colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
604,273 Commits 125 Branches 0 Tags 3.4 GiB
48f9437cd1
Commit Graph

29955 Commits

Author SHA1 Message Date
Florian Klink
39ebd395cc
Merge pull request #224666 from grindhold/container_underscores 
check nixos-container names for underscores
 2024-03-20 11:41:34 +02:00
Pol Dellaiera
15541288f3
Merge pull request #297133 from trofi/etebase-server-fix-test 
etebase-server: fix the eval on `null` `cfg.unixSocket`
 2024-03-20 07:38:15 +01:00
K900
e240f8bde9 Merge remote-tracking branch 'origin/master' into staging-next 2024-03-20 09:27:30 +03:00
K900
e382906174
Merge pull request #295839 from peterhoeg/m/sddm_kwin 
nixos/sddm: add support for kwin_wayland
 2024-03-20 09:02:52 +03:00
Ameya Shenoy
99c0c32a49
usbguard: fix policy enums 
The available policies for `InsertedDevicePolicy` and
`ImplicitPolicyTarget` differ from the defined policy enum. This change
is to prevent users from configuring incorrect policies for `usbguard`

Related `usbguard` documentation
https://usbguard.github.io/documentation/configuration.html

Signed-off-by: Ameya Shenoy <shenoy.ameya@gmail.com>
 2024-03-20 08:41:21 +05:30
lassulus
b82a5ef764 nixos/mycelium: init 2024-03-20 03:56:58 +01:00
Adam Stephens
deb5be50c4
incus: move wrapper to nixos module 2024-03-19 22:48:07 -04:00
github-actions[bot]
a474411771
Merge master into staging-next 2024-03-20 00:02:08 +00:00
aleksana
b60f6b118b nixos/mandoc: add leading slash to manPath 2024-03-20 00:56:18 +01:00
aleksana
da089cf63a nixos/mandoc: fix invalid manpath directory and add cachePath option 2024-03-20 00:56:18 +01:00
Philip Taron
29a46d2802
nixos/nvidia: Set SidebandSocketPath to a user-writable path in /run 
The NVIDIA X driver uses a UNIX domain socket to pass information to
other driver components. If unable to connect to this socket, some
driver features, such as G-Sync, may not work correctly. The socket will
be bound to a file with a name unique to the X server instance created
in the directory specified by this option. Note that on Linux, an
additional abstract socket (not associated with a file) will also be
created, with this pathname socket serving as a fallback if connecting
to the abstract socket fails.

The default, which was in effect prior to this change, was `/var/run`.

The effect of not setting this option was that GDM X sessions
(and other non-root sessions) would see this warning in the log files:

```
   (WW) NVIDIA: Failed to bind sideband socket to
   (WW) NVIDIA:     '/var/run/nvidia-xdriver-b4f69129' Permission denied
```

I don't see any security implications of turning this on universally,
since there already was an abstract socket created according to the
docs.

Documentation:

1. [NVIDIA X Config Options](https://download.nvidia.com/XFree86/Linux-x86_64/440.82/README/xconfigoptions.html#SidebandSocketPath)

Diagnosis:

