diff --git a/doc/languages-frameworks/python.md b/doc/languages-frameworks/python.md
index 298da8f9f0d2..7bdbbbd903a0 100644
--- a/doc/languages-frameworks/python.md
+++ b/doc/languages-frameworks/python.md
@@ -785,7 +785,20 @@ example of such a situation is when `py.test` is used.
#### Common issues
-- Non-working tests can often be deselected. In the case of `py.test`: `py.test -k 'not function_name and not other_function'`.
+- Non-working tests can often be deselected. By default `buildPythonPackage` runs `python setup.py test`.
+ Most python modules follows the standard test protocol where the pytest runner can be used instead.
+ `py.test` supports a `-k` parameter to ignore test methods or classes:
+
+ ```nix
+ buildPythonPackage {
+ # ...
+ # assumes the tests are located in tests
+ checkInputs = [ pytest ];
+ checkPhase = ''
+ py.test -k 'not function_name and not other_function' tests
+ '';
+ }
+ ```
- Unicode issues can typically be fixed by including `glibcLocales` in `buildInputs` and exporting `LC_ALL=en_US.utf-8`.
- Tests that attempt to access `$HOME` can be fixed by using the following work-around before running tests (e.g. `preCheck`): `export HOME=$(mktemp -d)`
diff --git a/doc/package-notes.xml b/doc/package-notes.xml
index e1aea62f7848..4d87a3a67fe9 100644
--- a/doc/package-notes.xml
+++ b/doc/package-notes.xml
@@ -477,32 +477,18 @@ it. Place the resulting package.nix file into
Using the FOSS Radeon or nouveau (nvidia) drivers
-
- Both the open source radeon drivers as well as the nouveau drivers (nvidia)
- need a newer libc++ than is provided by the default runtime, which leads to a
- crash on launch. Use environment.systemPackages =
- [(pkgs.steam.override { newStdcpp = true; })]; in your config
- if you get an error like
-
-libGL error: unable to load driver: radeonsi_dri.so
-libGL error: driver pointer missing
-libGL error: failed to load driver: radeonsi
-libGL error: unable to load driver: swrast_dri.so
-libGL error: failed to load driver: swrast
- or
-
-libGL error: unable to load driver: nouveau_dri.so
-libGL error: driver pointer missing
-libGL error: failed to load driver: nouveau
-libGL error: unable to load driver: swrast_dri.so
-libGL error: failed to load driver: swrast
-
- Steam ships statically linked with a version of libcrypto that
- conflics with the one dynamically loaded by radeonsi_dri.so.
- If you get the error
- steam.sh: line 713: 7842 Segmentation fault (core dumped)
- have a look at this pull request.
-
+
+ The newStdcpp parameter
+ was removed since NixOS 17.09 and should not be needed anymore.
+
+
+
+ Steam ships statically linked with a version of libcrypto that
+ conflics with the one dynamically loaded by radeonsi_dri.so.
+ If you get the error
+ steam.sh: line 713: 7842 Segmentation fault (core dumped)
+ have a look at this pull request.
+
diff --git a/lib/licenses.nix b/lib/licenses.nix
index a790b576032d..1bb153ce4c31 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -281,6 +281,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
url = https://fedoraproject.org/wiki/Licensing/GPL_Classpath_Exception;
};
+ hpnd = spdx {
+ spdxId = "HPND";
+ fullName = "Historic Permission Notice and Disclaimer";
+ };
+
# Intel's license, seems free
iasl = {
fullName = "iASL";
diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index 3f7eae52f6b9..a978313c42c1 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -107,6 +107,7 @@
choochootrain = "Hurshal Patel ";
chris-martin = "Chris Martin ";
chrisjefferson = "Christopher Jefferson ";
+ chrisrosset = "Christopher Rosset ";
christopherpoole = "Christopher Mark Poole ";
ciil = "Simon Lackerbauer ";
ckampka = "Christian Kampka ";
@@ -186,17 +187,20 @@
ellis = "Ellis Whitehead ";
eperuffo = "Emanuele Peruffo ";
epitrochoid = "Mabry Cervin ";
+ eqyiel = "Ruben Maher ";
ericbmerritt = "Eric Merritt ";
ericsagnes = "Eric Sagnes ";
erikryb = "Erik Rybakken ";
ertes = "Ertugrul Söylemez ";
ethercrow = "Dmitry Ivanov ";
+ etu = "Elis Hirwing ";
exi = "Reno Reckling ";
exlevan = "Alexey Levan ";
expipiplus1 = "Joe Hermaszewski ";
fadenb = "Tristan Helmich ";
- fare = "Francois-Rene Rideau ";
falsifian = "James Cook ";
+ fare = "Francois-Rene Rideau ";
+ fgaz = "Francesco Gazzetta ";
florianjacob = "Florian Jacob ";
flosse = "Markus Kohlhase ";
fluffynukeit = "Daniel Austin ";
@@ -288,12 +292,12 @@
jonafato = "Jon Banafato ";
jpierre03 = "Jean-Pierre PRUNARET ";
jpotier = "Martin Potier ";
- jyp = "Jean-Philippe Bernardy ";
jraygauthier = "Raymond Gauthier ";
jtojnar = "Jan Tojnar ";
juliendehos = "Julien Dehos ";
jwiegley = "John Wiegley ";
jwilberding = "Jordan Wilberding ";
+ jyp = "Jean-Philippe Bernardy ";
jzellner = "Jeff Zellner ";
kaiha = "Kai Harries ";
kamilchm = "Kamil Chmielewski ";
@@ -333,6 +337,7 @@
lovek323 = "Jason O'Conal ";
lowfatcomputing = "Andreas Wagner ";
lsix = "Lancelot SIX ";
+ ltavard = "Laure Tavard ";
lucas8 = "Luc Chabassier ";
ludo = "Ludovic Courtès ";
lufia = "Kyohei Kadota ";
@@ -495,6 +500,7 @@
renzo = "Renzo Carbonara ";
retrry = "Tadas Barzdžius ";
rht = "rht ";
+ richardipsum = "Richard Ipsum ";
rick68 = "Wei-Ming Yang ";
rickynils = "Rickard Nilsson ";
ris = "Robert Scott ";
@@ -504,6 +510,7 @@
robberer = "Longrin Wischnewski ";
robbinch = "Robbin C. ";
roberth = "Robert Hensing ";
+ robertodr = "Roberto Di Remigio ";
robgssp = "Rob Glossop ";
roblabla = "Robin Lambertz ";
roconnor = "Russell O'Connor ";
@@ -577,10 +584,9 @@
taku0 = "Takuo Yonezawa ";
tari = "Peter Marheine ";
tavyc = "Octavian Cerna ";
- ltavard = "Laure Tavard ";
teh = "Tom Hunger ";
- teto = "Matthieu Coudron ";
telotortium = "Robert Irelan ";
+ teto = "Matthieu Coudron ";
thall = "Niclas Thall ";
thammers = "Tobias Hammerschmidt ";
the-kenny = "Moritz Ulrich ";
@@ -609,6 +615,7 @@
#urkud = "Yury G. Kudryashov "; inactive since 2012
uwap = "uwap ";
vaibhavsagar = "Vaibhav Sagar ";
+ valeriangalliat = "Valérian Galliat ";
vandenoever = "Jos van den Oever ";
vanschelven = "Klaas van Schelven ";
vanzef = "Ivan Solyankin ";
@@ -625,7 +632,6 @@
vlstill = "Vladimír Štill ";
vmandela = "Venkateswara Rao Mandela ";
vmchale = "Vanessa McHale ";
- valeriangalliat = "Valérian Galliat ";
volhovm = "Mikhail Volkhov ";
volth = "Jaroslavas Pocepko ";
vozz = "Oliver Hunt ";
@@ -647,6 +653,7 @@
xvapx = "Marti Serra ";
xwvvvvwx = "David Terry ";
yarr = "Dmitry V. ";
+ yegortimoshenko = "Yegor Timoshenko ";
yochai = "Yochai ";
yorickvp = "Yorick van Pelt ";
yuriaisaka = "Yuri Aisaka ";
diff --git a/maintainers/scripts/gnome.sh b/maintainers/scripts/gnome.sh
index e5a8d606f1a3..f77dc5a9e64c 100755
--- a/maintainers/scripts/gnome.sh
+++ b/maintainers/scripts/gnome.sh
@@ -9,17 +9,15 @@ GNOME_FTP=ftp.gnome.org/pub/GNOME/sources
NO_GNOME_MAJOR="ghex gtkhtml gdm"
usage() {
- echo "Usage: $0 gnome_dir || [major.minor]" >&2
- echo "gnome_dir is for example pkgs/desktops/gnome-3/3.18" >&2
+ echo "Usage: $0 || [major.minor]" >&2
exit 0
}
-if [ "$#" -lt 2 ]; then
+if [ "$#" -lt 1 ]; then
usage
fi
-GNOME_TOP=$1
-shift
+GNOME_TOP=pkgs/desktops/gnome-3
action=$1
diff --git a/maintainers/scripts/hydra-eval-failures.py b/maintainers/scripts/hydra-eval-failures.py
index f82d14c3b46e..5233e0624450 100755
--- a/maintainers/scripts/hydra-eval-failures.py
+++ b/maintainers/scripts/hydra-eval-failures.py
@@ -13,10 +13,8 @@ from pyquery import PyQuery as pq
maintainers_json = subprocess.check_output([
- 'nix-instantiate',
- 'lib/maintainers.nix',
- '--eval',
- '--json'])
+ 'nix-instantiate', '-E', 'import ./lib/maintainers.nix {}', '--eval', '--json'
+])
maintainers = json.loads(maintainers_json)
MAINTAINERS = {v: k for k, v in maintainers.iteritems()}
diff --git a/nixos/doc/manual/release-notes/release-notes.xml b/nixos/doc/manual/release-notes/release-notes.xml
index 6065a86f60d8..5ed56bde6659 100644
--- a/nixos/doc/manual/release-notes/release-notes.xml
+++ b/nixos/doc/manual/release-notes/release-notes.xml
@@ -9,6 +9,7 @@
This section lists the release notes for each stable version of NixOS
and current unstable revision.
+
diff --git a/nixos/doc/manual/release-notes/rl-1709.xml b/nixos/doc/manual/release-notes/rl-1709.xml
index 55b39209f0d5..e4fac275d799 100644
--- a/nixos/doc/manual/release-notes/rl-1709.xml
+++ b/nixos/doc/manual/release-notes/rl-1709.xml
@@ -45,6 +45,33 @@ has the following highlights:
even though HDMI-0 is the first head in the list.
+
+
+ The handling of SSL in the nginx module has been cleaned up, renaming
+ the misnomed enableSSL to onlySSL
+ which reflects its original intention. This is not to be used with the
+ already existing forceSSL which creates a second
+ non-SSL virtual host redirecting to the SSL virtual host. This by
+ chance had worked earlier due to specific implementation details. In
+ case you had specified both please remove the enableSSL
+ option to keep the previous behaviour.
+
+
+ Another addSSL option has been introduced to configure
+ both a non-SSL virtual host and an SSL virtual host.
+
+
+ Options to configure resolvers and
+ upstreams have been introduced. See their information
+ for further details.
+
+
+ The port option has been replaced by a more generic
+ listen option which makes it possible to specify
+ multiple addresses, ports and SSL configs dependant on the new SSL
+ handling mentioned above.
+
+
The following new services were added since the last release:
@@ -62,10 +89,17 @@ following incompatible changes:
- aiccu package was removed. This is due to SixXS
+ The aiccu package was removed. This is due to SixXS
sunsetting its IPv6 tunnel.
+
+
+ The fanctl package and fan module
+ have been removed due to the developers not upstreaming their iproute2
+ patches and lagging with compatibility to recent iproute2 versions.
+
+
Top-level idea package collection was renamed.
@@ -202,6 +236,112 @@ rmdir /var/lib/ipfs/.ipfs
gpgv, etc.
+
+
+ services.mysql now has declarative
+ configuration of databases and users with the ensureDatabases and
+ ensureUsers options.
+
+
+
+ These options will never delete existing databases and users,
+ especially not when the value of the options are changed.
+
+
+
+ The MySQL users will be identified using
+
+ Unix socket authentication. This authenticates the
+ Unix user with the same name only, and that without the need
+ for a password.
+
+
+
+ If you have previously created a MySQL root
+ user with a password, you will need to add
+ root user for unix socket authentication
+ before using the new options. This can be done by running the
+ following SQL script:
+
+
+CREATE USER 'root'@'%' IDENTIFIED BY '';
+GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
+FLUSH PRIVILEGES;
+
+-- Optionally, delete the password-authenticated user:
+-- DROP USER 'root'@'localhost';
+
+
+
+
+
+ sha256 argument value of
+ dockerTools.pullImage expression must be
+ updated since the mechanism to download the image has been
+ changed. Skopeo is now used to pull the image instead of the
+ Docker daemon.
+
+
+
+
+ Templated systemd services e.g container@name are
+ now handled currectly when switching to a new configuration, resulting
+ in them being reloaded.
+
+
+
+
+
+ services.mysqlBackup now works by default
+ without any user setup, including for users other than
+ mysql.
+
+
+
+ By default, the mysql user is no longer the
+ user which performs the backup. Instead a system account
+ mysqlbackup is used.
+
+
+
+ The mysqlBackup service is also now using
+ systemd timers instead of cron.
+
+
+
+ Therefore, the services.mysqlBackup.period
+ option no longer exists, and has been replaced with
+ services.mysqlBackup.calendar, which is in
+ the format of systemd.time(7).
+
+
+
+ If you expect to be sent an e-mail when the backup fails,
+ consider using a script which monitors the systemd journal for
+ errors. Regretfully, at present there is no built-in
+ functionality for this.
+
+
+
+ You can check that backups still work by running
+ systemctl start mysql-backup then
+ systemctl status mysql-backup.
+
+
+
+
+ Steam: the newStdcpp parameter
+ was removed and should not be needed anymore.
+
+
+
+
+ Redis has been updated to version 4 which mandates a cluster
+ mass-restart, due to changes in the network handling, in order
+ to ensure compatibility with networks NATing traffic.
+
+
Other notable improvements:
@@ -257,11 +397,55 @@ rmdir /var/lib/ipfs/.ipfs
- sha256 argument value of
- dockerTools.pullImage expression must be
- updated since the mechanism to download the image has been
- changed. Skopeo is now used to pull the image instead of the
- Docker daemon.
+ Definitions for /etc/hosts can now be specified
+ declaratively with networking.hosts.
+
+
+
+
+ Two new options have been added to the installer loader, in addition
+ to the default having changed. The kernel log verbosity has been lowered
+ to the upstream default for the default options, in order to not spam
+ the console when e.g. joining a network.
+
+
+ This therefore leads to adding a new debug option
+ to set the log level to the previous verbose mode, to make debugging
+ easier, but still accessible easily.
+
+
+ Additionally a copytoram option has been added,
+ which makes it possible to remove the install medium after booting.
+ This allows tethering from your phone after booting from it.
+
+
+ services.gitlab-runner.configOptions has been added
+ to specify the configuration of gitlab-runners declaratively.
+
+
+ services.jenkins.plugins has been added
+ to install plugins easily, this can be generated with jenkinsPlugins2nix.
+
+
+ services.postfix.config has been added
+ to specify the main.cf with NixOS options. Additionally other options
+ have been added to the postfix module and has been improved further.
+
+
+ The GitLab package and module have been updated to the latest 9.5 release.
+
+
+ The systemd-boot boot loader now lists the NixOS
+ version, kernel version and build date of all bootable generations.
+
+
+
+
+ The dnscrypt-proxy service now defaults to using a random upstream resolver,
+ selected from the list of public non-logging resolvers with DNSSEC support.
+ Existing configurations can be migrated to this mode of operation by
+ omitting the option
+ or setting it to "random".
diff --git a/nixos/doc/manual/release-notes/rl-1803.xml b/nixos/doc/manual/release-notes/rl-1803.xml
index ce05cde7b08b..7acc689ed117 100644
--- a/nixos/doc/manual/release-notes/rl-1803.xml
+++ b/nixos/doc/manual/release-notes/rl-1803.xml
@@ -29,8 +29,7 @@ following incompatible changes:
-
-
+
diff --git a/nixos/maintainers/option-usages.nix b/nixos/maintainers/option-usages.nix
index 854ecf7eac51..7be0255b35ac 100644
--- a/nixos/maintainers/option-usages.nix
+++ b/nixos/maintainers/option-usages.nix
@@ -77,7 +77,6 @@ let
excludedOptions = [
"boot.systemd.services"
"systemd.services"
- "environment.gnome3.packageSet"
"kde.extraPackages"
];
excludeOptions = list:
diff --git a/nixos/modules/config/networking.nix b/nixos/modules/config/networking.nix
index 5fa91ec9cfbc..619f36cd5150 100644
--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@@ -9,9 +9,7 @@ let
cfg = config.networking;
dnsmasqResolve = config.services.dnsmasq.enable &&
config.services.dnsmasq.resolveLocalQueries;
- bindResolve = config.services.bind.enable &&
- config.services.bind.resolveLocalQueries;
- hasLocalResolver = bindResolve || dnsmasqResolve;
+ hasLocalResolver = config.services.bind.enable || dnsmasqResolve;
resolvconfOptions = cfg.resolvconfOptions
++ optional cfg.dnsSingleRequest "single-request"
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index 80abec95c03d..52f1773e9c45 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -40,6 +40,12 @@ in
{
config = mkIf enabled {
+ assertions = [
+ {
+ assertion = services.xserver.displayManager.gdm.wayland;
+ message = "NVidia drivers don't support wayland";
+ }
+ ];
services.xserver.drivers = singleton
{ name = "nvidia"; modules = [ nvidia_x11.bin ]; libPath = [ nvidia_x11 ]; };
@@ -62,11 +68,16 @@ in
boot.extraModulePackages = [ nvidia_x11.bin ];
# nvidia-uvm is required by CUDA applications.
- boot.kernelModules = [ "nvidia-uvm" ];
+ boot.kernelModules = [ "nvidia-uvm" ] ++
+ lib.optionals config.services.xserver.enable [ "nvidia" "nvidia_modeset" "nvidia_drm" ];
+
# Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
services.udev.extraRules =
''
+ KERNEL=="nvidia", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidiactl c $(grep nvidia-frontend /proc/devices | cut -d \ -f 1) 255'"
+ KERNEL=="nvidia_modeset", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia-modeset c $(grep nvidia-frontend /proc/devices | cut -d \ -f 1) 254'"
+ KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia%n c $(grep nvidia-frontend /proc/devices | cut -d \ -f 1) %n'"
KERNEL=="nvidia_uvm", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia-uvm c $(grep nvidia-uvm /proc/devices | cut -d \ -f 1) 0'"
'';
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 8891ce0b6667..a039f7fdcb6e 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -46,17 +46,24 @@ let
# A variant to boot with 'nomodeset'
LABEL boot-nomodeset
- MENU LABEL NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (with nomodeset)
+ MENU LABEL NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (nomodeset)
LINUX /boot/bzImage
APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} nomodeset
INITRD /boot/initrd
# A variant to boot with 'copytoram'
LABEL boot-copytoram
- MENU LABEL NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (with copytoram)
+ MENU LABEL NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (copytoram)
LINUX /boot/bzImage
APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} copytoram
INITRD /boot/initrd
+
+ # A variant to boot with verbose logging to the console
+ LABEL boot-nomodeset
+ MENU LABEL NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (debug)
+ LINUX /boot/bzImage
+ APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} loglevel=7
+ INITRD /boot/initrd
'';
isolinuxMemtest86Entry = ''
@@ -74,25 +81,43 @@ let
cp -v ${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${targetArch}.efi $out/EFI/boot/boot${targetArch}.efi
mkdir -p $out/loader/entries
- echo "title NixOS Live CD" > $out/loader/entries/nixos-livecd.conf
- echo "linux /boot/bzImage" >> $out/loader/entries/nixos-livecd.conf
- echo "initrd /boot/initrd" >> $out/loader/entries/nixos-livecd.conf
- echo "options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}" >> $out/loader/entries/nixos-livecd.conf
+ cat << EOF > $out/loader/entries/nixos-iso.conf
+ title NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel}
+ linux /boot/bzImage
+ initrd /boot/initrd
+ options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}
+ EOF
# A variant to boot with 'nomodeset'
- echo "title NixOS Live CD (with nomodeset)" > $out/loader/entries/nixos-livecd-nomodeset.conf
- echo "linux /boot/bzImage" >> $out/loader/entries/nixos-livecd-nomodeset.conf
- echo "initrd /boot/initrd" >> $out/loader/entries/nixos-livecd-nomodeset.conf
- echo "options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} nomodeset" >> $out/loader/entries/nixos-livecd-nomodeset.conf
+ cat << EOF > $out/loader/entries/nixos-iso-nomodeset.conf
+ title NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel}
+ version nomodeset
+ linux /boot/bzImage
+ initrd /boot/initrd
+ options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} nomodeset
+ EOF
# A variant to boot with 'copytoram'
- echo "title NixOS Live CD (with copytoram)" > $out/loader/entries/nixos-livecd-copytoram.conf
- echo "linux /boot/bzImage" >> $out/loader/entries/nixos-livecd-copytoram.conf
- echo "initrd /boot/initrd" >> $out/loader/entries/nixos-livecd-copytoram.conf
- echo "options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} copytoram" >> $out/loader/entries/nixos-livecd-copytoram.conf
+ cat << EOF > $out/loader/entries/nixos-iso-copytoram.conf
+ title NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel}
+ version copytoram
+ linux /boot/bzImage
+ initrd /boot/initrd
+ options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} copytoram
+ EOF
- echo "default nixos-livecd" > $out/loader/loader.conf
- echo "timeout ${builtins.toString config.boot.loader.timeout}" >> $out/loader/loader.conf
+ # A variant to boot with verbose logging to the console
+ cat << EOF > $out/loader/entries/nixos-iso-debug.conf
+ title NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (debug)
+ linux /boot/bzImage
+ initrd /boot/initrd
+ options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} loglevel=7
+ EOF
+
+ cat << EOF > $out/loader/loader.conf
+ default nixos-iso
+ timeout ${builtins.toString config.boot.loader.timeout}
+ EOF
'';
efiImg = pkgs.runCommand "efi-image_eltorito" { buildInputs = [ pkgs.mtools pkgs.libfaketime ]; }
@@ -336,6 +361,9 @@ in
{ source = config.isoImage.splashImage;
target = "/isolinux/background.png";
}
+ { source = pkgs.writeText "version" config.system.nixosVersion;
+ target = "/version.txt";
+ }
] ++ optionals config.isoImage.makeEfiBootable [
{ source = efiImg;
target = "/boot/efi.img";
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 3af76f898f9a..4ec48b773358 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -583,9 +583,15 @@ $bootLoaderConfig
# List packages installed in system profile. To search by name, run:
# \$ nix-env -qaP | grep wget
# environment.systemPackages = with pkgs; [
- # wget
+ # wget vim
# ];
+ # Some programs need SUID wrappers, can be configured further or are
+ # started in user sessions.
