gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge commit 59f9c6722b into haskell-updates

Browse Source
This commit is contained in:
sternenseemann
2025-10-08 12:34:28 +02:00
parent 3570093d39 59f9c6722b
commit 054e2d2541
1608 changed files with 21069 additions and 52923 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/periodic-merge-6h.yml
+2
View File
@@ -35,6 +35,8 @@ jobs:
into: staging-next
- from: staging-next
into: staging
- from: master
into: staging-nixos
uses: ./.github/workflows/periodic-merge.yml
with:
from: ${{ matrix.pairs.from }}
.github/workflows/periodic-merge.yml
+1 -1
View File
@@ -55,7 +55,7 @@ jobs:
github_token: ${{ steps.app-token.outputs.token }}
- name: Comment on failure
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
if: ${{ failure() }}
with:
issue-number: 105153
CONTRIBUTING.md
+30 -8
View File
@@ -430,20 +430,22 @@ gitGraph
Here's an overview of the different branches:
| branch | `master` | `staging-next` | `staging` |
| --- | --- | --- | --- |
| Used for development | ✔️ | ❌ | ✔️ |
| Built by Hydra | ✔️ | ✔️ | ❌ |
| [Mass rebuilds][mass-rebuild] | ❌ | ⚠️ Only to fix Hydra builds | ✔️ |
| Critical security fixes | ✔️ for non-mass-rebuilds | ✔️ for mass-rebuilds | ❌ |
| Automatically merged into | `staging-next` | `staging` | - |
| Manually merged into | - | `master` | `staging-next` |
| branch | `master` | `staging-next` | `staging` | [`staging-nixos`](#test-driver-rebuild) |
| --- | --- | --- | --- | --- |
| Used for development | ✔️ | ❌ | ✔️ | ✔️ |
| Built by Hydra | ✔️ | ✔️ | ❌ | ❌ |
| [Mass rebuilds][mass-rebuild] | ❌ | ⚠️ Only to fix Hydra builds | ✔️ | ❌[^1] |
| Critical security fixes | ✔️ for non-mass-rebuilds | ✔️ for mass-rebuilds | ❌ | ✔️ |
| Automatically merged into | `staging-next` & `staging-nixos` | `staging` | - | - |
| Manually merged into | - | `master` | `staging-next` | `master` |
The staging workflow is used for all stable branches with corresponding names:
- `master`/`release-YY.MM`
- `staging`/`staging-YY.MM`
- `staging-next`/`staging-next-YY.MM`
[^1]: Except changes that cause no more rebuilds than kernel updates
# Conventions
## Branch conventions
@@ -495,6 +497,26 @@ In order to help the decision, CI automatically assigns [`rebuild` labels](https
As a rule of thumb, if the number of rebuilds is **500 or more**, consider targeting the `staging` branch instead of `master`; if the number is **1000 or more**, the pull request causes a mass rebuild, and should target the `staging` branch.
See [previously merged pull requests to the staging branches](https://github.com/NixOS/nixpkgs/issues?q=base%3Astaging+-base%3Astaging-next+is%3Amerged) to get a sense for what changes are considered mass rebuilds.
Please note that changes to the Linux kernel are an exception to this rule.
These PRs go to `staging-nixos`, see [the next section for more context](#changes-rebuilding-all-tests).
### Changes rebuilding all NixOS tests
[test-driver-rebuild]: #changes-rebuilding-all-tests
Changes causing a rebuild of all NixOS tests get a special [`10.rebuild-nixos-tests`](https://github.com/NixOS/nixpkgs/issues?q=state%3Aopen%20label%3A10.rebuild-nixos-tests) label.
These changes pose a significant impact on the build infrastructure.
Hence, these PRs should either target a `staging`-branch or `staging-nixos`, provided one of following conditions applies:
* The label `10.rebuild-nixos-tests` is set, or
* The PR is a change affecting the Linux kernel.
The branch gets merged whenever mainline kernel updates or critical security fixes land on the branch.
This usually happens on a weekly basis.
Backports are not handled by such a branch.
The relevant PRs from this branch must be backported manually.
## Commit conventions
[commit-conventions]: #commit-conventions
README.md
+4 -4
View File
@@ -1,9 +1,9 @@
<p align="center">
<a href="https://nixos.org">
<picture>
<source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos.svg">
<source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.svg">
<img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos.svg" width="500px" alt="NixOS logo">
<source media="(prefers-color-scheme: light)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg">
<source media="(prefers-color-scheme: dark)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-white-regular-horizontal-minimal.svg">
<img src="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg" width="500px" alt="NixOS logo">
</picture>
</a>
</p>
@@ -57,7 +57,7 @@ When successful build and test criteria are met, the Nixpkgs expressions are dis
# Contributing
Nixpkgs is among the most active projects on GitHub.
While thousands of open issues and pull requests might seem a lot at first, it helps consider it in the context of the scope of the project.
While thousands of open issues and pull requests might seem like a lot at first, it helps to consider it in the context of the scope of the project.
Nixpkgs describes how to build tens of thousands of pieces of software and implements a Linux distribution.
The [GitHub Insights](https://github.com/NixOS/nixpkgs/pulse) page gives a sense of the project activity.
ci/OWNERS
+10
View File
@@ -190,6 +190,9 @@ nixos/modules/installer/tools/nix-fallback-paths.nix @NixOS/nix-team @raitobeza
/pkgs/top-level/release-cuda.nix @NixOS/cuda-maintainers
/pkgs/development/cuda-modules @NixOS/cuda-maintainers
# ROCm
/pkgs/development/rocm-modules @NixOS/rocm
# Haskell
/doc/languages-frameworks/haskell.section.md @sternenseemann @maralorn @wolfgangwalther
/maintainers/scripts/haskell @sternenseemann @maralorn @wolfgangwalther
@@ -333,6 +336,13 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
/pkgs/development/dhall-modules @Gabriella439 @Profpatsch
/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch
# Agda
/pkgs/build-support/agda @NixOS/agda
/pkgs/top-level/agda-packages.nix @NixOS/agda
/pkgs/development/libraries/agda @NixOS/agda
/doc/languages-frameworks/agda.section.md @NixOS/agda
/nixos/tests/agda.nix @NixOS/agda
# Idris
/pkgs/development/idris-modules @Infinisil
/pkgs/development/compilers/idris2 @mattpolzin
ci/eval/README.md
+1 -1
View File
@@ -8,7 +8,7 @@ Furthermore it also allows local evaluation using:
nix-build ci -A eval.baseline
```
The most important two arguments are:
The two most important arguments are:
- `--arg evalSystems`: The set of systems for which `nixpkgs` should be evaluated.
Defaults to the four official platforms (`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`).
Example: `--arg evalSystems '["x86_64-linux" "aarch64-darwin"]'`
ci/supportedBranches.js
+2
View File
@@ -8,6 +8,7 @@ const typeConfig = {
release: ['development', 'primary'],
staging: ['development', 'secondary'],
'staging-next': ['development', 'secondary'],
'staging-nixos': ['development', 'secondary'],
'haskell-updates': ['development', 'secondary'],
nixos: ['channel'],
nixpkgs: ['channel'],
@@ -19,6 +20,7 @@ const orderConfig = {
master: 0,
release: 1,
staging: 2,
'staging-nixos': 2,
'haskell-updates': 3,
'staging-next': 4,
}
doc/README.md
+2 -2
View File
@@ -408,7 +408,7 @@ Though this is not shown in the rendered documentation on nixos.org.
#### Footnotes
To add a foonote explanation, use the following syntax:
To add a footnote explanation, use the following syntax:
```markdown
Sometimes it's better to add context [^context] in a footnote.
@@ -443,7 +443,7 @@ This syntax is taken from [CommonMark](https://spec.commonmark.org/0.30/#link-re
#### Typographic replacements
Typographic replacements are enabled.
Check the [list of possible replacement patterns check](https://github.com/executablebooks/markdown-it-py/blob/3613e8016ecafe21709471ee0032a90a4157c2d1/markdown_it/rules_core/replacements.py#L1-L15).
Check the [list of possible replacement patterns](https://github.com/executablebooks/markdown-it-py/blob/3613e8016ecafe21709471ee0032a90a4157c2d1/markdown_it/rules_core/replacements.py#L1-L15).
## Getting help
doc/build-helpers.md
+2 -2
View File
@@ -3,13 +3,13 @@
A build helper is a function that produces derivations.
:::{.warning}
This is not to be confused with the [`builder` argument of the Nix `derivation` primitive](https://nixos.org/manual/nix/unstable/language/derivations.html), which refers to the executable that produces the build result, or [remote builder](https://nixos.org/manual/nix/stable/advanced-topics/distributed-builds.html), which refers to a remote machine that could run such an executable.
This is not to be confused with the [`builder` argument of the Nix `derivation` primitive](https://nixos.org/manual/nix/unstable/language/derivations.html), which refers to the executable that produces the build result, or [remote builder](https://nixos.org/manual/nix/stable/advanced-topics/distributed-builds.html), which refers to a remote machine that could run such an executable.
:::
Such a function is usually designed to abstract over a typical workflow for a given programming language or framework.
This allows declaring a build recipe by setting a limited number of options relevant to the particular use case instead of using the `derivation` function directly.
[`stdenv.mkDerivation`](#part-stdenv) is the most widely used build helper, and serves as a basis for many others.
[`stdenv.mkDerivation`](#part-stdenv) is the most widely used build helper and serves as a basis for many others.
In addition, it offers various options to customize parts of the builds.
There is no uniform interface for build helpers.
doc/build-helpers/fetchers.chapter.md
+12 -2
View File
@@ -416,7 +416,7 @@ fetchurl {
}
```
After building the package, the file will be downloaded and place into the Nix store:
After building the package, the file will be downloaded and placed into the Nix store:
```shell
$ nix-build
@@ -882,7 +882,17 @@ This is used with Gitiles repositories. The arguments expected are similar to `f
## `fetchFromBitbucket` {#fetchfrombitbucket}
This is used with BitBucket repositories. The arguments expected are very similar to `fetchFromGitHub` above.
Used for repositories hosted on Bitbucket (`"bitbucket.org"`) owned by the Australian-based Atlassian Corporation. It requires an `owner` and `repo` argument which are both strings that reference the workspace ID and repository name hosted on Bitbucket cloud as well as either a `tag` or `rev` argument.
By default, `fetchFromBitbucket` will attempt to download a commit snapshot tarball at the specified `tag` or `rev` at `https://bitbucket.org/<owner>/<repo>/get/<tag-or-rev>.tar.gz`
However, `fetchFromBitbucket` will automatically switch to using `fetchgit` and fetch from `https://bitbucket.org/<owner>/<repo>.git` in any of these cases:
- `forceFetchGit`, `leaveDotGit`, `deepClone`, `fetchLFS`, or `fetchSubmodules` are set to `true`
- `sparseCheckout` contains any entries (is a non-empty list)
- `rootDir` is set to a non-empty string
When `fetchgit` is used, refer to the `fetchgit` section for documentation of its available options.
## `fetchFromSavannah` {#fetchfromsavannah}
doc/build-helpers/fixed-point-arguments.chapter.md
+3 -4
View File
@@ -1,7 +1,6 @@
# Fixed-point arguments of build helpers {#chap-build-helpers-finalAttrs}
As mentioned in the beginning of this part, `stdenv.mkDerivation` could alternatively accept a fixed-point function. The input of such function, typically named `finalAttrs`, is expected to be the final state of the attribute set.
A build helper like this is said to accept **fixed-point arguments**.
As mentioned in the beginning of this part, `stdenv.mkDerivation` could alternatively accept a fixed-point function. The input of this function, typically named `finalAttrs`, is expected to be the final state of the attribute set. A build helper like this is said to accept **fixed-point arguments**.
Build helpers don't always support fixed-point arguments yet, as support in [`stdenv.mkDerivation`](#mkderivation-recursive-attributes) was first included in Nixpkgs 22.05.
@@ -9,7 +8,7 @@ Build helpers don't always support fixed-point arguments yet, as support in [`st
Developers can use the Nixpkgs library function [`lib.customisation.extendMkDerivation`](#function-library-lib.customisation.extendMkDerivation) to define a build helper supporting fixed-point arguments from an existing one with such support, with an attribute overlay similar to the one taken by [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
Beside overriding, `lib.extendMkDerivation` also supports `excludeDrvArgNames` to optionally exclude some arguments in the input fixed-point arguments from passing down the base build helper (specified as `constructDrv`).
Besides overriding, `lib.extendMkDerivation` also supports `excludeDrvArgNames` to optionally exclude some arguments in the input fixed-point arguments from passing down the base build helper (specified as `constructDrv`).
:::{.example #ex-build-helpers-extendMkDerivation}
@@ -41,7 +40,7 @@ stdenv.mkDerivation (
)
```
we could define with `lib.extendMkDerivation` an attribute overlay to make the result build helper also accepts the the attribute set's fixed point passing to the underlying `stdenv.mkDerivation`, named `finalAttrs` here:
we could define with `lib.extendMkDerivation` an attribute overlay to make the result build helper also accept the attribute set's fixed point passing to the underlying `stdenv.mkDerivation`, named `finalAttrs` here:
```nix
lib.extendMkDerivation {
doc/build-helpers/special/fhs-environments.section.md
+1 -1
View File
@@ -1,6 +1,6 @@
# buildFHSEnv {#sec-fhs-environments}
`buildFHSEnv` provides a way to build and run FHS-compatible lightweight sandboxes. It creates an isolated root filesystem with the host's `/nix/store`, so its footprint in terms of disk space is quite small. This allows you to run software which is hard or unfeasible to patch for NixOS; 3rd-party source trees with FHS assumptions, games distributed as tarballs, software with integrity checking and/or external self-updated binaries for instance.
`buildFHSEnv` provides a way to build and run an FHS-compatible, lightweight sandbox. It creates an isolated root filesystem with the host's `/nix/store`, so its footprint in terms of disk space is quite small. This allows you to run software which is hard or unfeasible to patch for NixOS; 3rd-party source trees with FHS assumptions, games distributed as tarballs, software with integrity checking and/or external self-updated binaries for instance.
It uses Linux' namespaces feature to create temporary lightweight environments which are destroyed after all child processes exit, without requiring elevated privileges. It works similar to containerisation technology such as Docker or FlatPak but provides no security-relevant separation from the host system.
Accepted arguments are:
doc/build-helpers/testers.chapter.md
+1 -1
View File
@@ -98,7 +98,7 @@ It has two modes:
: The path to the files to check.
`remap` (attribe set, optional) {#tester-lycheeLinkCheck-param-remap}
`remap` (attribute set, optional) {#tester-lycheeLinkCheck-param-remap}
: An attribute set where the attribute names are regular expressions.
The values should be strings, derivations, or path values.
doc/build-helpers/trivial-build-helpers.chapter.md
+1 -1
View File
@@ -651,7 +651,7 @@ Write a Bash script to a "bin" subdirectory of a directory in the Nix store.
: The contents of the file.
The file's contents will be put into `/nix/store/<store path>/bin/<name>`.
The store path will include the the name, and it will be a directory.
The store path will include the name, and it will be a directory.
This function is a combination of [](#trivial-builder-writeShellScript) and [](#trivial-builder-writeScriptBin).
doc/development.md
+1 -1
View File
@@ -1,6 +1,6 @@
# Development of Nixpkgs {#part-development}
This section shows you how Nixpkgs is being developed and how you can interact with the contributors and the latest updates.
This section shows you how Nixpkgs is developed and how you can interact with the contributors and the latest updates.
If you are interested in contributing yourself, see [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
<!-- In the future this section should also include: How to test pull requests, how to know if pull requests are available in channels, etc. -->
doc/functions.md
+1 -1
View File
@@ -1,6 +1,6 @@
# Functions reference {#chap-functions}
The nixpkgs repository has several utility functions to manipulate Nix expressions.
The Nixpkgs repository has several utility functions to manipulate Nix expressions.
```{=include=} sections
functions/library.md
doc/functions/debug.section.md
+1 -1
View File
@@ -1,5 +1,5 @@
# Debugging Nix Expressions {#sec-debug}
Nix is a unityped, dynamic language, this means every value can potentially appear anywhere. Since it is also non-strict, evaluation order and what ultimately is evaluated might surprise you. Therefore it is important to be able to debug nix expressions.
Nix is a unityped, dynamic language, this means any value can potentially appear anywhere. Since it is also non-strict, evaluation order and what is ultimately evaluated might surprise you. Therefore, it is important to be able to debug Nix expressions.