1. [Arch Linux BBS post](https://bbs.archlinux.org/viewtopic.php?pid=1909115#p1909115)
 2024-03-19 16:34:41 -07:00
maxine
b0f45b4837
Merge pull request #295926 from savannidgerinel/savanni/1password-8.10.28-21 
_1password-gui_beta: 8.10.28-11 -> 8.10.28-21 + refactor
 2024-03-19 23:11:29 +01:00
Savanni D'Gerinel
61b6a6ae6f
_1password-gui-beta: 8.10.28-11 -> 8.10.28-21 
- Updating the 1Password beta release to 8.10.28
- Removing the KeyringHelper application.
 2024-03-19 23:09:37 +01:00
Silvan Mosberger
308671dbe8 nixos/nix: Fix example for nix.settings option 
Attribute sets aren't valid option values, needs to be a list
 2024-03-19 22:55:19 +01:00
Peter Hoeg
404a2363d1 nixos/plasma6: use kwin with sddm 2024-03-19 21:14:46 +01:00
Peter Hoeg
8c642cd40a nixos/sddm: add support for kwin_wayland 2024-03-19 20:55:23 +01:00
github-actions[bot]
7338a5dec5
Merge master into staging-next 2024-03-19 18:01:00 +00:00
Will Fancher
f0701b576a
Merge pull request #290061 from SuperSandro2000/kernel-modules-package-name 
nixos/boot: move name overwrite to pkgs.aggregateModules to option
 2024-03-19 13:04:19 -04:00
WilliButz
e9fa0ec5fe
nixos/uki: add configFile option 
This option makes it easier to reuse a system's ukify.conf without the
need for manually calling the generator on `settings` again to receive a
rendered configuration file.

Theoretically, a complete configuration file could now be provided by
users.
 2024-03-19 17:58:28 +01:00
Martin Weinelt
7762462405
Merge remote-tracking branch 'origin/master' into staging-next 
Conflicts:
- pkgs/development/python-modules/flask-security-too/default.nix
 2024-03-19 17:30:16 +01:00
Bobby Rong
2dcadb7087
Merge pull request #297072 from FedericoSchonborn/add-federicoschonborn 
maintainers: Add federicoschonborn back again
 2024-03-19 23:12:06 +08:00
ajs124
bdabdf0c16 nixos/gitlab: use workhorse package from option in path 2024-03-19 13:47:55 +01:00
ajs124
1bada61543 nixos/gitlab: switch from sidekiq to sidekiq-cluster 2024-03-19 13:47:55 +01:00
Sandro
4a9a5fab1c
Merge pull request #283501 from SuperSandro2000/hedgedoc-fix-tools-exec 2024-03-19 13:37:46 +01:00
Sergei Trofimovich
5a3bd05394 etebase-server: fix the eval on null cfg.unixSocket 
Without the change the test eval fails as:

    $ nix build --no-link -f. etebase-server.tests
       error: cannot coerce null to a string: null
 2024-03-19 08:59:57 +00:00
Federico Damián Schonborn
455b915be0
maintainers: Add federicoschonborn back again 
Signed-off-by: Federico Damián Schonborn <federicoschonborn@disroot.org>
 2024-03-18 21:51:28 -03:00
github-actions[bot]
7c0bd382c7
Merge master into staging-next 2024-03-19 00:02:09 +00:00
Lily Foster
e3c0bb4255
Merge pull request #294542 from Janik-Haag/garage 
nixos/garage: add env-var wrapper for admin cli
 2024-03-18 16:10:15 -07:00
Janik H.
9ec0e31f79
nixos/garage: add env-var wrapper for admin cli 2024-03-18 22:53:21 +01:00
Will Fancher
57f69255d7
Merge pull request #293591 from lf-/jade/fix-luksroot-assert 
nixos.luksroot: fix assertion message to name correct option
 2024-03-18 17:46:11 -04:00
maralorn
b6668ded0e
Merge pull request #296977 from slotThe/maintainer 
Add slotThe as a maintainer
 2024-03-18 22:43:38 +01:00
Jade Lovelace
a72afcbc48 nixos.luksroot: fix assertion message to name correct option 2024-03-18 14:41:47 -07:00
Ryan Lahfa
ae07fcb07b
Merge pull request #293271 from nikstur/test-instrumentation-without-usr-bin-env 
nixos/test-instrumentation: use full path to env
 2024-03-18 13:57:37 -07:00
Tony Zorman
240c39ef2e nixos/xmonad: add slotThe as a maintainer 2024-03-18 20:27:15 +01:00
Martin Weinelt
00e2713c5b
Merge remote-tracking branch 'origin/master' into staging-next 2024-03-18 19:59:23 +01:00
Will Fancher
99587a3411
Merge pull request #209964 from Majiir/fix-initrd-systemd-closure 
nixos/systemd/initrd: follow init param symlinks
 2024-03-18 14:39:37 -04:00
Florian Klink
70d7abc09c
Merge pull request #296924 from flokli/document-servers-empty-fallback 
nixos/timesyncd: further document services.timesyncd.servers
 2024-03-18 20:08:22 +02:00
Jon Seager
ffc736695c
Merge pull request #296937 from MinerSebas/scrutiny-collector-ordering 2024-03-18 17:16:40 +00:00
Martin Weinelt
03fcd060ff
Merge pull request #296921 from patka-123/engelsystem-cleanup 
engelsystem: cleanup
 2024-03-18 17:14:59 +01:00
Patka
93aba53a08
engelsystem: cleanup 
The custom php with extensions is not needed. The default already has all the needed extensions enabled by default.
 2024-03-18 17:08:01 +01:00
K900
823897dde8 wireplumber: 0.4.17 -> 0.5.0 2024-03-18 18:57:05 +03:00
MinerSebas
9d384c350b nixos/scrutiny: Order scrutiny-collector after scrutiny 2024-03-18 16:30:51 +01:00
Florian Klink
78d8e2ca11 nixos/timesyncd: further document services.timesyncd.servers 
Running systemd-timesyncd with an empty list of timeservers to sync from
does not work.

