Since 816614bd62, the service is set to use the exim user so that
systemd takes care of the credentials ownership. The executable is
still required to run as root, to then drop privileges. The prefix '+'
that was used however interfers with the use of privilege restrictions
and other sandboxing options. Since we only want to escape the "User"
setting, we can use the '!' prefix instead.
When using Roundcube with a non local PostgreSQL database wait for
network start before running roundcube-setup.service
Otherwise the database is not reachable and the service fails.
Extract PostgreSQL database password for Roundcube from .pgpass file.
The password file is used in two locations:
1. in the Roundcube config.php
2. in the systemd setup service that initializes the roundcube
database
These two services need the password in different formats.
Keep the password file in PostgreSQL standard format and extract the
password for the Roundcube config (see #215986).
In the previous state, postfix would still try to use IPv6 addresses,
even when it is disabled in the global networking config.
Cf. https://www.postfix.org/postconf.5.html:
With Postfix 2.8 and earlier the default is "ipv4". For backwards compatibility with these releases,
the Postfix 2.9 and later upgrade procedure appends an explicit "inet_protocols = ipv4" setting to
main.cf when no explicit setting is present.
This compatibility workaround will be phased out as IPv6 deployment becomes more common.
inet_protocols = ipv4
inet_protocols = all (DEFAULT)
inet_protocols = ipv6
inet_protocols = ipv4, ipv6
So setting it to 'all' conditionally does not help, as we are now on version 3.x.
this converts meta.doc into an md pointer, not an xml pointer. since we
no longer need xml for manual chapters we can also remove support for
manual chapters from md-to-db.sh
since pandoc converts smart quotes to docbook quote elements and our
nixos-render-docs does not we lose this distinction in the rendered
output. that's probably not that bad, our stylesheet didn't make use of
this anyway (and pre-23.05 versions of the chapters didn't use quote
elements either).
also updates the nixpkgs manual to clarify that option docs support all
extensions (although it doesn't support headings at all, so heading
anchors don't work by extension).
makes sure that program listing tags are separated from their contents
by exactly a newline character. this makes the markdown translation
easier to verify (since no new newlines need to be inserted), and
there's no rendering difference anyway.
markdown cannot represent those links. remove them all now instead of in
each chapter conversion to keep the diff for each chapter small and more
understandable.
The `freeformType` of `settings.publicinbox` in this module prevented
users from setting settings on the `publicinbox` section itself (which
is necessary for making e.g. IMAP work correctly), and only allowed
configuration of nested per-inbox sections.
In general I believe that these overly specific types which are
traditional in NixOS, and this kind of config generation, are a huge
footgun. This commit is the least invasive change that makes the
module work correctly.
By settings User= to the actual Exim user, systemd will ensure that the
credentials directory will have the correct ownership, allowing users to
utilize LoadCredential=. Exim still gets started as root (and drops
privileges) to preserve the previous behavior.