In the `lib/debug.nix` file you will find a number of functions that help (pretty-)printing values while evaluation is running. You can even specify how deep these values should be printed recursively, and transform them on the fly. Please consult the docstrings in `lib/debug.nix` for usage information.
doc/functions/generators.section.md
+4 -4
View File
@@ -1,9 +1,9 @@
# Generators {#sec-generators}
Generators are functions that create file formats from nix data structures, e. g. for configuration files. There are generators available for: `INI`, `JSON` and `YAML`
Generators are functions that create file formats from Nix data structures, e.g. for configuration files. There are generators available for: `INI`, `JSON` and `YAML`.
All generators follow a similar call interface: `generatorName configFunctions data`, where `configFunctions` is an attrset of user-defined functions that format nested parts of the content. They each have common defaults, so often they do not need to be set manually. An example is `mkSectionName ? (name: libStr.escape [ "[" "]" ] name)` from the `INI` generator. It receives the name of a section and sanitizes it. The default `mkSectionName` escapes `[` and `]` with a backslash.
All generators follow a similar call interface: `generatorName configFunctions data`, where `configFunctions` is an attrset of user-defined functions that format nested parts of the content. They each have common defaults, so often they do not need to be set manually. An example is `mkSectionName` from the `INI` generator, which defaults to `(name: libStr.escape [ "[" "]" ] name)`. It receives the name of a section and sanitizes it. The default `mkSectionName` escapes `[` and `]` with a backslash.
Generators can be fine-tuned to produce exactly the file format required by your application/service. One example is an INI-file format which uses `: ` as separator, the strings `"yes"`/`"no"` as boolean values and requires all string values to be quoted:
Generators can be fine-tuned to produce exactly the file format required by your application/service. One example is an INI file format that uses `: ` as a separator, the strings `"yes"` and `"no"` as boolean values, and requires all string values to be quoted:
```nix
let
@@ -42,7 +42,7 @@ customToINI {
}
```
This will produce the following INI file as nix string:
This will produce the following INI file as a Nix string:
```INI
[main]
doc/interoperability/cyclonedx.md
+3 -3
View File
@@ -3,10 +3,10 @@
[OWASP](https://owasp.org/) [CycloneDX](https://cyclonedx.org/) is a Software [Bill of Materials](https://en.wikipedia.org/wiki/Bill_of_materials) (SBOM) standard.
The standards described here are for including Nix specific information within SBOMs in a way that is interoperable with external SBOM tooling.
## `nix` Namespace Property Taxonomy {#sec-interop.cylonedx-nix}
## `nix` Namespace Property Taxonomy {#sec-interop.cylonedx-nix}
The following tables describe namespaces for [properties](https://cyclonedx.org/docs/1.6/json/#components_items_properties) that may be attached to components within SBOMs.
Component properties are lists of name-value-pairs where values must be strings.
The following tables describe namespaces for [properties](https://cyclonedx.org/docs/1.6/json/#components_items_properties) that can be attached to components within SBOMs.
Component properties are lists of name-value-pairs where the values must be strings.
Properties with the same name may appear more than once.
Names and values are case-sensitive.
doc/languages-frameworks/chicken.section.md
+2 -2
View File
@@ -6,7 +6,7 @@ compiler. It includes an interactive mode and a custom package format, "eggs".
## Using Eggs {#sec-chicken-using}
Eggs described in nixpkgs are available inside the
Eggs described in Nixpkgs are available inside the
`chickenPackages.chickenEggs` attrset. Including an egg as a build input is
done in the typical Nix fashion. For example, to include support for [SRFI
189](https://srfi.schemers.org/srfi-189/srfi-189.html) in a derivation, one
@@ -26,7 +26,7 @@ variables `CHICKEN_INCLUDE_PATH` and `CHICKEN_REPOSITORY_PATH`.
## Updating Eggs {#sec-chicken-updating-eggs}
nixpkgs only knows about a subset of all published eggs. It uses
Nixpkgs only knows about a subset of all published eggs. It uses
[egg2nix](https://github.com/the-kenny/egg2nix) to generate a
package set from a list of eggs to include.
doc/languages-frameworks/gnome.section.md
+1 -1
View File
@@ -111,7 +111,7 @@ Fortunately, we have a [family of hooks]{#ssec-gnome-hooks-wrapgappshook} that a
- [`wrapGAppsHook4`]{#ssec-gnome-hooks-wrapgappshook4} for GTK 4 apps. Same as `wrapGAppsHook3` but replaces `gtk3` with `gtk4`.
- [`wrapGAppsNoGuiHook`]{#ssec-gnome-hooks-wrapgappsnoguihook} for programs without a graphical interface. Same as the above but does not bring `gtk3` and `librsvg` into the closure.
The hooks do the the following:
The hooks do the following:
- `wrapGApps*` hook itself will add the package’s `share` directory to `XDG_DATA_DIRS`.
doc/languages-frameworks/javascript.section.md
+1 -1
View File
@@ -542,7 +542,7 @@ set `prePnpmInstall` to the right commands to run. For example:
```nix
{
prePnpmInstall = ''
pnpm config set dedupe-peer-dependants false
pnpm config set dedupe-peer-dependents false
'';
pnpmDeps = pnpm.fetchDeps {
inherit (finalAttrs) prePnpmInstall;
doc/languages-frameworks/ocaml.section.md
+1 -1
View File
@@ -52,7 +52,7 @@ Here is a simple package example.
- It sets the optional `doCheck` attribute such that tests will be run with
`dune runtest -p angstrom` after the build (`dune build -p angstrom`) is
complete, but only if the OCaml version is at at least `"4.05"`.
complete, but only if the OCaml version is at least `"4.05"`.
- It uses the package `ocaml-syntax-shims` as a build input, `alcotest` and
`ppx_let` as check inputs (because they are needed to run the tests), and
doc/languages-frameworks/python.section.md
+1 -1
View File
@@ -1018,7 +1018,7 @@ that we introduced with the `let` expression.
#### Handling dependencies {#handling-dependencies}
Our example, `toolz`, does not have any dependencies on other Python packages or system libraries.
[`buildPythonPackage`](#buildpythonpackage-function) uses the the following arguments in the following circumstances:
[`buildPythonPackage`](#buildpythonpackage-function) uses the following arguments in the following circumstances:
- `dependencies` - For Python runtime dependencies.
- `build-system` - For Python build-time requirements.
doc/module-system/module-system.chapter.md
+1 -1
View File
@@ -162,7 +162,7 @@ the last category is only available after the `imports` have been resolved.
It is exposed as a module argument due to how the module system is implemented, which cannot be avoided without breaking compatibility.
It is a good practice not to rely on `_prefix`. A module should not make assumptions about its location in the configuration tree.
For example, the root of a NixOS configuration may have a non-empty prefix, for example when it is a specialisation, or when it is part of a larger, multi-host configuration such as a [NixOS test](https://nixos.org/manual/nixos/unstable/#sec-nixos-tests).
For example, the root of a NixOS configuration may have a non-empty prefix, for example when it is a specialisation, or when it is part of a larger, multi-host configuration, such as a [NixOS test](https://nixos.org/manual/nixos/unstable/#sec-nixos-tests).
Instead of depending on `_prefix` use explicit options, whose default definitions can be provided by the module that imports them.
<!-- markdown link aliases -->
doc/packages/linux.section.md
+53
View File
@@ -105,3 +105,56 @@ $ make -C $dev/lib/modules/*/build M=$(pwd)/drivers/net/ethernet/mellanox module
```
:::
## Maintainer information {#sec-linux-kernel-maintainer-information}
### Updating kernels {#sec-linux-updates}
Updating all kernels can be done with the following script:
```ShellSession
$ pkgs/os-specific/linux/kernel/update.sh
```
The change gets submitted like this:
* File a PR against `staging-nixos`.
* Add a `backport release-XX.XX` label for an automated backport.
We don't expect many other changes on that branch to require a backport, hence there's no such branch for stable.
By using an additional PR, we get the automatic backport against stable without manual cherry-picks.
* Merge into `staging-nixos`.
* File as PR from `staging-nixos` against `master`.
* When all status checks are green, merge.
### Add a new (major) version of the Linux kernel {#sec-linux-add-new-kernel-version}
* When running `./pkgs/os-specific/linux/kernel/update.sh`, new kernel majors get discovered automatically.
* Prepare all Nix expressions for the new kernel
* Instantiate the new kernel in `pkgs/top-level/linux-kernels.nix` in the `kernels`-section.
```nix
{
linux_X_Y = callPackage ../os-specific/linux/kernel/mainline.nix {
branch = "X.Y";
kernelPatches = [
# any new patches required (it makes to look which patches are used by its predecessor)
];
};
}
```
* Instantiate the package-set in `vanillaPackages`:
```nix
{
linux_X_Y = recurseIntoAttrs (packagesFor kernels.linux_X_Y);
}
```
* Update `linux_latest` to the new attribute.
* __SQUASH__ the changes into the `linux: init at …` commit.
* If a new hardened is available:
* Instantiate a `linux_X_Y_hardened = hardenedKernelsFor kernels.linux_X_Y { };` in `kernels` and
`linux_X_Y_hardened = hardenedKernelFor kernels.linux_X_Y { };` in the `packages`-section.
* Make sure to remove the hardened variant of the previous kernel version unless it's LTS.
We only support the latest and latest LTS version of hardened.
* If no new hardened kernel is available:
* Keep the previously latest kernel until its mainline counterpart gets removed.
After that `linux_hardened` points to the latest LTS supported by hardened.
* __SQUASH__ the changes into the `linux_X_Y_hardened: init at …` commit.
doc/preface.chapter.md
+3 -3
View File
@@ -19,7 +19,7 @@ To discover other kinds of documentation:
## Overview of Nixpkgs {#overview-of-nixpkgs}
Nix expressions describe how to build packages from source and are collected in
the [nixpkgs repository](https://github.com/NixOS/nixpkgs). Also included in the
the [Nixpkgs repository](https://github.com/NixOS/nixpkgs). Also included in the
collection are Nix expressions for
[NixOS modules](https://nixos.org/nixos/manual/index.html#sec-writing-modules).
With these expressions the Nix package manager can build binary packages.
@@ -34,7 +34,7 @@ security updates. More up-to-date packages and modules are available via the
`nixos-unstable` channel.
Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
nixpkgs repository, although both do lag the `master` branch by generally
Nixpkgs repository, although both do lag the `master` branch by generally
[a couple of days](https://status.nixos.org/). Updates to a channel are
distributed as soon as all tests for that channel pass, e.g.
[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
@@ -46,5 +46,5 @@ which also builds binary packages from the Nix expressions in Nixpkgs for
The binaries are made available via a [binary cache](https://cache.nixos.org).
The current Nix expressions of the channels are available in the
[nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
[Nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
that correspond to the channel names (e.g. `nixos-22.11-small`).
doc/redirects.json
+15
View File
@@ -216,6 +216,12 @@
"sec-building-packages-with-llvm-using-clang-stdenv": [
"index.html#sec-building-packages-with-llvm-using-clang-stdenv"
],
"sec-darwin-libcxx-deployment-targets": [
"index.html#sec-darwin-libcxx-deployment-targets"
],
"sec-darwin-libcxx-versions": [
"index.html#sec-darwin-libcxx-versions"
],
"sec-functions-library-treefmt": [
"index.html#sec-functions-library-treefmt"
],
@@ -4288,6 +4294,15 @@
"sec-linux-kernel": [
"index.html#sec-linux-kernel"
],
"sec-linux-kernel-maintainer-information": [
"index.html#sec-linux-kernel-maintainer-information"
],
"sec-linux-updates": [
"index.html#sec-linux-updates"
],
"sec-linux-add-new-kernel-version": [
"index.html#sec-linux-add-new-kernel-version"
],
"ex-overriding-kernel-derivation": [
"index.html#ex-overriding-kernel-derivation"
],
doc/release-notes/rl-2505.section.md
+5 -5
View File
@@ -230,7 +230,7 @@
- `buildGoModule` now supports a `goSum` attribute (`null` by default) to optionally provide a path to `go.sum` and correctly enabling rebuilds when the file changes.
- The newly added aliases `go_latest` and `buildGoLatestModule` are now available and can be use to prevent packages like `gopls` from breaking whenever the default toolchain minor version is lagging behind.
- The newly added aliases `go_latest` and `buildGoLatestModule` are now available and can be used to prevent packages like `gopls` from breaking whenever the default toolchain minor version is lagging behind.
It can also be used _outside of Nixpkgs_ to get fast access to new Go minor versions without having to wait for a staging cycle that will update the default builder/toolchain.
- A [policy documenting the details of Go toolchain and builder upgrades](https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/go/README.md#go-toolchainbuilder-upgrade-policy) in Nixpkgs, as well as rules related to using non-default builders like `buildGo1xxModule` and `buildGoLatestModule` has been added in-tree.
@@ -257,7 +257,7 @@
and `withGstreamer`/`withVlc` override options have been removed due to this.
- `nexusmods-app` has been upgraded from version 0.6.3. If you were running a version older than 0.7.0, then before upgrading, you **must reset all app state** (mods, games, settings, etc). Otherwise, NexusMods.App will crash due to app state files incompatibility.
- Typically, you can can reset to a clean state by running `NexusMods.App uninstall-app`. See Nexus Mod's [how to uninstall the app](https://nexus-mods.github.io/NexusMods.App/users/Uninstall) documentation for more detail and alternative methods.
- Typically, you can reset to a clean state by running `NexusMods.App uninstall-app`. See Nexus Mod's [how to uninstall the app](https://nexus-mods.github.io/NexusMods.App/users/Uninstall) documentation for more detail and alternative methods.
- This should not be necessary going forward, because loading app state from 0.7.0 or newer is now supported. This is documented in the [0.7.1 changelog](https://github.com/Nexus-Mods/NexusMods.App/releases/tag/v0.7.1).
- `nezha` and its agent `nezha-agent` have been updated to v1, which contains breaking changes. See the [official wiki](https://nezha.wiki/en_US/) for more details.
@@ -369,7 +369,7 @@
- `nodePackages.expo-cli` has been removed, as it was deprecated by upstream. The suggested replacement is the `npx expo` command.
- `open-policy-agent` has has been updated to 1.0.0+.
- `open-policy-agent` has been updated to 1.0.0+.
This major release makes the `rego.v1` syntax the default.
This is a breaking change for those using v0 Rego.
See the [upgrade documentation](https://www.openpolicyagent.org/docs/v1.0.1/v0-upgrade/) for more details.
@@ -514,7 +514,7 @@
Note that all provided plugins must have versions/tags (string after `@`), even if upstream repo does not tag each release. For untagged plugins, you can either create an empty Go project and run `go get <plugin>` and see changes in `go.mod` to get the pseudo-version number, or provide a commit hash in place of version/tag for the first run, and update the plugin string based on the error output.
- The `godot-export-templates` package now has its content at `share/godot/export_templates/$version` instead of the output root. This makes it more convenient for for symlinking into `~/.local`, but scripts expecting the old layout will need to be changed.
- The `godot-export-templates` package now has its content at `share/godot/export_templates/$version` instead of the output root. This makes it more convenient for symlinking into `~/.local`, but scripts expecting the old layout will need to be changed.
- GOverlay has been updated to 1.2, please check the [upstream changelog](https://github.com/benjamimgois/goverlay/releases) for more details.
@@ -549,7 +549,7 @@
- `gerbera` now has wavpack support.
- `signal-desktop` has been migrated to a from source build. No state migration is necessary. In case there's no working source build available (like on Darwin), the the binary build is still available at `signal-desktop-bin`.
- `signal-desktop` has been migrated to a from source build. No state migration is necessary. In case there's no working source build available (like on Darwin), the binary build is still available at `signal-desktop-bin`.
- `ddclient` was updated from 3.11.2 to 4.0.0 [Release notes](https://github.com/ddclient/ddclient/releases/tag/v4.0.0)
doc/release-notes/rl-2511.section.md
+18 -1
View File
@@ -12,6 +12,12 @@
- The default GHC version has been updated from 9.8 to 9.10.
`haskellPackages` correspondingly uses Stackage LTS 24 (instead of LTS 23) as a baseline.
- Darwin has switched to using the system libc++. This was done for improved compatibility and to avoid ODR violations.
If a newer C++ library feature is not available on the default deployment target, you will need to increase the deployment target.
See the Darwin platform documentation for more details.
- LLVM has been updated from 19 to 21.
## Backward Incompatibilities {#sec-nixpkgs-release-25.11-incompatibilities}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -62,7 +68,7 @@
- `buildGoModule` now warns if `<pkg>.passthru.overrideModAttrs` is lost during the overriding of its result packages.
- `gentium` package now provides `Gentium-*.ttf` files, and not `GentiumPlus-*.ttf` files like before. The font identifiers `Gentium Plus*` are available in the `gentium-plus` package, and if you want to use the more recently updated package `gentium` [by sil](https://software.sil.org/gentium/), you should update your configuration files to use the `Gentium` font identifier.