In case an empty list is configured here, systemd will fall back to its
compiled-in defaults, which NixOS sets to `{0..4}.nixos.pool.ntp.org`,
as per https://github.com/systemd/systemd/blob/main/docs/DISTRO_PORTING.md#ntp-pool

This has caused some confusion. Explicitly document this, and describe
how to disable timesyncd.
 2024-03-18 17:23:55 +02:00
github-actions[bot]
d5491af22d
Merge master into staging-next 2024-03-18 12:01:22 +00:00
Sandro
124ec2d9d6
nixos/xserver: don't conflict pinentry package with DEs 2024-03-18 11:22:48 +01:00
nikstur
a1c4f0a754
Merge pull request #282022 from ElvishJerricco/gpt-auto-root 
nixos: Support systemd-gpt-auto-root
 2024-03-18 10:27:22 +01:00
github-actions[bot]
819a14ad05
Merge master into staging-next 2024-03-18 06:01:21 +00:00
github-actions[bot]
ac91cf83c1
Merge master into staging-next 2024-03-18 00:02:20 +00:00
Alex Martens
bdb6849a32 nixos/llama-cpp: fix binary path 2024-03-17 16:48:51 -07:00
Sandro
1f212fd6e6
Merge pull request #289025 from tcheronneau/issue-288907 
nixos/tinyproxy: fix the quotes around the filter path
 2024-03-17 23:33:42 +01:00
Will Fancher
486e837cbe
Merge pull request #293710 from B4dM4n/networkd-policy-rule-port-range 
nixos/networkd: allow RoutingPolicyRule port ranges
 2024-03-17 12:36:30 -07:00
github-actions[bot]
100b3bb178
Merge master into staging-next 2024-03-17 18:00:54 +00:00
github-actions[bot]
c222aba0b8
Merge master into staging-next 2024-03-17 12:01:55 +00:00
Patka
c4e1ffb96b
engelsystem: 3.4.1 -> 3.5.0 
Release notes: https://github.com/engelsystem/engelsystem/releases/tag/v3.5.0
 2024-03-17 12:24:29 +01:00
Maximilian Bosch
6af7e814af
Merge pull request #292993 from wolfgangwalther/postgresql-refactor 
postgresql: refactor and cleanup
 2024-03-17 10:00:07 +00:00
Sandro
62748bdf42
Merge pull request #295891 from Stzx/pinentry-conflict 
pinentry: fix DM option and user conflict
 2024-03-17 08:50:13 +01:00
github-actions[bot]
2178d8d857
Merge master into staging-next 2024-03-17 00:02:17 +00:00
Martin Weinelt
2b003c0269
nixos/pretix: make state directory world-readable 
Pretix creates static files in its state directory, that nginx needs to
serve, so locking down the permissions that hard is not going to work.
 2024-03-16 23:44:37 +01:00
Atemu
44a3dd2ef4
Merge pull request #296009 from Atemu/steamcompattools 
proton-ge-bin: init at 9-1, nixos/steam: use steamcompattool output for extraCompatPackages
 2024-03-16 20:57:05 +00:00
Jon Seager
bfa0fb2dbe
Merge pull request #296463 from MinerSebas/scrutiny-split 2024-03-16 19:41:40 +00:00
Marcus Ramberg
20eec34036 nixos/nimdow: Make package configurable, ensure nimdow can start a terminal in it's default config 2024-03-16 19:32:34 +01:00
github-actions[bot]
60fbf92c10
Merge master into staging-next 2024-03-16 18:01:00 +00:00
Pol Dellaiera
5ebdb3eda7
Merge pull request #296465 from Janik-Haag/networkmanager-ensure-profiles 
nixos/networkmanager: ensure-profiles, make sure networkmanager is running
 2024-03-16 18:46:12 +01:00
Janik H.
847a53742c
nixos/networkmanager: ensure-profiles, make sure networkmanager is running 2024-03-16 18:11:58 +01:00
MinerSebas
2210ac7764 nixos/scrutiny: Order scrutiny.service after influxdb2.service 2024-03-16 18:02:17 +01:00
MinerSebas
7d6917088c nixos/scrutiny: Dont enable influxdb when only using scrutiny-collector 2024-03-16 18:02:10 +01:00
Atemu
bdc55d2f86 nixos/steam: provide example in extraCompatPackages 2024-03-16 17:59:27 +01:00
Atemu
2b619c2314 nixos/steam: use steamcompattool output for extraCompatPackages 
This sets a standard for Steam compat tools in NixOS where they must have the
compat tool in a special steamcompattool output.