+ # programs.bash.enableCompletion = true;
+ # programs.mtr.enable = true;
+ # programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
+
# List services that you want to enable:
# Enable the OpenSSH daemon.
diff --git a/nixos/modules/installer/tools/nixos-install.sh b/nixos/modules/installer/tools/nixos-install.sh
index 79ed18c923c0..f994d5b4bde1 100644
--- a/nixos/modules/installer/tools/nixos-install.sh
+++ b/nixos/modules/installer/tools/nixos-install.sh
@@ -102,7 +102,7 @@ fi
extraBuildFlags+=(--option "build-users-group" "$buildUsersGroup")
# Inherit binary caches from the host
-# TODO: will this still work with Nix 1.12 now that it has no perl? Probably not...
+# TODO: will this still work with Nix 1.12 now that it has no perl? Probably not...
binary_caches="$(@perl@/bin/perl -I @nix@/lib/perl5/site_perl/*/* -e 'use Nix::Config; Nix::Config::readConfig; print $Nix::Config::config{"binary-caches"};')"
extraBuildFlags+=(--option "binary-caches" "$binary_caches")
@@ -113,8 +113,33 @@ if [[ -z "$closure" ]]; then
fi
unset NIXOS_CONFIG
-# TODO: do I need to set NIX_SUBSTITUTERS here or is the --option binary-caches above enough?
+# These get created in nixos-prepare-root as well, but we want to make sure they're here in case we're
+# running with --chroot. TODO: --chroot should just be split into a separate tool.
+mkdir -m 0755 -p "$mountPoint/dev" "$mountPoint/proc" "$mountPoint/sys"
+# Set up some bind mounts we'll want regardless of chroot or not
+mount --rbind /dev "$mountPoint/dev"
+mount --rbind /proc "$mountPoint/proc"
+mount --rbind /sys "$mountPoint/sys"
+
+# If we asked for a chroot, that means we're not actually installing anything (yeah I was confused too)
+# and we just want to run a command in the context of a $mountPoint that we're assuming has already been
+# set up by a previous nixos-install invocation. In that case we set up some remaining bind mounts and
+# exec the requested command, skipping the rest of the installation procedure.
+if [ -n "$runChroot" ]; then
+ mount -t tmpfs -o "mode=0755" none $mountPoint/run
+ rm -rf $mountPoint/var/run
+ ln -s /run $mountPoint/var/run
+ for f in /etc/resolv.conf /etc/hosts; do rm -f $mountPoint/$f; [ -f "$f" ] && cp -Lf $f $mountPoint/etc/; done
+ for f in /etc/passwd /etc/group; do touch $mountPoint/$f; [ -f "$f" ] && mount --rbind -o ro $f $mountPoint/$f; done
+
+ if ! [ -L $mountPoint/nix/var/nix/profiles/system ]; then
+ echo "$0: installation not finished; cannot chroot into installation directory"
+ exit 1
+ fi
+ ln -s /nix/var/nix/profiles/system $mountPoint/run/current-system
+ exec chroot $mountPoint "${chrootCommand[@]}"
+fi
# A place to drop temporary closures
trap "rm -rf $tmpdir" EXIT
@@ -153,9 +178,7 @@ nix-store --export $channel_root > $channel_closure
# nixos-prepare-root doesn't currently do anything with file ownership, so we set it up here instead
chown @root_uid@:@nixbld_gid@ $mountPoint/nix/store
-mount --rbind /dev $mountPoint/dev
-mount --rbind /proc $mountPoint/proc
-mount --rbind /sys $mountPoint/sys
+
# Grub needs an mtab.
ln -sfn /proc/mounts $mountPoint/etc/mtab
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 0f3b8bcab8b0..508a76d3cab5 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -426,7 +426,7 @@
teamspeak = 124;
influxdb = 125;
nsd = 126;
- #gitolite = 127; # unused
+ gitolite = 127;
znc = 128;
polipo = 129;
mopidy = 130;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index eb478f66d40f..b3477fba8ae1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -92,6 +92,7 @@
./programs/mosh.nix
./programs/mtr.nix
./programs/nano.nix
+ ./programs/npm.nix
./programs/oblogout.nix
./programs/qt5ct.nix
./programs/screen.nix
@@ -156,7 +157,9 @@
./services/backup/tarsnap.nix
./services/backup/znapzend.nix
./services/cluster/fleet.nix
- ./services/cluster/kubernetes.nix
+ ./services/cluster/kubernetes/default.nix
+ ./services/cluster/kubernetes/dns.nix
+ ./services/cluster/kubernetes/dashboard.nix
./services/cluster/panamax.nix
./services/computing/boinc/client.nix
./services/computing/torque/server.nix
@@ -352,6 +355,7 @@
./services/monitoring/collectd.nix
./services/monitoring/das_watchdog.nix
./services/monitoring/dd-agent/dd-agent.nix
+ ./services/monitoring/fusion-inventory.nix
./services/monitoring/grafana.nix
./services/monitoring/graphite.nix
./services/monitoring/hdaps.nix
@@ -423,12 +427,12 @@
./services/networking/ddclient.nix
./services/networking/dhcpcd.nix
./services/networking/dhcpd.nix
+ ./services/networking/dnscache.nix
./services/networking/dnschain.nix
./services/networking/dnscrypt-proxy.nix
./services/networking/dnscrypt-wrapper.nix
./services/networking/dnsmasq.nix
./services/networking/ejabberd.nix
- ./services/networking/fan.nix
./services/networking/fakeroute.nix
./services/networking/ferm.nix
./services/networking/firefox/sync-server.nix
@@ -524,6 +528,7 @@
./services/networking/tcpcrypt.nix
./services/networking/teamspeak3.nix
./services/networking/tinc.nix
+ ./services/networking/tinydns.nix
./services/networking/tftpd.nix
./services/networking/tox-bootstrapd.nix
./services/networking/toxvpn.nix
diff --git a/nixos/modules/profiles/installation-device.nix b/nixos/modules/profiles/installation-device.nix
index 8e1482f5533f..506a6ee3eaa8 100644
--- a/nixos/modules/profiles/installation-device.nix
+++ b/nixos/modules/profiles/installation-device.nix
@@ -77,7 +77,6 @@ with lib;
# Show all debug messages from the kernel but don't log refused packets
# because we have the firewall enabled. This makes installs from the
# console less cumbersome if the machine has a public IP.
- boot.consoleLogLevel = mkDefault 7;
networking.firewall.logRefusedConnections = mkDefault false;
environment.systemPackages = [ pkgs.vim ];
diff --git a/nixos/modules/programs/npm.nix b/nixos/modules/programs/npm.nix
new file mode 100644
index 000000000000..7ef172355c1f
--- /dev/null
+++ b/nixos/modules/programs/npm.nix
@@ -0,0 +1,44 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+ cfg = config.programs.npm;
+in
+
+{
+ ###### interface
+
+ options = {
+ programs.npm = {
+ enable = mkEnableOption "npm global config";
+
+ npmrc = lib.mkOption {
+ type = lib.types.lines;
+ description = ''
+ The system-wide npm configuration.
+ See .
+ '';
+ default = ''
+ prefix = ''${HOME}/.npm
+ '';
+ example = ''
+ prefix = ''${HOME}/.npm
+ https-proxy=proxy.example.com
+ init-license=MIT
+ init-author-url=http://npmjs.org
+ color=true
+ '';
+ };
+ };
+ };
+
+ ###### implementation
+
+ config = lib.mkIf cfg.enable {
+ environment.etc."npmrc".text = cfg.npmrc;
+
+ environment.variables.NPM_CONFIG_GLOBALCONFIG = "/etc/npmrc";
+ };
+
+}
diff --git a/nixos/modules/security/lock-kernel-modules.nix b/nixos/modules/security/lock-kernel-modules.nix
index 260ec3fc9464..c81521ed9b08 100644
--- a/nixos/modules/security/lock-kernel-modules.nix
+++ b/nixos/modules/security/lock-kernel-modules.nix
@@ -17,19 +17,27 @@ with lib;
};
config = mkIf config.security.lockKernelModules {
+ boot.kernelModules = concatMap (x:
+ if x.device != null
+ then
+ if x.fsType == "vfat"
+ then [ "vfat" "nls-cp437" "nls-iso8859-1" ]
+ else [ x.fsType ]
+ else []) config.system.build.fileSystems;
+
systemd.services.disable-kernel-module-loading = rec {
description = "Disable kernel module loading";
wantedBy = [ config.systemd.defaultUnit ];
- after = [ "systemd-udev-settle.service" "firewall.service" "systemd-modules-load.service" ] ++ wantedBy;
- script = "echo -n 1 > /proc/sys/kernel/modules_disabled";
+ after = [ "systemd-udev-settle.service" "firewall.service" "systemd-modules-load.service" ] ++ wantedBy;
unitConfig.ConditionPathIsReadWrite = "/proc/sys/kernel";
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
+ ExecStart = "/bin/sh -c 'echo -n 1 >/proc/sys/kernel/modules_disabled'";
};
};
};
diff --git a/nixos/modules/services/amqp/rabbitmq.nix b/nixos/modules/services/amqp/rabbitmq.nix
index 61545a5acba8..f536d56d7c63 100644
--- a/nixos/modules/services/amqp/rabbitmq.nix
+++ b/nixos/modules/services/amqp/rabbitmq.nix
@@ -105,7 +105,8 @@ in {
RABBITMQ_MNESIA_BASE = "${cfg.dataDir}/mnesia";
RABBITMQ_NODE_IP_ADDRESS = cfg.listenAddress;
RABBITMQ_NODE_PORT = toString cfg.port;
- RABBITMQ_SERVER_START_ARGS = "-rabbit error_logger tty -rabbit sasl_error_logger false";
+ RABBITMQ_LOGS = "-";
+ RABBITMQ_SASL_LOGS = "-";
RABBITMQ_PID_FILE = "${cfg.dataDir}/pid";
SYS_PREFIX = "";
RABBITMQ_ENABLED_PLUGINS_FILE = pkgs.writeText "enabled_plugins" ''
@@ -128,7 +129,7 @@ in {
preStart = ''
${optionalString (cfg.cookie != "") ''
echo -n ${cfg.cookie} > ${cfg.dataDir}/.erlang.cookie
- chmod 400 ${cfg.dataDir}/.erlang.cookie
+ chmod 600 ${cfg.dataDir}/.erlang.cookie
''}
'';
};
diff --git a/nixos/modules/services/backup/mysql-backup.nix b/nixos/modules/services/backup/mysql-backup.nix
index 28f607861f77..3f533fa457dc 100644
--- a/nixos/modules/services/backup/mysql-backup.nix
+++ b/nixos/modules/services/backup/mysql-backup.nix
@@ -6,10 +6,28 @@ let
inherit (pkgs) mysql gzip;
- cfg = config.services.mysqlBackup ;
- location = cfg.location ;
- mysqlBackupCron = db : ''
- ${cfg.period} ${cfg.user} ${mysql}/bin/mysqldump ${if cfg.singleTransaction then "--single-transaction" else ""} ${db} | ${gzip}/bin/gzip -c > ${location}/${db}.gz
+ cfg = config.services.mysqlBackup;
+ defaultUser = "mysqlbackup";
+
+ backupScript = ''
+ set -o pipefail
+ failed=""
+ ${concatMapStringsSep "\n" backupDatabaseScript cfg.databases}
+ if [ -n "$failed" ]; then
+ echo "Backup of database(s) failed:$failed"
+ exit 1
+ fi
+ '';
+ backupDatabaseScript = db: ''
+ dest="${cfg.location}/${db}.gz"
+ if ${mysql}/bin/mysqldump ${if cfg.singleTransaction then "--single-transaction" else ""} ${db} | ${gzip}/bin/gzip -c > $dest.tmp; then
+ mv $dest.tmp $dest
+ echo "Backed up to $dest"
+ else
+ echo "Failed to back up to $dest"
+ rm -f $dest.tmp
+ failed="$failed ${db}"
+ fi
'';
in
@@ -26,17 +44,16 @@ in
'';
};
- period = mkOption {
- default = "15 01 * * *";
+ calendar = mkOption {
+ type = types.str;
+ default = "01:15:00";
description = ''
- This option defines (in the format used by cron) when the
- databases should be dumped.
- The default is to update at 01:15 (at night) every day.
+ Configured when to run the backup service systemd unit (DayOfWeek Year-Month-Day Hour:Minute:Second).
'';
};
user = mkOption {
- default = "mysql";
+ default = defaultUser;
description = ''
User to be used to perform backup.
