroma = { + enable = true; + secretConfigFile = "/var/lib/pleroma/secrets.exs"; + configs = [ + '' + import Config + + config :pleroma, Pleroma.Web.Endpoint, + url: [host: "social.tld.com", scheme: "https", port: 443], + http: [ip: {127, 0, 0, 1}, port: 4000] + + config :pleroma, :instance, + name: "NixOS test pleroma server", + email: "pleroma@social.tld.com", + notify_email: "pleroma@social.tld.com", + limit: 5000, + registrations_open: true + + config :pleroma, :media_proxy, + enabled: false, + redirect_on_failure: true + #base_url: "https://cache.pleroma.social" + + config :pleroma, Pleroma.Repo, + adapter: Ecto.Adapters.Postgres, + username: "pleroma", + password: "${test-db-passwd}", + database: "pleroma", + hostname: "localhost", + pool_size: 10, + prepare: :named, + parameters: [ + plan_cache_mode: "force_custom_plan" + ] + + config :pleroma, :database, rum_enabled: false + config :pleroma, :instance, static_dir: "/var/lib/pleroma/static" + config :pleroma, Pleroma.Uploaders.Local, uploads: "/var/lib/pleroma/uploads" + config :pleroma, configurable_from_database: false + '' + ]; + }; + postgresql = { + enable = true; + package = pkgs.postgresql_12; + }; + nginx = { + enable = true; + addSSL = true; + sslCertificate = "/var/lib/acme/social.tld.com/fullchain.pem"; + sslCertificateKey = "/var/lib/acme/social.tld.com/key.pem"; + root = "/var/www/social.tld.com"; + # ACME endpoint + locations."/.well-known/acme-challenge" = { + root = "/var/www/social.tld.com/"; + }; + virtualHosts."social.tld.com" = { + addSSL = true; + locations."/" = { + proxyPass = "http://127.0.0.1:4000"; + extraConfig = '' + add_header 'Access-Control-Allow-Origin' '*' always; + add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always; + add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always; + if ($request_method = OPTIONS) { + return 204; + } + add_header X-XSS-Protection "1; mode=block"; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options DENY; + add_header X-Content-Type-Options nosniff; + add_header Referrer-Policy same-origin; + add_header X-Download-Options noopen; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + client_max_body_size 16m; + ''; + }; + }; + }; + }; + }; + </programlisting></para> + <para>Note that you'll need to seed your database and upload your pleroma secrets to the path pointed by <literal>config.pleroma.secretConfigFile</literal>. You can find more informations about how to do that in the <link linkend="module-services-pleroma-generate-config">next</link> section.</para> + </section> + <section xml:id="module-services-pleroma-generate-config"> + <title>Generating the Pleroma Config and Seed the Database</title> + + <para>Before using this service, you'll need to generate your +server configuration and its associated database seed. The +<literal>pleroma_ctl</literal> CLI utility can help you with that. You +can start with <literal>pleroma_ctl instance gen --output config.exs +--output-psql setup.psql</literal>, this will prompt you some +questions and will generate both your config file and database initial +migration. </para> +<para>For more details about this configuration format, please have a look at the <link xlink:href="https://docs-develop.pleroma.social/backend/configuration/cheatsheet/">upstream documentation</link>.</para> +<para>To seed your database, you can use the <literal>setup.psql</literal> file you just generated by running +<programlisting> + sudo -u postgres psql -f setup.psql +</programlisting></para> + <para>In regard of the pleroma service configuration you also just generated, you'll need to split it in two parts. The "public" part, which do not contain any secrets and thus can be safely stored in the Nix store and its "private" counterpart containing some secrets (database password, endpoint secret key, salts, etc.).</para> + + <para>The public part will live in your NixOS machine configuration in the <link linkend="opt-services.pleroma.configs">services.pleroma.configs</link> option. However, it's up to you to upload the secret pleroma configuration to the path pointed by <link linkend="opt-services.pleroma.secretConfigFile">services.pleroma.secretConfigFile</link>. You can do that manually or rely on a third party tool such as <link xlink:href="https://github.com/DBCDK/morph">Morph</link> or <link xlink:href="https://github.com/NixOS/nixops">NixOps</link>.</para> + </section> +</chapter> diff --git a/nixos/modules/services/networking/prayer.nix b/nixos/modules/services/networking/prayer.nix index f04dac01d9b8e..ae9258b27122f 100644 --- a/nixos/modules/services/networking/prayer.nix +++ b/nixos/modules/services/networking/prayer.nix @@ -44,7 +44,8 @@ in enable = mkEnableOption "the prayer webmail http server"; port = mkOption { - default = "2080"; + default = 2080; + type = types.port; description = '' Port the prayer http server is listening to. ''; diff --git a/nixos/modules/services/networking/privoxy.nix b/nixos/modules/services/networking/privoxy.nix index 1f41c720adf58..7caae3282032c 100644 --- a/nixos/modules/services/networking/privoxy.nix +++ b/nixos/modules/services/networking/privoxy.nix @@ -8,15 +8,22 @@ let cfg = config.services.privoxy; - confFile = pkgs.writeText "privoxy.conf" '' + confFile = pkgs.writeText "privoxy.conf" ('' user-manual ${privoxy}/share/doc/privoxy/user-manual confdir ${privoxy}/etc/ listen-address ${cfg.listenAddress} enable-edit-actions ${if (cfg.enableEditActions == true) then "1" else "0"} ${concatMapStrings (f: "actionsfile ${f}\n") cfg.actionsFiles} ${concatMapStrings (f: "filterfile ${f}\n") cfg.filterFiles} + '' + optionalString cfg.enableTor '' + forward-socks5t / 127.0.0.1:9063 . + toggle 1 + enable-remote-toggle 0 + enable-edit-actions 0 + enable-remote-http-toggle 0 + '' + '' ${cfg.extraConfig} - ''; + ''); in @@ -72,6 +79,15 @@ in ''; }; + enableTor = mkOption { + type = types.bool; + default = false; + description = '' + Whether to configure Privoxy to use Tor's faster SOCKS port, + suitable for HTTP. + ''; + }; + extraConfig = mkOption { type = types.lines; default = "" ; @@ -107,6 +123,11 @@ in serviceConfig.ProtectSystem = "full"; }; + services.tor.settings.SOCKSPort = mkIf cfg.enableTor [ + # Route HTTP traffic over a faster port (without IsolateDestAddr). + { addr = "127.0.0.1"; port = 9063; IsolateDestAddr = false; } + ]; + }; meta.maintainers = with lib.maintainers; [ rnhmjoj ]; diff --git a/nixos/modules/services/networking/quassel.nix b/nixos/modules/services/networking/quassel.nix index da723ec86adf6..bfbd3b46ab4d9 100644 --- a/nixos/modules/services/networking/quassel.nix +++ b/nixos/modules/services/networking/quassel.nix @@ -45,6 +45,7 @@ in }; interfaces = mkOption { + type = types.listOf types.str; default = [ "127.0.0.1" ]; description = '' The interfaces the Quassel daemon will be listening to. If `[ 127.0.0.1 ]', @@ -54,6 +55,7 @@ in }; portNumber = mkOption { + type = types.port; default = 4242; description = '' The port number the Quassel daemon will be listening to. @@ -61,7 +63,8 @@ in }; dataDir = mkOption { - default = ''/home/${user}/.config/quassel-irc.org''; + default = "/home/${user}/.config/quassel-irc.org"; + type = types.str; description = '' The directory holding configuration files, the SQlite database and the SSL Cert. ''; @@ -69,6 +72,7 @@ in user = mkOption { default = null; + type = types.nullOr types.str; description = '' The existing user the Quassel daemon should run as. If left empty, a default "quassel" user will be created. ''; diff --git a/nixos/modules/services/networking/radvd.nix b/nixos/modules/services/networking/radvd.nix index f4b00c9b356ef..53fac4b7b72dc 100644 --- a/nixos/modules/services/networking/radvd.nix +++ b/nixos/modules/services/networking/radvd.nix @@ -33,6 +33,7 @@ in }; services.radvd.config = mkOption { + type = types.lines; example = '' interface eth0 { diff --git a/nixos/modules/services/networking/resilio.nix b/nixos/modules/services/networking/resilio.nix index 6193d7340fc4a..4701b0e8143d2 100644 --- a/nixos/modules/services/networking/resilio.nix +++ b/nixos/modules/services/networking/resilio.nix @@ -183,6 +183,7 @@ in sharedFolders = mkOption { default = []; + type = types.listOf (types.attrsOf types.anything); example = [ { secret = "AHMYFPCQAHBM7LQPFXQ7WV6Y42IGUXJ5Y"; directory = "/home/user/sync_test"; diff --git a/nixos/modules/services/networking/sabnzbd.nix b/nixos/modules/services/networking/sabnzbd.nix index ff5aef7d1cb47..43566dfd25c5f 100644 --- a/nixos/modules/services/networking/sabnzbd.nix +++ b/nixos/modules/services/networking/sabnzbd.nix @@ -18,16 +18,19 @@ in enable = mkEnableOption "the sabnzbd server"; configFile = mkOption { + type = types.path; default = "/var/lib/sabnzbd/sabnzbd.ini"; description = "Path to config file."; }; user = mkOption { default = "sabnzbd"; + type = types.str; description = "User to run the service as"; }; group = mkOption { + type = types.str; default = "sabnzbd"; description = "Group to run the service as"; }; diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix index 60fb3d5d6d443..a515e4a3dc3ba 100644 --- a/nixos/modules/services/networking/searx.nix +++ b/nixos/modules/services/networking/searx.nix @@ -1,34 +1,114 @@ -{ config, lib, pkgs, ... }: +{ options, config, lib, pkgs, ... }: with lib; let - + runDir = "/run/searx"; cfg = config.services.searx; - configFile = cfg.configFile; + generateConfig = '' + cd ${runDir} + + # write NixOS settings as JSON + cat <<'EOF' > settings.yml + ${builtins.toJSON cfg.settings} + EOF + + # substitute environment variables + env -0 | while IFS='=' read -r -d ''' n v; do + sed "s#@$n@#$v#g" -i settings.yml + done + + # set strict permissions + chmod 400 settings.yml + ''; + + settingType = with types; (oneOf + [ bool int float str + (listOf settingType) + (attrsOf settingType) + ]) // { description = "JSON value"; }; in { + imports = [ + (mkRenamedOptionModule + [ "services" "searx" "configFile" ] + [ "services" "searx" "settingsFile" ]) + ]; + ###### interface options = { services.searx = { - enable = mkEnableOption - "the searx server. See https://github.com/asciimoo/searx"; + enable = mkOption { + type = types.bool; + default = false; + relatedPackages = [ "searx" ]; + description = "Whether to enable Searx, the meta search engine."; + }; - configFile = mkOption { + environmentFile = mkOption { type = types.nullOr types.path; default = null; - description = " - The path of the Searx server configuration file. If no file - is specified, a default file is used (default config file has - debug mode enabled). - "; + description = '' + Environment file (see <literal>systemd.exec(5)</literal> + "EnvironmentFile=" section for the syntax) to define variables for + Searx. This option can be used to safely include secret keys into the + Searx configuration. + ''; + }; + + settings = mkOption { + type = types.attrsOf settingType; + default = { }; + example = literalExample '' + { server.port = 8080; + server.bind_address = "0.0.0.0"; + server.secret_key = "@SEARX_SECRET_KEY@"; + + engines = lib.singleton + { name = "wolframalpha"; + shortcut = "wa"; + api_key = "@WOLFRAM_API_KEY@"; + engine = "wolframalpha_api"; + }; + } + ''; + description = '' + Searx settings. These will be merged with (taking precedence over) + the default configuration. It's also possible to refer to + environment variables + (defined in <xref linkend="opt-services.searx.environmentFile"/>) + using the syntax <literal>@VARIABLE_NAME@</literal>. + <note> + <para> + For available settings, see the Searx + <link xlink:href="https://searx.github.io/searx/admin/settings.html">docs</link>. + </para> + </note> + ''; + }; + + settingsFile = mkOption { + type = types.path; + default = "${runDir}/settings.yml"; + description = '' + The path of the Searx server settings.yml file. If no file is + specified, a default file is used (default config file has debug mode + enabled). Note: setting this options overrides + <xref linkend="opt-services.searx.settings"/>. + <warning> + <para> + This file, along with any secret key it contains, will be copied + into the world-readable Nix store. + </para> + </warning> + ''; }; package = mkOption { @@ -38,6 +118,38 @@ in description = "searx package to use."; }; + runInUwsgi = mkOption { + type = types.bool; + default = false; + description = '' + Whether to run searx in uWSGI as a "vassal", instead of using its + built-in HTTP server. This is the recommended mode for public or + large instances, but is unecessary for LAN or local-only use. + <warning> + <para> + The built-in HTTP server logs all queries by default. + </para> + </warning> + ''; + }; + + uwsgiConfig = mkOption { + type = options.services.uwsgi.instance.type; + default = { http = ":8080"; }; + example = literalExample '' + { + disable-logging = true; + http = ":8080"; # serve via HTTP... + socket = "/run/searx/searx.sock"; # ...or UNIX socket + } + ''; + description = '' + Additional configuration of the uWSGI vassal running searx. It + should notably specify on which interfaces and ports the vassal + should listen. + ''; + }; + }; }; @@ -45,36 +157,74 @@ in ###### implementation - config = mkIf config.services.searx.enable { + config = mkIf cfg.enable { + environment.systemPackages = [ cfg.package ]; users.users.searx = - { uid = config.ids.uids.searx; - description = "Searx user"; - createHome = true; - home = "/var/lib/searx"; + { description = "Searx daemon user"; + group = "searx"; + isSystemUser = true; }; - users.groups.searx = - { gid = config.ids.gids.searx; + users.groups.searx = { }; + + systemd.services.searx-init = { + description = "Initialise Searx settings"; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + User = "searx"; + RuntimeDirectory = "searx"; + RuntimeDirectoryMode = "750"; + } // optionalAttrs (cfg.environmentFile != null) + { EnvironmentFile = builtins.toPath cfg.environmentFile; }; + script = generateConfig; + }; + + systemd.services.searx = mkIf (!cfg.runInUwsgi) { + description = "Searx server, the meta search engine."; + wantedBy = [ "network.target" "multi-user.target" ]; + requires = [ "searx-init.service" ]; + after = [ "searx-init.service" ]; + serviceConfig = { + User = "searx"; + Group = "searx"; + ExecStart = "${cfg.package}/bin/searx-run"; + } // optionalAttrs (cfg.environmentFile != null) + { EnvironmentFile = builtins.toPath cfg.environmentFile; }; + environment.SEARX_SETTINGS_PATH = cfg.settingsFile; + }; + + systemd.services.uwsgi = mkIf (cfg.runInUwsgi) + { requires = [ "searx-init.service" ]; + after = [ "searx-init.service" ]; }; - systemd.services.searx = - { - description = "Searx server, the meta search engine."; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - serviceConfig = { - User = "searx"; - ExecStart = "${cfg.package}/bin/searx-run"; - }; - } // (optionalAttrs (configFile != null) { - environment.SEARX_SETTINGS_PATH = configFile; - }); + services.searx.settings = { + # merge NixOS settings with defaults settings.yml + use_default_settings = mkDefault true; + }; - environment.systemPackages = [ cfg.package ]; + services.uwsgi = mkIf (cfg.runInUwsgi) { + enable = true; + plugins = [ "python3" ]; + + instance.type = "emperor"; + instance.vassals.searx = { + type = "normal"; + strict = true; + immediate-uid = "searx"; + immediate-gid = "searx"; + lazy-apps = true; + enable-threads = true; + module = "searx.webapp"; + env = [ "SEARX_SETTINGS_PATH=${cfg.settingsFile}" ]; + pythonPackages = self: [ cfg.package ]; + } // cfg.uwsgiConfig; + }; }; - meta.maintainers = with lib.maintainers; [ rnhmjoj ]; + meta.maintainers = with maintainers; [ rnhmjoj ]; } diff --git a/nixos/modules/services/networking/shairport-sync.nix b/nixos/modules/services/networking/shairport-sync.nix index b4b86a2d55bee..ac526c0e9f6f4 100644 --- a/nixos/modules/services/networking/shairport-sync.nix +++ b/nixos/modules/services/networking/shairport-sync.nix @@ -28,6 +28,7 @@ in }; arguments = mkOption { + type = types.str; default = "-v -o pa"; description = '' Arguments to pass to the daemon. Defaults to a local pulseaudio @@ -36,6 +37,7 @@ in }; user = mkOption { + type = types.str; default = "shairport"; description = '' User account name under which to run shairport-sync. The account diff --git a/nixos/modules/services/networking/shellhub-agent.nix b/nixos/modules/services/networking/shellhub-agent.nix new file mode 100644 index 0000000000000..4ce4b8250bc3c --- /dev/null +++ b/nixos/modules/services/networking/shellhub-agent.nix @@ -0,0 +1,91 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.services.shellhub-agent; +in { + + ###### interface + + options = { + + services.shellhub-agent = { + + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable the ShellHub Agent daemon, which allows + secure remote logins. + ''; + }; + + package = mkOption { + type = types.package; + default = pkgs.shellhub-agent; + defaultText = "pkgs.shellhub-agent"; + description = '' + Which ShellHub Agent package to use. + ''; + }; + + tenantId = mkOption { + type = types.str; + example = "ba0a880c-2ada-11eb-a35e-17266ef329d6"; + description = '' + The tenant ID to use when connecting to the ShellHub + Gateway. + ''; + }; + + server = mkOption { + type = types.str; + default = "https://cloud.shellhub.io"; + description = '' + Server address of ShellHub Gateway to connect. + ''; + }; + + privateKey = mkOption { + type = types.path; + default = "/var/lib/shellhub-agent/private.key"; + description = '' + Location where to store the ShellHub Agent private + key. + ''; + }; + }; + }; + + ###### implementation + + config = mkIf cfg.enable { + + systemd.services.shellhub-agent = { + description = "ShellHub Agent"; + + wantedBy = [ "multi-user.target" ]; + requires = [ "local-fs.target" ]; + wants = [ "network-online.target" ]; + after = [ + "local-fs.target" + "network.target" + "network-online.target" + "time-sync.target" + ]; + + environment.SERVER_ADDRESS = cfg.server; + environment.PRIVATE_KEY = cfg.privateKey; + environment.TENANT_ID = cfg.tenantId; + + serviceConfig = { + # The service starts sessions for different users. + User = "root"; + Restart = "on-failure"; + ExecStart = "${cfg.package}/bin/agent"; + }; + }; + + environment.systemPackages = [ cfg.package ]; + }; +} diff --git a/nixos/modules/services/networking/smokeping.nix b/nixos/modules/services/networking/smokeping.nix index 37ee2a8038908..4470c18fd5330 100644 --- a/nixos/modules/services/networking/smokeping.nix +++ b/nixos/modules/services/networking/smokeping.nix @@ -124,7 +124,8 @@ in }; hostName = mkOption { type = types.str; - default = config.networking.hostName; + default = config.networking.fqdn; + defaultText = "\${config.networking.fqdn}"; example = "somewhere.example.com"; description = "DNS name for the urls generated in the cgi."; }; @@ -156,6 +157,7 @@ in ownerEmail = mkOption { type = types.str; default = "no-reply@${cfg.hostName}"; + defaultText = "no-reply@\${hostName}"; example = "no-reply@yourdomain.com"; description = "Email contact for owner"; }; @@ -239,18 +241,18 @@ in targetConfig = mkOption { type = types.lines; default = '' - probe = FPing - menu = Top - title = Network Latency Grapher - remark = Welcome to the SmokePing website of xxx Company. \ - Here you will learn all about the latency of our network. - + Local - menu = Local - title = Local Network - ++ LocalMachine - menu = Local Machine - title = This host - host = localhost + probe = FPing + menu = Top + title = Network Latency Grapher + remark = Welcome to the SmokePing website of xxx Company. \ + Here you will learn all about the latency of our network. + + Local + menu = Local + title = Local Network + ++ LocalMachine + menu = Local Machine + title = This host + host = localhost ''; description = "Target configuration"; }; @@ -303,7 +305,7 @@ in ${cfg.package}/bin/smokeping --check --config=${configPath} ${cfg.package}/bin/smokeping --static --config=${configPath} ''; - script = ''${cfg.package}/bin/smokeping --config=${configPath} --nodaemon''; + script = "${cfg.package}/bin/smokeping --config=${configPath} --nodaemon"; }; systemd.services.thttpd = mkIf cfg.webService { wantedBy = [ "multi-user.target"]; diff --git a/nixos/modules/services/networking/ssh/lshd.nix b/nixos/modules/services/networking/ssh/lshd.nix index 41d0584080e48..862ff7df05407 100644 --- a/nixos/modules/services/networking/ssh/lshd.nix +++ b/nixos/modules/services/networking/ssh/lshd.nix @@ -29,6 +29,7 @@ in portNumber = mkOption { default = 22; + type = types.port; description = '' The port on which to listen for connections. ''; @@ -36,6 +37,7 @@ in interfaces = mkOption { default = []; + type = types.listOf types.str; description = '' List of network interfaces where listening for connections. When providing the empty list, `[]', lshd listens on all @@ -46,6 +48,7 @@ in hostKey = mkOption { default = "/etc/lsh/host-key"; + type = types.str; description = '' Path to the server's private key. Note that this key must have been created, e.g., using "lsh-keygen --server | @@ -56,29 +59,30 @@ in syslog = mkOption { type = types.bool; default = true; - description = ''Whether to enable syslog output.''; + description = "Whether to enable syslog output."; }; passwordAuthentication = mkOption { type = types.bool; default = true; - description = ''Whether to enable password authentication.''; + description = "Whether to enable password authentication."; }; publicKeyAuthentication = mkOption { type = types.bool; default = true; - description = ''Whether to enable public key authentication.''; + description = "Whether to enable public key authentication."; }; rootLogin = mkOption { type = types.bool; default = false; - description = ''Whether to enable remote root login.''; + description = "Whether to enable remote root login."; }; loginShell = mkOption { default = null; + type = types.nullOr types.str; description = '' If non-null, override the default login shell with the specified value. @@ -88,6 +92,7 @@ in srpKeyExchange = mkOption { default = false; + type = types.bool; description = '' Whether to enable SRP key exchange and user authentication. ''; @@ -96,16 +101,17 @@ in tcpForwarding = mkOption { type = types.bool; default = true; - description = ''Whether to enable TCP/IP forwarding.''; + description = "Whether to enable TCP/IP forwarding."; }; x11Forwarding = mkOption { type = types.bool; default = true; - description = ''Whether to enable X11 forwarding.''; + description = "Whether to enable X11 forwarding."; }; subsystems = mkOption { + type = types.listOf types.path; description = '' List of subsystem-path pairs, where the head of the pair denotes the subsystem name, and the tail denotes the path to diff --git a/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix b/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix index 1d1e0bd1ca19a..8ae62931a8f90 100644 --- a/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix +++ b/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix @@ -1273,7 +1273,7 @@ in { provided the user is prompted during an interactive <literal>--load-creds</literal> call. ''; - } ''Definition for a private key that's stored on a token/smartcard/TPM.''; + } "Definition for a private key that's stored on a token/smartcard/TPM."; }; diff --git a/nixos/modules/services/networking/supybot.nix b/nixos/modules/services/networking/supybot.nix index 7a62e04ec7c4b..332c3ced06f07 100644 --- a/nixos/modules/services/networking/supybot.nix +++ b/nixos/modules/services/networking/supybot.nix @@ -64,13 +64,14 @@ in }; extraPackages = mkOption { + type = types.functionTo (types.listOf types.package); default = p: []; description = '' Extra Python packages available to supybot plugins. The value must be a function which receives the attrset defined in <varname>python3Packages</varname> as the sole argument. ''; - example = literalExample ''p: [ p.lxml p.requests ]''; + example = literalExample "p: [ p.lxml p.requests ]"; }; }; diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix index 725bd9bf9403b..b6afd83a9abd8 100644 --- a/nixos/modules/services/networking/tinc.nix +++ b/nixos/modules/services/networking/tinc.nix @@ -1,13 +1,156 @@ { config, lib, pkgs, ... }: with lib; - let - cfg = config.services.tinc; -in + mkValueString = value: + if value == true then "yes" + else if value == false then "no" + else generators.mkValueStringDefault { } value; + + toTincConf = generators.toKeyValue { + listsAsDuplicateKeys = true; + mkKeyValue = generators.mkKeyValueDefault { inherit mkValueString; } "="; + }; + + tincConfType = with types; + let + valueType = oneOf [ bool str int ]; + in + attrsOf (either valueType (listOf valueType)); + + addressSubmodule = { + options = { + address = mkOption { + type = types.str; + description = "The external IP address or hostname where the host can be reached."; + }; + + port = mkOption { + type = types.nullOr types.port; + default = null; + description = '' + The port where the host can be reached. + + If no port is specified, the default Port is used. + ''; + }; + }; + }; + + subnetSubmodule = { + options = { + address = mkOption { + type = types.str; + description = '' + The subnet of this host. + + Subnets can either be single MAC, IPv4 or IPv6 addresses, in which case + a subnet consisting of only that single address is assumed, or they can + be a IPv4 or IPv6 network address with a prefix length. + + IPv4 subnets are notated like 192.168.1.0/24, IPv6 subnets are notated + like fec0:0:0:1::/64. MAC addresses are notated like 0:1a:2b:3c:4d:5e. + + Note that subnets like 192.168.1.1/24 are invalid. + ''; + }; + + prefixLength = mkOption { + type = with types; nullOr (addCheck int (n: n >= 0 && n <= 128)); + default = null; + description = '' + The prefix length of the subnet. + + If null, a subnet consisting of only that single address is assumed. + + This conforms to standard CIDR notation as described in RFC1519. + ''; + }; + + weight = mkOption { + type = types.ints.unsigned; + default = 10; + description = '' + Indicates the priority over identical Subnets owned by different nodes. + + Lower values indicate higher priority. Packets will be sent to the + node with the highest priority, unless that node is not reachable, in + which case the node with the next highest priority will be tried, and + so on. + ''; + }; + }; + }; + + hostSubmodule = { config, ... }: { + options = { + addresses = mkOption { + type = types.listOf (types.submodule addressSubmodule); + default = [ ]; + description = '' + The external address where the host can be reached. This will set this + host's <option>settings.Address</option> option. + + This variable is only required if you want to connect to this host. + ''; + }; + + subnets = mkOption { + type = types.listOf (types.submodule subnetSubmodule); + default = [ ]; + description = '' + The subnets which this tinc daemon will serve. This will set this + host's <option>settings.Subnet</option> option. + Tinc tries to look up which other daemon it should send a packet to by + searching the appropriate subnet. If the packet matches a subnet, it + will be sent to the daemon who has this subnet in his host + configuration file. + ''; + }; + + rsaPublicKey = mkOption { + type = types.str; + default = ""; + description = '' + Legacy RSA public key of the host in PEM format, including start and + end markers. + + This will be appended as-is in the host's configuration file. + + The ed25519 public key can be specified using the + <option>settings.Ed25519PublicKey</option> option instead. + ''; + }; + + settings = mkOption { + default = { }; + type = types.submodule { freeformType = tincConfType; }; + description = '' + Configuration for this host. + + See <link xlink:href="https://tinc-vpn.org/documentation-1.1/Host-configuration-variables.html"/> + for supported values. + ''; + }; + }; + + config.settings = { + Address = mkDefault (map + (address: "${address.address} ${toString address.port}") + config.addresses); + + Subnet = mkDefault (map + (subnet: + if subnet.prefixLength == null then "${subnet.address}#${toString subnet.weight}" + else "${subnet.address}/${toString subnet.prefixLength}#${toString subnet.weight}") + config.subnets); + }; + }; + +in { ###### interface @@ -18,7 +161,7 @@ in networks = mkOption { default = { }; - type = with types; attrsOf (submodule { + type = with types; attrsOf (submodule ({ config, ... }: { options = { extraConfig = mkOption { @@ -26,6 +169,9 @@ in type = types.lines; description = '' Extra lines to add to the tinc service configuration file. + + Note that using the declarative <option>service.tinc.networks.<name>.settings</option> + option is preferred. ''; }; @@ -72,6 +218,40 @@ in description = '' The name of the host in the network as well as the configuration for that host. This name should only contain alphanumerics and underscores. + + Note that using the declarative <option>service.tinc.networks.<name>.hostSettings</option> + option is preferred. + ''; + }; + + hostSettings = mkOption { + default = { }; + example = literalExample '' + { + host1 = { + addresses = [ + { address = "192.168.1.42"; } + { address = "192.168.1.42"; port = 1655; } + ]; + subnets = [ { address = "10.0.0.42"; } ]; + rsaPublicKey = "..."; + settings = { + Ed25519PublicKey = "..."; + }; + }; + host2 = { + subnets = [ { address = "10.0.1.0"; prefixLength = 24; weight = 2; } ]; + rsaPublicKey = "..."; + settings = { + Compression = 10; + }; + }; + } + ''; + type = types.attrsOf (types.submodule hostSubmodule); + description = '' + The name of the host in the network as well as the configuration for that host. + This name should only contain alphanumerics and underscores. ''; }; @@ -79,7 +259,7 @@ in default = "tun"; type = types.enum [ "tun" "tap" ]; description = '' - The type of virtual interface used for the network connection + The type of virtual interface used for the network connection. ''; }; @@ -118,8 +298,44 @@ in Note that tinc can't run scripts anymore (such as tinc-down or host-up), unless it is setup to be runnable inside chroot environment. ''; }; + + settings = mkOption { + default = { }; + type = types.submodule { freeformType = tincConfType; }; + example = literalExample '' + { + Interface = "custom.interface"; + DirectOnly = true; + Mode = "switch"; + } + ''; + description = '' + Configuration of the Tinc daemon for this network. + + See <link xlink:href="https://tinc-vpn.org/documentation-1.1/Main-configuration-variables.html"/> + for supported values. + ''; + }; + }; + + config = { + hosts = mapAttrs + (hostname: host: '' + ${toTincConf host.settings} + ${host.rsaPublicKey} + '') + config.hostSettings; + + settings = { + DeviceType = mkDefault config.interfaceType; + Name = mkDefault (if config.name == null then "$HOST" else config.name); + Ed25519PrivateKeyFile = mkIf (config.ed25519PrivateKeyFile != null) (mkDefault config.ed25519PrivateKeyFile); + PrivateKeyFile = mkIf (config.rsaPrivateKeyFile != null) (mkDefault config.rsaPrivateKeyFile); + ListenAddress = mkIf (config.listenAddress != null) (mkDefault config.listenAddress); + BindToAddress = mkIf (config.bindToAddress != null) (mkDefault config.bindToAddress); + }; }; - }); + })); description = '' Defines the tinc networks which will be started. @@ -144,13 +360,7 @@ in "tinc/${network}/tinc.conf" = { mode = "0444"; text = '' - Name = ${if data.name == null then "$HOST" else data.name} - DeviceType = ${data.interfaceType} - ${optionalString (data.ed25519PrivateKeyFile != null) "Ed25519PrivateKeyFile = ${data.ed25519PrivateKeyFile}"} - ${optionalString (data.rsaPrivateKeyFile != null) "PrivateKeyFile = ${data.rsaPrivateKeyFile}"} - ${optionalString (data.listenAddress != null) "ListenAddress = ${data.listenAddress}"} - ${optionalString (data.bindToAddress != null) "BindToAddress = ${data.bindToAddress}"} - Interface = tinc.${network} + ${toTincConf ({ Interface = "tinc.${network}"; } // data.settings)} ${data.extraConfig} ''; }; @@ -168,6 +378,7 @@ in Type = "simple"; Restart = "always"; RestartSec = "3"; + ExecReload = mkIf (versionAtLeast (getVersion data.package) "1.1pre") "${data.package}/bin/tinc -n ${network} reload"; ExecStart = "${data.package}/bin/tincd -D -U tinc.${network} -n ${network} ${optionalString (data.chroot) "-R"} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}"; }; preStart = '' @@ -221,4 +432,5 @@ in }; + meta.maintainers = with maintainers; [ minijackson ]; } diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index 9a46fa3075fa1..622c3d8ea434f 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -195,7 +195,7 @@ in RuntimeDirectory = "unbound"; ConfigurationDirectory = "unbound"; StateDirectory = "unbound"; - RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_NETLINK" "AF_UNIX" ]; RestrictRealtime = true; SystemCallArchitectures = "native"; SystemCallFilter = [ diff --git a/nixos/modules/services/networking/wakeonlan.nix b/nixos/modules/services/networking/wakeonlan.nix index ebfba263cd8f8..35ff67937fc7d 100644 --- a/nixos/modules/services/networking/wakeonlan.nix +++ b/nixos/modules/services/networking/wakeonlan.nix @@ -51,6 +51,6 @@ in ###### implementation - config.powerManagement.powerDownCommands = lines; + config.powerManagement.powerUpCommands = lines; } diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix index 395139879036a..61482596763a6 100644 --- a/nixos/modules/services/networking/wpa_supplicant.nix +++ b/nixos/modules/services/networking/wpa_supplicant.nix @@ -14,8 +14,8 @@ let then ''"${psk}"'' else pskRaw; baseAuth = if key != null - then ''psk=${key}'' - else ''key_mgmt=NONE''; + then "psk=${key}" + else "key_mgmt=NONE"; in '' network={ ssid="${ssid}" diff --git a/nixos/modules/services/search/elasticsearch-curator.nix b/nixos/modules/services/search/elasticsearch-curator.nix index 9620c3e0b6d49..bb2612322bbad 100644 --- a/nixos/modules/services/search/elasticsearch-curator.nix +++ b/nixos/modules/services/search/elasticsearch-curator.nix @@ -55,6 +55,7 @@ in { }; actionYAML = mkOption { description = "curator action.yaml file contents, alternatively use curator-cli which takes a simple action command"; + type = types.lines; example = '' --- actions: diff --git a/nixos/modules/services/security/fprintd.nix b/nixos/modules/services/security/fprintd.nix index cbac4ef05b8d3..48f8a9616c3ed 100644 --- a/nixos/modules/services/security/fprintd.nix +++ b/nixos/modules/services/security/fprintd.nix @@ -43,9 +43,9 @@ in config = mkIf cfg.enable { - services.dbus.packages = [ pkgs.fprintd ]; + services.dbus.packages = [ cfg.package ]; - environment.systemPackages = [ pkgs.fprintd ]; + environment.systemPackages = [ cfg.package ]; systemd.packages = [ cfg.package ]; diff --git a/nixos/modules/services/security/fprot.nix b/nixos/modules/services/security/fprot.nix index 3a0b08b3c6d83..df60d553e85bd 100644 --- a/nixos/modules/services/security/fprot.nix +++ b/nixos/modules/services/security/fprot.nix @@ -16,16 +16,19 @@ in { description = '' product.data file. Defaults to the one supplied with installation package. ''; + type = types.path; }; frequency = mkOption { default = 30; + type = types.int; description = '' Update virus definitions every X minutes. ''; }; licenseKeyfile = mkOption { + type = types.path; description = '' License keyfile. Defaults to the one supplied with installation package. ''; diff --git a/nixos/modules/services/security/oauth2_proxy.nix b/nixos/modules/services/security/oauth2_proxy.nix index 486f3ab05386d..77c579279abe5 100644 --- a/nixos/modules/services/security/oauth2_proxy.nix +++ b/nixos/modules/services/security/oauth2_proxy.nix @@ -538,6 +538,7 @@ in extraConfig = mkOption { default = {}; + type = types.attrsOf types.anything; description = '' Extra config to pass to oauth2-proxy. ''; diff --git a/nixos/modules/services/security/sshguard.nix b/nixos/modules/services/security/sshguard.nix index e7a9cefdef30a..72de11a9254cd 100644 --- a/nixos/modules/services/security/sshguard.nix +++ b/nixos/modules/services/security/sshguard.nix @@ -119,15 +119,17 @@ in { # firewall rules before sshguard starts. preStart = optionalString config.networking.firewall.enable '' ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard4 hash:net family inet - ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:net family inet6 ${pkgs.iptables}/bin/iptables -I INPUT -m set --match-set sshguard4 src -j DROP + '' + optionalString (config.networking.firewall.enable && config.networking.enableIPv6) '' + ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:net family inet6 ${pkgs.iptables}/bin/ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP ''; postStop = optionalString config.networking.firewall.enable '' ${pkgs.iptables}/bin/iptables -D INPUT -m set --match-set sshguard4 src -j DROP - ${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP ${pkgs.ipset}/bin/ipset -quiet destroy sshguard4 + '' + optionalString (config.networking.firewall.enable && config.networking.enableIPv6) '' + ${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP ${pkgs.ipset}/bin/ipset -quiet destroy sshguard6 ''; diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix index 38dc378887a83..54c2c2dea23af 100644 --- a/nixos/modules/services/security/tor.nix +++ b/nixos/modules/services/security/tor.nix @@ -1,311 +1,300 @@ { config, lib, pkgs, ... }: +with builtins; with lib; let cfg = config.services.tor; - torDirectory = "/var/lib/tor"; - torRunDirectory = "/run/tor"; - - opt = name: value: optionalString (value != null) "${name} ${value}"; - optint = name: value: optionalString (value != null && value != 0) "${name} ${toString value}"; - - isolationOptions = { - type = types.listOf (types.enum [ - "IsolateClientAddr" - "IsolateSOCKSAuth" - "IsolateClientProtocol" - "IsolateDestPort" - "IsolateDestAddr" + stateDir = "/var/lib/tor"; + runDir = "/run/tor"; + descriptionGeneric = option: '' + See <link xlink:href="https://2019.www.torproject.org/docs/tor-manual.html.en#${option}">torrc manual</link>. + ''; + bindsPrivilegedPort = + any (p0: + let p1 = if p0 ? "port" then p0.port else p0; in + if p1 == "auto" then false + else let p2 = if isInt p1 then p1 else toInt p1; in + p1 != null && 0 < p2 && p2 < 1024) + (flatten [ + cfg.settings.ORPort + cfg.settings.DirPort + cfg.settings.DNSPort + cfg.settings.ExtORPort + cfg.settings.HTTPTunnelPort + cfg.settings.NATDPort + cfg.settings.SOCKSPort + cfg.settings.TransPort ]); + optionBool = optionName: mkOption { + type = with types; nullOr bool; + default = null; + description = descriptionGeneric optionName; + }; + optionInt = optionName: mkOption { + type = with types; nullOr int; + default = null; + description = descriptionGeneric optionName; + }; + optionString = optionName: mkOption { + type = with types; nullOr str; + default = null; + description = descriptionGeneric optionName; + }; + optionStrings = optionName: mkOption { + type = with types; listOf str; + default = []; + description = descriptionGeneric optionName; + }; + optionAddress = mkOption { + type = with types; nullOr str; + default = null; + example = "0.0.0.0"; + description = '' + IPv4 or IPv6 (if between brackets) address. + ''; + }; + optionUnix = mkOption { + type = with types; nullOr path; + default = null; + description = '' + Unix domain socket path to use. + ''; + }; + optionPort = mkOption { + type = with types; nullOr (oneOf [port (enum ["auto"])]); + default = null; + }; + optionPorts = optionName: mkOption { + type = with types; listOf port; + default = []; + description = descriptionGeneric optionName; + }; + optionIsolablePort = with types; oneOf [ + port (enum ["auto"]) + (submodule ({config, ...}: { + options = { + addr = optionAddress; + port = optionPort; + flags = optionFlags; + SessionGroup = mkOption { type = nullOr int; default = null; }; + } // genAttrs isolateFlags (name: mkOption { type = types.bool; default = false; }); + config = { + flags = filter (name: config.${name} == true) isolateFlags ++ + optional (config.SessionGroup != null) "SessionGroup=${toString config.SessionGroup}"; + }; + })) + ]; + optionIsolablePorts = optionName: mkOption { default = []; - example = [ - "IsolateClientAddr" - "IsolateSOCKSAuth" - "IsolateClientProtocol" - "IsolateDestPort" - "IsolateDestAddr" + type = with types; either optionIsolablePort (listOf optionIsolablePort); + description = descriptionGeneric optionName; + }; + isolateFlags = [ + "IsolateClientAddr" + "IsolateClientProtocol" + "IsolateDestAddr" + "IsolateDestPort" + "IsolateSOCKSAuth" + "KeepAliveIsolateSOCKSAuth" + ]; + optionSOCKSPort = doConfig: let + flags = [ + "CacheDNS" "CacheIPv4DNS" "CacheIPv6DNS" "GroupWritable" "IPv6Traffic" + "NoDNSRequest" "NoIPv4Traffic" "NoOnionTraffic" "OnionTrafficOnly" + "PreferIPv6" "PreferIPv6Automap" "PreferSOCKSNoAuth" "UseDNSCache" + "UseIPv4Cache" "UseIPv6Cache" "WorldWritable" + ] ++ isolateFlags; + in with types; oneOf [ + port (submodule ({config, ...}: { + options = { + unix = optionUnix; + addr = optionAddress; + port = optionPort; + flags = optionFlags; + SessionGroup = mkOption { type = nullOr int; default = null; }; + } // genAttrs flags (name: mkOption { type = types.bool; default = false; }); + config = mkIf doConfig { # Only add flags in SOCKSPort to avoid duplicates + flags = filter (name: config.${name} == true) flags ++ + optional (config.SessionGroup != null) "SessionGroup=${toString config.SessionGroup}"; + }; + })) ]; - description = "Tor isolation options"; + optionFlags = mkOption { + type = with types; listOf str; + default = []; + }; + optionORPort = optionName: mkOption { + default = []; + example = 443; + type = with types; oneOf [port (enum ["auto"]) (listOf (oneOf [ + port + (enum ["auto"]) + (submodule ({config, ...}: + let flags = [ "IPv4Only" "IPv6Only" "NoAdvertise" "NoListen" ]; + in { + options = { + addr = optionAddress; + port = optionPort; + flags = optionFlags; + } // genAttrs flags (name: mkOption { type = types.bool; default = false; }); + config = { + flags = filter (name: config.${name} == true) flags; + }; + })) + ]))]; + description = descriptionGeneric optionName; + }; + optionBandwith = optionName: mkOption { + type = with types; nullOr (either int str); + default = null; + description = descriptionGeneric optionName; + }; + optionPath = optionName: mkOption { + type = with types; nullOr path; + default = null; + description = descriptionGeneric optionName; }; - - torRc = '' - User tor - DataDirectory ${torDirectory} - ${optionalString cfg.enableGeoIP '' - GeoIPFile ${cfg.package.geoip}/share/tor/geoip - GeoIPv6File ${cfg.package.geoip}/share/tor/geoip6 - ''} - - ${optint "ControlPort" cfg.controlPort} - ${optionalString cfg.controlSocket.enable "ControlPort unix:${torRunDirectory}/control GroupWritable RelaxDirModeCheck"} - '' - # Client connection config - + optionalString cfg.client.enable '' - SOCKSPort ${cfg.client.socksListenAddress} ${toString cfg.client.socksIsolationOptions} - SOCKSPort ${cfg.client.socksListenAddressFaster} - ${opt "SocksPolicy" cfg.client.socksPolicy} - - ${optionalString cfg.client.transparentProxy.enable '' - TransPort ${cfg.client.transparentProxy.listenAddress} ${toString cfg.client.transparentProxy.isolationOptions} - ''} - - ${optionalString cfg.client.dns.enable '' - DNSPort ${cfg.client.dns.listenAddress} ${toString cfg.client.dns.isolationOptions} - AutomapHostsOnResolve 1 - AutomapHostsSuffixes ${concatStringsSep "," cfg.client.dns.automapHostsSuffixes} - ''} - '' - # Explicitly disable the SOCKS server if the client is disabled. In - # particular, this makes non-anonymous hidden services possible. - + optionalString (! cfg.client.enable) '' - SOCKSPort 0 - '' - # Relay config - + optionalString cfg.relay.enable '' - ORPort ${toString cfg.relay.port} - ${opt "Address" cfg.relay.address} - ${opt "Nickname" cfg.relay.nickname} - ${opt "ContactInfo" cfg.relay.contactInfo} - - ${optint "RelayBandwidthRate" cfg.relay.bandwidthRate} - ${optint "RelayBandwidthBurst" cfg.relay.bandwidthBurst} - ${opt "AccountingMax" cfg.relay.accountingMax} - ${opt "AccountingStart" cfg.relay.accountingStart} - - ${if (cfg.relay.role == "exit") then - opt "ExitPolicy" cfg.relay.exitPolicy - else - "ExitPolicy reject *:*"} - - ${optionalString (elem cfg.relay.role ["bridge" "private-bridge"]) '' - BridgeRelay 1 - ServerTransportPlugin ${concatStringsSep "," cfg.relay.bridgeTransports} exec ${pkgs.obfs4}/bin/obfs4proxy managed - ExtORPort auto - ${optionalString (cfg.relay.role == "private-bridge") '' - ExtraInfoStatistics 0 - PublishServerDescriptor 0 - ''} - ''} - '' - # Hidden services - + concatStrings (flip mapAttrsToList cfg.hiddenServices (n: v: '' - HiddenServiceDir ${torDirectory}/onion/${v.name} - ${optionalString (v.version != null) "HiddenServiceVersion ${toString v.version}"} - ${flip concatMapStrings v.map (p: '' - HiddenServicePort ${toString p.port} ${p.destination} - '')} - ${optionalString (v.authorizeClient != null) '' - HiddenServiceAuthorizeClient ${v.authorizeClient.authType} ${concatStringsSep "," v.authorizeClient.clientNames} - ''} - '')) - + cfg.extraConfig; - - torRcFile = pkgs.writeText "torrc" torRc; - + mkValueString = k: v: + if v == null then "" + else if isBool v then + (if v then "1" else "0") + else if v ? "unix" && v.unix != null then + "unix:"+v.unix + + optionalString (v ? "flags") (" " + concatStringsSep " " v.flags) + else if v ? "port" && v.port != null then + optionalString (v ? "addr" && v.addr != null) "${v.addr}:" + + toString v.port + + optionalString (v ? "flags") (" " + concatStringsSep " " v.flags) + else if k == "ServerTransportPlugin" then + optionalString (v.transports != []) "${concatStringsSep "," v.transports} exec ${v.exec}" + else if k == "HidServAuth" then + concatMapStringsSep "\n${k} " (settings: settings.onion + " " settings.auth) v + else generators.mkValueStringDefault {} v; + genTorrc = settings: + generators.toKeyValue { + listsAsDuplicateKeys = true; + mkKeyValue = k: generators.mkKeyValueDefault { mkValueString = mkValueString k; } " " k; + } + (lib.mapAttrs (k: v: + # Not necesssary, but prettier rendering + if elem k [ "AutomapHostsSuffixes" "DirPolicy" "ExitPolicy" "SocksPolicy" ] + && v != [] + then concatStringsSep "," v + else v) + (lib.filterAttrs (k: v: !