Commit Graph

233 Commits

Author SHA1 Message Date
figsoda
6bb0dbf91f nixos: fix typos 2022-12-17 19:31:14 -05:00
ajs124
c7930769a7 krb5Full: turn into alias 2022-12-08 23:08:44 +01:00
WORLDofPEACE
de6f2b0a07 nixos/dbus: support dbus-broker 2022-11-22 09:36:22 +08:00
Sandro
8b5dd47fe0
Merge pull request #201647 from jtojnar/nixos-dbus-cleanup 2022-11-21 03:01:58 +01:00
Jan Tojnar
5acdf85467 nixos/dbus: Avoid redundant output specification
- Do not use `daemon`, it has been synonymous to `out` since 783c40eb68
- Do not use explicit `out` output, it has been default since a17216af4c (originally introduced in 2132c86c45)
2022-11-17 19:49:34 +01:00
Jan Tojnar
43f34da079 nixos/dbus: Clean up
- Format the expression with nixpkgs-fmt.
- Remove `with` statement for clarity.
- Remove useless comments.
- Regroup systemd options.
2022-11-17 16:26:14 +01:00
Jan Tojnar
65ddb0ef06 nixos/dbus: Remove socketActivated option removal warning
It has been removed since 21.05:

f292a27f44
2022-11-17 16:14:33 +01:00
Maxime Brunet
29b5192b08
automatic-timezoned: init at 1.0.41 2022-11-16 15:26:21 -08:00
illustris
79cf21151e nixos/cloud-init: fix hostname and resolvconf configuration
- Fix hostname configuration on proxmox, which uses "hostname" in user-data
  instead of "local-hostname" in meta-data.
- Allow setting resolv.conf through cloud-init
- Add tests for new changes
- Add timeouts to make tests fail faster
2022-10-27 08:07:48 +02:00
Florian Klink
aee40c2d8a nixos/nscd: add enableNsncd option
When set, this switches from using nscd to using nsncd.

It's a protocol-compatible, non-caching and much less flaky alternative.
2022-10-21 09:37:18 +02:00
Florian Klink
7987b41d44 nixos/nscd: nixpkgs-fmt 2022-10-20 13:15:16 +02:00
Jean-François Roche
dc529302fe
nixos: add cachix watch-store service
Self hosted CI push built packages asynchronously to cachix using a service.

Based on @Mic92 [code](https://github.com/cachix/cachix/issues/370#issuecomment-817081937)
2022-10-17 18:24:03 +02:00
John Soo
026e83a4a8
nixos/self-deploy: add gzip to path
The service fails without it.
2022-09-13 16:43:00 -07:00
Domen Kožar
2f22b267c5
Merge pull request #190959 from pennae/cachix-host-type
nixos/cachix-agent: fix type for host option
2022-09-13 10:08:00 +01:00
pennae
070b3966fc
nixos/cachix-agent: fix type for host option 2022-09-12 20:47:05 +02:00
John Soo
f0f4ad0cb0
nixos/self-deploy: add tar to path.
Previously it was missing, and the service would fail.
2022-09-12 09:08:43 -07:00
Domen Kožar
fbc23b491a cachix-agent: add host option 2022-09-11 21:18:09 +01:00
Domen Kožar
3f7ba12868 cachix-agent: fix a typo 2022-09-11 16:10:21 +01:00
pennae
9547123258 nixos/*: convert internal option descriptions to MD
we'll have to do it eventually, may as well be now.
2022-08-31 16:32:54 +02:00
pennae
ef176dcf7e nixos/*: automatically convert option descriptions
conversions were done using https://github.com/pennae/nix-doc-munge
using (probably) rev f34e145 running