'';
@@ -66,16 +83,49 @@ in
};
- config = mkIf config.services.mysqlBackup.enable {
+ config = mkIf cfg.enable {
+ users.extraUsers = optionalAttrs (cfg.user == defaultUser) (singleton
+ { name = defaultUser;
+ isSystemUser = true;
+ createHome = false;
+ home = cfg.location;
+ group = "nogroup";
+ });
- services.cron.systemCronJobs = map mysqlBackupCron config.services.mysqlBackup.databases;
-
- system.activationScripts.mysqlBackup = stringAfter [ "stdio" "users" ]
- ''
- mkdir -m 0700 -p ${config.services.mysqlBackup.location}
- chown ${config.services.mysqlBackup.user} ${config.services.mysqlBackup.location}
- '';
+ services.mysql.ensureUsers = [{
+ name = cfg.user;
+ ensurePermissions = with lib;
+ let
+ privs = "SELECT, SHOW VIEW, TRIGGER, LOCK TABLES";
+ grant = db: nameValuePair "${db}.*" privs;
+ in
+ listToAttrs (map grant cfg.databases);
+ }];
+ systemd = {
+ timers."mysql-backup" = {
+ description = "Mysql backup timer";
+ wantedBy = [ "timers.target" ];
+ timerConfig = {
+ OnCalendar = cfg.calendar;
+ AccuracySec = "5m";
+ Unit = "mysql-backup.service";
+ };
+ };
+ services."mysql-backup" = {
+ description = "Mysql backup service";
+ enable = true;
+ serviceConfig = {
+ User = cfg.user;
+ PermissionsStartOnly = true;
+ };
+ preStart = ''
+ mkdir -m 0700 -p ${cfg.location}
+ chown -R ${cfg.user} ${cfg.location}
+ '';
+ script = backupScript;
+ };
+ };
};
}
diff --git a/nixos/modules/services/cluster/kubernetes/dashboard.nix b/nixos/modules/services/cluster/kubernetes/dashboard.nix
new file mode 100644
index 000000000000..482cbd939cb7
--- /dev/null
+++ b/nixos/modules/services/cluster/kubernetes/dashboard.nix
@@ -0,0 +1,160 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+ cfg = config.services.kubernetes.addons.dashboard;
+
+ name = "gcr.io/google_containers/kubernetes-dashboard-amd64";
+ version = "v1.6.3";
+
+ image = pkgs.dockerTools.pullImage {
+ imageName = name;
+ imageTag = version;
+ sha256 = "0b5v7xa3s91yi9yfsw2b8wijiprnicbb02f5kqa579h4yndb3gfz";
+ };
+in {
+ options.services.kubernetes.addons.dashboard = {
+ enable = mkEnableOption "kubernetes dashboard addon";
+
+ enableRBAC = mkOption {
+ description = "Whether to enable role based access control is enabled for kubernetes dashboard";
+ type = types.bool;
+ default = elem "RBAC" config.services.kubernetes.apiserver.authorizationMode;
+ };
+ };
+
+ config = mkIf cfg.enable {
+ services.kubernetes.kubelet.seedDockerImages = [image];
+
+ services.kubernetes.addonManager.addons = {
+ kubernetes-dashboard-deployment = {
+ kind = "Deployment";
+ apiVersion = "apps/v1beta1";
+ metadata = {
+ labels = {
+ k8s-addon = "kubernetes-dashboard.addons.k8s.io";
+ k8s-app = "kubernetes-dashboard";
+ version = version;
+ "kubernetes.io/cluster-service" = "true";
+ "addonmanager.kubernetes.io/mode" = "Reconcile";
+ };
+ name = "kubernetes-dashboard";
+ namespace = "kube-system";
+ };
+ spec = {
+ replicas = 1;
+ revisionHistoryLimit = 10;
+ selector.matchLabels."k8s-app" = "kubernetes-dashboard";
+ template = {
+ metadata = {
+ labels = {
+ k8s-addon = "kubernetes-dashboard.addons.k8s.io";
+ k8s-app = "kubernetes-dashboard";
+ version = version;
+ "kubernetes.io/cluster-service" = "true";
+ };
+ annotations = {
+ "scheduler.alpha.kubernetes.io/critical-pod" = "";
+ #"scheduler.alpha.kubernetes.io/tolerations" = ''[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'';
+ };
+ };
+ spec = {
+ containers = [{
+ name = "kubernetes-dashboard";
+ image = "${name}:${version}";
+ ports = [{
+ containerPort = 9090;
+ protocol = "TCP";
+ }];
+ resources = {
+ limits = {
+ cpu = "100m";
+ memory = "50Mi";
+ };
+ requests = {
+ cpu = "100m";
+ memory = "50Mi";
+ };
+ };
+ livenessProbe = {
+ httpGet = {
+ path = "/";
+ port = 9090;
+ };
+ initialDelaySeconds = 30;
+ timeoutSeconds = 30;
+ };
+ }];
+ serviceAccountName = "kubernetes-dashboard";
+ tolerations = [{
+ key = "node-role.kubernetes.io/master";
+ effect = "NoSchedule";
+ }];
+ };
+ };
+ };
+ };
+
+ kubernetes-dashboard-svc = {
+ apiVersion = "v1";
+ kind = "Service";
+ metadata = {
+ labels = {
+ k8s-addon = "kubernetes-dashboard.addons.k8s.io";
+ k8s-app = "kubernetes-dashboard";
+ "kubernetes.io/cluster-service" = "true";
+ "kubernetes.io/name" = "KubeDashboard";
+ "addonmanager.kubernetes.io/mode" = "Reconcile";
+ };
+ name = "kubernetes-dashboard";
+ namespace = "kube-system";
+ };
+ spec = {
+ ports = [{
+ port = 80;
+ targetPort = 9090;
+ }];
+ selector.k8s-app = "kubernetes-dashboard";
+ };
+ };
+
+ kubernetes-dashboard-sa = {
+ apiVersion = "v1";
+ kind = "ServiceAccount";
+ metadata = {
+ labels = {
+ k8s-app = "kubernetes-dashboard";
+ k8s-addon = "kubernetes-dashboard.addons.k8s.io";
+ "addonmanager.kubernetes.io/mode" = "Reconcile";
+ };
+ name = "kubernetes-dashboard";
+ namespace = "kube-system";
+ };
+ };
+ } // (optionalAttrs cfg.enableRBAC {
+ kubernetes-dashboard-crb = {
+ apiVersion = "rbac.authorization.k8s.io/v1beta1";
+ kind = "ClusterRoleBinding";
+ metadata = {
+ name = "kubernetes-dashboard";
+ labels = {
+ k8s-app = "kubernetes-dashboard";
+ k8s-addon = "kubernetes-dashboard.addons.k8s.io";
+ "addonmanager.kubernetes.io/mode" = "Reconcile";
+ };
+ };
+ roleRef = {
+ apiGroup = "rbac.authorization.k8s.io";
+ kind = "ClusterRole";
+ name = "cluster-admin";
+ };
+ subjects = [{
+ kind = "ServiceAccount";
+ name = "kubernetes-dashboard";
+ namespace = "kube-system";
+ }];
+ };
+ });
+ };
+}
diff --git a/nixos/modules/services/cluster/kubernetes.nix b/nixos/modules/services/cluster/kubernetes/default.nix
similarity index 58%
rename from nixos/modules/services/cluster/kubernetes.nix
rename to nixos/modules/services/cluster/kubernetes/default.nix
index 4c9d9aad0e2d..077953e4d4f8 100644
--- a/nixos/modules/services/cluster/kubernetes.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@@ -15,19 +15,19 @@ let
config.Cmd = "/bin/pause";
};
- kubeconfig = pkgs.writeText "kubeconfig" (builtins.toJSON {
+ mkKubeConfig = name: cfg: pkgs.writeText "${name}-kubeconfig" (builtins.toJSON {
apiVersion = "v1";
kind = "Config";
clusters = [{
name = "local";
- cluster.certificate-authority = cfg.kubeconfig.caFile;
- cluster.server = cfg.kubeconfig.server;
+ cluster.certificate-authority = cfg.caFile;
+ cluster.server = cfg.server;
}];
users = [{
name = "kubelet";
user = {
- client-certificate = cfg.kubeconfig.certFile;
- client-key = cfg.kubeconfig.keyFile;
+ client-certificate = cfg.certFile;
+ client-key = cfg.keyFile;
};
}];
contexts = [{
@@ -39,12 +39,42 @@ let
}];
});
- policyFile = pkgs.writeText "kube-policy"
- (concatStringsSep "\n" (map builtins.toJSON cfg.apiserver.authorizationPolicy));
+ mkKubeConfigOptions = prefix: {
+ server = mkOption {
+ description = "${prefix} kube-apiserver server address.";
+ default = "http://${cfg.apiserver.address}:${toString cfg.apiserver.port}";
+ type = types.str;
+ };
+
+ caFile = mkOption {
+ description = "${prefix} certificate authrority file used to connect to kube-apiserver.";
+ type = types.nullOr types.path;
+ default = cfg.caFile;
+ };
+
+ certFile = mkOption {
+ description = "${prefix} client certificate file used to connect to kube-apiserver.";
+ type = types.nullOr types.path;
+ default = null;
+ };
+
+ keyFile = mkOption {
+ description = "${prefix} client key file used to connect to kube-apiserver.";
+ type = types.nullOr types.path;
+ default = null;
+ };
+ };
+
+ kubeConfigDefaults = {
+ server = mkDefault cfg.kubeconfig.server;
+ caFile = mkDefault cfg.kubeconfig.caFile;
+ certFile = mkDefault cfg.kubeconfig.certFile;
+ keyFile = mkDefault cfg.kubeconfig.keyFile;
+ };
cniConfig = pkgs.buildEnv {
name = "kubernetes-cni-config";
- paths = imap1 (i: entry:
+ paths = imap (i: entry:
pkgs.writeTextDir "${toString (10+i)}-${entry.type}.conf" (builtins.toJSON entry)
) cfg.kubelet.cni.config;
};
@@ -56,6 +86,45 @@ let
) cfg.kubelet.manifests;
};
+ addons = pkgs.runCommand "kubernetes-addons" { } ''
+ mkdir -p $out
+ # since we are mounting the addons to the addon manager, they need to be copied
+ ${concatMapStringsSep ";" (a: "cp -v ${a}/* $out/") (mapAttrsToList (name: addon:
+ pkgs.writeTextDir "${name}.json" (builtins.toJSON addon)
+ ) (cfg.addonManager.addons))}
+ '';
+
+ taintOptions = { name, ... }: {
+ options = {
+ key = mkOption {
+ description = "Key of taint.";
+ default = name;
+ type = types.str;
+ };
+ value = mkOption {
+ description = "Value of taint.";
+ type = types.str;
+ };
+ effect = mkOption {
+ description = "Effect of taint.";
+ example = "NoSchedule";
+ type = types.enum ["NoSchedule" "PreferNoSchedule" "NoExecute"];
+ };
+ };
+ };
+
+ taints = concatMapStringsSep "," (v: "${v.key}=${v.value}:${v.effect}") (mapAttrsToList (n: v: v) cfg.kubelet.taints);
+
+ # needed for flannel to pass options to docker
+ mkDockerOpts = pkgs.runCommand "mk-docker-opts" {
+ buildInputs = [ pkgs.makeWrapper ];
+ } ''
+ mkdir -p $out
+ cp ${pkgs.kubernetes.src}/cluster/centos/node/bin/mk-docker-opts.sh $out/mk-docker-opts.sh
+
+ # bashInteractive needed for `compgen`
+ makeWrapper ${pkgs.bashInteractive}/bin/bash $out/mk-docker-opts --add-flags "$out/mk-docker-opts.sh"
+ '';
in {
###### interface
@@ -80,7 +149,7 @@ in {
};
verbose = mkOption {
- description = "Kubernetes enable verbose mode for debugging";
+ description = "Kubernetes enable verbose mode for debugging.";
default = false;
type = types.bool;
};
@@ -93,48 +162,30 @@ in {
};
keyFile = mkOption {
- description = "Etcd key file";
+ description = "Etcd key file.";
default = null;
type = types.nullOr types.path;
};
certFile = mkOption {
- description = "Etcd cert file";
+ description = "Etcd cert file.";
default = null;
type = types.nullOr types.path;
};
caFile = mkOption {
- description = "Etcd ca file";
- default = null;
+ description = "Etcd ca file.";
+ default = cfg.caFile;
type = types.nullOr types.path;
};
};
- kubeconfig = {
- server = mkOption {
- description = "Kubernetes apiserver server address";
- default = "http://${cfg.apiserver.address}:${toString cfg.apiserver.port}";
- type = types.str;
- };
+ kubeconfig = mkKubeConfigOptions "Default kubeconfig";
- caFile = mkOption {
- description = "Certificate authrority file to use to connect to kuberentes apiserver";
- type = types.nullOr types.path;
- default = null;
- };
-
- certFile = mkOption {
- description = "Client certificate file to use to connect to kubernetes";
- type = types.nullOr types.path;
- default = null;
- };
-
- keyFile = mkOption {
- description = "Client key file to use to connect to kubernetes";
- type = types.nullOr types.path;
- default = null;
- };
+ caFile = mkOption {
+ description = "Default kubernetes certificate authority";
+ type = types.nullOr types.path;
+ default = null;
};
dataDir = mkOption {
@@ -143,13 +194,25 @@ in {
type = types.path;
};
+ featureGates = mkOption {
+ description = "List set of feature gates";
+ default = [];
+ type = types.listOf types.str;
+ };
+
apiserver = {
enable = mkOption {
- description = "Whether to enable kubernetes apiserver.";
+ description = "Whether to enable Kubernetes apiserver.";
default = false;
type = types.bool;
};
+ featureGates = mkOption {
+ description = "List set of feature gates";
+ default = cfg.featureGates;
+ type = types.listOf types.str;
+ };
+
address = mkOption {
description = "Kubernetes apiserver listening address.";
default = "127.0.0.1";
@@ -175,6 +238,14 @@ in {
type = types.nullOr types.str;
};
+ storageBackend = mkOption {
+ description = ''
+ Kubernetes apiserver storage backend.
+ '';
+ default = "etcd3";
+ type = types.enum ["etcd2" "etcd3"];
+ };
+
port = mkOption {
description = "Kubernetes apiserver listening port.";
default = 8080;
@@ -201,67 +272,69 @@ in {
clientCaFile = mkOption {
description = "Kubernetes apiserver CA file for client auth.";
- default = null;
+ default = cfg.caFile;
type = types.nullOr types.path;
};
- tokenAuth = mkOption {
+ tokenAuthFile = mkOption {
description = ''
Kubernetes apiserver token authentication file. See
'';
default = null;
- example = ''token,user,uid,"group1,group2,group3"'';
- type = types.nullOr types.lines;
+ type = types.nullOr types.path;
+ };
+
+ basicAuthFile = mkOption {
+ description = ''
+ Kubernetes apiserver basic authentication file. See
+
+ '';
+ default = pkgs.writeText "users" ''
+ kubernetes,admin,0
+ '';
+ type = types.nullOr types.path;
};
authorizationMode = mkOption {
description = ''
- Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC). See
-
+ Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See
+
'';
- default = "AlwaysAllow";
- type = types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC"];
+ default = ["RBAC"];
+ type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC"]);
};
authorizationPolicy = mkOption {
description = ''
Kubernetes apiserver authorization policy file. See
-
+
'';
default = [];
- example = literalExample ''
- [
- {user = "admin";}
- {user = "scheduler"; readonly = true; kind= "pods";}
- {user = "scheduler"; kind = "bindings";}
- {user = "kubelet"; readonly = true; kind = "bindings";}
- {user = "kubelet"; kind = "events";}
- {user= "alice"; ns = "projectCaribou";}
- {user = "bob"; readonly = true; ns = "projectCaribou";}
- ]
- '';
type = types.listOf types.attrs;
};
allowPrivileged = mkOption {
- description = "Whether to allow privileged containers on kubernetes.";
+ description = "Whether to allow privileged containers on Kubernetes.";
default = true;
type = types.bool;
};
- portalNet = mkOption {
- description = "Kubernetes CIDR notation IP range from which to assign portal IPs";
- default = "10.10.10.10/24";
+ serviceClusterIpRange = mkOption {
+ description = ''
+ A CIDR notation IP range from which to assign service cluster IPs.
+ This must not overlap with any IP ranges assigned to nodes for pods.
+ '';
+ default = "10.0.0.0/24";
type = types.str;
};
runtimeConfig = mkOption {
description = ''
Api runtime configuration. See
-
+
'';
- default = "";
+ default = "authentication.k8s.io/v1beta1=true";
example = "api/all=false,api/v1=true";
type = types.str;
};
@@ -271,10 +344,11 @@ in {
Kubernetes admission control plugins to use. See
'';
- default = ["NamespaceLifecycle" "LimitRanger" "ServiceAccount" "ResourceQuota"];
+ default = ["NamespaceLifecycle" "LimitRanger" "ServiceAccount" "ResourceQuota" "DefaultStorageClass" "DefaultTolerationSeconds"];
example = [
"NamespaceLifecycle" "NamespaceExists" "LimitRanger"
"SecurityContextDeny" "ServiceAccount" "ResourceQuota"
+ "PodSecurityPolicy" "NodeRestriction" "DefaultStorageClass"
];
type = types.listOf types.str;
};
@@ -290,25 +364,25 @@ in {
};
kubeletClientCaFile = mkOption {
- description = "Path to a cert file for connecting to kubelet";
- default = null;
+ description = "Path to a cert file for connecting to kubelet.";
+ default = cfg.caFile;
type = types.nullOr types.path;
};
kubeletClientCertFile = mkOption {
- description = "Client certificate to use for connections to kubelet";
+ description = "Client certificate to use for connections to kubelet.";
default = null;
type = types.nullOr types.path;
};
kubeletClientKeyFile = mkOption {
- description = "Key to use for connections to kubelet";
+ description = "Key to use for connections to kubelet.";
default = null;
type = types.nullOr types.path;
};
kubeletHttps = mkOption {
- description = "Whether to use https for connections to kubelet";
+ description = "Whether to use https for connections to kubelet.";
default = true;
type = types.bool;
};
@@ -322,11 +396,17 @@ in {
scheduler = {
enable = mkOption {
- description = "Whether to enable kubernetes scheduler.";
+ description = "Whether to enable Kubernetes scheduler.";
default = false;
type = types.bool;
};
+ featureGates = mkOption {
+ description = "List set of feature gates";
+ default = cfg.featureGates;
+ type = types.listOf types.str;
+ };
+
address = mkOption {
description = "Kubernetes scheduler listening address.";
default = "127.0.0.1";
@@ -340,11 +420,13 @@ in {
};
leaderElect = mkOption {
- description = "Whether to start leader election before executing main loop";
+ description = "Whether to start leader election before executing main loop.";
type = types.bool;
- default = false;
+ default = true;
};
+ kubeconfig = mkKubeConfigOptions "Kubernetes scheduler";
+
extraOpts = mkOption {
description = "Kubernetes scheduler extra command line options.";
default = "";
@@ -354,11 +436,17 @@ in {
controllerManager = {
enable = mkOption {
- description = "Whether to enable kubernetes controller manager.";
+ description = "Whether to enable Kubernetes controller manager.";
default = false;
type = types.bool;
};
+ featureGates = mkOption {
+ description = "List set of feature gates";
+ default = cfg.featureGates;
+ type = types.listOf types.str;
+ };
+
address = mkOption {
description = "Kubernetes controller manager listening address.";
default = "127.0.0.1";
@@ -372,9 +460,9 @@ in {
};
leaderElect = mkOption {
- description = "Whether to start leader election before executing main loop";
+ description = "Whether to start leader election before executing main loop.";
type = types.bool;
- default = false;
+ default = true;
};
serviceAccountKeyFile = mkOption {
@@ -391,15 +479,11 @@ in {
Kubernetes controller manager certificate authority file included in
service account's token secret.
