Commit Graph

79 Commits

Author SHA1 Message Date
Joachim Fasting
0677cc61c8
nixos: rewrite the grsecurity module
The new module is specifically adapted to the NixOS Grsecurity/PaX
kernel.  The module declares the required kernel configurations and
so *should* be somewhat compatible with custom Grsecurity kernels.

The module exposes only a limited number of options, minimising the need
for user intervention beyond enabling the module. For experts,
Grsecurity/PaX behavior may be configured via `boot.kernelParams` and
`boot.kernel.sysctl`.

The module assumes the user knows what she's doing (esp. if she decides
to modify configuration values not directly exposed by the module).

Administration of Grsecurity's role based access control system is yet
to be implemented.
2016-06-14 03:38:12 +02:00
Eelco Dolstra
32bed83b18 Remove boot.loader.grub.timeout and boot.loader.gummiboot.timeout
There is a generic boot.loader.timeout option.
2016-05-25 11:39:17 +02:00
Peter Simons
d270604117 nixos: remove redundant services.dovecot2.package option
Instead of using this option, please modify the dovecot package by means of an
override. For example:

  nixpkgs.config.packageOverrides = super: {
    dovecot = super.dovecot.override { withPgSQL = true; };
  };

Closes https://github.com/NixOS/nixpkgs/issues/14097.
2016-05-06 10:10:06 +02:00
Eric Sagnes
a8bc5b67f8 php: add default php.ini 2016-04-29 15:26:20 +09:00
Vladimír Čunát
7cf8daa2bb nixos: rename chroot* to sandbox*
On Nix side this was done months ago:
https://github.com/NixOS/nix/pull/682
2016-04-25 11:04:08 +02:00
Joachim Fasting
cba5ccb67b nixos: fix incorrect rename for input-methods options
Hotfix for e6ae05dd8a
2016-04-13 02:32:53 +02:00
Eric Sagnes
e6ae05dd8a input-method module: fix folder case 2016-04-12 19:50:26 +09:00
Mitchell Pleune
879778091a iodine service: add clients implimentation
- services.iodined moved to services.iodine
- configuration file backwards compatable
- old iodine server configuration moved to services.iodine.server
- attribute set services.iodine.clients added to specify any number
  of iodine clients
  - example:
    iodine.clients.home = { server = "iodinesubdomain.yourserver.com"; ... };
  - client services names iodine-name where name would be home
2016-03-26 21:16:29 -04:00
Peter Simons
5391882ebd services.xserver.startGnuPGAgent: remove obsolete NixOS option
GnuPG 2.1.x changed the way the gpg-agent works, and that new approach no
longer requires (or even supports) the "start everything as a child of the
agent" scheme we've implemented in NixOS for older versions.

To configure the gpg-agent for your X session, add the following code to
~/.xsession or some other appropriate place that's sourced at start-up:

    gpg-connect-agent /bye
    GPG_TTY=$(tty)
    export GPG_TTY

If you want to use gpg-agent for SSH, too, also add the settings

    unset SSH_AGENT_PID
    export SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh"

and make sure that

    enable-ssh-support

is included in your ~/.gnupg/gpg-agent.conf.

The gpg-agent(1) man page has more details about this subject, i.e. in the
"EXAMPLES" section.
2016-03-18 11:06:31 +01:00
Nikolay Amiantov
e358d9498c e19: rename to enlightenment, drop old one 2016-03-12 03:10:37 +03:00
Franz Pletz
bcfa59bf82 gitlab: 8.0.5 -> 8.5.0, service improvements
Updates gitlab to the current stable version and fixes a lot of features that
were broken, at least with the current version and our configuration.

Quite a lot of sweat and tears has gone into testing nearly all features and
reading/patching the Gitlab source as we're about to deploy gitlab for our
whole company.

Things to note:

 * The gitlab config is now written as a nix attribute set and will be
   converted to JSON. Gitlab uses YAML but JSON is a subset of YAML.
   The `extraConfig` opition is also an attribute set that will be merged
   with the default config. This way *all* Gitlab options are supported.

 * Some paths like uploads and configs are hardcoded in rails  (at least
   after my study of the Gitlab source). This is why they are linked from
   the Gitlab root to /run/gitlab and then linked to the  configurable
   `statePath`.

 * Backup & restore should work out of the box from another Gitlab instance.

 * gitlab-git-http-server has been replaced by gitlab-workhorse upstream.
   Push & pull over HTTPS works perfectly. Communication to gitlab is done
   over unix sockets. An HTTP server is required to proxy requests to
   gitlab-workhorse over another unix socket at
   `/run/gitlab/gitlab-workhorse.socket`.

 * The user & group running gitlab are now configurable. These can even be
   changed for live instances.

 * The initial email address & password of the root user can be configured.