(v == null || v == "")) + settings)); + torrc = pkgs.writeText "torrc" ( + genTorrc cfg.settings + + concatStrings (mapAttrsToList (name: onion: + "HiddenServiceDir ${onion.path}\n" + + genTorrc onion.settings) cfg.relay.onionServices) + ); in { imports = [ - (mkRenamedOptionModule [ "services" "tor" "relay" "portSpec" ] [ "services" "tor" "relay" "port" ]) + (mkRenamedOptionModule [ "services" "tor" "client" "dns" "automapHostsSuffixes" ] [ "services" "tor" "settings" "AutomapHostsSuffixes" ]) + (mkRemovedOptionModule [ "services" "tor" "client" "dns" "isolationOptions" ] "Use services.tor.settings.DNSPort instead.") + (mkRemovedOptionModule [ "services" "tor" "client" "dns" "listenAddress" ] "Use services.tor.settings.DNSPort instead.") + (mkRemovedOptionModule [ "services" "tor" "client" "privoxy" "enable" ] "Use services.privoxy.enable and services.privoxy.enableTor instead.") + (mkRemovedOptionModule [ "services" "tor" "client" "socksIsolationOptions" ] "Use services.tor.settings.SOCKSPort instead.") + (mkRemovedOptionModule [ "services" "tor" "client" "socksListenAddressFaster" ] "Use services.tor.settings.SOCKSPort instead.") + (mkRenamedOptionModule [ "services" "tor" "client" "socksPolicy" ] [ "services" "tor" "settings" "SocksPolicy" ]) + (mkRemovedOptionModule [ "services" "tor" "client" "transparentProxy" "isolationOptions" ] "Use services.tor.settings.TransPort instead.") + (mkRemovedOptionModule [ "services" "tor" "client" "transparentProxy" "listenAddress" ] "Use services.tor.settings.TransPort instead.") + (mkRenamedOptionModule [ "services" "tor" "controlPort" ] [ "services" "tor" "settings" "ControlPort" ]) + (mkRemovedOptionModule [ "services" "tor" "extraConfig" ] "Plese use services.tor.settings instead.") + (mkRenamedOptionModule [ "services" "tor" "hiddenServices" ] [ "services" "tor" "relay" "onionServices" ]) + (mkRenamedOptionModule [ "services" "tor" "relay" "accountingMax" ] [ "services" "tor" "settings" "AccountingMax" ]) + (mkRenamedOptionModule [ "services" "tor" "relay" "accountingStart" ] [ "services" "tor" "settings" "AccountingStart" ]) + (mkRenamedOptionModule [ "services" "tor" "relay" "address" ] [ "services" "tor" "settings" "Address" ]) + (mkRenamedOptionModule [ "services" "tor" "relay" "bandwidthBurst" ] [ "services" "tor" "settings" "BandwidthBurst" ]) + (mkRenamedOptionModule [ "services" "tor" "relay" "bandwidthRate" ] [ "services" "tor" "settings" "BandwidthRate" ]) + (mkRenamedOptionModule [ "services" "tor" "relay" "bridgeTransports" ] [ "services" "tor" "settings" "ServerTransportPlugin" "transports" ]) + (mkRenamedOptionModule [ "services" "tor" "relay" "contactInfo" ] [ "services" "tor" "settings" "ContactInfo" ]) + (mkRenamedOptionModule [ "services" "tor" "relay" "exitPolicy" ] [ "services" "tor" "settings" "ExitPolicy" ]) (mkRemovedOptionModule [ "services" "tor" "relay" "isBridge" ] "Use services.tor.relay.role instead.") (mkRemovedOptionModule [ "services" "tor" "relay" "isExit" ] "Use services.tor.relay.role instead.") + (mkRenamedOptionModule [ "services" "tor" "relay" "nickname" ] [ "services" "tor" "settings" "Nickname" ]) + (mkRenamedOptionModule [ "services" "tor" "relay" "port" ] [ "services" "tor" "settings" "ORPort" ]) + (mkRenamedOptionModule [ "services" "tor" "relay" "portSpec" ] [ "services" "tor" "settings" "ORPort" ]) ]; options = { services.tor = { - enable = mkOption { - type = types.bool; - default = false; - description = '' - Enable the Tor daemon. By default, the daemon is run without - relay, exit, bridge or client connectivity. - ''; - }; + enable = mkEnableOption ''Tor daemon. + By default, the daemon is run without + relay, exit, bridge or client connectivity''; + + openFirewall = mkEnableOption "opening of the relay port(s) in the firewall"; package = mkOption { type = types.package; default = pkgs.tor; defaultText = "pkgs.tor"; example = literalExample "pkgs.tor"; - description = '' - Tor package to use - ''; + description = "Tor package to use."; }; - enableGeoIP = mkOption { - type = types.bool; - default = true; - description = '' - Whenever to configure Tor daemon to use GeoIP databases. + enableGeoIP = mkEnableOption ''use of GeoIP databases. + Disabling this will disable by-country statistics for bridges and relays + and some client and third-party software functionality'' // { default = true; }; - Disabling this will disable by-country statistics for - bridges and relays and some client and third-party software - functionality. - ''; - }; - - extraConfig = mkOption { - type = types.lines; - default = ""; - description = '' - Extra configuration. Contents will be added verbatim to the - configuration file at the end. - ''; - }; - - controlPort = mkOption { - type = types.nullOr (types.either types.int types.str); - default = null; - example = 9051; - description = '' - If set, Tor will accept connections on the specified port - and allow them to control the tor process. - ''; - }; - - controlSocket = { - enable = mkOption { - type = types.bool; - default = false; - description = '' - Whether to enable Tor control socket. Control socket is created - in <literal>${torRunDirectory}/control</literal> - ''; - }; - }; + controlSocket.enable = mkEnableOption ''control socket, + created in <literal>${runDir}/control</literal>''; client = { - enable = mkOption { - type = types.bool; - default = false; - description = '' - Whether to enable Tor daemon to route application - connections. You might want to disable this if you plan - running a dedicated Tor relay. - ''; - }; + enable = mkEnableOption ''the routing of application connections. + You might want to disable this if you plan running a dedicated Tor relay''; + + transparentProxy.enable = mkEnableOption "transparent proxy"; + dns.enable = mkEnableOption "DNS resolver"; socksListenAddress = mkOption { - type = types.str; - default = "127.0.0.1:9050"; - example = "192.168.0.1:9100"; + type = optionSOCKSPort false; + default = {addr = "127.0.0.1"; port = 9050; IsolateDestAddr = true;}; + example = {addr = "192.168.0.1"; port = 9090; IsolateDestAddr = true;}; description = '' Bind to this address to listen for connections from - Socks-speaking applications. Provides strong circuit - isolation, separate circuit per IP address. + Socks-speaking applications. ''; }; - socksListenAddressFaster = mkOption { - type = types.str; - default = "127.0.0.1:9063"; - example = "192.168.0.1:9101"; - description = '' - Bind to this address to listen for connections from - Socks-speaking applications. Same as - <option>socksListenAddress</option> but uses weaker - circuit isolation to provide performance suitable for a - web browser. - ''; - }; - - socksPolicy = mkOption { - type = types.nullOr types.str; - default = null; - example = "accept 192.168.0.0/16, reject *"; - description = '' - Entry policies to allow/deny SOCKS requests based on IP - address. First entry that matches wins. If no SocksPolicy - is set, we accept all (and only) requests from - <option>socksListenAddress</option>. - ''; - }; - - socksIsolationOptions = mkOption (isolationOptions // { - default = ["IsolateDestAddr"]; - }); - - transparentProxy = { - enable = mkOption { - type = types.bool; - default = false; - description = "Whether to enable tor transparent proxy"; + onionServices = mkOption { + description = descriptionGeneric "HiddenServiceDir"; + default = {}; + example = { + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" = { + clientAuthorizations = ["/run/keys/tor/alice.prv.x25519"]; + }; }; - - listenAddress = mkOption { - type = types.str; - default = "127.0.0.1:9040"; - example = "192.168.0.1:9040"; - description = '' - Bind transparent proxy to this address. - ''; - }; - - isolationOptions = mkOption isolationOptions; - }; - - dns = { - enable = mkOption { - type = types.bool; - default = false; - description = "Whether to enable tor dns resolver"; - }; - - listenAddress = mkOption { - type = types.str; - default = "127.0.0.1:9053"; - example = "192.168.0.1:9053"; - description = '' - Bind tor dns to this address. - ''; - }; - - isolationOptions = mkOption isolationOptions; - - automapHostsSuffixes = mkOption { - type = types.listOf types.str; - default = [".onion" ".exit"]; - example = [".onion"]; - description = "List of suffixes to use with automapHostsOnResolve"; - }; - }; - - privoxy.enable = mkOption { - type = types.bool; - default = true; - description = '' - Whether to enable and configure the system Privoxy to use Tor's - faster port, suitable for HTTP. - - To have anonymity, protocols need to be scrubbed of identifying - information, and this can be accomplished for HTTP by Privoxy. - - Privoxy can also be useful for KDE torification. A good setup would be: - setting SOCKS proxy to the default Tor port, providing maximum - circuit isolation where possible; and setting HTTP proxy to Privoxy - to route HTTP traffic over faster, but less isolated port. - ''; + type = types.attrsOf (types.submodule ({name, config, ...}: { + options.clientAuthorizations = mkOption { + description = '' + Clients' authorizations for a v3 onion service, + as a list of files containing each one private key, in the format: + <screen>descriptor:x25519:<base32-private-key></screen> + '' + descriptionGeneric "_client_authorization"; + type = with types; listOf path; + default = []; + example = ["/run/keys/tor/alice.prv.x25519"]; + }; + })); }; }; relay = { - enable = mkOption { - type = types.bool; - default = false; - description = '' - Whether to enable relaying TOR traffic for others. + enable = mkEnableOption ''relaying of Tor traffic for others. - See <link xlink:href="https://www.torproject.org/docs/tor-doc-relay" /> - for details. + See <link xlink:href="https://www.torproject.org/docs/tor-doc-relay" /> + for details. - Setting this to true requires setting - <option>services.tor.relay.role</option> - and - <option>services.tor.relay.port</option> - options. - ''; - }; + Setting this to true requires setting + <option>services.tor.relay.role</option> + and + <option>services.tor.settings.ORPort</option> + options''; role = mkOption { type = types.enum [ "exit" "relay" "bridge" "private-bridge" ]; @@ -324,13 +313,13 @@ in <important><para> Running an exit relay may expose you to abuse complaints. See - <link xlink:href="https://www.torproject.org/faq.html.en#ExitPolicies" /> + <link xlink:href="https://www.torproject.org/faq.html.en#ExitPolicies"/> for more info. </para></important> <para> You can specify which services Tor users may access via - your exit relay using <option>exitPolicy</option> option. + your exit relay using <option>settings.ExitPolicy</option> option. </para> </listitem> </varlistentry> @@ -383,15 +372,14 @@ in <important> <para> WARNING: THE FOLLOWING PARAGRAPH IS NOT LEGAL ADVICE. - Consult with your lawer when in doubt. + Consult with your lawyer when in doubt. </para> <para> This role should be safe to use in most situations (unless the act of forwarding traffic for others is a punishable offence under your local laws, which - would be pretty insane as it would make ISP - illegal). + would be pretty insane as it would make ISP illegal). </para> </important> @@ -418,7 +406,7 @@ in <para> Use this if you want to run a private bridge, for - example because you'll give out your bridge address + example because you'll give out your bridge addr manually to your friends. </para> @@ -440,269 +428,393 @@ in ''; }; - bridgeTransports = mkOption { - type = types.listOf types.str; - default = ["obfs4"]; - example = ["obfs2" "obfs3" "obfs4" "scramblesuit"]; - description = "List of pluggable transports"; - }; - - nickname = mkOption { - type = types.str; - default = "anonymous"; - description = '' - A unique handle for your TOR relay. - ''; - }; - - contactInfo = mkOption { - type = types.nullOr types.str; - default = null; - example = "admin@relay.com"; - description = '' - Contact information for the relay owner (e.g. a mail - address and GPG key ID). - ''; - }; - - accountingMax = mkOption { - type = types.nullOr types.str; - default = null; - example = "450 GBytes"; - description = '' - Specify maximum bandwidth allowed during an accounting period. This - allows you to limit overall tor bandwidth over some time period. - See the <literal>AccountingMax</literal> option by looking at the - tor manual <citerefentry><refentrytitle>tor</refentrytitle> - <manvolnum>1</manvolnum></citerefentry> for more. - - Note this limit applies individually to upload and - download; if you specify <literal>"500 GBytes"</literal> - here, then you may transfer up to 1 TBytes of overall - bandwidth (500 GB upload, 500 GB download). - ''; - }; - - accountingStart = mkOption { - type = types.nullOr types.str; - default = null; - example = "month 1 1:00"; - description = '' - Specify length of an accounting period. This allows you to limit - overall tor bandwidth over some time period. See the - <literal>AccountingStart</literal> option by looking at the tor - manual <citerefentry><refentrytitle>tor</refentrytitle> - <manvolnum>1</manvolnum></citerefentry> for more. - ''; - }; - - bandwidthRate = mkOption { - type = types.nullOr types.int; - default = null; - example = 100; - description = '' - Specify this to limit the bandwidth usage of relayed (server) - traffic. Your own traffic is still unthrottled. Units: bytes/second. - ''; - }; - - bandwidthBurst = mkOption { - type = types.nullOr types.int; - default = cfg.relay.bandwidthRate; - example = 200; - description = '' - Specify this to allow bursts of the bandwidth usage of relayed (server) - traffic. The average usage will still be as specified in relayBandwidthRate. - Your own traffic is still unthrottled. Units: bytes/second. - ''; - }; - - address = mkOption { - type = types.nullOr types.str; - default = null; - example = "noname.example.com"; - description = '' - The IP address or full DNS name for advertised address of your relay. - Leave unset and Tor will guess. - ''; - }; - - port = mkOption { - type = types.either types.int types.str; - example = 143; - description = '' - What port to advertise for Tor connections. This corresponds to the - <literal>ORPort</literal> section in the Tor manual; see - <citerefentry><refentrytitle>tor</refentrytitle> - <manvolnum>1</manvolnum></citerefentry> for more details. - - At a minimum, you should just specify the port for the - relay to listen on; a common one like 143, 22, 80, or 443 - to help Tor users who may have very restrictive port-based - firewalls. - ''; - }; - - exitPolicy = mkOption { - type = types.nullOr types.str; - default = null; - example = "accept *:6660-6667,reject *:*"; - description = '' - A comma-separated list of exit policies. They're - considered first to last, and the first match wins. If you - want to _replace_ the default exit policy, end this with - either a reject *:* or an accept *:*. Otherwise, you're - _augmenting_ (prepending to) the default exit policy. - Leave commented to just use the default, which is - available in the man page or at - <link xlink:href="https://www.torproject.org/documentation.html" />. - - Look at - <link xlink:href="https://www.torproject.org/faq-abuse.html#TypicalAbuses" /> - for issues you might encounter if you use the default - exit policy. - - If certain IPs and ports are blocked externally, e.g. by - your firewall, you should update your exit policy to - reflect this -- otherwise Tor users will be told that - those destinations are down. - ''; + onionServices = mkOption { + description = descriptionGeneric "HiddenServiceDir"; + default = {}; + example = { + "example.org/www" = { + map = [ 80 ]; + authorizedClients = [ + "descriptor:x25519:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + ]; + }; + }; + type = types.attrsOf (types.submodule ({name, config, ...}: { + options.path = mkOption { + type = types.path; + description = '' + Path where to store the data files of the hidden service. + If the <option>secretKey</option> is null + this defaults to <literal>${stateDir}/onion/$onion</literal>, + otherwise to <literal>${runDir}/onion/$onion</literal>. + ''; + }; + options.secretKey = mkOption { + type = with types; nullOr path; + default = null; + example = "/run/keys/tor/onion/expyuzz4wqqyqhjn/hs_ed25519_secret_key"; + description = '' + Secret key of the onion service. + If null, Tor reuses any preexisting secret key (in <option>path</option>) + or generates a new one. + The associated public key and hostname are deterministically regenerated + from this file if they do not exist. + ''; + }; + options.authorizeClient = mkOption { + description = descriptionGeneric "HiddenServiceAuthorizeClient"; + default = null; + type = types.nullOr (types.submodule ({...}: { + options = { + authType = mkOption { + type = types.enum [ "basic" "stealth" ]; + description = '' + Either <literal>"basic"</literal> for a general-purpose authorization protocol + or <literal>"stealth"</literal> for a less scalable protocol + that also hides service activity from unauthorized clients. + ''; + }; + clientNames = mkOption { + type = with types; nonEmptyListOf (strMatching "[A-Za-z0-9+-_]+"); + description = '' + Only clients that are listed here are authorized to access the hidden service. + Generated authorization data can be found in <filename>${stateDir}/onion/$name/hostname</filename>. + Clients need to put this authorization data in their configuration file using + <xref linkend="opt-services.tor.settings.HidServAuth"/>. + ''; + }; + }; + })); + }; + options.authorizedClients = mkOption { + description = '' + Authorized clients for a v3 onion service, + as a list of public key, in the format: + <screen>descriptor:x25519:<base32-public-key></screen> + '' + descriptionGeneric "_client_authorization"; + type = with types; listOf str; + default = []; + example = ["descriptor:x25519:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"]; + }; + options.map = mkOption { + description = descriptionGeneric "HiddenServicePort"; + type = with types; listOf (oneOf [ + port (submodule ({...}: { + options = { + port = optionPort; + target = mkOption { + default = null; + type = nullOr (submodule ({...}: { + options = { + unix = optionUnix; + addr = optionAddress; + port = optionPort; + }; + })); + }; + }; + })) + ]); + apply = map (v: if isInt v then {port=v; target=null;} else v); + }; + options.version = mkOption { + description = descriptionGeneric "HiddenServiceVersion"; + type = with types; nullOr (enum [2 3]); + default = null; + }; + options.settings = mkOption { + description = '' + Settings of the onion service. + '' + descriptionGeneric "_hidden_service_options"; + default = {}; + type = types.submodule { + freeformType = with types; + (attrsOf (nullOr (oneOf [str int bool (listOf str)]))) // { + description = "settings option"; + }; + options.HiddenServiceAllowUnknownPorts = optionBool "HiddenServiceAllowUnknownPorts"; + options.HiddenServiceDirGroupReadable = optionBool "HiddenServiceDirGroupReadable"; + options.HiddenServiceExportCircuitID = mkOption { + description = descriptionGeneric "HiddenServiceExportCircuitID"; + type = with types; nullOr (enum ["haproxy"]); + default = null; + }; + options.HiddenServiceMaxStreams = mkOption { + description = descriptionGeneric "HiddenServiceMaxStreams"; + type = with types; nullOr (ints.between 0 65535); + default = null; + }; + options.HiddenServiceMaxStreamsCloseCircuit = optionBool "HiddenServiceMaxStreamsCloseCircuit"; + options.HiddenServiceNumIntroductionPoints = mkOption { + description = descriptionGeneric "HiddenServiceNumIntroductionPoints"; + type = with types; nullOr (ints.between 0 20); + default = null; + }; + options.HiddenServiceSingleHopMode = optionBool "HiddenServiceSingleHopMode"; + options.RendPostPeriod = optionString "RendPostPeriod"; + }; + }; + config = { + path = mkDefault ((if config.secretKey == null then stateDir else runDir) + "/onion/${name}"); + settings.HiddenServiceVersion = config.version; + settings.HiddenServiceAuthorizeClient = + if config.authorizeClient != null then + config.authorizeClient.authType + " " + + concatStringsSep "," config.authorizeClient.clientNames + else null; + settings.HiddenServicePort = map (p: mkValueString "" p.port + " " + mkValueString "" p.target) config.map; + }; + })); }; }; - hiddenServices = mkOption { + settings = mkOption { description = '' - A set of static hidden services that terminate their Tor - circuits at this node. - - Every element in this set declares a virtual onion host. - - You can specify your onion address by putting corresponding - private key to an appropriate place in ${torDirectory}. - - For services without private keys in ${torDirectory} Tor - daemon will generate random key pairs (which implies random - onion addresses) on restart. The latter could take a while, - please be patient. - - <note><para> - Hidden services can be useful even if you don't intend to - actually <emphasis>hide</emphasis> them, since they can - also be seen as a kind of NAT traversal mechanism. - - E.g. the example will make your sshd, whatever runs on - "8080" and your mail server available from anywhere where - the Tor network is available (which, with the help from - bridges, is pretty much everywhere), even if both client - and server machines are behind NAT you have no control - over. - </para></note> + See <link xlink:href="https://2019.www.torproject.org/docs/tor-manual.html.en">torrc manual</link> + for documentation. ''; default = {}; - example = literalExample '' - { "my-hidden-service-example".map = [ - { port = 22; } # map ssh port to this machine's ssh - { port = 80; toPort = 8080; } # map http port to whatever runs on 8080 - { port = "sip"; toHost = "mail.example.com"; toPort = "imap"; } # because we can - ]; - } - ''; - type = types.attrsOf (types.submodule ({name, ...}: { - options = { - - name = mkOption { - type = types.str; - description = '' - Name of this tor hidden service. - - This is purely descriptive. - - After restarting Tor daemon you should be able to - find your .onion address in - <literal>${torDirectory}/onion/$name/hostname</literal>. - ''; - }; - - map = mkOption { - default = []; - description = "Port mapping for this hidden service."; - type = types.listOf (types.submodule ({config, ...}: { - options = { - - port = mkOption { - type = types.either types.int types.str; - example = 80; - description = '' - Hidden service port to "bind to". - ''; - }; - - destination = mkOption { - internal = true; - type = types.str; - description = "Forward these connections where?"; - }; - - toHost = mkOption { - type = types.str; - default = "127.0.0.1"; - description = "Mapping destination host."; - }; - - toPort = mkOption { - type = types.either types.int types.str; - example = 8080; - description = "Mapping destination port."; - }; - - }; - - config = { - toPort = mkDefault config.port; - destination = mkDefault "${config.toHost}:${toString config.toPort}"; - }; - })); - }; - - authorizeClient = mkOption { - default = null; - description = "If configured, the hidden service is accessible for authorized clients only."; - type = types.nullOr (types.submodule ({...}: { - - options = { - - authType = mkOption { - type = types.enum [ "basic" "stealth" ]; - description = '' - Either <literal>"basic"</literal> for a general-purpose authorization protocol - or <literal>"stealth"</literal> for a less scalable protocol - that also hides service activity from unauthorized clients. - ''; - }; - - clientNames = mkOption { - type = types.nonEmptyListOf (types.strMatching "[A-Za-z0-9+-_]+"); - description = '' - Only clients that are listed here are authorized to access the hidden service. - Generated authorization data can be found in <filename>${torDirectory}/onion/$name/hostname</filename>. - Clients need to put this authorization data in their configuration file using <literal>HidServAuth</literal>. - ''; - }; - }; - })); - }; - - version = mkOption { - default = null; - description = "Rendezvous service descriptor version to publish for the hidden service. Currently, versions 2 and 3 are supported. (Default: 2)"; - type = types.nullOr (types.enum [ 2 3 ]); - }; + type = types.submodule { + freeformType = with types; + (attrsOf (nullOr (oneOf [str int bool (listOf str)]))) // { + description = "settings option"; + }; + options.Address = optionString "Address"; + options.AssumeReachable = optionBool "AssumeReachable"; + options.AccountingMax = optionBandwith "AccountingMax"; + options.AccountingStart = optionString "AccountingStart"; + options.AuthDirHasIPv6Connectivity = optionBool "AuthDirHasIPv6Connectivity"; + options.AuthDirListBadExits = optionBool "AuthDirListBadExits"; + options.AuthDirPinKeys = optionBool "AuthDirPinKeys"; + options.AuthDirSharedRandomness = optionBool "AuthDirSharedRandomness"; + options.AuthDirTestEd25519LinkKeys = optionBool "AuthDirTestEd25519LinkKeys"; + options.AuthoritativeDirectory = optionBool "AuthoritativeDirectory"; + options.AutomapHostsOnResolve = optionBool "AutomapHostsOnResolve"; + options.AutomapHostsSuffixes = optionStrings "AutomapHostsSuffixes" // { + default = [".onion" ".exit"]; + example = [".onion"]; }; - - config = { - name = mkDefault name; + options.BandwidthBurst = optionBandwith "BandwidthBurst"; + options.BandwidthRate = optionBandwith "BandwidthRate"; + options.BridgeAuthoritativeDir = optionBool "BridgeAuthoritativeDir"; + options.BridgeRecordUsageByCountry = optionBool "BridgeRecordUsageByCountry"; + options.BridgeRelay = optionBool "BridgeRelay" // { default = false; }; + options.CacheDirectory = optionPath "CacheDirectory"; + options.CacheDirectoryGroupReadable = optionBool "CacheDirectoryGroupReadable"; # default is null and like "auto" + options.CellStatistics = optionBool "CellStatistics"; + options.ClientAutoIPv6ORPort = optionBool "ClientAutoIPv6ORPort"; + options.ClientDNSRejectInternalAddresses = optionBool "ClientDNSRejectInternalAddresses"; + options.ClientOnionAuthDir = mkOption { + description = descriptionGeneric "ClientOnionAuthDir"; + default = null; + type = with types; nullOr path; + }; + options.ClientPreferIPv6DirPort = optionBool "ClientPreferIPv6DirPort"; # default is null and like "auto" + options.ClientPreferIPv6ORPort = optionBool "ClientPreferIPv6ORPort"; # default is null and like "auto" + options.ClientRejectInternalAddresses = optionBool "ClientRejectInternalAddresses"; + options.ClientUseIPv4 = optionBool "ClientUseIPv4"; + options.ClientUseIPv6 = optionBool "ClientUseIPv6"; + options.ConnDirectionStatistics = optionBool "ConnDirectionStatistics"; + options.ConstrainedSockets = optionBool "ConstrainedSockets"; + options.ContactInfo = optionString "ContactInfo"; + options.ControlPort = mkOption rec { + description = descriptionGeneric "ControlPort"; + default = []; + example = [{port = 9051;}]; + type = with types; oneOf [port (enum ["auto"]) (listOf (oneOf [ + port (enum ["auto"]) (submodule ({config, ...}: let + flags = ["GroupWritable" "RelaxDirModeCheck" "WorldWritable"]; + in { + options = { + unix = optionUnix; + flags = optionFlags; + addr = optionAddress; + port = optionPort; + } // genAttrs flags (name: mkOption { type = types.bool; default = false; }); + config = { + flags = filter (name: config.${name} == true) flags; + }; + })) + ]))]; + }; + options.ControlPortFileGroupReadable= optionBool "ControlPortFileGroupReadable"; + options.ControlPortWriteToFile = optionPath "ControlPortWriteToFile"; + options.ControlSocket = optionPath "ControlSocket"; + options.ControlSocketsGroupWritable = optionBool "ControlSocketsGroupWritable"; + options.CookieAuthFile = optionPath "CookieAuthFile"; + options.CookieAuthFileGroupReadable = optionBool "CookieAuthFileGroupReadable"; + options.CookieAuthentication = optionBool "CookieAuthentication"; + options.DataDirectory = optionPath "DataDirectory" // { default = stateDir; }; + options.DataDirectoryGroupReadable = optionBool "DataDirectoryGroupReadable"; + options.DirPortFrontPage = optionPath "DirPortFrontPage"; + options.DirAllowPrivateAddresses = optionBool "DirAllowPrivateAddresses"; + options.DormantCanceledByStartup = optionBool "DormantCanceledByStartup"; + options.DormantOnFirstStartup = optionBool "DormantOnFirstStartup"; + options.DormantTimeoutDisabledByIdleStreams = optionBool "DormantTimeoutDisabledByIdleStreams"; + options.DirCache = optionBool "DirCache"; + options.DirPolicy = mkOption { + description = descriptionGeneric "DirPolicy"; + type = with types; listOf str; + default = []; + example = ["accept *:*"]; + }; + options.DirPort = optionORPort "DirPort"; + options.DirReqStatistics = optionBool "DirReqStatistics"; + options.DisableAllSwap = optionBool "DisableAllSwap"; + options.DisableDebuggerAttachment = optionBool "DisableDebuggerAttachment"; + options.DisableNetwork = optionBool "DisableNetwork"; + options.DisableOOSCheck = optionBool "DisableOOSCheck"; + options.DNSPort = optionIsolablePorts "DNSPort"; + options.DoSCircuitCreationEnabled = optionBool "DoSCircuitCreationEnabled"; + options.DoSConnectionEnabled = optionBool "DoSConnectionEnabled"; # default is null and like "auto" + options.DoSRefuseSingleHopClientRendezvous = optionBool "DoSRefuseSingleHopClientRendezvous"; + options.DownloadExtraInfo = optionBool "DownloadExtraInfo"; + options.EnforceDistinctSubnets = optionBool "EnforceDistinctSubnets"; + options.EntryStatistics = optionBool "EntryStatistics"; + options.ExitPolicy = optionStrings "ExitPolicy" // { + default = ["reject *:*"]; + example = ["accept *:*"]; + }; + options.ExitPolicyRejectLocalInterfaces = optionBool "ExitPolicyRejectLocalInterfaces"; + options.ExitPolicyRejectPrivate = optionBool "ExitPolicyRejectPrivate"; + options.ExitPortStatistics = optionBool "ExitPortStatistics"; + options.ExitRelay = optionBool "ExitRelay"; # default is null and like "auto" + options.ExtORPort = mkOption { + description = descriptionGeneric "ExtORPort"; + default = null; + type = with types; nullOr (oneOf [ + port (enum ["auto"]) (submodule ({...}: { + options = { + addr = optionAddress; + port = optionPort; + }; + })) + ]); + apply = p: if isInt p || isString p then { port = p; } else p; + }; + options.ExtORPortCookieAuthFile = optionPath "ExtORPortCookieAuthFile"; + options.ExtORPortCookieAuthFileGroupReadable = optionBool "ExtORPortCookieAuthFileGroupReadable"; + options.ExtendAllowPrivateAddresses = optionBool "ExtendAllowPrivateAddresses"; + options.ExtraInfoStatistics = optionBool "ExtraInfoStatistics"; + options.FascistFirewall = optionBool "FascistFirewall"; + options.FetchDirInfoEarly = optionBool "FetchDirInfoEarly"; + options.FetchDirInfoExtraEarly = optionBool "FetchDirInfoExtraEarly"; + options.FetchHidServDescriptors = optionBool "FetchHidServDescriptors"; + options.FetchServerDescriptors = optionBool "FetchServerDescriptors"; + options.FetchUselessDescriptors = optionBool "FetchUselessDescriptors"; + options.ReachableAddresses = optionStrings "ReachableAddresses"; + options.ReachableDirAddresses = optionStrings "ReachableDirAddresses"; + options.ReachableORAddresses = optionStrings "ReachableORAddresses"; + options.GeoIPFile = optionPath "GeoIPFile"; + options.GeoIPv6File = optionPath "GeoIPv6File"; + options.GuardfractionFile = optionPath "GuardfractionFile"; + options.HidServAuth = mkOption { + description = descriptionGeneric "HidServAuth"; + default = []; + type = with types; listOf (oneOf [ + (submodule { + options = { + onion = mkOption { + type = strMatching "[a-z2-7]{16}(\\.onion)?"; + description = "Onion address."; + example = "xxxxxxxxxxxxxxxx.onion"; + }; + auth = mkOption { + type = strMatching "[A-Za-z0-9+/]{22}"; + description = "Authentication cookie."; + }; + }; + }) + ]); }; - })); + options.HiddenServiceNonAnonymousMode = optionBool "HiddenServiceNonAnonymousMode"; + options.HiddenServiceStatistics = optionBool "HiddenServiceStatistics"; + options.HSLayer2Nodes = optionStrings "HSLayer2Nodes"; + options.HSLayer3Nodes = optionStrings "HSLayer3Nodes"; + options.HTTPTunnelPort = optionIsolablePorts "HTTPTunnelPort"; + options.IPv6Exit = optionBool "IPv6Exit"; + options.KeyDirectory = optionPath "KeyDirectory"; + options.KeyDirectoryGroupReadable = optionBool "KeyDirectoryGroupReadable"; + options.LogMessageDomains = optionBool "LogMessageDomains"; + options.LongLivedPorts = optionPorts "LongLivedPorts"; + options.MainloopStats = optionBool "MainloopStats"; + options.MaxAdvertisedBandwidth = optionBandwith "MaxAdvertisedBandwidth"; + options.MaxCircuitDirtiness = optionInt "MaxCircuitDirtiness"; + options.MaxClientCircuitsPending = optionInt "MaxClientCircuitsPending"; + options.NATDPort = optionIsolablePorts "NATDPort"; + options.NewCircuitPeriod = optionInt "NewCircuitPeriod"; + options.Nickname = optionString "Nickname"; + options.ORPort = optionORPort "ORPort"; + options.OfflineMasterKey = optionBool "OfflineMasterKey"; + options.OptimisticData = optionBool "OptimisticData"; # default is null and like "auto" + options.PaddingStatistics = optionBool "PaddingStatistics"; + options.PerConnBWBurst = optionBandwith "PerConnBWBurst"; + options.PerConnBWRate = optionBandwith "PerConnBWRate"; + options.PidFile = optionPath "PidFile"; + options.ProtocolWarnings = optionBool "ProtocolWarnings"; + options.PublishHidServDescriptors = optionBool "PublishHidServDescriptors"; + options.PublishServerDescriptor = mkOption { + description = descriptionGeneric "PublishServerDescriptor"; + type = with types; nullOr (enum [false true 0 1 "0" "1" "v3" "bridge"]); + default = null; + }; + options.ReducedExitPolicy = optionBool "ReducedExitPolicy"; + options.RefuseUnknownExits = optionBool "RefuseUnknownExits"; # default is null and like "auto" + options.RejectPlaintextPorts = optionPorts "RejectPlaintextPorts"; + options.RelayBandwidthBurst = optionBandwith "RelayBandwidthBurst"; + options.RelayBandwidthRate = optionBandwith "RelayBandwidthRate"; + #options.RunAsDaemon + options.Sandbox = optionBool "Sandbox"; + options.ServerDNSAllowBrokenConfig = optionBool "ServerDNSAllowBrokenConfig"; + options.ServerDNSAllowNonRFC953Hostnames = optionBool "ServerDNSAllowNonRFC953Hostnames"; + options.ServerDNSDetectHijacking = optionBool "ServerDNSDetectHijacking"; + options.ServerDNSRandomizeCase = optionBool "ServerDNSRandomizeCase"; + options.ServerDNSResolvConfFile = optionPath "ServerDNSResolvConfFile"; + options.ServerDNSSearchDomains = optionBool "ServerDNSSearchDomains"; + options.ServerTransportPlugin = mkOption { + description = descriptionGeneric "ServerTransportPlugin"; + default = null; + type = with types; nullOr (submodule ({...}: { + options = { + transports = mkOption { + description = "List of pluggable transports."; + type = listOf str; + example = ["obfs2" "obfs3" "obfs4" "scramblesuit"]; + }; + exec = mkOption { + type = types.str; + description = "Command of pluggable transport."; + }; + }; + })); + }; + options.SocksPolicy = optionStrings "SocksPolicy" // { + example = ["accept *:*"]; + }; + options.SOCKSPort = mkOption { + description = descriptionGeneric "SOCKSPort"; + default = if cfg.settings.HiddenServiceNonAnonymousMode == true then [{port = 0;}] else []; + example = [{port = 9090;}]; + type = types.listOf (optionSOCKSPort true); + }; + options.TestingTorNetwork = optionBool "TestingTorNetwork"; + options.TransPort = optionIsolablePorts "TransPort"; + options.TransProxyType = mkOption { + description = descriptionGeneric "TransProxyType"; + type = with types; nullOr (enum ["default" "TPROXY" "ipfw" "pf-divert"]); + default = null; + }; + #options.TruncateLogFile + options.UnixSocksGroupWritable = optionBool "UnixSocksGroupWritable"; + options.UseDefaultFallbackDirs = optionBool "UseDefaultFallbackDirs"; + options.UseMicrodescriptors = optionBool "UseMicrodescriptors"; + options.V3AuthUseLegacyKey = optionBool "V3AuthUseLegacyKey"; + options.V3AuthoritativeDirectory = optionBool "V3AuthoritativeDirectory"; + options.VersioningAuthoritativeDirectory = optionBool "VersioningAuthoritativeDirectory"; + options.VirtualAddrNetworkIPv4 = optionString "VirtualAddrNetworkIPv4"; + options.VirtualAddrNetworkIPv6 = optionString "VirtualAddrNetworkIPv6"; + options.WarnPlaintextPorts = optionPorts "WarnPlaintextPorts"; + }; }; }; }; @@ -710,90 +822,219 @@ in config = mkIf cfg.enable { # Not sure if `cfg.relay.role == "private-bridge"` helps as tor # sends a lot of stats - warnings = optional (cfg.relay.enable && cfg.hiddenServices != {}) + warnings = optional (cfg.settings.BridgeRelay && + flatten (mapAttrsToList (n: o: o.map) cfg.relay.onionServices) != []) '' Running Tor hidden services on a public relay makes the presence of hidden services visible through simple statistical analysis of publicly available data. + See https://trac.torproject.org/projects/tor/ticket/8742 You can safely ignore this warning if you don't intend to actually hide your hidden services. In either case, you can always create a container/VM with a separate Tor daemon instance. - ''; + '' ++ + flatten (mapAttrsToList (n: o: + optional (o.settings.HiddenServiceVersion == 2) [ + (optional (o.settings.HiddenServiceExportCircuitID != null) '' + HiddenServiceExportCircuitID is used in the HiddenService: ${n} + but this option is only for v3 hidden services. + '') + ] ++ + optional (o.settings.HiddenServiceVersion != 2) [ + (optional (o.settings.HiddenServiceAuthorizeClient != null) '' + HiddenServiceAuthorizeClient is used in the HiddenService: ${n} + but this option is only for v2 hidden services. + '') + (optional (o.settings.RendPostPeriod != null) '' + RendPostPeriod is used in the HiddenService: ${n} + but this option is only for v2 hidden services. + '') + ] + ) cfg.relay.onionServices); users.groups.tor.gid = config.ids.gids.tor; users.users.tor = { description = "Tor Daemon User"; createHome = true; - home = torDirectory; + home = stateDir; group = "tor"; uid = config.ids.uids.tor; }; - # We have to do this instead of using RuntimeDirectory option in - # the service below because systemd has no way to set owners of - # RuntimeDirectory and putting this into the service below - # requires that service to relax it's sandbox since this needs - # writable /run - systemd.services.tor-init = - { description = "Tor Daemon Init"; - wantedBy = [ "tor.service" ]; - script = '' - install -m 0700 -o tor -g tor -d ${torDirectory} ${torDirectory}/onion - install -m 0750 -o tor -g tor -d ${torRunDirectory} - ''; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - }; - }; + services.tor.settings = mkMerge [ + (mkIf cfg.enableGeoIP { + GeoIPFile = "${cfg.package.geoip}/share/tor/geoip"; + GeoIPv6File = "${cfg.package.geoip}/share/tor/geoip6"; + }) + (mkIf cfg.controlSocket.enable { + ControlPort = [ { unix = runDir + "/control"; GroupWritable=true; RelaxDirModeCheck=true; } ]; + }) + (mkIf cfg.relay.enable ( + optionalAttrs (cfg.relay.role != "exit") { + ExitPolicy = mkForce ["reject *:*"]; + } // + optionalAttrs (elem cfg.relay.role ["bridge" "private-bridge"]) { + BridgeRelay = true; + ExtORPort.port = mkDefault "auto"; + ServerTransportPlugin.transports = mkDefault ["obfs4"]; + ServerTransportPlugin.exec = mkDefault "${pkgs.obfs4}/bin/obfs4proxy managed"; + } // optionalAttrs (cfg.relay.role == "private-bridge") { + ExtraInfoStatistics = false; + PublishServerDescriptor = false; + } + )) + (mkIf (!cfg.relay.enable) { + # Avoid surprises when leaving ORPort/DirPort configurations in cfg.settings, + # because it would still enable Tor as a relay, + # which can trigger all sort of problems when not carefully done, + # like the blocklisting of the machine's IP addresses + # by some hosting providers... + DirPort = mkForce []; + ORPort = mkForce []; + PublishServerDescriptor = mkForce false; + }) + (mkIf cfg.client.enable ( + { SOCKSPort = [ cfg.client.socksListenAddress ]; + } // optionalAttrs cfg.client.transparentProxy.enable { + TransPort = [{ addr = "127.0.0.1"; port = 9040; }]; + } // optionalAttrs cfg.client.dns.enable { + DNSPort = [{ addr = "127.0.0.1"; port = 9053; }]; + AutomapHostsOnResolve = true; + } // optionalAttrs (flatten (mapAttrsToList (n: o: o.clientAuthorizations) cfg.client.onionServices) != []) { + ClientOnionAuthDir = runDir + "/ClientOnionAuthDir"; + } + )) + ]; - systemd.services.tor = - { description = "Tor Daemon"; - path = [ pkgs.tor ]; - - wantedBy = [ "multi-user.target" ]; - after = [ "tor-init.service" "network.target" ]; - restartTriggers = [ torRcFile ]; - - serviceConfig = - { Type = "simple"; - # Translated from the upstream contrib/dist/tor.service.in - ExecStartPre = "${cfg.package}/bin/tor -f ${torRcFile} --verify-config"; - ExecStart = "${cfg.package}/bin/tor -f ${torRcFile}"; - ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; - KillSignal = "SIGINT"; - TimeoutSec = 30; - Restart = "on-failure"; - LimitNOFILE = 32768; - - # Hardening - # this seems to unshare /run despite what systemd.exec(5) says - PrivateTmp = mkIf (!cfg.controlSocket.enable) "yes"; - PrivateDevices = "yes"; - ProtectHome = "yes"; - ProtectSystem = "strict"; - InaccessiblePaths = "/home"; - ReadOnlyPaths = "/"; - ReadWritePaths = [ torDirectory torRunDirectory ]; - NoNewPrivileges = "yes"; - - # tor.service.in has this in, but this line it fails to spawn a namespace when using hidden services - #CapabilityBoundingSet = "CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE"; - }; + networking.firewall = mkIf cfg.openFirewall { + allowedTCPPorts = + concatMap (o: + if isInt o && o > 0 then [o] + else if o ? "port" && isInt o.port && o.port > 0 then [o.port] + else [] + ) (flatten [ + cfg.settings.ORPort + cfg.settings.DirPort + ]); + }; + + systemd.services.tor = { + description = "Tor Daemon"; + path = [ pkgs.tor ]; + + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + restartTriggers = [ torrc ]; + + serviceConfig = { + Type = "simple"; + User = "tor"; + Group = "tor"; + ExecStartPre = [ + "${cfg.package}/bin/tor -f ${torrc} --verify-config" + # DOC: Appendix G of https://spec.torproject.org/rend-spec-v3 + ("+" + pkgs.writeShellScript "ExecStartPre" (concatStringsSep "\n" (flatten (["set -eu"] ++ + mapAttrsToList (name: onion: + optional (onion.authorizedClients != []) '' + rm -rf ${escapeShellArg onion.path}/authorized_clients + install -d -o tor -g tor -m 0700 ${escapeShellArg onion.path} ${escapeShellArg onion.path}/authorized_clients + '' ++ + imap0 (i: pubKey: '' + echo ${pubKey} | + install -o tor -g tor -m 0400 /dev/stdin ${escapeShellArg onion.path}/authorized_clients/${toString i}.auth + '') onion.authorizedClients ++ + optional (onion.secretKey != null) '' + install -d -o tor -g tor -m 0700 ${escapeShellArg onion.path} + key="$(cut -f1 -d: ${escapeShellArg onion.secretKey})" + case "$key" in + ("== ed25519v"*"-secret") + install -o tor -g tor -m 0400 ${escapeShellArg onion.secretKey} ${escapeShellArg onion.path}/hs_ed25519_secret_key;; + (*) echo >&2 "NixOS does not (yet) support secret key type for onion: ${name}"; exit 1;; + esac + '' + ) cfg.relay.onionServices ++ + mapAttrsToList (name: onion: imap0 (i: prvKeyPath: + let hostname = removeSuffix ".onion" name; in '' + printf "%s:" ${escapeShellArg hostname} | cat - ${escapeShellArg prvKeyPath} | + install -o tor -g tor -m 0700 /dev/stdin \ + ${runDir}/ClientOnionAuthDir/${escapeShellArg hostname}.${toString i}.auth_private + '') onion.clientAuthorizations) + cfg.client.onionServices + )))) + ]; + ExecStart = "${cfg.package}/bin/tor -f ${torrc}"; + ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; + KillSignal = "SIGINT"; + TimeoutSec = 30; + Restart = "on-failure"; + LimitNOFILE = 32768; + RuntimeDirectory = [ + # g+x allows access to the control socket + "tor" + "tor/root" + # g+x can't be removed in ExecStart=, but will be removed by Tor + "tor/ClientOnionAuthDir" + ]; + RuntimeDirectoryMode = "0710"; + StateDirectoryMode = "0700"; + StateDirectory = [ + "tor" + "tor/onion" + ] ++ + flatten (mapAttrsToList (name: onion: + optional (onion.secretKey == null) "tor/onion/${name}" + ) cfg.relay.onionServices); + # The following options are only to optimize: + # systemd-analyze security tor + RootDirectory = runDir + "/root"; + RootDirectoryStartOnly = true; + #InaccessiblePaths = [ "-+${runDir}/root" ]; + UMask = "0066"; + BindPaths = [ stateDir ]; + BindReadOnlyPaths = [ storeDir "/etc" ]; + AmbientCapabilities = [""] ++ lib.optional bindsPrivilegedPort "CAP_NET_BIND_SERVICE"; + CapabilityBoundingSet = [""] ++ lib.optional bindsPrivilegedPort "CAP_NET_BIND_SERVICE"; + # ProtectClock= adds DeviceAllow=char-rtc r + DeviceAllow = ""; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateMounts = true; + PrivateNetwork = mkDefault false; + PrivateTmp = true; + # Tor cannot currently bind privileged port when PrivateUsers=true, + # see https://gitlab.torproject.org/legacy/trac/-/issues/20930 + PrivateUsers = !bindsPrivilegedPort; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectSystem = "strict"; + RemoveIPC = true; + RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + # See also the finer but experimental option settings.Sandbox + SystemCallFilter = [ + "@system-service" + # Groups in @system-service which do not contain a syscall listed by: + # perf stat -x, 2>perf.log -e 'syscalls:sys_enter_*' tor + # in tests, and seem likely not necessary for tor. + "~@aio" "~@chown" "~@keyring" "~@memlock" "~@resources" "~@setuid" "~@timer" + ]; + SystemCallArchitectures = "native"; + SystemCallErrorNumber = "EPERM"; }; + }; environment.systemPackages = [ cfg.package ]; - - services.privoxy = mkIf (cfg.client.enable && cfg.client.privoxy.enable) { - enable = true; - extraConfig = '' - forward-socks4a / ${cfg.client.socksListenAddressFaster} . - toggle 1 - enable-remote-toggle 0 - enable-edit-actions 0 - enable-remote-http-toggle 0 - ''; - }; }; + + meta.maintainers = with lib.maintainers; [ julm ]; } diff --git a/nixos/modules/services/security/usbguard.nix b/nixos/modules/services/security/usbguard.nix index 71fd71a2cab2f..4cdb3a041b59d 100644 --- a/nixos/modules/services/security/usbguard.nix +++ b/nixos/modules/services/security/usbguard.nix @@ -173,7 +173,7 @@ in serviceConfig = { Type = "simple"; - ExecStart = ''${cfg.package}/bin/usbguard-daemon -P -k -c ${daemonConfFile}''; + ExecStart = "${cfg.package}/bin/usbguard-daemon -P -k -c ${daemonConfFile}"; Restart = "on-failure"; StateDirectory = [ diff --git a/nixos/modules/services/security/vault.nix b/nixos/modules/services/security/vault.nix index 64622454b9dee..5a20f6413b1b7 100644 --- a/nixos/modules/services/security/vault.nix +++ b/nixos/modules/services/security/vault.nix @@ -27,6 +27,11 @@ let ''} ${cfg.extraConfig} ''; + + allConfigPaths = [configFile] ++ cfg.extraSettingsPaths; + + configOptions = escapeShellArgs (concatMap (p: ["-config" p]) allConfigPaths); + in { @@ -84,7 +89,14 @@ in storageConfig = mkOption { type = types.nullOr types.lines; default = null; - description = "Storage configuration"; + description = '' + HCL configuration to insert in the storageBackend section. + + Confidential values should not be specified here because this option's + value is written to the Nix store, which is publicly readable. + Provide credentials and such in a separate file using + <xref linkend="opt-services.vault.extraSettingsPaths"/>. + ''; }; telemetryConfig = mkOption { @@ -98,6 +110,36 @@ in default = ""; description = "Extra text appended to <filename>vault.hcl</filename>."; }; + + extraSettingsPaths = mkOption { + type = types.listOf types.path; + default = []; + description = '' + Configuration files to load besides the immutable one defined by the NixOS module. + This can be used to avoid putting credentials in the Nix store, which can be read by any user. + + Each path can point to a JSON- or HCL-formatted file, or a directory + to be scanned for files with <literal>.hcl</literal> or + <literal>.json</literal> extensions. + + To upload the confidential file with NixOps, use for example: + + <programlisting><![CDATA[ + # https://releases.nixos.org/nixops/latest/manual/manual.html#opt-deployment.keys + deployment.keys."vault.hcl" = let db = import ./db-credentials.nix; in { + text = ${"''"} + storage "postgresql" { + connection_url = "postgres://''${db.username}:''${db.password}@host.example.com/exampledb?sslmode=verify-ca" + } + ${"''"}; + user = "vault"; + }; + services.vault.extraSettingsPaths = ["/run/keys/vault.hcl"]; + services.vault.storageBackend = "postgresql"; + users.users.vault.extraGroups = ["keys"]; + ]]></programlisting> + ''; + }; }; }; @@ -136,7 +178,7 @@ in serviceConfig = { User = "vault"; Group = "vault"; - ExecStart = "${cfg.package}/bin/vault server -config ${configFile}"; + ExecStart = "${cfg.package}/bin/vault server ${configOptions}"; ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID"; PrivateDevices = true; PrivateTmp = true; diff --git a/nixos/modules/services/system/cloud-init.nix b/nixos/modules/services/system/cloud-init.nix index 3518e0ee9dca0..f83db30c1f02f 100644 --- a/nixos/modules/services/system/cloud-init.nix +++ b/nixos/modules/services/system/cloud-init.nix @@ -98,7 +98,7 @@ in - final-message - power-state-change ''; - description = ''cloud-init configuration.''; + description = "cloud-init configuration."; }; }; diff --git a/nixos/modules/services/torrent/deluge.nix b/nixos/modules/services/torrent/deluge.nix index 45398cb261387..7ca4fdcf64d40 100644 --- a/nixos/modules/services/torrent/deluge.nix +++ b/nixos/modules/services/torrent/deluge.nix @@ -41,6 +41,7 @@ in { openFilesLimit = mkOption { default = openFilesLimit; + type = types.either types.int types.str; description = '' Number of files to allow deluged to open. ''; diff --git a/nixos/modules/services/ttys/agetty.nix b/nixos/modules/services/ttys/getty.nix index d07746be2377a..ecfabef5fb131 100644 --- a/nixos/modules/services/ttys/agetty.nix +++ b/nixos/modules/services/ttys/getty.nix @@ -3,9 +3,19 @@ with lib; let + cfg = config.services.getty; - autologinArg = optionalString (config.services.mingetty.autologinUser != null) "--autologin ${config.services.mingetty.autologinUser}"; - gettyCmd = extraArgs: "@${pkgs.util-linux}/sbin/agetty agetty --login-program ${pkgs.shadow}/bin/login ${autologinArg} ${extraArgs}"; + loginArgs = [ + "--login-program" "${pkgs.shadow}/bin/login" + ] ++ optionals (cfg.autologinUser != null) [ + "--autologin" cfg.autologinUser + ] ++ optionals (cfg.loginOptions != null) [ + "--login-options" cfg.loginOptions + ]; + + gettyCmd = extraArgs: + "@${pkgs.util-linux}/sbin/agetty agetty ${escapeShellArgs loginArgs} " + + extraArgs; in @@ -13,9 +23,13 @@ in ###### interface + imports = [ + (mkRenamedOptionModule [ "services" "mingetty" ] [ "services" "getty" ]) + ]; + options = { - services.mingetty = { + services.getty = { autologinUser = mkOption { type = types.nullOr types.str; @@ -26,10 +40,27 @@ in ''; }; + loginOptions = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Template for arguments to be passed to + <citerefentry><refentrytitle>login</refentrytitle> + <manvolnum>1</manvolnum></citerefentry>. + + See <citerefentry><refentrytitle>agetty</refentrytitle> + <manvolnum>1</manvolnum></citerefentry> for details, + including security considerations. If unspecified, agetty + will not be invoked with a <option>--login-options</option> + option. + ''; + example = "-h darkstar -- \u"; + }; + greetingLine = mkOption { type = types.str; description = '' - Welcome line printed by mingetty. + Welcome line printed by agetty. The default shows current NixOS version label, machine type and tty. ''; }; @@ -38,7 +69,7 @@ in type = types.lines; default = ""; description = '' - Help line printed by mingetty below the welcome line. + Help line printed by agetty below the welcome line. Used by the installation CD to give some hints on how to proceed. ''; @@ -65,7 +96,7 @@ in config = { # Note: this is set here rather than up there so that changing # nixos.label would not rebuild manual pages - services.mingetty.greetingLine = mkDefault ''<<< Welcome to NixOS ${config.system.nixos.label} (\m) - \l >>>''; + services.getty.greetingLine = mkDefault ''<<< Welcome to NixOS ${config.system.nixos.label} (\m) - \l >>>''; systemd.services."getty@" = { serviceConfig.ExecStart = [ @@ -76,7 +107,7 @@ in }; systemd.services."serial-getty@" = - let speeds = concatStringsSep "," (map toString config.services.mingetty.serialSpeed); in + let speeds = concatStringsSep "," (map toString config.services.getty.serialSpeed); in { serviceConfig.ExecStart = [ "" # override upstream default with an empty ExecStart (gettyCmd "%I ${speeds} $TERM") @@ -106,8 +137,8 @@ in { # Friendly greeting on the virtual consoles. source = pkgs.writeText "issue" '' - [1;32m${config.services.mingetty.greetingLine}[0m - ${config.services.mingetty.helpLine} + [1;32m${config.services.getty.greetingLine}[0m + ${config.services.getty.helpLine} ''; }; diff --git a/nixos/modules/services/web-apps/dokuwiki.nix b/nixos/modules/services/web-apps/dokuwiki.nix index d9ebb3a98808c..9567223ebc7b5 100644 --- a/nixos/modules/services/web-apps/dokuwiki.nix +++ b/nixos/modules/services/web-apps/dokuwiki.nix @@ -336,7 +336,7 @@ in locations."/" = { priority = 1; index = "doku.php"; - extraConfig = ''try_files $uri $uri/ @dokuwiki;''; + extraConfig = "try_files $uri $uri/ @dokuwiki;"; }; locations."