'';
- default = null;
+ default = cfg.caFile;
type = types.nullOr types.path;
};
- clusterCidr = mkOption {
- description = "Kubernetes controller manager CIDR Range for Pods in cluster";
- default = "10.10.0.0/16";
- type = types.str;
- };
+ kubeconfig = mkKubeConfigOptions "Kubernetes controller manager";
extraOpts = mkOption {
description = "Kubernetes controller manager extra command line options.";
@@ -410,19 +494,25 @@ in {
kubelet = {
enable = mkOption {
- description = "Whether to enable kubernetes kubelet.";
+ description = "Whether to enable Kubernetes kubelet.";
default = false;
type = types.bool;
};
- registerNode = mkOption {
- description = "Whether to auto register kubelet with API server.";
- default = true;
- type = types.bool;
+ featureGates = mkOption {
+ description = "List set of feature gates";
+ default = cfg.featureGates;
+ type = types.listOf types.str;
};
- registerSchedulable = mkOption {
- description = "Register the node as schedulable. No-op if register-node is false.";
+ seedDockerImages = mkOption {
+ description = "List of docker images to preload on system";
+ default = [];
+ type = types.listOf types.package;
+ };
+
+ registerNode = mkOption {
+ description = "Whether to auto register kubelet with API server.";
default = true;
type = types.bool;
};
@@ -451,6 +541,12 @@ in {
type = types.nullOr types.path;
};
+ clientCaFile = mkOption {
+ description = "Kubernetes apiserver CA file for client authentication.";
+ default = cfg.caFile;
+ type = types.nullOr types.path;
+ };
+
healthz = {
bind = mkOption {
description = "Kubernetes kubelet healthz listening address.";
@@ -466,13 +562,13 @@ in {
};
hostname = mkOption {
- description = "Kubernetes kubelet hostname override";
+ description = "Kubernetes kubelet hostname override.";
default = config.networking.hostName;
type = types.str;
};
allowPrivileged = mkOption {
- description = "Whether to allow kubernetes containers to request privileged mode.";
+ description = "Whether to allow Kubernetes containers to request privileged mode.";
default = true;
type = types.bool;
};
@@ -484,32 +580,32 @@ in {
};
clusterDns = mkOption {
- description = "Use alternative dns.";
- default = "10.10.0.1";
+ description = "Use alternative DNS.";
+ default = "10.1.0.1";
type = types.str;
};
clusterDomain = mkOption {
description = "Use alternative domain.";
- default = "cluster.local";
+ default = config.services.kubernetes.addons.dns.clusterDomain;
type = types.str;
};
networkPlugin = mkOption {
- description = "Network plugin to use by kubernetes";
+ description = "Network plugin to use by Kubernetes.";
type = types.nullOr (types.enum ["cni" "kubenet"]);
default = "kubenet";
};
cni = {
packages = mkOption {
- description = "List of network plugin packages to install";
+ description = "List of network plugin packages to install.";
type = types.listOf types.package;
default = [];
};
config = mkOption {
- description = "Kubernetes CNI configuration";
+ description = "Kubernetes CNI configuration.";
type = types.listOf types.attrs;
default = [];
example = literalExample ''
@@ -536,11 +632,37 @@ in {
};
manifests = mkOption {
- description = "List of manifests to bootstrap with kubelet";
+ description = "List of manifests to bootstrap with kubelet (only pods can be created as manifest entry)";
type = types.attrsOf types.attrs;
default = {};
};
+ applyManifests = mkOption {
+ description = "Whether to apply manifests (this is true for master node).";
+ default = false;
+ type = types.bool;
+ };
+
+ unschedulable = mkOption {
+ description = "Whether to set node taint to unschedulable=true as it is the case of node that has only master role.";
+ default = false;
+ type = types.bool;
+ };
+
+ taints = mkOption {
+ description = "Node taints (https://kubernetes.io/docs/concepts/configuration/assign-pod-node/).";
+ default = {};
+ type = types.attrsOf (types.submodule [ taintOptions ]);
+ };
+
+ nodeIp = mkOption {
+ description = "IP address of the node. If set, kubelet will use this IP address for the node.";
+ default = null;
+ type = types.nullOr types.str;
+ };
+
+ kubeconfig = mkKubeConfigOptions "Kubelet";
+
extraOpts = mkOption {
description = "Kubernetes kubelet extra command line options.";
default = "";
@@ -550,17 +672,25 @@ in {
proxy = {
enable = mkOption {
- description = "Whether to enable kubernetes proxy.";
+ description = "Whether to enable Kubernetes proxy.";
default = false;
type = types.bool;
};
+ featureGates = mkOption {
+ description = "List set of feature gates";
+ default = cfg.featureGates;
+ type = types.listOf types.str;
+ };
+
address = mkOption {
description = "Kubernetes proxy listening address.";
default = "0.0.0.0";
type = types.str;
};
+ kubeconfig = mkKubeConfigOptions "Kubernetes proxy";
+
extraOpts = mkOption {
description = "Kubernetes proxy extra command line options.";
default = "";
@@ -568,57 +698,109 @@ in {
};
};
- dns = {
- enable = mkEnableOption "kubernetes dns service.";
-
- port = mkOption {
- description = "Kubernetes dns listening port";
- default = 53;
- type = types.int;
+ addonManager = {
+ enable = mkOption {
+ description = "Whether to enable Kubernetes addon manager.";
+ default = false;
+ type = types.bool;
};
- domain = mkOption {
- description = "Kuberntes dns domain under which to create names.";
- default = cfg.kubelet.clusterDomain;
- type = types.str;
- };
-
- extraOpts = mkOption {
- description = "Kubernetes dns extra command line options.";
- default = "";
- type = types.str;
+ addons = mkOption {
+ description = "Kubernetes addons (any kind of Kubernetes resource can be an addon).";
+ default = { };
+ type = types.attrsOf (types.either types.attrs (types.listOf types.attrs));
+ example = literalExample ''
+ {
+ "my-service" = {
+ "apiVersion" = "v1";
+ "kind" = "Service";
+ "metadata" = {
+ "name" = "my-service";
+ "namespace" = "default";
+ };
+ "spec" = { ... };
+ };
+ }
+ // import { cfg = config.services.kubernetes; };
+ '';
};
};
+
+ path = mkOption {
+ description = "Packages added to the services' PATH environment variable. Both the bin and sbin subdirectories of each package are added.";
+ type = types.listOf types.package;
+ default = [];
+ };
+
+ clusterCidr = mkOption {
+ description = "Kubernetes controller manager and proxy CIDR Range for Pods in cluster.";
+ default = "10.1.0.0/16";
+ type = types.str;
+ };
+
+ flannel.enable = mkOption {
+ description = "Whether to enable flannel networking";
+ default = false;
+ type = types.bool;
+ };
+
};
###### implementation
config = mkMerge [
(mkIf cfg.kubelet.enable {
- systemd.services.kubelet = {
- description = "Kubernetes Kubelet Service";
- wantedBy = [ "kubernetes.target" ];
- after = [ "network.target" "docker.service" "kube-apiserver.service" ];
- path = with pkgs; [ gitMinimal openssh docker utillinux iproute ethtool thin-provisioning-tools iptables ];
- preStart = ''
- docker load < ${infraContainer}
+ services.kubernetes.kubelet.seedDockerImages = [infraContainer];
+
+ systemd.services.kubelet-bootstrap = {
+ description = "Boostrap Kubelet";
+ wantedBy = ["kubernetes.target"];
+ after = ["docker.service" "network.target"];
+ path = with pkgs; [ docker ];
+ script = ''
+ ${concatMapStrings (img: ''
+ echo "Seeding docker image: ${img}"
+ docker load <${img}
+ '') cfg.kubelet.seedDockerImages}
+
rm /opt/cni/bin/* || true
- ${concatMapStringsSep "\n" (p: "ln -fs ${p.plugins}/* /opt/cni/bin") cfg.kubelet.cni.packages}
+ ${concatMapStrings (package: ''
+ echo "Linking cni package: ${package}"
+ ln -fs ${package.plugins}/* /opt/cni/bin
+ '') cfg.kubelet.cni.packages}
'';
+ serviceConfig = {
+ Slice = "kubernetes.slice";
+ Type = "oneshot";
+ };
+ };
+
+ systemd.services.kubelet = {
+ description = "Kubernetes Kubelet Service";
+ wantedBy = [ "kubernetes.target" ];
+ after = [ "network.target" "docker.service" "kube-apiserver.service" "kubelet-bootstrap.service" ];
+ path = with pkgs; [ gitMinimal openssh docker utillinux iproute ethtool thin-provisioning-tools iptables socat ] ++ cfg.path;
serviceConfig = {
Slice = "kubernetes.slice";
ExecStart = ''${cfg.package}/bin/kubelet \
- --pod-manifest-path=${manifests} \
- --kubeconfig=${kubeconfig} \
+ ${optionalString cfg.kubelet.applyManifests
+ "--pod-manifest-path=${manifests}"} \
+ ${optionalString (taints != "")
+ "--register-with-taints=${taints}"} \
+ --kubeconfig=${mkKubeConfig "kubelet" cfg.kubelet.kubeconfig} \
--require-kubeconfig \
--address=${cfg.kubelet.address} \
--port=${toString cfg.kubelet.port} \
--register-node=${boolToString cfg.kubelet.registerNode} \
- --register-schedulable=${boolToString cfg.kubelet.registerSchedulable} \
${optionalString (cfg.kubelet.tlsCertFile != null)
"--tls-cert-file=${cfg.kubelet.tlsCertFile}"} \
${optionalString (cfg.kubelet.tlsKeyFile != null)
"--tls-private-key-file=${cfg.kubelet.tlsKeyFile}"} \
+ ${optionalString (cfg.kubelet.clientCaFile != null)
+ "--client-ca-file=${cfg.kubelet.clientCaFile}"} \
+ --authentication-token-webhook \
+ --authentication-token-webhook-cache-ttl="10s" \
+ --authorization-mode=Webhook \
--healthz-bind-address=${cfg.kubelet.healthz.bind} \
--healthz-port=${toString cfg.kubelet.healthz.port} \
--hostname-override=${cfg.kubelet.hostname} \
@@ -633,8 +815,11 @@ in {
${optionalString (cfg.kubelet.networkPlugin != null)
"--network-plugin=${cfg.kubelet.networkPlugin}"} \
--cni-conf-dir=${cniConfig} \
- --reconcile-cidr \
--hairpin-mode=hairpin-veth \
+ ${optionalString (cfg.kubelet.nodeIp != null)
+ "--node-ip=${cfg.kubelet.nodeIp}"} \
+ ${optionalString (cfg.kubelet.featureGates != [])
+ "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.kubelet.featureGates}"} \
${optionalString cfg.verbose "--v=6 --log_flush_frequency=1s"} \
${cfg.kubelet.extraOpts}
'';
@@ -642,15 +827,28 @@ in {
};
};
+ # Allways include cni plugins
+ services.kubernetes.kubelet.cni.packages = [pkgs.cni];
+
+ boot.kernelModules = ["br_netfilter"];
+
+ services.kubernetes.kubelet.kubeconfig = kubeConfigDefaults;
+ })
+
+ (mkIf (cfg.kubelet.applyManifests && cfg.kubelet.enable) {
environment.etc = mapAttrs' (name: manifest:
nameValuePair "kubernetes/manifests/${name}.json" {
text = builtins.toJSON manifest;
mode = "0755";
}
) cfg.kubelet.manifests;
+ })
- # Allways include cni plugins
- services.kubernetes.kubelet.cni.packages = [pkgs.cni];
+ (mkIf (cfg.kubelet.unschedulable && cfg.kubelet.enable) {
+ services.kubernetes.kubelet.taints.unschedulable = {
+ value = "true";
+ effect = "NoSchedule";
+ };
})
(mkIf cfg.apiserver.enable {
@@ -677,9 +875,11 @@ in {
"--tls-cert-file=${cfg.apiserver.tlsCertFile}"} \
${optionalString (cfg.apiserver.tlsKeyFile != null)
"--tls-private-key-file=${cfg.apiserver.tlsKeyFile}"} \
- ${optionalString (cfg.apiserver.tokenAuth != null)
- "--token-auth-file=${cfg.apiserver.tokenAuth}"} \
- --kubelet-https=${boolToString cfg.apiserver.kubeletHttps} \
+ ${optionalString (cfg.apiserver.tokenAuthFile != null)
+ "--token-auth-file=${cfg.apiserver.tokenAuthFile}"} \
+ ${optionalString (cfg.apiserver.basicAuthFile != null)
+ "--basic-auth-file=${cfg.apiserver.basicAuthFile}"} \
+ --kubelet-https=${if cfg.apiserver.kubeletHttps then "true" else "false"} \
${optionalString (cfg.apiserver.kubeletClientCaFile != null)
"--kubelet-certificate-authority=${cfg.apiserver.kubeletClientCaFile}"} \
${optionalString (cfg.apiserver.kubeletClientCertFile != null)
@@ -688,11 +888,15 @@ in {
"--kubelet-client-key=${cfg.apiserver.kubeletClientKeyFile}"} \
${optionalString (cfg.apiserver.clientCaFile != null)
"--client-ca-file=${cfg.apiserver.clientCaFile}"} \
- --authorization-mode=${cfg.apiserver.authorizationMode} \
- ${optionalString (cfg.apiserver.authorizationMode == "ABAC")
- "--authorization-policy-file=${policyFile}"} \
+ --authorization-mode=${concatStringsSep "," cfg.apiserver.authorizationMode} \
+ ${optionalString (elem "ABAC" cfg.apiserver.authorizationMode)
+ "--authorization-policy-file=${
+ pkgs.writeText "kube-auth-policy.jsonl"
+ (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.apiserver.authorizationPolicy)
+ }"
+ } \
--secure-port=${toString cfg.apiserver.securePort} \
- --service-cluster-ip-range=${cfg.apiserver.portalNet} \
+ --service-cluster-ip-range=${cfg.apiserver.serviceClusterIpRange} \
${optionalString (cfg.apiserver.runtimeConfig != "")
"--runtime-config=${cfg.apiserver.runtimeConfig}"} \
--admission_control=${concatStringsSep "," cfg.apiserver.admissionControl} \
@@ -700,6 +904,9 @@ in {
"--service-account-key-file=${cfg.apiserver.serviceAccountKeyFile}"} \
${optionalString cfg.verbose "--v=6"} \
${optionalString cfg.verbose "--log-flush-frequency=1s"} \
+ --storage-backend=${cfg.apiserver.storageBackend} \
+ ${optionalString (cfg.kubelet.featureGates != [])
+ "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.kubelet.featureGates}"} \
${cfg.apiserver.extraOpts}
'';
WorkingDirectory = cfg.dataDir;
@@ -723,9 +930,11 @@ in {
--address=${cfg.scheduler.address} \
--port=${toString cfg.scheduler.port} \
--leader-elect=${boolToString cfg.scheduler.leaderElect} \
- --kubeconfig=${kubeconfig} \
+ --kubeconfig=${mkKubeConfig "kube-scheduler" cfg.scheduler.kubeconfig} \
${optionalString cfg.verbose "--v=6"} \
${optionalString cfg.verbose "--log-flush-frequency=1s"} \
+ ${optionalString (cfg.scheduler.featureGates != [])
+ "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.scheduler.featureGates}"} \
${cfg.scheduler.extraOpts}
'';
WorkingDirectory = cfg.dataDir;
@@ -733,6 +942,8 @@ in {
Group = "kubernetes";
};
};
+
+ services.kubernetes.scheduler.kubeconfig = kubeConfigDefaults;
})
(mkIf cfg.controllerManager.enable {
@@ -747,16 +958,19 @@ in {
ExecStart = ''${cfg.package}/bin/kube-controller-manager \
--address=${cfg.controllerManager.address} \
--port=${toString cfg.controllerManager.port} \
- --kubeconfig=${kubeconfig} \
+ --kubeconfig=${mkKubeConfig "kube-controller-manager" cfg.controllerManager.kubeconfig} \
--leader-elect=${boolToString cfg.controllerManager.leaderElect} \
${if (cfg.controllerManager.serviceAccountKeyFile!=null)
then "--service-account-private-key-file=${cfg.controllerManager.serviceAccountKeyFile}"
else "--service-account-private-key-file=/var/run/kubernetes/apiserver.key"} \
- ${optionalString (cfg.controllerManager.rootCaFile!=null)
- "--root-ca-file=${cfg.controllerManager.rootCaFile}"} \
- ${optionalString (cfg.controllerManager.clusterCidr!=null)
- "--cluster-cidr=${cfg.controllerManager.clusterCidr}"} \
+ ${if (cfg.controllerManager.rootCaFile!=null)
+ then "--root-ca-file=${cfg.controllerManager.rootCaFile}"
+ else "--root-ca-file=/var/run/kubernetes/apiserver.crt"} \
+ ${optionalString (cfg.clusterCidr!=null)
+ "--cluster-cidr=${cfg.clusterCidr}"} \
--allocate-node-cidrs=true \
+ ${optionalString (cfg.controllerManager.featureGates != [])
+ "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.controllerManager.featureGates}"} \
${optionalString cfg.verbose "--v=6"} \
${optionalString cfg.verbose "--log-flush-frequency=1s"} \
${cfg.controllerManager.extraOpts}
@@ -765,7 +979,10 @@ in {
User = "kubernetes";
Group = "kubernetes";
};
+ path = cfg.path;
};
+
+ services.kubernetes.controllerManager.kubeconfig = kubeConfigDefaults;
})
(mkIf cfg.proxy.enable {
@@ -773,65 +990,79 @@ in {
description = "Kubernetes Proxy Service";
wantedBy = [ "kubernetes.target" ];
after = [ "kube-apiserver.service" ];
- path = [pkgs.iptables];
+ path = [pkgs.iptables pkgs.conntrack_tools];
serviceConfig = {
Slice = "kubernetes.slice";
ExecStart = ''${cfg.package}/bin/kube-proxy \
- --kubeconfig=${kubeconfig} \
+ --kubeconfig=${mkKubeConfig "kube-proxy" cfg.proxy.kubeconfig} \
--bind-address=${cfg.proxy.address} \
+ ${optionalString (cfg.proxy.featureGates != [])
+ "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.proxy.featureGates}"} \
${optionalString cfg.verbose "--v=6"} \
${optionalString cfg.verbose "--log-flush-frequency=1s"} \
+ ${optionalString (cfg.clusterCidr!=null)
+ "--cluster-cidr=${cfg.clusterCidr}"} \
${cfg.proxy.extraOpts}
'';
WorkingDirectory = cfg.dataDir;
};
};
- })
- (mkIf cfg.dns.enable {
- systemd.services.kube-dns = {
- description = "Kubernetes Dns Service";
- wantedBy = [ "kubernetes.target" ];
- after = [ "kube-apiserver.service" ];
- serviceConfig = {
- Slice = "kubernetes.slice";
- ExecStart = ''${cfg.package}/bin/kube-dns \
- --kubecfg-file=${kubeconfig} \
- --dns-port=${toString cfg.dns.port} \
- --domain=${cfg.dns.domain} \
- ${optionalString cfg.verbose "--v=6"} \
- ${optionalString cfg.verbose "--log-flush-frequency=1s"} \
- ${cfg.dns.extraOpts}
- '';
- WorkingDirectory = cfg.dataDir;
- User = "kubernetes";
- Group = "kubernetes";
- AmbientCapabilities = "cap_net_bind_service";
- SendSIGHUP = true;
- };
- };
- })
+ # kube-proxy needs iptables
+ networking.firewall.enable = mkDefault true;
- (mkIf cfg.kubelet.enable {
- boot.kernelModules = ["br_netfilter"];
+ services.kubernetes.proxy.kubeconfig = kubeConfigDefaults;
})
(mkIf (any (el: el == "master") cfg.roles) {
virtualisation.docker.enable = mkDefault true;
services.kubernetes.kubelet.enable = mkDefault true;
services.kubernetes.kubelet.allowPrivileged = mkDefault true;
+ services.kubernetes.kubelet.applyManifests = mkDefault true;
services.kubernetes.apiserver.enable = mkDefault true;
services.kubernetes.scheduler.enable = mkDefault true;
services.kubernetes.controllerManager.enable = mkDefault true;
services.etcd.enable = mkDefault (cfg.etcd.servers == ["http://127.0.0.1:2379"]);
+ services.kubernetes.addonManager.enable = mkDefault true;
+ services.kubernetes.proxy.enable = mkDefault true;
+ })
+
+ # if this node is only a master make it unschedulable by default
+ (mkIf (all (el: el == "master") cfg.roles) {
+ services.kubernetes.kubelet.unschedulable = mkDefault true;
})
(mkIf (any (el: el == "node") cfg.roles) {
- virtualisation.docker.enable = mkDefault true;
- virtualisation.docker.logDriver = mkDefault "json-file";
+ virtualisation.docker = {
+ enable = mkDefault true;
+
+ # kubernetes needs access to logs
+ logDriver = mkDefault "json-file";
+
+ # iptables must be disabled for kubernetes
+ extraOptions = "--iptables=false --ip-masq=false";
+ };
+
services.kubernetes.kubelet.enable = mkDefault true;
services.kubernetes.proxy.enable = mkDefault true;
- services.kubernetes.dns.enable = mkDefault true;
+ })
+
+ (mkIf cfg.addonManager.enable {
+ environment.etc."kubernetes/addons".source = "${addons}/";
+
+ systemd.services.kube-addon-manager = {
+ description = "Kubernetes addon manager";
+ wantedBy = [ "kubernetes.target" ];
+ after = [ "kube-apiserver.service" ];
+ environment.ADDON_PATH = "/etc/kubernetes/addons/";
+ serviceConfig = {
+ Slice = "kubernetes.slice";
+ ExecStart = "${cfg.package}/bin/kube-addons";
+ WorkingDirectory = cfg.dataDir;
+ User = "kubernetes";
+ Group = "kubernetes";
+ };
+ };
})
(mkIf (
@@ -839,8 +1070,7 @@ in {
cfg.scheduler.enable ||
cfg.controllerManager.enable ||
cfg.kubelet.enable ||
- cfg.proxy.enable ||
- cfg.dns.enable
+ cfg.proxy.enable
) {
systemd.targets.kubernetes = {
description = "Kubernetes";
@@ -864,6 +1094,54 @@ in {
createHome = true;
};
users.extraGroups.kubernetes.gid = config.ids.gids.kubernetes;
+
+ # dns addon is enabled by default
+ services.kubernetes.addons.dns.enable = mkDefault true;
+ })
+
+ (mkIf cfg.flannel.enable {
+ services.flannel = {
+ enable = mkDefault true;
+ network = mkDefault cfg.clusterCidr;
+ etcd = mkDefault {
+ endpoints = cfg.etcd.servers;
+ inherit (cfg.etcd) caFile certFile keyFile;
+ };
+ };
+
