about summary refs log tree commit diff
path: root/nixos
AgeCommit message (Collapse)AuthorFilesLines
2023-09-10Merge pull request #254333 from amarshall/fix-networkd-reloadK9001-3/+2
nixos/networkd: Fix incorrectly treating attrset as list
2023-09-10Merge pull request #251770 from robryk/suidwrapapparmPierre Bourdon5-124/+39
nixos/security/wrappers: simplifications and a fix for #98863 (respin of #199599)
2023-09-10nixos/networkd: Fix incorrectly treating attrset as listAndrew Marshall1-3/+2
This reverses a [change made during PR review][1] that I did not sufficiently test, causing [this error][2]. [1]: https://github.com/NixOS/nixpkgs/pull/249643#discussion_r1309151135 [2]: https://github.com/NixOS/nixpkgs/pull/249643#issuecomment-1712707336
2023-09-09Merge pull request #246201 from n0emis/zigbee2mqtt-groups-fileJanik1-1/+2
2023-09-09security/acme: limit concurrent certificate generationsOliver Schmidt3-14/+136
fixes #232505 Implements the new option `security.acme.maxConcurrentRenewals` to limit the number of certificate generation (or renewal) jobs that can run in parallel. This avoids overloading the system resources with many certificates or running into acme registry rate limits and network timeouts. Architecture considerations: - simplicity, lightweight: Concerns have been voiced about making this already rather complex module even more convoluted. Additionally, locking solutions shall not significantly increase performance and footprint of individual job runs. To accomodate these concerns, this solution is implemented purely in Nix, bash, and using the light-weight `flock` util. To reduce complexity, jobs are already assigned their lockfile slot at system build time instead of dynamic locking and retrying. This comes at the cost of not always maxing out the permitted concurrency at runtime. - no stale locks: Limiting concurrency via locking mechanism is usually approached with semaphores. Unfortunately, both SysV as well as POSIX-Semaphores are *not* released when the process currently locking them is SIGKILLed. This poses the danger of stale locks staying around and certificate renewal being blocked from running altogether. `flock` locks though are released when the process holding the file descriptor of the lock file is KILLed or terminated. - lockfile generation: Lock files could either be created at build time in the Nix store or at script runtime in a idempotent manner. While the latter would be simpler to achieve, we might exceed the number of permitted concurrent runs during a system switch: Already running jobs are still locked on the existing lock files, while jobs started after the system switch will acquire locks on freshly created files, not being blocked by the still running services. For this reason, locks are generated and managed at runtime in the shared state directory `/var/lib/locks/`. nixos/security/acme: move locks to /run also, move over permission and directory management to systemd-tmpfiles nixos/security/acme: fix some linter remarks in my code there are some remarks left for existing code, not touching that nixos/security/acme: redesign script locking flow - get rid of subshell - provide function for wrapping scripts in a locked environment nixos/acme: improve visibility of blocking on locks nixos/acme: add smoke test for concurrency limitation heavily inspired by m1cr0man nixos/acme: release notes entry on new concurrency limits nixos/acme: cleanup, clarifications
2023-09-09nixos/decklink: inithexchen2-0/+17
2023-09-09Merge pull request #249964 from ambroisie/woodpecker-improvementsJanik1-18/+41
2023-09-09Merge pull request #253739 from mweinelt/firefox-102-removalajs1241-1/+0
firefox-esr-102-unwrapped: remove
2023-09-09Merge pull request #252006 from ajs124/logrotate-extraParamsLassulus1-3/+9
2023-09-09nixos/tt-rss: fix and significantly simplify database setupajs1241-41/+3
the schema files referenced in the current preStart are empty. other ones exist, but don't apply cleanly either. calling update.php with --update-schema works for initial setup and updates. if the database schema is already up to date, it's idempotent.