@dokuwiki" = { diff --git a/nixos/modules/services/web-apps/frab.nix b/nixos/modules/services/web-apps/frab.nix deleted file mode 100644 index 1b5890d6b0c73..0000000000000 --- a/nixos/modules/services/web-apps/frab.nix +++ /dev/null @@ -1,222 +0,0 @@ -{ config, lib, pkgs, ... }: - -with lib; - -let - cfg = config.services.frab; - - package = pkgs.frab; - - databaseConfig = builtins.toJSON { production = cfg.database; }; - - frabEnv = { - RAILS_ENV = "production"; - RACK_ENV = "production"; - SECRET_KEY_BASE = cfg.secretKeyBase; - FRAB_HOST = cfg.host; - FRAB_PROTOCOL = cfg.protocol; - FROM_EMAIL = cfg.fromEmail; - RAILS_SERVE_STATIC_FILES = "1"; - } // cfg.extraEnvironment; - - frab-rake = pkgs.stdenv.mkDerivation { - name = "frab-rake"; - buildInputs = [ package.env pkgs.makeWrapper ]; - phases = "installPhase fixupPhase"; - installPhase = '' - mkdir -p $out/bin - makeWrapper ${package.env}/bin/bundle $out/bin/frab-bundle \ - ${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") frabEnv)} \ - --set PATH '${lib.makeBinPath (with pkgs; [ nodejs file imagemagick ])}:$PATH' \ - --set RAKEOPT '-f ${package}/share/frab/Rakefile' \ - --run 'cd ${package}/share/frab' - makeWrapper $out/bin/frab-bundle $out/bin/frab-rake \ - --add-flags "exec rake" - ''; - }; - -in - -{ - options = { - services.frab = { - enable = mkOption { - type = types.bool; - default = false; - description = '' - Enable the frab service. - ''; - }; - - host = mkOption { - type = types.str; - example = "frab.example.com"; - description = '' - Hostname under which this frab instance can be reached. - ''; - }; - - protocol = mkOption { - type = types.str; - default = "https"; - example = "http"; - description = '' - Either http or https, depending on how your Frab instance - will be exposed to the public. - ''; - }; - - fromEmail = mkOption { - type = types.str; - default = "frab@localhost"; - description = '' - Email address used by frab. - ''; - }; - - listenAddress = mkOption { - type = types.str; - default = "localhost"; - description = '' - Address or hostname frab should listen on. - ''; - }; - - listenPort = mkOption { - type = types.int; - default = 3000; - description = '' - Port frab should listen on. - ''; - }; - - statePath = mkOption { - type = types.str; - default = "/var/lib/frab"; - description = '' - Directory where frab keeps its state. - ''; - }; - - user = mkOption { - type = types.str; - default = "frab"; - description = '' - User to run frab. - ''; - }; - - group = mkOption { - type = types.str; - default = "frab"; - description = '' - Group to run frab. - ''; - }; - - secretKeyBase = mkOption { - type = types.str; - description = '' - Your secret key is used for verifying the integrity of signed cookies. - If you change this key, all old signed cookies will become invalid! - - Make sure the secret is at least 30 characters and all random, - no regular words or you'll be exposed to dictionary attacks. - ''; - }; - - database = mkOption { - type = types.attrs; - default = { - adapter = "sqlite3"; - database = "/var/lib/frab/db.sqlite3"; - pool = 5; - timeout = 5000; - }; - example = { - adapter = "postgresql"; - database = "frab"; - host = "localhost"; - username = "frabuser"; - password = "supersecret"; - encoding = "utf8"; - pool = 5; - }; - description = '' - Rails database configuration for Frab as Nix attribute set. - ''; - }; - - extraEnvironment = mkOption { - type = types.attrs; - default = {}; - example = { - FRAB_CURRENCY_UNIT = "€"; - FRAB_CURRENCY_FORMAT = "%n%u"; - EXCEPTION_EMAIL = "frab-owner@example.com"; - SMTP_ADDRESS = "localhost"; - SMTP_PORT = "587"; - SMTP_DOMAIN = "localdomain"; - SMTP_USER_NAME = "root"; - SMTP_PASSWORD = "toor"; - SMTP_AUTHENTICATION = "1"; - SMTP_NOTLS = "1"; - }; - description = '' - Additional environment variables to set for frab for further - configuration. See the frab documentation for more information. - ''; - }; - }; - }; - - config = mkIf cfg.enable { - environment.systemPackages = [ frab-rake ]; - - users.users.${cfg.user} = - { group = cfg.group; - home = "${cfg.statePath}"; - isSystemUser = true; - }; - - users.groups.${cfg.group} = { }; - - systemd.tmpfiles.rules = [ - "d '${cfg.statePath}/system/attachments' - ${cfg.user} ${cfg.group} - -" - ]; - - systemd.services.frab = { - after = [ "network.target" "gitlab.service" ]; - wantedBy = [ "multi-user.target" ]; - environment = frabEnv; - - preStart = '' - ln -sf ${pkgs.writeText "frab-database.yml" databaseConfig} /run/frab/database.yml - ln -sf ${cfg.statePath}/system /run/frab/system - - if ! test -e "${cfg.statePath}/db-setup-done"; then - ${frab-rake}/bin/frab-rake db:setup - touch ${cfg.statePath}/db-setup-done - else - ${frab-rake}/bin/frab-rake db:migrate - fi - ''; - - serviceConfig = { - PrivateTmp = true; - PrivateDevices = true; - Type = "simple"; - User = cfg.user; - Group = cfg.group; - TimeoutSec = "300s"; - Restart = "on-failure"; - RestartSec = "10s"; - RuntimeDirectory = "frab"; - WorkingDirectory = "${package}/share/frab"; - ExecStart = "${frab-rake}/bin/frab-bundle exec rails server " + - "--binding=${cfg.listenAddress} --port=${toString cfg.listenPort}"; - }; - }; - - }; -} diff --git a/nixos/modules/services/web-apps/galene.nix b/nixos/modules/services/web-apps/galene.nix new file mode 100644 index 0000000000000..769490e915ac8 --- /dev/null +++ b/nixos/modules/services/web-apps/galene.nix @@ -0,0 +1,178 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.services.galene; + defaultstateDir = "/var/lib/galene"; + defaultrecordingsDir = "${cfg.stateDir}/recordings"; + defaultgroupsDir = "${cfg.stateDir}/groups"; + defaultdataDir = "${cfg.stateDir}/data"; +in +{ + options = { + services.galene = { + enable = mkEnableOption "Galene Service."; + + stateDir = mkOption { + default = defaultstateDir; + type = types.str; + description = '' + The directory where Galene stores its internal state. If left as the default + value this directory will automatically be created before the Galene server + starts, otherwise the sysadmin is responsible for ensuring the directory + exists with appropriate ownership and permissions. + ''; + }; + + user = mkOption { + type = types.str; + default = "galene"; + description = "User account under which galene runs."; + }; + + group = mkOption { + type = types.str; + default = "galene"; + description = "Group under which galene runs."; + }; + + insecure = mkOption { + type = types.bool; + default = false; + description = '' + Whether Galene should listen in http or in https. If left as the default + value (false), Galene needs to be fed a private key and a certificate. + ''; + }; + + certFile = mkOption { + type = types.nullOr types.str; + default = null; + example = "/path/to/your/cert.pem"; + description = '' + Path to the server's certificate. The file is copied at runtime to + Galene's data directory where it needs to reside. + ''; + }; + + keyFile = mkOption { + type = types.nullOr types.str; + default = null; + example = "/path/to/your/key.pem"; + description = '' + Path to the server's private key. The file is copied at runtime to + Galene's data directory where it needs to reside. + ''; + }; + + httpAddress = mkOption { + type = types.str; + default = ""; + description = "HTTP listen address for galene."; + }; + + httpPort = mkOption { + type = types.port; + default = 8443; + description = "HTTP listen port."; + }; + + staticDir = mkOption { + type = types.str; + default = "${cfg.package.static}/static"; + example = "/var/lib/galene/static"; + description = "Web server directory."; + }; + + recordingsDir = mkOption { + type = types.str; + default = defaultrecordingsDir; + example = "/var/lib/galene/recordings"; + description = "Recordings directory."; + }; + + dataDir = mkOption { + type = types.str; + default = defaultdataDir; + example = "/var/lib/galene/data"; + description = "Data directory."; + }; + + groupsDir = mkOption { + type = types.str; + default = defaultgroupsDir; + example = "/var/lib/galene/groups"; + description = "Web server directory."; + }; + + package = mkOption { + default = pkgs.galene; + defaultText = "pkgs.galene"; + type = types.package; + description = '' + Package for running Galene. + ''; + }; + }; + }; + + config = mkIf cfg.enable { + assertions = [ + { + assertion = cfg.insecure || (cfg.certFile != null && cfg.keyFile != null); + message = '' + Galene needs both certFile and keyFile defined for encryption, or + the insecure flag. + ''; + } + ]; + + systemd.services.galene = { + description = "galene"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + + preStart = '' + install -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.certFile} ${cfg.dataDir}/cert.pem + install -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.keyFile} ${cfg.dataDir}/key.pem + ''; + + serviceConfig = mkMerge [ + { + Type = "simple"; + User = cfg.user; + Group = cfg.group; + WorkingDirectory = cfg.stateDir; + ExecStart = ''${cfg.package}/bin/galene \ + ${optionalString (cfg.insecure) "-insecure"} \ + -data ${cfg.dataDir} \ + -groups ${cfg.groupsDir} \ + -recordings ${cfg.recordingsDir} \ + -static ${cfg.staticDir}''; + Restart = "always"; + # Upstream Requirements + LimitNOFILE = 65536; + StateDirectory = [ ] ++ + optional (cfg.stateDir == defaultstateDir) "galene" ++ + optional (cfg.dataDir == defaultdataDir) "galene/data" ++ + optional (cfg.groupsDir == defaultgroupsDir) "galene/groups" ++ + optional (cfg.recordingsDir == defaultrecordingsDir) "galene/recordings"; + } + ]; + }; + + users.users = mkIf (cfg.user == "galene") + { + galene = { + description = "galene Service"; + group = cfg.group; + isSystemUser = true; + }; + }; + + users.groups = mkIf (cfg.group == "galene") { + galene = { }; + }; + }; + meta.maintainers = with lib.maintainers; [ rgrunbla ]; +} diff --git a/nixos/modules/services/web-apps/grocy.nix b/nixos/modules/services/web-apps/grocy.nix index 568bdfd0c4297..be2de638dd961 100644 --- a/nixos/modules/services/web-apps/grocy.nix +++ b/nixos/modules/services/web-apps/grocy.nix @@ -115,9 +115,9 @@ in { user = "grocy"; group = "nginx"; - # PHP 7.3 is the only version which is supported/tested by upstream: - # https://github.com/grocy/grocy/blob/v2.6.0/README.md#how-to-install - phpPackage = pkgs.php73; + # PHP 7.4 is the only version which is supported/tested by upstream: + # https://github.com/grocy/grocy/blob/v3.0.0/README.md#how-to-install + phpPackage = pkgs.php74; inherit (cfg.phpfpm) settings; diff --git a/nixos/modules/services/web-apps/codimd.nix b/nixos/modules/services/web-apps/hedgedoc.nix index 0fbc9ee820e66..3f646d7db0cd7 100644 --- a/nixos/modules/services/web-apps/codimd.nix +++ b/nixos/modules/services/web-apps/hedgedoc.nix @@ -3,10 +3,14 @@ with lib; let - cfg = config.services.codimd; + cfg = config.services.hedgedoc; + + name = if versionAtLeast config.system.stateVersion "21.03" + then "hedgedoc" + else "codimd"; prettyJSON = conf: - pkgs.runCommandLocal "codimd-config.json" { + pkgs.runCommandLocal "hedgedoc-config.json" { nativeBuildInputs = [ pkgs.jq ]; } '' echo '${builtins.toJSON conf}' | jq \ @@ -14,22 +18,26 @@ let ''; in { - options.services.codimd = { - enable = mkEnableOption "the CodiMD Markdown Editor"; + imports = [ + (mkRenamedOptionModule [ "services" "codimd" ] [ "services" "hedgedoc" ]) + ]; + + options.services.hedgedoc = { + enable = mkEnableOption "the HedgeDoc Markdown Editor"; groups = mkOption { type = types.listOf types.str; default = []; description = '' - Groups to which the codimd user should be added. + Groups to which the user ${name} should be added. ''; }; workDir = mkOption { type = types.path; - default = "/var/lib/codimd"; + default = "/var/lib/${name}"; description = '' - Working directory for the CodiMD service. + Working directory for the HedgeDoc service. ''; }; @@ -38,17 +46,17 @@ in domain = mkOption { type = types.nullOr types.str; default = null; - example = "codimd.org"; + example = "hedgedoc.org"; description = '' - Domain name for the CodiMD instance. + Domain name for the HedgeDoc instance. ''; }; urlPath = mkOption { type = types.nullOr types.str; default = null; - example = "/url/path/to/codimd"; + example = "/url/path/to/hedgedoc"; description = '' - Path under which CodiMD is accessible. + Path under which HedgeDoc is accessible. ''; }; host = mkOption { @@ -69,7 +77,7 @@ in path = mkOption { type = types.nullOr types.str; default = null; - example = "/run/codimd.sock"; + example = "/run/hedgedoc.sock"; description = '' Specify where a UNIX domain socket should be placed. ''; @@ -77,7 +85,7 @@ in allowOrigin = mkOption { type = types.listOf types.str; default = []; - example = [ "localhost" "codimd.org" ]; + example = [ "localhost" "hedgedoc.org" ]; description = '' List of domains to whitelist. ''; @@ -201,7 +209,7 @@ in ''; description = '' Specify which database to use. - CodiMD supports mysql, postgres, sqlite and mssql. + HedgeDoc supports mysql, postgres, sqlite and mssql. See <link xlink:href="https://sequelize.readthedocs.io/en/v3/"> https://sequelize.readthedocs.io/en/v3/</link> for more information. Note: This option overrides <option>db</option>. @@ -213,12 +221,12 @@ in example = literalExample '' { dialect = "sqlite"; - storage = "/var/lib/codimd/db.codimd.sqlite"; + storage = "/var/lib/${name}/db.${name}.sqlite"; } ''; description = '' Specify the configuration for sequelize. - CodiMD supports mysql, postgres, sqlite and mssql. + HedgeDoc supports mysql, postgres, sqlite and mssql. See <link xlink:href="https://sequelize.readthedocs.io/en/v3/"> https://sequelize.readthedocs.io/en/v3/</link> for more information. Note: This option overrides <option>db</option>. @@ -227,7 +235,7 @@ in sslKeyPath= mkOption { type = types.nullOr types.str; default = null; - example = "/var/lib/codimd/codimd.key"; + example = "/var/lib/hedgedoc/hedgedoc.key"; description = '' Path to the SSL key. Needed when <option>useSSL</option> is enabled. ''; @@ -235,7 +243,7 @@ in sslCertPath = mkOption { type = types.nullOr types.str; default = null; - example = "/var/lib/codimd/codimd.crt"; + example = "/var/lib/hedgedoc/hedgedoc.crt"; description = '' Path to the SSL cert. Needed when <option>useSSL</option> is enabled. ''; @@ -243,7 +251,7 @@ in sslCAPath = mkOption { type = types.listOf types.str; default = []; - example = [ "/var/lib/codimd/ca.crt" ]; + example = [ "/var/lib/hedgedoc/ca.crt" ]; description = '' SSL ca chain. Needed when <option>useSSL</option> is enabled. ''; @@ -251,7 +259,7 @@ in dhParamPath = mkOption { type = types.nullOr types.str; default = null; - example = "/var/lib/codimd/dhparam.pem"; + example = "/var/lib/hedgedoc/dhparam.pem"; description = '' Path to the SSL dh params. Needed when <option>useSSL</option> is enabled. ''; @@ -260,10 +268,10 @@ in type = types.str; default = "/tmp"; description = '' - Path to the temp directory CodiMD should use. + Path to the temp directory HedgeDoc should use. Note that <option>serviceConfig.PrivateTmp</option> is enabled for - the CodiMD systemd service by default. - (Non-canonical paths are relative to CodiMD's base directory) + the HedgeDoc systemd service by default. + (Non-canonical paths are relative to HedgeDoc's base directory) ''; }; defaultNotePath = mkOption { @@ -271,7 +279,7 @@ in default = "./public/default.md"; description = '' Path to the default Note file. - (Non-canonical paths are relative to CodiMD's base directory) + (Non-canonical paths are relative to HedgeDoc's base directory) ''; }; docsPath = mkOption { @@ -279,7 +287,7 @@ in default = "./public/docs"; description = '' Path to the docs directory. - (Non-canonical paths are relative to CodiMD's base directory) + (Non-canonical paths are relative to HedgeDoc's base directory) ''; }; indexPath = mkOption { @@ -287,7 +295,7 @@ in default = "./public/views/index.ejs"; description = '' Path to the index template file. - (Non-canonical paths are relative to CodiMD's base directory) + (Non-canonical paths are relative to HedgeDoc's base directory) ''; }; hackmdPath = mkOption { @@ -295,7 +303,7 @@ in default = "./public/views/hackmd.ejs"; description = '' Path to the hackmd template file. - (Non-canonical paths are relative to CodiMD's base directory) + (Non-canonical paths are relative to HedgeDoc's base directory) ''; }; errorPath = mkOption { @@ -304,7 +312,7 @@ in defaultText = "./public/views/error.ejs"; description = '' Path to the error template file. - (Non-canonical paths are relative to CodiMD's base directory) + (Non-canonical paths are relative to HedgeDoc's base directory) ''; }; prettyPath = mkOption { @@ -313,7 +321,7 @@ in defaultText = "./public/views/pretty.ejs"; description = '' Path to the pretty template file. - (Non-canonical paths are relative to CodiMD's base directory) + (Non-canonical paths are relative to HedgeDoc's base directory) ''; }; slidePath = mkOption { @@ -322,13 +330,13 @@ in defaultText = "./public/views/slide.hbs"; description = '' Path to the slide template file. - (Non-canonical paths are relative to CodiMD's base directory) + (Non-canonical paths are relative to HedgeDoc's base directory) ''; }; uploadsPath = mkOption { type = types.str; default = "${cfg.workDir}/uploads"; - defaultText = "/var/lib/codimd/uploads"; + defaultText = "/var/lib/${name}/uploads"; description = '' Path under which uploaded files are saved. ''; @@ -766,7 +774,7 @@ in type = types.str; default = ""; description = '' - LDAP field which is used as the username on CodiMD. + LDAP field which is used as the username on HedgeDoc. By default <option>useridField</option> is used. ''; }; @@ -774,7 +782,7 @@ in type = types.str; example = "uid"; description = '' - LDAP field which is a unique identifier for users on CodiMD. + LDAP field which is a unique identifier for users on HedgeDoc. ''; }; tlsca = mkOption { @@ -840,7 +848,7 @@ in requiredGroups = mkOption { type = types.listOf types.str; default = []; - example = [ "Hackmd-users" "Codimd-users" ]; + example = [ "Hedgedoc-Users" ]; description = '' Required group names. ''; @@ -883,7 +891,7 @@ in environmentFile = mkOption { type = with types; nullOr path; default = null; - example = "/var/lib/codimd/codimd.env"; + example = "/var/lib/hedgedoc/hedgedoc.env"; description = '' Environment file as defined in <citerefentry> <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum> @@ -894,9 +902,9 @@ in setting these variables accordingly in the environment file. <programlisting> - # snippet of CodiMD-related config - services.codimd.configuration.dbURL = "postgres://codimd:\''${DB_PASSWORD}@db-host:5432/codimddb"; - services.codimd.configuration.minio.secretKey = "$MINIO_SECRET_KEY"; + # snippet of HedgeDoc-related config + services.hedgedoc.configuration.dbURL = "postgres://hedgedoc:\''${DB_PASSWORD}@db-host:5432/hedgedocdb"; + services.hedgedoc.configuration.minio.secretKey = "$MINIO_SECRET_KEY"; </programlisting> <programlisting> @@ -906,15 +914,15 @@ in </programlisting> Note that this file needs to be available on the host on which - <literal>CodiMD</literal> is running. + <literal>HedgeDoc</literal> is running. ''; }; package = mkOption { type = types.package; - default = pkgs.codimd; + default = pkgs.hedgedoc; description = '' - Package that provides CodiMD. + Package that provides HedgeDoc. ''; }; }; @@ -924,20 +932,20 @@ in { assertion = cfg.configuration.db == {} -> ( cfg.configuration.dbURL != "" && cfg.configuration.dbURL != null ); - message = "Database configuration for CodiMD missing."; } + message = "Database configuration for HedgeDoc missing."; } ]; - users.groups.codimd = {}; - users.users.codimd = { - description = "CodiMD service user"; - group = "codimd"; + users.groups.${name} = {}; + users.users.${name} = { + description = "HedgeDoc service user"; + group = name; extraGroups = cfg.groups; home = cfg.workDir; createHome = true; isSystemUser = true; }; - systemd.services.codimd = { - description = "CodiMD Service"; + systemd.services.hedgedoc = { + description = "HedgeDoc Service"; wantedBy = [ "multi-user.target" ]; after = [ "networking.target" ]; preStart = '' @@ -947,14 +955,14 @@ in ''; serviceConfig = { WorkingDirectory = cfg.workDir; - ExecStart = "${cfg.package}/bin/codimd"; + ExecStart = "${cfg.package}/bin/hedgedoc"; EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ]; Environment = [ "CMD_CONFIG_FILE=${cfg.workDir}/config.json" "NODE_ENV=production" ]; Restart = "always"; - User = "codimd"; + User = name; PrivateTmp = true; }; }; diff --git a/nixos/modules/services/web-apps/hledger-web.nix b/nixos/modules/services/web-apps/hledger-web.nix new file mode 100644 index 0000000000000..43fc4daa177fe --- /dev/null +++ b/nixos/modules/services/web-apps/hledger-web.nix @@ -0,0 +1,77 @@ +{ lib, pkgs, config, ... }: +with lib; +let + cfg = config.services.hledger-web; +in { + options.services.hledger-web = { + + enable = mkEnableOption "hledger-web service"; + + serveApi = mkEnableOption "Serve only the JSON web API, without the web UI."; + + host = mkOption { + type = types.str; + default = "127.0.0.1"; + description = '' + Address to listen on. + ''; + }; + + port = mkOption { + type = types.port; + default = 5000; + example = "80"; + description = '' + Port to listen on. + ''; + }; + + capabilities = mkOption { + type = types.commas; + default = "view"; + description = '' + Enable the view, add, and/or manage capabilities. E.g. view,add + ''; + }; + + journalFile = mkOption { + type = types.path; + example = "/home/hledger/.hledger.journal"; + description = '' + Input journal file. + ''; + }; + + baseUrl = mkOption { + type = with types; nullOr str; + default = null; + example = "https://example.org"; + description = '' + Base URL, when sharing over a network. + ''; + }; + }; + + config = mkIf cfg.enable { + systemd.services.hledger-web = { + description = "hledger-web - web-app for the hledger accounting tool."; + documentation = [ https://hledger.org/hledger-web.html ]; + wantedBy = [ "multi-user.target" ]; + after = [ "networking.target" ]; + serviceConfig = { + ExecStart = '' + ${pkgs.hledger-web}/bin/hledger-web \ + --host=${cfg.host} \ + --port=${toString cfg.port} \ + --file=${cfg.journalFile} \ + "--capabilities=${cfg.capabilities}" \ + ${optionalString (cfg.baseUrl != null) "--base-url=${cfg.baseUrl}"} \ + ${optionalString (cfg.serveApi) "--serve-api"} + ''; + Restart = "always"; + }; + }; + }; + + meta.maintainers = with lib.maintainers; [ marijanp ]; +} diff --git a/nixos/modules/services/web-apps/ihatemoney/default.nix b/nixos/modules/services/web-apps/ihatemoney/default.nix index 68769ac8c0316..b4987fa4702cf 100644 --- a/nixos/modules/services/web-apps/ihatemoney/default.nix +++ b/nixos/modules/services/web-apps/ihatemoney/default.nix @@ -44,7 +44,7 @@ let in { options.services.ihatemoney = { - enable = mkEnableOption "ihatemoney webapp. Note that this will set uwsgi to emperor mode running as root"; + enable = mkEnableOption "ihatemoney webapp. Note that this will set uwsgi to emperor mode"; backend = mkOption { type = types.enum [ "sqlite" "postgresql" ]; default = "sqlite"; @@ -116,16 +116,13 @@ in services.uwsgi = { enable = true; plugins = [ "python3" ]; - # the vassal needs to be able to setuid - user = "root"; - group = "root"; instance = { type = "emperor"; vassals.ihatemoney = { type = "normal"; strict = true; - uid = user; - gid = group; + immediate-uid = user; + immediate-gid = group; # apparently flask uses threads: https://github.com/spiral-project/ihatemoney/commit/c7815e48781b6d3a457eaff1808d179402558f8c enable-threads = true; module = "wsgi:application"; diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix index bbb0c8d048313..a93e93279331e 100644 --- a/nixos/modules/services/web-apps/keycloak.nix +++ b/nixos/modules/services/web-apps/keycloak.nix @@ -565,7 +565,7 @@ in assertions = [ { assertion = (cfg.databaseUseSSL && cfg.databaseType == "postgresql") -> (cfg.databaseCaCert != null); - message = ''A CA certificate must be specified (in 'services.keycloak.databaseCaCert') when PostgreSQL is used with SSL''; + message = "A CA certificate must be specified (in 'services.keycloak.databaseCaCert') when PostgreSQL is used with SSL"; } ]; diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix index 0a5b6047bb58a..1db1652022a34 100644 --- a/nixos/modules/services/web-apps/mediawiki.nix +++ b/nixos/modules/services/web-apps/mediawiki.nix @@ -180,6 +180,7 @@ in }; name = mkOption { + type = types.str; default = "MediaWiki"; example = "Foobar Wiki"; description = "Name of the wiki."; diff --git a/nixos/modules/services/web-apps/moodle.nix b/nixos/modules/services/web-apps/moodle.nix index 8887136ea5e7f..ad1e55d62d1d7 100644 --- a/nixos/modules/services/web-apps/moodle.nix +++ b/nixos/modules/services/web-apps/moodle.nix @@ -84,7 +84,7 @@ in type = mkOption { type = types.enum [ "mysql" "pgsql" ]; default = "mysql"; - description = ''Database engine to use.''; + description = "Database engine to use."; }; host = mkOption { diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix index 53c2ab76fdfa2..d50939e701ed9 100644 --- a/nixos/modules/services/web-apps/nextcloud.nix +++ b/nixos/modules/services/web-apps/nextcloud.nix @@ -6,17 +6,19 @@ let cfg = config.services.nextcloud; fpm = config.services.phpfpm.pools.nextcloud; - phpPackage = - let - base = pkgs.php74; - in - base.buildEnv { - extensions = { enabled, all }: with all; - enabled ++ [ - apcu redis memcached imagick - ]; - extraConfig = phpOptionsStr; - }; + phpPackage = pkgs.php74.buildEnv { + extensions = { enabled, all }: + (with all; + enabled + ++ [ imagick ] # Always enabled + # Optionally enabled depending on caching settings + ++ optional cfg.caching.apcu apcu + ++ optional cfg.caching.redis redis + ++ optional cfg.caching.memcached memcached + ) + ++ cfg.phpExtraExtensions all; # Enabled by user + extraConfig = toKeyValue phpOptions; + }; toKeyValue = generators.toKeyValue { mkKeyValue = generators.mkKeyValueDefault {} " = "; @@ -27,7 +29,6 @@ let post_max_size = cfg.maxUploadSize; memory_limit = cfg.maxUploadSize; } // cfg.phpOptions; - phpOptionsStr = toKeyValue phpOptions; occ = pkgs.writeScriptBin "nextcloud-occ" '' #! ${pkgs.runtimeShell} @@ -39,7 +40,7 @@ let export NEXTCLOUD_CONFIG_DIR="${cfg.home}/config" $sudo \ ${phpPackage}/bin/php \ - occ $* + occ "$@" ''; inherit (config.system) stateVersion; @@ -116,6 +117,21 @@ in { ''; }; + phpExtraExtensions = mkOption { + type = with types; functionTo (listOf package); + default = all: []; + defaultText = "all: []"; + description = '' + Additional PHP extensions to use for nextcloud. + By default, only extensions necessary for a vanilla nextcloud installation are enabled, + but you may choose from the list of available extensions and add further ones. + This is sometimes necessary to be able to install a certain nextcloud app that has additional requirements. + ''; + example = literalExample '' + all: [ all.pdlib all.bz2 ] + ''; + }; + phpOptions = mkOption { type = types.attrsOf types.str; default = { @@ -228,7 +244,8 @@ in { type = types.nullOr types.str; default = null; description = '' - The full path to a file that contains the admin's password. + The full path to a file that contains the admin's password. Must be + readable by user <literal>nextcloud</literal>. ''; }; @@ -391,7 +408,9 @@ in { $file = "${c.dbpassFile}"; if (!file_exists($file)) { throw new \RuntimeException(sprintf( - "Cannot start Nextcloud, dbpass file %s set by NixOS doesn't exist!", + "Cannot start Nextcloud, dbpass file %s set by NixOS doesn't seem to " + . "exist! Please make sure that the file exists and has appropriate " + . "permissions for user & group 'nextcloud'!", $file )); } @@ -509,7 +528,6 @@ in { pools.nextcloud = { user = "nextcloud"; group = "nextcloud"; - phpOptions = phpOptionsStr; phpPackage = phpPackage; phpEnv = { NEXTCLOUD_CONFIG_DIR = "${cfg.home}/config"; diff --git a/nixos/modules/services/web-apps/nextcloud.xml b/nixos/modules/services/web-apps/nextcloud.xml index 02e4dba286108..6cbfda118c4f6 100644 --- a/nixos/modules/services/web-apps/nextcloud.xml +++ b/nixos/modules/services/web-apps/nextcloud.xml @@ -10,6 +10,10 @@ <link linkend="opt-services.nextcloud.enable">services.nextcloud</link>. A desktop client is packaged at <literal>pkgs.nextcloud-client</literal>. </para> + <para> + The current default by NixOS is <package>nextcloud20</package> which is also the latest + major version available. + </para> <section xml:id="module-services-nextcloud-basic-usage"> <title>Basic usage</title> @@ -178,6 +182,17 @@ </para> </section> + <section xml:id="installing-apps-php-extensions-nextcloud"> + <title>Installing Apps and PHP extensions</title> + + <para> + Nextcloud apps are installed statefully through the web interface. + + Some apps may require extra PHP extensions to be installed. + This can be configured with the <xref linkend="opt-services.nextcloud.phpExtraExtensions" /> setting. + </para> + </section> + <section xml:id="module-services-nextcloud-maintainer-info"> <title>Maintainer information</title> @@ -210,7 +225,7 @@ nextcloud17 = generic { version = "17.0.x"; sha256 = "0000000000000000000000000000000000000000000000000000"; - insecure = true; + eol = true; }; }</programlisting> </para> diff --git a/nixos/modules/services/web-apps/plantuml-server.nix b/nixos/modules/services/web-apps/plantuml-server.nix new file mode 100644 index 0000000000000..a39f594c274c4 --- /dev/null +++ b/nixos/modules/services/web-apps/plantuml-server.nix @@ -0,0 +1,123 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + + cfg = config.services.plantuml-server; + +in + +{ + options = { + services.plantuml-server = { + enable = mkEnableOption "PlantUML server"; + + package = mkOption { + type = types.package; + default = pkgs.plantuml-server; + description = "PlantUML server package to use"; + }; + + user = mkOption { + type = types.str; + default = "plantuml"; + description = "User which runs PlantUML server."; + }; + + group = mkOption { + type = types.str; + default = "plantuml"; + description = "Group which runs PlantUML server."; + }; + + home = mkOption { + type = types.str; + default = "/var/lib/plantuml"; + description = "Home directory of the PlantUML server instance."; + }; + + listenHost = mkOption { + type = types.str; + default = "127.0.0.1"; + description = "Host to listen on."; + }; + + listenPort = mkOption { + type = types.int; + default = 8080; + description = "Port to listen on."; + }; + + plantumlLimitSize = mkOption { + type = types.int; + default = 4096; + description = "Limits image width and height."; + }; + + graphvizPackage = mkOption { + type = types.package; + default = pkgs.graphviz_2_32; + description = "Package containing the dot executable."; + }; + + plantumlStats = mkOption { + type = types.bool; + default = false; + description = "Set it to on to enable statistics report (https://plantuml.com/statistics-report)."; + }; + + httpAuthorization = mkOption { + type = types.nullOr types.str; + default = null; + description = "When calling the proxy endpoint, the value of HTTP_AUTHORIZATION will be used to set the HTTP Authorization header."; + }; + + allowPlantumlInclude = mkOption { + type = types.bool; + default = false; + description = "Enables !include processing which can read files from the server into diagrams. Files are read relative to the current working directory."; + }; + }; + }; + + config = mkIf cfg.enable { + users.users.${cfg.user} = { + isSystemUser = true; + group = cfg.group; + home = cfg.home; + createHome = true; + }; + + users.groups.${cfg.group} = {}; + + systemd.services.plantuml-server = { + description = "PlantUML server"; + wantedBy = [ "multi-user.target" ]; + path = [ cfg.home ]; + environment = { + PLANTUML_LIMIT_SIZE = builtins.toString cfg.plantumlLimitSize; + GRAPHVIZ_DOT = "${cfg.graphvizPackage}/bin/dot"; + PLANTUML_STATS = if cfg.plantumlStats then "on" else "off"; + HTTP_AUTHORIZATION = cfg.httpAuthorization; + ALLOW_PLANTUML_INCLUDE = if cfg.allowPlantumlInclude then "true" else "false"; + }; + script = '' + ${pkgs.jre}/bin/java \ + -jar ${pkgs.jetty}/start.jar \ + --module=deploy,http,jsp \ + jetty.home=${pkgs.jetty} \ + jetty.base=${cfg.package} \ + jetty.http.host=${cfg.listenHost} \ + jetty.http.port=${builtins.toString cfg.listenPort} + ''; + serviceConfig = { + User = cfg.user; + Group = cfg.group; + PrivateTmp = true; + }; + }; + }; + + meta.maintainers = with lib.maintainers; [ truh ]; +} diff --git a/nixos/modules/services/web-apps/trilium.nix b/nixos/modules/services/web-apps/trilium.nix index 3fa8dad049083..3a6ea02676aa5 100644 --- a/nixos/modules/services/web-apps/trilium.nix +++ b/nixos/modules/services/web-apps/trilium.nix @@ -85,7 +85,7 @@ in config = lib.mkIf cfg.enable (lib.mkMerge [ { - meta.maintainers = with lib.maintainers; [ kampka ]; + meta.maintainers = with lib.maintainers; [ ]; users.groups.trilium = {}; users.users.trilium = { diff --git a/nixos/modules/services/web-apps/whitebophir.nix b/nixos/modules/services/web-apps/whitebophir.nix new file mode 100644 index 0000000000000..a19812547c448 --- /dev/null +++ b/nixos/modules/services/web-apps/whitebophir.nix @@ -0,0 +1,45 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.whitebophir; +in { + options = { + services.whitebophir = { + enable = mkEnableOption "whitebophir, an online collaborative whiteboard server (persistent state will be maintained under <filename>/var/lib/whitebophir</filename>)"; + + package = mkOption { + default = pkgs.whitebophir; + defaultText = "pkgs.whitebophir"; + type = types.package; + description = "Whitebophir package to use."; + }; + + port = mkOption { + type = types.port; + default = 5001; + description = "Port to bind to."; + }; + }; + }; + + config = mkIf cfg.enable { + systemd.services.whitebophir = { + description = "Whitebophir Service"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + environment = { + PORT = "${toString cfg.port}"; + WBO_HISTORY_DIR = "/var/lib/whitebophir"; + }; + + serviceConfig = { + DynamicUser = true; + ExecStart = "${cfg.package}/bin/whitebophir"; + Restart = "always"; + StateDirectory = "whitebophir"; + }; + }; + }; +} diff --git a/nixos/modules/services/web-apps/zabbix.nix b/nixos/modules/services/web-apps/zabbix.nix index 0071951283478..e94861a90b5a8 100644 --- a/nixos/modules/services/web-apps/zabbix.nix +++ b/nixos/modules/services/web-apps/zabbix.nix @@ -3,7 +3,7 @@ let inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption types; - inherit (lib) literalExample mapAttrs optionalString; + inherit (lib) literalExample mapAttrs optionalString versionAtLeast; cfg = config.services.zabbixWeb; fpm = config.services.phpfpm.pools.zabbix; @@ -28,6 +28,8 @@ let $ZBX_SERVER_PORT = '${toString cfg.server.port}'; $ZBX_SERVER_NAME = '''; $IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG; + + ${cfg.extraConfig} ''; in @@ -143,6 +145,14 @@ in ''; }; + extraConfig = mkOption { + type = types.lines; + default = ""; + description = '' + Additional configuration to be copied verbatim into <filename>zabbix.conf.php</filename>. + ''; + }; + }; }; @@ -150,6 +160,10 @@ in config = mkIf cfg.enable { + services.zabbixWeb.extraConfig = optionalString ((versionAtLeast config.system.stateVersion "20.09") && (versionAtLeast cfg.package.version "5.0.0")) '' + $DB['DOUBLE_IEEE754'] = 'true'; + ''; + systemd.tmpfiles.rules = [ "d '${stateDir}' 0750 ${user} ${group} - -" "d '${stateDir}/session' 0750 ${user} ${config.services.httpd.group} - -" diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix index dc78728d66360..de3c7d693d47b 100644 --- a/nixos/modules/services/web-servers/apache-httpd/default.nix +++ b/nixos/modules/services/web-servers/apache-httpd/default.nix @@ -126,6 +126,13 @@ let </IfModule> ''; + luaSetPaths = '' + <IfModule mod_lua.c> + LuaPackageCPath ${cfg.package.lua5}/lib/lua/${cfg.package.lua5.lua.luaversion}/?.so + LuaPackagePath ${cfg.package.lua5}/share/lua/${cfg.package.lua5.lua.luaversion}/?.lua + </IfModule> + ''; + mkVHostConf = hostOpts: let adminAddr = if hostOpts.adminAddr != null then hostOpts.adminAddr else cfg.adminAddr; @@ -326,6 +333,8 @@ let ${sslConf} + ${if cfg.package.luaSupport then luaSetPaths else ""} + # Fascist default - deny access to everything. <Directory /> Options FollowSymLinks diff --git a/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix b/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix index 173c0f8561c0f..394f9a305546c 100644 --- a/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix +++ b/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix @@ -112,7 +112,7 @@ in acmeRoot = mkOption { type = types.str; - default = "/var/lib/acme/acme-challenges"; + default = "/var/lib/acme/acme-challenge"; description = "Directory for the acme challenge which is PUBLIC, don't put certs or keys in here"; }; diff --git a/nixos/modules/services/web-servers/caddy.nix b/nixos/modules/services/web-servers/caddy.nix index 297b732733927..6ecfc113ca26b 100644 --- a/nixos/modules/services/web-servers/caddy.nix +++ b/nixos/modules/services/web-servers/caddy.nix @@ -20,8 +20,24 @@ let --config ${configFile} --adapter ${cfg.adapter} > $out ''; tlsJSON = pkgs.writeText "tls.json" (builtins.toJSON tlsConfig); - configJSON = pkgs.runCommand "caddy-config.json" { } '' - ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${adaptedConfig} ${tlsJSON} > $out + + # merge the TLS config options we expose with the ones originating in the Caddyfile + configJSON = + let tlsConfigMerge = '' + {"apps": + {"tls": + {"automation": + {"policies": + (if .[0].apps.tls.automation.policies == .[1]?.apps.tls.automation.policies + then .[0].apps.tls.automation.policies + else (.[0].apps.tls.automation.policies + .[1]?.apps.tls.automation.policies) + end) + } + } + } + }''; + in pkgs.runCommand "caddy-config.json" { } '' + ${pkgs.jq}/bin/jq -s '.[0] * ${tlsConfigMerge}' ${adaptedConfig} ${tlsJSON} > $out ''; in { imports = [ diff --git a/nixos/modules/services/web-servers/jboss/default.nix b/nixos/modules/services/web-servers/jboss/default.nix index ca5b8635fc006..d243e0f3f1b78 100644 --- a/nixos/modules/services/web-servers/jboss/default.nix +++ b/nixos/modules/services/web-servers/jboss/default.nix @@ -31,32 +31,38 @@ in tempDir = mkOption { default = "/tmp"; + type = types.str; description = "Location where JBoss stores its temp files"; }; logDir = mkOption { default = "/var/log/jboss"; + type = types.str; description = "Location of the logfile directory of JBoss"; }; serverDir = mkOption { description = "Location of the server instance files"; default = "/var/jboss/server"; + type = types.str; }; deployDir = mkOption { description = "Location of the deployment files"; default = "/nix/var/nix/profiles/default/server/default/deploy/"; + type = types.str; }; libUrl = mkOption { default = "file:///nix/var/nix/profiles/default/server/default/lib"; description = "Location where the shared library JARs are stored"; + type = types.str; }; user = mkOption { default = "nobody"; description = "User account under which jboss runs."; + type = types.str; }; useJK = mkOption { diff --git a/nixos/modules/services/web-servers/lighttpd/default.nix b/nixos/modules/services/web-servers/lighttpd/default.nix index 7a3df26e47a6c..d1cb8a8dc2584 100644 --- a/nixos/modules/services/web-servers/lighttpd/default.nix +++ b/nixos/modules/services/web-servers/lighttpd/default.nix @@ -193,7 +193,7 @@ in configText = mkOption { default = ""; type = types.lines; - example = ''...verbatim config file contents...''; + example = "...verbatim config file contents..."; description = '' Overridable config file contents to use for lighttpd. By default, use the contents automatically generated by NixOS. diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index e9630d379f36c..29cb7cedcb0f9 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -27,6 +27,33 @@ let ) cfg.virtualHosts; enableIPv6 = config.networking.enableIPv6; + defaultFastcgiParams = { + SCRIPT_FILENAME = "$document_root$fastcgi_script_name"; + QUERY_STRING = "$query_string"; + REQUEST_METHOD = "$request_method"; + CONTENT_TYPE = "$content_type"; + CONTENT_LENGTH = "$content_length"; + + SCRIPT_NAME = "$fastcgi_script_name"; + REQUEST_URI = "$request_uri"; + DOCUMENT_URI = "$document_uri"; + DOCUMENT_ROOT = "$document_root"; + SERVER_PROTOCOL = "$server_protocol"; + REQUEST_SCHEME = "$scheme"; + HTTPS = "$https if_not_empty"; + + GATEWAY_INTERFACE = "CGI/1.1"; + SERVER_SOFTWARE = "nginx/$nginx_version"; + + REMOTE_ADDR = "$remote_addr"; + REMOTE_PORT = "$remote_port"; + SERVER_ADDR = "$server_addr"; + SERVER_PORT = "$server_port"; + SERVER_NAME = "$server_name"; + + REDIRECT_STATUS = "200"; + }; + recommendedProxyConfig = pkgs.writeText "nginx-recommended-proxy-headers.conf" '' proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; @@ -179,6 +206,12 @@ let ${cfg.httpConfig} }''} + ${optionalString (cfg.streamConfig != "") '' + stream { + ${cfg.streamConfig} + } + ''} + ${cfg.appendConfig} ''; @@ -283,6 +316,10 @@ let proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; ''} + ${concatStringsSep "\n" + (mapAttrsToList (n: v: ''fastcgi_param ${n} "${v}";'') + (optionalAttrs (config.fastcgiParams != {}) + (defaultFastcgiParams // config.fastcgiParams)))} ${optionalString (config.index != null) "index ${config.index};"} ${optionalString (config.tryFiles != null) "try_files ${config.tryFiles};"} ${optionalString (config.root != null) "root ${config.root};"} @@ -367,6 +404,7 @@ in logError = mkOption { default = "stderr"; + type = types.str; description = " Configures logging. The first parameter defines a file that will store the log. The @@ -390,13 +428,24 @@ in }; config = mkOption { + type = types.str; default = ""; - description = " - Verbatim nginx.conf configuration. - This is mutually exclusive with the structured configuration - via virtualHosts and the recommendedXyzSettings configuration - options. See appendConfig for appending to the generated http block. - "; + description = '' + Verbatim <filename>nginx.conf</filename> configuration. + This is mutually exclusive to any other config option for + <filename>nginx.conf</filename> except for + <itemizedlist> + <listitem><para><xref linkend="opt-services.nginx.appendConfig" /> + </para></listitem> + <listitem><para><xref linkend="opt-services.nginx.httpConfig" /> + </para></listitem> + <listitem><para><xref linkend="opt-services.nginx.logError" /> + </para></listitem> + </itemizedlist> + + If additional verbatim config in addition to other options is needed, + <xref linkend="opt-services.nginx.appendConfig" /> should be used instead. + ''; }; appendConfig = mkOption { @@ -441,6 +490,21 @@ in "; }; + streamConfig = mkOption { + type = types.lines; + default = ""; + example = '' + server { + listen 127.0.0.1:53 udp reuseport; + proxy_timeout 20s; + proxy_pass 192.168.0.1:53535; + } + ''; + description = " + Configuration lines to be set inside the stream block. + "; + }; + eventsConfig = mkOption { type = types.lines; default = ""; diff --git a/nixos/modules/services/web-servers/nginx/location-options.nix b/nixos/modules/services/web-servers/nginx/location-options.nix index f2fc072557256..d8c976f202fd1 100644 --- a/nixos/modules/services/web-servers/nginx/location-options.nix +++ b/nixos/modules/services/web-servers/nginx/location-options.nix @@ -52,7 +52,7 @@ with lib; default = false; example = true; description = '' - Whether to supporty proxying websocket connections with HTTP/1.1. + Whether to support proxying websocket connections with HTTP/1.1. ''; }; @@ -101,6 +101,16 @@ with lib; ''; }; + fastcgiParams = mkOption { + type = types.attrsOf types.str; + default = {}; + description = '' + FastCGI parameters to override. Unlike in the Nginx + configuration file, overriding only some default parameters + won't unset the default values for other parameters. + ''; + }; + extraConfig = mkOption { type = types.lines; default = ""; diff --git a/nixos/modules/services/web-servers/tomcat.nix b/nixos/modules/services/web-servers/tomcat.nix index 6d12925829f78..13fe98402c60e 100644 --- a/nixos/modules/services/web-servers/tomcat.nix +++ b/nixos/modules/services/web-servers/tomcat.nix @@ -74,6 +74,7 @@ in extraGroups = mkOption { default = []; + type = types.listOf types.str; example = [ "users" ]; description = "Defines extra groups to which the tomcat user belongs."; }; diff --git a/nixos/modules/services/web-servers/unit/default.nix b/nixos/modules/services/web-servers/unit/default.nix index 894271d1e55e4..2a264bf2e9a6f 100644 --- a/nixos/modules/services/web-servers/unit/default.nix +++ b/nixos/modules/services/web-servers/unit/default.nix @@ -28,10 +28,12 @@ in { description = "Group account under which unit runs."; }; stateDir = mkOption { + type = types.path; default = "/var/spool/unit"; description = "Unit data directory."; }; logDir = mkOption { + type = types.path; default = "/var/log/unit"; description = "Unit log directory."; }; diff --git a/nixos/modules/services/web-servers/uwsgi.nix b/nixos/modules/services/web-servers/uwsgi.nix index 936e211ec7138..2dfc39c847aa8 100644 --- a/nixos/modules/services/web-servers/uwsgi.nix +++ b/nixos/modules/services/web-servers/uwsgi.nix @@ -5,11 +5,24 @@ with lib; let cfg = config.services.uwsgi; + isEmperor = cfg.instance.type == "emperor"; + + imperialPowers = + [ + # spawn other user processes + "CAP_SETUID" "CAP_SETGID" + "CAP_SYS_CHROOT" + # transfer capabilities + "CAP_SETPCAP" + # create other user sockets + "CAP_CHOWN" + ]; + buildCfg = name: c: let plugins = if any (n: !any (m: m == n) cfg.plugins) (c.plugins or []) - then throw "`plugins` attribute in UWSGI configuration contains plugins not in config.services.uwsgi.plugins" + then throw "`plugins` attribute in uWSGI configuration contains plugins not in config.services.uwsgi.plugins" else c.plugins or cfg.plugins; hasPython = v: filter (n: n == "python${v}") plugins != []; @@ -18,7 +31,7 @@ let python = if hasPython2 && hasPython3 then - throw "`plugins` attribute in UWSGI configuration shouldn't contain both python2 and python3" + throw "`plugins` attribute in uWSGI configuration shouldn't contain both python2 and python3" else if hasPython2 then cfg.package.python2 else if hasPython3 then cfg.package.python3 else null; @@ -43,7 +56,7 @@ let oldPaths = filter (x: x != null) (map getPath env'); in env' ++ [ "PATH=${optionalString (oldPaths != []) "${last oldPaths}:"}${pythonEnv}/bin" ]; } - else if c.type == "emperor" + else if isEmperor then { emperor = if builtins.typeOf c.vassals != "set" then c.vassals else pkgs.buildEnv { @@ -51,7 +64,7 @@ let paths = mapAttrsToList buildCfg c.vassals; }; } // removeAttrs c [ "type" "vassals" ] - else throw "`type` attribute in UWSGI configuration should be either 'normal' or 'emperor'"; + else throw "`type` attribute in uWSGI configuration should be either 'normal' or 'emperor'"; }; in pkgs.writeTextDir "${name}.json" (builtins.toJSON uwsgiCfg); @@ -79,7 +92,7 @@ in { }; instance = mkOption { - type = with lib.types; let + type = with types; let valueType = nullOr (oneOf [ bool int @@ -137,31 +150,66 @@ in { user = mkOption { type = types.str; default = "uwsgi"; - description = "User account under which uwsgi runs."; + description = "User account under which uWSGI runs."; }; group = mkOption { type = types.str; default = "uwsgi"; - description = "Group account under which uwsgi runs."; + description = "Group account under which uWSGI runs."; + }; + + capabilities = mkOption { + type = types.listOf types.str; + apply = caps: caps ++ optionals isEmperor imperialPowers; + default = [ ]; + example = literalExample '' + [ + "CAP_NET_BIND_SERVICE" # bind on ports <1024 + "CAP_NET_RAW" # open raw sockets + ] + ''; + description = '' + Grant capabilities to the uWSGI instance. See the + <literal>capabilities(7)</literal> for available values. + <note> + <para> + uWSGI runs as an unprivileged user (even as Emperor) with the minimal + capabilities required. This option can be used to add fine-grained + permissions without running the service as root. + </para> + <para> + When in Emperor mode, any capability to be inherited by a vassal must + be specified again in the vassal configuration using <literal>cap</literal>. + See the uWSGI <link + xlink:href="https://uwsgi-docs.readthedocs.io/en/latest/Capabilities.html">docs</link> + for more information. + </para> + </note> + ''; }; }; }; config = mkIf cfg.enable { + systemd.tmpfiles.rules = optional (cfg.runDir != "/run/uwsgi") '' + d ${cfg.runDir} 775 ${cfg.user} ${cfg.group} + ''; + systemd.services.uwsgi = { wantedBy = [ "multi-user.target" ]; - preStart = '' - mkdir -p ${cfg.runDir} - chown ${cfg.user}:${cfg.group} ${cfg.runDir} - ''; serviceConfig = { + User = cfg.user; + Group = cfg.group; Type = "notify"; - ExecStart = "${cfg.package}/bin/uwsgi --uid ${cfg.user} --gid ${cfg.group} --json ${buildCfg "server" cfg.instance}/server.json"; + ExecStart = "${cfg.package}/bin/uwsgi --json ${buildCfg "server" cfg.instance}/server.json"; ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; ExecStop = "${pkgs.coreutils}/bin/kill -INT $MAINPID"; NotifyAccess = "main"; KillSignal = "SIGQUIT"; + AmbientCapabilities = cfg.capabilities; + CapabilityBoundingSet = cfg.capabilities; + RuntimeDirectory = mkIf (cfg.runDir == "/run/uwsgi") "uwsgi"; }; }; diff --git a/nixos/modules/services/x11/clight.nix b/nixos/modules/services/x11/clight.nix index 4daf6d8d9db7e..873f425fb8be4 100644 --- a/nixos/modules/services/x11/clight.nix +++ b/nixos/modules/services/x11/clight.nix @@ -11,14 +11,21 @@ let else if isBool v then boolToString v else if isString v then ''"${escape [''"''] v}"'' else if isList v then "[ " + concatMapStringsSep ", " toConf v + " ]" + else if isAttrs v then "\n{\n" + convertAttrs v + "\n}" else abort "clight.toConf: unexpected type (v = ${v})"; - clightConf = pkgs.writeText "clight.conf" - (concatStringsSep "\n" (mapAttrsToList - (name: value: "${toString name} = ${toConf value};") - (filterAttrs - (_: value: value != null) - cfg.settings))); + getSep = v: + if isAttrs v then ":" + else "="; + + convertAttrs = attrs: concatStringsSep "\n" (mapAttrsToList + (name: value: "${toString name} ${getSep value} ${toConf value};") + attrs); + + clightConf = pkgs.writeText "clight.conf" (convertAttrs + (filterAttrs + (_: value: value != null) + cfg.settings)); in { options.services.clight = { enable = mkOption { @@ -49,9 +56,10 @@ in { }; settings = let - validConfigTypes = with types; either int (either str (either bool float)); + validConfigTypes = with types; oneOf [ int str bool float ]; + collectionTypes = with types; oneOf [ validConfigTypes (listOf validConfigTypes) ]; in mkOption { - type = with types; attrsOf (nullOr (either validConfigTypes (listOf validConfigTypes))); + type = with types; attrsOf (nullOr (either collectionTypes (attrsOf collectionTypes))); default = {}; example = { captures = 20; gamma_long_transition = true; ac_capture_timeouts = [ 120 300 60 ]; }; description = '' @@ -69,10 +77,10 @@ in { services.upower.enable = true; services.clight.settings = { - gamma_temp = with cfg.temperature; mkDefault [ day night ]; + gamma.temp = with cfg.temperature; mkDefault [ day night ]; } // (optionalAttrs (config.location.provider == "manual") { - latitude = mkDefault config.location.latitude; - longitude = mkDefault config.location.longitude; + daytime.latitude = mkDefault config.location.latitude; + daytime.longitude = mkDefault config.location.longitude; }); services.geoclue2.appConfig.clightc = { diff --git a/nixos/modules/services/x11/desktop-managers/cinnamon.nix b/nixos/modules/services/x11/desktop-managers/cinnamon.nix index a404143a03d4b..14dcf009a7d13 100644 --- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix +++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix @@ -25,6 +25,7 @@ in sessionPath = mkOption { default = []; + type = types.listOf types.package; example = literalExample "[ pkgs.gnome3.gpaste ]"; description = '' Additional list of packages to be added to the session search path. diff --git a/nixos/modules/services/x11/desktop-managers/gnome3.nix b/nixos/modules/services/x11/desktop-managers/gnome3.nix index 68a65d77d62f0..671301246a8c7 100644 --- a/nixos/modules/services/x11/desktop-managers/gnome3.nix +++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix @@ -19,7 +19,7 @@ let defaultFavoriteAppsOverride = '' [org.gnome.shell] - favorite-apps=[ 'org.gnome.Geary.desktop', 'org.gnome.Calendar.desktop', 'org.gnome.Music.desktop', 'org.gnome.Photos.desktop', 'org.gnome.Nautilus.desktop' ] + favorite-apps=[ 'org.gnome.Epiphany.desktop', 'org.gnome.Geary.desktop', 'org.gnome.Calendar.desktop', 'org.gnome.Music.desktop', 'org.gnome.Photos.desktop', 'org.gnome.Nautilus.desktop' ] ''; nixos-gsettings-desktop-schemas = let @@ -118,6 +118,7 @@ in sessionPath = mkOption { default = []; + type = types.listOf types.package; example = literalExample "[ pkgs.gnome3.gpaste ]"; description = '' Additional list of packages to be added to the session search path. @@ -409,9 +410,7 @@ in baobab cheese eog - /* Not in good standing on nixos: - * https://github.com/NixOS/nixpkgs/issues/98819 - /* epiphany */ + epiphany gedit gnome-calculator gnome-calendar diff --git a/nixos/modules/services/x11/desktop-managers/pantheon.nix b/nixos/modules/services/x11/desktop-managers/pantheon.nix index cf02a71248b17..195da75e74437 100644 --- a/nixos/modules/services/x11/desktop-managers/pantheon.nix +++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix @@ -42,6 +42,7 @@ in sessionPath = mkOption { default = []; + type = types.listOf types.package; example = literalExample "[ pkgs.gnome3.gpaste ]"; description = '' Additional list of packages to be added to the session search path. diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix index 8cc579af2ca09..d6cf86d3a2e61 100644 --- a/nixos/modules/services/x11/desktop-managers/plasma5.nix +++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix @@ -7,9 +7,8 @@ let xcfg = config.services.xserver; cfg = xcfg.desktopManager.plasma5; - inherit (pkgs) kdeApplications kdeFrameworks plasma5; - libsForQt5 = pkgs.libsForQt514; - qt5 = pkgs.qt514; + libsForQt5 = pkgs.plasma5Packages; + inherit (libsForQt5) kdeApplications kdeFrameworks plasma5; inherit (pkgs) writeText; pulseaudio = config.hardware.pulseaudio; @@ -199,8 +198,8 @@ in }; security.wrappers = { - kcheckpass.source = "${lib.getBin plasma5.kscreenlocker}/libexec/kcheckpass"; - start_kdeinit.source = "${lib.getBin pkgs.kdeFrameworks.kinit}/libexec/kf5/start_kdeinit"; + kcheckpass.source = "${lib.getBin libsForQt5.kscreenlocker}/libexec/kcheckpass"; + start_kdeinit.source = "${lib.getBin libsForQt5.kinit}/libexec/kf5/start_kdeinit"; kwin_wayland = { source = "${lib.getBin plasma5.kwin}/bin/kwin_wayland"; capabilities = "cap_sys_nice+ep"; @@ -214,7 +213,7 @@ in ''; environment.systemPackages = - with qt5; with libsForQt5; + with libsForQt5; with plasma5; with kdeApplications; with kdeFrameworks; [ frameworkintegration @@ -238,6 +237,7 @@ in kidletime kimageformats kinit + kirigami2 # In system profile for SDDM theme. TODO: wrapper. kio kjobwidgets knewstuff diff --git a/nixos/modules/services/x11/display-managers/default.nix b/nixos/modules/services/x11/display-managers/default.nix index 6945a241f92fc..9fdbe753dad50 100644 --- a/nixos/modules/services/x11/display-managers/default.nix +++ b/nixos/modules/services/x11/display-managers/default.nix @@ -444,8 +444,8 @@ in in # We will generate every possible pair of WM and DM. concatLists ( - crossLists - (dm: wm: let + builtins.map + ({dm, wm}: let sessionName = "${dm.name}${optionalString (wm.name != "none") ("+" + wm.name)}"; script = xsession dm wm; desktopNames = if dm ? desktopNames @@ -472,7 +472,7 @@ in providedSessions = [ sessionName ]; }) ) - [dms wms] + (cartesianProductOfSets { dm = dms; wm = wms; }) ); # Make xsessions and wayland sessions available in XDG_DATA_DIRS diff --git a/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix b/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix index de932e6e840ae..9c1dc1d1c12d9 100644 --- a/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix +++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix @@ -88,6 +88,7 @@ in cursorTheme = { package = mkOption { + type = types.package; default = pkgs.gnome3.adwaita-icon-theme; defaultText = "pkgs.gnome3.adwaita-icon-theme"; description = '' diff --git a/nixos/modules/services/x11/display-managers/sddm.nix b/nixos/modules/services/x11/display-managers/sddm.nix index a39bb55b38c40..116994db1c140 100644 --- a/nixos/modules/services/x11/display-managers/sddm.nix +++ b/nixos/modules/services/x11/display-managers/sddm.nix @@ -1,102 +1,94 @@ { config, lib, pkgs, ... }: with lib; - let - xcfg = config.services.xserver; dmcfg = xcfg.displayManager; cfg = dmcfg.sddm; xEnv = config.systemd.services.display-manager.environment; - sddm = if config.services.xserver.desktopManager.lxqt.enable then - # TODO: Move lxqt to libsForQt515 - pkgs.libsForQt514.sddm - else - pkgs.libsForQt5.sddm - ; + sddm = pkgs.libsForQt5.sddm; + + iniFmt = pkgs.formats.ini { }; - xserverWrapper = pkgs.writeScript "xserver-wrapper" '' - #!