+ services.kubernetes.kubelet = {
+ networkPlugin = mkDefault "cni";
+ cni.config = mkDefault [{
+ name = "mynet";
+ type = "flannel";
+ delegate = {
+ isDefaultGateway = true;
+ bridge = "docker0";
+ };
+ }];
+ };
+
+ systemd.services."mk-docker-opts" = {
+ description = "Pre-Docker Actions";
+ wantedBy = [ "flannel.service" ];
+ before = [ "docker.service" ];
+ after = [ "flannel.service" ];
+ path = [ pkgs.gawk pkgs.gnugrep ];
+ script = ''
+ mkdir -p /run/flannel
+ ${mkDockerOpts}/mk-docker-opts -d /run/flannel/docker
+ '';
+ serviceConfig.Type = "oneshot";
+ };
+ systemd.services.docker.serviceConfig.EnvironmentFile = "/run/flannel/docker";
+
+ # read environment variables generated by mk-docker-opts
+ virtualisation.docker.extraOptions = "$DOCKER_OPTS";
+
+ networking.firewall.allowedUDPPorts = [
+ 8285 # flannel udp
+ 8472 # flannel vxlan
+ ];
})
];
}
diff --git a/nixos/modules/services/cluster/kubernetes/dns.nix b/nixos/modules/services/cluster/kubernetes/dns.nix
new file mode 100644
index 000000000000..d70663fa5d7b
--- /dev/null
+++ b/nixos/modules/services/cluster/kubernetes/dns.nix
@@ -0,0 +1,311 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+ version = "1.14.4";
+
+ k8s-dns-kube-dns = pkgs.dockerTools.pullImage {
+ imageName = "gcr.io/google_containers/k8s-dns-kube-dns-amd64";
+ imageTag = version;
+ sha256 = "0g64jc2076ng28xl4w3w9svf7hc6s9h8rq9mhvvwpfy2p6lgj6gy";
+ };
+
+ k8s-dns-dnsmasq-nanny = pkgs.dockerTools.pullImage {
+ imageName = "gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64";
+ imageTag = version;
+ sha256 = "0sdpsbj1vismihy7ass1cn96nwmav6sf3r5h6i4k2dxha0y0jsh5";
+ };
+
+ k8s-dns-sidecar = pkgs.dockerTools.pullImage {
+ imageName = "gcr.io/google_containers/k8s-dns-sidecar-amd64";
+ imageTag = version;
+ sha256 = "01zpi189hpy2z62awl38fap908s8rrhc3v5gb6m90y2pycl4ad6q";
+ };
+
+ cfg = config.services.kubernetes.addons.dns;
+in {
+ options.services.kubernetes.addons.dns = {
+ enable = mkEnableOption "kubernetes dns addon";
+
+ clusterIp = mkOption {
+ description = "Dns addon clusterIP";
+
+ # this default is also what kubernetes users
+ default = (
+ concatStringsSep "." (
+ take 3 (splitString "." config.services.kubernetes.apiserver.serviceClusterIpRange
+ ))
+ ) + ".254";
+ type = types.str;
+ };
+
+ clusterDomain = mkOption {
+ description = "Dns cluster domain";
+ default = "cluster.local";
+ type = types.str;
+ };
+ };
+
+ config = mkIf cfg.enable {
+ services.kubernetes.kubelet.seedDockerImages = [
+ k8s-dns-kube-dns
+ k8s-dns-dnsmasq-nanny
+ k8s-dns-sidecar
+ ];
+
+ services.kubernetes.addonManager.addons = {
+ kubedns-deployment = {
+ apiVersion = "apps/v1beta1";
+ kind = "Deployment";
+ metadata = {
+ labels = {
+ "addonmanager.kubernetes.io/mode" = "Reconcile";
+ "k8s-app" = "kube-dns";
+ "kubernetes.io/cluster-service" = "true";
+ };
+ name = "kube-dns";
+ namespace = "kube-system";
+ };
+ spec = {
+ selector.matchLabels."k8s-app" = "kube-dns";
+ strategy = {
+ rollingUpdate = {
+ maxSurge = "10%";
+ maxUnavailable = 0;
+ };
+ };
+ template = {
+ metadata = {
+ annotations."scheduler.alpha.kubernetes.io/critical-pod" = "";
+ labels.k8s-app = "kube-dns";
+ };
+ spec = {
+ containers = [
+ {
+ name = "kubedns";
+ args = [
+ "--domain=${cfg.clusterDomain}"
+ "--dns-port=10053"
+ "--config-dir=/kube-dns-config"
+ "--v=2"
+ ];
+ env = [
+ {
+ name = "PROMETHEUS_PORT";
+ value = "10055";
+ }
+ ];
+ image = "gcr.io/google_containers/k8s-dns-kube-dns-amd64:${version}";
+ livenessProbe = {
+ failureThreshold = 5;
+ httpGet = {
+ path = "/healthcheck/kubedns";
+ port = 10054;
+ scheme = "HTTP";
+ };
+ initialDelaySeconds = 60;
+ successThreshold = 1;
+ timeoutSeconds = 5;
+ };
+ ports = [
+ {
+ containerPort = 10053;
+ name = "dns-local";
+ protocol = "UDP";
+ }
+ {
+ containerPort = 10053;
+ name = "dns-tcp-local";
+ protocol = "TCP";
+ }
+ {
+ containerPort = 10055;
+ name = "metrics";
+ protocol = "TCP";
+ }
+ ];
+ readinessProbe = {
+ httpGet = {
+ path = "/readiness";
+ port = 8081;
+ scheme = "HTTP";
+ };
+ initialDelaySeconds = 3;
+ timeoutSeconds = 5;
+ };
+ resources = {
+ limits.memory = "170Mi";
+ requests = {
+ cpu = "100m";
+ memory = "70Mi";
+ };
+ };
+ volumeMounts = [
+ {
+ mountPath = "/kube-dns-config";
+ name = "kube-dns-config";
+ }
+ ];
+ }
+ {
+ args = [
+ "-v=2"
+ "-logtostderr"
+ "-configDir=/etc/k8s/dns/dnsmasq-nanny"
+ "-restartDnsmasq=true"
+ "--"
+ "-k"
+ "--cache-size=1000"
+ "--log-facility=-"
+ "--server=/${cfg.clusterDomain}/127.0.0.1#10053"
+ "--server=/in-addr.arpa/127.0.0.1#10053"
+ "--server=/ip6.arpa/127.0.0.1#10053"
+ ];
+ image = "gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:${version}";
+ livenessProbe = {
+ failureThreshold = 5;
+ httpGet = {
+ path = "/healthcheck/dnsmasq";
+ port = 10054;
+ scheme = "HTTP";
+ };
+ initialDelaySeconds = 60;
+ successThreshold = 1;
+ timeoutSeconds = 5;
+ };
+ name = "dnsmasq";
+ ports = [
+ {
+ containerPort = 53;
+ name = "dns";
+ protocol = "UDP";
+ }
+ {
+ containerPort = 53;
+ name = "dns-tcp";
+ protocol = "TCP";
+ }
+ ];
+ resources = {
+ requests = {
+ cpu = "150m";
+ memory = "20Mi";
+ };
+ };
+ volumeMounts = [
+ {
+ mountPath = "/etc/k8s/dns/dnsmasq-nanny";
+ name = "kube-dns-config";
+ }
+ ];
+ }
+ {
+ name = "sidecar";
+ image = "gcr.io/google_containers/k8s-dns-sidecar-amd64:${version}";
+ args = [
+ "--v=2"
+ "--logtostderr"
+ "--probe=kubedns,127.0.0.1:10053,kubernetes.default.svc.${cfg.clusterDomain},5,A"
+ "--probe=dnsmasq,127.0.0.1:53,kubernetes.default.svc.${cfg.clusterDomain},5,A"
+ ];
+ livenessProbe = {
+ failureThreshold = 5;
+ httpGet = {
+ path = "/metrics";
+ port = 10054;
+ scheme = "HTTP";
+ };
+ initialDelaySeconds = 60;
+ successThreshold = 1;
+ timeoutSeconds = 5;
+ };
+ ports = [
+ {
+ containerPort = 10054;
+ name = "metrics";
+ protocol = "TCP";
+ }
+ ];
+ resources = {
+ requests = {
+ cpu = "10m";
+ memory = "20Mi";
+ };
+ };
+ }
+ ];
+ dnsPolicy = "Default";
+ serviceAccountName = "kube-dns";
+ tolerations = [
+ {
+ key = "CriticalAddonsOnly";
+ operator = "Exists";
+ }
+ ];
+ volumes = [
+ {
+ configMap = {
+ name = "kube-dns";
+ optional = true;
+ };
+ name = "kube-dns-config";
+ }
+ ];
+ };
+ };
+ };
+ };
+
+ kubedns-svc = {
+ apiVersion = "v1";
+ kind = "Service";
+ metadata = {
+ labels = {
+ "addonmanager.kubernetes.io/mode" = "Reconcile";
+ "k8s-app" = "kube-dns";
+ "kubernetes.io/cluster-service" = "true";
+ "kubernetes.io/name" = "KubeDNS";
+ };
+ name = "kube-dns";
+ namespace = "kube-system";
+ };
+ spec = {
+ clusterIP = cfg.clusterIp;
+ ports = [
+ {name = "dns"; port = 53; protocol = "UDP";}
+ {name = "dns-tcp"; port = 53; protocol = "TCP";}
+ ];
+ selector.k8s-app = "kube-dns";
+ };
+ };
+
+ kubedns-sa = {
+ apiVersion = "v1";
+ kind = "ServiceAccount";
+ metadata = {
+ name = "kube-dns";
+ namespace = "kube-system";
+ labels = {
+ "kubernetes.io/cluster-service" = "true";
+ "addonmanager.kubernetes.io/mode" = "Reconcile";
+ };
+ };
+ };
+
+ kubedns-cm = {
+ apiVersion = "v1";
+ kind = "ConfigMap";
+ metadata = {
+ name = "kube-dns";
+ namespace = "kube-system";
+ labels = {
+ "addonmanager.kubernetes.io/mode" = "EnsureExists";
+ };
+ };
+ };
+ };
+
+ services.kubernetes.kubelet.clusterDns = mkDefault cfg.clusterIp;
+ };
+}
diff --git a/nixos/modules/services/databases/influxdb.nix b/nixos/modules/services/databases/influxdb.nix
index eeab33309fda..15b711f57b13 100644
--- a/nixos/modules/services/databases/influxdb.nix
+++ b/nixos/modules/services/databases/influxdb.nix
@@ -170,11 +170,16 @@ in
mkdir -m 0770 -p ${cfg.dataDir}
if [ "$(id -u)" = 0 ]; then chown -R ${cfg.user}:${cfg.group} ${cfg.dataDir}; fi
'';
- postStart = mkBefore ''
- until ${pkgs.curl.bin}/bin/curl -s -o /dev/null ${if configOptions.http.https-enabled then "-k https" else "http"}://127.0.0.1${toString configOptions.http.bind-address}/ping; do
- sleep 1;
- done
- '';
+ postStart =
+ let
+ scheme = if configOptions.http.https-enabled then "-k https" else "http";
+ bindAddr = (ba: if hasPrefix ":" ba then "127.0.0.1${ba}" else "${ba}")(toString configOptions.http.bind-address);
+ in
+ mkBefore ''
+ until ${pkgs.curl.bin}/bin/curl -s -o /dev/null ${scheme}://${bindAddr}/ping; do
+ sleep 1;
+ done
+ '';
};
users.extraUsers = optional (cfg.user == "influxdb") {
diff --git a/nixos/modules/services/desktops/gnome3/at-spi2-core.nix b/nixos/modules/services/desktops/gnome3/at-spi2-core.nix
index 6e4c59f4bb37..55ed2d9ee21b 100644
--- a/nixos/modules/services/desktops/gnome3/at-spi2-core.nix
+++ b/nixos/modules/services/desktops/gnome3/at-spi2-core.nix
@@ -34,6 +34,8 @@ with lib;
services.dbus.packages = [ pkgs.at_spi2_core ];
+ systemd.packages = [ pkgs.at_spi2_core ];
+
};
}
diff --git a/nixos/modules/services/desktops/gnome3/evolution-data-server.nix b/nixos/modules/services/desktops/gnome3/evolution-data-server.nix
index 2db2e2fe1c34..86a47488d865 100644
--- a/nixos/modules/services/desktops/gnome3/evolution-data-server.nix
+++ b/nixos/modules/services/desktops/gnome3/evolution-data-server.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -33,11 +30,11 @@ in
config = mkIf config.services.gnome3.evolution-data-server.enable {
- environment.systemPackages = [ gnome3.evolution_data_server ];
+ environment.systemPackages = [ pkgs.gnome3.evolution_data_server ];
- services.dbus.packages = [ gnome3.evolution_data_server ];
+ services.dbus.packages = [ pkgs.gnome3.evolution_data_server ];
- systemd.packages = [ gnome3.evolution_data_server ];
+ systemd.packages = [ pkgs.gnome3.evolution_data_server ];
};
diff --git a/nixos/modules/services/desktops/gnome3/gnome-disks.nix b/nixos/modules/services/desktops/gnome3/gnome-disks.nix
index 33c4bc49f982..139534cdb892 100644
--- a/nixos/modules/services/desktops/gnome3/gnome-disks.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-disks.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -33,9 +30,9 @@ in
config = mkIf config.services.gnome3.gnome-disks.enable {
- environment.systemPackages = [ gnome3.gnome-disk-utility ];
+ environment.systemPackages = [ pkgs.gnome3.gnome-disk-utility ];
- services.dbus.packages = [ gnome3.gnome-disk-utility ];
+ services.dbus.packages = [ pkgs.gnome3.gnome-disk-utility ];
};
diff --git a/nixos/modules/services/desktops/gnome3/gnome-documents.nix b/nixos/modules/services/desktops/gnome3/gnome-documents.nix
index 88bbdadfcbdd..f6efb6684240 100644
--- a/nixos/modules/services/desktops/gnome3/gnome-documents.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-documents.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -33,9 +30,9 @@ in
config = mkIf config.services.gnome3.gnome-documents.enable {
- environment.systemPackages = [ gnome3.gnome-documents ];
+ environment.systemPackages = [ pkgs.gnome3.gnome-documents ];
- services.dbus.packages = [ gnome3.gnome-documents ];
+ services.dbus.packages = [ pkgs.gnome3.gnome-documents ];
services.gnome3.gnome-online-accounts.enable = true;
diff --git a/nixos/modules/services/desktops/gnome3/gnome-keyring.nix b/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
index a36643a1cfb3..2a68af5a7dd8 100644
--- a/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -34,9 +31,9 @@ in
config = mkIf config.services.gnome3.gnome-keyring.enable {
- environment.systemPackages = [ gnome3.gnome_keyring ];
+ environment.systemPackages = [ pkgs.gnome3.gnome_keyring ];
- services.dbus.packages = [ gnome3.gnome_keyring gnome3.gcr ];
+ services.dbus.packages = [ pkgs.gnome3.gnome_keyring pkgs.gnome3.gcr ];
};
diff --git a/nixos/modules/services/desktops/gnome3/gnome-online-accounts.nix b/nixos/modules/services/desktops/gnome3/gnome-online-accounts.nix
index 82d04c62c70d..0da4aca73ecb 100644
--- a/nixos/modules/services/desktops/gnome3/gnome-online-accounts.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-online-accounts.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -33,9 +30,9 @@ in
config = mkIf config.services.gnome3.gnome-online-accounts.enable {
- environment.systemPackages = [ gnome3.gnome_online_accounts ];
+ environment.systemPackages = [ pkgs.gnome3.gnome_online_accounts ];
- services.dbus.packages = [ gnome3.gnome_online_accounts ];
+ services.dbus.packages = [ pkgs.gnome3.gnome_online_accounts ];
};
diff --git a/nixos/modules/services/desktops/gnome3/gnome-online-miners.nix b/nixos/modules/services/desktops/gnome3/gnome-online-miners.nix
index 6acd633b62c9..d406bf6f5e39 100644
--- a/nixos/modules/services/desktops/gnome3/gnome-online-miners.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-online-miners.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -33,9 +30,9 @@ in
config = mkIf config.services.gnome3.gnome-online-miners.enable {
- environment.systemPackages = [ gnome3.gnome-online-miners ];
+ environment.systemPackages = [ pkgs.gnome3.gnome-online-miners ];
- services.dbus.packages = [ gnome3.gnome-online-miners ];
+ services.dbus.packages = [ pkgs.gnome3.gnome-online-miners ];
};
diff --git a/nixos/modules/services/desktops/gnome3/gnome-terminal-server.nix b/nixos/modules/services/desktops/gnome3/gnome-terminal-server.nix
index 384cede679c6..3ac767bfa00d 100644
--- a/nixos/modules/services/desktops/gnome3/gnome-terminal-server.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-terminal-server.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -33,11 +30,11 @@ in
config = mkIf config.services.gnome3.gnome-terminal-server.enable {
- environment.systemPackages = [ gnome3.gnome_terminal ];
+ environment.systemPackages = [ pkgs.gnome3.gnome_terminal ];
- services.dbus.packages = [ gnome3.gnome_terminal ];
+ services.dbus.packages = [ pkgs.gnome3.gnome_terminal ];
- systemd.packages = [ gnome3.gnome_terminal ];
+ systemd.packages = [ pkgs.gnome3.gnome_terminal ];
};
diff --git a/nixos/modules/services/desktops/gnome3/gnome-user-share.nix b/nixos/modules/services/desktops/gnome3/gnome-user-share.nix
index e5c94cff7c84..1f6ce2ae968e 100644
--- a/nixos/modules/services/desktops/gnome3/gnome-user-share.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-user-share.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -33,9 +30,9 @@ in
config = mkIf config.services.gnome3.gnome-user-share.enable {
- environment.systemPackages = [ gnome3.gnome-user-share ];
+ environment.systemPackages = [ pkgs.gnome3.gnome-user-share ];
- services.xserver.displayManager.sessionCommands = with gnome3; ''
+ services.xserver.displayManager.sessionCommands = with pkgs.gnome3; ''
# Don't let gnome-control-center depend upon gnome-user-share
export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${gnome-user-share}/share/gsettings-schemas/${gnome-user-share.name}
'';
diff --git a/nixos/modules/services/desktops/gnome3/gpaste.nix b/nixos/modules/services/desktops/gnome3/gpaste.nix
index 0954cd2713aa..5a8258775e0a 100644
--- a/nixos/modules/services/desktops/gnome3/gpaste.nix
+++ b/nixos/modules/services/desktops/gnome3/gpaste.nix
@@ -1,11 +1,8 @@
# GPaste daemon.
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
options = {
@@ -22,9 +19,9 @@ in
###### implementation
config = mkIf config.services.gnome3.gpaste.enable {
- environment.systemPackages = [ gnome3.gpaste ];
- services.dbus.packages = [ gnome3.gpaste ];
- services.xserver.desktopManager.gnome3.sessionPath = [ gnome3.gpaste ];
- systemd.packages = [ gnome3.gpaste ];
+ environment.systemPackages = [ pkgs.gnome3.gpaste ];
+ services.dbus.packages = [ pkgs.gnome3.gpaste ];
+ services.xserver.desktopManager.gnome3.sessionPath = [ pkgs.gnome3.gpaste ];
+ systemd.packages = [ pkgs.gnome3.gpaste ];
};
}
diff --git a/nixos/modules/services/desktops/gnome3/gvfs.nix b/nixos/modules/services/desktops/gnome3/gvfs.nix
index 6bbabe8d3c56..4e99d191f18c 100644
--- a/nixos/modules/services/desktops/gnome3/gvfs.nix
+++ b/nixos/modules/services/desktops/gnome3/gvfs.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -33,11 +30,11 @@ in
config = mkIf config.services.gnome3.gvfs.enable {
- environment.systemPackages = [ gnome3.gvfs ];
+ environment.systemPackages = [ pkgs.gnome3.gvfs ];
- services.dbus.packages = [ gnome3.gvfs ];
+ services.dbus.packages = [ pkgs.gnome3.gvfs ];
- systemd.packages = [ gnome3.gvfs ];
+ systemd.packages = [ pkgs.gnome3.gvfs ];
services.udev.packages = [ pkgs.libmtp.bin ];
diff --git a/nixos/modules/services/desktops/gnome3/seahorse.nix b/nixos/modules/services/desktops/gnome3/seahorse.nix
index 45925aaca9b9..e9ad738269e4 100644
--- a/nixos/modules/services/desktops/gnome3/seahorse.nix
+++ b/nixos/modules/services/desktops/gnome3/seahorse.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -32,9 +29,9 @@ in
config = mkIf config.services.gnome3.seahorse.enable {
- environment.systemPackages = [ gnome3.seahorse ];
+ environment.systemPackages = [ pkgs.gnome3.seahorse ];
- services.dbus.packages = [ gnome3.seahorse ];
+ services.dbus.packages = [ pkgs.gnome3.seahorse ];
};
diff --git a/nixos/modules/services/desktops/gnome3/sushi.nix b/nixos/modules/services/desktops/gnome3/sushi.nix
index ff7f484602c7..7a4389038b22 100644
--- a/nixos/modules/services/desktops/gnome3/sushi.nix
+++ b/nixos/modules/services/desktops/gnome3/sushi.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -32,9 +29,9 @@ in
config = mkIf config.services.gnome3.sushi.enable {
- environment.systemPackages = [ gnome3.sushi ];
+ environment.systemPackages = [ pkgs.gnome3.sushi ];
- services.dbus.packages = [ gnome3.sushi ];
+ services.dbus.packages = [ pkgs.gnome3.sushi ];
};
diff --git a/nixos/modules/services/desktops/gnome3/tracker.nix b/nixos/modules/services/desktops/gnome3/tracker.nix
index dcaa60103a3b..c061f7890499 100644
--- a/nixos/modules/services/desktops/gnome3/tracker.nix
+++ b/nixos/modules/services/desktops/gnome3/tracker.nix
@@ -4,9 +4,6 @@
with lib;
-let
- gnome3 = config.environment.gnome3.packageSet;
-in
{
###### interface
@@ -33,11 +30,11 @@ in
config = mkIf config.services.gnome3.tracker.enable {
- environment.systemPackages = [ gnome3.tracker ];
+ environment.systemPackages = [ pkgs.gnome3.tracker ];
- services.dbus.packages = [ gnome3.tracker ];
+ services.dbus.packages = [ pkgs.gnome3.tracker ];
- systemd.packages = [ gnome3.tracker ];
+ systemd.packages = [ pkgs.gnome3.tracker ];
};
diff --git a/nixos/modules/services/mail/spamassassin.nix b/nixos/modules/services/mail/spamassassin.nix
index fc8396cd85e9..d483a8c3d67d 100644
--- a/nixos/modules/services/mail/spamassassin.nix
+++ b/nixos/modules/services/mail/spamassassin.nix
@@ -42,7 +42,7 @@ in
Then you can Use this sieve filter:
require ["fileinto", "reject", "envelope"];
-
+
if header :contains "X-Spam-Flag" "YES" {
fileinto "spam";
}
@@ -67,11 +67,11 @@ in
initPreConf = mkOption {
type = types.str;
description = "The SpamAssassin init.pre config.";
- default =
- ''
+ default =
+ ''
#
# to update this list, run this command in the rules directory:
- # grep 'loadplugin.*Mail::SpamAssassin::Plugin::.*' -o -h * | sort | uniq
+ # grep 'loadplugin.*Mail::SpamAssassin::Plugin::.*' -o -h * | sort | uniq
#
#loadplugin Mail::SpamAssassin::Plugin::AccessDB
@@ -122,7 +122,11 @@ in
config = mkIf cfg.enable {
# Allow users to run 'spamc'.
- environment.systemPackages = [ pkgs.spamassassin ];
+
+ environment = {
+ etc = singleton { source = spamdEnv; target = "spamassassin"; };
+ systemPackages = [ pkgs.spamassassin ];
+ };
users.extraUsers = singleton {
name = "spamd";
@@ -138,7 +142,7 @@ in
systemd.services.sa-update = {
script = ''
- set +e
+ set +e
${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/ --siteconfigpath=${spamdEnv}/" spamd
v=$?