- `gentium` package now provides `Gentium-*.ttf` files, and not `GentiumPlus-*.ttf` files like before. The font identifiers `Gentium Plus*` are available in the `gentium-plus` package, and if you want to use the more recently updated package `gentium` [by SIL](https://software.sil.org/gentium/), you should update your configuration files to use the `Gentium` font identifier.
- `space-orbit` package has been removed due to lack of upstream maintenance. Debian upstream stopped tracking it in 2011.
@@ -140,6 +146,8 @@
- `tooling-language-server` has been renamed to `deputy` (both the package and binary), following the rename of the upstream project.
- `fetchFromBitBucket` has gained a `fetchgit` backend when passing in git-related arguments similar to `fetchFromGitHub`.
- `fetchtorrent`, when using the "rqbit" backend, erroneously started fetching files into a subdirectory in Nixpkgs 24.11. The original behaviour &ndash; which matches the behaviour using the "transmission" backend &ndash; has now been restored. Users reliant on the erroneous behaviour can temporarily maintain it by adding `flatten = false` to the `fetchtorrent` arguments; Nix will produce an evaluation warning for anyone using `backend = "rqbit"` without `flatten = true`.
- `steamcontroller` has been removed due to lack of upstream maintenance. Consider using `sc-controller` instead.
@@ -168,6 +176,8 @@
- `neovimUtils.makeNeovimConfig` now uses `customLuaRC` parameter instead of accepting `luaRcContent`. The old usage is deprecated but still works with a warning.
- `python3Packages.pyocr` no longer supports `cuneiform` on Linux by default. It is still possible to enable it using `withCuneiformSupport` override.
- `telegram-desktop` packages now uses `Telegram` for its binary. The previous name was `telegram-desktop`. This is due to [an upstream decision](https://github.com/telegramdesktop/tdesktop/commit/56ff5808a3d766f892bc3c3305afb106b629ef6f) to make the name consistent with other platforms.
- `hsd` has been upgraded to version 8. See [their changelog](https://github.com/handshake-org/hsd/blob/v8.0.0/docs/release-notes/release-notes-8.x.md) for important instructions before upgrading.
@@ -219,6 +229,7 @@
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- Added `rewriteURL` attribute to the nixpkgs `config`, to allow for rewriting the URLs downloaded by `fetchurl`.
- Added `hashedMirrors` attribute to the nixpkgs `config`, to allow for customization of the hashed mirrors used by `fetchurl`.
- Added `gitConfig` and `gitConfigFile` option to the nixpkgs `config`, to allow for setting a default `gitConfigFile` for all `fetchgit` invocations.
@@ -228,6 +239,8 @@
- [`homebox` 0.20.0](https://github.com/sysadminsmedia/homebox/releases/tag/v0.20.0) changed how assets are stored and hashed. It is recommended to back up your database before this update.
- GIMP now defaults to version 3. Use `gimp2` for the old version.
- `installShellCompletion`: now supports Nushell completion files
- New hardening flags, `strictflexarrays1` and `strictflexarrays3` were made available, corresponding to the gcc/clang options `-fstrict-flex-arrays=1` and `-fstrict-flex-arrays=3` respectively.
@@ -271,6 +284,8 @@
recommendation](https://clickhouse.com/docs/faq/operations/production). Users
can continue to use the `clickhouse-lts` package if desired.
- `emacs` now disables the GC mark trace buffer by default. This improves GC performance by 5%, but can make GC issues harder to debug. This is configurable with `withGcMarkTrace`.
- `buildPythonPackage` and `buildPythonApplication` now default to `nix-update-script` as their default `updateScript`. This should improve automated updates, since nix-update is better maintained than the in-tree update script and has more robust fetcher support.
## Nixpkgs Library {#sec-nixpkgs-release-25.11-lib}
@@ -284,6 +299,8 @@
- `reaction` has been updated to version 2, which includes some breaking changes.
For more information, [check the release article](https://blog.ppom.me/en-reaction-v2).
- `lib.options.mkPackageOptionMD` has been removed, following its deprecation in NixOS 24.11. Use `lib.options.mkPackageOption` instead.
- The `buildPythonPackage` and `buildPythonApplication` functions now require
an explicit `format` attribute. Previously the default format used setuptools
and called `setup.py` from the source tree, which is deprecated.
doc/stdenv/platform-notes.chapter.md
+17
View File
@@ -12,6 +12,9 @@ If it does, you’re done; skip the rest of this.
- Darwin uses Clang by default instead of GCC. Packages that refer to `$CC` or `cc` should just work in most cases.
Some packages may hardcode `gcc` or `g++`. You can usually fix that by setting `makeFlags = [ "CC=cc" "CXX=C++" ]`.
If that does not work, you will have to patch the build scripts yourself to use the correct compiler for Darwin.
- Darwin uses the system libc++ by default to avoid ODR violations and potential compatibility issues from mixing LLVM libc++ with the system libc++.
While mixing the two usually worked, the two implementations are not guaranteed to be ABI compatible and are considered distinct by upstream.
See the troubleshooting guide below if you need to use newer C++ library features than those supported by the default deployment target.
- Darwin needs an SDK to build software.
The SDK provides a default set of frameworks and libraries to build software, most of which are specific to Darwin.
There are multiple versions of the SDK packages in Nixpkgs, but one is included by default in the `stdenv`.
@@ -30,6 +33,20 @@ If you run into issues or failures, continue reading below for how to deal with
### Darwin Issue Troubleshooting {#sec-darwin-troubleshooting}
#### Building a C++ package or library says that certain APIs are unavailable {#sec-darwin-libcxx-versions}
While some newer APIs may be available via headers only, some require using a system libc++ with the required API support.
When that happens, your build will fail because libc++ makes failure to use the correct deployment target an error.
To make the newer API available, increase the deployment target to the required version.
Note that it is possible to use libc++ from LLVM instead of increasing the deployment target, but it is not recommended.
Doing so can cause problems when multiple libc++ implementations are linked into a binary (e.g., from dependencies).
##### Using a newer deployment target {#sec-darwin-libcxx-deployment-targets}
See below for how to use a newer deployment target.
For example, `std::print` depends on features that are only available on macOS 13.3 or newer.
To make them available, set the deployment target to 13.3 using `darwinMinVersionHook`.
#### Package requires a non-default SDK or fails to build due to missing frameworks or symbols {#sec-darwin-troubleshooting-using-sdks}
In some cases, you may have to use a non-default SDK.
lib/attrsets.nix
+5 -5
View File
@@ -44,7 +44,7 @@ rec {
;
/**
Return an attribute from nested attribute sets.
Returns an attribute from nested attribute sets.
Nix has an [attribute selection operator `.`](https://nixos.org/manual/nix/stable/language/operators#attribute-selection) which is sufficient for such queries, as long as the number of attributes is static. For example:
@@ -111,7 +111,7 @@ rec {
attrByPath' 0 set;
/**
Return if an attribute from nested attribute set exists.
Returns if an attribute from nested attribute set exists.
Nix has a [has attribute operator `?`](https://nixos.org/manual/nix/stable/language/operators#has-attribute), which is sufficient for such queries, as long as the number of attributes is static. For example:
@@ -177,7 +177,7 @@ rec {
hasAttrByPath' 0 e;
/**
Return the longest prefix of an attribute path that refers to an existing attribute in a nesting of attribute sets.
Returns the longest prefix of an attribute path that refers to an existing attribute in a nesting of attribute sets.
Can be used after [`mapAttrsRecursiveCond`](#function-library-lib.attrsets.mapAttrsRecursiveCond) to apply a condition,
although this will evaluate the predicate function on sibling attributes as well.
@@ -504,7 +504,7 @@ rec {
updates: value: go 0 true value updates;
/**
Return the specified attributes from a set.
Returns the specified attributes from a set.
# Inputs
@@ -536,7 +536,7 @@ rec {
attrVals = nameList: set: map (x: set.${x}) nameList;
/**
Return the values of all attributes in the given set, sorted by
Returns the values of all attributes in the given set, sorted by
attribute name.
# Type
lib/default.nix
-1
View File
@@ -505,7 +505,6 @@ let
unknownModule
mkOption
mkPackageOption
mkPackageOptionMD
literalMD
;
inherit (self.types)
lib/deprecated/misc.nix
+2 -2
View File
@@ -73,7 +73,7 @@ let
name: default: attrs:
attrs.${name} or default;
# Return the second argument if the first one is true or the empty version
# Returns the second argument if the first one is true or the empty version
# of the second argument.
ifEnable =
cond: val:
@@ -89,7 +89,7 @@ let
else
null;
# Return true only if there is an attribute and it is true.
# Returns true only if there is an attribute and it is true.
checkFlag =
attrSet: name:
if name == "true" then
lib/fixed-points.nix
+1 -1
View File
@@ -119,7 +119,7 @@ rec {
x;
/**
Return the fixpoint that `f` converges to when called iteratively, starting
Returns the fixpoint that `f` converges to when called iteratively, starting
with the input `x`.
```
lib/licenses.nix
+5
View File
@@ -481,6 +481,11 @@ lib.mapAttrs mkLicense (
fullName = "Common Public License 1.0";
};
cnri-python = {
spdxId = "CNRI-Python";
fullName = "CNRI Python License";
};
cronyx = {
spdxId = "Cronyx";
fullName = "Cronyx License";
lib/lists.nix
+11 -11
View File
@@ -642,7 +642,7 @@ rec {
if index == null then default else elemAt list index;
/**
Return true if function `pred` returns true for at least one
Returns true if function `pred` returns true for at least one
element of `list`.
# Inputs
@@ -677,7 +677,7 @@ rec {
any = builtins.any;
/**
Return true if function `pred` returns true for all elements of
Returns true if function `pred` returns true for all elements of
`list`.
# Inputs
@@ -777,7 +777,7 @@ rec {
optional = cond: elem: if cond then [ elem ] else [ ];
/**
Return a list or an empty list, depending on a boolean value.
Returns a list or an empty list, depending on a boolean value.
# Inputs
@@ -837,7 +837,7 @@ rec {
toList = x: if isList x then x else [ x ];
/**
Return a list of integers from `first` up to and including `last`.
Returns a list of integers from `first` up to and including `last`.
# Inputs
@@ -871,7 +871,7 @@ rec {
range = first: last: if first > last then [ ] else genList (n: first + n) (last - first + 1);
/**
Return a list with `n` copies of an element.
Returns a list with `n` copies of an element.
# Inputs
@@ -1429,7 +1429,7 @@ rec {
map (x: elemAt x 1) (sort less prepared);
/**
Return the first (at most) N elements of a list.
Returns the first (at most) N elements of a list.
# Inputs
@@ -1463,7 +1463,7 @@ rec {
take = count: sublist 0 count;
/**
Return the last (at most) N elements of a list.
Returns the last (at most) N elements of a list.
# Inputs
@@ -1639,7 +1639,7 @@ rec {
throw "lib.lists.removePrefix: First argument is not a list prefix of the second argument";
/**
Return a list consisting of at most `count` elements of `list`,
Returns a list consisting of at most `count` elements of `list`,
starting at index `start`.
# Inputs
@@ -1737,7 +1737,7 @@ rec {
take commonPrefixLength list1;
/**
Return the last element of a list.
Returns the last element of a list.
This function throws an error if the list is empty.
@@ -1770,7 +1770,7 @@ rec {
elemAt list (length list - 1);
/**
Return all elements but the last.
Returns all elements but the last.
This function throws an error if the list is empty.
@@ -1803,7 +1803,7 @@ rec {
take (length list - 1) list;
/**
Return the image of the cross product of some lists by a function.
Returns the image of the cross product of some lists by a function.
# Examples
:::{.example}
lib/modules.nix
+6 -6
View File
@@ -1452,7 +1452,7 @@ let
};
/**
Return a definition with file location information.
Returns a definition with file location information.
*/
mkDefinition = args@{ file, value, ... }: args // { _type = "definition"; };
@@ -1541,7 +1541,7 @@ let
};
/**
Return a module that causes a warning to be shown if the
Returns a module that causes a warning to be shown if the
specified option is defined. For example,
mkRemovedOptionModule [ "boot" "loader" "grub" "bootDevice" ] "<replacement instructions>"
@@ -1589,7 +1589,7 @@ let
};
/**
Return a module that causes a warning to be shown if the
Returns a module that causes a warning to be shown if the
specified "from" option is defined; the defined value is however
forwarded to the "to" option. This can be used to rename options
while providing backward compatibility. For example,
@@ -1645,7 +1645,7 @@ let
};
/**
Return a module that causes a warning to be shown if any of the "from"
Returns a module that causes a warning to be shown if any of the "from"
option is defined; the defined values can be used in the "mergeFn" to set
the "to" value.
This function can be used to merge multiple options into one that has a
@@ -1724,7 +1724,7 @@ let
/**
Single "from" version of mkMergedOptionModule.
Return a module that causes a warning to be shown if the "from" option is
Returns a module that causes a warning to be shown if the "from" option is
defined; the defined value can be used in the "mergeFn" to set the "to"
value.
This function can be used to change an option into another that has a
@@ -1822,7 +1822,7 @@ let
mkDerivedConfig = opt: f: mkOverride (opt.highestPrio or defaultOverridePriority) (f opt.value);
/**
Return a module that help declares an option that has been renamed.
Returns a module that help declares an option that has been renamed.
When a value is defined for the old option, it is forwarded to the `to` option.
*/
doRename =
lib/options.nix
+1 -8
View File
@@ -344,13 +344,6 @@ rec {
}
);
/**
Deprecated alias of mkPackageOption, to be removed in 25.05.
Previously used to create options with markdown documentation, which is no longer required.
*/
mkPackageOptionMD = lib.warn "mkPackageOptionMD is deprecated and will be removed in 25.05; please use mkPackageOption." mkPackageOption;
/**
This option accepts arbitrary definitions, but it does not produce an option value.
@@ -503,7 +496,7 @@ rec {
loc: defs:
if defs == [ ] then
abort "This case should never happen."
# Return early if we only have one element
# Returns early if we only have one element
# This also makes it work for functions, because the foldl' below would try
# to compare the first element with itself, which is false for functions
else if length defs == 1 then
lib/path/default.nix
+1 -1
View File
@@ -40,7 +40,7 @@ let
isValid
;
# Return the reason why a subpath is invalid, or `null` if it's valid
# Returns the reason why a subpath is invalid, or `null` if it's valid
subpathInvalidReason =
value:
if !isString value then
lib/strings.nix
+4 -4
View File
@@ -1806,7 +1806,7 @@ rec {
if len == 0 then [ (addContextFrom str "") ] else map (addContextFrom str) (go 0 "" [ ]);
/**
Return a string without the specified prefix, if the prefix matches.
Returns a string without the specified prefix, if the prefix matches.
# Inputs
@@ -1857,7 +1857,7 @@ rec {
);
/**
Return a string without the specified suffix, if the suffix matches.
Returns a string without the specified suffix, if the suffix matches.
# Inputs
@@ -1908,7 +1908,7 @@ rec {
);
/**
Return true if string `v1` denotes a version older than `v2`.
Returns true if string `v1` denotes a version older than `v2`.
# Inputs
@@ -1940,7 +1940,7 @@ rec {
versionOlder = v1: v2: compareVersions v2 v1 == 1;
/**
Return true if string v1 denotes a version equal to or newer than v2.
Returns true if string v1 denotes a version equal to or newer than v2.
# Inputs
lib/trivial.nix
+3 -3
View File
@@ -327,7 +327,7 @@ in
f b a;
/**
Return `maybeValue` if not null, otherwise return `default`.
Returns `maybeValue` if not null, otherwise return `default`.
# Inputs
@@ -529,7 +529,7 @@ in
## Integer operations
/**
Return minimum of two numbers.
Returns minimum of two numbers.
# Inputs
@@ -544,7 +544,7 @@ in
min = x: y: if x < y then x else y;
/**
Return maximum of two numbers.
Returns maximum of two numbers.
# Inputs
lib/types.nix
+1 -1
View File
@@ -289,7 +289,7 @@ let
# `optionType`: The option type to parenthesize or not.
# The option whose description we're returning.
#
# Return value
# Returns value
#
# The description of the `optionType`, with parentheses if there may be an
# ambiguity.
maintainers/README.md
+2 -2
View File
@@ -8,7 +8,7 @@ This more fluid approach is one reason why we scale to so many packages.
The main responsibility of a maintainer is to keep the packages they maintain in a functioning state, and keep up with updates.
In order to do that, they are empowered to make decisions over the packages they maintain.
That being said, the maintainer is not alone proposing changes to the packages.
That being said, the maintainer is not alone in proposing changes to the packages.
Anybody (both bots and humans) can send PRs to bump or tweak the package.
We also allow other non-maintainer committers to merge changes to the package, provided enough time and priority has been given to the maintainer.