/bin/sh + xserverWrapper = pkgs.writeShellScript "xserver-wrapper" '' ${concatMapStrings (n: "export ${n}=\"${getAttr n xEnv}\"\n") (attrNames xEnv)} exec systemd-cat -t xserver-wrapper ${dmcfg.xserverBin} ${toString dmcfg.xserverArgs} "$@" ''; - Xsetup = pkgs.writeScript "Xsetup" '' - #!/bin/sh + Xsetup = pkgs.writeShellScript "Xsetup" '' ${cfg.setupScript} ${dmcfg.setupCommands} ''; - Xstop = pkgs.writeScript "Xstop" '' - #!/bin/sh + Xstop = pkgs.writeShellScript "Xstop" '' ${cfg.stopScript} ''; - cfgFile = pkgs.writeText "sddm.conf" '' - [General] - HaltCommand=/run/current-system/systemd/bin/systemctl poweroff - RebootCommand=/run/current-system/systemd/bin/systemctl reboot - ${optionalString cfg.autoNumlock '' - Numlock=on - ''} - - [Theme] - Current=${cfg.theme} - ThemeDir=/run/current-system/sw/share/sddm/themes - FacesDir=/run/current-system/sw/share/sddm/faces - - [Users] - MaximumUid=${toString config.ids.uids.nixbld} - HideUsers=${concatStringsSep "," dmcfg.hiddenUsers} - HideShells=/run/current-system/sw/bin/nologin - - [X11] - MinimumVT=${toString (if xcfg.tty != null then xcfg.tty else 7)} - ServerPath=${xserverWrapper} - XephyrPath=${pkgs.xorg.xorgserver.out}/bin/Xephyr - SessionCommand=${dmcfg.sessionData.wrapper} - SessionDir=${dmcfg.sessionData.desktops}/share/xsessions - XauthPath=${pkgs.xorg.xauth}/bin/xauth - DisplayCommand=${Xsetup} - DisplayStopCommand=${Xstop} - EnableHidpi=${boolToString cfg.enableHidpi} - - [Wayland] - EnableHidpi=${boolToString cfg.enableHidpi} - SessionDir=${dmcfg.sessionData.desktops}/share/wayland-sessions - - ${optionalString dmcfg.autoLogin.enable '' - [Autologin] - User=${dmcfg.autoLogin.user} - Session=${autoLoginSessionName}.desktop - Relogin=${boolToString cfg.autoLogin.relogin} - ''} - - ${cfg.extraConfig} - ''; + defaultConfig = { + General = { + HaltCommand = "/run/current-system/systemd/bin/systemctl poweroff"; + RebootCommand = "/run/current-system/systemd/bin/systemctl reboot"; + Numlock = if cfg.autoNumlock then "on" else "none"; # on, off none + }; + + Theme = { + Current = cfg.theme; + ThemeDir = "/run/current-system/sw/share/sddm/themes"; + FacesDir = "/run/current-system/sw/share/sddm/faces"; + }; + + Users = { + MaximumUid = config.ids.uids.nixbld; + HideUsers = concatStringsSep "," dmcfg.hiddenUsers; + HideShells = "/run/current-system/sw/bin/nologin"; + }; - autoLoginSessionName = dmcfg.sessionData.autologinSession; + X11 = { + MinimumVT = if xcfg.tty != null then xcfg.tty else 7; + ServerPath = toString xserverWrapper; + XephyrPath = "${pkgs.xorg.xorgserver.out}/bin/Xephyr"; + SessionCommand = toString dmcfg.sessionData.wrapper; + SessionDir = "${dmcfg.sessionData.desktops}/share/xsessions"; + XauthPath = "${pkgs.xorg.xauth}/bin/xauth"; + DisplayCommand = toString Xsetup; + DisplayStopCommand = toString Xstop; + EnableHiDPI = cfg.enableHidpi; + }; + + Wayland = { + EnableHiDPI = cfg.enableHidpi; + SessionDir = "${dmcfg.sessionData.desktops}/share/wayland-sessions"; + }; + } // lib.optionalAttrs dmcfg.autoLogin.enable { + Autologin = { + User = dmcfg.autoLogin.user; + Session = autoLoginSessionName; + Relogin = cfg.autoLogin.relogin; + }; + }; + + cfgFile = + iniFmt.generate "sddm.conf" (lib.recursiveUpdate defaultConfig cfg.settings); + + autoLoginSessionName = + "${dmcfg.sessionData.autologinSession}.desktop"; in { imports = [ - (mkRemovedOptionModule [ "services" "xserver" "displayManager" "sddm" "themes" ] + (mkRemovedOptionModule + [ "services" "xserver" "displayManager" "sddm" "themes" ] "Set the option `services.xserver.displayManager.sddm.package' instead.") - (mkRenamedOptionModule [ "services" "xserver" "displayManager" "sddm" "autoLogin" "enable" ] [ - "services" - "xserver" - "displayManager" - "autoLogin" - "enable" - ]) - (mkRenamedOptionModule [ "services" "xserver" "displayManager" "sddm" "autoLogin" "user" ] [ - "services" - "xserver" - "displayManager" - "autoLogin" - "user" - ]) + (mkRenamedOptionModule + [ "services" "xserver" "displayManager" "sddm" "autoLogin" "enable" ] + [ "services" "xserver" "displayManager" "autoLogin" "enable" ]) + (mkRenamedOptionModule + [ "services" "xserver" "displayManager" "sddm" "autoLogin" "user" ] + [ "services" "xserver" "displayManager" "autoLogin" "user" ]) + (mkRemovedOptionModule + [ "services" "xserver" "displayManager" "sddm" "extraConfig" ] + "Set the option `services.xserver.displayManager.sddm.settings' instead.") ]; options = { @@ -115,22 +107,22 @@ in default = true; description = '' Whether to enable automatic HiDPI mode. - </para> - <para> - Versions up to 0.17 are broken so this only works from 0.18 onwards. ''; }; - extraConfig = mkOption { - type = types.lines; - default = ""; + settings = mkOption { + type = iniFmt.type; + default = { }; example = '' - [Autologin] - User=john - Session=plasma.desktop + { + Autologin = { + User = "john"; + Session = "plasma.desktop"; + }; + } ''; description = '' - Extra lines appended to the configuration of SDDM. + Extra settings merged in and overwritting defaults in sddm.conf. ''; }; @@ -173,28 +165,38 @@ in }; # Configuration for automatic login specific to SDDM - autoLogin.relogin = mkOption { - type = types.bool; - default = false; - description = '' - If true automatic login will kick in again on session exit (logout), otherwise it - will only log in automatically when the display-manager is started. - ''; + autoLogin = { + relogin = mkOption { + type = types.bool; + default = false; + description = '' + If true automatic login will kick in again on session exit (logout), otherwise it + will only log in automatically when the display-manager is started. + ''; + }; + + minimumUid = mkOption { + type = types.ints.u16; + default = 1000; + description = '' + Minimum user ID for auto-login user. + ''; + }; }; - }; - }; config = mkIf cfg.enable { assertions = [ - { assertion = xcfg.enable; + { + assertion = xcfg.enable; message = '' SDDM requires services.xserver.enable to be true ''; } - { assertion = dmcfg.autoLogin.enable -> autoLoginSessionName != null; + { + assertion = dmcfg.autoLogin.enable -> autoLoginSessionName != null; message = '' SDDM auto-login requires that services.xserver.displayManager.defaultSession is set. ''; @@ -235,7 +237,7 @@ in sddm-autologin.text = '' auth requisite pam_nologin.so - auth required pam_succeed_if.so uid >= 1000 quiet + auth required pam_succeed_if.so uid >= ${toString cfg.autoLogin.minimumUid} quiet auth required pam_permit.so account include sddm diff --git a/nixos/modules/services/x11/display-managers/startx.nix b/nixos/modules/services/x11/display-managers/startx.nix index 3980203b9457f..6cd46cdf96498 100644 --- a/nixos/modules/services/x11/display-managers/startx.nix +++ b/nixos/modules/services/x11/display-managers/startx.nix @@ -39,6 +39,18 @@ in displayManager.lightdm.enable = lib.mkForce false; }; systemd.services.display-manager.enable = false; + + # Other displayManagers log to /dev/null because they're services and put + # Xorg's stdout in the journal + # + # To send log to Xorg's default log location ($XDG_DATA_HOME/xorg/), we do + # not specify a log file when running X + services.xserver.logFile = mkDefault null; + + # Implement xserverArgs via xinit's system-wide xserverrc + environment.etc."X11/xinit/xserverrc".source = pkgs.writeShellScript "xserverrc" '' + exec ${pkgs.xorg.xorgserver}/bin/X ${toString config.services.xserver.displayManager.xserverArgs} "$@" + ''; environment.systemPackages = with pkgs; [ xorg.xinit ]; }; diff --git a/nixos/modules/services/x11/hardware/libinput.nix b/nixos/modules/services/x11/hardware/libinput.nix index 9548ecb8ef6da..9b0757153cc2f 100644 --- a/nixos/modules/services/x11/hardware/libinput.nix +++ b/nixos/modules/services/x11/hardware/libinput.nix @@ -3,23 +3,18 @@ with lib; let cfg = config.services.xserver.libinput; - xorgBool = v: if v then "on" else "off"; -in { - options = { - - services.xserver.libinput = { - - enable = mkEnableOption "libinput"; + xorgBool = v: if v then "on" else "off"; + mkConfigForDevice = deviceType: { dev = mkOption { type = types.nullOr types.str; default = null; example = "/dev/input/event0"; description = '' - Path for touchpad device. Set to null to apply to any - auto-detected touchpad. + Path for ${deviceType} device. Set to null to apply to any + auto-detected ${deviceType}. ''; }; @@ -185,14 +180,64 @@ in { Option "DragLockButtons" "L1 B1 L2 B2" ''; description = '' - Additional options for libinput touchpad driver. See + Additional options for libinput ${deviceType} driver. See <citerefentry><refentrytitle>libinput</refentrytitle><manvolnum>4</manvolnum></citerefentry> for available options."; ''; }; - }; + mkX11ConfigForDevice = deviceType: matchIs: '' + Identifier "libinput ${deviceType} configuration" + MatchDriver "libinput" + MatchIs${matchIs} "${xorgBool true}" + ${optionalString (cfg.${deviceType}.dev != null) ''MatchDevicePath "${cfg.${deviceType}.dev}"''} + Option "AccelProfile" "${cfg.${deviceType}.accelProfile}" + ${optionalString (cfg.${deviceType}.accelSpeed != null) ''Option "AccelSpeed" "${cfg.${deviceType}.accelSpeed}"''} + ${optionalString (cfg.${deviceType}.buttonMapping != null) ''Option "ButtonMapping" "${cfg.${deviceType}.buttonMapping}"''} + ${optionalString (cfg.${deviceType}.calibrationMatrix != null) ''Option "CalibrationMatrix" "${cfg.${deviceType}.calibrationMatrix}"''} + ${optionalString (cfg.${deviceType}.clickMethod != null) ''Option "ClickMethod" "${cfg.${deviceType}.clickMethod}"''} + Option "LeftHanded" "${xorgBool cfg.${deviceType}.leftHanded}" + Option "MiddleEmulation" "${xorgBool cfg.${deviceType}.middleEmulation}" + Option "NaturalScrolling" "${xorgBool cfg.${deviceType}.naturalScrolling}" + ${optionalString (cfg.${deviceType}.scrollButton != null) ''Option "ScrollButton" "${toString cfg.${deviceType}.scrollButton}"''} + Option "ScrollMethod" "${cfg.${deviceType}.scrollMethod}" + Option "HorizontalScrolling" "${xorgBool cfg.${deviceType}.horizontalScrolling}" + Option "SendEventsMode" "${cfg.${deviceType}.sendEventsMode}" + Option "Tapping" "${xorgBool cfg.${deviceType}.tapping}" + Option "TappingDragLock" "${xorgBool cfg.${deviceType}.tappingDragLock}" + Option "DisableWhileTyping" "${xorgBool cfg.${deviceType}.disableWhileTyping}" + ${cfg.${deviceType}.additionalOptions} + ''; +in { + + imports = + (map (option: mkRenamedOptionModule ([ "services" "xserver" "libinput" option ]) [ "services" "xserver" "libinput" "touchpad" option ]) [ + "accelProfile" + "accelSpeed" + "buttonMapping" + "calibrationMatrix" + "clickMethod" + "leftHanded" + "middleEmulation" + "naturalScrolling" + "scrollButton" + "scrollMethod" + "horizontalScrolling" + "sendEventsMode" + "tapping" + "tappingDragLock" + "disableWhileTyping" + "additionalOptions" + ]); + + options = { + + services.xserver.libinput = { + enable = mkEnableOption "libinput"; + mouse = mkConfigForDevice "mouse"; + touchpad = mkConfigForDevice "touchpad"; + }; }; @@ -212,32 +257,10 @@ in { services.udev.packages = [ pkgs.libinput.out ]; - services.xserver.config = - '' - # General libinput configuration. - # See CONFIGURATION DETAILS section of man:libinput(4). - Section "InputClass" - Identifier "libinputConfiguration" - MatchDriver "libinput" - ${optionalString (cfg.dev != null) ''MatchDevicePath "${cfg.dev}"''} - Option "AccelProfile" "${cfg.accelProfile}" - ${optionalString (cfg.accelSpeed != null) ''Option "AccelSpeed" "${cfg.accelSpeed}"''} - ${optionalString (cfg.buttonMapping != null) ''Option "ButtonMapping" "${cfg.buttonMapping}"''} - ${optionalString (cfg.calibrationMatrix != null) ''Option "CalibrationMatrix" "${cfg.calibrationMatrix}"''} - ${optionalString (cfg.clickMethod != null) ''Option "ClickMethod" "${cfg.clickMethod}"''} - Option "LeftHanded" "${xorgBool cfg.leftHanded}" - Option "MiddleEmulation" "${xorgBool cfg.middleEmulation}" - Option "NaturalScrolling" "${xorgBool cfg.naturalScrolling}" - ${optionalString (cfg.scrollButton != null) ''Option "ScrollButton" "${toString cfg.scrollButton}"''} - Option "ScrollMethod" "${cfg.scrollMethod}" - Option "HorizontalScrolling" "${xorgBool cfg.horizontalScrolling}" - Option "SendEventsMode" "${cfg.sendEventsMode}" - Option "Tapping" "${xorgBool cfg.tapping}" - Option "TappingDragLock" "${xorgBool cfg.tappingDragLock}" - Option "DisableWhileTyping" "${xorgBool cfg.disableWhileTyping}" - ${cfg.additionalOptions} - EndSection - ''; + services.xserver.inputClassSections = [ + (mkX11ConfigForDevice "mouse" "Pointer") + (mkX11ConfigForDevice "touchpad" "Touchpad") + ]; assertions = [ # already present in synaptics.nix diff --git a/nixos/modules/services/x11/window-managers/clfswm.nix b/nixos/modules/services/x11/window-managers/clfswm.nix index 176c1f461271b..171660c53ac30 100644 --- a/nixos/modules/services/x11/window-managers/clfswm.nix +++ b/nixos/modules/services/x11/window-managers/clfswm.nix @@ -15,10 +15,10 @@ in services.xserver.windowManager.session = singleton { name = "clfswm"; start = '' - ${pkgs.clfswm}/bin/clfswm & + ${pkgs.lispPackages.clfswm}/bin/clfswm & waitPID=$! ''; }; - environment.systemPackages = [ pkgs.clfswm ]; + environment.systemPackages = [ pkgs.lispPackages.clfswm ]; }; } diff --git a/nixos/modules/services/x11/window-managers/default.nix b/nixos/modules/services/x11/window-managers/default.nix index 87702c58727a6..9ca24310e5673 100644 --- a/nixos/modules/services/x11/window-managers/default.nix +++ b/nixos/modules/services/x11/window-managers/default.nix @@ -13,6 +13,7 @@ in ./berry.nix ./bspwm.nix ./cwm.nix + ./clfswm.nix ./dwm.nix ./evilwm.nix ./exwm.nix diff --git a/nixos/modules/services/x11/window-managers/exwm.nix b/nixos/modules/services/x11/window-managers/exwm.nix index 88e13f4dbfb07..4b707d3984969 100644 --- a/nixos/modules/services/x11/window-managers/exwm.nix +++ b/nixos/modules/services/x11/window-managers/exwm.nix @@ -21,6 +21,7 @@ in enable = mkEnableOption "exwm"; loadScript = mkOption { default = "(require 'exwm)"; + type = types.lines; example = literalExample '' (require 'exwm) (exwm-enable) @@ -37,6 +38,7 @@ in description = "Enable an uncustomised exwm configuration."; }; extraPackages = mkOption { + type = types.functionTo (types.listOf types.package); default = self: []; example = literalExample '' epkgs: [ @@ -48,7 +50,7 @@ in description = '' Extra packages available to Emacs. The value must be a function which receives the attrset defined in - <varname>emacsPackages</varname> as the sole argument. + <varname>emacs.pkgs</varname> as the sole argument. ''; }; }; diff --git a/nixos/modules/services/x11/window-managers/xmonad.nix b/nixos/modules/services/x11/window-managers/xmonad.nix index b9013ca1ff9f1..fe8ed38125114 100644 --- a/nixos/modules/services/x11/window-managers/xmonad.nix +++ b/nixos/modules/services/x11/window-managers/xmonad.nix @@ -5,25 +5,37 @@ let inherit (lib) mkOption mkIf optionals literalExample; cfg = config.services.xserver.windowManager.xmonad; + ghcWithPackages = cfg.haskellPackages.ghcWithPackages; + packages = self: cfg.extraPackages self ++ + optionals cfg.enableContribAndExtras + [ self.xmonad-contrib self.xmonad-extras ]; + xmonad-vanilla = pkgs.xmonad-with-packages.override { - ghcWithPackages = cfg.haskellPackages.ghcWithPackages; - packages = self: cfg.extraPackages self ++ - optionals cfg.enableContribAndExtras - [ self.xmonad-contrib self.xmonad-extras ]; + inherit ghcWithPackages packages; }; - xmonad-config = pkgs.writers.writeHaskellBin "xmonad" { - ghc = cfg.haskellPackages.ghc; - libraries = [ cfg.haskellPackages.xmonad ] ++ - cfg.extraPackages cfg.haskellPackages ++ - optionals cfg.enableContribAndExtras - (with cfg.haskellPackages; [ xmonad-contrib xmonad-extras ]); - inherit (cfg) ghcArgs; - } cfg.config; + xmonad-config = + let + xmonadAndPackages = self: [ self.xmonad ] ++ packages self; + xmonadEnv = ghcWithPackages xmonadAndPackages; + configured = pkgs.writers.writeHaskellBin "xmonad" { + ghc = cfg.haskellPackages.ghc; + libraries = xmonadAndPackages cfg.haskellPackages; + inherit (cfg) ghcArgs; + } cfg.config; + in + pkgs.runCommandLocal "xmonad" { + nativeBuildInputs = [ pkgs.makeWrapper ]; + } '' + install -D ${xmonadEnv}/share/man/man1/xmonad.1.gz $out/share/man/man1/xmonad.1.gz + makeWrapper ${configured}/bin/xmonad $out/bin/xmonad \ + --set NIX_GHC "${xmonadEnv}/bin/ghc" \ + --set XMONAD_XMESSAGE "${pkgs.xorg.xmessage}/bin/xmessage" + ''; xmonad = if (cfg.config != null) then xmonad-config else xmonad-vanilla; in { - meta.maintainers = with maintainers; [ lassulus xaverdh ]; + meta.maintainers = with maintainers; [ lassulus xaverdh ivanbrennan ]; options = { services.xserver.windowManager.xmonad = { @@ -41,6 +53,7 @@ in { }; extraPackages = mkOption { + type = types.functionTo (types.listOf types.package); default = self: []; defaultText = "self: []"; example = literalExample '' @@ -72,13 +85,13 @@ in { This setup is then analogous to other (non-NixOS) linux distributions. If you do set this option, you likely want to use "launch" as your - entry point for xmonad (as in the example), to avoid xmonads + entry point for xmonad (as in the example), to avoid xmonad's recompilation logic on startup. Doing so will render the default "mod+q" restart key binding dysfunctional though, because that attempts to call your binary with the "--restart" command line option, unless you implement that yourself. You way mant to bind "mod+q" to <literal>(restart "xmonad" True)</literal> instead, which will just restart - xmonad from PATH. This allows e.g. switching to the new xmonad binary, + xmonad from PATH. This allows e.g. switching to the new xmonad binary after rebuilding your system with nixos-rebuild. If you actually want to run xmonad with a config specified here, but @@ -91,6 +104,7 @@ in { example = '' import XMonad import XMonad.Util.EZConfig (additionalKeys) + import Control.Monad (when) import Text.Printf (printf) import System.Posix.Process (executeFile) import System.Info (arch,os) @@ -99,16 +113,21 @@ in { compiledConfig = printf "xmonad-%s-%s" arch os - compileRestart = whenX (recompile True) . catchIO $ do - dir <- getXMonadDataDir - args <- getArgs - executeFile (dir </> compiledConfig) False args Nothing + compileRestart resume = + whenX (recompile True) $ + when resume writeStateToFile + *> catchIO + ( do + dir <- getXMonadDataDir + args <- getArgs + executeFile (dir </> compiledConfig) False args Nothing + ) main = launch defaultConfig { modMask = mod4Mask -- Use Super instead of Alt , terminal = "urxvt" } `additionalKeys` - [ ( (mod4Mask,xK_r), compileRestart ) + [ ( (mod4Mask,xK_r), compileRestart True) , ( (mod4Mask,xK_q), restart "xmonad" True ) ] ''; }; diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix index 9e971671c474e..8858559d8f27d 100644 --- a/nixos/modules/services/x11/xserver.nix +++ b/nixos/modules/services/x11/xserver.nix @@ -441,6 +441,7 @@ in serverFlagsSection = mkOption { default = ""; + type = types.lines; example = '' Option "BlankTime" "0" @@ -518,6 +519,19 @@ in ''; }; + logFile = mkOption { + type = types.nullOr types.str; + default = "/dev/null"; + example = "/var/log/Xorg.0.log"; + description = '' + Controls the file Xorg logs to. + + The default of <literal>/dev/null</literal> is set so that systemd services (like <literal>displayManagers</literal>) only log to the journal and don't create their own log files. + + Setting this to <literal>null</literal> will not pass the <literal>-logfile</literal> argument to Xorg which allows it to log to its default logfile locations instead (see <literal>man Xorg</literal>). You probably only want this behaviour when running Xorg manually (e.g. via <literal>startx</literal>). + ''; + }; + verbose = mkOption { type = types.nullOr types.int; default = 3; @@ -636,7 +650,7 @@ in xorg.xprop xorg.xauth pkgs.xterm - pkgs.xdg_utils + pkgs.xdg-utils xorg.xf86inputevdev.out # get evdev.4 man page ] ++ optional (elem "virtualbox" cfg.videoDrivers) xorg.xrefresh; @@ -692,11 +706,10 @@ in services.xserver.displayManager.xserverArgs = [ "-config ${configFile}" "-xkbdir" "${cfg.xkbDir}" - # Log at the default verbosity level to stderr rather than /var/log/X.*.log. - "-logfile" "/dev/null" ] ++ optional (cfg.display != null) ":${toString cfg.display}" ++ optional (cfg.tty != null) "vt${toString cfg.tty}" ++ optional (cfg.dpi != null) "-dpi ${toString cfg.dpi}" + ++ optional (cfg.logFile != null) "-logfile ${toString cfg.logFile}" ++ optional (cfg.verbose != null) "-verbose ${toString cfg.verbose}" ++ optional (!cfg.enableTCP) "-nolisten tcp" ++ optional (cfg.autoRepeatDelay != null) "-ardelay ${toString cfg.autoRepeatDelay}" diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix index 03d7e7493230b..b0f77ca3fb8d3 100644 --- a/nixos/modules/system/activation/top-level.nix +++ b/nixos/modules/system/activation/top-level.nix @@ -190,7 +190,7 @@ in system.boot.loader.kernelFile = mkOption { internal = true; - default = pkgs.stdenv.hostPlatform.platform.kernelTarget; + default = pkgs.stdenv.hostPlatform.linux-kernel.target; type = types.str; description = '' Name of the kernel file to be passed to the bootloader. diff --git a/nixos/modules/system/boot/binfmt.nix b/nixos/modules/system/boot/binfmt.nix index 9eeae0c3ef447..cbdf581d73a7f 100644 --- a/nixos/modules/system/boot/binfmt.nix +++ b/nixos/modules/system/boot/binfmt.nix @@ -20,8 +20,14 @@ let optionalString fixBinary "F"; in ":${name}:${type}:${offset'}:${magicOrExtension}:${mask'}:${interpreter}:${flags}"; - activationSnippet = name: { interpreter, ... }: - "ln -sf ${interpreter} /run/binfmt/${name}"; + activationSnippet = name: { interpreter, ... }: '' + rm -f /run/binfmt/${name} + cat > /run/binfmt/${name} << 'EOF' + #!${pkgs.bash}/bin/sh + exec -- ${interpreter} "$@" + EOF + chmod +x /run/binfmt/${name} + ''; getEmulator = system: (lib.systems.elaborate { inherit system; }).emulator pkgs; @@ -260,7 +266,7 @@ in { extra-platforms = ${toString (cfg.emulatedSystems ++ lib.optional pkgs.stdenv.hostPlatform.isx86_64 "i686-linux")} ''; nix.sandboxPaths = lib.mkIf (cfg.emulatedSystems != []) - ([ "/run/binfmt" ] ++ (map (system: dirOf (dirOf (getEmulator system))) cfg.emulatedSystems)); + ([ "/run/binfmt" "${pkgs.bash}" ] ++ (map (system: dirOf (dirOf (getEmulator system))) cfg.emulatedSystems)); environment.etc."binfmt.d/nixos.conf".source = builtins.toFile "binfmt_nixos.conf" (lib.concatStringsSep "\n" (lib.mapAttrsToList makeBinfmtLine config.boot.binfmt.registrations)); diff --git a/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix b/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix index 2d27611946e2c..1437ab3877009 100644 --- a/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix +++ b/nixos/modules/system/boot/loader/generations-dir/generations-dir.nix @@ -12,9 +12,6 @@ let inherit (config.boot.loader.generationsDir) copyKernels; }; - # Temporary check, for nixos to cope both with nixpkgs stdenv-updates and trunk - inherit (pkgs.stdenv.hostPlatform) platform; - in { @@ -59,7 +56,7 @@ in system.build.installBootLoader = generationsDirBuilder; system.boot.loader.id = "generationsDir"; - system.boot.loader.kernelFile = platform.kernelTarget; + system.boot.loader.kernelFile = pkgs.stdenv.hostPlatform.linux-kernel.target; }; } diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix index 09f7641dc9d9d..289c2b199862e 100644 --- a/nixos/modules/system/boot/loader/grub/grub.nix +++ b/nixos/modules/system/boot/loader/grub/grub.nix @@ -327,6 +327,26 @@ in ''; }; + extraInstallCommands = mkOption { + default = ""; + example = literalExample '' + # the example below generates detached signatures that GRUB can verify + # https://www.gnu.org/software/grub/manual/grub/grub.html#Using-digital-signatures + ''${pkgs.findutils}/bin/find /boot -not -path "/boot/efi/*" -type f -name '*.sig' -delete + old_gpg_home=$GNUPGHOME + export GNUPGHOME="$(mktemp -d)" + ''${pkgs.gnupg}/bin/gpg --import ''${priv_key} > /dev/null 2>&1 + ''${pkgs.findutils}/bin/find /boot -not -path "/boot/efi/*" -type f -exec ''${pkgs.gnupg}/bin/gpg --detach-sign "{}" \; > /dev/null 2>&1 + rm -rf $GNUPGHOME + export GNUPGHOME=$old_gpg_home + ''; + type = types.lines; + description = '' + Additional shell commands inserted in the bootloader installer + script after generating menu entries. + ''; + }; + extraPerEntryConfig = mkOption { default = ""; example = "root (hd0)"; @@ -715,7 +735,7 @@ in ${optionalString cfg.enableCryptodisk "export GRUB_ENABLE_CRYPTODISK=y"} '' + flip concatMapStrings cfg.mirroredBoots (args: '' ${pkgs.perl}/bin/perl ${install-grub-pl} ${grubConfig args} $@ - '')); + '') + cfg.extraInstallCommands); system.build.grub = grub; @@ -741,7 +761,7 @@ in + "'boot.loader.grub.mirroredBoots' to make the system bootable."; } { - assertion = cfg.efiSupport || all (c: c < 2) (mapAttrsToList (_: c: c) bootDeviceCounters); + assertion = cfg.efiSupport || all (c: c < 2) (mapAttrsToList (n: c: if n == "nodev" then 0 else c) bootDeviceCounters); message = "You cannot have duplicated devices in mirroredBoots"; } { diff --git a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi-builder.nix b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi-builder.nix index 7eb52e3d021ff..64e106036abd1 100644 --- a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi-builder.nix +++ b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi-builder.nix @@ -1,10 +1,9 @@ -{ pkgs, configTxt }: +{ pkgs, configTxt, firmware ? pkgs.raspberrypifw }: pkgs.substituteAll { src = ./raspberrypi-builder.sh; isExecutable = true; inherit (pkgs) bash; path = [pkgs.coreutils pkgs.gnused pkgs.gnugrep]; - firmware = pkgs.raspberrypifw; - inherit configTxt; + inherit firmware configTxt; } diff --git a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix index 337afe9ef628d..1023361f0b1f6 100644 --- a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix +++ b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix @@ -5,8 +5,6 @@ with lib; let cfg = config.boot.loader.raspberryPi; - inherit (pkgs.stdenv.hostPlatform) platform; - builderUboot = import ./uboot-builder.nix { inherit pkgs configTxt; inherit (cfg) version; }; builderGeneric = import ./raspberrypi-builder.nix { inherit pkgs configTxt; }; @@ -20,7 +18,7 @@ let timeoutStr = if blCfg.timeout == null then "-1" else toString blCfg.timeout; isAarch64 = pkgs.stdenv.hostPlatform.isAarch64; - optional = pkgs.stdenv.lib.optionalString; + optional = pkgs.lib.optionalString; configTxt = pkgs.writeText "config.txt" ('' @@ -60,8 +58,7 @@ in version = mkOption { default = 2; type = types.enum [ 0 1 2 3 4 ]; - description = '' - ''; + description = ""; }; uboot = { @@ -103,6 +100,6 @@ in system.build.installBootLoader = builder; system.boot.loader.id = "raspberrypi"; - system.boot.loader.kernelFile = platform.kernelTarget; + system.boot.loader.kernelFile = pkgs.stdenv.hostPlatform.linux-kernel.target; }; } diff --git a/nixos/modules/system/boot/plymouth.nix b/nixos/modules/system/boot/plymouth.nix index ddf5ef8a0a6af..662576888fc20 100644 --- a/nixos/modules/system/boot/plymouth.nix +++ b/nixos/modules/system/boot/plymouth.nix @@ -9,7 +9,7 @@ let cfg = config.boot.plymouth; - nixosBreezePlymouth = pkgs.plasma5.breeze-plymouth.override { + nixosBreezePlymouth = pkgs.plasma5Packages.breeze-plymouth.override { logoFile = cfg.logo; logoName = "nixos"; osName = "NixOS"; diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix index 84bc9b78076cf..7fe8f4dfb7e3a 100644 --- a/nixos/modules/system/boot/resolved.nix +++ b/nixos/modules/system/boot/resolved.nix @@ -1,4 +1,4 @@ -{ config, lib, ... }: +{ config, pkgs, lib, ... }: with lib; let @@ -150,6 +150,9 @@ in wantedBy = [ "multi-user.target" ]; aliases = [ "dbus-org.freedesktop.resolve1.service" ]; restartTriggers = [ config.environment.etc."systemd/resolved.conf".source ]; + # Upstream bug: https://github.com/systemd/systemd/issues/18078 + # systemd-resolved without libidn2 is broken + environment.LD_LIBRARY_PATH = "${lib.getLib pkgs.libidn2}/lib"; }; environment.etc = { diff --git a/nixos/modules/system/boot/stage-1-init.sh b/nixos/modules/system/boot/stage-1-init.sh index abc1a0af48a63..5b39f34200cdc 100644 --- a/nixos/modules/system/boot/stage-1-init.sh +++ b/nixos/modules/system/boot/stage-1-init.sh @@ -2,6 +2,13 @@ targetRoot=/mnt-root console=tty1 +verbose="@verbose@" + +info() { + if [[ -n "$verbose" ]]; then + echo "$@" + fi +} extraUtils="@extraUtils@" export LD_LIBRARY_PATH=@extraUtils@/lib @@ -55,7 +62,7 @@ EOF echo "Rebooting..." reboot -f else - echo "Continuing..." + info "Continuing..." fi } @@ -63,9 +70,9 @@ trap 'fail' 0 # Print a greeting. -echo -echo "[1;32m<<< NixOS Stage 1 >>>[0m" -echo +info +info "[1;32m<<< NixOS Stage 1 >>>[0m" +info # Make several required directories. mkdir -p /etc/udev @@ -210,14 +217,14 @@ ln -s @modulesClosure@/lib/modules /lib/modules ln -s @modulesClosure@/lib/firmware /lib/firmware echo @extraUtils@/bin/modprobe > /proc/sys/kernel/modprobe for i in @kernelModules@; do - echo "loading module $(basename $i)..." + info "loading module $(basename $i)..." modprobe $i done # Create device nodes in /dev. @preDeviceCommands@ -echo "running udev..." +info "running udev..." ln -sfn /proc/self/fd /dev/fd ln -sfn /proc/self/fd/0 /dev/stdin ln -sfn /proc/self/fd/1 /dev/stdout @@ -235,8 +242,7 @@ udevadm settle # XXX: Use case usb->lvm will still fail, usb->luks->lvm is covered @preLVMCommands@ - -echo "starting device mapper and LVM..." +info "starting device mapper and LVM..." lvm vgchange -ay if test -n "$debug1devices"; then fail; fi @@ -379,7 +385,7 @@ mountFS() { done fi - echo "mounting $device on $mountPoint..." + info "mounting $device on $mountPoint..." mkdir -p "/mnt-root$mountPoint" diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix index 0f5787a192102..44287f3cf09b3 100644 --- a/nixos/modules/system/boot/stage-1.nix +++ b/nixos/modules/system/boot/stage-1.nix @@ -22,7 +22,7 @@ let rootModules = config.boot.initrd.availableKernelModules ++ config.boot.initrd.kernelModules; kernel = modulesTree; firmware = firmware; - allowMissing = true; + allowMissing = false; }; @@ -280,7 +280,7 @@ let inherit (config.system.build) earlyMountScript; - inherit (config.boot.initrd) checkJournalingFS + inherit (config.boot.initrd) checkJournalingFS verbose preLVMCommands preDeviceCommands postDeviceCommands postMountCommands preFailCommands kernelModules; resumeDevices = map (sd: if sd ? device then sd.device else "/dev/disk/by-label/${sd.label}") @@ -308,7 +308,7 @@ let # the initial RAM disk. initialRamdisk = pkgs.makeInitrd { name = "initrd-${kernel-name}"; - inherit (config.boot.initrd) compressor prepend; + inherit (config.boot.initrd) compressor compressorArgs prepend; contents = [ { object = bootStage1; @@ -334,7 +334,9 @@ let # Script to add secret files to the initrd at bootloader update time initialRamdiskSecretAppender = - pkgs.writeScriptBin "append-initrd-secrets" + let + compressorExe = initialRamdisk.compressorExecutableFunction pkgs; + in pkgs.writeScriptBin "append-initrd-secrets" '' #!${pkgs.bash}/bin/bash -e function usage { @@ -376,7 +378,7 @@ let } (cd "$tmp" && find . -print0 | sort -z | cpio -o -H newc -R +0:+0 --reproducible --null) | \ - ${config.boot.initrd.compressor} >> "$1" + ${compressorExe} ${lib.escapeShellArgs initialRamdisk.compressorArgs} >> "$1" ''; in @@ -511,13 +513,33 @@ in }; boot.initrd.compressor = mkOption { - internal = true; - default = "gzip -9n"; - type = types.str; - description = "The compressor to use on the initrd image."; + default = ( + if lib.versionAtLeast config.boot.kernelPackages.kernel.version "5.9" + then "zstd" + else "gzip" + ); + defaultText = "zstd if the kernel supports it (5.9+), gzip if not."; + type = types.unspecified; # We don't have a function type... + description = '' + The compressor to use on the initrd image. May be any of: + + <itemizedlist> + <listitem><para>The name of one of the predefined compressors, see <filename>pkgs/build-support/kernel/initrd-compressor-meta.nix</filename> for the definitions.</para></listitem> + <listitem><para>A function which, given the nixpkgs package set, returns the path to a compressor tool, e.g. <literal>pkgs: "''${pkgs.pigz}/bin/pigz"</literal></para></listitem> + <listitem><para>(not recommended, because it does not work when cross-compiling) the full path to a compressor tool, e.g. <literal>"''${pkgs.pigz}/bin/pigz"</literal></para></listitem> + </itemizedlist> + + The given program should read data from stdin and write it to stdout compressed. + ''; example = "xz"; }; + boot.initrd.compressorArgs = mkOption { + default = null; + type = types.nullOr (types.listOf types.str); + description = "Arguments to pass to the compressor for the initrd image, or null to use the compressor's defaults."; + }; + boot.initrd.secrets = mkOption { default = {}; type = types.attrsOf (types.nullOr types.path); @@ -543,6 +565,23 @@ in description = "Names of supported filesystem types in the initial ramdisk."; }; + boot.initrd.verbose = mkOption { + default = true; + type = types.bool; + description = + '' + Verbosity of the initrd. Please note that disabling verbosity removes + only the mandatory messages generated by the NixOS scripts. For a + completely silent boot, you might also want to set the two following + configuration options: + + <itemizedlist> + <listitem><para><literal>boot.consoleLogLevel = 0;</literal></para></listitem> + <listitem><para><literal>boot.kernelParams = [ "quiet" "udev.log_priority=3" ];</literal></para></listitem> + </itemizedlist> + ''; + }; + boot.loader.supportsInitrdSecrets = mkOption { internal = true; default = false; diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index cbf9e7b49d365..6b672c7b2eb48 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -263,7 +263,7 @@ let } (mkIf (config.preStart != "") { serviceConfig.ExecStartPre = - makeJobScript "${name}-pre-start" config.preStart; + [ (makeJobScript "${name}-pre-start" config.preStart) ]; }) (mkIf (config.script != "") { serviceConfig.ExecStart = @@ -271,7 +271,7 @@ let }) (mkIf (config.postStart != "") { serviceConfig.ExecStartPost = - makeJobScript "${name}-post-start" config.postStart; + [ (makeJobScript "${name}-post-start" config.postStart) ]; }) (mkIf (config.reload != "") { serviceConfig.ExecReload = diff --git a/nixos/modules/system/boot/timesyncd.nix b/nixos/modules/system/boot/timesyncd.nix index 35fb5578b0705..692315dbe99c4 100644 --- a/nixos/modules/system/boot/timesyncd.nix +++ b/nixos/modules/system/boot/timesyncd.nix @@ -16,6 +16,7 @@ with lib; }; servers = mkOption { default = config.networking.timeServers; + type = types.listOf types.str; description = '' The set of NTP servers from which to synchronise. ''; diff --git a/nixos/modules/system/boot/tmp.nix b/nixos/modules/system/boot/tmp.nix index 26eb172210e73..5bb299adb15f0 100644 --- a/nixos/modules/system/boot/tmp.nix +++ b/nixos/modules/system/boot/tmp.nix @@ -30,7 +30,14 @@ with lib; config = { - systemd.additionalUpstreamSystemUnits = optional config.boot.tmpOnTmpfs "tmp.mount"; + systemd.mounts = mkIf config.boot.tmpOnTmpfs [ + { + what = "tmpfs"; + where = "/tmp"; + type = "tmpfs"; + mountConfig.Options = [ "mode=1777" "strictatime" "rw" "nosuid" "nodev" "size=50%" ]; + } + ]; systemd.tmpfiles.rules = optional config.boot.cleanTmpDir "D! /tmp 1777 root root"; diff --git a/nixos/modules/tasks/filesystems.nix b/nixos/modules/tasks/filesystems.nix index a055072f9c967..a9b5b134d889d 100644 --- a/nixos/modules/tasks/filesystems.nix +++ b/nixos/modules/tasks/filesystems.nix @@ -7,8 +7,9 @@ let addCheckDesc = desc: elemType: check: types.addCheck elemType check // { description = "${elemType.description} (with check: ${desc})"; }; - nonEmptyStr = addCheckDesc "non-empty" types.str - (x: x != "" && ! (all (c: c == " " || c == "\t") (stringToCharacters x))); + + isNonEmpty = s: (builtins.match "[ \t\n]*" s) == null; + nonEmptyStr = addCheckDesc "non-empty" types.str isNonEmpty; fileSystems' = toposort fsBefore (attrValues config.fileSystems); @@ -28,10 +29,10 @@ let coreFileSystemOpts = { name, config, ... }: { options = { - mountPoint = mkOption { example = "/mnt/usb"; - type = nonEmptyStr; + type = addCheckDesc "non-empty without trailing slash" types.str + (s: isNonEmpty s && (builtins.match ".+/" s) == null); description = "Location of the mounted the file system."; }; diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix index 5fda24adb9782..ac41ba5f93a4b 100644 --- a/nixos/modules/tasks/filesystems/bcachefs.nix +++ b/nixos/modules/tasks/filesystems/bcachefs.nix @@ -49,8 +49,8 @@ in } (mkIf ((elem "bcachefs" config.boot.initrd.supportedFilesystems) || (bootFs != {})) { - # the cryptographic modules are required only for decryption attempts - boot.initrd.availableKernelModules = [ "bcachefs" "chacha20" "poly1305" ]; + # chacha20 and poly1305 are required only for decryption attempts + boot.initrd.availableKernelModules = [ "bcachefs" "sha256" "chacha20" "poly1305" ]; boot.initrd.extraUtilsCommands = '' copy_bin_and_libs ${pkgs.bcachefs-tools}/bin/bcachefs diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix index 6becc69627356..b750820bfa509 100644 --- a/nixos/modules/tasks/filesystems/zfs.nix +++ b/nixos/modules/tasks/filesystems/zfs.nix @@ -17,20 +17,8 @@ let inInitrd = any (fs: fs == "zfs") config.boot.initrd.supportedFilesystems; inSystem = any (fs: fs == "zfs") config.boot.supportedFilesystems; - enableZfs = inInitrd || inSystem; - - kernel = config.boot.kernelPackages; - - packages = if config.boot.zfs.enableUnstable then { - zfs = kernel.zfsUnstable; - zfsUser = pkgs.zfsUnstable; - } else { - zfs = kernel.zfs; - zfsUser = pkgs.zfs; - }; - autosnapPkg = pkgs.zfstools.override { - zfs = packages.zfsUser; + zfs = cfgZfs.package; }; zfsAutoSnap = "${autosnapPkg}/bin/zfs-auto-snapshot"; @@ -111,6 +99,20 @@ in options = { boot.zfs = { + package = mkOption { + readOnly = true; + type = types.package; + default = if config.boot.zfs.enableUnstable then pkgs.zfsUnstable else pkgs.zfs; + description = "Configured ZFS userland tools package."; + }; + + enabled = mkOption { + readOnly = true; + type = types.bool; + default = inInitrd || inSystem; + description = "True if ZFS filesystem support is enabled"; + }; + enableUnstable = mkOption { type = types.bool; default = false; @@ -354,7 +356,7 @@ in ###### implementation config = mkMerge [ - (mkIf enableZfs { + (mkIf cfgZfs.enabled { assertions = [ { assertion = config.networking.hostId != null; @@ -366,20 +368,24 @@ in } ]; - virtualisation.lxd.zfsSupport = true; - boot = { kernelModules = [ "zfs" ]; - extraModulePackages = with packages; [ zfs ]; + + extraModulePackages = [ + (if config.boot.zfs.enableUnstable then + config.boot.kernelPackages.zfsUnstable + else + config.boot.kernelPackages.zfs) + ]; }; boot.initrd = mkIf inInitrd { kernelModules = [ "zfs" ] ++ optional (!cfgZfs.enableUnstable) "spl"; extraUtilsCommands = '' - copy_bin_and_libs ${packages.zfsUser}/sbin/zfs - copy_bin_and_libs ${packages.zfsUser}/sbin/zdb - copy_bin_and_libs ${packages.zfsUser}/sbin/zpool + copy_bin_and_libs ${cfgZfs.package}/sbin/zfs + copy_bin_and_libs ${cfgZfs.package}/sbin/zdb + copy_bin_and_libs ${cfgZfs.package}/sbin/zpool ''; extraUtilsCommandsTest = mkIf inInitrd '' @@ -433,7 +439,7 @@ in services.zfs.zed.settings = { ZED_EMAIL_PROG = mkDefault "${pkgs.mailutils}/bin/mail"; PATH = lib.makeBinPath [ - packages.zfsUser + cfgZfs.package pkgs.coreutils pkgs.curl pkgs.gawk @@ -461,18 +467,18 @@ in "vdev_clear-led.sh" ] ) - (file: { source = "${packages.zfsUser}/etc/${file}"; }) + (file: { source = "${cfgZfs.package}/etc/${file}"; }) // { "zfs/zed.d/zed.rc".text = zedConf; - "zfs/zpool.d".source = "${packages.zfsUser}/etc/zfs/zpool.d/"; + "zfs/zpool.d".source = "${cfgZfs.package}/etc/zfs/zpool.d/"; }; - system.fsPackages = [ packages.zfsUser ]; # XXX: needed? zfs doesn't have (need) a fsck - environment.systemPackages = [ packages.zfsUser ] + system.fsPackages = [ cfgZfs.package ]; # XXX: needed? zfs doesn't have (need) a fsck + environment.systemPackages = [ cfgZfs.package ] ++ optional cfgSnapshots.enable autosnapPkg; # so the user can run the command to see flags - services.udev.packages = [ packages.zfsUser ]; # to hook zvol naming, etc. - systemd.packages = [ packages.zfsUser ]; + services.udev.packages = [ cfgZfs.package ]; # to hook zvol naming, etc. + systemd.packages = [ cfgZfs.package ]; systemd.services = let getPoolFilesystems = pool: @@ -506,8 +512,8 @@ in environment.ZFS_FORCE = optionalString cfgZfs.forceImportAll "-f"; script = (importLib { # See comments at importLib definition. - zpoolCmd="${packages.zfsUser}/sbin/zpool"; - awkCmd="${pkgs.gawk}/bin/awk"; + zpoolCmd = "${cfgZfs.package}/sbin/zpool"; + awkCmd = "${pkgs.gawk}/bin/awk"; inherit cfgZfs; }) + '' poolImported "${pool}" && exit @@ -522,7 +528,7 @@ in ${optionalString (if isBool cfgZfs.requestEncryptionCredentials then cfgZfs.requestEncryptionCredentials else cfgZfs.requestEncryptionCredentials != []) '' - ${packages.zfsUser}/sbin/zfs list -rHo name,keylocation ${pool} | while IFS=$'\t' read ds kl; do + ${cfgZfs.package}/sbin/zfs list -rHo name,keylocation ${pool} | while IFS=$'\t' read ds kl; do (${optionalString (!isBool cfgZfs.requestEncryptionCredentials) '' if ! echo '${concatStringsSep "\n" cfgZfs.requestEncryptionCredentials}' | grep -qFx "$ds"; then continue @@ -532,10 +538,10 @@ in none ) ;; prompt ) - ${config.systemd.package}/bin/systemd-ask-password "Enter key for $ds:" | ${packages.zfsUser}/sbin/zfs load-key "$ds" + ${config.systemd.package}/bin/systemd-ask-password "Enter key for $ds:" | ${cfgZfs.package}/sbin/zfs load-key "$ds" ;; * ) - ${packages.zfsUser}/sbin/zfs load-key "$ds" + ${cfgZfs.package}/sbin/zfs load-key "$ds" ;; esac) < /dev/null # To protect while read ds kl in case anything reads stdin done @@ -561,7 +567,7 @@ in RemainAfterExit = true; }; script = '' - ${packages.zfsUser}/sbin/zfs set nixos:shutdown-time="$(date)" "${pool}" + ${cfgZfs.package}/sbin/zfs set nixos:shutdown-time="$(date)" "${pool}" ''; }; createZfsService = serv: @@ -587,7 +593,7 @@ in systemd.targets.zfs.wantedBy = [ "multi-user.target" ]; }) - (mkIf (enableZfs && cfgSnapshots.enable) { + (mkIf (cfgZfs.enabled && cfgSnapshots.enable) { systemd.services = let descr = name: if name == "frequent" then "15 mins" else if name == "hourly" then "hour" @@ -625,7 +631,7 @@ in }) snapshotNames); }) - (mkIf (enableZfs && cfgScrub.enable) { + (mkIf (cfgZfs.enabled && cfgScrub.enable) { systemd.services.zfs-scrub = { description = "ZFS pools scrubbing"; after = [ "zfs-import.target" ]; @@ -633,11 +639,11 @@ in Type = "oneshot"; }; script = '' - ${packages.zfsUser}/bin/zpool scrub ${ + ${cfgZfs.package}/bin/zpool scrub ${ if cfgScrub.pools != [] then (concatStringsSep " " cfgScrub.pools) else - "$(${packages.zfsUser}/bin/zpool list -H -o name)" + "$(${cfgZfs.package}/bin/zpool list -H -o name)" } ''; }; @@ -652,18 +658,20 @@ in }; }) - (mkIf (enableZfs && cfgTrim.enable) { + (mkIf (cfgZfs.enabled && cfgTrim.enable) { systemd.services.zpool-trim = { description = "ZFS pools trim"; after = [ "zfs-import.target" ]; - path = [ packages.zfsUser ]; + path = [ cfgZfs.package ]; startAt = cfgTrim.interval; # By default we ignore errors returned by the trim command, in case: # - HDDs are mixed with SSDs # - There is a SSDs in a pool that is currently trimmed. # - There are only HDDs and we would set the system in a degraded state - serviceConfig.ExecStart = ''${pkgs.runtimeShell} -c 'for pool in $(zpool list -H -o name); do zpool trim $pool; done || true' ''; + serviceConfig.ExecStart = "${pkgs.runtimeShell} -c 'for pool in $(zpool list -H -o name); do zpool trim $pool; done || true' "; }; + + systemd.timers.zpool-trim.timerConfig.Persistent = "yes"; }) ]; } diff --git a/nixos/modules/tasks/network-interfaces-systemd.nix b/nixos/modules/tasks/network-interfaces-systemd.nix index 23e1e611a71e9..088bffd7c5084 100644 --- a/nixos/modules/tasks/network-interfaces-systemd.nix +++ b/nixos/modules/tasks/network-interfaces-systemd.nix @@ -93,7 +93,17 @@ in (if i.useDHCP != null then i.useDHCP else false)); address = forEach (interfaceIps i) (ip: "${ip.address}/${toString ip.prefixLength}"); - networkConfig.IPv6PrivacyExtensions = "kernel"; + # IPv6PrivacyExtensions=kernel seems to be broken with networkd. + # Instead of using IPv6PrivacyExtensions=kernel, configure it according to the value of + # `tempAddress`: + networkConfig.IPv6PrivacyExtensions = { + # generate temporary addresses and use them by default + "default" = true; + # generate temporary addresses but keep using the standard EUI-64 ones by default + "enabled" = "prefer-public"; + # completely disable temporary addresses + "disabled" = false; + }.${i.tempAddress}; linkConfig = optionalAttrs (i.macAddress != null) { MACAddress = i.macAddress; } // optionalAttrs (i.mtu != null) { diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix index afb9c5404169f..f730ec82bdf5c 100644 --- a/nixos/modules/tasks/network-interfaces.nix +++ b/nixos/modules/tasks/network-interfaces.nix @@ -398,6 +398,24 @@ in ''; }; + networking.fqdn = mkOption { + readOnly = true; + type = types.str; + default = if (cfg.hostName != "" && cfg.domain != null) + then "${cfg.hostName}.${cfg.domain}" + else throw '' + The FQDN is required but cannot be determined. Please make sure that + both networking.hostName and networking.domain are set properly. + ''; + defaultText = literalExample ''''${networking.hostName}.''