@@ -153,7 +157,7 @@ in
'';
};
- systemd.timers.sa-update = {
+ systemd.timers.sa-update = {
description = "sa-update-service";
partOf = [ "sa-update.service" ];
wantedBy = [ "timers.target" ];
@@ -177,15 +181,10 @@ in
# 0 and 1 no error, exitcode > 1 means error:
# https://spamassassin.apache.org/full/3.1.x/doc/sa-update.html#exit_codes
preStart = ''
- # this abstraction requires no centralized config at all
- if [ -d /etc/spamassassin ]; then
- echo "This spamassassin does not support global '/etc/spamassassin' folder for configuration as this would be impure. Merge your configs into 'services.spamassassin' and remove the '/etc/spamassassin' folder to make this service work. Also see 'https://github.com/NixOS/nixpkgs/pull/26470'.";
- exit 1
- fi
echo "Recreating '/var/lib/spamasassin' with creating '3.004001' (or similar) and 'sa-update-keys'"
mkdir -p /var/lib/spamassassin
chown spamd:spamd /var/lib/spamassassin -R
- set +e
+ set +e
${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/ --siteconfigpath=${spamdEnv}/" spamd
v=$?
set -e
diff --git a/nixos/modules/services/misc/gitolite.nix b/nixos/modules/services/misc/gitolite.nix
index 60fc9d58ed07..f395b9558b5a 100644
--- a/nixos/modules/services/misc/gitolite.nix
+++ b/nixos/modules/services/misc/gitolite.nix
@@ -41,6 +41,15 @@ in
'';
};
+ enableGitAnnex = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Enable git-annex support. Uses the extraGitoliteRc option
+ to apply the necessary configuration.
+ '';
+ };
+
commonHooks = mkOption {
type = types.listOf types.path;
default = [];
@@ -49,6 +58,37 @@ in
'';
};
+ extraGitoliteRc = mkOption {
+ type = types.lines;
+ default = "";
+ example = literalExample ''
+ $RC{UMASK} = 0027;
+ $RC{SITE_INFO} = 'This is our private repository host';
+ push( @{$RC{ENABLE}}, 'Kindergarten' ); # enable the command/feature
+ @{$RC{ENABLE}} = grep { $_ ne 'desc' } @{$RC{ENABLE}}; # disable the command/feature
+ '';
+ description = ''
+ Extra configuration to append to the default ~/.gitolite.rc.
+
+ This should be Perl code that modifies the %RC
+ configuration variable. The default ~/.gitolite.rc
+ content is generated by invoking gitolite print-default-rc,
+ and extra configuration from this option is appended to it. The result
+ is placed to Nix store, and the ~/.gitolite.rc file
+ becomes a symlink to it.
+
+ If you already have a customized (or otherwise changed)
+ ~/.gitolite.rc file, NixOS will refuse to replace
+ it with a symlink, and the `gitolite-init` initialization service
+ will fail. In this situation, in order to use this option, you
+ will need to take any customizations you may have in
+ ~/.gitolite.rc, convert them to appropriate Perl
+ statements, add them to this option, and remove the file.
+
+ See also the enableGitAnnex option.
+ '';
+ };
+
user = mkOption {
type = types.str;
default = "gitolite";
@@ -56,17 +96,59 @@ in
Gitolite user account. This is the username of the gitolite endpoint.
'';
};
+
+ group = mkOption {
+ type = types.str;
+ default = "gitolite";
+ description = ''
+ Primary group of the Gitolite user account.
+ '';
+ };
};
};
- config = mkIf cfg.enable {
+ config = mkIf cfg.enable (
+ let
+ manageGitoliteRc = cfg.extraGitoliteRc != "";
+ rcDir = pkgs.runCommand "gitolite-rc" { } rcDirScript;
+ rcDirScript =
+ ''
+ mkdir "$out"
+ export HOME=temp-home
+ mkdir -p "$HOME/.gitolite/logs" # gitolite can't run without it
+ '${pkgs.gitolite}'/bin/gitolite print-default-rc >>"$out/gitolite.rc.default"
+ cat <>"$out/gitolite.rc"
+ # This file is managed by NixOS.
+ # Use services.gitolite options to control it.
+
+ END
+ cat "$out/gitolite.rc.default" >>"$out/gitolite.rc"
+ '' +
+ optionalString (cfg.extraGitoliteRc != "") ''
+ echo -n ${escapeShellArg ''
+
+ # Added by NixOS:
+ ${removeSuffix "\n" cfg.extraGitoliteRc}
+
+ # per perl rules, this should be the last line in such a file:
+ 1;
+ ''} >>"$out/gitolite.rc"
+ '';
+ in {
+ services.gitolite.extraGitoliteRc = optionalString cfg.enableGitAnnex ''
+ # Enable git-annex support:
+ push( @{$RC{ENABLE}}, 'git-annex-shell ua');
+ '';
+
users.extraUsers.${cfg.user} = {
description = "Gitolite user";
home = cfg.dataDir;
createHome = true;
uid = config.ids.uids.gitolite;
+ group = cfg.group;
useDefaultShell = true;
};
+ users.extraGroups."${cfg.group}".gid = config.ids.gids.gitolite;
systemd.services."gitolite-init" = {
description = "Gitolite initialization";
@@ -77,21 +159,62 @@ in
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
- path = [ pkgs.gitolite pkgs.git pkgs.perl pkgs.bash config.programs.ssh.package ];
- script = ''
- cd ${cfg.dataDir}
- mkdir -p .gitolite/logs
- if [ ! -d repositories ]; then
- gitolite setup -pk ${pubkeyFile}
- fi
- if [ -n "${hooks}" ]; then
- cp ${hooks} .gitolite/hooks/common/
- chmod +x .gitolite/hooks/common/*
- fi
- gitolite setup # Upgrade if needed
- '';
+ path = [ pkgs.gitolite pkgs.git pkgs.perl pkgs.bash pkgs.diffutils config.programs.ssh.package ];
+ script =
+ let
+ rcSetupScriptIfCustomFile =
+ if manageGitoliteRc then ''
+ cat <ERROR: NixOS can't apply declarative configuration
+ <3>to your .gitolite.rc file, because it seems to be
+ <3>already customized manually.
+ <3>See the services.gitolite.extraGitoliteRc option
+ <3>in "man configuration.nix" for more information.
+ END
+ # Not sure if the line below addresses the issue directly or just
+ # adds a delay, but without it our error message often doesn't
+ # show up in `systemctl status gitolite-init`.
+ journalctl --flush
+ exit 1
+ '' else ''
+ :
+ '';
+ rcSetupScriptIfDefaultFileOrStoreSymlink =
+ if manageGitoliteRc then ''
+ ln -sf "${rcDir}/gitolite.rc" "$GITOLITE_RC"
+ '' else ''
+ [[ -L "$GITOLITE_RC" ]] && rm -f "$GITOLITE_RC"
+ '';
+ in
+ ''
+ cd ${cfg.dataDir}
+ mkdir -p .gitolite/logs
+
+ GITOLITE_RC=.gitolite.rc
+ GITOLITE_RC_DEFAULT=${rcDir}/gitolite.rc.default
+ if ( [[ ! -e "$GITOLITE_RC" ]] && [[ ! -L "$GITOLITE_RC" ]] ) ||
+ ( [[ -f "$GITOLITE_RC" ]] && diff -q "$GITOLITE_RC" "$GITOLITE_RC_DEFAULT" >/dev/null ) ||
+ ( [[ -L "$GITOLITE_RC" ]] && [[ "$(readlink "$GITOLITE_RC")" =~ ^/nix/store/ ]] )
+ then
+ '' + rcSetupScriptIfDefaultFileOrStoreSymlink +
+ ''
+ else
+ '' + rcSetupScriptIfCustomFile +
+ ''
+ fi
+
+ if [ ! -d repositories ]; then
+ gitolite setup -pk ${pubkeyFile}
+ fi
+ if [ -n "${hooks}" ]; then
+ cp ${hooks} .gitolite/hooks/common/
+ chmod +x .gitolite/hooks/common/*
+ fi
+ gitolite setup # Upgrade if needed
+ '';
};
- environment.systemPackages = [ pkgs.gitolite pkgs.git ];
- };
+ environment.systemPackages = [ pkgs.gitolite pkgs.git ]
+ ++ optional cfg.enableGitAnnex pkgs.gitAndTools.git-annex;
+ });
}
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index bf1304ee7ac2..efa3b5b6bd76 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -428,7 +428,7 @@ in
fi
'';
- nix.nrBuildUsers = mkDefault (lib.max 10 cfg.maxJobs);
+ nix.nrBuildUsers = mkDefault (lib.max 32 cfg.maxJobs);
users.extraUsers = nixbldUsers;
diff --git a/nixos/modules/services/monitoring/fusion-inventory.nix b/nixos/modules/services/monitoring/fusion-inventory.nix
new file mode 100644
index 000000000000..1c00f3c299e9
--- /dev/null
+++ b/nixos/modules/services/monitoring/fusion-inventory.nix
@@ -0,0 +1,66 @@
+# Fusion Inventory daemon.
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.fusionInventory;
+
+ configFile = pkgs.writeText "fusion_inventory.conf" ''
+ server = ${concatStringsSep ", " cfg.servers}
+
+ logger = stderr
+
+ ${cfg.extraConfig}
+ '';
+
+in {
+
+ ###### interface
+
+ options = {
+
+ services.fusionInventory = {
+
+ enable = mkEnableOption "Fusion Inventory Agent";
+
+ servers = mkOption {
+ type = types.listOf types.str;
+ description = ''
+ The urls of the OCS/GLPI servers to connect to.
+ '';
+ };
+
+ extraConfig = mkOption {
+ default = "";
+ type = types.lines;
+ description = ''
+ Configuration that is injected verbatim into the configuration file.
+ '';
+ };
+ };
+ };
+
+
+ ###### implementation
+
+ config = mkIf cfg.enable {
+
+ users.extraUsers = singleton {
+ name = "fusion-inventory";
+ description = "FusionInventory user";
+ };
+
+ systemd.services."fusion-inventory" = {
+ description = "Fusion Inventory Agent";
+ wantedBy = [ "multi-user.target" ];
+
+ environment = {
+ OPTIONS = "--no-category=software";
+ };
+ serviceConfig = {
+ ExecStart = "${pkgs.fusionInventory}/bin/fusioninventory-agent --conf-file=${configFile} --daemon --no-fork";
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/monitoring/monit.nix b/nixos/modules/services/monitoring/monit.nix
index e07ffd2e8b54..71f50cc0f19d 100644
--- a/nixos/modules/services/monitoring/monit.nix
+++ b/nixos/modules/services/monitoring/monit.nix
@@ -17,20 +17,22 @@ in
};
config = mkOption {
default = "";
- description = "monit.conf content";
+ description = "monitrc content";
};
};
};
config = mkIf config.services.monit.enable {
+ environment.systemPackages = [ pkgs.monit ];
+
environment.etc = [
{
source = pkgs.writeTextFile {
- name = "monit.conf";
+ name = "monitrc";
text = config.services.monit.config;
};
- target = "monit.conf";
+ target = "monitrc";
mode = "0400";
}
];
@@ -40,9 +42,9 @@ in
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
- ExecStart = "${pkgs.monit}/bin/monit -I -c /etc/monit.conf";
- ExecStop = "${pkgs.monit}/bin/monit -c /etc/monit.conf quit";
- ExecReload = "${pkgs.monit}/bin/monit -c /etc/monit.conf reload";
+ ExecStart = "${pkgs.monit}/bin/monit -I -c /etc/monitrc";
+ ExecStop = "${pkgs.monit}/bin/monit -c /etc/monitrc quit";
+ ExecReload = "${pkgs.monit}/bin/monit -c /etc/monitrc reload";
KillMode = "process";
Restart = "always";
};
diff --git a/nixos/modules/services/network-filesystems/nfsd.nix b/nixos/modules/services/network-filesystems/nfsd.nix
index 7d127145101b..1a78f9a76a33 100644
--- a/nixos/modules/services/network-filesystems/nfsd.nix
+++ b/nixos/modules/services/network-filesystems/nfsd.nix
@@ -27,6 +27,14 @@ in
'';
};
+ extraNfsdConfig = mkOption {
+ type = types.str;
+ default = "";
+ description = ''
+ Extra configuration options for the [nfsd] section of /etc/nfs.conf.
+ '';
+ };
+
exports = mkOption {
type = types.lines;
default = "";
@@ -107,6 +115,7 @@ in
[nfsd]
threads=${toString cfg.nproc}
${optionalString (cfg.hostName != null) "host=${cfg.hostName}"}
+ ${cfg.extraNfsdConfig}
[mountd]
${optionalString (cfg.mountdPort != null) "port=${toString cfg.mountdPort}"}
diff --git a/nixos/modules/services/networking/bind.nix b/nixos/modules/services/networking/bind.nix
index 9f533eedf6e1..763283dfe7a2 100644
--- a/nixos/modules/services/networking/bind.nix
+++ b/nixos/modules/services/networking/bind.nix
@@ -151,15 +151,6 @@ in
";
};
- resolveLocalQueries = mkOption {
- type = types.bool;
- default = true;
- description = ''
- Whether bind should resolve local queries (i.e. add 127.0.0.1 to
- /etc/resolv.conf, overriding networking.nameserver).
- '';
- };
-
};
};
diff --git a/nixos/modules/services/networking/consul.nix b/nixos/modules/services/networking/consul.nix
index 166ee7732375..6333970cb338 100644
--- a/nixos/modules/services/networking/consul.nix
+++ b/nixos/modules/services/networking/consul.nix
@@ -183,6 +183,7 @@ in
ExecReload = "${cfg.package.bin}/bin/consul reload";
PermissionsStartOnly = true;
User = if cfg.dropPrivileges then "consul" else null;
+ Restart = "on-failure";
TimeoutStartSec = "0";
} // (optionalAttrs (cfg.leaveOnStop) {
ExecStop = "${cfg.package.bin}/bin/consul leave";
diff --git a/nixos/modules/services/networking/dnscache.nix b/nixos/modules/services/networking/dnscache.nix
new file mode 100644
index 000000000000..f782be97f6fa
--- /dev/null
+++ b/nixos/modules/services/networking/dnscache.nix
@@ -0,0 +1,86 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.dnscache;
+
+ dnscache-root = pkgs.runCommand "dnscache-root" {} ''
+ mkdir -p $out/{servers,ip}
+
+ ${concatMapStrings (ip: ''
+ echo > "$out/ip/"${lib.escapeShellArg ip}
+ '') cfg.clientIps}
+
+ ${concatStrings (mapAttrsToList (host: ips: ''
+ ${concatMapStrings (ip: ''
+ echo ${lib.escapeShellArg ip} > "$out/servers/"${lib.escapeShellArg host}
+ '') ips}
+ '') cfg.domainServers)}
+
+ # djbdns contains an outdated list of root servers;
+ # if one was not provided in config, provide a current list
+ if [ ! -e servers/@ ]; then
+ awk '/^.?.ROOT-SERVERS.NET/ { print $4 }' ${pkgs.dns-root-data}/root.hints > $out/servers/@
+ fi
+ '';
+
+in {
+
+ ###### interface
+
+ options = {
+ services.dnscache = {
+ enable = mkOption {
+ default = false;
+ type = types.bool;
+ description = "Whether to run the dnscache caching dns server";
+ };
+
+ ip = mkOption {
+ default = "0.0.0.0";
+ type = types.str;
+ description = "IP address on which to listen for connections";
+ };
+
+ clientIps = mkOption {
+ default = [ "127.0.0.1" ];
+ type = types.listOf types.str;
+ description = "client IP addresses (or prefixes) from which to accept connections";
+ example = ["192.168" "172.23.75.82"];
+ };
+
+ domainServers = mkOption {
+ default = { };
+ type = types.attrsOf (types.listOf types.str);
+ description = "table of {hostname: server} pairs to use as authoritative servers for hosts (and subhosts)";
+ example = {
+ "example.com" = ["8.8.8.8" "8.8.4.4"];
+ };
+ };
+ };
+ };
+
+ ###### implementation
+
+ config = mkIf config.services.dnscache.enable {
+ environment.systemPackages = [ pkgs.djbdns ];
+ users.extraUsers.dnscache = {};
+
+ systemd.services.dnscache = {
+ description = "djbdns dnscache server";
+ wantedBy = [ "multi-user.target" ];
+ path = with pkgs; [ bash daemontools djbdns ];
+ preStart = ''
+ rm -rf /var/lib/dnscache
+ dnscache-conf dnscache dnscache /var/lib/dnscache ${config.services.dnscache.ip}
+ rm -rf /var/lib/dnscache/root
+ ln -sf ${dnscache-root} /var/lib/dnscache/root
+ '';
+ script = ''
+ cd /var/lib/dnscache/
+ exec ./run
+ '';
+ };
+ };
+}
diff --git a/nixos/modules/services/networking/dnsmasq.nix b/nixos/modules/services/networking/dnsmasq.nix
index 3d1b931de07e..fcf5aa5f175b 100644
--- a/nixos/modules/services/networking/dnsmasq.nix
+++ b/nixos/modules/services/networking/dnsmasq.nix
@@ -42,7 +42,7 @@ in
default = true;
description = ''
Whether dnsmasq should resolve local queries (i.e. add 127.0.0.1 to
- /etc/resolv.conf overriding networking.nameservers).
+ /etc/resolv.conf).
'';
};
diff --git a/nixos/modules/services/networking/fan.nix b/nixos/modules/services/networking/fan.nix
deleted file mode 100644
index 7f4e36478325..000000000000
--- a/nixos/modules/services/networking/fan.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
- cfg = config.networking.fan;
- modprobe = "${pkgs.kmod}/bin/modprobe";
-
-in
-
-{
-
- ###### interface
-
- options = {
-
- networking.fan = {
-
- enable = mkEnableOption "FAN Networking";
-
- };
-
- };
-
-
- ###### implementation
-
- config = mkIf cfg.enable {
-
- environment.systemPackages = [ pkgs.fanctl ];
-
- systemd.services.fan = {
- description = "FAN Networking";
- wantedBy = [ "multi-user.target" ];
- after = [ "network-online.target" ];
- before = [ "docker.service" ];
- restartIfChanged = false;
- preStart = ''
- if [ ! -f /proc/sys/net/fan/version ]; then
- ${modprobe} ipip
- if [ ! -f /proc/sys/net/fan/version ]; then
- echo "The Fan Networking patches have not been applied to this kernel!" 1>&2
- exit 1
- fi
- fi
-
- mkdir -p /var/lib/fan-networking
- '';
- serviceConfig = {
- Type = "oneshot";
- RemainAfterExit = true;
- ExecStart = "${pkgs.fanctl}/bin/fanctl up -a";
- ExecStop = "${pkgs.fanctl}/bin/fanctl down -a";
- };
- };
-
- };
-
-}
diff --git a/nixos/modules/services/networking/radicale.nix b/nixos/modules/services/networking/radicale.nix
index 56f2e976cff5..391f4bdebbab 100644
--- a/nixos/modules/services/networking/radicale.nix
+++ b/nixos/modules/services/networking/radicale.nix
@@ -9,7 +9,7 @@ let
confFile = pkgs.writeText "radicale.conf" cfg.config;
# This enables us to default to version 2 while still not breaking configurations of people with version 1
- defaultPackage = if versionAtLeast "17.09" config.system.stateVersion then {
+ defaultPackage = if versionAtLeast config.system.stateVersion "17.09" then {
pkg = pkgs.radicale2;
text = "pkgs.radicale2";
} else {
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index d5db328310c1..adb80ea29840 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -141,7 +141,6 @@ in
${optionalString (data.ed25519PrivateKeyFile != null) "Ed25519PrivateKeyFile = ${data.ed25519PrivateKeyFile}"}
${optionalString (data.listenAddress != null) "ListenAddress = ${data.listenAddress}"}
${optionalString (data.bindToAddress != null) "BindToAddress = ${data.bindToAddress}"}
- Device = /dev/net/tun
Interface = tinc.${network}
${data.extraConfig}
'';
@@ -164,10 +163,17 @@ in
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
path = [ data.package ];
+ restartTriggers =
+ let
+ drvlist = [ config.environment.etc."tinc/${network}/tinc.conf".source ]
+ ++ mapAttrsToList (host: _: config.environment.etc."tinc/${network}/hosts/${host}".source) data.hosts;
+ in # drvlist might be too long to be used directly
+ [ (builtins.hashString "sha256" (concatMapStrings (d: d.outPath) drvlist)) ];
serviceConfig = {
Type = "simple";
Restart = "always";
RestartSec = "3";
+ ExecStart = "${data.package}/bin/tincd -D -U tinc.${network} -n ${network} ${optionalString (data.chroot) "-R"} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}";
};
preStart = ''
mkdir -p /etc/tinc/${network}/hosts
@@ -187,9 +193,6 @@ in
[ -f "/etc/tinc/${network}/rsa_key.priv" ] || tincd -n ${network} -K 4096
fi
'';
- script = ''
- tincd -D -U tinc.${network} -n ${network} ${optionalString (data.chroot) "-R"} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}
- '';
})
);
diff --git a/nixos/modules/services/networking/tinydns.nix b/nixos/modules/services/networking/tinydns.nix
new file mode 100644
index 000000000000..184888ef05da
--- /dev/null
+++ b/nixos/modules/services/networking/tinydns.nix
@@ -0,0 +1,54 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+ ###### interface
+
+ options = {
+ services.tinydns = {
+ enable = mkOption {
+ default = false;
+ type = types.bool;
+ description = "Whether to run the tinydns dns server";
+ };
+
+ data = mkOption {
+ type = types.lines;
+ default = "";
+ description = "The DNS data to serve, in the format described by tinydns-data(8)";
+ };
+
+ ip = mkOption {
+ default = "0.0.0.0";
+ type = types.str;
+ description = "IP address on which to listen for connections";
+ };
+ };
+ };
+
+ ###### implementation
+
+ config = mkIf config.services.tinydns.enable {
+ environment.systemPackages = [ pkgs.djbdns ];
+
+ users.extraUsers.tinydns = {};
+
+ systemd.services.tinydns = {
+ description = "djbdns tinydns server";
+ wantedBy = [ "multi-user.target" ];
+ path = with pkgs; [ daemontools djbdns ];
+ preStart = ''
+ rm -rf /var/lib/tinydns
+ tinydns-conf tinydns tinydns /var/lib/tinydns ${config.services.tinydns.ip}
+ cd /var/lib/tinydns/root/
+ ln -sf ${pkgs.writeText "tinydns-data" config.services.tinydns.data} data
+ tinydns-data
+ '';
+ script = ''
+ cd /var/lib/tinydns
+ exec ./run
+ '';
+ };
+ };
+}
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index 4f54b45639f6..eb08e7f90c0d 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -95,6 +95,14 @@ let
type = with types; listOf (submodule peerOpts);
};
+ allowedIPsAsRoutes = mkOption {
+ example = false;
+ default = true;
+ type = types.bool;
+ description = ''
+ Determines whether to add allowed IPs as routes or not.