proton-ge-bin was adjusted to conform with it.
 2024-03-16 17:59:27 +01:00
Arian van Putten
d211b80d29
Merge pull request #294493 from endgame/ec2-image-ssm-agent 
nixos/amazon-image: Enable Amazon SSM Agent by default
 2024-03-16 17:57:42 +01:00
Guillaume Girol
119099506c
Merge pull request #292477 from nu-nu-ko/nixos-komga-hardening 
nixos/komga: add service hardening and misc format changes.
 2024-03-16 17:34:45 +01:00
Martin Weinelt
fe8d02e2bc
Merge pull request #296180 from mweinelt/pretix 
pretix: init at 2024.2.0
 2024-03-16 17:28:20 +01:00
Jörg Thalheim
56db90d274
Merge pull request #296164 from bubuntux/ivsc-option 
Add ivsc-firmware to ipu6 option
 2024-03-16 16:14:05 +01:00
Martin Weinelt
b05a529fd6
nixos/pretix: init 2024-03-16 14:50:56 +01:00
Bobby Rong
3b48b3aaa9
Merge pull request #289062 from bobby285271/upd/mate 
MATE 1.28
 2024-03-16 21:38:24 +08:00
github-actions[bot]
9db4d84312
Merge master into staging-next 2024-03-16 12:01:19 +00:00
Pol Dellaiera
4285a30496
Merge pull request #295837 from abysssol/ollama-env-vars 
nixos/ollama: add option to set environment variables
 2024-03-16 08:02:55 +01:00
github-actions[bot]
7006358e6a
Merge master into staging-next 2024-03-16 00:02:02 +00:00
Will Fancher
f1731f2e28 nixos: Support systemd-gpt-auto-root 2024-03-15 18:22:04 -04:00
Guillaume Girol
1f26e67560
Merge pull request #278064 from symphorien/nix_config_extra 
nixos/nix: add workaround for https://github.com/NixOS/nix/issues/9487
 2024-03-15 22:46:51 +01:00
Pol Dellaiera
21456ee2a7
Merge pull request #296183 from laalsaas/etebase-server-fix 
etebase-server: create required tmpdir
 2024-03-15 22:08:15 +01:00
Wolfgang Walther
4b6bce5c31
postgresql: refactor to remove "this" argument 
This was proposed by abbradar in #150801, but left out of the follow up PR
#221851 by Ma27 to reduce the size of the diff. Compared to the initial
proposal this includes the callPackage call in the recursion, which avoids
breaking the withJIT/withoutJIT helpers.