${networking.domain}''; + description = '' + The fully qualified domain name (FQDN) of this host. It is the result + of combining networking.hostName and networking.domain. Using this + option will result in an evaluation error if the hostname is empty or + no domain is specified. + ''; + }; + networking.hostId = mkOption { default = null; example = "4e98920d"; diff --git a/nixos/modules/virtualisation/amazon-init.nix b/nixos/modules/virtualisation/amazon-init.nix index 8c12e0e49bf5b..c5470b7af09b0 100644 --- a/nixos/modules/virtualisation/amazon-init.nix +++ b/nixos/modules/virtualisation/amazon-init.nix @@ -7,7 +7,7 @@ let echo "attempting to fetch configuration from EC2 user data..." export HOME=/root - export PATH=${pkgs.lib.makeBinPath [ config.nix.package pkgs.systemd pkgs.gnugrep pkgs.git pkgs.gnutar pkgs.gzip pkgs.gnused config.system.build.nixos-rebuild]}:$PATH + export PATH=${pkgs.lib.makeBinPath [ config.nix.package pkgs.systemd pkgs.gnugrep pkgs.git pkgs.gnutar pkgs.gzip pkgs.gnused pkgs.xz config.system.build.nixos-rebuild]}:$PATH export NIX_PATH=nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos:nixos-config=/etc/nixos/configuration.nix:/nix/var/nix/profiles/per-user/root/channels userData=/etc/ec2-metadata/user-data diff --git a/nixos/modules/virtualisation/azure-agent.nix b/nixos/modules/virtualisation/azure-agent.nix index 81413792eda0a..41f3fa0e6642e 100644 --- a/nixos/modules/virtualisation/azure-agent.nix +++ b/nixos/modules/virtualisation/azure-agent.nix @@ -146,7 +146,7 @@ in services.logrotate = { enable = true; - config = '' + extraConfig = '' /var/log/waagent.log { compress monthly diff --git a/nixos/modules/virtualisation/docker.nix b/nixos/modules/virtualisation/docker.nix index ec257801b3305..b1415bf021dd9 100644 --- a/nixos/modules/virtualisation/docker.nix +++ b/nixos/modules/virtualisation/docker.nix @@ -155,13 +155,12 @@ in users.groups.docker.gid = config.ids.gids.docker; systemd.packages = [ cfg.package ]; - # TODO: remove once docker 20.10 is released - systemd.enableUnifiedCgroupHierarchy = false; - systemd.services.docker = { wantedBy = optional cfg.enableOnBoot "multi-user.target"; + requires = [ "docker.socket" ]; environment = proxy_env; serviceConfig = { + Type = "notify"; ExecStart = [ "" '' @@ -215,13 +214,10 @@ in message = "Option enableNvidia requires 32bit support libraries"; }]; } - (mkIf cfg.enableNvidia { - environment.etc."nvidia-container-runtime/config.toml".source = "${pkgs.nvidia-docker}/etc/config.toml"; - }) ]); imports = [ - (mkRemovedOptionModule ["virtualisation" "docker" "socketActivation"] "This option was removed in favor of starting docker at boot") + (mkRemovedOptionModule ["virtualisation" "docker" "socketActivation"] "This option was removed and socket activation is now always active") ]; } diff --git a/nixos/modules/virtualisation/ec2-amis.nix b/nixos/modules/virtualisation/ec2-amis.nix index 3da63078a2145..892af513b0320 100644 --- a/nixos/modules/virtualisation/ec2-amis.nix +++ b/nixos/modules/virtualisation/ec2-amis.nix @@ -329,24 +329,24 @@ let self = { "20.03".ap-east-1.hvm-ebs = "ami-0d18fdd309cdefa86"; "20.03".sa-east-1.hvm-ebs = "ami-09859378158ae971d"; - # 20.09.1632.a6a3a368dda - "20.09".eu-west-1.hvm-ebs = "ami-01a79d5ce435f4db3"; - "20.09".eu-west-2.hvm-ebs = "ami-0cbe14f32904e6331"; - "20.09".eu-west-3.hvm-ebs = "ami-07f493412d6213de6"; - "20.09".eu-central-1.hvm-ebs = "ami-01d4a0c2248cbfe38"; - "20.09".eu-north-1.hvm-ebs = "ami-0003f54dd99d68e0f"; - "20.09".us-east-1.hvm-ebs = "ami-068a62d478710462d"; - "20.09".us-east-2.hvm-ebs = "ami-01ac677ff61399caa"; - "20.09".us-west-1.hvm-ebs = "ami-04befdb203b4b17f6"; - "20.09".us-west-2.hvm-ebs = "ami-0fb7bd4a43261c6b2"; - "20.09".ca-central-1.hvm-ebs = "ami-06d5ee429f153f856"; - "20.09".ap-southeast-1.hvm-ebs = "ami-0db0304e23c535b2a"; - "20.09".ap-southeast-2.hvm-ebs = "ami-045983c4db7e36447"; - "20.09".ap-northeast-1.hvm-ebs = "ami-0beb18d632cf64e5a"; - "20.09".ap-northeast-2.hvm-ebs = "ami-0dd0316af578862db"; - "20.09".ap-south-1.hvm-ebs = "ami-008d15ced81c88aed"; - "20.09".ap-east-1.hvm-ebs = "ami-071f49713f86ea965"; - "20.09".sa-east-1.hvm-ebs = "ami-05ded1ae35209b5a8"; + # 20.09.2016.19db3e5ea27 + "20.09".eu-west-1.hvm-ebs = "ami-0057cb7d614329fa2"; + "20.09".eu-west-2.hvm-ebs = "ami-0d46f16e0bb0ec8fd"; + "20.09".eu-west-3.hvm-ebs = "ami-0e8985c3ea42f87fe"; + "20.09".eu-central-1.hvm-ebs = "ami-0eed77c38432886d2"; + "20.09".eu-north-1.hvm-ebs = "ami-0be5bcadd632bea14"; + "20.09".us-east-1.hvm-ebs = "ami-0a2cce52b42daccc8"; + "20.09".us-east-2.hvm-ebs = "ami-09378bf487b07a4d8"; + "20.09".us-west-1.hvm-ebs = "ami-09b4337b2a9e77485"; + "20.09".us-west-2.hvm-ebs = "ami-081d3bb5fbee0a1ac"; + "20.09".ca-central-1.hvm-ebs = "ami-020c24c6c607e7ac7"; + "20.09".ap-southeast-1.hvm-ebs = "ami-08f648d5db009e67d"; + "20.09".ap-southeast-2.hvm-ebs = "ami-0be390efaccbd40f9"; + "20.09".ap-northeast-1.hvm-ebs = "ami-0c3311601cbe8f927"; + "20.09".ap-northeast-2.hvm-ebs = "ami-0020146701f4d56cf"; + "20.09".ap-south-1.hvm-ebs = "ami-0117e2bd876bb40d1"; + "20.09".ap-east-1.hvm-ebs = "ami-0c42f97e5b1fda92f"; + "20.09".sa-east-1.hvm-ebs = "ami-021637976b094959d"; latest = self."20.09"; }; in self diff --git a/nixos/modules/virtualisation/google-compute-image.nix b/nixos/modules/virtualisation/google-compute-image.nix index d172ae38fdcfa..e2332df611aa0 100644 --- a/nixos/modules/virtualisation/google-compute-image.nix +++ b/nixos/modules/virtualisation/google-compute-image.nix @@ -43,7 +43,7 @@ in system.build.googleComputeImage = import ../../lib/make-disk-image.nix { name = "google-compute-image"; postVM = '' - PATH=$PATH:${with pkgs; stdenv.lib.makeBinPath [ gnutar gzip ]} + PATH=$PATH:${with pkgs; lib.makeBinPath [ gnutar gzip ]} pushd $out mv $diskImage disk.raw tar -Szcf nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.raw.tar.gz disk.raw diff --git a/nixos/modules/virtualisation/lxc-container.nix b/nixos/modules/virtualisation/lxc-container.nix index d493648401872..e47bd59dc016b 100644 --- a/nixos/modules/virtualisation/lxc-container.nix +++ b/nixos/modules/virtualisation/lxc-container.nix @@ -11,7 +11,7 @@ with lib; users.users.root.initialHashedPassword = mkOverride 150 ""; # Some more help text. - services.mingetty.helpLine = + services.getty.helpLine = '' Log in as "root" with an empty password. diff --git a/nixos/modules/virtualisation/lxd.nix b/nixos/modules/virtualisation/lxd.nix index 3958fc2c1d7c5..4b2adf4cc699b 100644 --- a/nixos/modules/virtualisation/lxd.nix +++ b/nixos/modules/virtualisation/lxd.nix @@ -5,13 +5,12 @@ with lib; let - cfg = config.virtualisation.lxd; - zfsCfg = config.boot.zfs; - -in +in { + imports = [ + (mkRemovedOptionModule [ "virtualisation" "lxd" "zfsPackage" ] "Override zfs in an overlay instead to override it globally") + ]; -{ ###### interface options = { @@ -51,18 +50,10 @@ in ''; }; - zfsPackage = mkOption { - type = types.package; - default = with pkgs; if zfsCfg.enableUnstable then zfsUnstable else zfs; - defaultText = "pkgs.zfs"; - description = '' - The ZFS package to use with LXD. - ''; - }; - zfsSupport = mkOption { type = types.bool; - default = false; + default = config.boot.zfs.enabled; + defaultText = "config.boot.zfs.enabled"; description = '' Enables lxd to use zfs as a storage for containers. @@ -87,7 +78,6 @@ in }; ###### implementation - config = mkIf cfg.enable { environment.systemPackages = [ cfg.package ]; @@ -100,13 +90,17 @@ in packages = [ cfg.lxcPackage ]; }; + # TODO: remove once LXD gets proper support for cgroupsv2 + # (currently most of the e.g. CPU accounting stuff doesn't work) + systemd.enableUnifiedCgroupHierarchy = false; + systemd.services.lxd = { description = "LXD Container Management Daemon"; wantedBy = [ "multi-user.target" ]; after = [ "systemd-udev-settle.service" ]; - path = lib.optional cfg.zfsSupport cfg.zfsPackage; + path = lib.optional config.boot.zfs.enabled config.boot.zfs.package; preStart = '' mkdir -m 0755 -p /var/lib/lxc/rootfs diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix index c721858225c9d..f06977f88fc16 100644 --- a/nixos/modules/virtualisation/nixos-containers.nix +++ b/nixos/modules/virtualisation/nixos-containers.nix @@ -56,10 +56,10 @@ let ip -6 route add $HOST_ADDRESS6 dev eth0 ip -6 route add default via $HOST_ADDRESS6 fi - - ${concatStringsSep "\n" (mapAttrsToList renderExtraVeth cfg.extraVeths)} fi + ${concatStringsSep "\n" (mapAttrsToList renderExtraVeth cfg.extraVeths)} + # Start the regular stage 1 script. exec "$1" '' @@ -170,7 +170,7 @@ let ${concatStringsSep "\n" ( mapAttrsToList (name: cfg: - ''ip link del dev ${name} 2> /dev/null || true '' + "ip link del dev ${name} 2> /dev/null || true " ) cfg.extraVeths )} ''; @@ -185,7 +185,7 @@ let fi '' else - ''${ipcmd} add ${cfg.${attribute}} dev $ifaceHost''; + "${ipcmd} add ${cfg.${attribute}} dev $ifaceHost"; renderExtraVeth = name: cfg: if cfg.hostBridge != null then '' @@ -223,8 +223,8 @@ let ${ipcall cfg "ip route" "$LOCAL_ADDRESS" "localAddress"} ${ipcall cfg "ip -6 route" "$LOCAL_ADDRESS6" "localAddress6"} fi - ${concatStringsSep "\n" (mapAttrsToList renderExtraVeth cfg.extraVeths)} fi + ${concatStringsSep "\n" (mapAttrsToList renderExtraVeth cfg.extraVeths)} '' ); diff --git a/nixos/modules/virtualisation/oci-containers.nix b/nixos/modules/virtualisation/oci-containers.nix index a46dd65eb4910..2dd15e3aba455 100644 --- a/nixos/modules/virtualisation/oci-containers.nix +++ b/nixos/modules/virtualisation/oci-containers.nix @@ -176,10 +176,10 @@ let description = '' Define which other containers this one depends on. They will be added to both After and Requires for the unit. - Use the same name as the attribute under <literal>virtualisation.oci-containers</literal>. + Use the same name as the attribute under <literal>virtualisation.oci-containers.containers</literal>. ''; example = literalExample '' - virtualisation.oci-containers = { + virtualisation.oci-containers.containers = { node1 = {}; node2 = { dependsOn = [ "node1" ]; @@ -217,7 +217,7 @@ let environment = proxy_env; path = - if cfg.backend == "docker" then [ pkgs.docker ] + if cfg.backend == "docker" then [ config.virtualisation.docker.package ] else if cfg.backend == "podman" then [ config.virtualisation.podman.package ] else throw "Unhandled backend: ${cfg.backend}"; @@ -227,29 +227,30 @@ let ${cfg.backend} load -i ${container.imageFile} ''} ''; + + script = concatStringsSep " \\\n " ([ + "exec ${cfg.backend} run" + "--rm" + "--name=${escapeShellArg name}" + "--log-driver=${container.log-driver}" + ] ++ optional (container.entrypoint != null) + "--entrypoint=${escapeShellArg container.entrypoint}" + ++ (mapAttrsToList (k: v: "-e ${escapeShellArg k}=${escapeShellArg v}") container.environment) + ++ map (p: "-p ${escapeShellArg p}") container.ports + ++ optional (container.user != null) "-u ${escapeShellArg container.user}" + ++ map (v: "-v ${escapeShellArg v}") container.volumes + ++ optional (container.workdir != null) "-w ${escapeShellArg container.workdir}" + ++ map escapeShellArg container.extraOptions + ++ [container.image] + ++ map escapeShellArg container.cmd + ); + + preStop = "[ $SERVICE_RESULT = success ] || ${cfg.backend} stop ${name}"; postStop = "${cfg.backend} rm -f ${name} || true"; serviceConfig = { StandardOutput = "null"; StandardError = "null"; - ExecStart = concatStringsSep " \\\n " ([ - "${config.system.path}/bin/${cfg.backend} run" - "--rm" - "--name=${name}" - "--log-driver=${container.log-driver}" - ] ++ optional (container.entrypoint != null) - "--entrypoint=${escapeShellArg container.entrypoint}" - ++ (mapAttrsToList (k: v: "-e ${escapeShellArg k}=${escapeShellArg v}") container.environment) - ++ map (p: "-p ${escapeShellArg p}") container.ports - ++ optional (container.user != null) "-u ${escapeShellArg container.user}" - ++ map (v: "-v ${escapeShellArg v}") container.volumes - ++ optional (container.workdir != null) "-w ${escapeShellArg container.workdir}" - ++ map escapeShellArg container.extraOptions - ++ [container.image] - ++ map escapeShellArg container.cmd - ); - - ExecStop = ''${pkgs.bash}/bin/sh -c "[ $SERVICE_RESULT = success ] || ${cfg.backend} stop ${name}"''; ### There is no generalized way of supporting `reload` for docker ### containers. Some containers may respond well to SIGHUP sent to their diff --git a/nixos/modules/virtualisation/podman.nix b/nixos/modules/virtualisation/podman.nix index f554aeffb451d..98da5a096d911 100644 --- a/nixos/modules/virtualisation/podman.nix +++ b/nixos/modules/virtualisation/podman.nix @@ -1,6 +1,7 @@ { config, lib, pkgs, utils, ... }: let cfg = config.virtualisation.podman; + toml = pkgs.formats.toml { }; inherit (lib) mkOption types; @@ -53,6 +54,14 @@ in ''; }; + enableNvidia = mkOption { + type = types.bool; + default = false; + description = '' + Enable use of NVidia GPUs from within podman containers. + ''; + }; + extraPackages = mkOption { type = with types; listOf package; default = [ ]; @@ -78,21 +87,30 @@ in }; - config = lib.mkIf cfg.enable { - - environment.systemPackages = [ cfg.package ] - ++ lib.optional cfg.dockerCompat dockerCompat; - - environment.etc."cni/net.d/87-podman-bridge.conflist".source = utils.copyFile "${pkgs.podman-unwrapped.src}/cni/87-podman-bridge.conflist"; - - # Enable common /etc/containers configuration - virtualisation.containers.enable = true; - - assertions = [{ - assertion = cfg.dockerCompat -> !config.virtualisation.docker.enable; - message = "Option dockerCompat conflicts with docker"; - }]; - - }; + config = lib.mkIf cfg.enable (lib.mkMerge [ + { + environment.systemPackages = [ cfg.package ] + ++ lib.optional cfg.dockerCompat dockerCompat; + + environment.etc."cni/net.d/87-podman-bridge.conflist".source = utils.copyFile "${pkgs.podman-unwrapped.src}/cni/87-podman-bridge.conflist"; + + virtualisation.containers = { + enable = true; # Enable common /etc/containers configuration + containersConf.extraConfig = lib.optionalString cfg.enableNvidia + (builtins.readFile (toml.generate "podman.nvidia.containers.conf" { + engine = { + conmon_env_vars = [ "PATH=${lib.makeBinPath [ pkgs.nvidia-podman ]}" ]; + runtimes.nvidia = [ "${pkgs.nvidia-podman}/bin/nvidia-container-runtime" ]; + }; + })); + }; + assertions = [ + { + assertion = cfg.dockerCompat -> !config.virtualisation.docker.enable; + message = "Option dockerCompat conflicts with docker"; + } + ]; + } + ]); } diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index 447d1f091c8c9..bf3615f2fe71b 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -136,10 +136,8 @@ let cp ${bootDisk}/efi-vars.fd "$NIX_EFI_VARS" || exit 1 chmod 0644 "$NIX_EFI_VARS" || exit 1 fi - '' else '' - ''} - '' else '' - ''} + '' else ""} + '' else ""} cd $TMPDIR idx=0 @@ -187,8 +185,7 @@ let efiVars=$out/efi-vars.fd cp ${efiVarsDefault} $efiVars chmod 0644 $efiVars - '' else '' - ''} + '' else ""} ''; buildInputs = [ pkgs.util-linux ]; QEMU_OPTS = "-nographic -serial stdio -monitor none" diff --git a/nixos/modules/virtualisation/railcar.nix b/nixos/modules/virtualisation/railcar.nix index 10464f6289846..b603effef6e01 100644 --- a/nixos/modules/virtualisation/railcar.nix +++ b/nixos/modules/virtualisation/railcar.nix @@ -105,7 +105,7 @@ in stateDir = mkOption { type = types.path; - default = ''/var/railcar''; + default = "/var/railcar"; description = "Railcar persistent state directory"; }; diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix index 5ad647769bbd9..5b57ca860da29 100644 --- a/nixos/modules/virtualisation/xen-dom0.nix +++ b/nixos/modules/virtualisation/xen-dom0.nix @@ -57,7 +57,8 @@ in virtualisation.xen.bootParams = mkOption { - default = ""; + default = []; + type = types.listOf types.str; description = '' Parameters passed to the Xen hypervisor at boot time. @@ -68,6 +69,7 @@ in mkOption { default = 0; example = 512; + type = types.addCheck types.int (n: n >= 0); description = '' Amount of memory (in MiB) allocated to Domain 0 on boot. @@ -78,6 +80,7 @@ in virtualisation.xen.bridge = { name = mkOption { default = "xenbr0"; + type = types.str; description = '' Name of bridge the Xen domUs connect to. ''; diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix index 5f8a64702a82a..ea82adf09ad1d 100644 --- a/nixos/release-combined.nix +++ b/nixos/release-combined.nix @@ -145,6 +145,7 @@ in rec { (onFullSupported "nixos.tests.printing") (onFullSupported "nixos.tests.proxy") (onFullSupported "nixos.tests.sddm.default") + (onFullSupported "nixos.tests.shadow") (onFullSupported "nixos.tests.simple") (onFullSupported "nixos.tests.switchTest") (onFullSupported "nixos.tests.udisks2") diff --git a/nixos/release.nix b/nixos/release.nix index 1f5c158126955..109747945f78a 100644 --- a/nixos/release.nix +++ b/nixos/release.nix @@ -79,7 +79,7 @@ let in tarball // { meta = { - description = "NixOS system tarball for ${system} - ${stdenv.hostPlatform.platform.name}"; + description = "NixOS system tarball for ${system} - ${stdenv.hostPlatform.linux-kernel.name}"; maintainers = map (x: lib.maintainers.${x}) maintainers; }; inherit config; @@ -105,7 +105,7 @@ let modules = makeModules module {}; }; build = configEvaled.config.system.build; - kernelTarget = configEvaled.pkgs.stdenv.hostPlatform.platform.kernelTarget; + kernelTarget = configEvaled.pkgs.stdenv.hostPlatform.linux-kernel.target; in pkgs.symlinkJoin { name = "netboot"; diff --git a/nixos/tests/3proxy.nix b/nixos/tests/3proxy.nix index de3056f6710f5..dfc4b35a772dc 100644 --- a/nixos/tests/3proxy.nix +++ b/nixos/tests/3proxy.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "3proxy"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ misuzu ]; }; diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix index eb152cf51a6a8..c6d393d919639 100644 --- a/nixos/tests/acme.nix +++ b/nixos/tests/acme.nix @@ -77,6 +77,27 @@ in import ./make-test-python.nix ({ lib, ... }: { after = [ "acme-a.example.test.service" "nginx-config-reload.service" ]; }; + # Test that account creation is collated into one service + specialisation.account-creation.configuration = { nodes, pkgs, lib, ... }: let + email = "newhostmaster@example.test"; + caDomain = nodes.acme.config.test-support.acme.caDomain; + # Exit 99 to make it easier to track if this is the reason a renew failed + testScript = '' + test -e accounts/${caDomain}/${email}/account.json || exit 99 + ''; + in { + security.acme.email = lib.mkForce email; + systemd.services."b.example.test".preStart = testScript; + systemd.services."c.example.test".preStart = testScript; + + services.nginx.virtualHosts."b.example.test" = (vhostBase pkgs) // { + enableACME = true; + }; + services.nginx.virtualHosts."c.example.test" = (vhostBase pkgs) // { + enableACME = true; + }; + }; + # Cert config changes will not cause the nginx configuration to change. # This tests that the reload service is correctly triggered. # It also tests that postRun is exec'd as root @@ -289,7 +310,7 @@ in import ./make-test-python.nix ({ lib, ... }: { acme.start() webserver.start() - acme.wait_for_unit("default.target") + acme.wait_for_unit("network-online.target") acme.wait_for_unit("pebble.service") client.succeed("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt") @@ -314,6 +335,15 @@ in import ./make-test-python.nix ({ lib, ... }: { check_issuer(webserver, "a.example.test", "pebble") check_connection(client, "a.example.test") + with subtest("Runs 1 cert for account creation before others"): + switch_to(webserver, "account-creation") + webserver.wait_for_unit("acme-finished-a.example.test.target") + check_connection(client, "a.example.test") + webserver.wait_for_unit("acme-finished-b.example.test.target") + webserver.wait_for_unit("acme-finished-c.example.test.target") + check_connection(client, "b.example.test") + check_connection(client, "c.example.test") + with subtest("Can reload web server when cert configuration changes"): switch_to(webserver, "cert-change") webserver.wait_for_unit("acme-finished-a.example.test.target") diff --git a/nixos/tests/agda.nix b/nixos/tests/agda.nix index 3b3eb2803bdd3..3773907cff557 100644 --- a/nixos/tests/agda.nix +++ b/nixos/tests/agda.nix @@ -9,7 +9,7 @@ let in { name = "agda"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ alexarice turion ]; }; @@ -23,6 +23,13 @@ in }; testScript = '' + assert ( + "${pkgs.agdaPackages.lib.interfaceFile "Everything.agda"}" == "Everything.agdai" + ), "wrong interface file for Everything.agda" + assert ( + "${pkgs.agdaPackages.lib.interfaceFile "tmp/Everything.agda.md"}" == "tmp/Everything.agdai" + ), "wrong interface file for tmp/Everything.agda.md" + # Minimal script that typechecks machine.succeed("touch TestEmpty.agda") machine.succeed("agda TestEmpty.agda") @@ -36,6 +43,10 @@ in "cp ${hello-world} HelloWorld.agda" ) machine.succeed("agda -l standard-library -i . -c HelloWorld.agda") + # Check execution + assert "Hello World!" in machine.succeed( + "./HelloWorld" + ), "HelloWorld does not run properly" ''; } ) diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 2e79a214569a7..4ea2dc44d5a33 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -49,7 +49,10 @@ in cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {}; cage = handleTest ./cage.nix {}; cagebreak = handleTest ./cagebreak.nix {}; - cassandra = handleTest ./cassandra.nix {}; + cassandra_2_1 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_2_1; }; + cassandra_2_2 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_2_2; }; + cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; }; + cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; }; ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {}; ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {}; certmgr = handleTest ./certmgr.nix {}; @@ -60,7 +63,6 @@ in clickhouse = handleTest ./clickhouse.nix {}; cloud-init = handleTest ./cloud-init.nix {}; cockroachdb = handleTestOn ["x86_64-linux"] ./cockroachdb.nix {}; - codimd = handleTest ./codimd.nix {}; consul = handleTest ./consul.nix {}; containers-bridge = handleTest ./containers-bridge.nix {}; containers-custom-pkgs.nix = handleTest ./containers-custom-pkgs.nix {}; @@ -88,6 +90,7 @@ in docker-edge = handleTestOn ["x86_64-linux"] ./docker-edge.nix {}; docker-registry = handleTest ./docker-registry.nix {}; docker-tools = handleTestOn ["x86_64-linux"] ./docker-tools.nix {}; + docker-tools-cross = handleTestOn ["x86_64-linux" "aarch64-linux"] ./docker-tools-cross.nix {}; docker-tools-overlay = handleTestOn ["x86_64-linux"] ./docker-tools-overlay.nix {}; documize = handleTest ./documize.nix {}; dokuwiki = handleTest ./dokuwiki.nix {}; @@ -103,6 +106,7 @@ in ergo = handleTest ./ergo.nix {}; etcd = handleTestOn ["x86_64-linux"] ./etcd.nix {}; etcd-cluster = handleTestOn ["x86_64-linux"] ./etcd-cluster.nix {}; + etesync-dav = handleTest ./etesync-dav.nix {}; fancontrol = handleTest ./fancontrol.nix {}; fcitx = handleTest ./fcitx {}; ferm = handleTest ./ferm.nix {}; @@ -142,6 +146,8 @@ in handbrake = handleTestOn ["x86_64-linux"] ./handbrake.nix {}; haproxy = handleTest ./haproxy.nix {}; hardened = handleTest ./hardened.nix {}; + hedgedoc = handleTest ./hedgedoc.nix {}; + herbstluftwm = handleTest ./herbstluftwm.nix {}; installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {}); oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {}; # 9pnet_virtio used to mount /nix partition doesn't support @@ -149,10 +155,12 @@ in # not on other platforms. hibernate = handleTestOn ["x86_64-linux"] ./hibernate.nix {}; hitch = handleTest ./hitch {}; + hledger-web = handleTest ./hledger-web.nix {}; hocker-fetchdocker = handleTest ./hocker-fetchdocker {}; home-assistant = handleTest ./home-assistant.nix {}; hostname = handleTest ./hostname.nix {}; hound = handleTest ./hound.nix {}; + hub = handleTest ./git/hub.nix {}; hydra = handleTest ./hydra {}; i3wm = handleTest ./i3wm.nix {}; icingaweb2 = handleTest ./icingaweb2.nix {}; @@ -163,6 +171,7 @@ in initrd-network-openvpn = handleTest ./initrd-network-openvpn {}; initrd-network-ssh = handleTest ./initrd-network-ssh {}; initrdNetwork = handleTest ./initrd-network.nix {}; + initrd-secrets = handleTest ./initrd-secrets.nix {}; installer = handleTest ./installer.nix {}; iodine = handleTest ./iodine.nix {}; ipfs = handleTest ./ipfs.nix {}; @@ -180,6 +189,7 @@ in kernel-latest = handleTest ./kernel-latest.nix {}; kernel-lts = handleTest ./kernel-lts.nix {}; kernel-testing = handleTest ./kernel-testing.nix {}; + kernel-latest-ath-user-regd = handleTest ./kernel-latest-ath-user-regd.nix {}; keycloak = discoverTests (import ./keycloak.nix); keymap = handleTest ./keymap.nix {}; knot = handleTest ./knot.nix {}; @@ -194,6 +204,7 @@ in lidarr = handleTest ./lidarr.nix {}; lightdm = handleTest ./lightdm.nix {}; limesurvey = handleTest ./limesurvey.nix {}; + locate = handleTest ./locate.nix {}; login = handleTest ./login.nix {}; loki = handleTest ./loki.nix {}; lsd = handleTest ./lsd.nix {}; @@ -204,6 +215,7 @@ in magic-wormhole-mailbox-server = handleTest ./magic-wormhole-mailbox-server.nix {}; magnetico = handleTest ./magnetico.nix {}; mailcatcher = handleTest ./mailcatcher.nix {}; + mailhog = handleTest ./mailhog.nix {}; mariadb-galera-mariabackup = handleTest ./mysql/mariadb-galera-mariabackup.nix {}; mariadb-galera-rsync = handleTest ./mysql/mariadb-galera-rsync.nix {}; matomo = handleTest ./matomo.nix {}; @@ -231,6 +243,7 @@ in mysql-autobackup = handleTest ./mysql/mysql-autobackup.nix {}; mysql-backup = handleTest ./mysql/mysql-backup.nix {}; mysql-replication = handleTest ./mysql/mysql-replication.nix {}; + n8n = handleTest ./n8n.nix {}; nagios = handleTest ./nagios.nix {}; nano = handleTest ./nano.nix {}; nar-serve = handleTest ./nar-serve.nix {}; @@ -261,9 +274,11 @@ in nginx-variants = handleTest ./nginx-variants.nix {}; nix-ssh-serve = handleTest ./nix-ssh-serve.nix {}; nixos-generate-config = handleTest ./nixos-generate-config.nix {}; + nomad = handleTest ./nomad.nix {}; novacomd = handleTestOn ["x86_64-linux"] ./novacomd.nix {}; nsd = handleTest ./nsd.nix {}; nzbget = handleTest ./nzbget.nix {}; + nzbhydra2 = handleTest ./nzbhydra2.nix {}; oh-my-zsh = handleTest ./oh-my-zsh.nix {}; openarena = handleTest ./openarena.nix {}; openldap = handleTest ./openldap.nix {}; @@ -271,6 +286,8 @@ in openssh = handleTest ./openssh.nix {}; openstack-image-metadata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).metadata or {}; openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {}; + opentabletdriver = handleTest ./opentabletdriver.nix {}; + image-contents = handleTest ./image-contents.nix {}; orangefs = handleTest ./orangefs.nix {}; os-prober = handleTestOn ["x86_64-linux"] ./os-prober.nix {}; osrm-backend = handleTest ./osrm-backend.nix {}; @@ -287,6 +304,7 @@ in php = handleTest ./php {}; pinnwand = handleTest ./pinnwand.nix {}; plasma5 = handleTest ./plasma5.nix {}; + pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix {}; plotinus = handleTest ./plotinus.nix {}; podman = handleTestOn ["x86_64-linux"] ./podman.nix {}; postfix = handleTest ./postfix.nix {}; @@ -314,6 +332,7 @@ in redis = handleTest ./redis.nix {}; redmine = handleTest ./redmine.nix {}; restic = handleTest ./restic.nix {}; + ripgrep = handleTest ./ripgrep.nix {}; robustirc-bridge = handleTest ./robustirc-bridge.nix {}; roundcube = handleTest ./roundcube.nix {}; rspamd = handleTest ./rspamd.nix {}; @@ -326,9 +345,10 @@ in sanoid = handleTest ./sanoid.nix {}; sbt = handleTest ./sbt.nix {}; sbt-extras = handleTest ./sbt-extras.nix {}; - scala = handleTest ./scala.nix {}; sddm = handleTest ./sddm.nix {}; + searx = handleTest ./searx.nix {}; service-runner = handleTest ./service-runner.nix {}; + shadow = handleTest ./shadow.nix {}; shadowsocks = handleTest ./shadowsocks {}; shattered-pixel-dungeon = handleTest ./shattered-pixel-dungeon.nix {}; shiori = handleTest ./shiori.nix {}; @@ -369,6 +389,7 @@ in telegraf = handleTest ./telegraf.nix {}; tiddlywiki = handleTest ./tiddlywiki.nix {}; timezone = handleTest ./timezone.nix {}; + tinc = handleTest ./tinc {}; tinydns = handleTest ./tinydns.nix {}; tor = handleTest ./tor.nix {}; # traefik test relies on docker-containers @@ -384,9 +405,11 @@ in unbound = handleTest ./unbound.nix {}; unit-php = handleTest ./web-servers/unit-php.nix {}; upnp = handleTest ./upnp.nix {}; + usbguard = handleTest ./usbguard.nix {}; uwsgi = handleTest ./uwsgi.nix {}; v2ray = handleTest ./v2ray.nix {}; vault = handleTest ./vault.nix {}; + vault-postgresql = handleTest ./vault-postgresql.nix {}; vector = handleTest ./vector.nix {}; victoriametrics = handleTest ./victoriametrics.nix {}; virtualbox = handleTestOn ["x86_64-linux"] ./virtualbox.nix {}; @@ -402,6 +425,7 @@ in xterm = handleTest ./xterm.nix {}; yabar = handleTest ./yabar.nix {}; yggdrasil = handleTest ./yggdrasil.nix {}; + yq = handleTest ./yq.nix {}; zfs = handleTest ./zfs.nix {}; zigbee2mqtt = handleTest ./zigbee2mqtt.nix {}; zoneminder = handleTest ./zoneminder.nix {}; diff --git a/nixos/tests/ammonite.nix b/nixos/tests/ammonite.nix index e9f06358e13f6..4b674f35e3cb0 100644 --- a/nixos/tests/ammonite.nix +++ b/nixos/tests/ammonite.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "ammonite"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; diff --git a/nixos/tests/atd.nix b/nixos/tests/atd.nix index c3abe5c253df6..ad4d60067cf1e 100644 --- a/nixos/tests/atd.nix +++ b/nixos/tests/atd.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "atd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ bjornfor ]; }; diff --git a/nixos/tests/avahi.nix b/nixos/tests/avahi.nix index c1a9114a40f6f..ebb46838325f3 100644 --- a/nixos/tests/avahi.nix +++ b/nixos/tests/avahi.nix @@ -8,7 +8,7 @@ # Test whether `avahi-daemon' and `libnss-mdns' work as expected. import ./make-test-python.nix { name = "avahi"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco ]; }; diff --git a/nixos/tests/awscli.nix b/nixos/tests/awscli.nix index 35bdd6d99b1a0..e6741fcf14121 100644 --- a/nixos/tests/awscli.nix +++ b/nixos/tests/awscli.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "awscli"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; diff --git a/nixos/tests/babeld.nix b/nixos/tests/babeld.nix index fafa788ba57bb..5817ea4ce142d 100644 --- a/nixos/tests/babeld.nix +++ b/nixos/tests/babeld.nix @@ -1,7 +1,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : { name = "babeld"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ hexa ]; }; diff --git a/nixos/tests/bat.nix b/nixos/tests/bat.nix index 8e65e235d94f4..0f548a590fb02 100644 --- a/nixos/tests/bat.nix +++ b/nixos/tests/bat.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "bat"; - meta = with pkgs.stdenv.lib.maintainers; { maintainers = [ nequissimus ]; }; + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; machine = { pkgs, ... }: { environment.systemPackages = [ pkgs.bat ]; }; diff --git a/nixos/tests/bcachefs.nix b/nixos/tests/bcachefs.nix index 3f116d7df92aa..146225e72ceed 100644 --- a/nixos/tests/bcachefs.nix +++ b/nixos/tests/bcachefs.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "bcachefs"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ chiiruno ]; + meta.maintainers = with pkgs.lib.maintainers; [ chiiruno ]; machine = { pkgs, ... }: { virtualisation.emptyDiskImages = [ 4096 ]; diff --git a/nixos/tests/bitcoind.nix b/nixos/tests/bitcoind.nix index 9068b29b8e5c1..3e9e085287ac0 100644 --- a/nixos/tests/bitcoind.nix +++ b/nixos/tests/bitcoind.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "bitcoind"; - meta = with pkgs.stdenv.lib; { + meta = with pkgs.lib; { maintainers = with maintainers; [ _1000101 ]; }; diff --git a/nixos/tests/bittorrent.nix b/nixos/tests/bittorrent.nix index c195b60cd5695..ee7a582922ce7 100644 --- a/nixos/tests/bittorrent.nix +++ b/nixos/tests/bittorrent.nix @@ -35,7 +35,7 @@ in { name = "bittorrent"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ domenkozar eelco rob bobvanderlinden ]; }; diff --git a/nixos/tests/bitwarden.nix b/nixos/tests/bitwarden.nix index a47c77cec2137..5345c7245d00d 100644 --- a/nixos/tests/bitwarden.nix +++ b/nixos/tests/bitwarden.nix @@ -27,7 +27,7 @@ let makeBitwardenTest = backend: makeTest { name = "bitwarden_rs-${backend}"; meta = { - maintainers = with pkgs.stdenv.lib.maintainers; [ jjjollyjim ]; + maintainers = with pkgs.lib.maintainers; [ jjjollyjim ]; }; nodes = { diff --git a/nixos/tests/blockbook-frontend.nix b/nixos/tests/blockbook-frontend.nix index 742a02999e745..e17a2d0577977 100644 --- a/nixos/tests/blockbook-frontend.nix +++ b/nixos/tests/blockbook-frontend.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "blockbook-frontend"; - meta = with pkgs.stdenv.lib; { + meta = with pkgs.lib; { maintainers = with maintainers; [ _1000101 ]; }; diff --git a/nixos/tests/boot-stage1.nix b/nixos/tests/boot-stage1.nix index cfb2ccb828563..ce86fc5f494df 100644 --- a/nixos/tests/boot-stage1.nix +++ b/nixos/tests/boot-stage1.nix @@ -158,5 +158,5 @@ import ./make-test-python.nix ({ pkgs, ... }: { machine.succeed('pgrep -a -f "^kcanary$"') ''; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ aszlig ]; + meta.maintainers = with pkgs.lib.maintainers; [ aszlig ]; }) diff --git a/nixos/tests/borgbackup.nix b/nixos/tests/borgbackup.nix index bf37eb8607b28..fae1d2d071389 100644 --- a/nixos/tests/borgbackup.nix +++ b/nixos/tests/borgbackup.nix @@ -36,7 +36,7 @@ let in { name = "borgbackup"; - meta = with pkgs.stdenv.lib; { + meta = with pkgs.lib; { maintainers = with maintainers; [ dotlambda ]; }; diff --git a/nixos/tests/buildbot.nix b/nixos/tests/buildbot.nix index 0d979dc2d0540..11f9fbef635ed 100644 --- a/nixos/tests/buildbot.nix +++ b/nixos/tests/buildbot.nix @@ -109,5 +109,5 @@ import ./make-test-python.nix { bbworker.fail("nc -z bbmaster 8011") ''; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ nand0p ]; + meta.maintainers = with pkgs.lib.maintainers; [ nand0p ]; } {} diff --git a/nixos/tests/buildkite-agents.nix b/nixos/tests/buildkite-agents.nix index a6f33e0143c5e..6674a0e884ed3 100644 --- a/nixos/tests/buildkite-agents.nix +++ b/nixos/tests/buildkite-agents.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "buildkite-agent"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ flokli ]; }; diff --git a/nixos/tests/caddy.nix b/nixos/tests/caddy.nix index a21dbec248ab2..063f83a2f3d37 100644 --- a/nixos/tests/caddy.nix +++ b/nixos/tests/caddy.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "caddy"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ xfix Br1ght0ne ]; }; diff --git a/nixos/tests/cadvisor.nix b/nixos/tests/cadvisor.nix index 664aa3ad876af..c372dea301d29 100644 --- a/nixos/tests/cadvisor.nix +++ b/nixos/tests/cadvisor.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... } : { name = "cadvisor"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ offline ]; }; diff --git a/nixos/tests/cage.nix b/nixos/tests/cage.nix index a6f73e00c066e..1ae07b6fd2ff9 100644 --- a/nixos/tests/cage.nix +++ b/nixos/tests/cage.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "cage"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ matthewbauer flokli ]; }; diff --git a/nixos/tests/cagebreak.nix b/nixos/tests/cagebreak.nix index e5f9a29fb18d8..87f43cc3c3216 100644 --- a/nixos/tests/cagebreak.nix +++ b/nixos/tests/cagebreak.nix @@ -9,7 +9,7 @@ let in { name = "cagebreak"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ berbiche ]; }; diff --git a/nixos/tests/cassandra.nix b/nixos/tests/cassandra.nix index 05607956a9d66..bef3105f0a9eb 100644 --- a/nixos/tests/cassandra.nix +++ b/nixos/tests/cassandra.nix @@ -1,7 +1,5 @@ -import ./make-test-python.nix ({ pkgs, lib, ... }: +import ./make-test-python.nix ({ pkgs, lib, testPackage ? pkgs.cassandra, ... }: let - # Change this to test a different version of Cassandra: - testPackage = pkgs.cassandra; clusterName = "NixOS Automated-Test Cluster"; testRemoteAuth = lib.versionAtLeast testPackage.version "3.11"; @@ -47,7 +45,7 @@ let }; in { - name = "cassandra"; + name = "cassandra-${testPackage.version}"; meta = { maintainers = with lib.maintainers; [ johnazoidberg ]; }; @@ -128,4 +126,8 @@ in "nodetool status -p ${jmxPortStr} --resolve-ip | egrep '^UN[[:space:]]+cass2'" ) ''; + + passthru = { + inherit testPackage; + }; }) diff --git a/nixos/tests/ceph-multi-node.nix b/nixos/tests/ceph-multi-node.nix index e26c6d5d670cf..4e6d644f96c8a 100644 --- a/nixos/tests/ceph-multi-node.nix +++ b/nixos/tests/ceph-multi-node.nix @@ -218,7 +218,7 @@ let ''; in { name = "basic-multi-node-ceph-cluster"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ lejonet ]; }; diff --git a/nixos/tests/ceph-single-node.nix b/nixos/tests/ceph-single-node.nix index 98528f6317bc0..19919371a3ca7 100644 --- a/nixos/tests/ceph-single-node.nix +++ b/nixos/tests/ceph-single-node.nix @@ -184,7 +184,7 @@ let ''; in { name = "basic-single-node-ceph-cluster"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ lejonet johanot ]; }; diff --git a/nixos/tests/charliecloud.nix b/nixos/tests/charliecloud.nix index acba41e228a66..28c3e2f2dbf73 100644 --- a/nixos/tests/charliecloud.nix +++ b/nixos/tests/charliecloud.nix @@ -11,7 +11,7 @@ import ./make-test-python.nix ({ pkgs, ...} : let in { name = "charliecloud"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ bzizou ]; }; diff --git a/nixos/tests/chromium.nix b/nixos/tests/chromium.nix index 795b93f6f54e5..8429d932ae694 100644 --- a/nixos/tests/chromium.nix +++ b/nixos/tests/chromium.nix @@ -1,10 +1,14 @@ { system ? builtins.currentSystem , config ? {} , pkgs ? import ../.. { inherit system config; } -, channelMap ? { - stable = pkgs.chromium; - beta = pkgs.chromiumBeta; - dev = pkgs.chromiumDev; +, channelMap ? { # Maps "channels" to packages + stable = pkgs.chromium; + beta = pkgs.chromiumBeta; + dev = pkgs.chromiumDev; + ungoogled = pkgs.ungoogled-chromium; + chrome-stable = pkgs.google-chrome; + chrome-beta = pkgs.google-chrome-beta; + chrome-dev = pkgs.google-chrome-dev; } }: @@ -14,7 +18,7 @@ with pkgs.lib; mapAttrs (channel: chromiumPkg: makeTest rec { name = "chromium-${channel}"; meta = { - maintainers = with maintainers; [ aszlig ]; + maintainers = with maintainers; [ aszlig primeos ]; # https://github.com/NixOS/hydra/issues/591#issuecomment-435125621 inherit (chromiumPkg.meta) timeout; }; @@ -47,7 +51,7 @@ mapAttrs (channel: chromiumPkg: makeTest rec { testScript = let xdo = name: text: let xdoScript = pkgs.writeText "${name}.xdo" text; - in "${pkgs.xdotool}/bin/xdotool '${xdoScript}'"; + in "${pkgs.xdotool}/bin/xdotool ${xdoScript}"; in '' import shlex from contextlib import contextmanager, _GeneratorContextManager @@ -58,101 +62,86 @@ mapAttrs (channel: chromiumPkg: makeTest rec { return "su - ${user} -c " + shlex.quote(cmd) + def get_browser_binary(): + """Returns the name of the browser binary.""" + pname = "${getName chromiumPkg.name}" + if pname.find("chromium") != -1: + return "chromium" # Same name for all channels and ungoogled-chromium + if pname == "google-chrome": + return "google-chrome-stable" + if pname == "google-chrome-dev": + return "google-chrome-unstable" + # For google-chrome-beta and as fallback: + return pname + + def create_new_win(): + """Creates a new Chromium window.""" with machine.nested("Creating a new Chromium window"): - machine.execute( + machine.wait_until_succeeds( ru( - "${xdo "new-window" '' + "${xdo "create_new_win-select_main_window" '' search --onlyvisible --name "startup done" windowfocus --sync windowactivate --sync ''}" ) ) - machine.execute( + machine.send_key("ctrl-n") + # Wait until the new window appears: + machine.wait_until_succeeds( ru( - "${xdo "new-window" '' - key Ctrl+n - ''}" - ) - ) - - - def close_win(): - def try_close(_): - machine.execute( - ru( - "${xdo "close-window" '' - search --onlyvisible --name "new tab" + "${xdo "create_new_win-wait_for_window" '' + search --onlyvisible --name "New Tab" windowfocus --sync windowactivate --sync ''}" ) ) - machine.execute( - ru( - "${xdo "close-window" '' - key Ctrl+w - ''}" - ) - ) - for _ in range(1, 20): - status, out = machine.execute( - ru( - "${xdo "wait-for-close" '' - search --onlyvisible --name "new tab" - ''}" - ) - ) - if status != 0: - return True - machine.sleep(1) - return False - - retry(try_close) - - - def wait_for_new_win(): - ret = False - with machine.nested("Waiting for new Chromium window to appear"): - for _ in range(1, 20): - status, out = machine.execute( - ru( - "${xdo "wait-for-window" '' - search --onlyvisible --name "new tab" - windowfocus --sync - windowactivate --sync - ''}" - ) - ) - if status == 0: - ret = True - machine.sleep(10) - break - machine.sleep(1) - return ret - def create_and_wait_for_new_win(): - for _ in range(1, 3): - create_new_win() - if wait_for_new_win(): - return True - assert False, "new window did not appear within 60 seconds" + def close_new_tab_win(): + """Closes the Chromium window with the title "New Tab".""" + machine.wait_until_succeeds( + ru( + "${xdo "close_new_tab_win-select_main_window" '' + search --onlyvisible --name "New Tab" + windowfocus --sync + windowactivate --sync + ''}" + ) + ) + machine.send_key("ctrl-w") + # Wait until the closed window disappears: + machine.wait_until_fails( + ru( + "${xdo "close_new_tab_win-wait_for_close" '' + search --onlyvisible --name "New Tab" + ''}" + ) + ) @contextmanager def test_new_win(description): - create_and_wait_for_new_win() + create_new_win() with machine.nested(description): yield - close_win() + # Close the newly created window: + machine.send_key("ctrl-w") machine.wait_for_x() url = "file://${startupHTML}" - machine.succeed(ru(f'ulimit -c unlimited; chromium "{url}" & disown')) + machine.succeed(ru(f'ulimit -c unlimited; "{get_browser_binary()}" "{url}" & disown')) + + if get_browser_binary().startswith("google-chrome"): + # Need to click away the first window: + machine.wait_for_text("Make Google Chrome the default browser") + machine.screenshot("google_chrome_default_browser_prompt") + machine.send_key("ret") + machine.wait_for_text("startup done") machine.wait_until_succeeds( ru( @@ -166,9 +155,11 @@ mapAttrs (channel: chromiumPkg: makeTest rec { ) ) - create_and_wait_for_new_win() + create_new_win() + # Optional: Wait for the new tab page to fully load before taking the screenshot: + machine.wait_for_text("Web Store") machine.screenshot("empty_windows") - close_win() + close_new_tab_win() machine.screenshot("startup_done") @@ -176,7 +167,7 @@ mapAttrs (channel: chromiumPkg: makeTest rec { machine.succeed( ru( "${xdo "type-url" '' - search --sync --onlyvisible --name "new tab" + search --sync --onlyvisible --name "New Tab" windowfocus --sync type --delay 1000 "chrome://sandbox" ''}" @@ -186,7 +177,7 @@ mapAttrs (channel: chromiumPkg: makeTest rec { machine.succeed( ru( "${xdo "submit-url" '' - search --sync --onlyvisible --name "new tab" + search --sync --onlyvisible --name "New Tab" windowfocus --sync key --delay 1000 Return ''}" @@ -198,7 +189,7 @@ mapAttrs (channel: chromiumPkg: makeTest rec { machine.succeed( ru( "${xdo "find-window" '' - search --sync --onlyvisible --name "sandbox status" + search --sync --onlyvisible --name "Sandbox Status" windowfocus --sync ''}" ) @@ -232,7 +223,7 @@ mapAttrs (channel: chromiumPkg: makeTest rec { machine.succeed( ru( "${xdo "find-window-after-copy" '' - search --onlyvisible --name "sandbox status" + search --onlyvisible --name "Sandbox Status" ''}" ) ) diff --git a/nixos/tests/cifs-utils.nix b/nixos/tests/cifs-utils.nix new file mode 100644 index 0000000000000..98587b10d941a --- /dev/null +++ b/nixos/tests/cifs-utils.nix @@ -0,0 +1,12 @@ +import ./make-test-python.nix ({ pkgs, ... }: { + name = "cifs-utils"; + + machine = { pkgs, ... }: { environment.systemPackages = [ pkgs.cifs-utils ]; }; + + testScript = '' + machine.succeed("smbinfo -h") + machine.succeed("smb2-quota -h") + assert "${pkgs.cifs-utils.version}" in machine.succeed("cifs.upcall -v") + assert "${pkgs.cifs-utils.version}" in machine.succeed("mount.cifs -V") + ''; +}) diff --git a/nixos/tests/cjdns.nix b/nixos/tests/cjdns.nix index d72236d415d4d..dc5f371c74d83 100644 --- a/nixos/tests/cjdns.nix +++ b/nixos/tests/cjdns.nix @@ -19,7 +19,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : { name = "cjdns"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ehmry ]; }; diff --git a/nixos/tests/clickhouse.nix b/nixos/tests/clickhouse.nix index 2d8a7cf7aa9fa..98d8b4b465257 100644 --- a/nixos/tests/clickhouse.nix +++ b/nixos/tests/clickhouse.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "clickhouse"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ ma27 ]; + meta.maintainers = with pkgs.lib.maintainers; [ ma27 ]; machine = { services.clickhouse.enable = true; diff --git a/nixos/tests/cloud-init.nix b/nixos/tests/cloud-init.nix index a127be6dd85f1..e06cbd056a323 100644 --- a/nixos/tests/cloud-init.nix +++ b/nixos/tests/cloud-init.nix @@ -40,7 +40,7 @@ let }; in makeTest { name = "cloud-init"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ lewo ]; }; machine = { ... }: @@ -51,29 +51,31 @@ in makeTest { networking.hostName = ""; }; testScript = '' - machine.wait_for_unit("cloud-init.service") - machine.succeed("cat /tmp/cloudinit-write-file | grep -q 'cloudinit'") + # To wait until cloud-init terminates its run + unnamed.wait_for_unit("cloud-final.service") + + unnamed.succeed("cat /tmp/cloudinit-write-file | grep -q 'cloudinit'") # install snakeoil ssh key and provision .ssh/config file - machine.succeed("mkdir -p ~/.ssh") - machine.succeed( + unnamed.succeed("mkdir -p ~/.ssh") + unnamed.succeed( "cat ${snakeOilPrivateKey} > ~/.ssh/id_snakeoil" ) - machine.succeed("chmod 600 ~/.ssh/id_snakeoil") + unnamed.succeed("chmod 600 ~/.ssh/id_snakeoil") - machine.wait_for_unit("sshd.service") + unnamed.wait_for_unit("sshd.service") # we should be able to log in as the root user, as well as the created nixos user - machine.succeed( + unnamed.succeed( "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentityFile=~/.ssh/id_snakeoil root@localhost 'true'" ) - machine.succeed( + unnamed.succeed( "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentityFile=~/.ssh/id_snakeoil nixos@localhost 'true'" ) # test changing hostname via cloud-init worked assert ( - machine.succeed( + unnamed.succeed( "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentityFile=~/.ssh/id_snakeoil nixos@localhost 'hostname'" ).strip() == "test" diff --git a/nixos/tests/cockroachdb.nix b/nixos/tests/cockroachdb.nix index d0cc5e19837c6..d793842f0ab2d 100644 --- a/nixos/tests/cockroachdb.nix +++ b/nixos/tests/cockroachdb.nix @@ -99,7 +99,7 @@ let in import ./make-test-python.nix ({ pkgs, ...} : { name = "cockroachdb"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; + meta.maintainers = with pkgs.lib.maintainers; [ thoughtpolice ]; nodes = { diff --git a/nixos/tests/codimd.nix b/nixos/tests/codimd.nix deleted file mode 100644 index aa581dfeb584b..0000000000000 --- a/nixos/tests/codimd.nix +++ /dev/null @@ -1,60 +0,0 @@ -import ./make-test-python.nix ({ pkgs, lib, ... }: -{ - name = "codimd"; - - meta = with lib.maintainers; { - maintainers = [ willibutz ]; - }; - - nodes = { - codimdSqlite = { ... }: { - services = { - codimd = { - enable = true; - configuration.dbURL = "sqlite:///var/lib/codimd/codimd.db"; - }; - }; - }; - - codimdPostgres = { ... }: { - systemd.services.codimd.after = [ "postgresql.service" ]; - services = { - codimd = { - enable = true; - configuration.dbURL = "postgres://codimd:\${DB_PASSWORD}@localhost:5432/codimddb"; - - /* - * Do not use pkgs.writeText for secrets as - * they will end up in the world-readable Nix store. - */ - environmentFile = pkgs.writeText "codimd-env" '' - DB_PASSWORD=snakeoilpassword - ''; - }; - postgresql = { - enable = true; - initialScript = pkgs.writeText "pg-init-script.sql" '' - CREATE ROLE codimd LOGIN PASSWORD 'snakeoilpassword'; - CREATE DATABASE codimddb OWNER codimd; - ''; - }; - }; - }; - }; - - testScript = '' - start_all() - - with subtest("CodiMD sqlite"): - codimdSqlite.wait_for_unit("codimd.service") - codimdSqlite.wait_for_open_port(3000) - codimdSqlite.wait_until_succeeds("curl -sSf http://localhost:3000/new") - - with subtest("CodiMD postgres"): - codimdPostgres.wait_for_unit("postgresql.service") - codimdPostgres.wait_for_unit("codimd.service") - codimdPostgres.wait_for_open_port(5432) - codimdPostgres.wait_for_open_port(3000) - codimdPostgres.wait_until_succeeds("curl -sSf http://localhost:3000/new") - ''; -}) diff --git a/nixos/tests/containers-bridge.nix b/nixos/tests/containers-bridge.nix index 2c8e8fa5370f0..1208aa8fced7e 100644 --- a/nixos/tests/containers-bridge.nix +++ b/nixos/tests/containers-bridge.nix @@ -9,7 +9,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : { name = "containers-bridge"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ aristid aszlig eelco kampfschlaefer ]; }; diff --git a/nixos/tests/containers-extra_veth.nix b/nixos/tests/containers-extra_veth.nix index 7d30b3f76cd7b..212f3d0f46cbc 100644 --- a/nixos/tests/containers-extra_veth.nix +++ b/nixos/tests/containers-extra_veth.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "containers-extra_veth"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ kampfschlaefer ]; }; diff --git a/nixos/tests/containers-hosts.nix b/nixos/tests/containers-hosts.nix index d6fb4a761eef7..65a983c42a789 100644 --- a/nixos/tests/containers-hosts.nix +++ b/nixos/tests/containers-hosts.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "containers-hosts"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ montag451 ]; }; diff --git a/nixos/tests/containers-imperative.nix b/nixos/tests/containers-imperative.nix index c4f2002918fc7..393b4a5135dd5 100644 --- a/nixos/tests/containers-imperative.nix +++ b/nixos/tests/containers-imperative.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "containers-imperative"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ aristid aszlig eelco kampfschlaefer ]; }; diff --git a/nixos/tests/containers-ip.nix b/nixos/tests/containers-ip.nix index 8583a08c62589..0265ed92d41cb 100644 --- a/nixos/tests/containers-ip.nix +++ b/nixos/tests/containers-ip.nix @@ -15,7 +15,7 @@ let in import ./make-test-python.nix ({ pkgs, ...