about summary refs log tree commit diff
path: root/nixos/modules/profiles
AgeCommit message (Collapse)AuthorFilesLines
2024-05-02nixos/top-level: Rename `system.forbiddenDependenciesRegex` to ↵Christian Kampka1-1/+1
`system.forbiddenDependenciesRegexes` and turn it in to a list. The current setting of system.forbiddenDependenciesRegex is a string, meaning only one such regex as any additional setting would result in conflicts. As maintainers have already started using this setting eg. in profiles, it would be good if this setting would accept a list of regex to allow the end user to make use of it in addition to package maintainers.
2024-04-17treewide: reanme renamed libinput optionsSandro Jäckel1-2/+4
2024-04-16profiles/graphical:rename services.xserver.displayManagerJulian Stecklina1-4/+3
2024-04-16profiles/demo: rename services.xserver.displayManagerJulian Stecklina1-1/+1
2024-04-13nixos: remove all uses of lib.mdDocstuebinm1-3/+3
these changes were generated with nixq 0.0.2, by running nixq ">> lib.mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix nixq ">> mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix nixq ">> Inherit >> mdDoc[remove]" --batchmode nixos/**.nix two mentions of the mdDoc function remain in nixos/, both of which are inside of comments. Since lib.mdDoc is already defined as just id, this commit is a no-op as far as Nix (and the built manual) is concerned.
2024-03-25Merge pull request #293846 from amarshall/darwin-linux-builder-fail-on-errorRobert Hensing1-0/+5
darwin.linux-builder: Exit scripts on error
2024-03-24nixos/profile/all-hardware: remove simplefbK9001-9/+0
It's simpledrm now and it's compiled in.
2024-03-15darwin.linux-builder: Exit scripts on errorAndrew Marshall1-0/+5
For example, if the user decided to ctrl-c upon getting the sudo password prompt, the script previously continued on to start the VM, but that should not be the case.
2024-01-27nixos/hardened: update hardened profile to new recommendationsTamara Schmitz1-3/+6
Borrowing from here to match hardened profile with more recent kernels: * https://madaidans-insecurities.github.io/guides/linux-hardening.html?#boot-parameters * https://github.com/a13xp0p0v/kernel-hardening-checker/ Removed "slub_debug" as that option disables kernel memory address hashing. You also see a big warning about this in the dmesg: "This system shows unhashed kernel memory addresses via the console, logs, and other interfaces." "init_on_alloc=1" and "init_on_free=1" zeroes all SLAB and SLUB allocations. Introduced in 6471384af2a6530696fc0203bafe4de41a23c9ef. Also the default for the Android Google kernel btw. It is on by default through the KConfig. "slab_nomerge" prevents the merging of slab/slub caches. These are effectively slab/slub pools. "LEGACY_VSYSCALL_NONE" disables the older vsyscall mechanic that relies on static address. It got superseeded by vdsos a decade ago. Read some LWN.net to learn more ;) "debugfs=off" I'm sure there are some few userspace programs that rely on debugfs, but they shouldn't. Most other things mentioned on the blog where already the default on a running machine or may not be applicable. Most other Kconfigs changes come from the kernel hardening checker and were added, when they were not applied to the kernel already. Unsure about CONFIG_STATIC_USERMODEHELPER. Would need testing.