    nix-doc-munge nixos/**/*.nix
    nix-doc-munge --import nixos/**/*.nix

the tool ensures that only changes that could affect the generated
manual *but don't* are committed, other changes require manual review
and are discarded.
2022-08-31 16:32:53 +02:00
pennae
1013069f52 nixos/*: convert more partially-md option descriptions
this mostly means marking options that use markdown already
appropriately and making a few adjustments so they still render
correctly. notable for nftables we have to transform the md links
because the manpage would not render them correctly otherwise.
2022-08-31 16:32:14 +02:00
pennae
7e7d68a250 nixos/*: mark pre-existing markdown descriptions as mdDoc 2022-08-19 22:40:58 +02:00
Lassulus
8471526587
Merge pull request #186785 from helsinki-systems/feat/nss-lookup-nscd 2022-08-16 20:45:45 +02:00
Maximilian Bosch
9e8ea1b855
Merge pull request #183717 from NetaliDev/mysql-auth
nixos: add mysql/mariadb user authentication module
2022-08-16 20:30:16 +02:00
Janne Heß
8cef7eec93
nixos/nscd: Add requiredBy for the nss targets
This is to ensure the targets are stopped when nscd is stopped to
prevent races on switch. Example interaction: nscd is stopped, some
service that requires nss-user-lookup.target is restarted. Without this
PR, nss-user-lookup.target would still be active, hence the service
would start without nscd running.
2022-08-15 13:18:03 +02:00
Bernardo Meurer
5975411744
nixos/localtimed: fix service 2022-08-12 22:46:16 -04:00
pennae
087472b1e5 nixos/*: automatically convert option docs 2022-08-06 20:39:12 +02:00
Netali
f23a1e6a54
nixos: add mysql/mariadb user authentication 2022-08-06 19:39:23 +02:00
Netali
7a6c3cf4ae
nixos/nscd: use a static user instead of systemd DynamicUser 2022-08-06 19:39:22 +02:00
pennae
61e93df189 nixos/*: automatically convert option docs to MD
once again using nix-doc-munge (69d080323a)
2022-08-03 22:46:41 +02:00
pennae
9c8531c8a5 nixos/*: replace <replaceable>s with «thing»
we can't embed syntactic annotations of this kind in markdown code
blocks without yet another extension. replaceable is rare enough to make
this not much worth it, so we'll go with «thing» instead. the module
system already uses this format for its placeholder names in attrsOf
paths.
2022-08-03 21:08:58 +02:00
pennae
2e751c0772 treewide: automatically md-convert option descriptions
the conversion procedure is simple:

 - find all things that look like options, ie calls to either `mkOption`
   or `lib.mkOption` that take an attrset. remember the attrset as the
   option
 - for all options, find a `description` attribute who's value is not a
   call to `mdDoc` or `lib.mdDoc`
 - textually convert the entire value of the attribute to MD with a few
   simple regexes (the set from mdize-module.sh)
 - if the change produced a change in the manual output, discard
 - if the change kept the manual unchanged, add some text to the
   description to make sure we've actually found an option. if the
   manual changes this time, keep the converted description

this procedure converts 80% of nixos options to markdown. around 2000
options remain to be inspected, but most of those fail the "does not
change the manual output check": currently the MD conversion process
does not faithfully convert docbook tags like <code> and <package>, so
any option using such tags will not be converted at all.
2022-07-30 15:16:34 +02:00
Domen Kožar
c46a3dc50a cachix-agent: allow restarts now that deployments are subprocesses 2022-07-13 11:40:54 -05:00
Domen Kožar
989565d676 cachix-agent: expose verbose option 2022-06-30 09:56:28 -05:00
Domen Kožar
c7b135ac8e cachix-agent: properly handle not restarting the service 2022-06-29 17:17:35 -05:00
Domen Kožar
f38fd46992 cachix-agent: set USER to please cachix 2022-06-09 17:07:28 +01:00
Alyssa Ross
c0b05f106f
nixos/localtime: add missing mkRenamedOptionModule
Fixes: ffae8569b0 ("nixos/localtimed: hopefully fix geoclue")
2022-06-08 13:46:26 +00:00
Bernardo Meurer
ffae8569b0 nixos/localtimed: hopefully fix geoclue 2022-06-01 13:20:16 -07:00
Jan Tojnar
6b738bce80 nixos/nscd: Fix lib.literalExample deprecation
The NixOS evaluation would complain:

trace: warning: literalExample is deprecated, use literalExpression instead, or use literalDocBook for a non-Nix description.
2022-04-26 14:06:52 +02:00
Martin Weinelt
df6fa84709 nixos/nscd: fix manual build 2022-04-18 23:50:46 +10:00
Milan Pässler
517c17420f nixos/nscd: add package option 2022-04-16 14:47:47 -04:00
Naïm Favier
a8296e7537
nixos/earlyoom: bring the module up to date (#163663)
* nixos/earlyoom: bring the module up to date

Removes deprecated option `ignoreOOMScoreAdjust`, introduces `killHook`
as a replacement for `notificationsCommand`, and adds an `extraArgs`
option for things not covered by the module.