@@ -143,7 +143,7 @@ When adding users to [`maintainer-list.nix`](./maintainer-list.nix), the followi
### Maintainer teams
Feel free to create a new maintainer team in [`team-list.nix`](./team-list.nix) when a group is collectively responsible for a collection of packages.
Use taste and personal judgement when deciding if a team is warranted.
Use taste and personal judgment when deciding if a team is warranted.
Teams are allowed to define their own rules about membership.
maintainers/maintainer-list.nix
+30 -22
View File
@@ -1738,7 +1738,7 @@
};
annaaurora = {
email = "anna@annaaurora.eu";
matrix = "@papojari:artemislena.eu";
matrix = "@anna:annaaurora.eu";
github = "auroraanna";
githubId = 81317317;
name = "Anna Aurora";
@@ -6905,12 +6905,6 @@
githubId = 187309685;
name = "Drew Council";
};
drewrisinger = {
email = "drisinger+nixpkgs@gmail.com";
github = "drewrisinger";
githubId = 10198051;
name = "Drew Risinger";
};
dritter = {
email = "dritter03@googlemail.com";
github = "dritter";
@@ -8051,13 +8045,6 @@
githubId = 6803717;
name = "Ilya Elenskiy";
};
evils = {
email = "evils.devils@protonmail.com";
matrix = "@evils:nixos.dev";
github = "evils";
githubId = 30512529;
name = "Evils";
};
evris99 = {
name = "Evrymachos Koukoumakas";
github = "evris99";
@@ -10347,6 +10334,11 @@
github = "higebu";
githubId = 733288;
};
higherorderlogic = {
name = "Hol";
github = "HigherOrderLogic";
githubId = 73709188;
};
hirenashah = {
email = "hiren@hiren.io";
github = "hirenashah";
@@ -11082,6 +11074,13 @@
githubId = 54999;
name = "Ariel Nunez";
};
insipx = {
email = "github@andrewplaza.dev";
github = "insipx";
githubId = 6452260;
name = "Andrew Plaza";
keys = [ { fingerprint = "843D 72A9 EB79 A869 2C58 5B3A E773 8A7A 0F5C DB89"; } ];
};
Intuinewin = {
email = "antoinelabarussias@gmail.com";
github = "Intuinewin";
@@ -14160,14 +14159,6 @@
keys = [ { fingerprint = "5A9A 1C9B 2369 8049 3B48 CF5B 81A1 5409 4816 2372"; } ];
};
l-as = {
email = "las@protonmail.ch";
matrix = "@Las:matrix.org";
github = "L-as";
githubId = 22075344;
keys = [ { fingerprint = "A093 EA17 F450 D4D1 60A0 1194 AC45 8A7D 1087 D025"; } ];
name = "Las Safin";
};
l0b0 = {
email = "victor@engmark.name";
github = "l0b0";
@@ -15899,6 +15890,12 @@
githubId = 33522919;
name = "Marshall Arruda";
};
mart-mihkel = {
email = "mart.mihkel.aun@gmail.com";
github = "mart-mihkel";
githubId = 73405010;
name = "Mart-Mihkel Aun";
};
martijnvermaat = {
email = "martijn@vermaat.name";
github = "martijnvermaat";
@@ -21661,6 +21658,11 @@
githubId = 77415970;
name = "Redhawk";
};
redianthus = {
github = "redianthus";
githubId = 16472988;
name = "redianthus";
};
redlonghead = {
email = "git@beardit.net";
github = "Redlonghead";
@@ -26255,6 +26257,12 @@
githubId = 74688871;
name = "Tochukwu Ahanonu";
};
tom94 = {
email = "nix@94.me";
github = "Tom94";
githubId = 4923655;
name = "Thomas Müller";
};
tomahna = {
email = "kevin.rauscher@tomahna.fr";
github = "Tomahna";
maintainers/scripts/README.md
+1 -1
View File
@@ -1,7 +1,7 @@
# Maintainer scripts
This folder contains various executable scripts for nixpkgs maintainers, and supporting data or nixlang files as needed.
These scripts generally aren't a stable interface and may changed or be removed.
These scripts generally aren't a stable interface and may be changed or be removed.
What follows is a (very incomplete) overview of available scripts.
maintainers/scripts/bootstrap-files/README.md
+1 -1
View File
@@ -1,6 +1,6 @@
# Bootstrap files
Currently `nixpkgs` builds most of it's packages using bootstrap seed binaries (without the reliance on external inputs):
Currently `nixpkgs` builds most of its packages using bootstrap seed binaries (without the reliance on external inputs):
- `bootstrap-tools`: an archive with the compiler toolchain and other helper tools enough to build the rest of the `nixpkgs`.
- initial binaries needed to unpack `bootstrap-tools.*`.
maintainers/team-list.nix
+12 -1
View File
@@ -45,6 +45,17 @@ with lib.maintainers;
enableFeatureFreezePing = true;
};
agda = {
members = [
alexarice
ncfavier
phijor
turion
];
scope = "Maintain Agda-related packages and modules.";
shortName = "Agda";
};
android = {
members = [
adrian-gierakowski
@@ -1125,7 +1136,7 @@ with lib.maintainers;
LunNova
mschwaig
];
githubTeams = [ "rocm-maintainers" ];
githubTeams = [ "rocm" ];
scope = "Maintain ROCm and related packages.";
shortName = "ROCm";
};
nixos/doc/manual/development/freeform-modules.section.md
+1 -1
View File
@@ -50,7 +50,7 @@ And the following shows what such a module then allows
# Not a declared option, but the freeform type allows this
settings.logLevel = "debug";
# Not allowed because the the freeform type only allows strings
# Not allowed because the freeform type only allows strings
# settings.enable = true;
# Allowed because there is a port option declared
nixos/doc/manual/installation/installing.chapter.md
+1 -1
View File
@@ -254,7 +254,7 @@ update /etc/fstab.
# parted /dev/sda -- mklabel msdos
```
2. Add the *root* partition. This will fill the the disk except for the
2. Add the *root* partition. This will fill the disk except for the
end part, where the swap will live.
```ShellSession
nixos/doc/manual/manual.md
+2 -2
View File
@@ -7,11 +7,11 @@
the manual structure extends the nixpkgs commonmark further with include
blocks to allow better organization of input text. there are six types of
include blocks: preface, parts, chapters, sections, appendix, and options.
each type except `options`` corresponds to the docbook elements of (roughly)
each type except `options` corresponds to the docbook elements of (roughly)
the same name, and can itself can further include blocks to denote its
substructure.
non-`options`` include blocks are fenced code blocks that list a number of
non-`options` include blocks are fenced code blocks that list a number of
files to include, in the form
```{=include=} <type>
nixos/doc/manual/redirects.json
+24
View File
@@ -1,4 +1,28 @@
{
"module-security-tpm2": [
"index.html#module-security-tpm2"
],
"module-security-tpm2-introduction": [
"index.html#module-security-tpm2-introduction"
],
"module-security-tpm2-introduction-hli": [
"index.html#module-security-tpm2-introduction-hli"
],
"module-security-tpm2-introduction-resourcemanagers": [
"index.html#module-security-tpm2-introduction-resourcemanagers"
],
"module-security-tpm2-introduction-softwarearchitecture": [
"index.html#module-security-tpm2-introduction-softwarearchitecture"
],
"module-security-tpm2-introduction-softwarearchitecture-tcti": [
"index.html#module-security-tpm2-introduction-softwarearchitecture-tcti"
],
"module-security-tpm2-nixosmodule": [
"index.html#module-security-tpm2-nixosmodule"
],
"module-security-tpm2-nixosmodule-fapiconfiguration": [
"index.html#module-security-tpm2-nixosmodule-fapiconfiguration"
],
"module-boot-plymouth-tpm2-totp": [
"index.html#module-boot-plymouth-tpm2-totp"
],
nixos/doc/manual/release-notes/rl-1603.section.md
+1 -1
View File
@@ -217,7 +217,7 @@ When upgrading from a previous release, please be aware of the following incompa
- `services.udev.extraRules` option now writes rules to `99-local.rules` instead of `10-local.rules`. This makes all the user rules apply after others, so their results wouldn't be overridden by anything else.
- Large parts of the `services.gitlab` module has been been rewritten. There are new configuration options available. The `stateDir` option was renamned to `statePath` and the `satellitesDir` option was removed. Please review the currently available options.
- Large parts of the `services.gitlab` module have been rewritten. There are new configuration options available. The `stateDir` option was renamed to `statePath` and the `satellitesDir` option was removed. Please review the currently available options.
- The option `services.nsd.zones.<name>.data` no longer interpret the dollar sign (\$) as a shell variable, as such it should not be escaped anymore. Thus the following zone data:
nixos/doc/manual/release-notes/rl-1709.section.md
+1 -1
View File
@@ -33,7 +33,7 @@ In addition to numerous new and upgraded packages, this release has the followin
Options to configure `resolver` options and `upstream` blocks have been introduced. See their information for further details.
The `port` option has been replaced by a more generic `listen` option which makes it possible to specify multiple addresses, ports and SSL configs dependant on the new SSL handling mentioned above.
The `port` option has been replaced by a more generic `listen` option which makes it possible to specify multiple addresses, ports and SSL configs dependent on the new SSL handling mentioned above.
## New Services {#sec-release-17.09-new-services}
nixos/doc/manual/release-notes/rl-2003.section.md
+1 -1
View File
@@ -59,7 +59,7 @@ In addition to numerous new and upgraded packages, this release has the followin
{ services.xserver.displayManager.defaultSession = "xfce+icewm"; }
```
- The testing driver implementation in NixOS is now in Python `make-test-python.nix`. This was done by Jacek Galowicz ([\@tfc](https://github.com/tfc)), and with the collaboration of Julian Stecklina ([\@blitz](https://github.com/blitz)) and Jana Traue ([\@jtraue](https://github.com/jtraue)). All documentation has been updated to use this testing driver, and a vast majority of the 286 tests in NixOS were ported to python driver. In 20.09 the Perl driver implementation, `make-test.nix`, is slated for removal. This should give users of the NixOS integration framework a transitory period to rewrite their tests to use the Python implementation. Users of the Perl driver will see this warning everytime they use it:
- The testing driver implementation in NixOS is now in Python `make-test-python.nix`. This was done by Jacek Galowicz ([\@tfc](https://github.com/tfc)), and with the collaboration of Julian Stecklina ([\@blitz](https://github.com/blitz)) and Jana Traue ([\@jtraue](https://github.com/jtraue)). All documentation has been updated to use this testing driver, and a vast majority of the 286 tests in NixOS were ported to python driver. In 20.09 the Perl driver implementation, `make-test.nix`, is slated for removal. This should give users of the NixOS integration framework a transitory period to rewrite their tests to use the Python implementation. Users of the Perl driver will see this warning every time they use it:
```ShellSession
$ warning: Perl VM tests are deprecated and will be removed for 20.09.
nixos/doc/manual/release-notes/rl-2009.section.md
+1 -1
View File
@@ -580,7 +580,7 @@ When upgrading from a previous release, please be aware of the following incompa
Please note that Rust packages utilizing a custom build/install procedure (e.g. by using a `Makefile`) or test suites that rely on the structure of the `target/` directory may break due to those assumptions. For further information, please read the Rust section in the Nixpkgs manual.
- The cc- and binutils-wrapper's "infix salt" and `_BUILD_` and `_TARGET_` user infixes have been replaced with with a "suffix salt" and suffixes and `_FOR_BUILD` and `_FOR_TARGET`. This matches the autotools convention for env vars which standard for these things, making interfacing with other tools easier.
- The cc- and binutils-wrapper's "infix salt" and `_BUILD_` and `_TARGET_` user infixes have been replaced with a "suffix salt" and suffixes and `_FOR_BUILD` and `_FOR_TARGET`. This matches the autotools convention for env vars which standard for these things, making interfacing with other tools easier.
- Additional Git documentation (HTML and text files) is now available via the `git-doc` package.
nixos/doc/manual/release-notes/rl-2205.section.md
+1 -1
View File
@@ -754,7 +754,7 @@ In addition to numerous new and upgraded packages, this release has the followin
Similarly [virtualisation.vmVariantWithBootloader](#opt-virtualisation.vmVariantWithBootLoader) was added.
- The configuration portion of the `nix-daemon` module has been reworked and exposed as [nix.settings](options.html#opt-nix-settings):
* Legacy options have been mapped to the corresponding options under under [nix.settings](options.html#opt-nix.settings) and will be deprecated when NixOS 21.11 reaches end of life.
* Legacy options have been mapped to the corresponding options under [nix.settings](options.html#opt-nix.settings) and will be deprecated when NixOS 21.11 reaches end of life.
* [nix.buildMachines.publicHostKey](options.html#opt-nix.buildMachines.publicHostKey) has been added.
- [`kops`](https://kops.sigs.k8s.io) defaults to 1.23.2, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes >= 1.22. This will increase security by default, but may break some types of workloads. The default behaviour for `spec.kubeDNS.nodeLocalDNS.forwardToKubeDNS` has changed from `true` to `false`. Cilium now has `disable-cnp-status-updates: true` by default. Set this to false if you rely on the CiliumNetworkPolicy status fields. Support for Kubernetes 1.17, the Lyft CNI, Weave CNI on Kubernetes >= 1.23, CentOS 7 and 8, Debian 9, RHEL 7, and Ubuntu 16.05 (Xenial) has been removed. See the [1.22 release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) and [1.23 release notes](https://kops.sigs.k8s.io/releases/1.23-notes/) for more details, including other significant changes.
nixos/doc/manual/release-notes/rl-2211.section.md
+1 -1
View File
@@ -106,7 +106,7 @@ In addition to numerous new and upgraded packages, this release includes the fol
been removed. Please convert any uses to
[services.logrotate.settings](#opt-services.logrotate.settings) instead.
- The `isPowerPC` predicate, found on `platform` attrsets (`hostPlatform`, `buildPlatform`, `targetPlatform`, etc) has been removed in order to reduce confusion. The predicate was was defined such that it matches only the 32-bit big-endian members of the POWER/PowerPC family, despite having a name which would imply a broader set of systems. If you were using this predicate, you can replace `foo.isPowerPC` with `(with foo; isPower && is32bit && isBigEndian)`.
- The `isPowerPC` predicate, found on `platform` attrsets (`hostPlatform`, `buildPlatform`, `targetPlatform`, etc) has been removed in order to reduce confusion. The predicate was defined such that it matches only the 32-bit big-endian members of the POWER/PowerPC family, despite having a name which would imply a broader set of systems. If you were using this predicate, you can replace `foo.isPowerPC` with `(with foo; isPower && is32bit && isBigEndian)`.
- The `fetchgit` fetcher now uses [cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalscone_mode_handling) by default for sparse checkouts. [Non-cone mode](https://www.git-scm.com/docs/git-sparse-checkout/2.37.0#_internalsnon_cone_problems) can be enabled by passing `nonConeMode = true`, but note that non-cone mode is deprecated and this option may be removed alongside a future Git update without notice.
nixos/doc/manual/release-notes/rl-2311.section.md
+1 -1
View File
@@ -248,7 +248,7 @@ Make sure to also check the many updates in the [Nixpkgs library](#sec-release-2
attribute values of `phpOptions` are still defaults, these can be overridden
as shown here.
To override all of the options (including including `upload_max_filesize`,
To override all of the options (including `upload_max_filesize`,
`post_max_size` and `memory_limit` which all point to
[`services.nextcloud.maxUploadSize`](#opt-services.nextcloud.maxUploadSize)
by default) can be done like this:
nixos/doc/manual/release-notes/rl-2411.section.md
+1 -1
View File
@@ -1066,7 +1066,7 @@ Module System:
### Deprecations {#sec-release-24.11-lib-deprecations}
- [`lib.options.mkPackageOptionMD`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOptionMD) is now obsolete; use the identical [`lib.options.mkPackageOption`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOption) instead.
- `lib.options.mkPackageOptionMD` is now obsolete; use the identical [`lib.options.mkPackageOption`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOption) instead.
- `lib.misc.mapAttrsFlatten` is now formally deprecated and will be removed in future releases; use the identical [`lib.attrsets.mapAttrsToList`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.attrsets.mapAttrsToList) instead.
- `lib.isInOldestRelease`: Renamed to [`oldestSupportedReleaseIsAtLeast`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.oldestSupportedReleaseIsAtLeast) and deprecated.
nixos/doc/manual/release-notes/rl-2511.section.md
+8
View File
@@ -76,6 +76,8 @@
- [yubikey-manager](https://github.com/Yubico/yubikey-manager), a tool for configuring YubiKey devices. Available as [programs.yubikey-manager](#opt-programs.yubikey-manager.enable).