} : { name = "containers-ipv4-ipv6"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ aristid aszlig eelco kampfschlaefer ]; }; diff --git a/nixos/tests/containers-macvlans.nix b/nixos/tests/containers-macvlans.nix index 0e8f67bc76f0b..9425252cb8862 100644 --- a/nixos/tests/containers-macvlans.nix +++ b/nixos/tests/containers-macvlans.nix @@ -8,7 +8,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : { name = "containers-macvlans"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ montag451 ]; }; diff --git a/nixos/tests/containers-physical_interfaces.nix b/nixos/tests/containers-physical_interfaces.nix index e800751a23c23..0b55c3418edfb 100644 --- a/nixos/tests/containers-physical_interfaces.nix +++ b/nixos/tests/containers-physical_interfaces.nix @@ -1,7 +1,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "containers-physical_interfaces"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ kampfschlaefer ]; }; diff --git a/nixos/tests/containers-portforward.nix b/nixos/tests/containers-portforward.nix index 1e2c2c6c374f5..d0be3c7d43ec6 100644 --- a/nixos/tests/containers-portforward.nix +++ b/nixos/tests/containers-portforward.nix @@ -9,7 +9,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : { name = "containers-portforward"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ aristid aszlig eelco kampfschlaefer ianwookim ]; }; diff --git a/nixos/tests/containers-reloadable.nix b/nixos/tests/containers-reloadable.nix index 2d81f1639387d..8772469176727 100644 --- a/nixos/tests/containers-reloadable.nix +++ b/nixos/tests/containers-reloadable.nix @@ -16,7 +16,7 @@ let }; in { name = "containers-reloadable"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ danbst ]; }; diff --git a/nixos/tests/containers-restart_networking.nix b/nixos/tests/containers-restart_networking.nix index b50dadd13e479..b35552b5b1919 100644 --- a/nixos/tests/containers-restart_networking.nix +++ b/nixos/tests/containers-restart_networking.nix @@ -19,7 +19,7 @@ let in import ./make-test-python.nix ({ pkgs, ...} : { name = "containers-restart_networking"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ kampfschlaefer ]; }; diff --git a/nixos/tests/containers-tmpfs.nix b/nixos/tests/containers-tmpfs.nix index 171e8f01c7b95..7ebf0d02a2406 100644 --- a/nixos/tests/containers-tmpfs.nix +++ b/nixos/tests/containers-tmpfs.nix @@ -2,8 +2,8 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "containers-tmpfs"; - meta = with pkgs.stdenv.lib.maintainers; { - maintainers = [ kampka ]; + meta = with pkgs.lib.maintainers; { + maintainers = [ ]; }; machine = diff --git a/nixos/tests/convos.nix b/nixos/tests/convos.nix index af2758c857d09..a13870d170843 100644 --- a/nixos/tests/convos.nix +++ b/nixos/tests/convos.nix @@ -6,7 +6,7 @@ let in { name = "convos"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ sgo ]; }; diff --git a/nixos/tests/couchdb.nix b/nixos/tests/couchdb.nix index 57b79e29b4330..d038ee7d890dc 100644 --- a/nixos/tests/couchdb.nix +++ b/nixos/tests/couchdb.nix @@ -19,7 +19,7 @@ with lib; { name = "couchdb"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ fpletz ]; }; diff --git a/nixos/tests/cri-o.nix b/nixos/tests/cri-o.nix index f13f1bdacb6af..91d46657f2411 100644 --- a/nixos/tests/cri-o.nix +++ b/nixos/tests/cri-o.nix @@ -1,7 +1,7 @@ # This test runs CRI-O and verifies via critest import ./make-test-python.nix ({ pkgs, ... }: { name = "cri-o"; - maintainers = with pkgs.stdenv.lib.maintainers; teams.podman.members; + maintainers = with pkgs.lib.maintainers; teams.podman.members; nodes = { crio = { diff --git a/nixos/tests/deluge.nix b/nixos/tests/deluge.nix index 3cf179a382164..300bc0a1157b3 100644 --- a/nixos/tests/deluge.nix +++ b/nixos/tests/deluge.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "deluge"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ flokli ]; }; diff --git a/nixos/tests/dnscrypt-proxy2.nix b/nixos/tests/dnscrypt-proxy2.nix index b614d912a9f4e..1ba5d983e9b92 100644 --- a/nixos/tests/dnscrypt-proxy2.nix +++ b/nixos/tests/dnscrypt-proxy2.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "dnscrypt-proxy2"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ joachifm ]; }; diff --git a/nixos/tests/dnscrypt-wrapper/default.nix b/nixos/tests/dnscrypt-wrapper/default.nix index 1dc925f4de7ab..1bdd064e1130c 100644 --- a/nixos/tests/dnscrypt-wrapper/default.nix +++ b/nixos/tests/dnscrypt-wrapper/default.nix @@ -1,6 +1,6 @@ import ../make-test-python.nix ({ pkgs, ... }: { name = "dnscrypt-wrapper"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ rnhmjoj ]; }; @@ -31,6 +31,7 @@ import ../make-test-python.nix ({ pkgs, ... }: { client = { lib, ... }: { services.dnscrypt-proxy2.enable = true; + services.dnscrypt-proxy2.upstreamDefaults = false; services.dnscrypt-proxy2.settings = { server_names = [ "server" ]; static.server.stamp = "sdns://AQAAAAAAAAAAEDE5Mi4xNjguMS4xOjUzNTMgFEHYOv0SCKSuqR5CDYa7-58cCBuXO2_5uTSVU9wNQF0WMi5kbnNjcnlwdC1jZXJ0LnNlcnZlcg"; diff --git a/nixos/tests/docker-edge.nix b/nixos/tests/docker-edge.nix index 703179eef1956..c6a1a08301890 100644 --- a/nixos/tests/docker-edge.nix +++ b/nixos/tests/docker-edge.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "docker"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus offline ]; }; diff --git a/nixos/tests/docker-registry.nix b/nixos/tests/docker-registry.nix index 2928fd8141a43..1d449db45191f 100644 --- a/nixos/tests/docker-registry.nix +++ b/nixos/tests/docker-registry.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "docker-registry"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ globin ma27 ironpinguin ]; }; diff --git a/nixos/tests/docker-tools-cross.nix b/nixos/tests/docker-tools-cross.nix new file mode 100644 index 0000000000000..a7a6a31475d67 --- /dev/null +++ b/nixos/tests/docker-tools-cross.nix @@ -0,0 +1,76 @@ +# Not everyone has a suitable remote builder set up, so the cross-compilation +# tests that _include_ running the result are separate. That way, most people +# can run the majority of the test suite without the extra setup. + + +import ./make-test-python.nix ({ pkgs, ... }: +let + + remoteSystem = + if pkgs.system == "aarch64-linux" + then "x86_64-linux" + else "aarch64-linux"; + + remoteCrossPkgs = import ../.. /*nixpkgs*/ { + # NOTE: This is the machine that runs the build - local from the + # 'perspective' of the build script. + localSystem = remoteSystem; + + # NOTE: Since this file can't control where the test will be _run_ we don't + # cross-compile _to_ a different system but _from_ a different system + crossSystem = pkgs.system; + }; + + hello1 = remoteCrossPkgs.dockerTools.buildImage { + name = "hello1"; + tag = "latest"; + contents = remoteCrossPkgs.hello; + }; + + hello2 = remoteCrossPkgs.dockerTools.buildLayeredImage { + name = "hello2"; + tag = "latest"; + contents = remoteCrossPkgs.hello; + }; + +in { + name = "docker-tools"; + meta = with pkgs.lib.maintainers; { + maintainers = [ roberth ]; + }; + + nodes = { + docker = { ... }: { + virtualisation = { + diskSize = 2048; + docker.enable = true; + }; + }; + }; + + testScript = '' + docker.wait_for_unit("sockets.target") + + with subtest("Ensure cross compiled buildImage image can run."): + docker.succeed( + "docker load --input='${hello1}'" + ) + assert "Hello, world!" in docker.succeed( + "docker run --rm ${hello1.imageName} hello", + ) + docker.succeed( + "docker rmi ${hello1.imageName}", + ) + + with subtest("Ensure cross compiled buildLayeredImage image can run."): + docker.succeed( + "docker load --input='${hello2}'" + ) + assert "Hello, world!" in docker.succeed( + "docker run --rm ${hello2.imageName} hello", + ) + docker.succeed( + "docker rmi ${hello2.imageName}", + ) + ''; +}) diff --git a/nixos/tests/docker-tools-overlay.nix b/nixos/tests/docker-tools-overlay.nix index 1a0e0ea67750a..98eb728661565 100644 --- a/nixos/tests/docker-tools-overlay.nix +++ b/nixos/tests/docker-tools-overlay.nix @@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "docker-tools-overlay"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ lnl7 ]; }; diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix index 3d1e39a379c17..6638ec4927ce1 100644 --- a/nixos/tests/docker-tools.nix +++ b/nixos/tests/docker-tools.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "docker-tools"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ lnl7 ]; }; @@ -245,7 +245,14 @@ import ./make-test-python.nix ({ pkgs, ... }: { "docker inspect ${pkgs.dockerTools.examples.cross.imageName} " + "| ${pkgs.jq}/bin/jq -r .[].Architecture" ).strip() - == "${if pkgs.system == "aarch64-linux" then "amd64" else "arm64v8"}" + == "${if pkgs.system == "aarch64-linux" then "amd64" else "arm64"}" + ) + + with subtest("buildLayeredImage doesn't dereference /nix/store symlink layers"): + docker.succeed( + "docker load --input='${examples.layeredStoreSymlink}'", + "docker run --rm ${examples.layeredStoreSymlink.imageName} bash -c 'test -L ${examples.layeredStoreSymlink.passthru.symlink}'", + "docker rmi ${examples.layeredStoreSymlink.imageName}", ) ''; }) diff --git a/nixos/tests/docker.nix b/nixos/tests/docker.nix index a4a61468f33dc..58e33535ed31e 100644 --- a/nixos/tests/docker.nix +++ b/nixos/tests/docker.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "docker"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus offline ]; }; diff --git a/nixos/tests/documize.nix b/nixos/tests/documize.nix index 3be20a780d318..d5a77ffcd4f26 100644 --- a/nixos/tests/documize.nix +++ b/nixos/tests/documize.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : { name = "documize"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ma27 ]; }; diff --git a/nixos/tests/dokuwiki.nix b/nixos/tests/dokuwiki.nix index 58069366ca36e..40475d789d47a 100644 --- a/nixos/tests/dokuwiki.nix +++ b/nixos/tests/dokuwiki.nix @@ -32,7 +32,7 @@ let in { name = "dokuwiki"; - meta = with pkgs.stdenv.lib; { + meta = with pkgs.lib; { maintainers = with maintainers; [ _1000101 ]; }; machine = { ... }: { diff --git a/nixos/tests/dovecot.nix b/nixos/tests/dovecot.nix index bcbe234fd8052..1129e3b45d9d6 100644 --- a/nixos/tests/dovecot.nix +++ b/nixos/tests/dovecot.nix @@ -4,8 +4,11 @@ import ./make-test-python.nix { machine = { pkgs, ... }: { imports = [ common/user-account.nix ]; services.postfix.enable = true; - services.dovecot2.enable = true; - services.dovecot2.protocols = [ "imap" "pop3" ]; + services.dovecot2 = { + enable = true; + protocols = [ "imap" "pop3" ]; + modules = [ pkgs.dovecot_pigeonhole ]; + }; environment.systemPackages = let sendTestMail = pkgs.writeScriptBin "send-testmail" '' #!${pkgs.runtimeShell} diff --git a/nixos/tests/elk.nix b/nixos/tests/elk.nix index 7e87197ed9f3d..8488c97c01e8c 100644 --- a/nixos/tests/elk.nix +++ b/nixos/tests/elk.nix @@ -12,7 +12,7 @@ let mkElkTest = name : elk : import ./make-test-python.nix ({ inherit name; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco offline basvandijk ]; }; nodes = { diff --git a/nixos/tests/emacs-daemon.nix b/nixos/tests/emacs-daemon.nix index b89d9b1bde691..58bcd095990ad 100644 --- a/nixos/tests/emacs-daemon.nix +++ b/nixos/tests/emacs-daemon.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "emacs-daemon"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ]; }; diff --git a/nixos/tests/engelsystem.nix b/nixos/tests/engelsystem.nix index 39c10718093f6..7be3b8a5a1fe2 100644 --- a/nixos/tests/engelsystem.nix +++ b/nixos/tests/engelsystem.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ( { pkgs, lib, ... }: { name = "engelsystem"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ talyz ]; }; diff --git a/nixos/tests/enlightenment.nix b/nixos/tests/enlightenment.nix index 0132b98b1cbb1..cc1da649d493e 100644 --- a/nixos/tests/enlightenment.nix +++ b/nixos/tests/enlightenment.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "enlightenment"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ romildo ]; }; diff --git a/nixos/tests/env.nix b/nixos/tests/env.nix index e603338e489b9..fc96ace6b2d2a 100644 --- a/nixos/tests/env.nix +++ b/nixos/tests/env.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "environment"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; diff --git a/nixos/tests/ergo.nix b/nixos/tests/ergo.nix index 8cdbbf62a9564..b49e0c9dfed73 100644 --- a/nixos/tests/ergo.nix +++ b/nixos/tests/ergo.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "ergo"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ mmahut ]; }; diff --git a/nixos/tests/etcd-cluster.nix b/nixos/tests/etcd-cluster.nix index 19c5d9158236b..410cb654794f2 100644 --- a/nixos/tests/etcd-cluster.nix +++ b/nixos/tests/etcd-cluster.nix @@ -97,7 +97,7 @@ import ./make-test-python.nix ({ pkgs, ... } : let in { name = "etcd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ offline ]; }; diff --git a/nixos/tests/etcd.nix b/nixos/tests/etcd.nix index 8427243438411..702bbb668f57f 100644 --- a/nixos/tests/etcd.nix +++ b/nixos/tests/etcd.nix @@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, ... } : { name = "etcd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ offline ]; }; diff --git a/nixos/tests/etesync-dav.nix b/nixos/tests/etesync-dav.nix new file mode 100644 index 0000000000000..da5c056f53497 --- /dev/null +++ b/nixos/tests/etesync-dav.nix @@ -0,0 +1,21 @@ +import ./make-test-python.nix ({ pkgs, ... }: { + + name = "etesync-dav"; + meta = with pkgs.lib.maintainers; { + maintainers = [ _3699n ]; + }; + + machine = { config, pkgs, ... }: { + environment.systemPackages = [ pkgs.curl pkgs.etesync-dav ]; + }; + + testScript = + '' + machine.wait_for_unit("multi-user.target") + machine.succeed("etesync-dav --version") + machine.execute("etesync-dav &") + machine.wait_for_open_port(37358) + with subtest("Check that the web interface is accessible"): + assert "Add User" in machine.succeed("curl -s http://localhost:37358/.web/add/") + ''; +}) diff --git a/nixos/tests/fenics.nix b/nixos/tests/fenics.nix index 7252d19e4e654..56f09d6a27e40 100644 --- a/nixos/tests/fenics.nix +++ b/nixos/tests/fenics.nix @@ -29,7 +29,7 @@ in { name = "fenics"; meta = { - maintainers = with pkgs.stdenv.lib.maintainers; [ knedlsepp ]; + maintainers = with pkgs.lib.maintainers; [ knedlsepp ]; }; nodes = { diff --git a/nixos/tests/ferm.nix b/nixos/tests/ferm.nix index 112b5f19a7dea..be43877445ebf 100644 --- a/nixos/tests/ferm.nix +++ b/nixos/tests/ferm.nix @@ -1,7 +1,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "ferm"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ mic92 ]; }; diff --git a/nixos/tests/firefox.nix b/nixos/tests/firefox.nix index 07e25bd4ca72d..4262f5443bf89 100644 --- a/nixos/tests/firefox.nix +++ b/nixos/tests/firefox.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, esr ? false, ... }: { name = "firefox"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco shlevy ]; }; diff --git a/nixos/tests/firejail.nix b/nixos/tests/firejail.nix index a723cb01664f3..6c42c37b2813a 100644 --- a/nixos/tests/firejail.nix +++ b/nixos/tests/firejail.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "firejail"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ sgo ]; }; @@ -11,6 +11,10 @@ import ./make-test-python.nix ({ pkgs, ...} : { enable = true; wrappedBinaries = { bash-jailed = "${pkgs.bash}/bin/bash"; + bash-jailed2 = { + executable = "${pkgs.bash}/bin/bash"; + extraArgs = [ "--private=~/firejail-home" ]; + }; }; }; @@ -53,6 +57,11 @@ import ./make-test-python.nix ({ pkgs, ...} : { ) machine.fail("sudo -u alice bash-jailed -c 'cat ~/my-secrets/secret' | grep -q s3cret") + # Test extraArgs + machine.succeed("sudo -u alice mkdir /home/alice/firejail-home") + machine.succeed("sudo -u alice bash-jailed2 -c 'echo test > /home/alice/foo'") + machine.fail("sudo -u alice cat /home/alice/foo") + machine.succeed("sudo -u alice cat /home/alice/firejail-home/foo | grep test") # Test path acl with firejail executable machine.succeed("sudo -u alice firejail -- bash -c 'cat ~/public' | grep -q publ1c") diff --git a/nixos/tests/firewall.nix b/nixos/tests/firewall.nix index 09a1fef852e64..5c434c1cb6d68 100644 --- a/nixos/tests/firewall.nix +++ b/nixos/tests/firewall.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ( { pkgs, ... } : { name = "firewall"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco ]; }; diff --git a/nixos/tests/freeswitch.nix b/nixos/tests/freeswitch.nix index 349d0e7bc6f0d..bcc6a9cb3586c 100644 --- a/nixos/tests/freeswitch.nix +++ b/nixos/tests/freeswitch.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "freeswitch"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ misuzu ]; }; nodes = { diff --git a/nixos/tests/gerrit.nix b/nixos/tests/gerrit.nix index 6cee64a20095a..b6b6486fae86c 100644 --- a/nixos/tests/gerrit.nix +++ b/nixos/tests/gerrit.nix @@ -9,7 +9,7 @@ let in { name = "gerrit"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ flokli zimbatm ]; }; diff --git a/nixos/tests/git/hub.nix b/nixos/tests/git/hub.nix new file mode 100644 index 0000000000000..4f3189861a004 --- /dev/null +++ b/nixos/tests/git/hub.nix @@ -0,0 +1,17 @@ +import ../make-test-python.nix ({ pkgs, ...} : { + name = "hub"; + meta = with pkgs.lib.maintainers; { + maintainers = [ nequissimus ]; + }; + + nodes.hub = { pkgs, ... }: + { + environment.systemPackages = [ pkgs.hub ]; + }; + + testScript = + '' + assert "git version ${pkgs.git.version}\nhub version ${pkgs.hub.version}\n" in hub.succeed("hub version") + assert "These GitHub commands are provided by hub" in hub.succeed("hub help") + ''; +}) diff --git a/nixos/tests/gitdaemon.nix b/nixos/tests/gitdaemon.nix index c4a707943ef1b..d0156fb9a49fb 100644 --- a/nixos/tests/gitdaemon.nix +++ b/nixos/tests/gitdaemon.nix @@ -7,7 +7,7 @@ let in { name = "gitdaemon"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ tilpner ]; }; diff --git a/nixos/tests/gitlab.nix b/nixos/tests/gitlab.nix index 1214cddd09370..ba085338944a0 100644 --- a/nixos/tests/gitlab.nix +++ b/nixos/tests/gitlab.nix @@ -5,7 +5,7 @@ let in import ./make-test-python.nix ({ pkgs, lib, ...} : with lib; { name = "gitlab"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ globin ]; }; diff --git a/nixos/tests/gitolite-fcgiwrap.nix b/nixos/tests/gitolite-fcgiwrap.nix index 414b7d6fe7efe..fc9b214b762ee 100644 --- a/nixos/tests/gitolite-fcgiwrap.nix +++ b/nixos/tests/gitolite-fcgiwrap.nix @@ -13,7 +13,7 @@ import ./make-test-python.nix ( { name = "gitolite-fcgiwrap"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ bbigras ]; }; diff --git a/nixos/tests/gitolite.nix b/nixos/tests/gitolite.nix index a928645bd80f8..128677cebde3a 100644 --- a/nixos/tests/gitolite.nix +++ b/nixos/tests/gitolite.nix @@ -51,7 +51,7 @@ in { name = "gitolite"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ bjornfor ]; }; diff --git a/nixos/tests/go-neb.nix b/nixos/tests/go-neb.nix index 531ab5a66714e..f8801ff68d64d 100644 --- a/nixos/tests/go-neb.nix +++ b/nixos/tests/go-neb.nix @@ -1,7 +1,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "go-neb"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ hexa maralorn ]; }; diff --git a/nixos/tests/gocd-agent.nix b/nixos/tests/gocd-agent.nix index 5b630a40736e9..75edf43ee295b 100644 --- a/nixos/tests/gocd-agent.nix +++ b/nixos/tests/gocd-agent.nix @@ -11,7 +11,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : { name = "gocd-agent"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ grahamc swarren83 ]; # gocd agent needs to register with the autoregister key created on first server startup, diff --git a/nixos/tests/gocd-server.nix b/nixos/tests/gocd-server.nix index 20faf85a1ccd8..aff651c5278fb 100644 --- a/nixos/tests/gocd-server.nix +++ b/nixos/tests/gocd-server.nix @@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "gocd-server"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ swarren83 ]; }; diff --git a/nixos/tests/google-oslogin/default.nix b/nixos/tests/google-oslogin/default.nix index 97783c81f3972..dea660ed05a48 100644 --- a/nixos/tests/google-oslogin/default.nix +++ b/nixos/tests/google-oslogin/default.nix @@ -11,7 +11,7 @@ let ''; in { name = "google-oslogin"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ adisbladis flokli ]; }; diff --git a/nixos/tests/gotify-server.nix b/nixos/tests/gotify-server.nix index c0b8ba43548a8..051666fbe72e7 100644 --- a/nixos/tests/gotify-server.nix +++ b/nixos/tests/gotify-server.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : { name = "gotify-server"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ma27 ]; }; diff --git a/nixos/tests/grafana.nix b/nixos/tests/grafana.nix index 4b453ece7f1ef..4ba091b893f42 100644 --- a/nixos/tests/grafana.nix +++ b/nixos/tests/grafana.nix @@ -17,6 +17,10 @@ let }; extraNodeConfs = { + declarativePlugins = { + services.grafana.declarativePlugins = [ pkgs.grafanaPlugins.grafana-clock-panel ]; + }; + postgresql = { services.grafana.database = { host = "127.0.0.1:5432"; @@ -52,7 +56,7 @@ let nameValuePair dbName (mkMerge [ baseGrafanaConf (extraNodeConfs.${dbName} or {}) - ])) [ "sqlite" "postgresql" "mysql" ]); + ])) [ "sqlite" "declarativePlugins" "postgresql" "mysql" ]); in { name = "grafana"; @@ -66,6 +70,14 @@ in { testScript = '' start_all() + with subtest("Declarative plugins installed"): + declarativePlugins.wait_for_unit("grafana.service") + declarativePlugins.wait_for_open_port(3000) + declarativePlugins.succeed( + "curl -sSfN -u testadmin:snakeoilpwd http://127.0.0.1:3000/api/plugins | grep -q grafana-clock-panel" + ) + declarativePlugins.shutdown() + with subtest("Successful API query as admin user with sqlite db"): sqlite.wait_for_unit("grafana.service") sqlite.wait_for_open_port(3000) diff --git a/nixos/tests/grocy.nix b/nixos/tests/grocy.nix index 7fa479ed2c42e..220c55b1f6346 100644 --- a/nixos/tests/grocy.nix +++ b/nixos/tests/grocy.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "grocy"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ma27 ]; }; diff --git a/nixos/tests/gvisor.nix b/nixos/tests/gvisor.nix index 4d68a1d8a5f89..77ff29341bed2 100644 --- a/nixos/tests/gvisor.nix +++ b/nixos/tests/gvisor.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "gvisor"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ andrew-d ]; }; diff --git a/nixos/tests/haka.nix b/nixos/tests/haka.nix index 3ca19cb0971c7..dd65a6bcf115a 100644 --- a/nixos/tests/haka.nix +++ b/nixos/tests/haka.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "haka"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ tvestelind ]; }; diff --git a/nixos/tests/handbrake.nix b/nixos/tests/handbrake.nix index e5fb6b269b197..226dc8b2aa8a8 100644 --- a/nixos/tests/handbrake.nix +++ b/nixos/tests/handbrake.nix @@ -9,7 +9,7 @@ in { name = "handbrake"; meta = { - maintainers = with pkgs.stdenv.lib.maintainers; [ danieldk ]; + maintainers = with pkgs.lib.maintainers; [ danieldk ]; }; machine = { pkgs, ... }: { diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix index ab5fa609e0725..d3f1f3172965a 100644 --- a/nixos/tests/hardened.nix +++ b/nixos/tests/hardened.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : { name = "hardened"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ joachifm ]; }; diff --git a/nixos/tests/hedgedoc.nix b/nixos/tests/hedgedoc.nix new file mode 100644 index 0000000000000..657d49c555e99 --- /dev/null +++ b/nixos/tests/hedgedoc.nix @@ -0,0 +1,60 @@ +import ./make-test-python.nix ({ pkgs, lib, ... }: +{ + name = "hedgedoc"; + + meta = with lib.maintainers; { + maintainers = [ willibutz ]; + }; + + nodes = { + hedgedocSqlite = { ... }: { + services = { + hedgedoc = { + enable = true; + configuration.dbURL = "sqlite:///var/lib/hedgedoc/hedgedoc.db"; + }; + }; + }; + + hedgedocPostgres = { ... }: { + systemd.services.hedgedoc.after = [ "postgresql.service" ]; + services = { + hedgedoc = { + enable = true; + configuration.dbURL = "postgres://hedgedoc:\${DB_PASSWORD}@localhost:5432/hedgedocdb"; + + /* + * Do not use pkgs.writeText for secrets as + * they will end up in the world-readable Nix store. + */ + environmentFile = pkgs.writeText "hedgedoc-env" '' + DB_PASSWORD=snakeoilpassword + ''; + }; + postgresql = { + enable = true; + initialScript = pkgs.writeText "pg-init-script.sql" '' + CREATE ROLE hedgedoc LOGIN PASSWORD 'snakeoilpassword'; + CREATE DATABASE hedgedocdb OWNER hedgedoc; + ''; + }; + }; + }; + }; + + testScript = '' + start_all() + + with subtest("HedgeDoc sqlite"): + hedgedocSqlite.wait_for_unit("hedgedoc.service") + hedgedocSqlite.wait_for_open_port(3000) + hedgedocSqlite.wait_until_succeeds("curl -sSf http://localhost:3000/new") + + with subtest("HedgeDoc postgres"): + hedgedocPostgres.wait_for_unit("postgresql.service") + hedgedocPostgres.wait_for_unit("hedgedoc.service") + hedgedocPostgres.wait_for_open_port(5432) + hedgedocPostgres.wait_for_open_port(3000) + hedgedocPostgres.wait_until_succeeds("curl -sSf http://localhost:3000/new") + ''; +}) diff --git a/nixos/tests/herbstluftwm.nix b/nixos/tests/herbstluftwm.nix new file mode 100644 index 0000000000000..2c98cceee6a21 --- /dev/null +++ b/nixos/tests/herbstluftwm.nix @@ -0,0 +1,38 @@ +import ./make-test-python.nix ({ lib, ...} : { + name = "herbstluftwm"; + + meta = { + maintainers = with lib.maintainers; [ thibautmarty ]; + timeout = 30; + }; + + machine = { pkgs, lib, ... }: { + imports = [ ./common/x11.nix ./common/user-account.nix ]; + test-support.displayManager.auto.user = "alice"; + services.xserver.displayManager.defaultSession = lib.mkForce "none+herbstluftwm"; + services.xserver.windowManager.herbstluftwm.enable = true; + environment.systemPackages = [ pkgs.dzen2 ]; # needed for upstream provided panel + }; + + testScript = '' + with subtest("ensure x starts"): + machine.wait_for_x() + machine.wait_for_file("/home/alice/.Xauthority") + machine.succeed("xauth merge ~alice/.Xauthority") + + with subtest("ensure client is available"): + machine.succeed("herbstclient --version") + + with subtest("ensure keybindings are set"): + machine.wait_until_succeeds("herbstclient list_keybinds | grep xterm") + + with subtest("ensure panel starts"): + machine.wait_for_window("dzen title") + + with subtest("ensure we can open a new terminal"): + machine.send_key("alt-ret") + machine.wait_for_window(r"alice.*?machine") + machine.sleep(2) + machine.screenshot("terminal") + ''; +}) diff --git a/nixos/tests/hitch/default.nix b/nixos/tests/hitch/default.nix index 8a2193e75f2ac..a1d8e6162606d 100644 --- a/nixos/tests/hitch/default.nix +++ b/nixos/tests/hitch/default.nix @@ -1,7 +1,7 @@ import ../make-test-python.nix ({ pkgs, ... }: { name = "hitch"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ jflanglois ]; }; machine = { pkgs, ... }: { diff --git a/nixos/tests/hledger-web.nix b/nixos/tests/hledger-web.nix new file mode 100644 index 0000000000000..378d819437db0 --- /dev/null +++ b/nixos/tests/hledger-web.nix @@ -0,0 +1,53 @@ +import ./make-test-python.nix ({ pkgs, lib, ... }: +let + journal = pkgs.writeText "test.journal" '' + 2010/01/10 Loan + assets:cash 500$ + income:loan -500$ + 2010/01/10 NixOS Foundation donation + expenses:donation 250$ + assets:cash -250$ + ''; +in +rec { + name = "hledger-web"; + meta.maintainers = with lib.maintainers; [ marijanp ]; + + nodes = { + server = { config, pkgs, ... }: rec { + services.hledger-web = { + host = "127.0.0.1"; + port = 5000; + enable = true; + journalFile = journal; + }; + networking.firewall.allowedTCPPorts = [ services.hledger-web.port ]; + }; + apiserver = { config, pkgs, ... }: rec { + services.hledger-web = { + host = "127.0.0.1"; + port = 5000; + enable = true; + serveApi = true; + journalFile = journal; + }; + networking.firewall.allowedTCPPorts = [ services.hledger-web.port ]; + }; + }; + + testScript = '' + start_all() + + server.wait_for_unit("hledger-web.service") + server.wait_for_open_port(5000) + with subtest("Check if web UI is accessible"): + page = server.succeed("curl -L http://127.0.0.1:5000") + assert "test.journal" in page + + apiserver.wait_for_unit("hledger-web.service") + apiserver.wait_for_open_port(5000) + with subtest("Check if the JSON API is served"): + transactions = apiserver.succeed("curl -L http://127.0.0.1:5000/transactions") + assert "NixOS Foundation donation" in transactions + ''; +}) diff --git a/nixos/tests/hocker-fetchdocker/default.nix b/nixos/tests/hocker-fetchdocker/default.nix index 978dbf310b122..e3979db3c60b5 100644 --- a/nixos/tests/hocker-fetchdocker/default.nix +++ b/nixos/tests/hocker-fetchdocker/default.nix @@ -1,6 +1,6 @@ import ../make-test-python.nix ({ pkgs, ...} : { name = "test-hocker-fetchdocker"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ixmatus ]; broken = true; # tries to download from registry-1.docker.io - how did this ever work? }; diff --git a/nixos/tests/home-assistant.nix b/nixos/tests/home-assistant.nix index a93a28d877a31..131f50747fef0 100644 --- a/nixos/tests/home-assistant.nix +++ b/nixos/tests/home-assistant.nix @@ -6,7 +6,7 @@ let mqttPassword = "secret"; in { name = "home-assistant"; - meta = with pkgs.stdenv.lib; { + meta = with pkgs.lib; { maintainers = with maintainers; [ dotlambda ]; }; diff --git a/nixos/tests/hostname.nix b/nixos/tests/hostname.nix index 3b87303d73e74..2e92b4259a6ab 100644 --- a/nixos/tests/hostname.nix +++ b/nixos/tests/hostname.nix @@ -7,13 +7,16 @@ with import ../lib/testing-python.nix { inherit system pkgs; }; with pkgs.lib; let - makeHostNameTest = hostName: domain: + makeHostNameTest = hostName: domain: fqdnOrNull: let fqdn = hostName + (optionalString (domain != null) ".${domain}"); + getStr = str: # maybeString2String + let res = builtins.tryEval str; + in if (res.success && res.value != null) then res.value else "null"; in makeTest { name = "hostname-${fqdn}"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ primeos blitz ]; }; @@ -26,13 +29,16 @@ let ]; }; - testScript = '' + testScript = { nodes, ... }: '' start_all() machine = ${hostName} machine.wait_for_unit("network-online.target") + # Test if NixOS computes the correct FQDN (either a FQDN or an error/null): + assert "${getStr nodes.machine.config.networking.fqdn}" == "${getStr fqdnOrNull}" + # The FQDN, domain name, and hostname detection should work as expected: assert "${fqdn}" == machine.succeed("hostname --fqdn").strip() assert "${optionalString (domain != null) domain}" == machine.succeed("dnsdomainname").strip() @@ -60,7 +66,7 @@ let in { - noExplicitDomain = makeHostNameTest "ahost" null; + noExplicitDomain = makeHostNameTest "ahost" null null; - explicitDomain = makeHostNameTest "ahost" "adomain"; + explicitDomain = makeHostNameTest "ahost" "adomain" "ahost.adomain"; } diff --git a/nixos/tests/hound.nix b/nixos/tests/hound.nix index b8b10022bd920..4f51db1de9dec 100644 --- a/nixos/tests/hound.nix +++ b/nixos/tests/hound.nix @@ -1,7 +1,7 @@ # Test whether `houndd` indexes nixpkgs import ./make-test-python.nix ({ pkgs, ... } : { name = "hound"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ grahamc ]; }; machine = { pkgs, ... }: { diff --git a/nixos/tests/hydra/common.nix b/nixos/tests/hydra/common.nix index 312c52e889a94..1a3a4d8fb3d4f 100644 --- a/nixos/tests/hydra/common.nix +++ b/nixos/tests/hydra/common.nix @@ -19,7 +19,7 @@ buildInputs = [ pkgs.makeWrapper ]; installPhase = "install -m755 -D ${./create-trivial-project.sh} $out/bin/create-trivial-project.sh"; postFixup = '' - wrapProgram "$out/bin/create-trivial-project.sh" --prefix PATH ":" ${pkgs.stdenv.lib.makeBinPath [ pkgs.curl ]} --set EXPR_PATH ${trivialJob} + wrapProgram "$out/bin/create-trivial-project.sh" --prefix PATH ":" ${pkgs.lib.makeBinPath [ pkgs.curl ]} --set EXPR_PATH ${trivialJob} ''; }; in { diff --git a/nixos/tests/hydra/default.nix b/nixos/tests/hydra/default.nix index e91a1cd3359d9..d92f032b82922 100644 --- a/nixos/tests/hydra/default.nix +++ b/nixos/tests/hydra/default.nix @@ -16,7 +16,7 @@ let makeHydraTest = with pkgs.lib; name: package: makeTest { name = "hydra-${name}"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ pstn lewo ma27 ]; }; diff --git a/nixos/tests/i3wm.nix b/nixos/tests/i3wm.nix index b527aa706ad21..59b4ffe3986e2 100644 --- a/nixos/tests/i3wm.nix +++ b/nixos/tests/i3wm.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "i3wm"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ aszlig ]; }; diff --git a/nixos/tests/icingaweb2.nix b/nixos/tests/icingaweb2.nix index 2f65604539c11..e631e667bd504 100644 --- a/nixos/tests/icingaweb2.nix +++ b/nixos/tests/icingaweb2.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "icingaweb2"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ das_j ]; }; diff --git a/nixos/tests/iftop.nix b/nixos/tests/iftop.nix index 8a161027c2ad7..6d0090b39463d 100644 --- a/nixos/tests/iftop.nix +++ b/nixos/tests/iftop.nix @@ -4,7 +4,7 @@ with lib; { name = "iftop"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ ma27 ]; + meta.maintainers = with pkgs.lib.maintainers; [ ma27 ]; nodes = { withIftop = { diff --git a/nixos/tests/image-contents.nix b/nixos/tests/image-contents.nix new file mode 100644 index 0000000000000..90908968a7e27 --- /dev/null +++ b/nixos/tests/image-contents.nix @@ -0,0 +1,51 @@ +# Tests the contents attribute of nixos/lib/make-disk-image.nix +# including its user, group, and mode attributes. +{ system ? builtins.currentSystem, + config ? {}, + pkgs ? import ../.. { inherit system config; } +}: + +with import ../lib/testing-python.nix { inherit system pkgs; }; +with pkgs.lib; + +with import common/ec2.nix { inherit makeTest pkgs; }; + +let + config = (import ../lib/eval-config.nix { + inherit system; + modules = [ + ../modules/testing/test-instrumentation.nix + ../modules/profiles/qemu-guest.nix + { + fileSystems."/".device = "/dev/disk/by-label/nixos"; + boot.loader.grub.device = "/dev/vda"; + boot.loader.timeout = 0; + } + ]; + }).config; + image = (import ../lib/make-disk-image.nix { + inherit pkgs config; + lib = pkgs.lib; + format = "qcow2"; + contents = [{ + source = pkgs.writeText "testFile" "contents"; + target = "/testFile"; + user = "1234"; + group = "5678"; + mode = "755"; + }]; + }) + "/nixos.qcow2"; + +in makeEc2Test { + name = "image-contents"; + inherit image; + userData = null; + script = '' + machine.start() + assert "content" in machine.succeed("cat /testFile") + fileDetails = machine.succeed("ls -l /testFile") + assert "1234" in fileDetails + assert "5678" in fileDetails + assert "rwxr-xr-x" in fileDetails + ''; +} diff --git a/nixos/tests/influxdb.nix b/nixos/tests/influxdb.nix index 04ef80461010b..03026f8404be5 100644 --- a/nixos/tests/influxdb.nix +++ b/nixos/tests/influxdb.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "influxdb"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ offline ]; }; diff --git a/nixos/tests/initrd-network.nix b/nixos/tests/initrd-network.nix index 9c35b7305768f..14e7e7d40bc59 100644 --- a/nixos/tests/initrd-network.nix +++ b/nixos/tests/initrd-network.nix @@ -1,7 +1,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : { name = "initrd-network"; - meta.maintainers = [ pkgs.stdenv.lib.maintainers.eelco ]; + meta.maintainers = [ pkgs.lib.maintainers.eelco ]; machine = { ... }: { imports = [ ../modules/profiles/minimal.nix ]; diff --git a/nixos/tests/initrd-secrets.nix b/nixos/tests/initrd-secrets.nix new file mode 100644 index 0000000000000..10dd908502d5b --- /dev/null +++ b/nixos/tests/initrd-secrets.nix @@ -0,0 +1,35 @@ +{ system ? builtins.currentSystem +, config ? {} +, pkgs ? import ../.. { inherit system config; } +, lib ? pkgs.lib +, testing ? import ../lib/testing-python.nix { inherit system pkgs; } +}: +let + secretInStore = pkgs.writeText "topsecret" "iamasecret"; + testWithCompressor = compressor: testing.makeTest { + name = "initrd-secrets-${compressor}"; + + meta.maintainers = [ lib.maintainers.lheckemann ]; + + machine = { ... }: { + virtualisation.useBootLoader = true; + boot.initrd.secrets."/test" = secretInStore; + boot.initrd.postMountCommands = '' + cp /test /mnt-root/secret-from-initramfs + ''; + boot.initrd.compressor = compressor; + # zstd compression is only supported from 5.9 onwards. Remove when 5.10 becomes default. + boot.kernelPackages = pkgs.linuxPackages_latest; + }; + + testScript = '' + start_all() + machine.wait_for_unit("multi-user.target") + machine.succeed( + "cmp ${secretInStore} /secret-from-initramfs" + ) + ''; + }; +in lib.flip lib.genAttrs testWithCompressor [ + "cat" "gzip" "bzip2" "xz" "lzma" "lzop" "pigz" "pixz" "zstd" +] diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix index d80cfb4bd83f2..789add331b793 100644 --- a/nixos/tests/installer.nix +++ b/nixos/tests/installer.nix @@ -76,8 +76,8 @@ let def assemble_qemu_flags(): flags = "-cpu max" ${if system == "x86_64-linux" - then ''flags += " -m 768"'' - else ''flags += " -m 512 -enable-kvm -machine virt,gic-version=host"'' + then ''flags += " -m 1024"'' + else ''flags += " -m 768 -enable-kvm -machine virt,gic-version=host"'' } return flags @@ -270,7 +270,7 @@ let makeTest { inherit enableOCR; name = "installer-" + name; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { # put global maintainers here, individuals go into makeInstallerTest fkt call maintainers = (meta.maintainers or []); }; @@ -284,7 +284,9 @@ let extraInstallerConfig ]; + # builds stuff in the VM, needs more juice virtualisation.diskSize = 8 * 1024; + virtualisation.cores = 8; virtualisation.memorySize = 1536; # Use a small /dev/vdb as the root disk for the @@ -324,8 +326,8 @@ let ] ++ optional (bootLoader == "grub" && grubVersion == 1) pkgs.grub ++ optionals (bootLoader == "grub" && grubVersion == 2) [ - pkgs.grub2 - pkgs.grub2_efi + (pkgs.grub2.override { zfsSupport = true; }) + (pkgs.grub2_efi.override { zfsSupport = true; }) ]; nix.binaryCaches = mkForce [ ]; diff --git a/nixos/tests/ipfs.nix b/nixos/tests/ipfs.nix index 9c0ff5306e06a..f8683b0a85809 100644 --- a/nixos/tests/ipfs.nix +++ b/nixos/tests/ipfs.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "ipfs"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ mguentner ]; }; diff --git a/nixos/tests/ipv6.nix b/nixos/tests/ipv6.nix index ba464b57447bb..f9d6d82b54acf 100644 --- a/nixos/tests/ipv6.nix +++ b/nixos/tests/ipv6.nix @@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : { name = "ipv6"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco ]; }; diff --git a/nixos/tests/jenkins.nix b/nixos/tests/jenkins.nix index cd64ff5128788..5898adab759a1 100644 --- a/nixos/tests/jenkins.nix +++ b/nixos/tests/jenkins.nix @@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "jenkins"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ bjornfor coconnor domenkozar eelco ]; }; diff --git a/nixos/tests/jitsi-meet.nix b/nixos/tests/jitsi-meet.nix index 42762dfdad8e0..dec49c83121b9 100644 --- a/nixos/tests/jitsi-meet.nix +++ b/nixos/tests/jitsi-meet.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "jitsi-meet"; - meta = with pkgs.stdenv.lib; { + meta = with pkgs.lib; { maintainers = teams.jitsi.members; }; diff --git a/nixos/tests/jq.nix b/nixos/tests/jq.nix index 20b67522ee6e6..075e6c43c09d4 100644 --- a/nixos/tests/jq.nix +++ b/nixos/tests/jq.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "jq"; - meta = with pkgs.stdenv.lib.maintainers; { maintainers = [ nequissimus ]; }; + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; nodes.jq = { pkgs, ... }: { environment.systemPackages = [ pkgs.jq ]; }; diff --git a/nixos/tests/k3s.nix b/nixos/tests/k3s.nix index 5bda6f493f0e3..494a3b68b59d2 100644 --- a/nixos/tests/k3s.nix +++ b/nixos/tests/k3s.nix @@ -31,7 +31,7 @@ let in { name = "k3s"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ euank ]; }; diff --git a/nixos/tests/kafka.nix b/nixos/tests/kafka.nix index 88e30b62baa2d..d5c54f7d99107 100644 --- a/nixos/tests/kafka.nix +++ b/nixos/tests/kafka.nix @@ -8,7 +8,7 @@ with pkgs.lib; let makeKafkaTest = name: kafkaPackage: (import ./make-test-python.nix ({ inherit name; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; @@ -80,15 +80,6 @@ let }) { inherit system; }); in with pkgs; { - kafka_0_9 = makeKafkaTest "kafka_0_9" apacheKafka_0_9; - kafka_0_10 = makeKafkaTest "kafka_0_10" apacheKafka_0_10; - kafka_0_11 = makeKafkaTest "kafka_0_11" apacheKafka_0_11; - kafka_1_0 = makeKafkaTest "kafka_1_0" apacheKafka_1_0; - kafka_1_1 = makeKafkaTest "kafka_1_1" apacheKafka_1_1; - kafka_2_0 = makeKafkaTest "kafka_2_0" apacheKafka_2_0; - kafka_2_1 = makeKafkaTest "kafka_2_1" apacheKafka_2_1; - kafka_2_2 = makeKafkaTest "kafka_2_2" apacheKafka_2_2; - kafka_2_3 = makeKafkaTest "kafka_2_3" apacheKafka_2_3; kafka_2_4 = makeKafkaTest "kafka_2_4" apacheKafka_2_4; kafka_2_5 = makeKafkaTest "kafka_2_5" apacheKafka_2_5; } diff --git a/nixos/tests/kernel-latest-ath-user-regd.nix b/nixos/tests/kernel-latest-ath-user-regd.nix new file mode 100644 index 0000000000000..11a3959e692e9 --- /dev/null +++ b/nixos/tests/kernel-latest-ath-user-regd.nix @@ -0,0 +1,17 @@ +import ./make-test-python.nix ({ pkgs, ...} : { + name = "kernel-latest-ath-user-regd"; + meta = with pkgs.lib.maintainers; { + maintainers = [ veehaitch ]; + }; + + machine = { pkgs, ... }: + { + boot.kernelPackages = pkgs.linuxPackages_latest; + networking.wireless.athUserRegulatoryDomain = true; + }; + + testScript = + '' + assert "CONFIG_ATH_USER_REGD=y" in machine.succeed("zcat /proc/config.gz") + ''; +}) diff --git a/nixos/tests/kernel-latest.nix b/nixos/tests/kernel-latest.nix index f09d0926d2236..323dde267a426 100644 --- a/nixos/tests/kernel-latest.nix +++ b/nixos/tests/kernel-latest.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "kernel-latest"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; diff --git a/nixos/tests/kernel-lts.nix b/nixos/tests/kernel-lts.nix index bad706d63c03a..9b03e9db6d84e 100644 --- a/nixos/tests/kernel-lts.nix +++ b/nixos/tests/kernel-lts.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "kernel-lts"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; diff --git a/nixos/tests/kernel-testing.nix b/nixos/tests/kernel-testing.nix index b7e10ebd5bd1c..017007c0aec85 100644 --- a/nixos/tests/kernel-testing.nix +++ b/nixos/tests/kernel-testing.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "kernel-testing"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; diff --git a/nixos/tests/keycloak.nix b/nixos/tests/keycloak.nix index f448a0f7095f6..45d8677af5675 100644 --- a/nixos/tests/keycloak.nix +++ b/nixos/tests/keycloak.nix @@ -10,7 +10,7 @@ let { pkgs, databaseType, ... }: { name = "keycloak"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ talyz ]; }; diff --git a/nixos/tests/knot.nix b/nixos/tests/knot.nix index 8bab917a351e3..22279292f77f9 100644 --- a/nixos/tests/knot.nix +++ b/nixos/tests/knot.nix @@ -37,7 +37,7 @@ let ''; in { name = "knot"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ hexa ]; }; diff --git a/nixos/tests/krb5/deprecated-config.nix b/nixos/tests/krb5/deprecated-config.nix index be6ebce9e0516..9a9cafd4b13e9 100644 --- a/nixos/tests/krb5/deprecated-config.nix +++ b/nixos/tests/krb5/deprecated-config.nix @@ -3,7 +3,7 @@ import ../make-test-python.nix ({ pkgs, ...} : { name = "krb5-with-deprecated-config"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eqyiel ]; }; diff --git a/nixos/tests/krb5/example-config.nix b/nixos/tests/krb5/example-config.nix index e2e10a9fda892..0932c71dd9705 100644 --- a/nixos/tests/krb5/example-config.nix +++ b/nixos/tests/krb5/example-config.nix @@ -3,7 +3,7 @@ import ../make-test-python.nix ({ pkgs, ...} : { name = "krb5-with-example-config"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eqyiel ]; }; diff --git a/nixos/tests/leaps.nix b/nixos/tests/leaps.nix index ec5b69a76290f..5cc387c86a452 100644 --- a/nixos/tests/leaps.nix +++ b/nixos/tests/leaps.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "leaps"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ qknight ]; }; diff --git a/nixos/tests/lightdm.nix b/nixos/tests/lightdm.nix index 46c2ed7ccc594..9611bdbdafec3 100644 --- a/nixos/tests/lightdm.nix +++ b/nixos/tests/lightdm.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "lightdm"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ aszlig worldofpeace ]; }; diff --git a/nixos/tests/limesurvey.nix b/nixos/tests/limesurvey.nix index dad807fb73300..b60e80be2444c 100644 --- a/nixos/tests/limesurvey.nix +++ b/nixos/tests/limesurvey.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "limesurvey"; - meta.maintainers = [ pkgs.stdenv.lib.maintainers.aanderse ]; + meta.maintainers = [ pkgs.lib.maintainers.aanderse ]; machine = { ... }: { services.limesurvey = { diff --git a/nixos/tests/locate.nix b/nixos/tests/locate.nix new file mode 100644 index 0000000000000..67ae610fe0127 --- /dev/null +++ b/nixos/tests/locate.nix @@ -0,0 +1,62 @@ +import ./make-test-python.nix ({ lib, pkgs, ... }: + let inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey; + in { + name = "locate"; + meta.maintainers = with pkgs.lib.maintainers; [ chkno ]; + + nodes = rec { + a = { + environment.systemPackages = with pkgs; [ sshfs ]; + fileSystems = lib.mkVMOverride { + "/ssh" = { + device = "alice@b:/"; + fsType = "fuse.sshfs"; + options = [ + "allow_other" + "IdentityFile=/privkey" + "noauto" + "StrictHostKeyChecking=no" + "UserKnownHostsFile=/dev/null" + ]; + }; + }; + services.locate = { + enable = true; + interval = "*:*:0/5"; + }; + }; + b = { + services.openssh.enable = true; + users.users.alice = { + isNormalUser = true; + openssh.authorizedKeys.keys = [ snakeOilPublicKey ]; + }; + }; + }; + + testScript = '' + start_all() + + # Set up sshfs mount + a.succeed( + "(umask 077; cat ${snakeOilPrivateKey} > /privkey)" + ) + b.succeed("touch /file-on-b-machine") + b.wait_for_open_port(22) + a.succeed("mkdir /ssh") + a.succeed("mount /ssh") + + # Core locatedb functionality + a.succeed("touch /file-on-a-machine-1") + a.wait_for_file("/var/cache/locatedb") + a.wait_until_succeeds("locate file-on-a-machine-1") + + # Wait for a second update to make sure we're using a locatedb from a run + # that began after the sshfs mount + a.succeed("touch /file-on-a-machine-2") + a.wait_until_succeeds("locate file-on-a-machine-2") + + # We shouldn't be able to see files on the other machine + a.fail("locate file-on-b-machine") + ''; + }) diff --git a/nixos/tests/login.nix b/nixos/tests/login.nix index d36c1a91be432..4d1dcc8cc32da 100644 --- a/nixos/tests/login.nix +++ b/nixos/tests/login.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... }: { name = "login"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco ]; }; @@ -50,7 +50,7 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... }: with subtest("Virtual console logout"): machine.send_chars("exit\n") machine.wait_until_fails("pgrep -u alice bash") - machine.screenshot("mingetty") + machine.screenshot("getty") with subtest("Check whether ctrl-alt-delete works"): machine.send_key("ctrl-alt-delete") diff --git a/nixos/tests/loki.nix b/nixos/tests/loki.nix index bede775b7d3c3..0c6dff3fdf137 100644 --- a/nixos/tests/loki.nix +++ b/nixos/tests/loki.nix @@ -46,7 +46,9 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: machine.wait_for_open_port(9080) machine.succeed("echo 'Loki Ingestion Test' > /var/log/testlog") # should not have access to journal unless specified - machine.fail("systemctl show --property=SupplementaryGroups promtail | grep -q systemd-journal") + machine.fail( + "systemctl show --property=SupplementaryGroups promtail | grep -q systemd-journal" + ) machine.wait_until_succeeds( "${pkgs.grafana-loki}/bin/logcli --addr='http://localhost:3100' query --no-labels '{job=\"varlogs\",filename=\"/var/log/testlog\"}' | grep -q 'Loki Ingestion Test'" ) diff --git a/nixos/tests/lsd.nix b/nixos/tests/lsd.nix index fee8e95e14ffb..c643f2f0b7b7d 100644 --- a/nixos/tests/lsd.nix +++ b/nixos/tests/lsd.nix @@ -1,12 +1,12 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "lsd"; - meta = with pkgs.stdenv.lib.maintainers; { maintainers = [ nequissimus ]; }; + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; nodes.lsd = { pkgs, ... }: { environment.systemPackages = [ pkgs.lsd ]; }; testScript = '' lsd.succeed('echo "abc" > /tmp/foo') - assert "4 B /tmp/foo" in lsd.succeed('lsd --classic --blocks "size,name" /tmp/foo') + assert "4 B /tmp/foo" in lsd.succeed('lsd --classic --blocks "size,name" -l /tmp/foo') assert "lsd ${pkgs.lsd.version}" in lsd.succeed("lsd --version") ''; }) diff --git a/nixos/tests/lxd-nftables.nix b/nixos/tests/lxd-nftables.nix index 4ca02067a0ae0..a62d5a3064dfb 100644 --- a/nixos/tests/lxd-nftables.nix +++ b/nixos/tests/lxd-nftables.nix @@ -8,7 +8,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "lxd-nftables"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ patryk27 ]; }; diff --git a/nixos/tests/lxd.nix b/nixos/tests/lxd.nix index d1e642383cf86..ab56b75c02e4e 100644 --- a/nixos/tests/lxd.nix +++ b/nixos/tests/lxd.nix @@ -47,7 +47,7 @@ let in { name = "lxd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ patryk27 ]; }; diff --git a/nixos/tests/magic-wormhole-mailbox-server.nix b/nixos/tests/magic-wormhole-mailbox-server.nix index 144a07e13492f..afdf7124fdc56 100644 --- a/nixos/tests/magic-wormhole-mailbox-server.nix +++ b/nixos/tests/magic-wormhole-mailbox-server.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "magic-wormhole-mailbox-server"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ mmahut ]; }; diff --git a/nixos/tests/magnetico.nix b/nixos/tests/magnetico.nix index e79a728b2ac86..8433a974f453b 100644 --- a/nixos/tests/magnetico.nix +++ b/nixos/tests/magnetico.nix @@ -5,7 +5,7 @@ let in { name = "magnetico"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ rnhmjoj ]; }; diff --git a/nixos/tests/mailhog.nix b/nixos/tests/mailhog.nix new file mode 100644 index 0000000000000..aece57178dd17 --- /dev/null +++ b/nixos/tests/mailhog.nix @@ -0,0 +1,24 @@ +import ./make-test-python.nix ({ lib, ... }: { + name = "mailhog"; + meta.maintainers = with lib.maintainers; [ jojosch ]; + + machine = { pkgs, ... }: { + services.mailhog.enable = true; + + environment.systemPackages = with pkgs; [ swaks ]; + }; + + testScript = '' + start_all() + + machine.wait_for_unit("mailhog.service") + machine.wait_for_open_port("1025") + machine.wait_for_open_port("8025") + machine.succeed( + 'echo "this is the body of the email" | swaks --to root@example.org --body - --server localhost:1025' + ) + assert "this is the body of the email" in machine.succeed( + "curl --fail http://localhost:8025/api/v2/messages" + ) + ''; +}) diff --git a/nixos/tests/matrix-synapse.nix b/nixos/tests/matrix-synapse.nix index 6c8f1e188d528..9a1ff8a0d3ed0 100644 --- a/nixos/tests/matrix-synapse.nix +++ b/nixos/tests/matrix-synapse.nix @@ -29,7 +29,7 @@ import ./make-test-python.nix ({ pkgs, ... } : let in { name = "matrix-synapse"; - meta = with pkgs.stdenv.lib; { + meta = with pkgs.lib; { maintainers = teams.matrix.members; }; diff --git a/nixos/tests/metabase.nix b/nixos/tests/metabase.nix index 65619cc793a74..370114e922230 100644 --- a/nixos/tests/metabase.nix +++ b/nixos/tests/metabase.