Fixes #8598.
2016-02-26 07:08:31 +01:00
Eric Sagnes
3ad12f2dec inputMethod service: init 2016-02-19 08:52:18 +09:00
Eric Sagnes
52dd53373f ibus service: refactoring 2016-02-17 20:44:29 +09:00
Nikolay Amiantov
b52acfdf01 nixos xserver: remove vaapiDrivers
Use hardware.opengl.extraPackages instead.
2016-01-26 13:42:40 +03:00
Nikolay Amiantov
c311901810 cupsd service: don't allow overriding necessary configuration options 2016-01-17 15:50:40 +03:00
Domen Kožar
8525936f80 nixos: Document "jobs" option removal 2016-01-14 13:08:56 +01:00
Peter Simons
d807b057ed Merge pull request #11920 from bjornfor/rename-host-to-listen-address
Rename NixOS option names: 'host' to 'listenAddress'
2016-01-05 12:54:15 +01:00
Jakob Gillich
ae4a7f9351 hostapd: rename extraCfg -> extraConfig, added asserts 2015-12-26 11:37:00 +01:00
Bjørn Forsman
c7c3c95d92 nixos/kibana: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:28:27 +01:00
Bjørn Forsman
7334ecd41a nixos/elasticsearch: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:28:09 +01:00
Bjørn Forsman
46924e77a2 nixos/sslh: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:23:51 +01:00
Bjørn Forsman
6c2fc3a5ac nixos/shout: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:22:47 +01:00
Bjørn Forsman
19aed49163 nixos/statsd: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:20:56 +01:00
Bjørn Forsman
8b9f3c8c35 nixos/graphite: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:20:39 +01:00
Bjørn Forsman
38ca880612 nixos/cadvisor: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:14:40 +01:00
Bjørn Forsman
6b10df7eaa nixos/subsonic: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:13:15 +01:00
Bjørn Forsman
e0b0b9723c nixos/docker-registry: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:06:40 +01:00
Bjørn Forsman
79367816a9 nixos/mpd: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:04:04 +01:00
Bjørn Forsman
873a9202f6 nixos/neo4j: rename 'host' to 'listenAddress'
More descriptive option name.
2015-12-24 00:01:02 +01:00
Eelco Dolstra
5f077e2296 Factor out option renaming
Option aliases/deprecations can now be declared in any NixOS module,
not just in nixos/modules/rename.nix. This is more modular (since it
allows for example grub-related aliases to be declared in the grub
module), and allows aliases outside of NixOS (e.g. in NixOps modules).

The syntax is a bit funky. Ideally we'd have something like:

  options = {
    foo.bar.newOption = mkOption { ... };
    foo.bar.oldOption = mkAliasOption [ "foo" "bar" "newOption" ];
  };

but that's not possible because options cannot define values in
*other* options - you need to have a "config" for that. So instead we
have functions that return a *module*: mkRemovedOptionModule,
mkRenamedOptionModule and mkAliasOptionModule. These can be used via
"imports", e.g.

  imports = [
    (mkAliasOptionModule [ "foo" "bar" "oldOption" ] [ "foo" "bar" "newOption" ]);
  ];

As an added bonus, deprecation warnings now show the file name of the
offending module.

Fixes #10385.
2015-10-14 18:18:47 +02:00
Peter Simons
7690891ea4 nixos: give users of 'services.openvpn.enable' a nice warning message 2015-09-10 11:38:43 +02:00
Eelco Dolstra
14321ae243 Rename users.extraUsers -> users.users, users.extraGroup -> users.groups
The "extra" part hasn't made sense for years.
2015-09-02 17:34:23 +02:00
Eelco Dolstra
287c08d8a3 Rename services.openssh.knownHosts -> programs.ssh.knownHosts
This option configures the SSH client, not the server.
2015-08-27 15:32:46 +02:00
Jan Malakhovski
2a9dbf36b3 nixos: make services.smartd much more helpful
Now it generates notifications for auto-detected devices as well as
for explicitly configured ones, sends well formed e-mails and supports
immediate `wall` and `xmessage` notifications.
2015-08-16 22:36:13 +00:00
aszlig
6440e9bbfd
nixos/vbox: Move all options to virtualisation.*.
Commit 687caeb renamed services.virtualboxHost to programs.virtualbox,
but according to the discussion on the commit, it's probably a better to
put it into virtualisation.virtualbox instead.

The discussion can be found here:

https://github.com/NixOS/nixpkgs/commit/687caeb#commitcomment-12664978

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-08-13 12:28:24 +02:00
Eelco Dolstra
687caebfcb Rename services.virtualboxHost -> programs.virtualbox
VirtualBox is an application, not a system service.
2015-08-12 14:12:21 +02:00
James Cook
a456168e5b Merge pull request #6702 from joachifm/dnscrypt-proxy
nixos: some improvements for dnscrypt-proxy
2015-07-12 00:17:46 -07:00
Eelco Dolstra
96b325b0b7 Remove option ec2.metadata 2015-06-30 17:25:56 +02:00
Joachim Fasting
ffc6275e55 dnscrypt-proxy service: support custom providers
The primary use-case is private DNSCrypt providers.