- [Linkwarden](https://linkwarden.app/) a self-hosted collaborative bookmark manager to collect, read, annotate, and fully preserve what matters, all in one place. Available as [services.linkwarden](#opt-services.linkwarden.enable).
- [Draupnir](https://github.com/the-draupnir-project/draupnir), a Matrix moderation bot. Available as [services.draupnir](#opt-services.draupnir.enable).
- [Pangolin](https://github.com/fosrl/pangolin), a tunneled reverse proxy server with access control. Available as [services.pangolin](#opt-services.pangolin.enable).
@@ -140,6 +142,8 @@
- [Sshwifty](https://github.com/nirui/sshwifty), a Telnet and SSH client for your browser. Available as [services.sshwifty](#opt-services.sshwifty.enable).
- Added `nixos-init`, a Rust-based bashless initialization system for systemd initrd. This allows to build NixOS systems without any interpreter. Enable via `system.nixos-init.enable = true;`.
- [nvme-rs](https://github.com/liberodark/nvme-rs), NVMe monitoring [services.nvme-rs](#opt-services.nvme-rs.enable).
- [ringboard](https://github.com/SUPERCILEX/clipboard-history), a fast, efficient, and composable clipboard manager for Linux. Available for x11 as [services.ringboard](#opt-services.ringboard.x11.enable) and for wayland as [services.ringboard](#opt-services.ringboard.wayland.enable).
@@ -222,6 +226,8 @@
- The `services.mysql` module now restarts the database `on-abnormal`, which means that it now will be restarted in certain situations, it wasn't before. For example an OOM-kill.
- The `services.tt-rss` module and package have been removed as upstream development ceased on 2025-11-01, and the source is no longer available officially.
- The `services.siproxd` module has been removed as `siproxd` is unmaintained and broken with libosip 5.x.
- `services.tor.torsocks.enable` no longer defaults to true if Tor and Tor client functionality is enabled.
@@ -253,6 +259,8 @@
- `i18n.inputMethod.fcitx5.plasma6Support` has been removed because qt6 is the only one used for fcitx5-configtool now.
- `firezone` has changed how the `Everyone` group behaves. Service Accounts are no longer considered part of `Everyone`.
- The `boot.readOnlyNixStore` has been removed. Control over bind mount options on `/nix/store` is now offered by the `boot.nixStoreMountOpts` option.
- The Postfix module has been updated and likely requires configuration changes:
nixos/lib/systemd-lib.nix
+26 -28
View File
@@ -349,6 +349,15 @@ rec {
)
);
settingsToSections =
settings:
concatStringsSep "\n" (
mapAttrsToList (section_name: section_attrs: ''
[${section_name}]
${attrsToSection section_attrs}
'') settings
);
generateUnits =
{
allowCollisions ? true,
@@ -724,10 +733,7 @@ rec {
commonUnitText =
def: lines:
''
[Unit]
${attrsToSection def.unitConfig}
''
(settingsToSections { Unit = def.unitConfig; })
+ lines
+ optionalString (def.wantedBy != [ ]) ''
@@ -745,10 +751,7 @@ rec {
enable
overrideStrategy
;
text = ''
[Unit]
${attrsToSection def.unitConfig}
'';
text = (settingsToSections { Unit = def.unitConfig; });
};
serviceToUnit = def: {
@@ -832,10 +835,9 @@ rec {
enable
overrideStrategy
;
text = commonUnitText def ''
[Timer]
${attrsToSection def.timerConfig}
'';
text = commonUnitText def (settingsToSections {
Timer = def.timerConfig;
});
};
pathToUnit = def: {
@@ -848,10 +850,9 @@ rec {
enable
overrideStrategy
;
text = commonUnitText def ''
[Path]
${attrsToSection def.pathConfig}
'';
text = commonUnitText def (settingsToSections {
Path = def.pathConfig;
});
};
mountToUnit = def: {
@@ -864,10 +865,9 @@ rec {
enable
overrideStrategy
;
text = commonUnitText def ''
[Mount]
${attrsToSection def.mountConfig}
'';
text = commonUnitText def (settingsToSections {
Mount = def.mountConfig;
});
};
automountToUnit = def: {
@@ -880,10 +880,9 @@ rec {
enable
overrideStrategy
;
text = commonUnitText def ''
[Automount]
${attrsToSection def.automountConfig}
'';
text = commonUnitText def (settingsToSections {
Automount = def.automountConfig;
});
};
sliceToUnit = def: {
@@ -896,10 +895,9 @@ rec {
enable
overrideStrategy
;
text = commonUnitText def ''
[Slice]
${attrsToSection def.sliceConfig}
'';
text = commonUnitText def (settingsToSections {
Slice = def.sliceConfig;
});
};
# Create a directory that contains systemd definition files from an attrset
nixos/lib/test-driver/src/test_driver/machine/__init__.py
+1 -2
View File
@@ -822,9 +822,8 @@ class Machine:
while True:
chunk = self.shell.recv(1024)
# No need to print empty strings, it means we are waiting.
if len(chunk) == 0:
continue
raise RuntimeError("Shell disconnected")
self.log(f"Guest shell says: {chunk!r}")
# NOTE: for this to work, nothing must be printed after this line!
if b"Spawning backdoor root shell..." in chunk:
nixos/modules/config/malloc.nix
+1 -1
View File
@@ -52,7 +52,7 @@ let
or (throw "scudo not supported on ${pkgs.stdenv.hostPlatform.system}");
in
{
libPath = "${pkgs.llvmPackages.compiler-rt}/lib/linux/libclang_rt.scudo-${systemPlatform}.so";
libPath = "${pkgs.llvmPackages.compiler-rt}/lib/linux/libclang_rt.scudo_standalone-${systemPlatform}.so";
description = ''
A user-mode allocator based on LLVM Sanitizer’s CombinedAllocator,
which aims at providing additional mitigations against heap based
nixos/modules/installer/netboot/netboot.nix
+1 -1
View File
@@ -96,7 +96,7 @@ with lib;
# Create the initrd
system.build.netbootRamdisk = pkgs.makeInitrdNG {
inherit (config.boot.initrd) compressor;
inherit (config.boot.initrd) compressor compressorArgs;
prepend = [ "${config.system.build.initialRamdisk}/initrd" ];
contents = [
nixos/modules/installer/tools/nix-fallback-paths.nix
+6 -6
View File
@@ -1,8 +1,8 @@
{
x86_64-linux = "/nix/store/0bvxg6fr61zrlhi93azhp8yfhb5rcrs9-nix-2.28.5";
i686-linux = "/nix/store/m5na49mxl4xpcs3xh086s5v08jqjhbmb-nix-2.28.5";
aarch64-linux = "/nix/store/95rhdhjfwbi7ilwy5j0knj1852p7x6c6-nix-2.28.5";
riscv64-linux = "/nix/store/cqiiv36c773023p6lp9h4ff57fjlzisk-nix-riscv64-unknown-linux-gnu-2.28.5";
x86_64-darwin = "/nix/store/xiw5636h616yi3balx96pmdk6b052rhk-nix-2.28.5";
aarch64-darwin = "/nix/store/sax8chv80d9fy4s0y3ahsr9y4kc2f0ib-nix-2.28.5";
x86_64-linux = "/nix/store/x30lnlgk1s16rynrfslbf8phr6h6rqf2-nix-2.31.2";
i686-linux = "/nix/store/ix94q6rrdg6cr4893cjpzdbmibhlm0dv-nix-2.31.2";
aarch64-linux = "/nix/store/xnybj9lk0kwvmr2va253avanq7m3cpyg-nix-2.31.2";
riscv64-linux = "/nix/store/33as1vqp8mq36nr5bb5gr7ziw1nf4q1v-nix-riscv64-unknown-linux-gnu-2.31.2";
x86_64-darwin = "/nix/store/b9dvary8rcljj7ajv1x64hwwch4cvyvp-nix-2.31.2";
aarch64-darwin = "/nix/store/lvv1j8qbrvlnl3aagcjrhf42d458zgb5-nix-2.31.2";
}
nixos/modules/module-list.nix
+1 -1
View File
@@ -1628,6 +1628,7 @@
./services/web-apps/lemmy.nix
./services/web-apps/libretranslate.nix
./services/web-apps/limesurvey.nix
./services/web-apps/linkwarden.nix
./services/web-apps/mainsail.nix
./services/web-apps/mastodon.nix
./services/web-apps/matomo.nix
@@ -1705,7 +1706,6 @@
./services/web-apps/suwayomi-server.nix
./services/web-apps/szurubooru.nix
./services/web-apps/trilium.nix
./services/web-apps/tt-rss.nix
./services/web-apps/umami.nix
./services/web-apps/vikunja.nix
./services/web-apps/wakapi.nix
nixos/modules/profiles/hardened.nix
+1 -1
View File
@@ -39,7 +39,7 @@ in
nix.settings.allowed-users = mkDefault [ "@users" ];
environment.memoryAllocator.provider = mkDefault "scudo";
environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1";
environment.variables.SCUDO_OPTIONS = mkDefault "zero_contents=true";
security.lockKernelModules = mkDefault true;
nixos/modules/programs/gpu-screen-recorder.nix
+1 -7
View File
@@ -32,13 +32,7 @@ in
owner = "root";
group = "root";
capabilities = "cap_sys_admin+ep";
source = "${package}/bin/gsr-kms-server";
};
security.wrappers."gpu-screen-recorder" = {
owner = "root";
group = "root";
capabilities = "cap_sys_nice+ep";
source = "${package}/bin/gpu-screen-recorder";
source = lib.getExe' package "gsr-kms-server";
};
};
nixos/modules/rename.nix
+3
View File
@@ -266,6 +266,9 @@ in
(mkRemovedOptionModule [ "services" "sourcehut" ] ''
The sourcehut packages and the corresponding module have been removed due to being broken and unmaintained.
'')
(mkRemovedOptionModule [ "services" "tt-rss" ] ''
The tt-rss package and module have been removed, since upstream development ceased 2025-11-01 and the source is no longer available officially.
'')
(mkRemovedOptionModule [ "services" "tvheadend" ]
"The tvheadend package and the corresponding module have been removed as nobody was willing to maintain them and they were stuck on an unmaintained version that required FFmpeg 4; please see https://github.com/NixOS/nixpkgs/pull/332259 if you are interested in maintaining a newer version."
)
nixos/modules/security/audit.nix
+4 -1
View File
@@ -95,7 +95,10 @@ in
environment.systemPackages = [ pkgs.audit ];
systemd.services.audit-rules = {
# upstream contains a audit-rules.service, which uses augenrules.
# That script does not handle cleanup correctly and insists on loading from /etc/audit.
# So, instead we have our own service for loading rules.
systemd.services.audit-rules-nixos = {
description = "Load Audit Rules";
wantedBy = [ "sysinit.target" ];
before = [
nixos/modules/security/auditd.nix
+14 -32
View File
@@ -229,7 +229,7 @@ in
path = lib.getExe' pkgs.audit "audisp-af_unix";
args = [
"0640"
"/var/run/audispd_events"
"/run/audit/audispd_events"
"string"
];
format = "binary";
@@ -256,41 +256,23 @@ in
};
};
systemd.services.auditd = {
description = "Security Audit Logging Service";
documentation = [ "man:auditd(8)" ];
wantedBy = [ "sysinit.target" ];
after = [
"local-fs.target"
"systemd-tmpfiles-setup.service"
];
before = [
"sysinit.target"
"shutdown.target"
];
conflicts = [ "shutdown.target" ];
systemd.packages = [ pkgs.audit.out ];
unitConfig = {
DefaultDependencies = false;
RefuseManualStop = true;
ConditionVirtualization = "!container";
ConditionKernelCommandLine = [
"!audit=0"
"!audit=off"
];
};
systemd.services.auditd = {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
# https://github.com/linux-audit/audit-userspace/pull/501
# set up audit directories using systemd service instead of tmpfiles
LogsDirectory = "audit";
ExecStart = "${pkgs.audit}/bin/auditd -l -n -s nochange";
Restart = "on-failure";
# Do not restart for intentional exits. See EXIT CODES section in auditd(8).
RestartPreventExitStatus = "2 4 6";
# Upstream hardening settings
MemoryDenyWriteExecute = true;
LockPersonality = true;
RestrictRealtime = true;
LogsDirectoryMode = "0700";
RuntimeDirectory = "audit";
RuntimeDirectoryMode = "0755";
ExecStart = [
# the upstream unit does not allow symlinks, so clear and rewrite the ExecStart
""
"${lib.getExe' pkgs.audit "auditd"} -l -s nochange"
];
};
};
};
nixos/modules/security/tpm2.md
+116
View File
@@ -0,0 +1,116 @@
# TPM2 {#module-security-tpm2}
## Introduction {#module-security-tpm2-introduction}
The `tpm2` module allows configuration of a number of programs and services associated with the use of a Trusted Platform Module (TPM).
A TPM is a hardware or firmware device that can be useful for security purposes.
One thing you can do with a TPM is to instruct it to create cryptographic keys which reside inside the TPM hardware, and which cannot be exported, not even to the computer hosting the TPM.
To make those keys useful, the TPM also exposes operations that you can perform using the keys.
So for instance, you can instruct the TPM to encrypt a piece of data using a cryptographic key protected by the TPM, or cryptographically sign a piece of data using a cryptographic key protected by the TPM.
A key stored directly on the TPM is called a resident key.
Because the TPM has very limited storage, it's common to work with another kind of key, called a wrapped key.
When you instruct the TPM to create a wrapped key, it creates a new key, encrypts the secret material using a key stored directly on the TPM, and returns the encrypted secret material along with some metadata to the user, in a file called the key context.
The TPM also supports operations where you provide it with the key context along with whatever you want to encrypt or sign, and it will unwrap the key and do the operation.
Another important concept is attestation.
The idea is that the user of a TPM may want to prove to a third party that a particular key is protected by the TPM hardware.
This is typically done by the manufacturer or distributor of the TPM hardware prior to distribution to the end user, and involves creating a resident key on the TPM, along with a certificate for that key signed by the manufacturer's or distributor's key.
The user can then provide the certificate to the third party along with the public portion of the resident key to prove that the key is protected by the TPM.
Most physical TPMs come with one resident key that also has a certificate.
This key is known as the Endorsement Key, or EK, and the certificate is known as the EK Certificate.
For applications where you want to be able to prove properties of a key to third parties, you will want a key that is wrapped by the EK.
Such keys are described as residing in the Endorsement Hierarchy.
If you do not require attestation, you will generally wrap your keys with the storage root key (SRK).
Such keys are described as residing in the Storage Hierarchy, or the Owners Hierarchy.
### Software Architecture {#module-security-tpm2-introduction-softwarearchitecture}
#### TCTI {#module-security-tpm2-introduction-softwarearchitecture-tcti}
TPM hardware uses a binary protocol called the TPM Command Transmission Interface, or TCTI, to communicate with the host computer.
The TPM kernel driver exposes a character device, typically `/dev/tpm0`, and one way of interacting with the TPM is to read and write the TCTI protocol to that device.
Of course doing that directly in your own code would be quite laborious, and there are a number of software libraries and programs that can help you do it.
The lowest level of these is C library called ESAPI, located inside the `tpm2-tss` package.
#### Resource Managers {#module-security-tpm2-introduction-resourcemanagers}
Another thing you need to know is that the TPM is a stateful device: operations can affect its state, and it's common to perform a sequence of operations where early operations modify the state, and later operations depend on that state to do other operations.
For instance, you may load a wrapped key to a particular storage location, then do an encryption operation using that loaded key.
This makes multi-user access challenging, as two users may modify the state in incompatible ways.
The solution to this is to use a resource manager.
The resource manager can handle multiple different sessions, keep track of the accumulated state of each session, and load and unload state as necessary to interleave multiple different sessions.
There are two resource managers available in the software stack surrounding the TPM: a kernel-space resource manager, and a user-space resource manager.
The kernel-space resource manager is exposed via the tpmrm subsystem.
You can see more info about that subsystem in the sysfs at `/sys/class/tpmrm`.
In a typical system you will also see a `/dev/tpmrm0` device, but it is possible to give it a different name.
The user-space resource manager is contained in the `tpm2-abrmd` package.
It is also frequently referred to as `tabrmd`.
Both resource managers are designed so that they use the same TCTI protocol as a raw tpm device.
For the kernel RM, you access it via a character device (typically `/dev/tpmrm0`).
For the userspace RM, you access it over DBUS.
It is common to refer to a component that is on the "receiving" or "server" side of the TCTI protocol as "a TCTI".
So the raw tpm character device, the kernel RM, and `tabrmd` are all "TCTIs".
The ESAPI library speaks the client side of the TCTI protocol, and can be connected to any server TCTI.