In terms of nixpkgs, this is a pure refactor, no derivations change. However,
this makes downstream expressions like the following possible:

  (postgresql.override { jitSupport = true; }).pkgs.postgis

This would have not worked before without passing another "this" argument,
which is error prone as can be seen in this example:

  https://github.com/PostgREST/postgrest/pull/3222/files
 2024-03-15 21:11:09 +01:00
Wolfgang Walther
14b3ea2789
postgresql: refactor to pass jitSupport/llvm via scope instead of passthru 
This makes it less error-prone to use the llvm package in extensions, because
it will always match the package used by the postgresql derivation itself.

Previously, you could've accidentally used llvm instead of postgresql.llvm
with a different result.
 2024-03-15 21:11:09 +01:00
Maximilian Bosch
0d17fd9524
Merge pull request #292473 from networkException/fix-synapse-unix-socket-permissions 
nixos/matrix-synapse: allow synapse to write to directories of unix socket paths
 2024-03-15 18:53:04 +00:00
Janik H.
fc060cc3cb nixos/resolvconf: add ::1 as local dns resolver 2024-03-15 19:31:37 +01:00
github-actions[bot]
00729a3d21
Merge master into staging-next 2024-03-15 18:01:19 +00:00
laalsaas
1d4c8cb0ff etebase-server: create required tmpdir 2024-03-15 16:52:21 +01:00
Julio Gutierrez
811872a489 Add ivsc-firmware to ipu6 option 2024-03-15 09:29:46 -05:00
Andrew Marshall
24ae983076 darwin.linux-builder: Exit scripts on error 
For example, if the user decided to ctrl-c upon getting the sudo
password prompt, the script previously continued on to start the VM, but
that should not be the case.
 2024-03-15 08:52:30 -04:00
Peder Bergebakken Sundt
3399de5396
Merge pull request #295342 from pbsds/spotifyd-url-1710255988 
nixos/spotifyd: update configuration documentation url
 2024-03-15 13:03:01 +01:00
github-actions[bot]
4aac48ff7f
Merge master into staging-next 2024-03-15 06:01:09 +00:00
Bobby Rong
9254f99be6
Merge pull request #296019 from bobby285271/upd/budgie 
nixos/budgie: Fix default fonts
 2024-03-15 08:35:12 +08:00
github-actions[bot]
2bffd64e73
Merge master into staging-next 2024-03-15 00:01:59 +00:00
Bobby Rong
f7f3a3ec53
nixos/budgie: Fix default fonts 
Always install noto fonts and hack font.
 2024-03-15 07:56:02 +08:00
Ilan Joselevich
09078fd022
Merge pull request #295932 from Kranzes/nextcloud 
nixos/nextcloud: remove opcache.enable_cli=1
 2024-03-14 21:36:09 +02:00
Ilan Joselevich
9353fb2309
nixos/nextcloud: remove opcache.enable_cli=1 
Upstream no longer recommends enabling the opcache cli.
See the following:
 - https://github.com/nextcloud/documentation/issues/1439
 - https://github.com/nextcloud/server/pull/15468
 2024-03-14 18:36:11 +02:00
Bobby Rong
398cce395c
nixos/mate: Add enableWaylandSession option 
Make this an opt-in for now since the session is in early stage
and introduces a new set of wayfire closure.