* nixos/earlyoom: add nixos test

* nixos/earlyoom: add reportInterval

Allows setting the interval for logging a memory report. Defaults to
3600 following upstream
     (https://github.com/rfjakob/earlyoom/blob/master/earlyoom.default#L5)
to avoid flooding logs.

* nixos/earlyoom: add free{Mem,Swap}KillThreshold

Fixes https://github.com/NixOS/nixpkgs/issues/83504
2022-03-24 15:34:09 +08:00
Peter Hoeg
895090bf89 nixos/earlyoom: use the newly introduced systembus-notify option
Also some cleanups.
2022-03-13 20:21:21 +08:00
Peter Hoeg
27e32bbfde nixos/systembus-notify: add support for system services notifying users 2022-03-13 20:21:21 +08:00
Naïm Favier
2e46cc1f00 nixos/earlyoom: remove useKernelOOMKiller
This option is deprecated and ignored by earlyoom since 1.2.
2022-03-04 13:04:24 +00:00
Xe Iaso
1a417bc1dd nixos/cloud-init: fix trivial error that prevents deploy 2022-02-08 08:15:27 -05:00
Sandro
255417b8f4
Merge pull request #157146 from illustris/cloudinit 2022-02-07 01:27:21 +01:00
William Carroll
e8ff81edb7 nixos/self-deploy: make systemd dependency conditional
As recommended in the discussion at #157883
2022-02-04 10:59:24 +01:00
William Carroll
b830507425 nixos/self-deploy: consume self-deploy's startAt attribute
As #157879 points-out, this attribute appears unused.

Fixes #157879
2022-02-03 12:19:47 +01:00
illustris
43cfb7204b nixos/cloud-init: add support for network configuration 2022-01-31 09:50:23 +05:30
Domen Kožar
91cc0cf63b
Update nixos/modules/services/system/cachix-agent/default.nix
Co-authored-by: pennae <82953136+pennae@users.noreply.github.com>
2022-01-18 16:49:18 +01:00
Domen Kožar
42994be64b nixos: add cachix-agent service 2022-01-18 10:26:47 +01:00
Nikolay Amiantov
b451eca621 nscd service: fix ordering and start automatically
During working on #150837 I discovered that `google-oslogin` test
started failing, and so did some of my development machines. Turns out
it was because nscd doesn't start by default; rather it's wanted by
NSS lookup targets, which are not always fired up.

To quote from section on systemd.special(7) on `nss-user-lookup.target`:

> All services which provide parts of the user/group database should be
> ordered before this target, and pull it in.

