| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
lomiri.lomiri: Try to consider services.xserver.xkb.layout
|
|
Upstream replaced `use` with `use{v4,v6}`:
https://github.com/ddclient/ddclient/blob/4a1b06630b90b3e6ff1d837b849bdbc68a2f53f9/ChangeLog.md#new-features
|
|
lomiri.lomiri-filemanager-app: init at 1.0.4
|
|
netboot: drop syslinux and grub (10% savings for nixos-anywhere images)
|
|
|
|
|
|
The CacheDirectory subdirectory is already part of $CACHE_DIRECTORY.
|
|
Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
|
|
nixos/boot: use `--replace-fail`
|
|
nixos/opengl: use systemd.tmpfiles.settings
|
|
|
|
nixos/pantheon: Do not set QT_QPA_PLATFORMTHEME
|
|
Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
|
|
|
|
option, drop with lib
This allows to easily test bash-completion updates without triggering a mass rebuild locally.
|
|
|
|
I want to use the final symlinked package in system.checks and need to
access that somehow. Instead of adding a new option, we might as well
convert tmpfiles to the new structure.
|
|
|
|
`podman --help` and `docker --help` each have global options, that
must be specified before `run`.
|
|
nixos/virtualbox-host: fix typo in assertion
|
|
nixos/forgejo: refactor secrets, add `cfg.secrets`, forgejo: build `environment-to-ini`, nixos/tests/forgejo: test `cfg.secrets` using /metrics endpoint
|
|
|
|
The `openssh` and `openssh_hpn` packages are now built without
the Kerberos support by default in an effort to reduce the attack surface.
The Kerberos support is likely used only by a fraction of the total users
(I'm guessing mainly users integrating SSH in an Active Directory env) so
dropping it should not impact too many users. It should also be noted that
the Kerberos/GSSAPI auth is disabled by default in the configuration.
`opensshWithKerberos` and `openssh_hpnWithKerberos` are added in order
to provide an easy migration path for users needing this support.
The `openssh_gssapi` package is kept untouched.
|
|
nixos/systemd: link user-generators
|
|
nixos/{hyprland, wayland-common}: disable wlr portal for hyprland, enable xdg autostart for all wayland compositors
|
|
nixos/{ollama,open-webui}: minor service update
|
|
|
|
|
|
nixos/open-webui: remove `preStart` step
|
|
|
|
|
|
|
|
|
|
This is not a breaking change. Existing setups continue to work as-is.
Users of `cfg.mailerPasswordFile` will get an option rename/deprecation
warning, but that's it (assuming there is no regression).
This adds `cfg.secrets`, which is a wrapper over systemd's
`LoadCredential=` leveraging Forgejo's `environment-to-ini`.
`environment-to-ini` is intended for configuring Forgejo in OCI
containers.
It requires some fairly annoying escaping of the section names to fit
into the allowed environment variable charset.
E.g. `"log.console".COLORIZE = false` becomes
`FORGEJO__LOG_0x2E_CONSOLE__COLORIZE=false`.
- `.` needs to be replaced with `_0X2E_` and
- `-` needs to be replaced with `_0X2D_`
Those are simply the hex representation of each char from an ASCII
table:
. = ASCII 46 = 46 (decimal) = 2E (hex) = 0x2E = _OX2E_
To make interacting with `environment-to-ini` less annoying, we template
and escape the sections/keys in nix:
`cfg.secrets` takes the same free-form sections/keys as `cfg.settings`.
Meaning there is now a generalized abstraction for all keys, not just
those that have been manually implemented in the past.
It goes as far as theoretically allowing one to have `DEFAULT.APP_NAME`
read from a secret file.
I don't know why one would want to do that, but it has been made
possible by this :^)
More reasonable examples are listed in the `cfg.secrets` option example.
We also continue to bootstrap a handful of secrets like
`security.SECRET_KEY`. This is done is a sort of sidecar bootstrap unit
fittingly called `forgejo-secrets.service`.
Overriding those is, just like before, not really intended and requires
the use of `lib.mkForce` and might lead to breakage. But it is, in a
way, more possible than before.
|
|
repart-image: remove --map-root-user flag from unshare
|
|
nixos/nvidia-optimus: add nvidia-modeset to blacklist
|
|
nixos/acme: allow setting security.acme.defaults.server = null to keep old accounts directory
|
|
nixos/plasma6: make print-manager depend on cups
|
|
nixos/nextcloud: make memory_limit of nextcloud-cron configurable
|
|
|
|
accounts directory
The accounts directory is based on the hash of the settings.
https://github.com/NixOS/nixpkgs/pull/270221 changed the default of
security.acme.defaults.server from null to the default letsencrypt URL
however as an unwanted side effect this means the accounts directory
changes and the ACME module will create a new a new account.
This can cause issues with people using CAA records that pin the
account ID or people who have datacenter-scale NixOS deployments
We allow setting this option to null again for people who want
to keep the old account and migrate at their own leisure.
Fixes https://github.com/NixOS/nixpkgs/issues/316608
Co-authored-by: Arian van Putten <arian.vanputten@gmail.com>
|
|
open-webui: init at 0.2.4
|
|
|
|
The comment says this is required by other modules but to be honest, I
cannot see where. Bootloaders will be included automatically by nixos
generation if their `installBootLoader` attribute references it.
This helps us to make kexec images even smaller espeically when
combined with the perlless profile.
|
|
nixos/xdg/portal: Fix typo
|
|
invocation
..
|
|
https://github.com/elementary/default-settings/commit/7aa79d47f7624b55f38e5392747452a90ac4cc89
Closes #316991
|
|
The nvidia-modeset module is loaded, which in turn pulls in the nvidia module. This makes bbswitch fail to turn off the card since it would be in use by the module.
|
|
|
|
|