Also rename the `port` option to differentiate it from the
`customResolver.port` option.
2015-06-12 15:12:33 +02:00
Eelco Dolstra
d923a6eab5 Make environment.checkConfigurationOptions an alias
NixOps uses it, and we can't change it there for
backward-compatibility reasons.
2015-04-10 16:11:07 +02:00
Nicolas B. Pierron
6de931a0f8 Merge rename.nix changes. 2015-04-03 23:12:12 +02:00
Edward Tjörnhammar
1345a65765 Remove XBMC expressions in favor of the Kodi ones 2015-03-30 21:43:32 +02:00
Nicolas B. Pierron
05e8a48fb4 Document and rename internal option of modules. 2015-03-15 14:45:42 +01:00
Shea Levy
e3eff53037 evalModules: Add internal option for the check argument 2015-03-12 23:42:57 +01:00
Joachim Fasting
1bdd12ed69 nixos: refactor tarsnap backup service module
Major changes
- Port to systemd timers: for each archive configuration is created a
  tarsnap@archive-name.timer which triggers the instanced service unit
- Rename the `config` option to `archives`

Minor/superficial improvements
- Restrict tarsnap service capabilities
- Use dirOf builtin
- Set executable bit for owner of tarsnap cache directory
- Set IOSchedulingClass to idle
- Humanize numbers when printing stats
- Rewrite most option descriptions
- Simplify assertion
2015-03-10 12:35:58 +01:00
aszlig
127c928c23
nixos/rename: Fix merging multiple destinations.
The renaming of options define the original value for the new attribute
path. This works well if there is only *one* target, but if there are
more, we end up recursing into the attribute set of the option
definition itself.

We now check for that within the parent recursion node (we can't check
that from the subnode, because we lack that information about whether
it's defined multiple times) and if the subnode consist entirely of a
list of definitions, we use mkMerge on it.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-01-22 14:08:28 +01:00
Nicolas B. Pierron
d7f29acd48 modules: Extract mkAliasDefinition from the rename.nix NixOS module. 2014-12-22 22:38:38 +01:00
Thomas Tuegel
1df1305a8a Rewrite Fontconfig NixOS module
Details:
* The option `fonts.enableFontConfig` has (finally) been renamed
  `fonts.fontconfig.enable`.
* Configurations are loaded in this order: first the Fontconfig-upstream
  configuration is loaded, then the NixOS-specific font directories are
  set, the system-wide default configuration is loaded, and finally the
  user configuration is loaded (if enabled).
* The NixOS options `fonts.fontconfig.defaultFonts.monospace`,
  `fonts.fontconfig.defaultFonts.sansSerif` and
  `fonts.fontconfig.defaultFonts.serif` are added to allow setting the
  default system-wide font used for these generic faces. The defaults
  are the appropriate faces from the DejaVu collection because of their
  comprehensive Unicode coverage, clean rendering, and excellent
  legibility.
* The NixOS option `fonts.fontconfig.antialias` can be used to disable
  antialiasing (it is enabled by default).
* The options `fonts.fontconfig.subpixel.rgba` and
  `fonts.fontconfig.subpixel.lcdfilter` control the system-wide default
  settings for subpixel order and LCD filtering algorithm,
  respectively.
* `fonts.fontconfig.hinting.enable` can be used to disable TrueType font
  hinting (it is enabled by default).
  `fonts.fontconfig.hinting.autohint` controls the FreeType autohinter.
  `fonts.fontconfig.hinting.style` controls the hint style; it is "full"
  by default.
* User configurations can be disabled system-wide by setting
  `fonts.fontconfig.includeUserConf = false`. They are enabled by
  default so users can set Fontconfig options in the desktop environment
  of their choice.
2014-12-08 10:55:23 -06:00
Antoine R. Dumont
3c7e779602 Introduce a dedicated networking.proxy option
Following the discussion NixOS#5021:
- obsolete the nix.proxy option
- add the networking.proxy option
- open a default no_proxy environment variable
- add a rsync option
- Manual tests ok.
- Automatic tests ok.

Amended by lethalman to simplify the option descriptions.
2014-11-30 15:19:25 +01:00
aszlig
444987193e
nixos: Rename virtualbox to virtualboxGuest.
Especially new users could be confused by this, so we're now marking
services.virtualbox.enable as obsolete and defaulting to
services.virtualboxGuest.enable instead. I believe this now makes it
clear, that this option is for guest additions only.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-27 18:42:22 +01:00