Following this advice and comparing our unit to official `sssd.service`
unit (which is a similar service), we now pull NSS lookup targets from
the service, while starting it with `multi-user.target`.
2022-01-10 22:45:12 +03:00
Sandro
947fb3818f
Merge pull request #140604 from obadz/earlyoom-stderr 2021-10-05 17:16:59 +02:00
obadz
b4981eb8e1 earlyoom module: log stderr to journald
(Default is to do the same as stdout which is > /dev/null)
2021-10-05 12:03:24 +01:00
Naïm Favier
2ddc335e6f
nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
Vladimír Čunát
8be5516756
Merge #138918: Fix several NixOS errors in Hydra evaluation
In particular, this should unblock the trunk-combined jobset.
2021-09-22 17:28:37 +02:00
rnhmjoj
88b3c29cf1
nixos: heimdalFull -> heimdal
The package has been renamed in 2018-05-01.
2021-09-22 11:20:30 +02:00
Dominik Schrempf
fade6648c7
nixos/localtimed: nogroup fix 2021-09-20 22:16:09 +02:00
Artturin
bd8eeec9c0 {uptimed,nixos/uptimed}: switch to /var/lib/ and fix perms 2021-07-31 01:05:44 +03:00
Ashlynn Anderson
47db174a3c
nixos/self-deploy: make nixAttribute nullable (#125617)
Allows using a nix file that directly provides the derivation
2021-06-07 12:44:13 -07:00
Ashlynn Anderson
903665f31c
nixos/self-deploy: init (#120940)
Add `self-deploy` service to facilitate continuous deployment of NixOS
configuration from a git repository.
2021-05-18 08:29:37 -07:00
ajs124
c6d4dae35d treewide: fix eval without aliases after 9378fdf87e 2021-04-08 13:33:09 +02:00
V
0268691925 nixos/localtime: make localtimed a system user
Currently, a user is created in the 1000-29999 range. This is incorrect,
as localtimed is a system service and not a user.
2021-02-11 22:36:37 +01:00
volth
bc0d605cf1 treewide: fix double quoted strings in meta.description
Signed-off-by: Ben Siraphob <bensiraphob@gmail.com>
2021-01-24 19:56:59 +07:00
Graham Christensen
bc49a0815a
utillinux: rename to util-linux 2020-11-24 12:42:06 -05:00
Janne Heß
e5e9887e38
nixos/dbus: Add AppArmor support 2020-11-18 10:10:36 +01:00
Robert Helgesson
94819fdb5f
nixos/dbus: re-add a dummy socketActivated option
If set, then issue a warning instead of an error as previously.
2020-10-24 23:01:00 +02:00
Robert Helgesson
f292a27f44
nixos/dbus: always use socket activates user session
This removes the `services.dbus.socketActivated` and
`services.xserver.startDbusSession` options. Instead the user D-Bus
session is always socket activated.
2020-09-13 11:17:16 +02:00
Florian Klink
962e15aebc nixos: remove StandardOutput=syslog, StandardError=syslog lines
Since systemd 243, docs were already steering users towards using
`journal`:

eedaf7f322

systemd 246 will go one step further, it shows warnings for these units
during bootup, and will [automatically convert these occurences to
`journal`](f3dc6af20f):

> [    6.955976] systemd[1]: /nix/store/hwyfgbwg804vmr92fxc1vkmqfq2k9s17-unit-display-manager.service/display-manager.service:27: Standard output type syslog is obsolete, automatically updating to journal. Please update│······················
 your unit file, and consider removing the setting altogether.

So there's no point of keeping `syslog` here, and it's probably a better
idea to just not set it, due to:

> This setting defaults to the value set with DefaultStandardOutput= in
> systemd-system.conf(5), which defaults to journal.
2020-08-13 18:49:15 +02:00
Jörg Thalheim
073d2fc4d5
cgmanager: remove
fixes #30023
2020-06-05 09:47:12 +01:00
Florian Klink
09244cbd98 nixos/nscd: set positive hosts caching ttl to 0
This effectively disables nscd's built-in hosts cache, which turns out
to be erratic in some cases.

We only use nscd these days as a more ABI-neutral NSS dispatcher
mechanism.

Local caching should still be possible with local resolvers in
/etc/resolv.conf (via the `dns` NSS module), or without local resolvers
via systemd-networkd (via the `resolve` nss module)

We don't set enable-cache to no due to
https://github.com/NixOS/nixpkgs/pull/50316#discussion_r241035226.
2020-06-01 01:12:43 +02:00
oxalica
fe3e52c291
earlyoom: patch absolute dbus path and make nixos module up to date (#88443)
* earlyoom: patch absolute path of dbus-send