 2024-03-14 23:34:11 +08:00
Bobby Rong
b45faa9834
nixos/mate: Add extraPanelApplets, extraCajaExtensions option 
Hopefully this is more user-friendly.
 2024-03-14 23:34:10 +08:00
Bobby Rong
a323f4f828
mate: Install mate-panel-with-applets by default 2024-03-14 23:34:06 +08:00
Bobby Rong
c87f6b5591
mate: Install caja-with-extensions by default 2024-03-14 23:34:05 +08:00
Stzx
8bf5cc2666
pinentry: fix DM option and user conflict 2024-03-14 21:54:35 +08:00
abysssol
b5e7a05bb7 nixos/ollama: add option to set environment variables 2024-03-14 04:21:36 -04:00
github-actions[bot]
f4c4bfc9fc
Merge master into staging-next 2024-03-13 18:00:53 +00:00
nikstur
7f175e69ca
Merge pull request #295370 from arianvp/fix-295365 
nixos/binfmt: fix race condition between systemd-tmpfiles and systemd-binfmt
 2024-03-13 14:52:24 +01:00
Sandro
db55012fa3
Merge pull request #291455 from SuperSandro2000/hydra-starman-worker 2024-03-13 13:57:12 +01:00
github-actions[bot]
cecf050e96
Merge master into staging-next 2024-03-13 12:01:25 +00:00
Pol Dellaiera
55251f1ffc
Merge pull request #295547 from Janik-Haag/unbound 
nixos/unbound: drop networkmanager since it doesn't support unbound anymore
 2024-03-13 10:33:52 +01:00
Janik H.
4147e50f18
nixos/unbound: drop networkmanager since it doesn't support unbound anymore 2024-03-13 09:50:56 +01:00
Pol Dellaiera
c35c016e5d
Merge pull request #295529 from Janik-Haag/networkmanager-drop-unbound 
nixos/networkmanager: drop unbound form dns servers
 2024-03-13 09:04:58 +01:00
Pol Dellaiera
6710011819
Merge pull request #295199 from blakesmith/gotosocial_14_2 
gotosocial 0.14.1 -> 0.14.2
 2024-03-13 08:53:37 +01:00
Janik H.
a97e56ae28
nixos/networkmanager: drop unbound form dns servers 
upstream dropped unbound in 5da17c689b
 2024-03-13 08:31:52 +01:00
éclairevoyant
e7db1f299c
nixos/scrutiny: fix timer not auto-starting 2024-03-12 22:25:54 -04:00
Blake Smith
b0529146b9 nixos/gotosocial: add blakesmith as a maintainer 2024-03-12 21:13:22 -05:00
annalee
8e038835fe
Merge remote-tracking branch 'upstream/master' into staging-next 2024-03-13 00:38:07 +00:00
Rok Garbas
6f11ba9ffe
Merge branch 'master' into amazon-ec2-amis 2024-03-13 00:37:12 +01:00
Jörg Thalheim
721c6579d2
Merge pull request #295407 from Stunkymonkey/nixos-murmur-registerPassword-fix 
nixos/murmur: fix writing registerPassword to config
 2024-03-12 22:47:26 +01:00
Fabián Heredia Montiel
da8768347e
Merge pull request #293950 from DCsunset/nixos-hoogle 
nixos/hoogle: add extraOptions
 2024-03-12 14:57:30 -06:00
Felix Buehler
1e22e7d75e nixos/murmur: fix writing registerPassword to config 2024-03-12 21:19:24 +01:00
Arian van Putten
16526f454f nixos/binfmt: fix race condition between systemd-tmpfiles and systemd-binfmt 
We need to make sure systemd-tmpfiles-setup.service ran before we
start systemd-binft.service. Otherwise it might fail to start
due to non-existant files