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "metabase"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ mmahut ]; }; diff --git a/nixos/tests/minecraft-server.nix b/nixos/tests/minecraft-server.nix index 53780e4636ca8..e6e0bca972a97 100644 --- a/nixos/tests/minecraft-server.nix +++ b/nixos/tests/minecraft-server.nix @@ -4,7 +4,7 @@ let rcon-port = 43000; in import ./make-test-python.nix ({ pkgs, ... }: { name = "minecraft-server"; - meta = with pkgs.stdenv.lib.maintainers; { maintainers = [ nequissimus ]; }; + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; nodes.server = { ... }: { environment.systemPackages = [ pkgs.mcrcon ]; diff --git a/nixos/tests/minecraft.nix b/nixos/tests/minecraft.nix index e0c35f2d27695..3225ebac392ab 100644 --- a/nixos/tests/minecraft.nix +++ b/nixos/tests/minecraft.nix @@ -21,7 +21,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: { in '' client.wait_for_x() client.execute("su - alice -c minecraft-launcher &") - client.wait_for_text("CONTINUE WITHOUT LOGIN") + client.wait_for_text("Create a new Microsoft account") client.sleep(10) client.screenshot("launcher") ''; diff --git a/nixos/tests/miniflux.nix b/nixos/tests/miniflux.nix index 7d83d061a9df7..9f8b52c3c8570 100644 --- a/nixos/tests/miniflux.nix +++ b/nixos/tests/miniflux.nix @@ -11,7 +11,7 @@ in with lib; { name = "miniflux"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ bricewge ]; + meta.maintainers = with pkgs.lib.maintainers; [ bricewge ]; nodes = { default = diff --git a/nixos/tests/minio.nix b/nixos/tests/minio.nix index 02d1f7aa6c208..e49c517098aea 100644 --- a/nixos/tests/minio.nix +++ b/nixos/tests/minio.nix @@ -20,7 +20,7 @@ let ''; in { name = "minio"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ bachp ]; }; diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix index 40661cdca0a11..fda2e60a41b6f 100644 --- a/nixos/tests/misc.nix +++ b/nixos/tests/misc.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : rec { name = "misc"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco ]; }; diff --git a/nixos/tests/molly-brown.nix b/nixos/tests/molly-brown.nix index 09ce42726ca98..bfc036e81ba04 100644 --- a/nixos/tests/molly-brown.nix +++ b/nixos/tests/molly-brown.nix @@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, ... }: in { name = "molly-brown"; - meta = with pkgs.stdenv.lib.maintainers; { maintainers = [ ehmry ]; }; + meta = with pkgs.lib.maintainers; { maintainers = [ ehmry ]; }; nodes = { diff --git a/nixos/tests/mongodb.nix b/nixos/tests/mongodb.nix index 1a71238830189..9c6fdfb1ca76e 100644 --- a/nixos/tests/mongodb.nix +++ b/nixos/tests/mongodb.nix @@ -26,7 +26,7 @@ import ./make-test-python.nix ({ pkgs, ... }: in { name = "mongodb"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ bluescreen303 offline cstrahan rvl phile314 ]; }; diff --git a/nixos/tests/morty.nix b/nixos/tests/morty.nix index 924dce2717e3b..9909596820d31 100644 --- a/nixos/tests/morty.nix +++ b/nixos/tests/morty.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "morty"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ leenaars ]; }; diff --git a/nixos/tests/mosquitto.nix b/nixos/tests/mosquitto.nix index 1f2fdf4237fa7..308c1396013d6 100644 --- a/nixos/tests/mosquitto.nix +++ b/nixos/tests/mosquitto.nix @@ -7,7 +7,7 @@ let topic = "test/foo"; in { name = "mosquitto"; - meta = with pkgs.stdenv.lib; { + meta = with pkgs.lib; { maintainers = with maintainers; [ peterhoeg ]; }; diff --git a/nixos/tests/mpd.nix b/nixos/tests/mpd.nix index 60aef586ad5c9..5c969fc9c9176 100644 --- a/nixos/tests/mpd.nix +++ b/nixos/tests/mpd.nix @@ -27,10 +27,12 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: after = [ "mpd.service" ]; wantedBy = [ "default.target" ]; script = '' - mkdir -p ${musicDirectory} && chown -R ${user}:${group} ${musicDirectory} cp ${track} ${musicDirectory} - chown ${user}:${group} ${musicDirectory}/$(basename ${track}) ''; + serviceConfig = { + User = user; + Group = group; + }; }; mkServer = { mpd, musicService, }: @@ -41,7 +43,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: }; in { name = "mpd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ emmanuelrosa ]; }; @@ -105,7 +107,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: for track in tracks.splitlines(): server.succeed(f"{mpc} add {track}") - _, added_tracks = server.execute(f"{mpc} listall") + _, added_tracks = server.execute(f"{mpc} playlist") # Check we succeeded adding audio tracks to the playlist assert len(added_tracks.splitlines()) > 0 diff --git a/nixos/tests/mumble.nix b/nixos/tests/mumble.nix index cb3e0ec42fc58..717f3c7892888 100644 --- a/nixos/tests/mumble.nix +++ b/nixos/tests/mumble.nix @@ -14,7 +14,7 @@ let in { name = "mumble"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ thoughtpolice eelco ]; }; diff --git a/nixos/tests/munin.nix b/nixos/tests/munin.nix index 7b674db7768d9..4ec17e0339df0 100644 --- a/nixos/tests/munin.nix +++ b/nixos/tests/munin.nix @@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "munin"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ domenkozar eelco ]; }; @@ -27,7 +27,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { }; # increase the systemd timer interval so it fires more often - systemd.timers.munin-cron.timerConfig.OnCalendar = pkgs.stdenv.lib.mkForce "*:*:0/10"; + systemd.timers.munin-cron.timerConfig.OnCalendar = pkgs.lib.mkForce "*:*:0/10"; }; }; diff --git a/nixos/tests/mutable-users.nix b/nixos/tests/mutable-users.nix index 49c7f78b82edf..e3f002d9b1988 100644 --- a/nixos/tests/mutable-users.nix +++ b/nixos/tests/mutable-users.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "mutable-users"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ gleber ]; }; diff --git a/nixos/tests/mxisd.nix b/nixos/tests/mxisd.nix index b2b60db4d8227..22755ea353b64 100644 --- a/nixos/tests/mxisd.nix +++ b/nixos/tests/mxisd.nix @@ -1,7 +1,7 @@ import ./make-test-python.nix ({ pkgs, ... } : { name = "mxisd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ mguentner ]; }; diff --git a/nixos/tests/mysql/mariadb-galera-mariabackup.nix b/nixos/tests/mysql/mariadb-galera-mariabackup.nix index cae55878060c7..a4b893a9f33a9 100644 --- a/nixos/tests/mysql/mariadb-galera-mariabackup.nix +++ b/nixos/tests/mysql/mariadb-galera-mariabackup.nix @@ -6,7 +6,7 @@ let in { name = "mariadb-galera-mariabackup"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ izorkin ]; }; diff --git a/nixos/tests/mysql/mariadb-galera-rsync.nix b/nixos/tests/mysql/mariadb-galera-rsync.nix index 4318efae8a936..6fb3cfef8d731 100644 --- a/nixos/tests/mysql/mariadb-galera-rsync.nix +++ b/nixos/tests/mysql/mariadb-galera-rsync.nix @@ -6,7 +6,7 @@ let in { name = "mariadb-galera-rsync"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ izorkin ]; }; diff --git a/nixos/tests/mysql/mysql-backup.nix b/nixos/tests/mysql/mysql-backup.nix index c4c1079a8a641..d428fb6c16e68 100644 --- a/nixos/tests/mysql/mysql-backup.nix +++ b/nixos/tests/mysql/mysql-backup.nix @@ -1,7 +1,7 @@ # Test whether mysqlBackup option works import ./../make-test-python.nix ({ pkgs, ... } : { name = "mysql-backup"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ rvl ]; }; diff --git a/nixos/tests/mysql/mysql-replication.nix b/nixos/tests/mysql/mysql-replication.nix index b5e0032501936..ad84c801ea106 100644 --- a/nixos/tests/mysql/mysql-replication.nix +++ b/nixos/tests/mysql/mysql-replication.nix @@ -7,7 +7,7 @@ in { name = "mysql-replication"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco shlevy ]; }; diff --git a/nixos/tests/mysql/mysql.nix b/nixos/tests/mysql/mysql.nix index 5437a2860437e..50ad5c68aef1d 100644 --- a/nixos/tests/mysql/mysql.nix +++ b/nixos/tests/mysql/mysql.nix @@ -1,6 +1,6 @@ import ./../make-test-python.nix ({ pkgs, ...} : { name = "mysql"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco shlevy ]; }; @@ -98,7 +98,7 @@ import ./../make-test-python.nix ({ pkgs, ...} : { }]; services.mysql.settings = { mysqld = { - plugin-load-add = [ "ha_tokudb.so" "ha_rocksdb.so" ]; + plugin-load-add = [ "ha_rocksdb.so" ]; }; }; services.mysql.package = pkgs.mariadb; @@ -185,19 +185,5 @@ import ./../make-test-python.nix ({ pkgs, ...} : { mariadb.succeed( "echo 'use testdb; drop table rocksdb;' | sudo -u testuser mysql -u testuser" ) - '' + pkgs.stdenv.lib.optionalString pkgs.stdenv.isx86_64 '' - # Check if TokuDB plugin works - mariadb.succeed( - "echo 'use testdb; create table tokudb (test_id INT, PRIMARY KEY (test_id)) ENGINE = TokuDB;' | sudo -u testuser mysql -u testuser" - ) - mariadb.succeed( - "echo 'use testdb; insert into tokudb values (25);' | sudo -u testuser mysql -u testuser" - ) - mariadb.succeed( - "echo 'use testdb; select test_id from tokudb;' | sudo -u testuser mysql -u testuser -N | grep 25" - ) - mariadb.succeed( - "echo 'use testdb; drop table tokudb;' | sudo -u testuser mysql -u testuser" - ) ''; }) diff --git a/nixos/tests/n8n.nix b/nixos/tests/n8n.nix new file mode 100644 index 0000000000000..ed93639f2a429 --- /dev/null +++ b/nixos/tests/n8n.nix @@ -0,0 +1,25 @@ +import ./make-test-python.nix ({ lib, ... }: + +with lib; + +let + port = 5678; +in +{ + name = "n8n"; + meta.maintainers = with maintainers; [ freezeboy ]; + + nodes.machine = + { pkgs, ... }: + { + services.n8n = { + enable = true; + }; + }; + + testScript = '' + machine.wait_for_unit("n8n.service") + machine.wait_for_open_port("${toString port}") + machine.succeed("curl --fail http://localhost:${toString port}/") + ''; +}) diff --git a/nixos/tests/nagios.nix b/nixos/tests/nagios.nix index 6f5d444728788..e4d8dabedf72c 100644 --- a/nixos/tests/nagios.nix +++ b/nixos/tests/nagios.nix @@ -1,7 +1,7 @@ import ./make-test-python.nix ( { pkgs, ... }: { name = "nagios"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ symphorien ]; }; diff --git a/nixos/tests/nano.nix b/nixos/tests/nano.nix index 9e0a9e147f2c5..6585a6842e857 100644 --- a/nixos/tests/nano.nix +++ b/nixos/tests/nano.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "nano"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; diff --git a/nixos/tests/nat.nix b/nixos/tests/nat.nix index 0d1f7aaedfa23..545eb46f2bf59 100644 --- a/nixos/tests/nat.nix +++ b/nixos/tests/nat.nix @@ -23,7 +23,7 @@ import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? { name = "nat" + (if withFirewall then "WithFirewall" else "Standalone") + (lib.optionalString withConntrackHelpers "withConntrackHelpers"); - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco rob ]; }; diff --git a/nixos/tests/ncdns.nix b/nixos/tests/ncdns.nix index 9960ac63e26b0..50193676f34f3 100644 --- a/nixos/tests/ncdns.nix +++ b/nixos/tests/ncdns.nix @@ -24,7 +24,7 @@ in { name = "ncdns"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ rnhmjoj ]; }; diff --git a/nixos/tests/ndppd.nix b/nixos/tests/ndppd.nix index b67b26a79341f..e79e2a097b406 100644 --- a/nixos/tests/ndppd.nix +++ b/nixos/tests/ndppd.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : { name = "ndppd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ fpletz ]; }; diff --git a/nixos/tests/netdata.nix b/nixos/tests/netdata.nix index 4ddc96e8bc224..0f26630da9d4b 100644 --- a/nixos/tests/netdata.nix +++ b/nixos/tests/netdata.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "netdata"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ cransom ]; }; diff --git a/nixos/tests/networking-proxy.nix b/nixos/tests/networking-proxy.nix index bae9c66ed61a2..62b5e690f6d1e 100644 --- a/nixos/tests/networking-proxy.nix +++ b/nixos/tests/networking-proxy.nix @@ -12,7 +12,7 @@ let default-config = { }; in import ./make-test-python.nix ({ pkgs, ...} : { name = "networking-proxy"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ]; }; diff --git a/nixos/tests/nextcloud/basic.nix b/nixos/tests/nextcloud/basic.nix index 72fb020dca708..9005044704279 100644 --- a/nixos/tests/nextcloud/basic.nix +++ b/nixos/tests/nextcloud/basic.nix @@ -3,7 +3,7 @@ import ../make-test-python.nix ({ pkgs, ...}: let adminuser = "root"; in { name = "nextcloud-basic"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ globin eqyiel ]; }; @@ -42,6 +42,7 @@ in { enable = true; startAt = "20:00"; }; + phpExtraExtensions = all: [ all.bz2 ]; }; environment.systemPackages = [ cfg.services.nextcloud.occ ]; diff --git a/nixos/tests/nextcloud/with-mysql-and-memcached.nix b/nixos/tests/nextcloud/with-mysql-and-memcached.nix index bec3815a3e14c..82041874de43f 100644 --- a/nixos/tests/nextcloud/with-mysql-and-memcached.nix +++ b/nixos/tests/nextcloud/with-mysql-and-memcached.nix @@ -3,7 +3,7 @@ import ../make-test-python.nix ({ pkgs, ...}: let adminuser = "root"; in { name = "nextcloud-with-mysql-and-memcached"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eqyiel ]; }; diff --git a/nixos/tests/nextcloud/with-postgresql-and-redis.nix b/nixos/tests/nextcloud/with-postgresql-and-redis.nix index 40a208115c32c..81af620598ee8 100644 --- a/nixos/tests/nextcloud/with-postgresql-and-redis.nix +++ b/nixos/tests/nextcloud/with-postgresql-and-redis.nix @@ -3,7 +3,7 @@ import ../make-test-python.nix ({ pkgs, ...}: let adminuser = "custom-admin-username"; in { name = "nextcloud-with-postgresql-and-redis"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eqyiel ]; }; diff --git a/nixos/tests/nexus.nix b/nixos/tests/nexus.nix index 1ec5c40476a68..2a30a4eb2cc87 100644 --- a/nixos/tests/nexus.nix +++ b/nixos/tests/nexus.nix @@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "nexus"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ironpinguin ma27 ]; }; diff --git a/nixos/tests/nfs/simple.nix b/nixos/tests/nfs/simple.nix index c49ebddc2fddf..630c68a5b05d0 100644 --- a/nixos/tests/nfs/simple.nix +++ b/nixos/tests/nfs/simple.nix @@ -19,7 +19,7 @@ in { name = "nfs"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco ]; }; diff --git a/nixos/tests/nginx-sandbox.nix b/nixos/tests/nginx-sandbox.nix index 514318c9456c4..2d512725f2650 100644 --- a/nixos/tests/nginx-sandbox.nix +++ b/nixos/tests/nginx-sandbox.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "nginx-sandbox"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ izorkin ]; }; diff --git a/nixos/tests/nginx-sso.nix b/nixos/tests/nginx-sso.nix index 8834fc31c387b..aeb89859c73f1 100644 --- a/nixos/tests/nginx-sso.nix +++ b/nixos/tests/nginx-sso.nix @@ -1,7 +1,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "nginx-sso"; meta = { - maintainers = with pkgs.stdenv.lib.maintainers; [ delroth ]; + maintainers = with pkgs.lib.maintainers; [ delroth ]; }; machine = { diff --git a/nixos/tests/nginx.nix b/nixos/tests/nginx.nix index 18822f095688b..5686afcd043e8 100644 --- a/nixos/tests/nginx.nix +++ b/nixos/tests/nginx.nix @@ -6,7 +6,7 @@ # 3. nginx doesn't restart on configuration changes (only reloads) import ./make-test-python.nix ({ pkgs, ... }: { name = "nginx"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ mbbx6spp danbst ]; }; diff --git a/nixos/tests/nomad.nix b/nixos/tests/nomad.nix new file mode 100644 index 0000000000000..51b11a8fef909 --- /dev/null +++ b/nixos/tests/nomad.nix @@ -0,0 +1,97 @@ +import ./make-test-python.nix ( + { lib, ... }: { + name = "nomad"; + nodes = { + default_server = { pkgs, lib, ... }: { + networking = { + interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [{ + address = "192.168.1.1"; + prefixLength = 16; + }]; + }; + + environment.etc."nomad.custom.json".source = + (pkgs.formats.json { }).generate "nomad.custom.json" { + region = "universe"; + datacenter = "earth"; + }; + + services.nomad = { + enable = true; + + settings = { + server = { + enabled = true; + bootstrap_expect = 1; + }; + }; + + extraSettingsPaths = [ "/etc/nomad.custom.json" ]; + enableDocker = false; + }; + }; + + custom_state_dir_server = { pkgs, lib, ... }: { + networking = { + interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [{ + address = "192.168.1.1"; + prefixLength = 16; + }]; + }; + + environment.etc."nomad.custom.json".source = + (pkgs.formats.json { }).generate "nomad.custom.json" { + region = "universe"; + datacenter = "earth"; + }; + + services.nomad = { + enable = true; + dropPrivileges = false; + + settings = { + data_dir = "/nomad/data/dir"; + server = { + enabled = true; + bootstrap_expect = 1; + }; + }; + + extraSettingsPaths = [ "/etc/nomad.custom.json" ]; + enableDocker = false; + }; + + systemd.services.nomad.serviceConfig.ExecStartPre = "${pkgs.writeShellScript "mk_data_dir" '' + set -euxo pipefail + + ${pkgs.coreutils}/bin/mkdir -p /nomad/data/dir + ''}"; + }; + }; + + testScript = '' + def test_nomad_server(server): + server.wait_for_unit("nomad.service") + + # wait for healthy server + server.wait_until_succeeds( + "[ $(nomad operator raft list-peers | grep true | wc -l) == 1 ]" + ) + + # wait for server liveness + server.succeed("[ $(nomad server members | grep -o alive | wc -l) == 1 ]") + + # check the region + server.succeed("nomad server members | grep -o universe") + + # check the datacenter + server.succeed("[ $(nomad server members | grep -o earth | wc -l) == 1 ]") + + + servers = [default_server, custom_state_dir_server] + + for server in servers: + test_nomad_server(server) + ''; + } +) diff --git a/nixos/tests/novacomd.nix b/nixos/tests/novacomd.nix index 940210dee2355..b470c117e1e15 100644 --- a/nixos/tests/novacomd.nix +++ b/nixos/tests/novacomd.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "novacomd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ dtzWill ]; }; diff --git a/nixos/tests/nsd.nix b/nixos/tests/nsd.nix index bcc14e817a876..a558ee0a42542 100644 --- a/nixos/tests/nsd.nix +++ b/nixos/tests/nsd.nix @@ -7,7 +7,7 @@ let }; in import ./make-test-python.nix ({ pkgs, ...} : { name = "nsd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ aszlig ]; }; diff --git a/nixos/tests/nzbget.nix b/nixos/tests/nzbget.nix index b39c9b035e612..d6111ba079c85 100644 --- a/nixos/tests/nzbget.nix +++ b/nixos/tests/nzbget.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "nzbget"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ aanderse flokli ]; }; @@ -10,7 +10,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { # hack, don't add (unfree) unrar to nzbget's path, # so we can run this test in CI - systemd.services.nzbget.path = pkgs.stdenv.lib.mkForce [ pkgs.p7zip ]; + systemd.services.nzbget.path = pkgs.lib.mkForce [ pkgs.p7zip ]; }; }; diff --git a/nixos/tests/nzbhydra2.nix b/nixos/tests/nzbhydra2.nix new file mode 100644 index 0000000000000..c82c756c3a1ce --- /dev/null +++ b/nixos/tests/nzbhydra2.nix @@ -0,0 +1,17 @@ +import ./make-test-python.nix ({ lib, ... }: + + with lib; + + { + name = "nzbhydra2"; + meta.maintainers = with maintainers; [ jamiemagee ]; + + nodes.machine = { pkgs, ... }: { services.nzbhydra2.enable = true; }; + + testScript = '' + machine.start() + machine.wait_for_unit("nzbhydra2.service") + machine.wait_for_open_port(5076) + machine.succeed("curl --fail http://localhost:5076/") + ''; + }) diff --git a/nixos/tests/openarena.nix b/nixos/tests/openarena.nix index 395ed9153ea11..461a35e89fe79 100644 --- a/nixos/tests/openarena.nix +++ b/nixos/tests/openarena.nix @@ -11,7 +11,7 @@ let in { name = "openarena"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ fpletz ]; }; diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix index e9692b5032721..003813379e697 100644 --- a/nixos/tests/openssh.nix +++ b/nixos/tests/openssh.nix @@ -4,7 +4,7 @@ let inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey; in { name = "openssh"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ aszlig eelco ]; }; diff --git a/nixos/tests/opentabletdriver.nix b/nixos/tests/opentabletdriver.nix new file mode 100644 index 0000000000000..fe345a7bec735 --- /dev/null +++ b/nixos/tests/opentabletdriver.nix @@ -0,0 +1,30 @@ +import ./make-test-python.nix ( { pkgs, ... }: let + testUser = "alice"; +in { + name = "opentabletdriver"; + meta = { + maintainers = with pkgs.lib.maintainers; [ thiagokokada ]; + }; + + machine = { pkgs, ... }: + { + imports = [ + ./common/user-account.nix + ./common/x11.nix + ]; + test-support.displayManager.auto.user = testUser; + hardware.opentabletdriver.enable = true; + }; + + testScript = + '' + machine.start() + machine.wait_for_x() + machine.wait_for_unit("opentabletdriver.service", "${testUser}") + + machine.succeed("cat /etc/udev/rules.d/99-opentabletdriver.rules") + # Will fail if service is not running + # Needs to run as the same user that started the service + machine.succeed("su - ${testUser} -c 'otd detect'") + ''; +}) diff --git a/nixos/tests/overlayfs.nix b/nixos/tests/overlayfs.nix index 33794deb9ed83..142e7d378b2f5 100644 --- a/nixos/tests/overlayfs.nix +++ b/nixos/tests/overlayfs.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "overlayfs"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ bachp ]; + meta.maintainers = with pkgs.lib.maintainers; [ bachp ]; machine = { pkgs, ... }: { virtualisation.emptyDiskImages = [ 512 ]; diff --git a/nixos/tests/packagekit.nix b/nixos/tests/packagekit.nix index 7e93ad35e80a8..28d1374bf92cd 100644 --- a/nixos/tests/packagekit.nix +++ b/nixos/tests/packagekit.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "packagekit"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ peterhoeg ]; }; diff --git a/nixos/tests/pantheon.nix b/nixos/tests/pantheon.nix index c0434f20754ce..3894440333c99 100644 --- a/nixos/tests/pantheon.nix +++ b/nixos/tests/pantheon.nix @@ -3,7 +3,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "pantheon"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = pkgs.pantheon.maintainers; }; diff --git a/nixos/tests/peerflix.nix b/nixos/tests/peerflix.nix index 6e534dedc4715..4800413783b1b 100644 --- a/nixos/tests/peerflix.nix +++ b/nixos/tests/peerflix.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "peerflix"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ offline ]; }; diff --git a/nixos/tests/pgmanage.nix b/nixos/tests/pgmanage.nix index 4f5dbed24a97f..6f8f2f9653408 100644 --- a/nixos/tests/pgmanage.nix +++ b/nixos/tests/pgmanage.nix @@ -6,7 +6,7 @@ let in { name = "pgmanage"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ basvandijk ]; }; nodes = { diff --git a/nixos/tests/pinnwand.nix b/nixos/tests/pinnwand.nix index 2204e74b2c286..0c583e1104dec 100644 --- a/nixos/tests/pinnwand.nix +++ b/nixos/tests/pinnwand.nix @@ -25,7 +25,7 @@ let in { name = "pinnwand"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers =[ hexa ]; }; diff --git a/nixos/tests/plasma5.nix b/nixos/tests/plasma5.nix index 5a603f8cbfb5b..f09859a055d5c 100644 --- a/nixos/tests/plasma5.nix +++ b/nixos/tests/plasma5.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "plasma5"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ttuegel ]; }; @@ -35,6 +35,9 @@ import ./make-test-python.nix ({ pkgs, ...} : machine.wait_until_succeeds("pgrep plasmashell") machine.wait_for_window("^Desktop ") + with subtest("Check that KDED is running"): + machine.succeed("pgrep kded5") + with subtest("Check that logging in has given the user ownership of devices"): machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}") diff --git a/nixos/tests/pleroma.nix b/nixos/tests/pleroma.nix new file mode 100644 index 0000000000000..797cac44f9562 --- /dev/null +++ b/nixos/tests/pleroma.nix @@ -0,0 +1,265 @@ +/* + Pleroma E2E VM test. + + Abstract: + ========= + Using pleroma, postgresql, a local CA cert, a nginx reverse proxy + and a toot-based client, we're going to: + + 1. Provision a pleroma service from scratch (pleroma config + postgres db). + 2. Create a "jamy" admin user. + 3. Send a toot from this user. + 4. Send a upload from this user. + 5. Check the toot is part of the server public timeline + + Notes: + - We need a fully functional TLS setup without having any access to + the internet. We do that by issuing a self-signed cert, add this + self-cert to the hosts pki trust store and finally spoof the + hostnames using /etc/hosts. + - For this NixOS test, we *had* to store some DB-related and + pleroma-related secrets to the store. Keep in mind the store is + world-readable, it's the worst place possible to store *any* + secret. **DO NOT DO THIS IN A REAL WORLD DEPLOYMENT**. +*/ + +import ./make-test-python.nix ({ pkgs, ... }: + let + send-toot = pkgs.writeScriptBin "send-toot" '' + set -eux + # toot is using the requests library internally. This library + # sadly embed its own certificate store instead of relying on the + # system one. Overriding this pretty bad default behaviour. + export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt + + export TOOT_LOGIN_CLI_PASSWORD="jamy-password" + toot login_cli -i "pleroma.nixos.test" -e "jamy@nixos.test" + echo "Login OK" + + # Send a toot then verify it's part of the public timeline + echo "y" | toot post "hello world Jamy here" + echo "Send toot OK" + echo "y" | toot timeline | grep -c "hello world Jamy here" + echo "Get toot from timeline OK" + + # Test file upload + echo "y" | toot upload ${db-seed} | grep -c "https://pleroma.nixos.test/media" + echo "File upload OK" + + echo "=====================================================" + echo "= SUCCESS =" + echo "= =" + echo "= We were able to sent a toot + a upload and =" + echo "= retrieve both of them in the public timeline. =" + echo "=====================================================" + ''; + + provision-db = pkgs.writeScriptBin "provision-db" '' + set -eux + sudo -u postgres psql -f ${db-seed} + ''; + + test-db-passwd = "SccZOvTGM//BMrpoQj68JJkjDkMGb4pHv2cECWiI+XhVe3uGJTLI0vFV/gDlZ5jJ"; + + /* For this NixOS test, we *had* to store this secret to the store. + Keep in mind the store is world-readable, it's the worst place + possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD + DEPLOYMENT**.*/ + db-seed = pkgs.writeText "provision.psql" '' + CREATE USER pleroma WITH ENCRYPTED PASSWORD '${test-db-passwd}'; + CREATE DATABASE pleroma OWNER pleroma; + \c pleroma; + --Extensions made by ecto.migrate that need superuser access + CREATE EXTENSION IF NOT EXISTS citext; + CREATE EXTENSION IF NOT EXISTS pg_trgm; + CREATE EXTENSION IF NOT EXISTS "uuid-ossp"; + ''; + + pleroma-conf = '' + import Config + + config :pleroma, Pleroma.Web.Endpoint, + url: [host: "pleroma.nixos.test", scheme: "https", port: 443], + http: [ip: {127, 0, 0, 1}, port: 4000] + + config :pleroma, :instance, + name: "NixOS test pleroma server", + email: "pleroma@nixos.test", + notify_email: "pleroma@nixos.test", + limit: 5000, + registrations_open: true + + config :pleroma, :media_proxy, + enabled: false, + redirect_on_failure: true + #base_url: "https://cache.pleroma.social" + + config :pleroma, Pleroma.Repo, + adapter: Ecto.Adapters.Postgres, + username: "pleroma", + password: "${test-db-passwd}", + database: "pleroma", + hostname: "localhost", + pool_size: 10, + prepare: :named, + parameters: [ + plan_cache_mode: "force_custom_plan" + ] + + config :pleroma, :database, rum_enabled: false + config :pleroma, :instance, static_dir: "/var/lib/pleroma/static" + config :pleroma, Pleroma.Uploaders.Local, uploads: "/var/lib/pleroma/uploads" + config :pleroma, configurable_from_database: false + ''; + + /* For this NixOS test, we *had* to store this secret to the store. + Keep in mind the store is world-readable, it's the worst place + possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD + DEPLOYMENT**. + In a real-word deployment, you'd handle this either by: + - manually upload your pleroma secrets to /var/lib/pleroma/secrets.exs + - use a deployment tool such as morph or NixOps to deploy your secrets. + */ + pleroma-conf-secret = pkgs.writeText "secrets.exs" '' + import Config + + config :joken, default_signer: "PS69/wMW7X6FIQPABt9lwvlZvgrJIncfiAMrK9J5mjVus/7/NJJi1DsDA1OghBE5" + + config :pleroma, Pleroma.Web.Endpoint, + secret_key_base: "NvfmU7lYaQrmmxt4NACm0AaAfN9t6WxsrX0NCB4awkGHvr1S7jyshlEmrjaPFhhq", + signing_salt: "3L41+BuJ" + + config :web_push_encryption, :vapid_details, + subject: "mailto:pleroma@nixos.test", + public_key: "BKjfNX9-UqAcncaNqERQtF7n9pKrB0-MO-juv6U5E5XQr_Tg5D-f8AlRjduAguDpyAngeDzG8MdrTejMSL4VF30", + private_key: "k7o9onKMQrgMjMb6l4fsxSaXO0BTNAer5MVSje3q60k" + ''; + + /* For this NixOS test, we *had* to store this secret to the store. + Keep in mind the store is world-readable, it's the worst place + possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD + DEPLOYMENT**. + In a real-word deployment, you'd handle this either by: + - manually upload your pleroma secrets to /var/lib/pleroma/secrets.exs + - use a deployment tool such as morph or NixOps to deploy your secrets. + */ + provision-secrets = pkgs.writeScriptBin "provision-secrets" '' + set -eux + cp "${pleroma-conf-secret}" "/var/lib/pleroma/secrets.exs" + chown pleroma:pleroma /var/lib/pleroma/secrets.exs + ''; + + /* For this NixOS test, we *had* to store this secret to the store. + Keep in mind the store is world-readable, it's the worst place + possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD + DEPLOYMENT**. + */ + provision-user = pkgs.writeScriptBin "provision-user" '' + set -eux + + # Waiting for pleroma to be up. + timeout 5m bash -c 'while [[ "$(curl -s -o /dev/null -w '%{http_code}' https://pleroma.nixos.test/api/v1/instance)" != "200" ]]; do sleep 2; done' + pleroma_ctl user new jamy jamy@nixos.test --password 'jamy-password' --moderator --admin -y + ''; + + tls-cert = pkgs.runCommandNoCC "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } '' + openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=pleroma.nixos.test' + mkdir -p $out + cp key.pem cert.pem $out + ''; + + /* Toot is preventing users from feeding login_cli a password non + interactively. While it makes sense most of the times, it's + preventing us to login in this non-interactive test. This patch + introduce a TOOT_LOGIN_CLI_PASSWORD env variable allowing us to + provide a password to toot login_cli + + If https://github.com/ihabunek/toot/pull/180 gets merged at some + point, feel free to remove this patch. */ + custom-toot = pkgs.toot.overrideAttrs(old:{ + patches = [ (pkgs.fetchpatch { + url = "https://github.com/NinjaTrappeur/toot/commit/b4a4c30f41c0cb7e336714c2c4af9bc9bfa0c9f2.patch"; + sha256 = "sha256-0xxNwjR/fStLjjUUhwzCCfrghRVts+fc+fvVJqVcaFg="; + }) ]; + }); + + hosts = nodes: '' + ${nodes.pleroma.config.networking.primaryIPAddress} pleroma.nixos.test + ${nodes.client.config.networking.primaryIPAddress} client.nixos.test + ''; + in { + name = "pleroma"; + nodes = { + client = { nodes, pkgs, config, ... }: { + security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ]; + networking.extraHosts = hosts nodes; + environment.systemPackages = with pkgs; [ + custom-toot + send-toot + ]; + }; + pleroma = { nodes, pkgs, config, ... }: { + security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ]; + networking.extraHosts = hosts nodes; + networking.firewall.enable = false; + environment.systemPackages = with pkgs; [ + provision-db + provision-secrets + provision-user + ]; + services = { + pleroma = { + enable = true; + configs = [ + pleroma-conf + ]; + }; + postgresql = { + enable = true; + package = pkgs.postgresql_12; + }; + nginx = { + enable = true; + virtualHosts."pleroma.nixos.test" = { + addSSL = true; + sslCertificate = "${tls-cert}/cert.pem"; + sslCertificateKey = "${tls-cert}/key.pem"; + locations."/" = { + proxyPass = "http://127.0.0.1:4000"; + extraConfig = '' + add_header 'Access-Control-Allow-Origin' '*' always; + add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always; + add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always; + if ($request_method = OPTIONS) { + return 204; + } + add_header X-XSS-Protection "1; mode=block"; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options DENY; + add_header X-Content-Type-Options nosniff; + add_header Referrer-Policy same-origin; + add_header X-Download-Options noopen; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + client_max_body_size 16m; + ''; + }; + }; + }; + }; + }; + }; + + testScript = { nodes, ... }: '' + pleroma.wait_for_unit("postgresql.service") + pleroma.succeed("provision-db") + pleroma.succeed("provision-secrets") + pleroma.systemctl("restart pleroma.service") + pleroma.wait_for_unit("pleroma.service") + pleroma.succeed("provision-user") + client.succeed("send-toot") + ''; +}) diff --git a/nixos/tests/podman.nix b/nixos/tests/podman.nix index dd28563dc4c16..4985ff60365c9 100644 --- a/nixos/tests/podman.nix +++ b/nixos/tests/podman.nix @@ -61,11 +61,19 @@ import ./make-test-python.nix ( podman.succeed("podman stop sleeping") podman.succeed("podman rm sleeping") + # create systemd session for rootless + podman.succeed("loginctl enable-linger alice") - podman.succeed( - "mkdir -p /tmp/podman-run-1000/libpod && chown alice -R /tmp/podman-run-1000" - ) - + with subtest("Run container rootless with runc"): + podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg")) + podman.succeed( + su_cmd( + "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10" + ) + ) + podman.succeed(su_cmd("podman ps | grep sleeping")) + podman.succeed(su_cmd("podman stop sleeping")) + podman.succeed(su_cmd("podman rm sleeping")) with subtest("Run container rootless with crun"): podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg")) @@ -77,7 +85,6 @@ import ./make-test-python.nix ( podman.succeed(su_cmd("podman ps | grep sleeping")) podman.succeed(su_cmd("podman stop sleeping")) podman.succeed(su_cmd("podman rm sleeping")) - # As of 2020-11-20, the runc backend doesn't work with cgroupsv2 yet, so we don't run that test. with subtest("Run container rootless with the default backend"): podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg")) diff --git a/nixos/tests/postgis.nix b/nixos/tests/postgis.nix index 84bbb0bc8ec63..9d81ebaad85f2 100644 --- a/nixos/tests/postgis.nix +++ b/nixos/tests/postgis.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "postgis"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ lsix ]; }; diff --git a/nixos/tests/postgresql-wal-receiver.nix b/nixos/tests/postgresql-wal-receiver.nix index 432b46234f9c1..0e8b3bfd6c34f 100644 --- a/nixos/tests/postgresql-wal-receiver.nix +++ b/nixos/tests/postgresql-wal-receiver.nix @@ -1,11 +1,19 @@ +{ system ? builtins.currentSystem, + config ? {}, + pkgs ? import ../.. { inherit system config; } +}: + +with import ../lib/testing-python.nix { inherit system pkgs; }; + let + lib = pkgs.lib; + # Makes a test for a PostgreSQL package, given by name and looked up from `pkgs`. makePostgresqlWalReceiverTest = postgresqlPackage: { name = postgresqlPackage; value = - import ./make-test-python.nix ({ pkgs, lib, ... }: let - + let pkg = pkgs."${postgresqlPackage}"; postgresqlDataDir = "/var/lib/postgresql/${pkg.psqlSchema}"; replicationUser = "wal_receiver_user"; @@ -19,7 +27,7 @@ let then pkgs.writeTextDir "recovery.signal" "" else pkgs.writeTextDir "recovery.conf" "restore_command = 'cp ${walBackupDir}/%f %p'"; - in { + in makeTest { name = "postgresql-wal-receiver-${postgresqlPackage}"; meta.maintainers = with lib.maintainers; [ pacien ]; @@ -104,7 +112,7 @@ let "test $(sudo -u postgres psql --pset='pager=off' --tuples-only --command='select count(distinct val) from dummy;') -eq 100" ) ''; - }); + }; }; # Maps the generic function over all attributes of PostgreSQL packages diff --git a/nixos/tests/postgresql.nix b/nixos/tests/postgresql.nix index 3201e22555eab..091e64294ac5b 100644 --- a/nixos/tests/postgresql.nix +++ b/nixos/tests/postgresql.nix @@ -23,7 +23,7 @@ let ''; make-postgresql-test = postgresql-name: postgresql-package: backup-all: makeTest { name = postgresql-name; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ zagy ]; }; diff --git a/nixos/tests/predictable-interface-names.nix b/nixos/tests/predictable-interface-names.nix index bab091d57acf1..c0b472638a14d 100644 --- a/nixos/tests/predictable-interface-names.nix +++ b/nixos/tests/predictable-interface-names.nix @@ -5,7 +5,11 @@ let inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest; -in pkgs.lib.listToAttrs (pkgs.lib.crossLists (predictable: withNetworkd: { + testCombinations = pkgs.lib.cartesianProductOfSets { + predictable = [true false]; + withNetworkd = [true false]; + }; +in pkgs.lib.listToAttrs (builtins.map ({ predictable, withNetworkd }: { name = pkgs.lib.optionalString (!predictable) "un" + "predictable" + pkgs.lib.optionalString withNetworkd "Networkd"; value = makeTest { @@ -30,4 +34,4 @@ in pkgs.lib.listToAttrs (pkgs.lib.crossLists (predictable: withNetworkd: { machine.${if predictable then "fail" else "succeed"}("ip link show eth0") ''; }; -}) [[true false] [true false]]) +}) testCombinations) diff --git a/nixos/tests/printing.nix b/nixos/tests/printing.nix index 355c94a038616..6a1801fb28840 100644 --- a/nixos/tests/printing.nix +++ b/nixos/tests/printing.nix @@ -35,7 +35,7 @@ let in { name = "printing"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ domenkozar eelco matthewbauer ]; }; diff --git a/nixos/tests/privacyidea.nix b/nixos/tests/privacyidea.nix index 45c7cd37c241f..b71ff0a1669fe 100644 --- a/nixos/tests/privacyidea.nix +++ b/nixos/tests/privacyidea.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : rec { name = "privacyidea"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ fpletz ]; }; diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix index 0b9957404f3b4..89d17c9de8c06 100644 --- a/nixos/tests/prometheus-exporters.nix +++ b/nixos/tests/prometheus-exporters.nix @@ -96,6 +96,31 @@ let ''; }; + bird = { + exporterConfig = { + enable = true; + }; + metricProvider = { + services.bird2.enable = true; + services.bird2.config = '' + protocol kernel MyObviousTestString { + ipv4 { + import all; + export none; + }; + } + + protocol device { + } + ''; + }; + exporterTest = '' + wait_for_unit("prometheus-bird-exporter.service") + wait_for_open_port(9324) + succeed("curl -sSf http://localhost:9324/metrics | grep -q 'MyObviousTestString'") + ''; + }; + blackbox = { exporterConfig = { enable = true; @@ -197,10 +222,11 @@ let exporterConfig = { enable = true; url = "http://localhost"; - configFile = pkgs.writeText "json-exporter-conf.json" (builtins.toJSON [{ - name = "json_test_metric"; - path = "$.test"; - }]); + configFile = pkgs.writeText "json-exporter-conf.json" (builtins.toJSON { + metrics = [ + { name = "json_test_metric"; path = "$.test"; } + ]; + }); }; metricProvider = { systemd.services.prometheus-json-exporter.after = [ "nginx.service" ]; @@ -216,7 +242,9 @@ let wait_for_open_port(80) wait_for_unit("prometheus-json-exporter.service") wait_for_open_port(7979) - succeed("curl -sSf localhost:7979/metrics | grep -q 'json_test_metric 1'") + succeed( + "curl -sSf 'localhost:7979/probe?target=http://localhost' | grep -q 'json_test_metric 1'" + ) ''; }; @@ -395,7 +423,7 @@ let exporterConfig = { enable = true; passwordFile = "/var/nextcloud-pwfile"; - url = "http://localhost/negative-space.xml"; + url = "http://localhost"; }; metricProvider = { systemd.services.nc-pwfile = let @@ -413,6 +441,7 @@ let basicAuth.nextcloud-exporter = "snakeoilpw"; locations."/" = { root = "${pkgs.prometheus-nextcloud-exporter.src}/serverinfo/testdata"; + tryFiles = "/negative-space.xml =404"; }; }; }; @@ -444,6 +473,67 @@ let ''; }; + nginxlog = { + exporterConfig = { + enable = true; + group = "nginx"; + settings = { + namespaces = [ + { + name = "filelogger"; + source = { + files = [ "/var/log/nginx/filelogger.access.log" ]; + }; + } + { + name = "syslogger"; + source = { + syslog = { + listen_address = "udp://127.0.0.1:10000"; + format = "rfc3164"; + tags = ["nginx"]; + }; + }; + } + ]; + }; + }; + metricProvider = { + services.nginx = { + enable = true; + httpConfig = '' + server { + listen 80; + server_name filelogger.local; + access_log /var/log/nginx/filelogger.access.log; + } + server { + listen 81; + server_name syslogger.local; + access_log syslog:server=127.0.0.1:10000,tag=nginx,severity=info; + } + ''; + }; + }; + exporterTest = '' + wait_for_unit("nginx.service") + wait_for_unit("prometheus-nginxlog-exporter.service") + wait_for_open_port(9117) + wait_for_open_port(80) + wait_for_open_port(81) + succeed("curl http://localhost") + execute("sleep 1") + succeed( + "curl -sSf http://localhost:9117/metrics | grep 'filelogger_http_response_count_total' | grep -q 1" + ) + succeed("curl http://localhost:81") + execute("sleep 1") + succeed( + "curl -sSf http://localhost:9117/metrics | grep 'syslogger_http_response_count_total' | grep -q 1" + ) + ''; + }; + node = { exporterConfig = { enable = true; @@ -530,6 +620,21 @@ let ''; }; + py-air-control = { + nodeName = "py_air_control"; + exporterConfig = { + enable = true; + deviceHostname = "127.0.0.1"; + }; + exporterTest = '' + wait_for_unit("prometheus-py-air-control-exporter.service") + wait_for_open_port(9896) + succeed( + "curl -sSf http://localhost:9896/metrics | grep -q 'py_air_control_sampling_error_total'" + ) + ''; + }; + redis = { exporterConfig = { enable = true; @@ -558,7 +663,7 @@ let wait_for_open_port(11334) wait_for_open_port(7980) wait_until_succeeds( - "curl -sSf localhost:7980/metrics | grep -q 'rspamd_scanned{host=\"rspamd\"} 0'" + "curl -sSf 'localhost:7980/probe?target=http://localhost:11334/stat' | grep -q 'rspamd_scanned{host=\"rspamd\"} 0'" ) ''; }; @@ -594,6 +699,27 @@ let ''; }; + smokeping = { + exporterConfig = { + enable = true; + hosts = ["127.0.0.1"]; + }; + exporterTest = '' + wait_for_unit("prometheus-smokeping-exporter.service") + wait_for_open_port(9374) + wait_until_succeeds( + "curl -sSf localhost:9374/metrics | grep '{}' | grep -qv ' 0$'".format( + 'smokeping_requests_total{host="127.0.0.1",ip="127.0.0.1"} ' + ) + ) + wait_until_succeeds( + "curl -sSf localhost:9374/metrics | grep -q '{}'".format( + 'smokeping_response_ttl{host="127.0.0.1",ip="127.0.0.1"}' + ) + ) + ''; + }; + snmp = { exporterConfig = { enable = true; diff --git a/nixos/tests/prometheus.nix b/nixos/tests/prometheus.nix index 6881c659e6d0c..70ac78a4a4689 100644 --- a/nixos/tests/prometheus.nix +++ b/nixos/tests/prometheus.nix @@ -36,6 +36,7 @@ in import ./make-test-python.nix { nodes = { prometheus = { pkgs, ... }: { virtualisation.diskSize = 2 * 1024; + virtualisation.memorySize = 2048; environment.systemPackages = [ pkgs.jq ]; networking.firewall.allowedTCPPorts = [ grpcPort ]; services.prometheus = { @@ -132,6 +133,7 @@ in import ./make-test-python.nix { store = { pkgs, ... }: { virtualisation.diskSize = 2 * 1024; + virtualisation.memorySize = 2048; environment.systemPackages = with pkgs; [ jq thanos ]; services.thanos.store = { enable = true; diff --git a/nixos/tests/proxy.nix b/nixos/tests/proxy.nix index 6a14a9af59aec..f8a3d576903e3 100644 --- a/nixos/tests/proxy.nix +++ b/nixos/tests/proxy.nix @@ -11,7 +11,7 @@ let }; in { name = "proxy"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco ]; }; diff --git a/nixos/tests/pt2-clone.nix b/nixos/tests/pt2-clone.nix index b502172e2ee5e..3c090b7de4286 100644 --- a/nixos/tests/pt2-clone.nix +++ b/nixos/tests/pt2-clone.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "pt2-clone"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ fgaz ]; }; diff --git a/nixos/tests/quagga.nix b/nixos/tests/quagga.nix index 04590aa0eb386..9aed49bf452f6 100644 --- a/nixos/tests/quagga.nix +++ b/nixos/tests/quagga.nix @@ -23,7 +23,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "quagga"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ tavyc ]; }; diff --git a/nixos/tests/quorum.nix b/nixos/tests/quorum.nix index d5906806a0a2b..498b55ace7af5 100644 --- a/nixos/tests/quorum.nix +++ b/nixos/tests/quorum.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "quorum"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ mmahut ]; }; diff --git a/nixos/tests/rabbitmq.nix b/nixos/tests/rabbitmq.nix index f403e4ac2edc5..8a7fcc0e8991a 100644 --- a/nixos/tests/rabbitmq.nix +++ b/nixos/tests/rabbitmq.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "rabbitmq"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco offline ]; }; diff --git a/nixos/tests/redis.nix b/nixos/tests/redis.nix index 529965d7acdee..ca17156143598 100644 --- a/nixos/tests/redis.nix +++ b/nixos/tests/redis.nix @@ -1,6 +1,10 @@ -import ./make-test-python.nix ({ pkgs, ...} : { +import ./make-test-python.nix ({ pkgs, ... }: +let + redisSocket = "/run/redis/redis.sock"; +in +{ name = "redis"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ flokli ]; }; @@ -10,7 +14,20 @@ import ./make-test-python.nix ({ pkgs, ...} : { { services.redis.enable = true; - services.redis.unixSocket = "/run/redis/redis.sock"; + services.redis.unixSocket = redisSocket; + + # Allow access to the unix socket for the "redis" group. + services.redis.settings.unixsocketperm = "770"; + + users.users."member" = { + createHome = false; + description = "A member of the redis group"; + extraGroups = [ + "redis" + ]; + group = "users"; + shell = "/bin/sh"; + }; }; }; @@ -18,7 +35,11 @@ import ./make-test-python.nix ({ pkgs, ...} : { start_all() machine.wait_for_unit("redis") machine.wait_for_open_port("6379") + + # The unix socket is accessible to the redis group + machine.succeed('su member -c "redis-cli ping | grep PONG"') + machine.succeed("redis-cli ping | grep PONG") - machine.succeed("redis-cli -s /run/redis/redis.sock ping | grep PONG") + machine.succeed("redis-cli -s ${redisSocket} ping | grep PONG") ''; }) diff --git a/nixos/tests/resolv.nix b/nixos/tests/resolv.nix index b506f87451ee7..f0aa7e42aaf35 100644 --- a/nixos/tests/resolv.nix +++ b/nixos/tests/resolv.nix @@ -1,7 +1,7 @@ # Test whether DNS resolving returns multiple records and all address families. import ./make-test-python.nix ({ pkgs, ... } : { name = "resolv"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ckauhaus ]; }; diff --git a/nixos/tests/restic.nix b/nixos/tests/restic.nix index dad5bdfff27dc..0cc8bd39afbb0 100644 --- a/nixos/tests/restic.nix +++ b/nixos/tests/restic.nix @@ -19,7 +19,7 @@ import ./make-test-python.nix ( { name = "restic"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ bbigras i077 ]; }; diff --git a/nixos/tests/ripgrep.nix b/nixos/tests/ripgrep.nix new file mode 100644 index 0000000000000..3ff3bf4be1518 --- /dev/null +++ b/nixos/tests/ripgrep.nix @@ -0,0 +1,13 @@ +import ./make-test-python.nix ({ pkgs, ... }: { + name = "ripgrep"; + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; + + nodes.ripgrep = { pkgs, ... }: { environment.systemPackages = [ pkgs.ripgrep ]; }; + + testScript = '' + ripgrep.succeed('echo "abc\nbcd\ncde" > /tmp/foo') + assert "bcd" in ripgrep.succeed("rg -N 'bcd' /tmp/foo") + assert "bcd\ncde" in ripgrep.succeed("rg -N 'cd' /tmp/foo") + assert "ripgrep ${pkgs.ripgrep.version}" in ripgrep.succeed("rg --version | head -1") + ''; +}) diff --git a/nixos/tests/robustirc-bridge.nix b/nixos/tests/robustirc-bridge.nix index a5c22d73a34f3..8493fd6282128 100644 --- a/nixos/tests/robustirc-bridge.nix +++ b/nixos/tests/robustirc-bridge.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "robustirc-bridge"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ hax404 ]; }; diff --git a/nixos/tests/roundcube.nix b/nixos/tests/roundcube.nix index 97e1125694b6b..763f10a7a2dda 100644 --- a/nixos/tests/roundcube.nix +++ b/nixos/tests/roundcube.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "roundcube"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ globin ]; }; diff --git a/nixos/tests/rsyncd.nix b/nixos/tests/rsyncd.nix index 3639320f645d1..44464e42f28d4 100644 --- a/nixos/tests/rsyncd.nix +++ b/nixos/tests/rsyncd.nix @@ -2,24 +2,35 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "rsyncd"; meta.maintainers = with pkgs.lib.maintainers; [ ehmry ]; - nodes.machine.services.rsyncd = { - enable = true; - settings = { - global = { - "reverse lookup" = false; - "forward lookup" = false; + nodes = let + mkNode = socketActivated: + { config, ... }: { + networking.firewall.allowedTCPPorts = [ config.services.rsyncd.port ]; + services.rsyncd = { + enable = true; + inherit socketActivated; + settings = { + global = { + "reverse lookup" = false; + "forward lookup" = false; + }; + tmp = { + path = "/nix/store"; + comment = "test module"; + }; + }; + }; }; - tmp = { - path = "/nix/store"; - comment = "test module"; - }; - - }; + in { + a = mkNode false; + b = mkNode true; }; testScript = '' start_all() - machine.wait_for_unit("rsyncd") - machine.succeed("rsync localhost::") + a.wait_for_unit("rsync") + b.wait_for_unit("sockets.target") + b.succeed("rsync a::") + a.succeed("rsync b::") ''; }) diff --git a/nixos/tests/rsyslogd.nix b/nixos/tests/rsyslogd.nix index 50523920c60b2..f35db3bd44b83 100644 --- a/nixos/tests/rsyslogd.nix +++ b/nixos/tests/rsyslogd.nix @@ -9,7 +9,7 @@ with pkgs.lib; { test1 = makeTest { name = "rsyslogd-test1"; - meta.maintainers = [ pkgs.stdenv.lib.maintainers.aanderse ]; + meta.maintainers = [ pkgs.lib.maintainers.aanderse ]; machine = { config, pkgs, ... }: { services.rsyslogd.enable = true; @@ -25,7 +25,7 @@ with pkgs.lib; test2 = makeTest { name = "rsyslogd-test2"; - meta.maintainers = [ pkgs.stdenv.lib.maintainers.aanderse ]; + meta.maintainers = [ pkgs.lib.maintainers.aanderse ]; machine = { config, pkgs, ... }: { services.rsyslogd.enable = true; diff --git a/nixos/tests/samba-wsdd.nix b/nixos/tests/samba-wsdd.nix index 1edef6c0056de..e7dd17c089a3e 100644 --- a/nixos/tests/samba-wsdd.nix +++ b/nixos/tests/samba-wsdd.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "samba-wsdd"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ izorkin ]; + meta.maintainers = with pkgs.lib.maintainers; [ izorkin ]; nodes = { client_wsdd = { pkgs, ... }: { diff --git a/nixos/tests/sanoid.nix b/nixos/tests/sanoid.nix index 66ddaad60ea25..da6d4c9ffe828 100644 --- a/nixos/tests/sanoid.nix +++ b/nixos/tests/sanoid.nix @@ -9,7 +9,7 @@ import ./make-test-python.nix ({ pkgs, ... }: let }; in { name = "sanoid"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ lopsided98 ]; }; diff --git a/nixos/tests/sbt-extras.nix b/nixos/tests/sbt-extras.nix index d63113f943e4e..f1672bf20665c 100644 --- a/nixos/tests/sbt-extras.nix +++ b/nixos/tests/sbt-extras.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "sbt-extras"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; diff --git a/nixos/tests/sbt.nix b/nixos/tests/sbt.nix index 004d9c2e140a0..22541232ba65d 100644 --- a/nixos/tests/sbt.nix +++ b/nixos/tests/sbt.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "sbt"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; diff --git a/nixos/tests/scala.nix b/nixos/tests/scala.nix deleted file mode 100644 index f99d9e563ffe3..0000000000000 --- a/nixos/tests/scala.nix +++ /dev/null @@ -1,33 +0,0 @@ -{ system ? builtins.currentSystem, - config ? {}, - pkgs ? import ../.. { inherit system config; } -}: - -with pkgs.lib; - -let - common = name: package: (import ./make-test-python.nix ({ - inherit name; - meta = with pkgs.stdenv.lib.maintainers; { - maintainers = [ nequissimus ]; - }; - - nodes = { - scala = { ... }: { - environment.systemPackages = [ package ]; - }; - }; - - testScript = '' - start_all() - - scala.succeed("scalac -version 2>&1 | grep '^Scala compiler version ${package.version}'") - ''; - }) { inherit system; }); - -in with pkgs; { - scala_2_10 = common "scala_2_10" scala_2_10; - scala_2_11 = common "scala_2_11" scala_2_11; - scala_2_12 = common "scala_2_12" scala_2_12; - scala_2_13 = common "scala_2_13" scala_2_13; -} diff --git a/nixos/tests/sddm.nix b/nixos/tests/sddm.nix index f9b961163c3c1..d7c65fa33d67c 100644 --- a/nixos/tests/sddm.nix +++ b/nixos/tests/sddm.nix @@ -37,7 +37,7 @@ let autoLogin = { name = "sddm-autologin"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ttuegel ]; }; diff --git a/nixos/tests/searx.nix b/nixos/tests/searx.nix new file mode 100644 index 0000000000000..7c28eea30d207 --- /dev/null +++ b/nixos/tests/searx.nix @@ -0,0 +1,114 @@ +import ./make-test-python.nix ({ pkgs, ...