All of the other libraries or programs that work with TPM all use ESAPI under the hood, and so a common characteristic among all these libraries is that you will find you need to configure them in some way as to which TCTI they should be talking to.
#### Higher Level Interfaces {#module-security-tpm2-introduction-hli}
As alluded to previously, there are a number of ways of speaking the client side TCTI that all amount to wrappers around ESAPI. They include:
* FAPI - a C library with an easier API for managing cryptographic algorithms and keys, contained in the `tpm2-tss` package.
* pytss - a python library that wraps ESAPI and FAPI. Contained in the `tpm2-pytss` package.
* tpm2 tools - a command line interface exposed through the programs `tpm2`, which roughly corresponds to the ESAPI, and `tss2` which roughly corresponds to FAPI. Contained in the `tpm2-tools` package.
* pkcs11 - libraries that wrap TPM functionality into a pkcs11 interface. There are variants for the ESAPI, and the FAPI. See the `tpm2-pkcs11`, `tpm2-pkcs11-esapi` and `tpm2-pkcs11-fapi` packages.
* TPM2 OpenSSL - an OpenSSL provider allowing openssl to use the TPM as its cryptographic engine.
## Using the tpm2 NixOS module {#module-security-tpm2-nixosmodule}
A typical configuration is:
```
security.tpm2 = {
enable = true;
abrmd.enable = true;
pkcs11.enable = true;
tctiEnvironment.enable = true;
tctiEnvironment.interface = "tabrmd";
}
```
`enable = true;` is required for any tpm functionality other than the raw character device and kernel resource manager to be available.
`abrmd.enable = true;` causes the tpm2-abrmd program (the user-space resource manager) to run as a systemd service.
Generally you want this because the user-space resource manager gets more frequent updates than the kernel-space RM, and there aren't any kernel RM features that are unavailable in the user-space RM.
`pkcs11.enable = true;` makes the PKCS11 tool and libraries available in the system path.
Generally you want this because it's unlikely to cause problems and it's required by one of the more common TPM use cases, which is protecting an ssh key using the TPM.
`tctiEnvironment.enable = true;` and `tctiEnvironment.interface = "tabrmd";` causes the TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI environment variables to be set properly to use the user-space resource manager.
In other words, it configures all users to use the user-space resource manager for tpm2 tools and tpm2 pkcs11 by default.
### FAPI Configuration {#module-security-tpm2-nixosmodule-fapiconfiguration}
A reasonable FAPI config file is shipped by default and available in `/etc/tpm2-tss/fapi-config.json`.
The `tss2` command line utility in `tpm2-tools` will use this file by default.
If you wish to customize it, you can do so like this:
```
security.tpm2.fapi = {
profileName = "P_RSA2048SHA256";
};
```
This example changes the cryptographic profile from the default P_ECCP256SHA256 to P_RSA2048SHA256.
The profiles specify a number of algorithmic details, but the short version is that P_ECCP256SHA256 uses elliptic curve cryptography over the NIST P256 curve and SHA256 for hashes, while P_RSA2048SHA256 uses RSA 2048 bit keys and SHA256 for hashes.
Probably the most likely option you may want to use in the FAPI config would be `ekCertLess`.
If set to `null` (the default) or `false`, then FAPI calls will fail if the TPM does not have an EK certificate.
Most TPMs that come with physical computers will have an EK cert, so the default setting would not be a problem.
However, virtual TPMs may not have an EK certificate.
For instance, the Nitro TPM provided on some Amazon Web Services virtual machines does not come with an EK Cert.
In such cases, you may wish to set `ekCertLess = true;` so that FAPI is usable without an EK cert.
nixos/modules/security/tpm2.nix
+210 -2
View File
@@ -12,14 +12,39 @@ let
# the tssGroup is only allowed to access the kernel resource manager
# Therefore, if either of the two are null, the respective part isn't generated
udevRules = tssUser: tssGroup: ''
${lib.optionalString (tssUser != null) ''KERNEL=="tpm[0-9]*", MODE="0660", OWNER="${tssUser}"''}
${lib.optionalString (
tssUser != null
) ''KERNEL=="tpm[0-9]*", TAG+="systemd", MODE="0660", OWNER="${tssUser}"''}
${
lib.optionalString (tssUser != null || tssGroup != null) ''KERNEL=="tpmrm[0-9]*", MODE="0660"''
lib.optionalString (
tssUser != null || tssGroup != null
) ''KERNEL=="tpmrm[0-9]*", TAG+="systemd", MODE="0660"''
+ lib.optionalString (tssUser != null) '', OWNER="${tssUser}"''
+ lib.optionalString (tssGroup != null) '', GROUP="${tssGroup}"''
}
'';
fapiConfig = (
pkgs.writeText "fapi-config.json" (
builtins.toJSON (
{
profile_name = cfg.fapi.profileName;
profile_dir = cfg.fapi.profileDir;
user_dir = cfg.fapi.userDir;
system_dir = cfg.fapi.systemDir;
tcti = cfg.fapi.tcti;
system_pcrs = cfg.fapi.systemPcrs;
log_dir = cfg.fapi.logDir;
firmware_log_file = cfg.fapi.firmwareLogFile;
ima_log_file = cfg.fapi.imaLogFile;
}
// lib.optionalAttrs (cfg.fapi.ekCertLess != null) {
ek_cert_less = if cfg.fapi.ekCertLess then "yes" else "no";
}
// lib.optionalAttrs (cfg.fapi.ekFingerprint != null) { ek_fingerprint = cfg.fapi.ekFingerprint; }
)
)
);
in
{
options.security.tpm2 = {
@@ -123,6 +148,120 @@ in
default = "bus_name=com.intel.tss2.Tabrmd";
};
};
fapi = {
profileName = lib.mkOption {
description = ''
Name of the default cryptographic profile chosen from the profile_dir directory.
'';
type = lib.types.str;
default = "P_ECCP256SHA256";
};
profileDir = lib.mkOption {
description = ''
Directory that contains all cryptographic profiles known to FAPI.
'';
type = lib.types.str;
default = "${pkgs.tpm2-tss}/etc/tpm2-tss/fapi-profiles/";
defaultText = lib.literalExpression "\${pkgs.tpm2-tss}/etc/fapi-profiles/";
};
userDir = lib.mkOption {
description = ''
The directory where user objects are stored.
'';
type = lib.types.str;
default = "~/.local/share/tpm2-tss/user/keystore/";
};
systemDir = lib.mkOption {
description = ''
The directory where system objects, policies, and imported objects are stored.
'';
type = lib.types.str;
default = "/var/lib/tpm2-tss/keystore";
};
tcti = lib.mkOption {
description = ''
The TCTI which will be used.
An empty string indicates no TCTI is specified by the FAPI config.
If not specified in the FAPI config it can be specified by environment
variable (TPM2TOOLS_TCTI, TPM2_PKCS11_TCTI, etc) or a TCTI will be chosen
by the FAPI library by searching for tabrmd, device, and mssim TCTIs in
that order.
'';
type = lib.types.str;
default = "";
example = "device:/dev/tpmrm0";
};
systemPcrs = lib.mkOption {
description = ''
The PCR registers which are used by the system.
'';
type = lib.types.listOf lib.types.int;
default = [ ];
};
logDir = lib.mkOption {
description = ''
The directory for the event log.
'';
type = lib.types.str;
default = "/var/log/tpm2-tss/eventlog/";
};
ekCertLess = lib.mkOption {
description = ''
A switch to disable Endorsement Key (EK) certificate verification.
A value of null indicates that the generated fapi config file does not
contain a ek_cert_less key. The effect of not having that key at all is
the same as setting its value to false.
A value of false means that the tss2 cli will not work if there is no
EK Cert installed, or if the installed EK Cert can't be validated.
A value of true means that the tss2 cli will work even if there's no EK
cert installed.
'';
type = lib.types.nullOr lib.types.bool;
default = null;
};
ekFingerprint = lib.mkOption {
description = ''
The fingerprint of the endorsement key.
A value of null means that you have chosen not to specify the expected
fingerprint of the EK. You can still have an endorsement key, it just
won't get checked to see if it's fingerprint matches a particular value
before being used.
'';
type = lib.types.nullOr lib.types.str;
default = null;
};
firmwareLogFile = lib.mkOption {
description = ''
The binary bios measurements.
'';
type = lib.types.str;
default = "/sys/kernel/security/tpm0/binary_bios_measurements";
};
imaLogFile = lib.mkOption {
description = ''
The binary IMA measurements (Integrity Measurement Architecture).
'';
type = lib.types.str;
default = "/sys/kernel/security/ima/binary_runtime_measurements";
};
};
};
config = lib.mkIf cfg.enable (
@@ -161,8 +300,68 @@ in
);
}
{
# This script has the hash of the udev rules in it,
# and also writes that hash to
# /var/lib/tpm2-udev-trigger/hash.txt at the end.
# On each run, it checks to see if the hash embedded in the script
# matches the hash on disk. If they are different, that
# indicates that the udev rules created by this module
# have changed. In that case, a udev change is triggered
# for tpm and tpmrm devices so that the new rules are
# applied at the end of a nixos-rebuild switch or activate
systemd.services."tpm2-udev-trigger" =
let
udevHash =
if cfg.applyUdevRules then (builtins.hashString "md5" (udevRules cfg.tssUser cfg.tssGroup)) else "";
in
{
description = "Trigger udev change for TPM devices";
wants = [ "systemd-udevd.service" ];
after = [
"tpm2.target"
"systemd-udevd.service"
];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = pkgs.writeShellScript "tpm2-udev-trigger.sh" ''
stateDir=/var/lib/tpm2-udev-trigger
mkdir -p $stateDir
newHash=${udevHash}
hashFile=$stateDir/hash.txt
# if file exists, read old hash
if [ -f $hashFile ]; then
oldHash="$(< $hashFile)"
else
oldHash=""
fi
if [ "$oldHash" != "$newHash" ]; then
echo "TPM udev rules changed, triggering udev"
${config.systemd.package}/bin/udevadm trigger --subsystem-match=tpm --action=change
${config.systemd.package}/bin/udevadm trigger --subsystem-match=tpmrm --action=change
echo "$newHash" > $hashFile
else
echo "TPM udev rules unchanged, not triggering udev"
fi
'';
};
};
}
(lib.mkIf cfg.abrmd.enable {
systemd.services."tpm2-abrmd" = {
wants = [
"tpm2-udev-trigger.service"
"dev-tpm0.device"
];
after = [
"tpm2-udev-trigger.service"
"dev-tpm0.device"
];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "dbus";
@@ -177,8 +376,17 @@ in
services.dbus.packages = lib.singleton cfg.abrmd.package;
})
{
environment.etc."tpm2-tss/fapi-config.json".source = fapiConfig;
systemd.tmpfiles.rules = [
"d ${cfg.fapi.logDir} 2750 tss ${cfg.tssGroup} -"
"d ${cfg.fapi.systemDir} 2750 root ${cfg.tssGroup} -"
];
}
]
);
meta.doc = ./tpm2.md;
meta.maintainers = with lib.maintainers; [ lschuermann ];
}
nixos/modules/services/audio/music-assistant.nix
+1 -1
View File
@@ -85,7 +85,7 @@ in
lsof
]
++ lib.optionals (lib.elem "spotify" cfg.providers) [
librespot
librespot-ma
]
++ lib.optionals (lib.elem "snapcast" cfg.providers) [
snapcast
nixos/modules/services/desktops/linyaps.nix
+3
View File
@@ -22,6 +22,8 @@ in
package = lib.mkPackageOption pkgs "linyaps" { };
boxPackage = lib.mkPackageOption pkgs "linyaps-box" { };
webStoreInstallerPackage = lib.mkPackageOption pkgs "linyaps-web-store-installer" { };
};
};
@@ -33,6 +35,7 @@ in
systemPackages = [
cfg.package
cfg.boxPackage
cfg.webStoreInstallerPackage
];
};
nixos/modules/services/hardware/fancontrol.nix
-2
View File
@@ -52,6 +52,4 @@ in
'';
};
meta.maintainers = [ lib.maintainers.evils ];
}
nixos/modules/services/hardware/rasdaemon.nix
-3
View File
@@ -176,7 +176,4 @@ in
};
};
};
meta.maintainers = [ lib.maintainers.evils ];
}
nixos/modules/services/matrix/maubot.md
+1 -1
View File
@@ -100,7 +100,7 @@ framework for Matrix.
url: https://matrix.example.org
secret: your-very-secret-key
```
10. Restart Maubot after editing `/var/lib/maubot/config.yaml`,and
10. Restart Maubot after editing `/var/lib/maubot/config.yaml`, and
Maubot will be available at
`https://matrix.example.org/_matrix/maubot`. If you want to use the
`mbc` CLI, it's available using the `maubot` package (`nix-shell -p
nixos/modules/services/matrix/mautrix-whatsapp.md
+1 -1
View File
@@ -13,7 +13,7 @@
::: {.warning}
Mautrix-Whatsapp allows for some options like `encryption.pickle_key`,
`provisioning.shared_secret`, allow the value `generate` to be set.
`provisioning.shared_secret`, to allow the value `generate` to be set.
Since the configuration file is regenerated on every start of the
service, the generated values would be discarded and might break your
installation. Instead, set those values via
nixos/modules/services/misc/redmine.nix
+4 -2
View File
@@ -461,19 +461,21 @@ in
CapabilityBoundingSet = "";
LockPersonality = true;
MemoryDenyWriteExecute = true;
MountAPIVFS = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectControlGroups = "strict";
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "noaccess";
ProtectProc = "invisible";
ProtectSystem = "strict";
ReadWritePaths = [
cfg.stateDir
nixos/modules/services/monitoring/tuptime.nix
-3
View File
@@ -89,7 +89,4 @@ in
};
};
};
meta.maintainers = [ lib.maintainers.evils ];
}
nixos/modules/services/monitoring/vnstat.nix
-2
View File
@@ -58,6 +58,4 @@ in
};
};
};
meta.maintainers = [ lib.maintainers.evils ];
}
nixos/modules/services/networking/firezone/provision.exs
+1 -1
View File
@@ -343,7 +343,7 @@ defmodule Provision do
case Map.get(changes, {:account, slug}) do
{:new, account} ->
Logger.info("Creating everyone group for new account")
{:ok, actor_group} = Actors.create_managed_group(account, %{name: "Everyone", membership_rules: [%{operator: true}]})
{:ok, actor_group} = Actors.create_managed_group(account, %{name: "Everyone"})
UuidMapping.update_entities(slug, "actor_groups", %{"everyone" => actor_group.id})
{:ok, actor_group}
{:existing, _account} ->
nixos/modules/services/networking/firezone/server.nix
+4 -1
View File
@@ -546,7 +546,6 @@ in
};
in
{
flow_activities = mkFeatureOption "flow_activities" true;
policy_conditions = mkFeatureOption "policy_conditions" true;
multi_site_resources = mkFeatureOption "multi_site_resources" true;
traffic_filters = mkFeatureOption "traffic_filters" true;
@@ -923,9 +922,13 @@ in
{
name = "firezone";
ensureDBOwnership = true;
ensureClauses.superuser = true;
}
];
ensureDatabases = [ "firezone" ];
# Firezone uses an internal replication strategy
# that depends on a logical wal
settings.wal_level = "logical";
};
services.firezone.server.settings = {
nixos/modules/services/networking/murmur.nix
+2 -1
View File
@@ -347,9 +347,10 @@ in
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectControlGroups = "strict";
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
nixos/modules/services/security/opensnitch.nix
+9
View File
@@ -161,6 +161,15 @@ in
'';
};
Audit.AudispSocketPath = lib.mkOption {
type = lib.types.path;
default = "/run/audit/audispd_events";
description = ''
Configure audit socket path. Used when
`settings.ProcMonitorMethod` is set to `audit`.
'';
};
Rules.Path = lib.mkOption {
type = lib.types.path;
default = "/var/lib/opensnitch/rules";
nixos/modules/services/web-apps/gerrit.nix
+8 -3
View File
@@ -219,28 +219,33 @@ in
'';
serviceConfig = {
CacheDirectory = "gerrit";
DynamicUser = true;
ExecStart = "${gerrit-cli}/bin/gerrit daemon --console-log";
LimitNOFILE = 4096;
StandardInput = "socket";
StandardOutput = "journal";
StateDirectory = "gerrit";
StateDirectoryMode = "750";
CacheDirectory = "gerrit";
CacheDirectoryMode = "750";
WorkingDirectory = "%S/gerrit";
AmbientCapabilities = "";
CapabilityBoundingSet = "";
LockPersonality = true;
MountAPIVFS = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectControlGroups = "strict";
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "noaccess";
ProtectProc = "invisible";
ProtectSystem = "full";
RestrictAddressFamilies = [
"AF_UNIX"
nixos/modules/services/web-apps/glance.md
+1 -1
View File
@@ -7,7 +7,7 @@ more about it.