2023-09-09Merge pull request #251062 from ajs124/restic-wrapper-scriptJanik3-12/+42
2023-09-09Merge pull request #251302 from Mic92/buildbotLassulus1-1/+7
nixos/buildbot: support reload, buildbot-www-react: init 3.9
2023-09-09Merge pull request #254166 from Artturin/fixthingy1Artturi1-1/+1
2023-09-09Merge pull request #248502 from kurnevsky/wstunnelYorick1-2/+2
wstunnel: correct listen option
2023-09-09Merge pull request #249643 from amarshall/networkd-reloadJanne Heß1-2/+9
nixos/networkd: Reload (not restart) when only .network units change
2023-09-09Merge pull request #254027 from luochen1990/feature-better-binfmtJanne Heß1-1/+1
nixos/binfmt: improve type annotations
2023-09-09nixos/listmonk: fixing datatype of optionsrevol-xut1-2/+2
2023-09-09nixos/cfdyndns: add option to use CF tokenTimothy DeHerrera1-1/+13
2023-09-09Merge pull request #254029 from delroth/sudo-maintainersPierre Bourdon1-1/+1
sudo, nixosTests.sudo: refresh set of maintainers
2023-09-09nixos/stage-2-init: dont use install to create /etc/nixos if it's a symlinkArtturin1-1/+1
it should be checking that it is not a broken symlink but bash conditionals are difficult -d was causing the directory to not be created if it does not exist ``` $ install -m 0755 -d $PWD/hello $ ls hello/ $ ln -s something notexist 'notexist' -> 'something' $ ls -l lrwxrwxrwx artturin artturin 9 B Sat Sep 9 06:59:44 2023 notexist@ ⇒ something drwxr-xr-x artturin artturin 2 B Sat Sep 9 06:59:36 2023 hello/ $ install -m 0755 -d $PWD/notexist install: cannot change permissions of ‘/home/artturin/nixgits/my-nixpkgs/test/notexist’: No such file or directory ```
2023-09-09Merge pull request #254089 from BruNeu/patch-1Weijia Wang1-1/+1
nixos/stalwart-mail: fixed broken link
2023-09-08nixos/stalwart-mail: fixed broken linkBruNeu1-1/+1
2023-09-08Merge pull request #254078 from nbraud/hailMaciej Krüger3-62/+2
2023-09-08plausible: 1.4.4 -> 1.5.1Salar Rahmanian1-0/+1
2023-09-08nixos/hail: Remove modulenicoo3-62/+2
2023-09-08Merge pull request #253299 from pennae/jack-toolspennae1-0/+2
jack-example-tools: init at 4
2023-09-08nixosTests.sudo: use same maintainers as the packagePierre Bourdon1-1/+1
2023-09-08nixos/binfmt: improve type annotationsLuoChen1-1/+1
2023-09-07Merge pull request #253142 from SuperSandro2000/patch-1Weijia Wang1-5/+7
nixos/nginx: fix services.nginx.defaultListen description
2023-09-07Merge pull request #253071 from linsui/yaziWeijia Wang1-0/+49
nixos/yazi: init
2023-09-07Merge pull request #253048 from Mic92/openrbgWeijia Wang1-1/+8
nixos/openrbg: set cpu model based on what microcode updates are enabled
2023-09-07Merge pull request #249941 from FrancescoDeSimone/duplicati-service-fixWeijia Wang1-3/+4
nixos/duplicati: add package option
2023-09-07nixos/infiniband: add support for configurable guidsEdward Tjörnhammar3-0/+61
2023-09-07nixos/mobilizon: add release notesKerstin Humm1-0/+2
2023-09-07mobilizon: init at 3.1.3Kerstin Humm4-0/+488
Co-Authored-By: Minijackson <minijackson@riseup.net> Co-Authored-By: summersamara <summersamara@proton.me>
2023-09-07nixos/surrealdb: incorporate beta 10 changeshappysalada1-22/+7
2023-09-07Merge pull request #247618 from Majiir/streamdeck-ui-3.0.1Weijia Wang1-1/+1
streamdeck-ui: 2.0.6 -> 3.0.1
2023-09-06streamdeck-ui: split desktop itemsMajiir Paktu1-1/+1
2023-09-07Merge pull request #251118 from jmbaur/tpm-crb-initrdWeijia Wang1-1/+1
nixos/systemd-initrd: disable tpm-crb if on armv7l-linux
2023-09-07Merge pull request #250224 from n0emis/grocy-4.0.2Weijia Wang1-3/+13
grocy: 4.0.0 -> 4.0.2
2023-09-07firefox-esr-102-unwrapped: removeMartin Weinelt1-1/+0
The Firefox ESR 102.0 series has reached its end of life. Removes package and test and references to them.
2023-09-07nixos/systemd-initrd: disable tpm-crb if on armv7l-linuxJared Baur1-1/+1
In addition to the existing riscv64 exception, also disable adding the tpm-crb module to the initrd if the host platform is armv7.
2023-09-06auto-cpufreq: 1.7.1 -> 1.9.9 (#253595)May1-2/+5
* auto-cpufreq: 1.7.1 -> 1.9.9 * fix test * set `meta.buildDocsInSandbox = false` required because description depends on restricted module argument pkgs
2023-09-06nixos/iso-image: Remove leftover false dichotomy between console/serialSamuel Dionne-Riel1-28/+10
Relying on the built-in UEFI console here was already necessary, so we are losing nothing by removing the needless `serial` call, which hung some systems. This also makes the implementation much easier to understand. Also, no ugly-font menu anymore!
2023-09-06nixos/iso-image: graphicalGrub -> forceTextModeSamuel Dionne-Riel1-5/+9
This helps keep logic simpler, as what we do is forcing text mode, which means the non-default case is `truthy`, making things easier to digest in the config file. Also renaming this option is considered "internal", since it lives only within the `iso-image` namespace, and also not a breaking change since it was not part of a stable release.
2023-09-06nixos/iso-image: Tear down GOP and rely on console for Linux bootSamuel Dionne-Riel1-0/+3
This solves an issue where *some systems* (tested on Steam Deck) the EFI GOP may be broken during stage-1.
2023-09-06nixos/iso-image: Drop all unneeded FS modulesSamuel Dionne-Riel1-6/+0
It's not like the iso-image will be anything else than isohybrid FAT+iso9660...
2023-09-06nixos/iso-image: Re-enable graphics modeSamuel Dionne-Riel1-1/+1
Which ***anyway*** was not disabled correctly. Following changes will actually disable it. What this did was disable the "themed" menu driver, but still continued relying on the gfxterm infra, which in itself is why things were ugly and weird.
2023-09-06nixos/iso-image: Check GRUB config on buildSamuel Dionne-Riel1-0/+2
2023-09-06nixos/iso-image: Add common display resolutionsSamuel Dionne-Riel1-0/+4
Hey, look at that, grub is the correct way around on a Steam Deck!
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-09-18 23:10:33 +0000