* nixos/earlyoom: replace `notificationsCommand` with `enableNotification`

* nixos/earlyoom: setup `systembus-notify` when `enableNotification`
2020-05-25 10:13:55 -05:00
Florian Klink
2ececf1ed9 nixos/nscd: be more specific in the nscd.enable description on what breaks 2020-04-25 18:11:10 +02:00
Frederik Rietdijk
23be4a8b4d Merge master into staging-next 2020-04-21 19:59:56 +02:00
Dominik Xaver Hörl
0412bde942 treewide: add bool type to enable options, or make use of mkEnableOption
Add missing type information to manually specified enable options or replace them by mkEnableOption where appropriate.
2020-04-21 08:55:36 +02:00
Matthew Bauer
7cc40e15e4 treewide/nixos: use stdenv.cc.libc instead of glibc when available
This prevents duplication in cross-compiled nixos machines. The
bootstrapped glibc differs from the natively compiled one, so we get
two glibc’s in the closure. To reduce closure size, just use
stdenv.cc.libc where available.
2020-04-06 16:36:27 -04:00
rnhmjoj
1d61efb7f1 treewide: use attrs instead of list for types.loaOf options 2020-01-06 10:39:18 -05:00
Vladimír Čunát
f21211ebfe
Merge branch 'master' into staging 2019-09-02 23:25:24 +02:00
Florian Klink
f74735c9d7 nixos: remove dependencies on local-fs.target
Since https://github.com/NixOS/nixpkgs/pull/61321, local-fs.target is
part of sysinit.target again, meaning units without
DefaultDependencies=no will automatically depend on it, and the manual
set dependencies can be dropped.
2019-09-01 19:06:38 +02:00
worldofpeace
2f7d0993b7
Merge pull request #67363 from worldofpeace/dbus-datadir
dbus: don't make datadir /etc, set runstatedir to /run
2019-08-29 19:46:51 -04:00
volth
35d68ef143 treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
worldofpeace
53a7d67344 nixos/doc: document share/dbus-1/*.d 2019-08-24 15:07:44 -04:00
Jamey Sharp
d79584c902 nixos/nscd: document why it is configured this way 2019-07-12 12:07:45 -07:00
Jamey Sharp
f7c776760b nixos/nscd: only drop privs after nss module init
NixOS usually needs nscd just to have a single place where
LD_LIBRARY_PATH can be set to include all NSS modules, but nscd is also
useful if some of the NSS modules need to read files which are only
accessible by root.

For example, nixos/modules/config/ldap.nix needs this when
  users.ldap.enable = true;
  users.ldap.daemon.enable = false;
and users.ldap.bind.passwordFile exists. In that case, the module
creates an /etc/ldap.conf which is only readable by root, but which the
NSS module needs to read in order to find out what LDAP server to
connect to and with what credentials.

If nscd is started as root and configured with the server-user option in
nscd.conf, then it gives each NSS module the opportunity to initialize
itself before dropping privileges. The initialization happens in the
glibc-internal __nss_disable_nscd function, which pre-loads all the
configured NSS modules for passwd, group, hosts, and services (but not
netgroup for some reason?) and, for each loaded module, calls an init
function if one is defined. After that finishes, nscd's main() calls
nscd_init() which ends by calling finish_drop_privileges().

There are provisions in systemd for using DynamicUser with a service
which needs to drop privileges itself, so this patch does that.
2019-07-07 08:43:41 -07:00
Jamey Sharp
c38fa99757 nixos/nscd: don't need to specify username
Thanks to @arianvp for pointing out that when DynamicUser is true,
systemd defaults the value of User to be the name of the unit, which in
this case is already "nscd".
2019-07-06 09:24:49 -07:00
Jamey Sharp
4c64375e91 nixos/nscd: delete redundant nscd.conf options
These options were being set to the same value as the defaults that are
hardcoded in nscd. Delete them so it's clear which settings are actually
important for NixOS.

One exception is `threads 1`, which is different from the built-in
default of 4. However, both values are equivalent because nscd forces
the number of threads to be at least as many as the number of kinds of
databases it supports, which is 5.
2019-07-03 15:34:44 -07:00
Jamey Sharp
de251704d6 nixos/nscd: run with a dynamic user
nscd doesn't create any files outside of /run/nscd unless the nscd.conf
"persistent" option is used, which we don't do by default. Therefore it
doesn't matter what UID/GID we run this service as, so long as it isn't
shared with any other running processes.

/run/nscd does need to be owned by the same UID that the service is
running as, but systemd takes care of that for us thanks to the
RuntimeDirectory directive.

If someone wants to turn on the "persistent" option, they need to
manually configure users.users.nscd and systemd.tmpfiles.rules so that
/var/db/nscd is owned by the same user that nscd runs as.