Fixes #295365
 2024-03-12 21:08:03 +01:00
github-actions[bot]
6b78f024b2
Merge staging-next into staging 2024-03-12 18:01:46 +00:00
Azat Bahawi
d3e30a442b
nixos/incus: fix systemd service path 
Fixes a regression introduced in #294754.
 2024-03-12 20:03:36 +03:00
Peder Bergebakken Sundt
285d2dcf3c nixos/spotifyd: update configuration documentation url 2024-03-12 16:07:48 +01:00
Sandro
e220724911
Merge pull request #292141 from SuperSandro2000/plasma-out-xserver 2024-03-12 13:55:27 +01:00
K900
21adc4f16a
Merge pull request #295092 from K900/more-heinous-crimes 
nixos/iso-image: extremely cursed performance optimization for Hydra
 2024-03-12 15:45:38 +03:00
K900
77536af43b nixos/iso-image: extremely cursed performance optimization for Hydra 
Right now the worst case chain of events for building an ISO on Hydra is

    - copy everything to squashfs builder
    - run squashfs builder
    - download squashfs from builder
    - compress squashfs
    - upload squashfs to S3
    - copy squashfs to ISO builder
    - run ISO builder
    - download ISO from builder
    - compress ISO
    - upload ISO to S3

This inlines the squashfs build into the ISO build, which makes it

    - copy everything to ISO builder
    - run ISO builder
    - download ISO from builder
    - compress ISO
    - upload ISO to S3

Which should reduce queue runner load by $alot per ISO, which we have four of on small channels
(one release, one test per arch) and a lot more than four of on large channels (with various desktops)
 2024-03-12 15:41:59 +03:00
github-actions[bot]
1cef2a1be7
Merge staging-next into staging 2024-03-12 12:01:40 +00:00
nikstur
da05945c74
Merge pull request #295096 from jmbaur/uki-dtb 
nixos/uki: add ".dtb" section if devicetree is used
 2024-03-12 12:57:15 +01:00
Sandro Jäckel
b07cdeb1b3
nixos/plasma6: move out of x11 
This release focuses on wayland, lets give that justice
 2024-03-12 10:49:42 +01:00
github-actions[bot]
0917422ffe
Merge staging-next into staging 2024-03-12 06:01:24 +00:00
cmspam
701fcd7982 nixos/incus: add openvswitch support 
1. Added openvswitch integration to incus service.
2. Added tests to test openvswitch functionality with incus.
 2024-03-12 01:03:39 +00:00
Jared Baur
2837c0d9aa
nixos/uki: add ".dtb" section if devicetree is used 
This ensures a ".dtb" PE section makes it into the UKI so systemd-stub
can install the correct devicetree for use by the Linux kernel. This is
often needed on systems that boot with u-boot since the devicetree used
by u-boot is often a paired down version of what the Linux kernel needs.
On those kinds of boards, the lack of this PE section means that u-boot
will end up installing its internal devicetree into the UEFI
configuration table, which is what the Linux kernel ends up using.
 2024-03-11 12:42:21 -07:00
github-actions[bot]
06e5eb63d3
Merge staging-next into staging 2024-03-11 18:01:53 +00:00
emilylange
08c37ba899 nixos/lldap: set service UMask=0027 and StateDirectoryMode=0750 
While `/var/lib/lldap` isn't technically accessible by unprivileged
users thanks to `DynamicUser=true`, a user might prefer and change it to
`DynamicUser=false`.

There is currently also a PR open that intends to make `DynamicUser`
configurable via module option.

As such, `jwt_secret_file`, if bootstrapped by the service start
procedure, might be rendered world-readable due to its permissions
(`0644/-rw-r--r--`) defaulting to the service's umask (`022`) and
`/var/lib/lldap` to `0755/drwxr-xr-x` due to `StateDirectoryMode=0755`.

This would usually be fixed by using `(umask 027; openssl ...)` instead
of just `openssl ...`.

However, it was found that another file (`users.db`), this time
bootstrapped by `lldap` itself, also had insufficient permissions
(`0644/-rw-r--r--`) inherited by the global umask and would be left
world-readable as well.