## Quickstart {#module-services-glance-quickstart}
Checkout the [configuration docs](https://github.com/glanceapp/glance/blob/main/docs/configuration.md) to learn more.
Check out the [configuration docs](https://github.com/glanceapp/glance/blob/main/docs/configuration.md) to learn more.
Use the following configuration to start a public instance of Glance locally:
```nix
nixos/modules/services/web-apps/hatsu.md
+1 -1
View File
@@ -4,7 +4,7 @@
## Quickstart {#module-services-hatsu-quickstart}
the minimum configuration to start hatsu server would look like this:
The minimum configuration to start hatsu server would look like this:
```nix
{
nixos/modules/services/web-apps/immich.nix
+43 -1
View File
@@ -10,6 +10,10 @@ let
isPostgresUnixSocket = lib.hasPrefix "/" cfg.database.host;
isRedisUnixSocket = lib.hasPrefix "/" cfg.redis.host;
# convert a Nix attribute path to jq object identifier-index:
# https://jqlang.org/manual/#object-identifier-index
attrPathToIndex = attrPath: "." + lib.concatStringsSep "." attrPath;
commonServiceConfig = {
Type = "simple";
Restart = "on-failure";
@@ -147,6 +151,27 @@ in
);
};
secretSettings = mkOption {
default = { };
description = ''
Secrets to to be added to the JSON file generated from {option}`settings`, read from files.
'';
example = lib.literalExpression ''
{
notifications.smtp.transport.password = "/path/to/secret";
oauth.clientSecret = "/path/to/other/secret";
}
'';
type =
let
inherit (types) attrsOf either path;
recursiveType = either (attrsOf recursiveType) path // {
description = "nested " + (attrsOf path).description;
};
in
recursiveType;
};
machine-learning = {
enable =
mkEnableOption "immich's machine-learning functionality to detect faces and search for objects"
@@ -353,7 +378,7 @@ in
IMMICH_MACHINE_LEARNING_URL = "http://localhost:3003";
}
// lib.optionalAttrs (cfg.settings != null) {
IMMICH_CONFIG_FILE = "${format.generate "immich.json" cfg.settings}";
IMMICH_CONFIG_FILE = "/run/immich/config.json";
};
services.immich.machine-learning.environment = {
@@ -382,7 +407,24 @@ in
postgresqlPackage
];
preStart = mkIf (cfg.settings != null) (
''
cat '${format.generate "immich-config.json" cfg.settings}' > /run/immich/config.json
''
+ lib.concatStrings (
lib.mapAttrsToListRecursive (attrPath: _: ''
tmp="$(mktemp)"
${lib.getExe pkgs.jq} --rawfile secret "$CREDENTIALS_DIRECTORY/${attrPathToIndex attrPath}" \
'${attrPathToIndex attrPath} = $secret' /run/immich/config.json > "$tmp"
mv "$tmp" /run/immich/config.json
'') cfg.secretSettings
)
);
serviceConfig = commonServiceConfig // {
LoadCredential = lib.mapAttrsToListRecursive (
attrPath: file: "${attrPathToIndex attrPath}:${file}"
) cfg.secretSettings;
ExecStart = lib.getExe cfg.package;
EnvironmentFile = mkIf (cfg.secretsFile != null) cfg.secretsFile;
Slice = "system-immich.slice";
nixos/modules/services/web-apps/lemmy.md
+2 -2
View File
@@ -4,7 +4,7 @@ Lemmy is a federated alternative to reddit in rust.
## Quickstart {#module-services-lemmy-quickstart}
the minimum to start lemmy is
The minimum to start lemmy is
```nix
{
@@ -19,7 +19,7 @@ the minimum to start lemmy is
}
```
this will start the backend on port 8536 and the frontend on port 1234.
This will start the backend on port 8536 and the frontend on port 1234.
It will expose your instance with a caddy reverse proxy to the hostname you've provided.
Postgres will be initialized on that same instance automatically.
nixos/modules/services/web-apps/limesurvey.nix
+2 -1
View File
@@ -45,7 +45,7 @@ let
limesurveyConfig = pkgs.writeText "config.php" ''
<?php
return \array_merge(
return \array_merge_recursive(
\json_decode('${builtins.toJSON cfg.config}', true),
[
'config' => [
@@ -304,6 +304,7 @@ in
config = {
tempdir = "${stateDir}/tmp";
uploaddir = "${stateDir}/upload";
userquestionthemerootdir = "${stateDir}/upload/themes/question";
force_ssl = mkIf (
cfg.virtualHost.addSSL || cfg.virtualHost.forceSSL || cfg.virtualHost.onlySSL
) "on";
nixos/modules/services/web-apps/linkwarden.nix
+293
View File
@@ -0,0 +1,293 @@
{
lib,
config,
pkgs,
...
}:
let
cfg = config.services.linkwarden;
isPostgresUnixSocket = lib.hasPrefix "/" cfg.database.host;
inherit (lib)
types
mkIf
mkOption
mkEnableOption
;
commonServiceConfig = {
Type = "simple";
Restart = "on-failure";
RestartSec = 3;
EnvironmentFile = cfg.environmentFile;
StateDirectory = "linkwarden";
CacheDirectory = "linkwarden";
User = cfg.user;
Group = cfg.group;
# Hardening
CapabilityBoundingSet = "";
NoNewPrivileges = true;
PrivateUsers = true;
PrivateTmp = true;
PrivateDevices = true;
PrivateMounts = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
secret = types.nullOr (
types.str
// {
# We don't want users to be able to pass a path literal here but
# it should look like a path.
check = it: lib.isString it && lib.types.path.check it;
}
);
startupScript =
arg:
if cfg.secretFiles == { } then
"${lib.getExe cfg.package}" + arg
else
pkgs.writeShellScript "linkwarden-env" ''
${lib.strings.concatStringsSep "\n" (
lib.attrsets.mapAttrsToList (key: path: "export ${key}=$(< \"${path}\")") cfg.secretFiles
)}
${lib.getExe cfg.package}${arg}
'';
in
{
options.services.linkwarden = {
enable = mkEnableOption "Linkwarden";
package = lib.mkPackageOption pkgs "linkwarden" { };
storageLocation = mkOption {
type = types.path;
default = "/var/lib/linkwarden";
description = "Directory used to store media files. If it is not the default, the directory has to be created manually such that the linkwarden user is able to read and write to it.";
};
cacheLocation = mkOption {
type = types.path;
default = "/var/cache/linkwarden";
description = "Directory used as cache. If it is not the default, the directory has to be created manually such that the linkwarden user is able to read and write to it.";
};
enableRegistration = mkEnableOption "registration for new users";
environment = mkOption {
type = types.attrsOf types.str;
default = { };
example = {
PAGINATION_TAKE_COUNT = "50";
};
description = ''
Extra configuration environment variables. Refer to the [documentation](https://docs.linkwarden.app/self-hosting/environment-variables) for options.
'';
};
environmentFile = mkOption {
type = secret;
example = "/run/secrets/linkwarden";
default = null;
description = ''
Path of a file with extra environment variables to be loaded from disk.
This file is not added to the nix store, so it can be used to pass secrets to linkwarden.
Refer to the [documentation](https://docs.linkwarden.app/self-hosting/environment-variables) for options.
Linkwarden needs at least a nextauth secret. To set a database password use POSTGRES_PASSWORD:
```
NEXTAUTH_SECRET=<secret>
POSTGRES_PASSWORD=<pass>
```
'';
};
secretFiles = mkOption {
type = types.attrsOf secret;
example = {
POSTGRES_PASSWORD = "/run/secrets/linkwarden_postgres_passwd";
NEXTAUTH_SECRET = "/run/secrets/linkwarden_secret";
};
default = { };
description = ''
Attribute set containing paths to files to add to the environment of linkwarden.
The files are not added to the nix store, so they can be used to pass secrets to linkwarden.
Refer to the [documentation](https://docs.linkwarden.app/self-hosting/environment-variables) for options.
Linkwarden needs at least a nextauth secret. To set a database password use POSTGRES_PASSWORD:
```
NEXTAUTH_SECRET=<secret>
POSTGRES_PASSWORD=<pass>
```
'';
};
host = mkOption {
type = types.str;
default = "localhost";
description = "The host that Linkwarden will listen on.";
};
port = mkOption {
type = types.port;
default = 3000;
description = "The port that Linkwarden will listen on.";
};
openFirewall = mkOption {
type = types.bool;
default = false;
description = "Whether to open the Linkwarden port in the firewall";
};
user = mkOption {
type = types.str;
default = "linkwarden";
description = "The user Linkwarden should run as.";
};
group = mkOption {
type = types.str;
default = "linkwarden";
description = "The group Linkwarden should run as.";
};
database = {
createLocally = mkEnableOption "the automatic creation of the database for Linkwarden." // {
default = true;
};
name = mkOption {
type = types.str;
default = "linkwarden";
description = "The name of the Linkwarden database.";
};
host = mkOption {
type = types.str;
default = "/run/postgresql";
example = "localhost";
description = "Hostname or address of the postgresql server. If an absolute path is given here, it will be interpreted as a unix socket path.";
};
port = mkOption {
type = types.port;
default = 5432;
description = "Port of the postgresql server.";
};
user = mkOption {
type = types.str;
default = "linkwarden";
description = "The database user for Linkwarden.";
};
};
};
config = mkIf cfg.enable {
assertions = [
{
assertion = cfg.database.createLocally -> cfg.database.name == cfg.database.user;
message = "The postgres module requires the database name and the database user name to be the same.";
}
{
assertion = cfg.environmentFile == null -> cfg.secretFiles ? "NEXTAUTH_SECRET";
message = ''
Linkwarden needs at least a nextauth secret to run.
Use either the environmentFile or secretFiles.NEXTAUTH_SECRET to provide one.
'';
}
];
services.postgresql = mkIf cfg.database.createLocally {
enable = true;
ensureDatabases = [ cfg.database.name ];
ensureUsers = [
{
name = cfg.database.user;
ensureDBOwnership = true;
ensureClauses.login = true;
}
];
};
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
services.linkwarden.environment = {
LINKWARDEN_HOST = cfg.host;
LINKWARDEN_PORT = toString cfg.port;
LINKWARDEN_CACHE_DIR = cfg.cacheLocation;
STORAGE_FOLDER = cfg.storageLocation;
NEXT_PUBLIC_DISABLE_REGISTRATION = mkIf (!cfg.enableRegistration) "true";
NEXT_TELEMETRY_DISABLED = "1";
DATABASE_URL = mkIf isPostgresUnixSocket "postgresql://${lib.strings.escapeURL cfg.database.user}@localhost/${lib.strings.escapeURL cfg.database.name}?host=${cfg.database.host}";
DATABASE_PORT = toString cfg.database.port;
DATABASE_HOST = mkIf (!isPostgresUnixSocket) cfg.database.host;
DATABASE_NAME = cfg.database.name;
DATABASE_USER = cfg.database.user;
};
systemd.services.linkwarden = {
description = "Linkwarden (Self-hosted collaborative bookmark manager to collect, organize, and preserve webpages, articles, and more...)";
requires = [
"network-online.target"
]
++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
after = [
"network-online.target"
]
++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
wantedBy = [ "multi-user.target" ];
environment = cfg.environment // {
# Required, otherwise chrome dumps core
CHROME_CONFIG_HOME = cfg.cacheLocation;
};
serviceConfig = commonServiceConfig // {
ExecStart = startupScript "";
};
};
systemd.services.linkwarden-worker = {
description = "Linkwarden (worker process)";
requires = [
"network-online.target"
"linkwarden.service"
]
++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
after = [
"network-online.target"
"linkwarden.service"
]
++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
wantedBy = [ "multi-user.target" ];
environment = cfg.environment // {
# Required, otherwise chrome dumps core
CHROME_CONFIG_HOME = cfg.cacheLocation;
};
serviceConfig = commonServiceConfig // {
ExecStart = startupScript " worker";
};
};
users.users = mkIf (cfg.user == "linkwarden") {
linkwarden = {
name = "linkwarden";
group = cfg.group;
isSystemUser = true;
};
};
users.groups = mkIf (cfg.group == "linkwarden") { linkwarden = { }; };
meta.maintainers = with lib.maintainers; [ jvanbruegge ];
};
}
nixos/modules/services/web-apps/ocis.md
+1 -1
View File
@@ -33,7 +33,7 @@ A very basic configuration may look like this:
This will start the oCIS server and make it available at `https://localhost:9200`
However to make this configuration work you will need generate a configuration.
However, to make this configuration work, you will need to generate a configuration.
You can do this with:
```console
nixos/modules/services/web-apps/pixelfed.nix
-1
View File
@@ -524,7 +524,6 @@ in
'';
extraConfig = ''
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
index index.html index.htm index.php;
error_page 404 /index.php;
nixos/modules/services/web-apps/szurubooru.md
+1 -1
View File
@@ -31,7 +31,7 @@ Here is a basic configuration:
## Reverse proxy configuration {#module-services-szurubooru-reverse-proxy-configuration}
The prefered method to run this service is behind a reverse proxy not to expose an open port. For example, here is a minimal Nginx configuration:
The preferred method to run this service is behind a reverse proxy not to expose an open port. For example, here is a minimal Nginx configuration:
```nix
{
nixos/modules/services/web-apps/tt-rss.nix
-712
View File
@@ -1,712 +0,0 @@
{
config,
lib,
pkgs,
...
}:
with lib;
let
cfg = config.services.tt-rss;
inherit (cfg) phpPackage;
configVersion = 26;
dbPort =
if cfg.database.port == null then
(if cfg.database.type == "pgsql" then 5432 else 3306)
else
cfg.database.port;
poolName = "tt-rss";
mysqlLocal = cfg.database.createLocally && cfg.database.type == "mysql";
pgsqlLocal = cfg.database.createLocally && cfg.database.type == "pgsql";
tt-rss-config =
let
password =
if (cfg.database.password != null) then
"'${(escape [ "'" "\\" ] cfg.database.password)}'"
else if (cfg.database.passwordFile != null) then
"file_get_contents('${cfg.database.passwordFile}')"
else
null;
in
pkgs.writeText "config.php" ''
<?php
putenv('TTRSS_PHP_EXECUTABLE=${phpPackage}/bin/php');
putenv('TTRSS_LOCK_DIRECTORY=${cfg.root}/lock');
putenv('TTRSS_CACHE_DIR=${cfg.root}/cache');
putenv('TTRSS_ICONS_DIR=${cfg.root}/feed-icons');
putenv('TTRSS_ICONS_URL=feed-icons');
putenv('TTRSS_SELF_URL_PATH=${cfg.selfUrlPath}');
putenv('TTRSS_MYSQL_CHARSET=UTF8');
putenv('TTRSS_DB_TYPE=${cfg.database.type}');
putenv('TTRSS_DB_HOST=${optionalString (cfg.database.host != null) cfg.database.host}');
putenv('TTRSS_DB_USER=${cfg.database.user}');
putenv('TTRSS_DB_NAME=${cfg.database.name}');
putenv('TTRSS_DB_PASS=' ${optionalString (password != null) ". ${password}"});
putenv('TTRSS_DB_PORT=${toString dbPort}');
putenv('TTRSS_AUTH_AUTO_CREATE=${boolToString cfg.auth.autoCreate}');
putenv('TTRSS_AUTH_AUTO_LOGIN=${boolToString cfg.auth.autoLogin}');
putenv('TTRSS_FEED_CRYPT_KEY=${escape [ "'" "\\" ] cfg.feedCryptKey}');
putenv('TTRSS_SINGLE_USER_MODE=${boolToString cfg.singleUserMode}');
putenv('TTRSS_SIMPLE_UPDATE_MODE=${boolToString cfg.simpleUpdateMode}');