2024-01-26Merge pull request #283244 from bjornfor/nixos-add-polkit-to-installation-deviceRyan Lahfa1-0/+3
nixos/installation-device: enable polkit
2024-01-23nixos/installation-device: enable polkitBjørn Forsman1-0/+3
Polkit enables running 'reboot' and 'poweroff' in the installer without being root, and non-root is the default login for a few NixOS releases now. There's no size increase in the minimal ISO: $ git checkout nixpkgs-unstable $ nix-build -A config.system.build.isoImage -I nixos-config=nixos/modules/installer/cd-dvd/installation-cd-minimal.nix nixos/default.nix && du -sc ./result/iso/*.iso /nix/store/bfvbvrrqjmnqqhyqyxc0w32gagdz2rya-nixos-24.05.git.1149dab64e7-x86_64-linux.iso 998404 ./result/iso/nixos-24.05.git.1149dab64e7-x86_64-linux.iso 998404 total $ git checkout THIS_COMMIT $ nix-build -A config.system.build.isoImage -I nixos-config=nixos/modules/installer/cd-dvd/installation-cd-minimal.nix nixos/default.nix && du -sc ./result/iso/*.iso /nix/store/l9x9rwlvfddnri70h1ifx865q0cvka5l-nixos-24.05.git.1149dab64e7-x86_64-linux.iso 998404 ./result/iso/nixos-24.05.git.1149dab64e7-x86_64-linux.iso 998404 total
2024-01-22nixos/profiles/perlless: initnikstur1-0/+31
2023-12-25Merge pull request #273308 from Stunkymonkey/install-device-fix-mdadmLinus Heckemann1-0/+2
nixos/installation-device: remove warning about mdadm
2023-12-11nixos/stub-ld: init moduleJeff Huffman1-0/+2
2023-12-10nixos/installation-device: remove warning about mdadmFelix Buehler1-0/+2
2023-11-28Merge pull request #268574 from hercules-ci/linux-builder-no-evalAtemu1-0/+13
darwin.linux-builder: Disable evaluation
2023-11-26Merge pull request #256159 from YtvwlD/yamaThiago Kenji Okada1-4/+0
nixos/sysctl: Stop disabling yama by default
2023-11-19darwin.linux-builder: Disable installer toolsRobert Hensing1-0/+3
2023-11-19darwin.linux-builder: Disable evaluationRobert Hensing1-0/+10
A remote builder does not need to evaluate anything, so let's trim it down to (eventually) save some space, and make the purpose of the builder clear. Users should evaluate on the host instead.
2023-10-28nixos/profiles: add image-based-appliance profileJulian Stecklina1-0/+26
2023-10-28nixos/profiles/minimal: remove some perlnikstur1-0/+9
2023-10-19nixos/sysctl: Enable Yama by defaultNiklas Sombert1-4/+0
Yama is a LSM which restricts debugging. This prevents processes from snooping on another. It can be easily disabled with sysctl. This was initially included in #14392 and disabled by default by 86721a5f78718caf10c578e9501f8b4d19c0eb44. This has been part of the hardened configuration, but many other distros ship this for quite some time (Ubuntu for about ten years), so I'd say it might make sense to enable this per default.
2023-10-12darwin.linux-builder: Expose nixosConfig and nixosOptions attributesRobert Hensing1-1/+6
I chose not to do nixos.{config, options} because that would make it look too much like a configuration object, which it is not. A configuration object I would define as for example the result of calling NixOS, an attrset with `_type = "configuration";`. Recreating a configuration object without evalModules is quite feasible but not guaranteed to be correct, and not maintainable.
2023-10-12darwin.linux-builder: Set meta.positionRobert Hensing1-0/+1
2023-10-04systemd-stage-1: Default to full systemd build.Will Fancher1-2/+0
2023-08-07nixos/installation-device: allow nix-copy for root/nixos userJörg Thalheim1-0/+3
For non-interactive installation it's quite handy to be able to nix copy additional dependencies to the system. While this is possible for the root user, we cannot easily ssh into it, as we don't allow root login with a password. By making nixos a trusted user, we can do "passwd && sudo systemctl start sshd" and than run nixos-anywhere
2023-07-23linux-builder: fix eval failureMichael Hoang1-1/+2
2023-07-10boot.initrd.services.swraid -> boot.swraidLinus Heckemann1-3/+1
Since the option affects both stage-1 and stage-2, it does not make sense to keep it within the boot.initrd namespace.
2023-07-10nixos/swraid: make entire module optionalLinus Heckemann1-0/+4
swraid support will now only be enabled by default if stateVersion is older than 23.11. nixos-generate-config will now generate explicit config for enabling support if needed.