} : + +{ + name = "searx"; + meta = with pkgs.lib.maintainers; { + maintainers = [ rnhmjoj ]; + }; + + # basic setup: searx running the built-in webserver + nodes.base = { ... }: { + imports = [ ../modules/profiles/minimal.nix ]; + + services.searx = { + enable = true; + environmentFile = pkgs.writeText "secrets" '' + WOLFRAM_API_KEY = sometoken + SEARX_SECRET_KEY = somesecret + ''; + + settings.server = + { port = "8080"; + bind_address = "0.0.0.0"; + secret_key = "@SEARX_SECRET_KEY@"; + }; + settings.engines = [ + { name = "wolframalpha"; + api_key = "@WOLFRAM_API_KEY@"; + engine = "wolframalpha_api"; + } + { name = "startpage"; + shortcut = "start"; + } + ]; + }; + + }; + + # fancy setup: run in uWSGI and use nginx as proxy + nodes.fancy = { ... }: { + imports = [ ../modules/profiles/minimal.nix ]; + + services.searx = { + enable = true; + # searx refuses to run if unchanged + settings.server.secret_key = "somesecret"; + + runInUwsgi = true; + uwsgiConfig = { + # serve using the uwsgi protocol + socket = "/run/searx/uwsgi.sock"; + chmod-socket = "660"; + + # use /searx as url "mountpoint" + mount = "/searx=searx.webapp:application"; + module = ""; + manage-script-name = true; + }; + }; + + # use nginx as reverse proxy + services.nginx.enable = true; + services.nginx.virtualHosts.localhost = { + locations."/searx".extraConfig = + '' + include ${pkgs.nginx}/conf/uwsgi_params; + uwsgi_pass unix:/run/searx/uwsgi.sock; + ''; + locations."/searx/static/".alias = "${pkgs.searx}/share/static/"; + }; + + # allow nginx access to the searx socket + users.users.nginx.extraGroups = [ "searx" ]; + + }; + + testScript = + '' + base.start() + + with subtest("Settings have been merged"): + base.wait_for_unit("searx-init") + base.wait_for_file("/run/searx/settings.yml") + output = base.succeed( + "${pkgs.yq-go}/bin/yq eval" + " '.engines[] | select(.name==\"startpage\") | .shortcut'" + " /run/searx/settings.yml" + ).strip() + assert output == "start", "Settings not merged" + + with subtest("Environment variables have been substituted"): + base.succeed("grep -q somesecret /run/searx/settings.yml") + base.succeed("grep -q sometoken /run/searx/settings.yml") + base.copy_from_vm("/run/searx/settings.yml") + + with subtest("Basic setup is working"): + base.wait_for_open_port(8080) + base.wait_for_unit("searx") + base.succeed( + "${pkgs.curl}/bin/curl --fail http://localhost:8080" + ) + base.shutdown() + + with subtest("Nginx+uWSGI setup is working"): + fancy.start() + fancy.wait_for_open_port(80) + fancy.wait_for_unit("uwsgi") + fancy.succeed( + "${pkgs.curl}/bin/curl --fail http://localhost/searx >&2" + ) + fancy.succeed( + "${pkgs.curl}/bin/curl --fail http://localhost/searx/static/js/bootstrap.min.js >&2" + ) + ''; +}) diff --git a/nixos/tests/service-runner.nix b/nixos/tests/service-runner.nix index 55fbbb7293445..58f46735f56dc 100644 --- a/nixos/tests/service-runner.nix +++ b/nixos/tests/service-runner.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "service-runner"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ roberth ]; }; diff --git a/nixos/tests/shadow.nix b/nixos/tests/shadow.nix new file mode 100644 index 0000000000000..e5755e8e0878c --- /dev/null +++ b/nixos/tests/shadow.nix @@ -0,0 +1,116 @@ +let + password1 = "foobar"; + password2 = "helloworld"; + password3 = "bazqux"; + password4 = "asdf123"; +in import ./make-test-python.nix ({ pkgs, ... }: { + name = "shadow"; + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; + + nodes.shadow = { pkgs, ... }: { + environment.systemPackages = [ pkgs.shadow ]; + + users = { + mutableUsers = true; + users.emma = { + password = password1; + shell = pkgs.bash; + }; + users.layla = { + password = password2; + shell = pkgs.shadow; + }; + users.ash = { + password = password4; + shell = pkgs.bash; + }; + }; + }; + + testScript = '' + shadow.wait_for_unit("multi-user.target") + shadow.wait_until_succeeds("pgrep -f 'agetty.*tty1'") + + with subtest("Normal login"): + shadow.send_key("alt-f2") + shadow.wait_until_succeeds(f"[ $(fgconsole) = 2 ]") + shadow.wait_for_unit(f"getty@tty2.service") + shadow.wait_until_succeeds(f"pgrep -f 'agetty.*tty2'") + shadow.wait_until_tty_matches(2, "login: ") + shadow.send_chars("emma\n") + shadow.wait_until_tty_matches(2, "login: emma") + shadow.wait_until_succeeds("pgrep login") + shadow.sleep(2) + shadow.send_chars("${password1}\n") + shadow.send_chars("whoami > /tmp/1\n") + shadow.wait_for_file("/tmp/1") + assert "emma" in shadow.succeed("cat /tmp/1") + + with subtest("Switch user"): + shadow.send_chars("su - ash\n") + shadow.sleep(2) + shadow.send_chars("${password4}\n") + shadow.sleep(2) + shadow.send_chars("whoami > /tmp/3\n") + shadow.wait_for_file("/tmp/3") + assert "ash" in shadow.succeed("cat /tmp/3") + + with subtest("Change password"): + shadow.send_key("alt-f3") + shadow.wait_until_succeeds(f"[ $(fgconsole) = 3 ]") + shadow.wait_for_unit(f"getty@tty3.service") + shadow.wait_until_succeeds(f"pgrep -f 'agetty.*tty3'") + shadow.wait_until_tty_matches(3, "login: ") + shadow.send_chars("emma\n") + shadow.wait_until_tty_matches(3, "login: emma") + shadow.wait_until_succeeds("pgrep login") + shadow.sleep(2) + shadow.send_chars("${password1}\n") + shadow.send_chars("passwd\n") + shadow.sleep(2) + shadow.send_chars("${password1}\n") + shadow.sleep(2) + shadow.send_chars("${password3}\n") + shadow.sleep(2) + shadow.send_chars("${password3}\n") + shadow.sleep(2) + shadow.send_key("alt-f4") + shadow.wait_until_succeeds(f"[ $(fgconsole) = 4 ]") + shadow.wait_for_unit(f"getty@tty4.service") + shadow.wait_until_succeeds(f"pgrep -f 'agetty.*tty4'") + shadow.wait_until_tty_matches(4, "login: ") + shadow.send_chars("emma\n") + shadow.wait_until_tty_matches(4, "login: emma") + shadow.wait_until_succeeds("pgrep login") + shadow.sleep(2) + shadow.send_chars("${password1}\n") + shadow.wait_until_tty_matches(4, "Login incorrect") + shadow.wait_until_tty_matches(4, "login:") + shadow.send_chars("emma\n") + shadow.wait_until_tty_matches(4, "login: emma") + shadow.wait_until_succeeds("pgrep login") + shadow.sleep(2) + shadow.send_chars("${password3}\n") + shadow.send_chars("whoami > /tmp/2\n") + shadow.wait_for_file("/tmp/2") + assert "emma" in shadow.succeed("cat /tmp/2") + + with subtest("Groups"): + assert "foobar" not in shadow.succeed("groups emma") + shadow.succeed("groupadd foobar") + shadow.succeed("usermod -a -G foobar emma") + assert "foobar" in shadow.succeed("groups emma") + + with subtest("nologin shell"): + shadow.send_key("alt-f5") + shadow.wait_until_succeeds(f"[ $(fgconsole) = 5 ]") + shadow.wait_for_unit(f"getty@tty5.service") + shadow.wait_until_succeeds(f"pgrep -f 'agetty.*tty5'") + shadow.wait_until_tty_matches(5, "login: ") + shadow.send_chars("layla\n") + shadow.wait_until_tty_matches(5, "login: layla") + shadow.wait_until_succeeds("pgrep login") + shadow.send_chars("${password2}\n") + shadow.wait_until_tty_matches(5, "login:") + ''; +}) diff --git a/nixos/tests/signal-desktop.nix b/nixos/tests/signal-desktop.nix index 65ae49a267d98..c424288e00a90 100644 --- a/nixos/tests/signal-desktop.nix +++ b/nixos/tests/signal-desktop.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "signal-desktop"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ flokli ]; }; diff --git a/nixos/tests/simple.nix b/nixos/tests/simple.nix index 3810a2cd3a582..b4d90f750ecfb 100644 --- a/nixos/tests/simple.nix +++ b/nixos/tests/simple.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "simple"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco ]; }; diff --git a/nixos/tests/slurm.nix b/nixos/tests/slurm.nix index a54c5d9db4826..3702d243b486b 100644 --- a/nixos/tests/slurm.nix +++ b/nixos/tests/slurm.nix @@ -86,14 +86,16 @@ in { dbd = { pkgs, ... } : - { + let + passFile = pkgs.writeText "dbdpassword" "password123"; + in { networking.firewall.enable = false; systemd.tmpfiles.rules = [ "f /etc/munge/munge.key 0400 munge munge - mungeverryweakkeybuteasytointegratoinatest" ]; services.slurm.dbdserver = { enable = true; - storagePass = "password123"; + storagePassFile = "${passFile}"; }; services.mysql = { enable = true; @@ -107,12 +109,12 @@ in { ensurePermissions = { "slurm_acct_db.*" = "ALL PRIVILEGES"; }; name = "slurm"; }]; - extraOptions = '' + settings.mysqld = { # recommendations from: https://slurm.schedmd.com/accounting.html#mysql-configuration - innodb_buffer_pool_size=1024M - innodb_log_file_size=64M - innodb_lock_wait_timeout=900 - ''; + innodb_buffer_pool_size="1024M"; + innodb_log_file_size="64M"; + innodb_lock_wait_timeout=900; + }; }; }; diff --git a/nixos/tests/smokeping.nix b/nixos/tests/smokeping.nix index 4f8f0fcc9fe2e..ccacf60cfe4bd 100644 --- a/nixos/tests/smokeping.nix +++ b/nixos/tests/smokeping.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "smokeping"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ cransom ]; }; @@ -8,6 +8,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { sm = { ... }: { + networking.domain = "example.com"; # FQDN: sm.example.com services.smokeping = { enable = true; port = 8081; diff --git a/nixos/tests/snapcast.nix b/nixos/tests/snapcast.nix index 92534f1028190..05d08d76cc055 100644 --- a/nixos/tests/snapcast.nix +++ b/nixos/tests/snapcast.nix @@ -4,9 +4,10 @@ let port = 10004; tcpPort = 10005; httpPort = 10080; + tcpStreamPort = 10006; in { name = "snapcast"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ hexa ]; }; @@ -21,11 +22,16 @@ in { mpd = { type = "pipe"; location = "/run/snapserver/mpd"; + query.mode = "create"; }; bluetooth = { type = "pipe"; location = "/run/snapserver/bluetooth"; }; + tcp = { + type = "tcp"; + location = "127.0.0.1:${toString tcpStreamPort}"; + }; }; }; }; @@ -42,6 +48,7 @@ in { server.wait_until_succeeds("ss -ntl | grep -q ${toString port}") server.wait_until_succeeds("ss -ntl | grep -q ${toString tcpPort}") server.wait_until_succeeds("ss -ntl | grep -q ${toString httpPort}") + server.wait_until_succeeds("ss -ntl | grep -q ${toString tcpStreamPort}") with subtest("check that pipes are created"): server.succeed("test -p /run/snapserver/mpd") diff --git a/nixos/tests/sogo.nix b/nixos/tests/sogo.nix index 016331a9eed68..3f600b4cd5553 100644 --- a/nixos/tests/sogo.nix +++ b/nixos/tests/sogo.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "sogo"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ajs124 das_j ]; }; diff --git a/nixos/tests/solr.nix b/nixos/tests/solr.nix index dc5770e16bc72..86efe87c70783 100644 --- a/nixos/tests/solr.nix +++ b/nixos/tests/solr.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "solr"; - meta.maintainers = [ pkgs.stdenv.lib.maintainers.aanderse ]; + meta.maintainers = [ pkgs.lib.maintainers.aanderse ]; machine = { config, pkgs, ... }: diff --git a/nixos/tests/spike.nix b/nixos/tests/spike.nix index 47763e75ffa2b..cb89df73877b3 100644 --- a/nixos/tests/spike.nix +++ b/nixos/tests/spike.nix @@ -1,11 +1,11 @@ import ./make-test-python.nix ({ pkgs, ... }: let - riscvPkgs = import ../.. { crossSystem = pkgs.stdenv.lib.systems.examples.riscv64-embedded; }; + riscvPkgs = import ../.. { crossSystem = pkgs.lib.systems.examples.riscv64-embedded; }; in { name = "spike"; - meta = with pkgs.stdenv.lib.maintainers; { maintainers = [ blitz ]; }; + meta = with pkgs.lib.maintainers; { maintainers = [ blitz ]; }; machine = { pkgs, lib, ... }: { environment.systemPackages = [ pkgs.spike riscvPkgs.riscv-pk riscvPkgs.hello ]; diff --git a/nixos/tests/sssd-ldap.nix b/nixos/tests/sssd-ldap.nix index 4831eaa4ba20b..e3119348eac7e 100644 --- a/nixos/tests/sssd-ldap.nix +++ b/nixos/tests/sssd-ldap.nix @@ -10,7 +10,7 @@ in import ./make-test-python.nix { name = "sssd-ldap"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ bbigras ]; }; diff --git a/nixos/tests/sssd.nix b/nixos/tests/sssd.nix index 4c6ca86c74c8f..5c1abdca6aef4 100644 --- a/nixos/tests/sssd.nix +++ b/nixos/tests/sssd.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "sssd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ bbigras ]; }; machine = { pkgs, ... }: { diff --git a/nixos/tests/strongswan-swanctl.nix b/nixos/tests/strongswan-swanctl.nix index 152c0d61c5434..0cf181ee62a56 100644 --- a/nixos/tests/strongswan-swanctl.nix +++ b/nixos/tests/strongswan-swanctl.nix @@ -31,7 +31,7 @@ let proposals = [ "aes128-sha256-x25519" ]; in { name = "strongswan-swanctl"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ basvandijk ]; + meta.maintainers = with pkgs.lib.maintainers; [ basvandijk ]; nodes = { alice = { ... } : { diff --git a/nixos/tests/sudo.nix b/nixos/tests/sudo.nix index 8c38f1b47ef0c..2a85c490665a9 100644 --- a/nixos/tests/sudo.nix +++ b/nixos/tests/sudo.nix @@ -6,7 +6,7 @@ let in import ./make-test-python.nix ({ pkgs, ...} : { name = "sudo"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ lschuermann ]; }; diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix index 9ef96cec5ef36..78adf7ffa7da5 100644 --- a/nixos/tests/switch-test.nix +++ b/nixos/tests/switch-test.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "switch-test"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ gleber ]; }; diff --git a/nixos/tests/syncthing-init.nix b/nixos/tests/syncthing-init.nix index 0a01da52b68bc..4581e3fd4fbe5 100644 --- a/nixos/tests/syncthing-init.nix +++ b/nixos/tests/syncthing-init.nix @@ -4,7 +4,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: let in { name = "syncthing-init"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ lassulus ]; + meta.maintainers = with pkgs.lib.maintainers; [ lassulus ]; machine = { services.syncthing = { diff --git a/nixos/tests/syncthing-relay.nix b/nixos/tests/syncthing-relay.nix index c144bf7fca372..a0233c969ec06 100644 --- a/nixos/tests/syncthing-relay.nix +++ b/nixos/tests/syncthing-relay.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: { name = "syncthing-relay"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ delroth ]; + meta.maintainers = with pkgs.lib.maintainers; [ delroth ]; machine = { environment.systemPackages = [ pkgs.jq ]; diff --git a/nixos/tests/syncthing.nix b/nixos/tests/syncthing.nix index ac9df5e50c8c1..5536b7055cc9c 100644 --- a/nixos/tests/syncthing.nix +++ b/nixos/tests/syncthing.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: { name = "syncthing"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ chkno ]; + meta.maintainers = with pkgs.lib.maintainers; [ chkno ]; nodes = rec { a = { diff --git a/nixos/tests/systemd-analyze.nix b/nixos/tests/systemd-analyze.nix index a78ba08cd55cb..186f5aee7b85e 100644 --- a/nixos/tests/systemd-analyze.nix +++ b/nixos/tests/systemd-analyze.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... }: { name = "systemd-analyze"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ raskin ]; }; diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix index 7a663dd9b4284..3c93cb82d646d 100644 --- a/nixos/tests/systemd-boot.nix +++ b/nixos/tests/systemd-boot.nix @@ -18,7 +18,7 @@ in { basic = makeTest { name = "systemd-boot"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ danielfullmer ]; + meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer ]; machine = common; @@ -42,7 +42,7 @@ in # Boot without having created an EFI entry--instead using default "/EFI/BOOT/BOOTX64.EFI" fallback = makeTest { name = "systemd-boot-fallback"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ danielfullmer ]; + meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer ]; machine = { pkgs, lib, ... }: { imports = [ common ]; @@ -68,7 +68,7 @@ in update = makeTest { name = "systemd-boot-update"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ danielfullmer ]; + meta.maintainers = with pkgs.lib.maintainers; [ danielfullmer ]; machine = common; diff --git a/nixos/tests/systemd-journal.nix b/nixos/tests/systemd-journal.nix index c50c151ae10d8..6ab7c72463181 100644 --- a/nixos/tests/systemd-journal.nix +++ b/nixos/tests/systemd-journal.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "systemd-journal"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ lewo ]; }; @@ -13,6 +13,8 @@ import ./make-test-python.nix ({ pkgs, ... }: testScript = '' machine.wait_for_unit("multi-user.target") + machine.succeed("journalctl --grep=systemd") + machine.succeed( "${pkgs.curl}/bin/curl -s localhost:19531/machine | ${pkgs.jq}/bin/jq -e '.hostname == \"machine\"'" ) diff --git a/nixos/tests/systemd-networkd-dhcpserver.nix b/nixos/tests/systemd-networkd-dhcpserver.nix index f1a2662f8cb4b..b52c1499718b7 100644 --- a/nixos/tests/systemd-networkd-dhcpserver.nix +++ b/nixos/tests/systemd-networkd-dhcpserver.nix @@ -3,7 +3,7 @@ # reachable via the DHCP allocated address. import ./make-test-python.nix ({pkgs, ...}: { name = "systemd-networkd-dhcpserver"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ tomfitzhenry ]; }; nodes = { diff --git a/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix b/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix index 99395fe3023f3..bce78f09fdcce 100644 --- a/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix +++ b/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix @@ -9,7 +9,7 @@ import ./make-test-python.nix ({pkgs, ...}: { name = "systemd-networkd-ipv6-prefix-delegation"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ andir ]; }; nodes = { diff --git a/nixos/tests/systemd-networkd.nix b/nixos/tests/systemd-networkd.nix index d5fb2431dbad5..4f2cb75f5a0cb 100644 --- a/nixos/tests/systemd-networkd.nix +++ b/nixos/tests/systemd-networkd.nix @@ -61,7 +61,7 @@ let generateNodeConf = { lib, pkgs, config, privk, pubk, peerId, nodeId, ...}: { }; in import ./make-test-python.nix ({pkgs, ... }: { name = "networkd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ninjatrappeur ]; }; nodes = { diff --git a/nixos/tests/teeworlds.nix b/nixos/tests/teeworlds.nix index edf588968788c..17e9eeb869b02 100644 --- a/nixos/tests/teeworlds.nix +++ b/nixos/tests/teeworlds.nix @@ -10,7 +10,7 @@ let in { name = "teeworlds"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ hax404 ]; }; diff --git a/nixos/tests/telegraf.nix b/nixos/tests/telegraf.nix index 7f4b367525821..d99680ce2c3c4 100644 --- a/nixos/tests/telegraf.nix +++ b/nixos/tests/telegraf.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "telegraf"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ mic92 ]; }; diff --git a/nixos/tests/tinc/default.nix b/nixos/tests/tinc/default.nix new file mode 100644 index 0000000000000..31b675ad35c06 --- /dev/null +++ b/nixos/tests/tinc/default.nix @@ -0,0 +1,139 @@ +import ../make-test-python.nix ({ lib, ... }: + let + snakeoil-keys = import ./snakeoil-keys.nix; + + hosts = lib.attrNames snakeoil-keys; + + subnetOf = name: config: + let + subnets = config.services.tinc.networks.myNetwork.hostSettings.${name}.subnets; + in + (builtins.head subnets).address; + + makeTincHost = name: { subnet, extraConfig ? { } }: lib.mkMerge [ + { + subnets = [{ address = subnet; }]; + settings = { + Ed25519PublicKey = snakeoil-keys.${name}.ed25519Public; + }; + rsaPublicKey = snakeoil-keys.${name}.rsaPublic; + } + extraConfig + ]; + + makeTincNode = { config, ... }: name: extraConfig: lib.mkMerge [ + { + services.tinc.networks.myNetwork = { + inherit name; + rsaPrivateKeyFile = + builtins.toFile "rsa.priv" snakeoil-keys.${name}.rsaPrivate; + ed25519PrivateKeyFile = + builtins.toFile "ed25519.priv" snakeoil-keys.${name}.ed25519Private; + + hostSettings = lib.mapAttrs makeTincHost { + static = { + subnet = "10.0.0.11"; + # Only specify the addresses in the node's vlans, Tinc does not + # seem to try each one, unlike the documentation suggests... + extraConfig.addresses = map + (vlan: { address = "192.168.${toString vlan}.11"; port = 655; }) + config.virtualisation.vlans; + }; + dynamic1 = { subnet = "10.0.0.21"; }; + dynamic2 = { subnet = "10.0.0.22"; }; + }; + }; + + networking.useDHCP = false; + + networking.interfaces."tinc.myNetwork" = { + virtual = true; + virtualType = "tun"; + ipv4.addresses = [{ + address = subnetOf name config; + prefixLength = 24; + }]; + }; + + # Prevents race condition between NixOS service and tinc creating the + # interface. + # See: https://github.com/NixOS/nixpkgs/issues/27070 + systemd.services."tinc.myNetwork" = { + after = [ "network-addresses-tinc.myNetwork.service" ]; + requires = [ "network-addresses-tinc.myNetwork.service" ]; + }; + + networking.firewall.allowedTCPPorts = [ 655 ]; + networking.firewall.allowedUDPPorts = [ 655 ]; + } + extraConfig + ]; + + in + { + name = "tinc"; + meta.maintainers = with lib.maintainers; [ minijackson ]; + + nodes = { + + static = { ... } @ args: + makeTincNode args "static" { + virtualisation.vlans = [ 1 2 ]; + + networking.interfaces.eth1.ipv4.addresses = [{ + address = "192.168.1.11"; + prefixLength = 24; + }]; + + networking.interfaces.eth2.ipv4.addresses = [{ + address = "192.168.2.11"; + prefixLength = 24; + }]; + }; + + + dynamic1 = { ... } @ args: + makeTincNode args "dynamic1" { + virtualisation.vlans = [ 1 ]; + }; + + dynamic2 = { ... } @ args: + makeTincNode args "dynamic2" { + virtualisation.vlans = [ 2 ]; + }; + + }; + + testScript = '' + start_all() + + static.wait_for_unit("tinc.myNetwork.service") + dynamic1.wait_for_unit("tinc.myNetwork.service") + dynamic2.wait_for_unit("tinc.myNetwork.service") + + # Static is accessible by the other hosts + dynamic1.succeed("ping -c5 192.168.1.11") + dynamic2.succeed("ping -c5 192.168.2.11") + + # The other hosts are in separate vlans + dynamic1.fail("ping -c5 192.168.2.11") + dynamic2.fail("ping -c5 192.168.1.11") + + # Each host can ping themselves through Tinc + static.succeed("ping -c5 10.0.0.11") + dynamic1.succeed("ping -c5 10.0.0.21") + dynamic2.succeed("ping -c5 10.0.0.22") + + # Static is accessible by the other hosts through Tinc + dynamic1.succeed("ping -c5 10.0.0.11") + dynamic2.succeed("ping -c5 10.0.0.11") + + # Static can access the other hosts through Tinc + static.succeed("ping -c5 10.0.0.21") + static.succeed("ping -c5 10.0.0.22") + + # The other hosts in separate vlans can access each other through Tinc + dynamic1.succeed("ping -c5 10.0.0.22") + dynamic2.succeed("ping -c5 10.0.0.21") + ''; + }) diff --git a/nixos/tests/tinc/snakeoil-keys.nix b/nixos/tests/tinc/snakeoil-keys.nix new file mode 100644 index 0000000000000..650e57d61d4a7 --- /dev/null +++ b/nixos/tests/tinc/snakeoil-keys.nix @@ -0,0 +1,157 @@ +{ + static = { + ed25519Private = '' + -----BEGIN ED25519 PRIVATE KEY----- + IPR+ur5LfVdm6VlR1+FGIkbkL8Enkb9sejBa/JP6tXkg/vHoraIp70srb6jAUFm5 + 3YbCJiBjLW3dy16qM5PovBoWtr5hoqYYA9dFLOys8FBUFFsIGfKhnbk7g25iwxbO + -----END ED25519 PRIVATE KEY----- + ''; + + ed25519Public = "AqV7aeIqKGGQfXxijMLfRAVRBLixnS45G5OoduIc8mD"; + + rsaPrivate = '' + -----BEGIN RSA PRIVATE KEY----- + MIIEpAIBAAKCAQEAxDHl0TIhhT2yH5rT+Q7MLnj+Ir8bbs3uaPqnzcxWzN1EfVP8 + TWt5fSTrF2Dc78Kyu5ZNALrp7tUj0GZAegp1YeYJ28p3qTwCveywtCwbB4dI987S + yJwq95kE9aoyLa+cT99VwSTdb2YowQv2tWj/idxE3oJ+qZjy9tE5mysXm7jmTQDx + +U0XmNe6MHjKXc01Ener41u0ykJLeUfdgJ1zEyM2rQGtaHpIXfMT6kmxCaMcAMLg + YFpI38/1pQGQtROKdGOaUomx2m058bkMsJhTiBjESiLRDElRGxmMJ732crGJP0GR + ChJkaX/CnxHq7R0daZfwoTVHRu6N7WDbFQL5twIDAQABAoIBAQCM/fLTIHyYXRr5 + vXFhxXGUYBz56W6UdWdEiAU5TwR92vFSQ53IIVlARtyvg0ui/b8mMcAKq0hb+03u + gN0LFyL+BKvHCLxvoRGzXTorcJrIET+t3jL6OchjANNgnDvNOytQ9wWQdKaxXLAi + 8y8LdXZWozXW1d6ikKjiGL+WNCSWIcq83ktSJZcohihptU9Un16FYQzdolSC8RtI + XyT7i1ye6hW/wJTJxqZ4taX3EPat85kXS234VGSqg9bb2A1yE+U8Rq37bf8AKldJ + NUQB3JyxnkYGJcqvzDmz139+744VWxDRvXDA5vU29LC6f8bGBvwEttD98QW+pgmB + 1NBU1Uo5AoGBAOzUk6k74h1RarwXaftjh/9Pures0CfNNnrkJApzFCh4bAoHNxq6 + SSXqLcc/vvX2+YaZ72nn5YTo+JLQP6evM9oUaqRMAxa3nzoNCtF8U2r48UWmoUQE + aZCYbD3m7IVWFacCKRVaVTMZMTTicypSnXcbCSIEH8PRs9+L4jkHgql9AoGBANQT + TZECVhIaQnyRiKWlUE8G1QKzXIxjmfyirBe+ftlIG2XMXasAtQ4VRxpnorgqUnIH + BVrIbvRx21zlqwZbrZvyb1jHWRoyi1cqBPijpYBUm5LbV2jgHPhnfhRVqdD4CDKj + NQzIQrNymFaMWAoOQv/DE3g+Txr0fm9Ztu8ZRXZDAoGAHh3SQT0aPfwyhIS9t3gq + vS7YYa8aMVWJTgthAessbxERPB06xq1Vy/qBo8rZb9HeXV2J8n/I0iQGKDVPQvWm + tF7QSOBZrDPhjbJG4+jZesr5c5ADBfFBs1+OtDh/b11JF5nQu6RnHT5g4YbCemlT + GOhZOvgnSfGK3CyfsfzggskCgYEAmpKDK5kPUNxw70hH16v5L9Bj+zbt0qlZ+Ag8 + 9IV1ATuMNJNTBitay6v4iidVM3QtaUzyuytxq5s87qW7FMRHcm2ueH+70ttaMiq/ + OtZT74g7aDuUpy0KEIemHn4dauENYJMSPIHOE+sHW7WpCZNBhBcUHsUTdSsU6GX0 + bqr1tO8CgYBpZdR2OoX/rn8nwjmtBOH38aPnCpaAfdI2Eq2Lg6DjksP6TBt53a+R + m1lk6Kt37BPPZQ85SBr7ywvDgUzfoD7uSmHujF2JUHPsdrg9nx7pNIGlW6DlS9OU + oNXGAJ/6/y6F8uDbToUfrwFq5tKMypEEa32kFtxb9f0XQ5fSgHrBEw== + -----END RSA PRIVATE KEY----- + ''; + + rsaPublic = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAxDHl0TIhhT2yH5rT+Q7MLnj+Ir8bbs3uaPqnzcxWzN1EfVP8TWt5 + fSTrF2Dc78Kyu5ZNALrp7tUj0GZAegp1YeYJ28p3qTwCveywtCwbB4dI987SyJwq + 95kE9aoyLa+cT99VwSTdb2YowQv2tWj/idxE3oJ+qZjy9tE5mysXm7jmTQDx+U0X + mNe6MHjKXc01Ener41u0ykJLeUfdgJ1zEyM2rQGtaHpIXfMT6kmxCaMcAMLgYFpI + 38/1pQGQtROKdGOaUomx2m058bkMsJhTiBjESiLRDElRGxmMJ732crGJP0GRChJk + aX/CnxHq7R0daZfwoTVHRu6N7WDbFQL5twIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + + dynamic1 = { + ed25519Private = '' + -----BEGIN ED25519 PRIVATE KEY----- + wHNC2IMXfYtL4ehdsCX154HBvlIZYEiTOnXtckWMUtEAiX9fu7peyBkp9q+yOy9c + xsNyssLL78lt0GoweCxlu3Sza2oBQAcwb+6tuv7P/bqzcG005uCwquyCz8LVymXA + -----END ED25519 PRIVATE KEY----- + ''; + + ed25519Public = "t0smNaAEAH8mver77+z/m6MnBNdurAsqrswM/Sls5FA"; + + rsaPrivate = '' + -----BEGIN RSA PRIVATE KEY----- + MIIEpAIBAAKCAQEApukYNGFNWvVlmx75LyOE7MEcd/ViV+yEyk+4cIBXYJ3Ouw+/ + oEuh8ghQfsiUtbUPR6hPYhX2ZV8XGhuU2nAXVQV0sfZ8pdkbHQ6wHUqFcUIQAVvS + Wpm2DvZM8jkbCPP64/x5nukPwQ8VoNnb62rWGzbcj7rOeb7ndMK0TpX5Wwv8F297 + nKTNCEDbK3DLTj3VD+QGnw6AoEt5i44vViAWZBXuHLHWTDC0Nq8GG+9TKODkEwt5 + 4dgN2X9f+WTVAYhZT3SayHLqIFIMQunN89RpWwhHSW+JIRfAfuT1TbP+wA5ptDeI + ktCkJwWyv4hK6l800BJ9GW1nbId5LPa58ipaVwIDAQABAoIBAHcw3WgKVAMwWm57 + n9ZZtwKapInFYYUIEYungj5UaBFGn+pVRLJjUDJWXaUr94YK1e6F8qpIpLufPBAY + wiN7CC5exwaOzlRgxUvqwTkpjkFiu6s8tuqb+baVjD0tKnEqSW+lS/R+2hEzhG5p + JPLoSB0HAFpjPC8UdJSctcWos3if3mvOGkGCKyTkrwaJgECDfD+lZ+NBIAiYLSps + jWLE+XlY1+nfPdLUQ+TRSv3IikJ/CWbvJLl9EE1tKhkY564KytwZrkIdJlc7NyRO + HpzhyMzHu1GLsr+OsBZByNNUxEPU+bzkDQluRXUSIUs9zZoBiCQr3o04qGPTEX9n + pNU60gECgYEA3Uf+c80eqzjDxv+O0YzC+9x6A+yMrV56siGkKRPMlrSqjX7iE2Yg + tUjD25kEvtaFuB3f/7zp3h4O/VLZgXreRtXHvdrfoyyJGHvHIyCGm8sw8CEWsKo4 + 1LgZUzdPJRkXJq1zOgS0r1xsA1UDC4s02Ww2HwNeVWtmLUyCpA+B/ccCgYEAwRk9 + tbe82eq1a85zZiPVXP2qvDH5+Vz9YiMky8xsBnoxmz2siR+NdvWBLcE2VDIY8MK1 + 9a1dz2a7cAHQBrtWtACFVY4zvr69DumApjbQRClDYpJ42tp2VbzlMcUDIoKudRQV + CObhrE4w4yfVizXFyH9+4Tsg5NzVYuGg9fUJ/vECgYEAoRz7KouNqfMhsLF/5hkM + Gt9zw4mm/9ALm8kcwn/U9WHD0FQy/Rbd98BsQmaOavi80cqGvqhoyz2tgkqhbUHt + tzuOPDCxphgWFcqBupTDDYoLLruYzraRvGfyoIFj0coL7jBZ9kNY31l2l5J9LhmE + OE4utbP5Kk6RTagocpWL+x8CgYB48CwcIcWf3kZeDOFtuUeqhB1o3Qwox7rSuhwT + oCaQL/vdtNTY1PAu7zhGxdoXBYFlWS3JfxlgCoGedyQo8zAscJ8RpIx4DNIwAsLW + V0I9TnKry/zxZR30OOh7MV7zQFGvdjJubtwspJQt0QcHt1f2aRO4UOYbMMxcr9+1 + 7BCkoQKBgQDBEtg1hx9zYGg1WN2TBSvh6NShi9S23r6IZ3Up8vz6Z2rcwB3UuhKi + xluI2ZFwM9s+7UOpaGC+hnc1aMHDEguYOPXoIzvebbYAdN4AkrsJ5d0r1GoEe64E + UXxrfuv5LeJ/vkUgWof+U3/jGOVvrjzi5y1xOC0r3kiSpMa85s1dhQ== + -----END RSA PRIVATE KEY----- + ''; + + rsaPublic = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEApukYNGFNWvVlmx75LyOE7MEcd/ViV+yEyk+4cIBXYJ3Ouw+/oEuh + 8ghQfsiUtbUPR6hPYhX2ZV8XGhuU2nAXVQV0sfZ8pdkbHQ6wHUqFcUIQAVvSWpm2 + DvZM8jkbCPP64/x5nukPwQ8VoNnb62rWGzbcj7rOeb7ndMK0TpX5Wwv8F297nKTN + CEDbK3DLTj3VD+QGnw6AoEt5i44vViAWZBXuHLHWTDC0Nq8GG+9TKODkEwt54dgN + 2X9f+WTVAYhZT3SayHLqIFIMQunN89RpWwhHSW+JIRfAfuT1TbP+wA5ptDeIktCk + JwWyv4hK6l800BJ9GW1nbId5LPa58ipaVwIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + + dynamic2 = { + ed25519Private = '' + -----BEGIN ED25519 PRIVATE KEY----- + oUx9JdIstZLMj3ZPD8mP3ITsUscCTIXhNF3VKFUVi/ma5uk50/1vrEohfDraiMxj + gAWthpkhnFzUbp+YlOHE7/Z3h1a/br2/tk8DoZ5PV6ufoV1MaBlGdu+TZgeZou0t + -----END ED25519 PRIVATE KEY----- + ''; + + ed25519Public = "f2dYt2/2q9fLJ/AaW+Tlu7HaVNjWQpRnr/UGoXGqLdL"; + + rsaPrivate = '' + -----BEGIN RSA PRIVATE KEY----- + MIIEpAIBAAKCAQEAtQfijPX3BwOAs2Y0EuNjcBmsI90uYqNAonrFgTtcVwERIVE6 + p6alSEakazhByujBg3jI8oPKC8eO0IJ7x/BWcgxqaw8hsPfJZFnRlwEcU5kK4c+j + UNS+hJOXp0x97T1edLpSFHDK9bZ2necblHKG5MsI4UsxEa+CZ0yoIybwWCDmYuya + PvE7CeNNa+CIOUbtPVoN4p/aBj0vZeerNBBuodNkglKRxj4l9wD9uOx4S9sdK5lu + q/rkxlViBoXRAshT+G2d/u/7/WPoiKB3QJcF33z8UfrlsTRnDDqOMSGisTPSv2LK + 4QLN4hWOGXAYQqZcxTkvvjl62mCDuoy0TM+CKQIDAQABAoIBAFKpMAxXf52nPswr + /dkmFVCpmE2kADsv+iJ21tpkpYxgw1aoRZUp5cyz3P3MaVZio4IJ1A/Ql6B7Vb3l + 5ulr170p6CnMdgDdlAsLbEV8T1foyOxFKHiPPBNDZXsR1WpPnGLGdRY6TqKV12HQ + lmpZRTkRcJOXBufhcTUD7r5mWFaUoZ7so6VxR4L4Tzcgv1Rl4S6jgnHOQdO6lj47 + BaPjpBb+hplJ4wsRm91dQ7JApYq25XZwyxnBwQ2zAwb46wsuFxDPHlSc4wU7qTt6 + x2omm33Xy2cm8L1XQhrassZzldSnAyaLBh9DC3+vFPLODDxdz5M2kpHujYYctRhv + CICMYJUCgYEA7mWVYuw0S8FNjaLx6n9Q1hr9d9vAFDd3NEaegH586xvhYNxf6n+C + 2zZloVLEsX0UnBU/6ZtLAUfxUIqlvDS2r1VjSYG5SNxM6/vyGl17Niu1jC8nzf7M + V1WtDCHhT4ikZCuNkAldtgI7CXVdCVO/fTqVhjk4hDblJo7VsCZSZysCgYEAwmXp + TwlDHapDqA8UxClZuxS8k+2hthny3ihRPCuT34yqAz074zYG97ZBKwIa4Lm1vnkc + mwU7yR2aK7IYeU4ScfWm1mLjkW5iaNV/sG7iTz/RP4mBAs3KSGmuhhz8sFWcXByU + IZyvMJvC+FpgJQJn/Xc8ZmdImvXlZd6k8v4/kfsCgYEA6VzFPB2OH63slb4w42SX + o86t2dtiDigxZxnN5GhtLdSP7borpigF10JLf/y+kCOpvhRLCQk8Bdf/z+C41iAf + yEhktbrnvfvwzHxHhSmHCAMHZ19trodCTiePCrZLkQhoK6o6nAmfEyDh26NoXE3/ + v71OSyLOQRZfgDwHz7PjrBsCgYAe0zojpjxWP+FqjLmmQUhROgCNFGlIDuVMBOic + uexAznVG/ja42KBSNzwuLa9FYy1Gfr3idvn78g24UA1BbvfNyj4iUJv1O6OvK+uL + dom8N0pe4NbsMuWYhel+qqoG7AxXLtDuY4IEGy7XYr1MIQ2MS5PwSQBiUguGE7/k + KBy8cQKBgQCyC9R8VWJxQLqJxZGa9Ful01bSuntB5OLRfEjFCCuGiY/3Vj+mCiQL + GOfMOi2jrcnSNgUm0uevmiFCq9m7QiPiAcSYKXPWhsz/55jJIGcZy8bwyhZ2s2Mg + BGeZgj4RFORidqkt5g/KJz0+Wp6Ks4sLoCvOzkpeXvLzFVyzGkihrw== + -----END RSA PRIVATE KEY----- + ''; + + rsaPublic = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAtQfijPX3BwOAs2Y0EuNjcBmsI90uYqNAonrFgTtcVwERIVE6p6al + SEakazhByujBg3jI8oPKC8eO0IJ7x/BWcgxqaw8hsPfJZFnRlwEcU5kK4c+jUNS+ + hJOXp0x97T1edLpSFHDK9bZ2necblHKG5MsI4UsxEa+CZ0yoIybwWCDmYuyaPvE7 + CeNNa+CIOUbtPVoN4p/aBj0vZeerNBBuodNkglKRxj4l9wD9uOx4S9sdK5luq/rk + xlViBoXRAshT+G2d/u/7/WPoiKB3QJcF33z8UfrlsTRnDDqOMSGisTPSv2LK4QLN + 4hWOGXAYQqZcxTkvvjl62mCDuoy0TM+CKQIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; +} diff --git a/nixos/tests/tor.nix b/nixos/tests/tor.nix index ad07231557c3c..c061f59226cfb 100644 --- a/nixos/tests/tor.nix +++ b/nixos/tests/tor.nix @@ -17,7 +17,7 @@ rec { environment.systemPackages = with pkgs; [ netcat ]; services.tor.enable = true; services.tor.client.enable = true; - services.tor.controlPort = 9051; + services.tor.settings.ControlPort = 9051; }; testScript = '' diff --git a/nixos/tests/trac.nix b/nixos/tests/trac.nix index af7182d1e185c..d6914c1008175 100644 --- a/nixos/tests/trac.nix +++ b/nixos/tests/trac.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "trac"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ mmahut ]; }; diff --git a/nixos/tests/traefik.nix b/nixos/tests/traefik.nix index 0e21a7cf8437f..4eeae29acadf3 100644 --- a/nixos/tests/traefik.nix +++ b/nixos/tests/traefik.nix @@ -2,7 +2,7 @@ # and a Docker container. import ./make-test-python.nix ({ pkgs, ... }: { name = "traefik"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ joko ]; }; diff --git a/nixos/tests/transmission.nix b/nixos/tests/transmission.nix index 37c0352dcfb8f..7e2648804de21 100644 --- a/nixos/tests/transmission.nix +++ b/nixos/tests/transmission.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "transmission"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ coconnor ]; }; diff --git a/nixos/tests/trezord.nix b/nixos/tests/trezord.nix index 7c8370f409ed4..fb60cb4aff100 100644 --- a/nixos/tests/trezord.nix +++ b/nixos/tests/trezord.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "trezord"; - meta = with pkgs.stdenv.lib; { + meta = with pkgs.lib; { maintainers = with maintainers; [ mmahut _1000101 ]; }; nodes = { diff --git a/nixos/tests/trickster.nix b/nixos/tests/trickster.nix index e32f919a1ada9..acb2e735c39f8 100644 --- a/nixos/tests/trickster.nix +++ b/nixos/tests/trickster.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "trickster"; - meta = with pkgs.stdenv.lib; { + meta = with pkgs.lib; { maintainers = with maintainers; [ _1000101 ]; }; diff --git a/nixos/tests/tuptime.nix b/nixos/tests/tuptime.nix index 36ce2b1ae1923..6d37e30698390 100644 --- a/nixos/tests/tuptime.nix +++ b/nixos/tests/tuptime.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "tuptime"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ evils ]; }; diff --git a/nixos/tests/ucg.nix b/nixos/tests/ucg.nix index 47507aee07c16..7769fd01fce42 100644 --- a/nixos/tests/ucg.nix +++ b/nixos/tests/ucg.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "ucg"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ AndersonTorres ]; }; diff --git a/nixos/tests/udisks2.nix b/nixos/tests/udisks2.nix index 50a0239689181..1f01cc6de4d6f 100644 --- a/nixos/tests/udisks2.nix +++ b/nixos/tests/udisks2.nix @@ -11,7 +11,7 @@ in { name = "udisks2"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ eelco ]; }; diff --git a/nixos/tests/unbound.nix b/nixos/tests/unbound.nix index dc8e5a9d3ed8c..c88231636226b 100644 --- a/nixos/tests/unbound.nix +++ b/nixos/tests/unbound.nix @@ -38,7 +38,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: in { name = "unbound"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ andir ]; }; diff --git a/nixos/tests/upnp.nix b/nixos/tests/upnp.nix index 046c0a56b2a76..451c8607d0ebd 100644 --- a/nixos/tests/upnp.nix +++ b/nixos/tests/upnp.nix @@ -15,7 +15,7 @@ let in { name = "upnp"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ bobvanderlinden ]; }; diff --git a/nixos/tests/usbguard.nix b/nixos/tests/usbguard.nix new file mode 100644 index 0000000000000..cba905db44f34 --- /dev/null +++ b/nixos/tests/usbguard.nix @@ -0,0 +1,62 @@ +import ./make-test-python.nix ({ pkgs, ... }: { + name = "usbguard"; + meta = with pkgs.lib.maintainers; { + maintainers = [ tnias ]; + }; + + machine = + { ... }: + { + services.usbguard = { + enable = true; + IPCAllowedUsers = [ "alice" "root" ]; + + # As virtual USB devices get attached to the "QEMU USB Hub" we need to + # allow Hubs. Otherwise we would have to explicitly allow them too. + rules = '' + allow with-interface equals { 09:00:00 } + ''; + }; + imports = [ ./common/user-account.nix ]; + }; + + testScript = '' + # create a blank disk image for our fake USB stick + with open(machine.state_dir + "/usbstick.img", "wb") as stick: + stick.write(b"\x00" * (1024 * 1024)) + + # wait for machine to have started and the usbguard service to be up + machine.wait_for_unit("usbguard.service") + + with subtest("IPC access control"): + # User "alice" is allowed to access the IPC interface + machine.succeed("su alice -c 'usbguard list-devices'") + + # User "bob" is not allowed to access the IPC interface + machine.fail("su bob -c 'usbguard list-devices'") + + with subtest("check basic functionality"): + # at this point we expect that no USB HDD is connected + machine.fail("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'") + + # insert usb device + machine.send_monitor_command( + f"drive_add 0 id=stick,if=none,file={stick.name},format=raw" + ) + machine.send_monitor_command("device_add usb-storage,id=stick,drive=stick") + + # the attached USB HDD should show up after a short while + machine.wait_until_succeeds("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'") + + # at this point there should be a **blocked** USB HDD + machine.succeed("usbguard list-devices | grep -E 'block.*QEMU USB HARDDRIVE'") + machine.fail("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'") + + # allow storage devices + machine.succeed("usbguard allow-device 'with-interface { 08:*:* }'") + + # at this point there should be an **allowed** USB HDD + machine.succeed("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'") + machine.fail("usbguard list-devices | grep -E ' block .*QEMU USB HARDDRIVE'") + ''; +}) diff --git a/nixos/tests/uwsgi.nix b/nixos/tests/uwsgi.nix index 7f4945a88030f..80dcde324aad7 100644 --- a/nixos/tests/uwsgi.nix +++ b/nixos/tests/uwsgi.nix @@ -1,29 +1,58 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "uwsgi"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ lnl7 ]; }; + machine = { pkgs, ... }: { - services.uwsgi.enable = true; - services.uwsgi.plugins = [ "python3" ]; - services.uwsgi.instance = { - type = "emperor"; - vassals.hello = { + users.users.hello = + { isSystemUser = true; + group = "hello"; + }; + users.groups.hello = { }; + + services.uwsgi = { + enable = true; + plugins = [ "python3" "php" ]; + capabilities = [ "CAP_NET_BIND_SERVICE" ]; + instance.type = "emperor"; + + instance.vassals.hello = { type = "normal"; - master = true; - workers = 2; - http = ":8000"; + immediate-uid = "hello"; + immediate-gid = "hello"; module = "wsgi:application"; + http = ":80"; + cap = "net_bind_service"; + pythonPackages = self: [ self.flask ]; chdir = pkgs.writeTextDir "wsgi.py" '' from flask import Flask + import subprocess application = Flask(__name__) @application.route("/") def hello(): - return "Hello World!" + return "Hello, World!" + + @application.route("/whoami") + def whoami(): + whoami = "${pkgs.coreutils}/bin/whoami" + proc = subprocess.run(whoami, capture_output=True) + return proc.stdout.decode().strip() + ''; + }; + + instance.vassals.php = { + type = "normal"; + master = true; + workers = 2; + http-socket = ":8000"; + http-socket-modifier1 = 14; + php-index = "index.php"; + php-docroot = pkgs.writeTextDir "index.php" '' + <?php echo "Hello World\n"; ?> ''; - pythonPackages = self: with self; [ flask ]; }; }; }; @@ -32,7 +61,21 @@ import ./make-test-python.nix ({ pkgs, ... }: '' machine.wait_for_unit("multi-user.target") machine.wait_for_unit("uwsgi.service") - machine.wait_for_open_port(8000) - assert "Hello World" in machine.succeed("curl -fv 127.0.0.1:8000") + + with subtest("uWSGI has started"): + machine.wait_for_unit("uwsgi.service") + + with subtest("Vassal can bind on port <1024"): + machine.wait_for_open_port(80) + hello = machine.succeed("curl -f http://machine").strip() + assert "Hello, World!" in hello, f"Excepted 'Hello, World!', got '{hello}'" + + with subtest("Vassal is running as dedicated user"): + username = machine.succeed("curl -f http://machine/whoami").strip() + assert username == "hello", f"Excepted 'hello', got '{username}'" + + with subtest("PHP plugin is working"): + machine.wait_for_open_port(8000) + assert "Hello World" in machine.succeed("curl -fv http://machine:8000") ''; }) diff --git a/nixos/tests/vault-postgresql.nix b/nixos/tests/vault-postgresql.nix new file mode 100644 index 0000000000000..a563aead22a3b --- /dev/null +++ b/nixos/tests/vault-postgresql.nix @@ -0,0 +1,70 @@ +/* This test checks that + - multiple config files can be loaded + - the storage backend can be in a file outside the nix store + as is required for security (required because while confidentiality is + always covered, availability isn't) + - the postgres integration works + */ +import ./make-test-python.nix ({ pkgs, ... }: +{ + name = "vault-postgresql"; + meta = with pkgs.lib.maintainers; { + maintainers = [ lnl7 roberth ]; + }; + machine = { lib, pkgs, ... }: { + virtualisation.memorySize = 512; + environment.systemPackages = [ pkgs.vault ]; + environment.variables.VAULT_ADDR = "http://127.0.0.1:8200"; + services.vault.enable = true; + services.vault.extraSettingsPaths = [ "/run/vault.hcl" ]; + + systemd.services.vault = { + after = [ + "postgresql.service" + ]; + # Try for about 10 minutes rather than the default of 5 attempts. + serviceConfig.RestartSec = 1; + serviceConfig.StartLimitBurst = 600; + }; + # systemd.services.vault.unitConfig.RequiresMountsFor = "/run/keys/"; + + services.postgresql.enable = true; + services.postgresql.initialScript = pkgs.writeText "init.psql" '' + CREATE USER vaultuser WITH ENCRYPTED PASSWORD 'thisisthepass'; + GRANT CONNECT ON DATABASE postgres TO vaultuser; + + -- https://www.vaultproject.io/docs/configuration/storage/postgresql + CREATE TABLE vault_kv_store ( + parent_path TEXT COLLATE "C" NOT NULL, + path TEXT COLLATE "C", + key TEXT COLLATE "C", + value BYTEA, + CONSTRAINT pkey PRIMARY KEY (path, key) + ); + CREATE INDEX parent_path_idx ON vault_kv_store (parent_path); + + GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO vaultuser; + ''; + }; + + testScript = + '' + secretConfig = """ + storage "postgresql" { + connection_url = "postgres://vaultuser:thisisthepass@localhost/postgres?sslmode=disable" + } + """ + + start_all() + + machine.wait_for_unit("multi-user.target") + machine.succeed("cat >/root/vault.hcl <<EOF\n%s\nEOF\n" % secretConfig) + machine.succeed( + "install --owner vault --mode 0400 /root/vault.hcl /run/vault.hcl; rm /root/vault.hcl" + ) + machine.wait_for_unit("vault.service") + machine.wait_for_open_port(8200) + machine.succeed("vault operator init") + machine.succeed("vault status | grep Sealed | grep true") + ''; +}) diff --git a/nixos/tests/vault.nix b/nixos/tests/vault.nix index ac8cf0703da5d..59bccbe259590 100644 --- a/nixos/tests/vault.nix +++ b/nixos/tests/vault.nix @@ -1,13 +1,14 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "vault"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ lnl7 ]; }; machine = { pkgs, ... }: { environment.systemPackages = [ pkgs.vault ]; environment.variables.VAULT_ADDR = "http://127.0.0.1:8200"; services.vault.enable = true; + virtualisation.memorySize = 512; }; testScript = diff --git a/nixos/tests/vector.nix b/nixos/tests/vector.nix index e96c3ad152f3f..583e60ddc5681 100644 --- a/nixos/tests/vector.nix +++ b/nixos/tests/vector.nix @@ -7,7 +7,7 @@ with pkgs.lib; { test1 = makeTest { name = "vector-test1"; - meta.maintainers = [ pkgs.stdenv.lib.maintainers.happysalada ]; + meta.maintainers = [ pkgs.lib.maintainers.happysalada ]; machine = { config, pkgs, ... }: { services.vector = { diff --git a/nixos/tests/victoriametrics.nix b/nixos/tests/victoriametrics.nix index fff8d7005da17..5e364b67bf87e 100644 --- a/nixos/tests/victoriametrics.nix +++ b/nixos/tests/victoriametrics.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "victoriametrics"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ yorickvp ]; }; diff --git a/nixos/tests/virtualbox.nix b/nixos/tests/virtualbox.nix index 900ee610a70b9..0a7369b0fa2aa 100644 --- a/nixos/tests/virtualbox.nix +++ b/nixos/tests/virtualbox.nix @@ -402,7 +402,7 @@ let # (keep black happy) ''; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ aszlig cdepillabout ]; }; }; diff --git a/nixos/tests/wasabibackend.nix b/nixos/tests/wasabibackend.nix index d169ad152722a..1832698ab698c 100644 --- a/nixos/tests/wasabibackend.nix +++ b/nixos/tests/wasabibackend.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "wasabibackend"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ mmahut ]; }; diff --git a/nixos/tests/web-servers/unit-php.nix b/nixos/tests/web-servers/unit-php.nix index 033036ee76673..24d6f5f16a72c 100644 --- a/nixos/tests/web-servers/unit-php.nix +++ b/nixos/tests/web-servers/unit-php.nix @@ -4,7 +4,7 @@ import ../make-test-python.nix ({pkgs, ...}: in { name = "unit-php-test"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ izorkin ]; + meta.maintainers = with pkgs.lib.maintainers; [ izorkin ]; machine = { config, lib, pkgs, ... }: { services.unit = { diff --git a/nixos/tests/wireguard/basic.nix b/nixos/tests/wireguard/basic.nix index 25d706ae2e52c..a31e92e8649de 100644 --- a/nixos/tests/wireguard/basic.nix +++ b/nixos/tests/wireguard/basic.nix @@ -6,7 +6,7 @@ import ../make-test-python.nix ({ pkgs, lib, ...} : in { name = "wireguard"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ma27 ]; }; diff --git a/nixos/tests/wireguard/generated.nix b/nixos/tests/wireguard/generated.nix index cdf15483265cd..84a35d29b4535 100644 --- a/nixos/tests/wireguard/generated.nix +++ b/nixos/tests/wireguard/generated.nix @@ -1,7 +1,7 @@ { kernelPackages ? null }: import ../make-test-python.nix ({ pkgs, lib, ... } : { name = "wireguard-generated"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ma27 grahamc ]; }; diff --git a/nixos/tests/wireguard/namespaces.nix b/nixos/tests/wireguard/namespaces.nix index c47175ceafc83..93dc84a8768e5 100644 --- a/nixos/tests/wireguard/namespaces.nix +++ b/nixos/tests/wireguard/namespaces.nix @@ -17,7 +17,7 @@ in import ../make-test-python.nix ({ pkgs, lib, ... } : { name = "wireguard-with-namespaces"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ asymmetric ]; }; diff --git a/nixos/tests/wireguard/wg-quick.nix b/nixos/tests/wireguard/wg-quick.nix index 5472d21cd1ec2..8cf8c307de385 100644 --- a/nixos/tests/wireguard/wg-quick.nix +++ b/nixos/tests/wireguard/wg-quick.nix @@ -7,7 +7,7 @@ import ../make-test-python.nix ({ pkgs, lib, ... }: in { name = "wg-quick"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ xwvvvvwx ]; }; diff --git a/nixos/tests/wordpress.nix b/nixos/tests/wordpress.nix index 5d740502bb572..a5c10c2de741d 100644 --- a/nixos/tests/wordpress.nix +++ b/nixos/tests/wordpress.nix @@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "wordpress"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ flokli grahamc # under duress! diff --git a/nixos/tests/xautolock.nix b/nixos/tests/xautolock.nix index 4a8d3f4cebf7c..2d29f80b3fee8 100644 --- a/nixos/tests/xautolock.nix +++ b/nixos/tests/xautolock.nix @@ -4,7 +4,7 @@ with lib; { name = "xautolock"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ ma27 ]; + meta.maintainers = with pkgs.lib.maintainers; [ ma27 ]; nodes.machine = { imports = [ ./common/x11.nix ./common/user-account.nix ]; diff --git a/nixos/tests/xmonad.nix b/nixos/tests/xmonad.nix index 308dbca154fd4..078cd2118107c 100644 --- a/nixos/tests/xmonad.nix +++ b/nixos/tests/xmonad.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "xmonad"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; diff --git a/nixos/tests/xmpp/ejabberd.nix b/nixos/tests/xmpp/ejabberd.nix index 2b09f99f5fd99..7926fe80de2fd 100644 --- a/nixos/tests/xmpp/ejabberd.nix +++ b/nixos/tests/xmpp/ejabberd.nix @@ -1,6 +1,6 @@ import ../make-test-python.nix ({ pkgs, ... }: { name = "ejabberd"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ajs124 ]; }; nodes = { diff --git a/nixos/tests/xrdp.nix b/nixos/tests/xrdp.nix index 6d7f2b9249ffa..92eb7d4772ef2 100644 --- a/nixos/tests/xrdp.nix +++ b/nixos/tests/xrdp.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "xrdp"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ volth ]; }; diff --git a/nixos/tests/xss-lock.nix b/nixos/tests/xss-lock.nix index b77bbbbb3c4e7..71f56e32c58a2 100644 --- a/nixos/tests/xss-lock.nix +++ b/nixos/tests/xss-lock.nix @@ -4,7 +4,7 @@ with lib; { name = "xss-lock"; - meta.maintainers = with pkgs.stdenv.lib.maintainers; [ ma27 ]; + meta.maintainers = with pkgs.lib.maintainers; [ ma27 ]; nodes = { simple = { diff --git a/nixos/tests/xterm.nix b/nixos/tests/xterm.nix index 9f30543bf3859..078d1dca96423 100644 --- a/nixos/tests/xterm.nix +++ b/nixos/tests/xterm.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "xterm"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; diff --git a/nixos/tests/yabar.nix b/nixos/tests/yabar.nix index b374ef2968074..545fe544d534e 100644 --- a/nixos/tests/yabar.nix +++ b/nixos/tests/yabar.nix @@ -4,7 +4,7 @@ with lib; { name = "yabar"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ ma27 ]; }; diff --git a/nixos/tests/yggdrasil.nix b/nixos/tests/yggdrasil.nix index 1d7541308b481..0b58ad29aa2b1 100644 --- a/nixos/tests/yggdrasil.nix +++ b/nixos/tests/yggdrasil.nix @@ -23,7 +23,7 @@ let in import ./make-test-python.nix ({ pkgs, ...} : { name = "yggdrasil"; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ gazally ]; }; diff --git a/nixos/tests/yq.nix b/nixos/tests/yq.nix new file mode 100644 index 0000000000000..cdcb3d6e2462d --- /dev/null +++ b/nixos/tests/yq.nix @@ -0,0 +1,12 @@ +import ./make-test-python.nix ({ pkgs, ... }: { + name = "yq"; + meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; }; + + nodes.yq = { pkgs, ... }: { environment.systemPackages = with pkgs; [ jq yq ]; }; + + testScript = '' + assert "hello:\n foo: bar\n" in yq.succeed( + 'echo \'{"hello":{"foo":"bar"}}\' | yq -y .' + ) + ''; +}) diff --git a/nixos/tests/zfs.nix b/nixos/tests/zfs.nix index e05cd540227a6..03aa5e5399c65 100644 --- a/nixos/tests/zfs.nix +++ b/nixos/tests/zfs.nix @@ -8,13 +8,13 @@ with import ../lib/testing-python.nix { inherit system pkgs; }; let makeZfsTest = name: - { kernelPackage ? pkgs.linuxPackages_latest + { kernelPackage ? if enableUnstable then pkgs.linuxPackages_latest else pkgs.linuxPackages , enableUnstable ? false , extraTest ? "" }: makeTest { name = "zfs-" + name; - meta = with pkgs.stdenv.lib.maintainers; { + meta = with pkgs.lib.maintainers; { maintainers = [ adisbladis ]; }; diff --git a/nixos/tests/zookeeper.nix b/nixos/tests/zookeeper.nix index 42cf20b39c522..0ee2673886a74 100644 --- a/nixos/tests/zookeeper.nix +++ b/nixos/tests/zookeeper.nix @@ -1,7 +1,12 @@ -import ./make-test-python.nix ({ pkgs, ...} : { +import ./make-test-python.nix ({ pkgs, ...} : +let + + perlEnv = pkgs.perl.withPackages (p: [p.NetZooKeeper]); + +in { name = "zookeeper"; - meta = with pkgs.stdenv.lib.maintainers; { - maintainers = [ nequissimus ]; + meta = with pkgs.lib.maintainers; { + maintainers = [ nequissimus ztzg ]; }; nodes = { @@ -30,5 +35,12 @@ import ./make-test-python.nix ({ pkgs, ...} : { server.wait_until_succeeds( "${pkgs.zookeeper}/bin/zkCli.sh -server localhost:2181 get /foo | grep hello" ) + + server.wait_until_succeeds( + "${perlEnv}/bin/perl -E 'use Net::ZooKeeper qw(:acls); $z=Net::ZooKeeper->new(q(localhost:2181)); $z->create(qw(/perl foo acl), ZOO_OPEN_ACL_UNSAFE) || die $z->get_error()'" + ) + server.wait_until_succeeds( + "${perlEnv}/bin/perl -E 'use Net::ZooKeeper qw(:acls); $z=Net::ZooKeeper->new(q(localhost:2181)); $z->get(qw(/perl)) eq qw(foo) || die $z->get_error()'" + ) ''; }) diff --git a/nixos/tests/zsh-history.nix b/nixos/tests/zsh-history.nix index 4380ec9adfd25..3109c3f650818 100644 --- a/nixos/tests/zsh-history.nix +++ b/nixos/tests/zsh-history.nix @@ -1,7 +1,7 @@ import ./make-test-python.nix ({ pkgs, ...} : { name = "zsh-history"; - meta = with pkgs.stdenv.lib.maintainers; { - maintainers = [ kampka ]; + meta = with pkgs.lib.maintainers; { + maintainers = [ ]; }; nodes.default = { ... }: { |