# Never check for updates - the running version of the code should
# be controlled entirely by the version of TT-RSS active in the
# current Nix profile. If TT-RSS updates itself to a version
# requiring a database schema upgrade, and then the SystemD
# tt-rss.service is restarted, the old code copied from the Nix
# store will overwrite the updated version, causing the code to
# detect the need for a schema "upgrade" (since the schema version
# in the database is different than in the code), but the update
# schema operation in TT-RSS will do nothing because the schema
# version in the database is newer than that in the code.
putenv('TTRSS_CHECK_FOR_UPDATES=false');
putenv('TTRSS_FORCE_ARTICLE_PURGE=${toString cfg.forceArticlePurge}');
putenv('TTRSS_SESSION_COOKIE_LIFETIME=${toString cfg.sessionCookieLifetime}');
putenv('TTRSS_ENABLE_GZIP_OUTPUT=${boolToString cfg.enableGZipOutput}');
putenv('TTRSS_PLUGINS=${builtins.concatStringsSep "," cfg.plugins}');
putenv('TTRSS_LOG_DESTINATION=${cfg.logDestination}');
putenv('TTRSS_CONFIG_VERSION=${toString configVersion}');
putenv('TTRSS_PUBSUBHUBBUB_ENABLED=${boolToString cfg.pubSubHubbub.enable}');
putenv('TTRSS_PUBSUBHUBBUB_HUB=${cfg.pubSubHubbub.hub}');
putenv('TTRSS_SPHINX_SERVER=${cfg.sphinx.server}');
putenv('TTRSS_SPHINX_INDEX=${builtins.concatStringsSep "," cfg.sphinx.index}');
putenv('TTRSS_ENABLE_REGISTRATION=${boolToString cfg.registration.enable}');
putenv('TTRSS_REG_NOTIFY_ADDRESS=${cfg.registration.notifyAddress}');
putenv('TTRSS_REG_MAX_USERS=${toString cfg.registration.maxUsers}');
putenv('TTRSS_SMTP_SERVER=${cfg.email.server}');
putenv('TTRSS_SMTP_LOGIN=${cfg.email.login}');
putenv('TTRSS_SMTP_PASSWORD=${escape [ "'" "\\" ] cfg.email.password}');
putenv('TTRSS_SMTP_SECURE=${cfg.email.security}');
putenv('TTRSS_SMTP_FROM_NAME=${escape [ "'" "\\" ] cfg.email.fromName}');
putenv('TTRSS_SMTP_FROM_ADDRESS=${escape [ "'" "\\" ] cfg.email.fromAddress}');
putenv('TTRSS_DIGEST_SUBJECT=${escape [ "'" "\\" ] cfg.email.digestSubject}');
${cfg.extraConfig}
'';
# tt-rss and plugins and themes and config.php
servedRoot = pkgs.runCommand "tt-rss-served-root" { } ''
cp --no-preserve=mode -r ${pkgs.tt-rss} $out
cp ${tt-rss-config} $out/config.php
${optionalString (cfg.pluginPackages != [ ]) ''
for plugin in ${concatStringsSep " " cfg.pluginPackages}; do
cp -r "$plugin"/* "$out/plugins.local/"
done
''}
${optionalString (cfg.themePackages != [ ]) ''
for theme in ${concatStringsSep " " cfg.themePackages}; do
cp -r "$theme"/* "$out/themes.local/"
done
''}
'';
in
{
###### interface
options = {
services.tt-rss = {
enable = mkEnableOption "tt-rss";
root = mkOption {
type = types.path;
default = "/var/lib/tt-rss";
description = ''
Root of the application.
'';
};
user = mkOption {
type = types.str;
default = "tt_rss";
description = ''
User account under which both the update daemon and the web-application run.
'';
};
pool = mkOption {
type = types.str;
default = "${poolName}";
description = ''
Name of existing phpfpm pool that is used to run web-application.
If not specified a pool will be created automatically with
default values.
'';
};
virtualHost = mkOption {
type = types.nullOr types.str;
default = "tt-rss";
description = ''
Name of the nginx virtualhost to use and setup. If null, do not setup any virtualhost.
'';
};
database = {
type = mkOption {
type = types.enum [
"pgsql"
"mysql"
];
default = "pgsql";
description = ''
Database to store feeds. Supported are pgsql and mysql.
'';
};
host = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Host of the database. Leave null to use Unix domain socket.
'';
};
name = mkOption {
type = types.str;
default = "tt_rss";
description = ''
Name of the existing database.
'';
};
user = mkOption {
type = types.str;
default = "tt_rss";
description = ''
The database user. The user must exist and has access to
the specified database.
'';
};
password = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
The database user's password.
'';
};
passwordFile = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
The database user's password.
'';
};
port = mkOption {
type = types.nullOr types.port;
default = null;
description = ''
The database's port. If not set, the default ports will be provided (5432
and 3306 for pgsql and mysql respectively).
'';
};
createLocally = mkOption {
type = types.bool;
default = true;
description = "Create the database and database user locally.";
};
};
auth = {
autoCreate = mkOption {
type = types.bool;
default = true;
description = ''
Allow authentication modules to auto-create users in tt-rss internal
database when authenticated successfully.
'';
};
autoLogin = mkOption {
type = types.bool;
default = true;
description = ''
Automatically login user on remote or other kind of externally supplied
authentication, otherwise redirect to login form as normal.
If set to true, users won't be able to set application language
and settings profile.
'';
};
};
pubSubHubbub = {
hub = mkOption {
type = types.str;
default = "";
description = ''
URL to a PubSubHubbub-compatible hub server. If defined, "Published
articles" generated feed would automatically become PUSH-enabled.
'';
};
enable = mkOption {
type = types.bool;
default = false;
description = ''
Enable client PubSubHubbub support in tt-rss. When disabled, tt-rss
won't try to subscribe to PUSH feed updates.
'';
};
};
sphinx = {
server = mkOption {
type = types.str;
default = "localhost:9312";
description = ''
Hostname:port combination for the Sphinx server.
'';
};
index = mkOption {
type = types.listOf types.str;
default = [
"ttrss"
"delta"
];
description = ''
Index names in Sphinx configuration. Example configuration
files are available on tt-rss wiki.
'';
};
};
registration = {
enable = mkOption {
type = types.bool;
default = false;
description = ''
Allow users to register themselves. Please be aware that allowing
random people to access your tt-rss installation is a security risk
and potentially might lead to data loss or server exploit. Disabled
by default.
'';
};
notifyAddress = mkOption {
type = types.str;
default = "";
description = ''
Email address to send new user notifications to.
'';
};
maxUsers = mkOption {
type = types.int;
default = 0;
description = ''
Maximum amount of users which will be allowed to register on this
system. 0 - no limit.
'';
};
};
email = {
server = mkOption {
type = types.str;
default = "";
example = "localhost:25";
description = ''
Hostname:port combination to send outgoing mail. Blank - use system
MTA.
'';
};
login = mkOption {
type = types.str;
default = "";
description = ''
SMTP authentication login used when sending outgoing mail.
'';
};
password = mkOption {
type = types.str;
default = "";
description = ''
SMTP authentication password used when sending outgoing mail.
'';
};
security = mkOption {
type = types.enum [
""
"ssl"
"tls"
];
default = "";
description = ''
Used to select a secure SMTP connection. Allowed values: ssl, tls,
or empty.
'';
};
fromName = mkOption {
type = types.str;
default = "Tiny Tiny RSS";
description = ''
Name for sending outgoing mail. This applies to password reset
notifications, digest emails and any other mail.
'';
};
fromAddress = mkOption {
type = types.str;
default = "";
description = ''
Address for sending outgoing mail. This applies to password reset
notifications, digest emails and any other mail.
'';
};
digestSubject = mkOption {
type = types.str;
default = "[tt-rss] New headlines for last 24 hours";
description = ''
Subject line for email digests.
'';
};
};
sessionCookieLifetime = mkOption {
type = types.int;
default = 86400;
description = ''
Default lifetime of a session (e.g. login) cookie. In seconds,
0 means cookie will be deleted when browser closes.
'';
};
selfUrlPath = mkOption {
type = types.str;
description = ''
Full URL of your tt-rss installation. This should be set to the
location of tt-rss directory, e.g. http://example.org/tt-rss/
You need to set this option correctly otherwise several features
including PUSH, bookmarklets and browser integration will not work properly.
'';
example = "http://localhost";
};
feedCryptKey = mkOption {
type = types.str;
default = "";
description = ''
Key used for encryption of passwords for password-protected feeds
in the database. A string of 24 random characters. If left blank, encryption
is not used. Requires mcrypt functions.
Warning: changing this key will make your stored feed passwords impossible
to decrypt.
'';
};
singleUserMode = mkOption {
type = types.bool;
default = false;
description = ''
Operate in single user mode, disables all functionality related to
multiple users and authentication. Enabling this assumes you have
your tt-rss directory protected by other means (e.g. http auth).
'';
};
simpleUpdateMode = mkOption {
type = types.bool;
default = false;
description = ''
Enables fallback update mode where tt-rss tries to update feeds in
background while tt-rss is open in your browser.
If you don't have a lot of feeds and don't want to or can't run
background processes while not running tt-rss, this method is generally
viable to keep your feeds up to date.
Still, there are more robust (and recommended) updating methods
available, you can read about them here: <https://tt-rss.org/wiki/UpdatingFeeds>
'';
};
forceArticlePurge = mkOption {
type = types.int;
default = 0;
description = ''
When this option is not 0, users ability to control feed purging
intervals is disabled and all articles (which are not starred)
older than this amount of days are purged.
'';
};
enableGZipOutput = mkOption {
type = types.bool;
default = true;
description = ''
Selectively gzip output to improve wire performance. This requires
PHP Zlib extension on the server.
Enabling this can break tt-rss in several httpd/php configurations,
if you experience weird errors and tt-rss failing to start, blank pages
after login, or content encoding errors, disable it.
'';
};
phpPackage = lib.mkOption {
type = lib.types.package;
default = pkgs.php;
defaultText = "pkgs.php";
description = ''
php package to use for php fpm and update daemon.
'';
};
plugins = mkOption {
type = types.listOf types.str;
default = [
"auth_internal"
"note"
];
description = ''
List of plugins to load automatically for all users.
System plugins have to be specified here. Please enable at least one
authentication plugin here (auth_*).
Users may enable other user plugins from Preferences/Plugins but may not
disable plugins specified in this list.
Disabling auth_internal in this list would automatically disable
reset password link on the login form.
'';
};
pluginPackages = mkOption {
type = types.listOf types.package;
default = [ ];
description = ''
List of plugins to install. The list elements are expected to
be derivations. All elements in this derivation are automatically
copied to the `plugins.local` directory.
'';
};
themePackages = mkOption {
type = types.listOf types.package;
default = [ ];
description = ''
List of themes to install. The list elements are expected to
be derivations. All elements in this derivation are automatically
copied to the `themes.local` directory.
'';
};
logDestination = mkOption {
type = types.enum [
""
"sql"
"syslog"
];
default = "sql";
description = ''
Log destination to use. Possible values: sql (uses internal logging
you can read in Preferences -> System), syslog - logs to system log.
Setting this to blank uses PHP logging (usually to http server
error.log).
'';
};
updateDaemon = {
commandFlags = mkOption {
type = types.str;
default = "--quiet";
description = ''
Command-line flags passed to the update daemon.
The default --quiet flag mutes all logging, including errors.
'';
};
};
extraConfig = mkOption {
type = types.lines;
default = "";
description = ''
Additional lines to append to `config.php`.
'';
};
};
};
imports = [
(mkRemovedOptionModule [ "services" "tt-rss" "checkForUpdates" ] ''
This option was removed because setting this to true will cause TT-RSS
to be unable to start if an automatic update of the code in
services.tt-rss.root leads to a database schema upgrade that is not
supported by the code active in the Nix store.
'')
];
###### implementation
config = mkIf cfg.enable {
assertions = [
{
assertion = cfg.database.password != null -> cfg.database.passwordFile == null;
message = "Cannot set both password and passwordFile";
}
{
assertion =
cfg.database.createLocally -> cfg.database.name == cfg.user && cfg.database.user == cfg.user;
message = ''
When creating a database via NixOS, the db user and db name must be equal!
If you already have an existing DB+user and this assertion is new, you can safely set
`services.tt-rss.database.createLocally` to `false` because removal of `ensureUsers`
and `ensureDatabases` doesn't have any effect.
'';
}
];
services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
${poolName} = {
inherit (cfg) user;
inherit phpPackage;
settings = mapAttrs (name: mkDefault) {
"listen.owner" = "nginx";
"listen.group" = "nginx";
"listen.mode" = "0600";
"pm" = "dynamic";
"pm.max_children" = 75;
"pm.start_servers" = 10;
"pm.min_spare_servers" = 5;
"pm.max_spare_servers" = 20;
"pm.max_requests" = 500;
"catch_workers_output" = 1;
};
};
};
# NOTE: No configuration is done if not using virtual host
services.nginx = mkIf (cfg.virtualHost != null) {
enable = true;
virtualHosts = {
${cfg.virtualHost} = {
root = "${cfg.root}/www";
locations."/" = {
index = "index.php";
};
locations."^~ /feed-icons" = {
root = "${cfg.root}";
};
locations."~ \\.php$" = {
extraConfig = ''
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:${config.services.phpfpm.pools.${cfg.pool}.socket};
fastcgi_index index.php;
'';
};
};
};
};
systemd.tmpfiles.rules = [
"d '${cfg.root}' 0555 ${cfg.user} tt_rss - -"
"d '${cfg.root}/lock' 0755 ${cfg.user} tt_rss - -"
"d '${cfg.root}/cache' 0755 ${cfg.user} tt_rss - -"
"d '${cfg.root}/cache/upload' 0755 ${cfg.user} tt_rss - -"
"d '${cfg.root}/cache/images' 0755 ${cfg.user} tt_rss - -"
"d '${cfg.root}/cache/export' 0755 ${cfg.user} tt_rss - -"
"d '${cfg.root}/feed-icons' 0755 ${cfg.user} tt_rss - -"
"L+ '${cfg.root}/www' - - - - ${servedRoot}"
];
systemd.services = {
phpfpm-tt-rss = mkIf (cfg.pool == "${poolName}") {
restartTriggers = [ servedRoot ];
};
tt-rss = {
description = "Tiny Tiny RSS feeds update daemon";
preStart = ''
${phpPackage}/bin/php ${cfg.root}/www/update.php --update-schema --force-yes
'';
serviceConfig = {
User = "${cfg.user}";
Group = "tt_rss";
ExecStart = "${phpPackage}/bin/php ${cfg.root}/www/update.php --daemon ${cfg.updateDaemon.commandFlags}";
Restart = "on-failure";
RestartSec = "60";
SyslogIdentifier = "tt-rss";
};
wantedBy = [ "multi-user.target" ];
requires = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
after = [
"network.target"
]
++ optional mysqlLocal "mysql.service"
++ optional pgsqlLocal "postgresql.target";
};
};
services.mysql = mkIf mysqlLocal {
enable = true;
package = mkDefault pkgs.mariadb;
ensureDatabases = [ cfg.database.name ];
ensureUsers = [
{
name = cfg.user;
ensurePermissions = {
"${cfg.database.name}.*" = "ALL PRIVILEGES";
};
}
];
};
services.postgresql = mkIf pgsqlLocal {
enable = mkDefault true;
ensureDatabases = [ cfg.database.name ];
ensureUsers = [
{
name = cfg.database.user;
ensureDBOwnership = true;
}
];
};
users.users.tt_rss = optionalAttrs (cfg.user == "tt_rss") {
description = "tt-rss service user";
isSystemUser = true;
group = "tt_rss";
};
users.groups.tt_rss = { };
};
}
nixos/modules/system/boot/loader/limine/limine-install.py
+3 -3
View File
@@ -630,15 +630,15 @@ def install_bootloader() -> None:
if config('partitionIndex'):
limine_deploy_args.append(str(config('partitionIndex')))
if config('forceMbr'):
limine_deploy_args.append('--force-mbr')
if config('force'):
limine_deploy_args.append('--force')
try:
subprocess.run(limine_deploy_args)
except:
raise Exception(
'Failed to deploy BIOS stage 1 Limine bootloader!\n' +
'You might want to try enabling the `boot.loader.limine.forceMbr` option.')
'You might want to try enabling the `boot.loader.limine.force` option.')
print("removing unused boot files...")
for path in paths:
nixos/modules/system/boot/loader/limine/limine.nix
+10 -3
View File
@@ -22,7 +22,7 @@ let
biosSupport = cfg.biosSupport;
biosDevice = cfg.biosDevice;
partitionIndex = cfg.partitionIndex;
forceMbr = cfg.forceMbr;
force = cfg.force;
enrollConfig = cfg.enrollConfig;
style = cfg.style;
maxGenerations = if cfg.maxGenerations == null then 0 else cfg.maxGenerations;
@@ -43,6 +43,13 @@ in
inherit (pkgs.limine.meta) maintainers;
};
imports = [
(lib.mkRenamedOptionModule
[ "boot" "loader" "limine" "forceMbr" ]
[ "boot" "loader" "limine" "force" ]
)
];
options.boot.loader.limine = {
enable = lib.mkEnableOption "the Limine Bootloader";
package = lib.mkPackageOption pkgs "limine" { };
@@ -169,9 +176,9 @@ in
'';
};
forceMbr = lib.mkEnableOption null // {
force = lib.mkEnableOption null // {
description = ''
Force MBR detection to work even if the safety checks fail, use absolutely only if necessary!
Force installation even if the safety checks fail, use absolutely only if necessary!
'';
};

Some files were not shown because too many files have changed in this diff Show More