+ '';
+ };
};
};
@@ -217,11 +225,11 @@ let
"${ipCommand} link set up dev ${name}"
- (map (peer:
+ (optionals (values.allowedIPsAsRoutes != false) (map (peer:
(map (allowedIP:
"${ipCommand} route replace ${allowedIP} dev ${name} table ${values.table}"
) peer.allowedIPs)
- ) values.peers)
+ ) values.peers))
values.postSetup
]);
diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index c91ba91fcb4d..908c8730ad2a 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -148,6 +148,7 @@ in {
wants = [ "network.target" ];
requires = lib.concatMap deviceUnit ifaces;
wantedBy = [ "multi-user.target" ];
+ stopIfChanged = false;
path = [ pkgs.wpa_supplicant ];
diff --git a/nixos/modules/services/networking/znc.nix b/nixos/modules/services/networking/znc.nix
index 763843fdec00..3d9cec46a582 100644
--- a/nixos/modules/services/networking/znc.nix
+++ b/nixos/modules/services/networking/znc.nix
@@ -212,6 +212,14 @@ in
'';
};
+ openFirewall = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to open ports in the firewall for ZNC.
+ '';
+ };
+
zncConf = mkOption {
default = "";
example = "See: http://wiki.znc.in/Configuration";
@@ -276,14 +284,6 @@ in
'';
};
- openFirewall = mkOption {
- type = types.bool;
- default = false;
- description = ''
- Whether to open ports in the firewall for ZNC.
- '';
- };
-
passBlock = mkOption {
example = defaultPassBlock;
type = types.string;
@@ -359,7 +359,7 @@ in
config = mkIf cfg.enable {
networking.firewall = mkIf cfg.openFirewall {
- allowedTCPPorts = [ cfg.port ];
+ allowedTCPPorts = [ cfg.confOptions.port ];
};
systemd.services.znc = {
diff --git a/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix b/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
index aa0fe4f14796..02695c1c43a1 100644
--- a/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
@@ -83,11 +83,11 @@ let
# Unpack Mediawiki and put the config file in its root directory.
mediawikiRoot = pkgs.stdenv.mkDerivation rec {
- name= "mediawiki-1.27.3";
+ name= "mediawiki-1.29.1";
src = pkgs.fetchurl {
- url = "http://download.wikimedia.org/mediawiki/1.27/${name}.tar.gz";
- sha256 = "08x8mvc0y1gwq8rg0zm98wc6hc5j8imb6dcpx6s7392j5dc71m0i";
+ url = "http://download.wikimedia.org/mediawiki/1.29/${name}.tar.gz";
+ sha256 = "03mpazbxvb011s2nmlw5p6dc43yjgl5yrsilmj1imyykm57bwb3m";
};
skins = config.skins;
diff --git a/nixos/modules/services/x11/desktop-managers/gnome3.nix b/nixos/modules/services/x11/desktop-managers/gnome3.nix
index 0abdc27bbfc6..ecf0abb1efd2 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@@ -4,7 +4,6 @@ with lib;
let
cfg = config.services.xserver.desktopManager.gnome3;
- gnome3 = config.environment.gnome3.packageSet;
# Remove packages of ys from xs, based on their names
removePackagesByName = xs: ys:
@@ -28,7 +27,7 @@ let
nixos-gsettings-desktop-schemas = pkgs.runCommand "nixos-gsettings-desktop-schemas" {}
''
mkdir -p $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas
- cp -rf ${gnome3.gsettings_desktop_schemas}/share/gsettings-schemas/gsettings-desktop-schemas*/glib-2.0/schemas/*.xml $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas
+ cp -rf ${pkgs.gnome3.gsettings_desktop_schemas}/share/gsettings-schemas/gsettings-desktop-schemas*/glib-2.0/schemas/*.xml $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas
${concatMapStrings (pkg: "cp -rf ${pkg}/share/gsettings-schemas/*/glib-2.0/schemas/*.xml $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas\n") cfg.extraGSettingsOverridePackages}
@@ -61,7 +60,7 @@ in {
example = literalExample "[ pkgs.gnome3.gpaste ]";
description = "Additional list of packages to be added to the session search path.
Useful for gnome shell extensions or gsettings-conditionated autostart.";
- apply = list: list ++ [ gnome3.gnome_shell gnome3.gnome-shell-extensions ];
+ apply = list: list ++ [ pkgs.gnome3.gnome_shell pkgs.gnome3.gnome-shell-extensions ];
};
extraGSettingsOverrides = mkOption {
@@ -79,13 +78,6 @@ in {
debug = mkEnableOption "gnome-session debug messages";
};
- environment.gnome3.packageSet = mkOption {
- default = null;
- example = literalExample "pkgs.gnome3_22";
- description = "Which GNOME 3 package set to use.";
- apply = p: if p == null then pkgs.gnome3 else p;
- };
-
environment.gnome3.excludePackages = mkOption {
default = [];
example = literalExample "[ pkgs.gnome3.totem ]";
@@ -169,26 +161,26 @@ in {
# Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
${pkgs.xdg-user-dirs}/bin/xdg-user-dirs-update
- ${gnome3.gnome_session}/bin/gnome-session ${optionalString cfg.debug "--debug"} &
+ ${pkgs.gnome3.gnome_session}/bin/gnome-session ${optionalString cfg.debug "--debug"} &
waitPID=$!
'';
};
services.xserver.updateDbusEnvironment = true;
- environment.variables.GIO_EXTRA_MODULES = [ "${lib.getLib gnome3.dconf}/lib/gio/modules"
- "${gnome3.glib_networking.out}/lib/gio/modules"
- "${gnome3.gvfs}/lib/gio/modules" ];
- environment.systemPackages = gnome3.corePackages ++ cfg.sessionPath
- ++ (removePackagesByName gnome3.optionalPackages config.environment.gnome3.excludePackages);
+ environment.variables.GIO_EXTRA_MODULES = [ "${lib.getLib pkgs.gnome3.dconf}/lib/gio/modules"
+ "${pkgs.gnome3.glib_networking.out}/lib/gio/modules"
+ "${pkgs.gnome3.gvfs}/lib/gio/modules" ];
+ environment.systemPackages = pkgs.gnome3.corePackages ++ cfg.sessionPath
+ ++ (removePackagesByName pkgs.gnome3.optionalPackages config.environment.gnome3.excludePackages);
# Use the correct gnome3 packageSet
networking.networkmanager.basePackages =
{ inherit (pkgs) networkmanager modemmanager wpa_supplicant;
- inherit (gnome3) networkmanager_openvpn networkmanager_vpnc
- networkmanager_openconnect networkmanager_fortisslvpn
- networkmanager_pptp networkmanager_iodine
- networkmanager_l2tp; };
+ inherit (pkgs.gnome3) networkmanager_openvpn networkmanager_vpnc
+ networkmanager_openconnect networkmanager_fortisslvpn
+ networkmanager_pptp networkmanager_iodine
+ networkmanager_l2tp; };
# Needed for themes and backgrounds
environment.pathsToLink = [ "/share" ];
diff --git a/nixos/modules/services/x11/display-managers/gdm.nix b/nixos/modules/services/x11/display-managers/gdm.nix
index bd16f2210592..83c5c95dae7e 100644
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@@ -5,8 +5,7 @@ with lib;
let
cfg = config.services.xserver.displayManager;
- gnome3 = config.environment.gnome3.packageSet;
- gdm = gnome3.gdm;
+ gdm = pkgs.gnome3.gdm;
in
@@ -65,6 +64,14 @@ in
};
};
+ wayland = mkOption {
+ default = true;
+ description = ''
+ Allow GDM run on Wayland instead of Xserver
+ '';
+ type = types.bool;
+ };
+
};
};
@@ -95,6 +102,7 @@ in
# GDM needs different xserverArgs, presumable because using wayland by default.
services.xserver.tty = null;
services.xserver.display = null;
+ services.xserver.verbose = null;
services.xserver.displayManager.job =
{
@@ -103,7 +111,7 @@ in
(filter (arg: arg != "-terminate") cfg.xserverArgs);
GDM_SESSIONS_DIR = "${cfg.session.desktops}";
# Find the mouse
- XCURSOR_PATH = "~/.icons:${gnome3.adwaita-icon-theme}/share/icons";
+ XCURSOR_PATH = "~/.icons:${pkgs.gnome3.adwaita-icon-theme}/share/icons";
};
execCmd = "exec ${gdm}/bin/gdm";
};
@@ -127,7 +135,7 @@ in
StandardError = "inherit";
};
- systemd.services.display-manager.path = [ gnome3.gnome_session ];
+ systemd.services.display-manager.path = [ pkgs.gnome3.gnome_session ];
services.dbus.packages = [ gdm ];
@@ -140,6 +148,7 @@ in
# presented and there's a little delay.
environment.etc."gdm/custom.conf".text = ''
[daemon]
+ WaylandEnable=${if cfg.gdm.wayland then "true" else "false"}
${optionalString cfg.gdm.autoLogin.enable (
if cfg.gdm.autoLogin.delay > 0 then ''
TimedLoginEnable=true
@@ -186,7 +195,7 @@ in
auth required pam_env.so envfile=${config.system.build.pamEnvironment}
auth required pam_succeed_if.so uid >= 1000 quiet
- auth optional ${gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so
+ auth optional ${pkgs.gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so
auth ${if config.security.pam.enableEcryptfs then "required" else "sufficient"} pam_unix.so nullok likeauth
${optionalString config.security.pam.enableEcryptfs
"auth required ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
@@ -206,7 +215,7 @@ in
"session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"}
session required pam_loginuid.so
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
- session optional ${gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so auto_start
+ session optional ${pkgs.gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so auto_start
'';
gdm-password.text = ''
@@ -214,7 +223,7 @@ in
auth required pam_env.so envfile=${config.system.build.pamEnvironment}
auth required pam_succeed_if.so uid >= 1000 quiet
- auth optional ${gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so
+ auth optional ${pkgs.gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so
auth ${if config.security.pam.enableEcryptfs then "required" else "sufficient"} pam_unix.so nullok likeauth
${optionalString config.security.pam.enableEcryptfs
"auth required ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
@@ -233,7 +242,7 @@ in
"session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"}
session required pam_loginuid.so
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
- session optional ${gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so auto_start
+ session optional ${pkgs.gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so auto_start
'';
gdm-autologin.text = ''
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 3ce124d3da27..d4fe475690ce 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -480,6 +480,15 @@ in
'';
};
+ verbose = mkOption {
+ type = types.nullOr types.int;
+ default = 3;
+ example = 7;
+ description = ''
+ Controls verbosity of X logging.
+ '';
+ };
+
useGlamor = mkOption {
type = types.bool;
default = false;
@@ -631,10 +640,11 @@ in
[ "-config ${configFile}"
"-xkbdir" "${cfg.xkbDir}"
# Log at the default verbosity level to stderr rather than /var/log/X.*.log.
- "-verbose" "3" "-logfile" "/dev/null"
+ "-logfile" "/dev/null"
] ++ optional (cfg.display != null) ":${toString cfg.display}"
++ optional (cfg.tty != null) "vt${toString cfg.tty}"
++ optional (cfg.dpi != null) "-dpi ${toString cfg.dpi}"
+ ++ optional (cfg.verbose != null) "-verbose ${toString cfg.verbose}"
++ optional (!cfg.enableTCP) "-nolisten tcp"
++ optional (cfg.autoRepeatDelay != null) "-ardelay ${toString cfg.autoRepeatDelay}"
++ optional (cfg.autoRepeatInterval != null) "-arinterval ${toString cfg.autoRepeatInterval}"
diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 3ca679b479a0..06f004fb06ec 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -235,6 +235,16 @@ in
'';
};
+ boot.initrd.luks.forceLuksSupportInInitrd = mkOption {
+ type = types.bool;
+ default = false;
+ internal = true;
+ description = ''
+ Whether to configure luks support in the initrd, when no luks
+ devices are configured.
+ '';
+ };
+
boot.initrd.luks.devices = mkOption {
default = { };
example = { "luksroot".device = "/dev/disk/by-uuid/430e9eff-d852-4f68-aa3b-2fa3599ebe08"; };
@@ -417,7 +427,7 @@ in
};
};
- config = mkIf (luks.devices != {}) {
+ config = mkIf (luks.devices != {} || luks.forceLuksSupportInInitrd) {
# actually, sbp2 driver is the one enabling the DMA attack, but this needs to be tested
boot.blacklistedKernelModules = optionals luks.mitigateDMAAttacks
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index d12d0a06f444..dd9ba7104485 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -639,11 +639,7 @@ in
Rules for creating and cleaning up temporary files
automatically. See
tmpfiles.d5
- for the exact format. You should not use this option to create
- files required by systemd services, since there is no
- guarantee that systemd-tmpfiles runs when
- the system is reconfigured using
- nixos-rebuild.
+ for the exact format.
'';
};
@@ -879,7 +875,12 @@ in
systemd.services.systemd-remount-fs.restartIfChanged = false;
systemd.services.systemd-update-utmp.restartIfChanged = false;
systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions.
- systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ];
+ # Restarting systemd-logind breaks X11
+ # - upstream commit: https://cgit.freedesktop.org/xorg/xserver/commit/?id=dc48bd653c7e101
+ # - systemd announcement: https://github.com/systemd/systemd/blob/22043e4317ecd2bc7834b48a6d364de76bb26d91/NEWS#L103-L112
+ # - this might be addressed in the future by xorg
+ #systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ];
+ systemd.services.systemd-logind.restartIfChanged = false;
systemd.services.systemd-logind.stopIfChanged = false;
systemd.services.systemd-journald.restartTriggers = [ config.environment.etc."systemd/journald.conf".source ];
systemd.services.systemd-journald.stopIfChanged = false;
diff --git a/nixos/modules/tasks/encrypted-devices.nix b/nixos/modules/tasks/encrypted-devices.nix
index b1a7711ddcb4..fa0abb43c0ce 100644
--- a/nixos/modules/tasks/encrypted-devices.nix
+++ b/nixos/modules/tasks/encrypted-devices.nix
@@ -56,11 +56,19 @@ in
};
config = mkIf anyEncrypted {
+ assertions = map (dev: {
+ assertion = dev.label != null;
+ message = ''
+ The filesystem for ${dev.mountPoint} has encrypted.enable set to true, but no encrypted.label set
+ '';
+ }) encDevs;
+
boot.initrd = {
luks = {
devices =
map (dev: { name = dev.encrypted.label; device = dev.encrypted.blkDev; } ) keylessEncDevs;
cryptoModules = [ "aes" "sha256" "sha1" "xts" ];
+ forceLuksSupportInInitrd = true;
};
postMountCommands =
concatMapStrings (dev: "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.blkDev} ${dev.encrypted.label};\n") keyedEncDevs;
diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix
index 145fae432c65..7fee99115329 100644
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@@ -140,6 +140,17 @@ in
this once.
'';
};
+
+ requestEncryptionCredentials = mkOption {
+ type = types.bool;
+ default = config.boot.zfs.enableUnstable;
+ description = ''
+ Request encryption keys or passwords for all encrypted datasets on import.
+
+ Dataset encryption is only supported in zfsUnstable at the moment.
+ '';
+ };
+
};
services.zfs.autoSnapshot = {
@@ -263,6 +274,10 @@ in
assertion = !cfgZfs.forceImportAll || cfgZfs.forceImportRoot;
message = "If you enable boot.zfs.forceImportAll, you must also enable boot.zfs.forceImportRoot";
}
+ {
+ assertion = cfgZfs.requestEncryptionCredentials -> cfgZfs.enableUnstable;
+ message = "This feature is only available for zfs unstable. Set the NixOS option boot.zfs.enableUnstable.";
+ }
];
boot = {
@@ -306,6 +321,9 @@ in
done
echo
if [[ -n "$msg" ]]; then echo "$msg"; fi
+ ${lib.optionalString cfgZfs.requestEncryptionCredentials ''
+ zfs load-key -a
+ ''}
'') rootPools));
};
diff --git a/nixos/modules/tasks/kbd.nix b/nixos/modules/tasks/kbd.nix
index 3975dd5b0ffd..7fb3cbc5c1bc 100644
--- a/nixos/modules/tasks/kbd.nix
+++ b/nixos/modules/tasks/kbd.nix
@@ -98,22 +98,10 @@ in
'') config.i18n.consoleColors}
'';
- /* XXX: systemd-vconsole-setup needs a "main" terminal. By default
- * /dev/tty0 is used which wouldn't work when the service is restarted
- * from X11. We set this to /dev/tty1; not ideal because it may also be
- * owned by X11 or something else.
- *
- * See #22470.