Due to this, we instead change the service's to `027`.

And to lower the impact for already bootstrapped files on existing
instances like `users.db`, set `StateDirectoryMode=0750`.
 2024-03-11 17:34:29 +01:00
emilylange
61a651e362 nixos/lldap: bootstrap jwt_secret if not provided 
If not provided, lldap defaults to `secretjwtsecret` as value which is
hardcoded in the code base.

See https://github.com/lldap/lldap/blob/v0.5.0/server/src/infra/configuration.rs#L76-L77

This is really bad, because it is trivially easy to generate an admin
access token/cookie as attacker, if a `jwt_secret` is known.
 2024-03-11 17:34:29 +01:00
Sandro
869ec01e56
Merge pull request #294286 from SuperSandro2000/unbound-remote-config-check 2024-03-11 16:06:31 +01:00
WilliButz
a2c0efbf5e
Merge pull request #274307 from thillux/esdm-1.0.1 
esdm: update module after 1.0.1 changes
 2024-03-11 15:11:05 +01:00
Markus Theil
36f1c0c2b3 nixos/esdm: simplify module 
ESDM 1.0.1 fixed bugs related to Linux compatibility layer with CUSE.

During these fixes, the compatibility layer was simplified behind a
target in order to start the necessary services together or none of
them (services.esdm.linuxCompatServices).

Furthermore, a small helper was added to ESDM 1.0.1 in order to deal
with resume/suspend/hibernate (FUSE needs to be unblocked).

Removed options are marked.

Signed-off-by: Markus Theil <theil.markus@gmail.com>
 2024-03-11 14:28:26 +01:00
github-actions[bot]
339816cfdf
Merge staging-next into staging 2024-03-11 12:01:42 +00:00
Pierre Allix
cf625fe5f0 nixos/networkmanager: add doc about nm profiles interaction with resolvconf 2024-03-11 12:55:27 +01:00
Sandro
80ec88edec
Merge pull request #292025 from RaHoni/baculaTls 2024-03-11 12:01:19 +01:00
Guanran Wang
a6857b00fe
nixos/mihomo: init 2024-03-11 09:51:36 +08:00
github-actions[bot]
e5f37c0e88
Merge staging-next into staging 2024-03-11 00:02:46 +00:00
Sandro
88c9f04d1a
Merge pull request #294771 from flokli/yubikey-agent-eval 
nixos/yubikey-agent: fix eval error
 2024-03-11 00:15:31 +01:00
Guanran Wang
0a5801395a nixos/clash-verge: add cfg.package 2024-03-10 20:16:41 +01:00
github-actions[bot]
43d40d2ee7
Merge staging-next into staging 2024-03-10 18:01:43 +00:00
Florian Klink
b437b19f54 nixos/yubikey-agent: fix eval error 
This has been refactored in https://github.com/NixOS/nixpkgs/
pull/133542, but this reference wasn't updated.
 2024-03-10 19:08:23 +02:00
Pol Dellaiera
2bd0c18d98
Merge pull request #282160 from gaykitty/stargazer-debug-mode 
nixos/stargazer: add missing debugMode setting
 2024-03-10 14:31:06 +01:00
github-actions[bot]
973ef4b818
Merge staging-next into staging 2024-03-10 06:01:30 +00:00
Peder Bergebakken Sundt
4a4a70ca31
Merge pull request #280836 from numinit/nebula-port-zero 
nixos/nebula: default to port 0 for hosts other than lighthouse/relay
 2024-03-10 05:01:04 +01:00
Will Fancher
f592a7ea77
Merge pull request #293720 from vkleen/fix/systemd-boot-random-seed 
nixos/systemd: Only include systemd-boot-random-seed if the unit exists
 2024-03-09 21:01:35 -05:00
github-actions[bot]
3ce29d4386
Merge staging-next into staging 2024-03-10 00:02:48 +00:00