In an all-defaults boot.isContainer configuration of NixOS, this removes
the only user which did not have a pre-assigned UID.
2019-07-03 13:27:29 -07:00
Jamey Sharp
597563d248 nixos/nscd: let systemd manage directories
Previously this module created both /var/db/nscd and /run/nscd using
shell commands in a preStart script. Note that both of these paths are
hard-coded in the nscd source. (Well, the latter is actually
/var/run/nscd but /var/run is a symlink to /run so it works out the
same.)

/var/db/nscd is only used if the nscd.conf "persistent" option is turned
on for one or more databases, which it is not in our default config
file. I'm not even sure persistent mode can work under systemd, since
`nscd --shutdown` is not synchronous so systemd will always
unceremoniously kill nscd without reliably giving it time to mark the
databases as unused. Nonetheless, if someone wants to use that option,
they can ensure the directory exists using systemd.tmpfiles.rules.

systemd can create /run/nscd for us with the RuntimeDirectory directive,
with the added benefit of causing systemd to delete the directory on
service stop or restart. The default value of RuntimeDirectoryMode is
755, the same as the mode which this module was using before.

I don't think the `rm -f /run/nscd/nscd.pid` was necessary after NixOS
switched to systemd and used its PIDFile directive, because systemd
deletes the specified file after the service stops, and because the file
can't persist across reboots since /run is a tmpfs. Even if the file
still exists when nscd starts, it's only a problem if the pid it
contains has been reused by another process, which is unlikely. Anyway,
this change makes that deletion even less necessary, because now systemd
deletes the entire /run/nscd directory when the service stops.
2019-07-03 12:39:48 -07:00
Jamey Sharp
93f185df65 nixos/nscd: no longer need to wait for readiness
This postStart step was introduced on 2014-04-24 with the comment that
"Nscd forks into the background before it's ready to accept
connections."

However, that was fixed upstream almost two months earlier, on
2014-03-03, with the comment that "This, along with setting the nscd
service type to forking in its systemd configuration file, allows
systemd to be certain that the nscd service is ready and is accepting
connections."

The fix was released several months later in glibc 2.20, which was
merged in NixOS sometime before 15.09, so it certainly should be safe to
remove this workaround by now.
2019-07-03 12:26:47 -07:00
worldofpeace
d672ceeb68
Merge pull request #63204 from michaelpj/imp/localtime-upstream
localtime: use upstream unit, fix polkit rules
2019-06-19 08:38:03 -04:00
Michael Peyton Jones
0073c1fb0b
localtime: use upstream unit and fix polkit rule installation
Also don't allocate a user - the upstream unit uses DynamicUser.
2019-06-19 11:07:44 +01:00
volth
f3282c8d1e treewide: remove unused variables (#63177)
* treewide: remove unused variables

* making ofborg happy
2019-06-16 19:59:05 +00:00
Michael Peyton Jones
d3a4a5bd95
localtime: set geoclue config
The geoclue module now lets us set application config. This should make
it more robust in environments that don't provide a geoclue agent.

Fixes #44725.
2019-06-03 18:12:33 +01:00
Lassulus
9cda3faecd
Merge pull request #53444 from wedens/earlyoom-notifications
nixos/earlyoom: add notificationsCommand option
2019-04-27 21:34:37 +09:00
wedens
5798d12842 nixos/earlyoom: add notificationsCommand option
Add option for specifying command that will be used for sending notifications.
See https://github.com/rfjakob/earlyoom#notifications for details.
2019-01-08 22:14:48 +07:00
Jan Tojnar
aead6e12f9
Merge remote-tracking branch 'upstream/master' into staging 2018-12-16 22:55:06 +01:00
Arian van Putten
1d5f4cbb78 nixos/nscd: Add a descriptive comment to the nscd configuration 2018-12-12 15:35:46 +01:00
Arian van Putten
a74619c1ae nixos/nscd: also add netgroup to the config
It was the last database that wasn't listed.
2018-12-12 15:35:40 +01:00
Arian van Putten
de76c16f9c nixos/nscd: Merge nscd and sssd-nscd config 2018-12-12 15:35:40 +01:00