2023-07-06darwin.linux-builder: rename from `darwin.builder`Michael Hoang1-1/+1
2023-07-06darwin.builder: allow overriding configurationMichael Hoang1-1/+1
2023-07-06nixos/qemu-vm: use CA certificates from hostMichael Hoang1-0/+4
2023-07-06darwin.builder: use port 31022 by defaultMichael Hoang1-5/+5
2023-07-01Merge pull request #178610 from Et7f3/headless-remove-vesaJanik1-3/+1
2023-04-08nixos/installer: update getty help messageBjørn Forsman1-3/+3
I think this is clearer.
2023-04-08nixos/installation-device.nix: improve comment about ssh loginBjørn Forsman1-2/+2
root is not the only user that can login (user "nixos" can too), so generalize the wording.
2023-04-07nixos/darwin-builder: add disk space options (#224480)Geraint Ballinger1-123/+183
2023-03-03nixos/profiles/base: remove duplicate and optimize fsPackagesIzorkin1-10/+2
2023-03-03nixos/profiles/base: remove duplicate systemPackagesIzorkin1-3/+1
2023-01-17Merge pull request #208956 from SuperSandro2000/profile-base-tcpdumpSandro1-0/+1
2023-01-15services.openssh: support freeform settings (#193757)Matthieu Coudron1-1/+1
* services.openssh: support freeform settings Keep "extraConfig" but introduces "settings". Also renames several options (mkRenamedOptionModule [ "services" "openssh" "kbdInteractiveAuthentication" ] [ "services" "openssh" "settings" "KbdInteractiveAuthentication" ]) (mkRenamedOptionModule [ "services" "openssh" "passwordAuthentication" ] [ "services" "openssh" "settings" "PasswordAuthentication" ]) (mkRenamedOptionModule [ "services" "openssh" "useDns" ] [ "services" "openssh" "settings" "UseDns" ]) (mkRenamedOptionModule [ "services" "openssh" "permitRootLogin" ] [ "services" "openssh" "settings" "PermitRootLogin" ]) * updated doc * regen doc
2023-01-04nixos/misc: add VARIANT_ID in /etc/os-release for identifying nixos installerlassulus1-0/+1
This is a feature useful for nixos-remote and other installation tools that try to identify if the remote machine has been successfully booted into an installer.
2023-01-03darwin.builder: auto-login as the `builder` user (#208772)Gabriella Gonzalez1-3/+7
… as suggested by @NiklasGollenstede in: https://github.com/NixOS/nixpkgs/pull/206951#issuecomment-1369020601 This simplifies the user experience for logging into and debugging the machine and also simplifies the instructions for shutting down the machine gracefully.
2023-01-04nixos/profiles/base: add tcpdumpSandro1-0/+1
2023-01-02darwin.builder: prefer shutting down over halting VM (#208450)Winter1-9/+21
This is preferable because it prevents things like disk corruption (requiring the user to delete the disk image when starting up) that I consistently ran into.
2022-12-28nixos/macos-builder: Remove unnecessary paragraphRobert Hensing1-5/+0
I was considering the broader context of stateVersion, but the macos builder does not enable documentation, making this paragraph a distraction.
2022-12-28nixos/macos-builder: Simplify error messageRobert Hensing1-5/+1
The `system` argument is usually implied, and not hard to figure out. Co-authored-by: Gabriella Gonzalez <Gabriel439@gmail.com>
2022-12-28darwin.builder: Avoid unnecessary dependency on stateVersionRobert Hensing1-1/+28
2022-12-26darwin.builder: Fix gratuitous rebuildsGabriella Gonzalez1-1/+6
See the discussion starting here: https://github.com/NixOS/nixpkgs/pull/206951#issuecomment-1364760917 The `darwin.builder` derivation had a gratuitous dependency on the current Nixpkgs revision due to `config.system.nixos.revision`. Setting the revision explicitly to null fixes this problem and prevents the derivation from being rebuilt on every change to Nixpkgs.
2022-12-24darwin.builder: Fix `system` for `install-credentials`Gabriella Gonzalez1-1/+1
The script was being mistakenly being built for the guest system instead of the host system
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-08 22:15:32 +0000