- */
systemd.services."systemd-vconsole-setup" =
- { wantedBy = [ "sysinit.target" ];
- before = [ "display-manager.service" ];
+ { before = [ "display-manager.service" ];
after = [ "systemd-udev-settle.service" ];
restartTriggers = [ vconsoleConf kbdEnv ];
- serviceConfig.ExecStart = [
- ""
- "${pkgs.systemd}/lib/systemd/systemd-vconsole-setup /dev/tty1"
- ];
};
}
diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index adc048f3ca2c..e92c9bc27def 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -9,6 +9,12 @@ let
interfaces = attrValues cfg.interfaces;
hasVirtuals = any (i: i.virtual) interfaces;
+ slaves = concatMap (i: i.interfaces) (attrValues cfg.bonds)
+ ++ concatMap (i: i.interfaces) (attrValues cfg.bridges)
+ ++ concatMap (i: i.interfaces) (attrValues cfg.vswitches)
+ ++ concatMap (i: [i.interface]) (attrValues cfg.macvlans)
+ ++ concatMap (i: [i.interface]) (attrValues cfg.vlans);
+
# We must escape interfaces due to the systemd interpretation
subsystemDevice = interface:
"sys-subsystem-net-devices-${escapeSystemdPath interface}.device";
@@ -105,7 +111,7 @@ let
''
# Set the static DNS configuration, if given.
${pkgs.openresolv}/sbin/resolvconf -m 1 -a static <fail("cat /proc/kcore");
};
+
+ # Test deferred mount
+ subtest "mount", sub {
+ $machine->fail("mountpoint -q /efi"); # was deferred
+ $machine->execute("mkdir -p /efi");
+ $machine->succeed("mount /dev/disk/by-label/EFISYS /efi");
+ $machine->succeed("mountpoint -q /efi"); # now mounted
+ };
'';
})
diff --git a/nixos/tests/kubernetes.nix b/nixos/tests/kubernetes.nix
deleted file mode 100644
index dcd25e211971..000000000000
--- a/nixos/tests/kubernetes.nix
+++ /dev/null
@@ -1,409 +0,0 @@
-{ system ? builtins.currentSystem }:
-
-with import ../lib/testing.nix { inherit system; };
-with import ../lib/qemu-flags.nix;
-with pkgs.lib;
-
-let
- redisPod = pkgs.writeText "redis-master-pod.json" (builtins.toJSON {
- kind = "Pod";
- apiVersion = "v1";
- metadata.name = "redis";
- metadata.labels.name = "redis";
- spec.containers = [{
- name = "redis";
- image = "redis";
- args = ["--bind" "0.0.0.0"];
- imagePullPolicy = "Never";
- ports = [{
- name = "redis-server";
- containerPort = 6379;
- }];
- }];
- });
-
- redisService = pkgs.writeText "redis-service.json" (builtins.toJSON {
- kind = "Service";
- apiVersion = "v1";
- metadata.name = "redis";
- spec = {
- ports = [{port = 6379; targetPort = 6379;}];
- selector = {name = "redis";};
- };
- });
-
- redisImage = pkgs.dockerTools.buildImage {
- name = "redis";
- tag = "latest";
- contents = pkgs.redis;
- config.Entrypoint = "/bin/redis-server";
- };
-
- testSimplePod = ''
- $kubernetes->execute("docker load < ${redisImage}");
- $kubernetes->waitUntilSucceeds("kubectl create -f ${redisPod}");
- $kubernetes->succeed("kubectl create -f ${redisService}");
- $kubernetes->waitUntilSucceeds("kubectl get pod redis | grep Running");
- $kubernetes->succeed("nc -z \$\(dig \@10.10.0.1 redis.default.svc.cluster.local +short\) 6379");
- '';
-in {
- # This test runs kubernetes on a single node
- trivial = makeTest {
- name = "kubernetes-trivial";
-
- nodes = {
- kubernetes =
- { config, pkgs, lib, nodes, ... }:
- {
- virtualisation.memorySize = 768;
- virtualisation.diskSize = 2048;
-
- programs.bash.enableCompletion = true;
- environment.systemPackages = with pkgs; [ netcat bind ];
-
- services.kubernetes.roles = ["master" "node"];
- virtualisation.docker.extraOptions = "--iptables=false --ip-masq=false -b cbr0";
-
- networking.bridges.cbr0.interfaces = [];
- networking.interfaces.cbr0 = {};
- };
- };
-
- testScript = ''
- startAll;
-
- $kubernetes->waitUntilSucceeds("kubectl get nodes | grep kubernetes | grep Ready");
-
- ${testSimplePod}
- '';
- };
-
- cluster = let
- runWithOpenSSL = file: cmd: pkgs.runCommand file {
- buildInputs = [ pkgs.openssl ];
- } cmd;
-
- ca_key = runWithOpenSSL "ca-key.pem" "openssl genrsa -out $out 2048";
- ca_pem = runWithOpenSSL "ca.pem" ''
- openssl req \
- -x509 -new -nodes -key ${ca_key} \
- -days 10000 -out $out -subj "/CN=etcd-ca"
- '';
- etcd_key = runWithOpenSSL "etcd-key.pem" "openssl genrsa -out $out 2048";
- etcd_csr = runWithOpenSSL "etcd.csr" ''
- openssl req \
- -new -key ${etcd_key} \
- -out $out -subj "/CN=etcd" \
- -config ${openssl_cnf}
- '';
- etcd_cert = runWithOpenSSL "etcd.pem" ''
- openssl x509 \
- -req -in ${etcd_csr} \
- -CA ${ca_pem} -CAkey ${ca_key} \
- -CAcreateserial -out $out \
- -days 365 -extensions v3_req \
- -extfile ${openssl_cnf}
- '';
-
- etcd_client_key = runWithOpenSSL "etcd-client-key.pem"
- "openssl genrsa -out $out 2048";
-
- etcd_client_csr = runWithOpenSSL "etcd-client-key.pem" ''
- openssl req \
- -new -key ${etcd_client_key} \
- -out $out -subj "/CN=etcd-client" \
- -config ${client_openssl_cnf}
- '';
-
- etcd_client_cert = runWithOpenSSL "etcd-client.crt" ''
- openssl x509 \
- -req -in ${etcd_client_csr} \
- -CA ${ca_pem} -CAkey ${ca_key} -CAcreateserial \
- -out $out -days 365 -extensions v3_req \
- -extfile ${client_openssl_cnf}
- '';
-
- apiserver_key = runWithOpenSSL "apiserver-key.pem" "openssl genrsa -out $out 2048";
-
- apiserver_csr = runWithOpenSSL "apiserver.csr" ''
- openssl req \
- -new -key ${apiserver_key} \
- -out $out -subj "/CN=kube-apiserver" \
- -config ${apiserver_cnf}
- '';
-
- apiserver_cert = runWithOpenSSL "apiserver.pem" ''
- openssl x509 \
- -req -in ${apiserver_csr} \
- -CA ${ca_pem} -CAkey ${ca_key} -CAcreateserial \
- -out $out -days 365 -extensions v3_req \
- -extfile ${apiserver_cnf}
- '';
-
- worker_key = runWithOpenSSL "worker-key.pem" "openssl genrsa -out $out 2048";
-
- worker_csr = runWithOpenSSL "worker.csr" ''
- openssl req \
- -new -key ${worker_key} \
- -out $out -subj "/CN=kube-worker" \
- -config ${worker_cnf}
- '';
-
- worker_cert = runWithOpenSSL "worker.pem" ''
- openssl x509 \
- -req -in ${worker_csr} \
- -CA ${ca_pem} -CAkey ${ca_key} -CAcreateserial \
- -out $out -days 365 -extensions v3_req \
- -extfile ${worker_cnf}
- '';
-
- openssl_cnf = pkgs.writeText "openssl.cnf" ''
- [req]
- req_extensions = v3_req
- distinguished_name = req_distinguished_name
- [req_distinguished_name]
- [ v3_req ]
- basicConstraints = CA:FALSE
- keyUsage = digitalSignature, keyEncipherment
- extendedKeyUsage = serverAuth
- subjectAltName = @alt_names
- [alt_names]
- DNS.1 = etcd1
- DNS.2 = etcd2
- DNS.3 = etcd3
- IP.1 = 127.0.0.1
- '';
-
- client_openssl_cnf = pkgs.writeText "client-openssl.cnf" ''
- [req]
- req_extensions = v3_req
- distinguished_name = req_distinguished_name
- [req_distinguished_name]
- [ v3_req ]
- basicConstraints = CA:FALSE
- keyUsage = digitalSignature, keyEncipherment
- extendedKeyUsage = clientAuth
- '';
-
- apiserver_cnf = pkgs.writeText "apiserver-openssl.cnf" ''
- [req]
- req_extensions = v3_req
- distinguished_name = req_distinguished_name
- [req_distinguished_name]
- [ v3_req ]
- basicConstraints = CA:FALSE
- keyUsage = nonRepudiation, digitalSignature, keyEncipherment
- subjectAltName = @alt_names
- [alt_names]
- DNS.1 = kubernetes
- DNS.2 = kubernetes.default
- DNS.3 = kubernetes.default.svc
- DNS.4 = kubernetes.default.svc.cluster.local
- IP.1 = 10.10.10.1
- '';
-
- worker_cnf = pkgs.writeText "worker-openssl.cnf" ''
- [req]
- req_extensions = v3_req
- distinguished_name = req_distinguished_name
- [req_distinguished_name]
- [ v3_req ]
- basicConstraints = CA:FALSE
- keyUsage = nonRepudiation, digitalSignature, keyEncipherment
- subjectAltName = @alt_names
- [alt_names]
- DNS.1 = kubeWorker1
- DNS.2 = kubeWorker2
- '';
-
- etcdNodeConfig = {
- virtualisation.memorySize = 128;
-
- services = {
- etcd = {
- enable = true;
- keyFile = etcd_key;
- certFile = etcd_cert;
- trustedCaFile = ca_pem;
- peerClientCertAuth = true;
- listenClientUrls = ["https://0.0.0.0:2379"];
- listenPeerUrls = ["https://0.0.0.0:2380"];
- };
- };
-
- environment.variables = {
- ETCDCTL_CERT_FILE = "${etcd_client_cert}";
- ETCDCTL_KEY_FILE = "${etcd_client_key}";
- ETCDCTL_CA_FILE = "${ca_pem}";
- ETCDCTL_PEERS = "https://127.0.0.1:2379";
- };
-
- networking.firewall.allowedTCPPorts = [ 2379 2380 ];
- };
-
- kubeConfig = {
- virtualisation.diskSize = 2048;
- programs.bash.enableCompletion = true;
-
- services.flannel = {
- enable = true;
- network = "10.10.0.0/16";
- iface = "eth1";
- etcd = {
- endpoints = ["https://etcd1:2379" "https://etcd2:2379" "https://etcd3:2379"];
- keyFile = etcd_client_key;
- certFile = etcd_client_cert;
- caFile = ca_pem;
- };
- };
-
- # vxlan
- networking.firewall.allowedUDPPorts = [ 8472 ];
-
- systemd.services.docker.after = ["flannel.service"];
- systemd.services.docker.serviceConfig.EnvironmentFile = "/run/flannel/subnet.env";
- virtualisation.docker.extraOptions = "--iptables=false --ip-masq=false --bip $FLANNEL_SUBNET";
-
- services.kubernetes.verbose = true;
- services.kubernetes.etcd = {
- servers = ["https://etcd1:2379" "https://etcd2:2379" "https://etcd3:2379"];
- keyFile = etcd_client_key;
- certFile = etcd_client_cert;
- caFile = ca_pem;
- };
-
- environment.systemPackages = [ pkgs.bind pkgs.tcpdump pkgs.utillinux ];
- };
-
- kubeMasterConfig = {pkgs, ...}: {
- require = [kubeConfig];
-
- # kube apiserver
- networking.firewall.allowedTCPPorts = [ 443 ];
-
- virtualisation.memorySize = 512;
-
- services.kubernetes = {
- roles = ["master"];
- scheduler.leaderElect = true;
- controllerManager.leaderElect = true;
-
- apiserver = {
- publicAddress = "0.0.0.0";
- advertiseAddress = "192.168.1.8";
- tlsKeyFile = apiserver_key;
- tlsCertFile = apiserver_cert;
- clientCaFile = ca_pem;
- kubeletClientCaFile = ca_pem;
- kubeletClientKeyFile = worker_key;
- kubeletClientCertFile = worker_cert;
- };
- };
- };
-
- kubeWorkerConfig = { pkgs, ... }: {
- require = [kubeConfig];
-
- virtualisation.memorySize = 512;
-
- # kubelet
- networking.firewall.allowedTCPPorts = [ 10250 ];
-
- services.kubernetes = {
- roles = ["node"];
- kubeconfig = {
- server = "https://kubernetes:443";
- caFile = ca_pem;
- certFile = worker_cert;
- keyFile = worker_key;
- };
- kubelet = {
- tlsKeyFile = worker_key;
- tlsCertFile = worker_cert;
- };
- };
- };
- in makeTest {
- name = "kubernetes-cluster";
-
- nodes = {
- etcd1 = { config, pkgs, nodes, ... }: {
- require = [etcdNodeConfig];
- services.etcd = {
- advertiseClientUrls = ["https://etcd1:2379"];
- initialCluster = ["etcd1=https://etcd1:2380" "etcd2=https://etcd2:2380" "etcd3=https://etcd3:2380"];
- initialAdvertisePeerUrls = ["https://etcd1:2380"];
- };
- };
-
- etcd2 = { config, pkgs, ... }: {
- require = [etcdNodeConfig];
- services.etcd = {
- advertiseClientUrls = ["https://etcd2:2379"];
- initialCluster = ["etcd1=https://etcd1:2380" "etcd2=https://etcd2:2380" "etcd3=https://etcd3:2380"];
- initialAdvertisePeerUrls = ["https://etcd2:2380"];
- };
- };
-
- etcd3 = { config, pkgs, ... }: {
- require = [etcdNodeConfig];
- services.etcd = {
- advertiseClientUrls = ["https://etcd3:2379"];
- initialCluster = ["etcd1=https://etcd1:2380" "etcd2=https://etcd2:2380" "etcd3=https://etcd3:2380"];
- initialAdvertisePeerUrls = ["https://etcd3:2380"];
- };
- };
-
- kubeMaster1 = { config, pkgs, lib, nodes, ... }: {
- require = [kubeMasterConfig];
- };
-
- kubeMaster2 = { config, pkgs, lib, nodes, ... }: {
- require = [kubeMasterConfig];
- };
-
- # Kubernetes TCP load balancer
- kubernetes = { config, pkgs, ... }: {
- # kubernetes
- networking.firewall.allowedTCPPorts = [ 443 ];
-
- services.haproxy.enable = true;
- services.haproxy.config = ''
- global
- log 127.0.0.1 local0 notice
- user haproxy
- group haproxy
-
- defaults
- log global
- retries 2
- timeout connect 3000
- timeout server 5000
- timeout client 5000
-
- listen kubernetes
- bind 0.0.0.0:443
- mode tcp
- option ssl-hello-chk
- balance roundrobin
- server kube-master-1 kubeMaster1:443 check
- server kube-master-2 kubeMaster2:443 check
- '';
- };
-
- kubeWorker1 = { config, pkgs, lib, nodes, ... }: {
- require = [kubeWorkerConfig];
- };
-
- kubeWorker2 = { config, pkgs, lib, nodes, ... }: {
- require = [kubeWorkerConfig];
- };
- };
-
- testScript = ''
- startAll;
-
- ${testSimplePod}
- '';
- };
-}
diff --git a/nixos/tests/kubernetes/base.nix b/nixos/tests/kubernetes/base.nix
new file mode 100644
index 000000000000..acf2e0250819
--- /dev/null
+++ b/nixos/tests/kubernetes/base.nix
@@ -0,0 +1,113 @@
+{ system ? builtins.currentSystem }:
+
+with import ../../lib/testing.nix { inherit system; };
+with import ../../lib/qemu-flags.nix;
+with pkgs.lib;
+
+let
+ mkKubernetesBaseTest =
+ { name, domain ? "my.zyx", test, machines
+ , pkgs ? import { inherit system; }
+ , certs ? import ./certs.nix { inherit pkgs; externalDomain = domain; }
+ , extraConfiguration ? null }:
+ let
+ masterName = head (filter (machineName: any (role: role == "master") machines.${machineName}.roles) (attrNames machines));
+ master = machines.${masterName};
+ extraHosts = ''
+ ${master.ip} etcd.${domain}
+ ${master.ip} api.${domain}
+ ${concatMapStringsSep "\n" (machineName: "${machines.${machineName}.ip} ${machineName}.${domain}") (attrNames machines)}
+ '';
+ in makeTest {
+ inherit name;
+
+ nodes = mapAttrs (machineName: machine:
+ { config, pkgs, lib, nodes, ... }:
+ mkMerge [
+ {
+ virtualisation.memorySize = mkDefault 768;
+ virtualisation.diskSize = mkDefault 4096;
+ networking = {
+ inherit domain extraHosts;
+ primaryIPAddress = mkForce machine.ip;
+
+ firewall = {
+ allowedTCPPorts = [
+ 10250 # kubelet
+ ];
+ trustedInterfaces = ["docker0"];
+
+ extraCommands = concatMapStrings (node: ''
+ iptables -A INPUT -s ${node.config.networking.primaryIPAddress} -j ACCEPT
+ '') (attrValues nodes);
+ };
+ };
+ programs.bash.enableCompletion = true;
+ environment.variables = {
+ ETCDCTL_CERT_FILE = "${certs.worker}/etcd-client.pem";
+ ETCDCTL_KEY_FILE = "${certs.worker}/etcd-client-key.pem";
+ ETCDCTL_CA_FILE = "${certs.worker}/ca.pem";
+ ETCDCTL_PEERS = "https://etcd.${domain}:2379";
+ };
+ services.flannel.iface = "eth1";
+ services.kubernetes.apiserver.advertiseAddress = master.ip;
+ }
+ (optionalAttrs (any (role: role == "master") machine.roles) {
+ networking.firewall.allowedTCPPorts = [
+ 2379 2380 # etcd
+ 443 # kubernetes apiserver
+ ];
+ services.etcd = {
+ enable = true;
+ certFile = "${certs.master}/etcd.pem";
+ keyFile = "${certs.master}/etcd-key.pem";
+ trustedCaFile = "${certs.master}/ca.pem";
+ peerClientCertAuth = true;
+ listenClientUrls = ["https://0.0.0.0:2379"];
+ listenPeerUrls = ["https://0.0.0.0:2380"];
+ advertiseClientUrls = ["https://etcd.${config.networking.domain}:2379"];
+ initialCluster = ["${masterName}=https://etcd.${config.networking.domain}:2380"];
+ initialAdvertisePeerUrls = ["https://etcd.${config.networking.domain}:2380"];
+ };
+ })
+ (import ./kubernetes-common.nix { inherit (machine) roles; inherit pkgs config certs; })
+ (optionalAttrs (machine ? "extraConfiguration") (machine.extraConfiguration { inherit config pkgs lib nodes; }))
+ (optionalAttrs (extraConfiguration != null) (extraConfiguration { inherit config pkgs lib nodes; }))
+ ]
+ ) machines;
+
+ testScript = ''
+ startAll;
+
+ ${test}
+ '';
+ };
+
+ mkKubernetesMultiNodeTest = attrs: mkKubernetesBaseTest ({
+ machines = {
+ machine1 = {
+ roles = ["master"];
+ ip = "192.168.1.1";
+ };
+ machine2 = {
+ roles = ["node"];
+ ip = "192.168.1.2";
+ };
+ };
+ } // attrs // {
+ name = "kubernetes-${attrs.name}-multinode";
+ });
+
+ mkKubernetesSingleNodeTest = attrs: mkKubernetesBaseTest ({
+ machines = {
+ machine1 = {
+ roles = ["master" "node"];
+ ip = "192.168.1.1";
+ };
+ };
+ } // attrs // {
+ name = "kubernetes-${attrs.name}-singlenode";
+ });
+in {
+ inherit mkKubernetesBaseTest mkKubernetesSingleNodeTest mkKubernetesMultiNodeTest;
+}
diff --git a/nixos/tests/kubernetes/certs.nix b/nixos/tests/kubernetes/certs.nix
new file mode 100644
index 000000000000..f108e35b98cd
--- /dev/null
+++ b/nixos/tests/kubernetes/certs.nix
@@ -0,0 +1,185 @@
+{
+ pkgs ? import {},
+ internalDomain ? "cloud.yourdomain.net",
+ externalDomain ? "myawesomecluster.cluster.yourdomain.net",
+ serviceClusterIp ? "10.0.0.1"
+}:
+let
+ runWithCFSSL = name: cmd:
+ builtins.fromJSON (builtins.readFile (
+ pkgs.runCommand "${name}-cfss.json" {
+ buildInputs = [ pkgs.cfssl ];
+ } "cfssl ${cmd} > $out"
+ ));
+
+ writeCFSSL = content:
+ pkgs.runCommand content.name {
+ buildInputs = [ pkgs.cfssl ];
+ } ''
+ mkdir -p $out
+ cd $out
+ cat ${writeFile content} | cfssljson -bare ${content.name}
+ '';
+
+ noCSR = content: pkgs.lib.filterAttrs (n: v: n != "csr") content;
+ noKey = content: pkgs.lib.filterAttrs (n: v: n != "key") content;
+
+ writeFile = content: pkgs.writeText "content" (
+ if pkgs.lib.isAttrs content then builtins.toJSON content
+ else toString content
+ );
+
+ createServingCertKey = { ca, cn, hosts? [], size ? 2048, name ? cn }:
+ noCSR (
+ (runWithCFSSL name "gencert -ca=${writeFile ca.cert} -ca-key=${writeFile ca.key} -profile=server -config=${writeFile ca.config} ${writeFile {
+ CN = cn;
+ hosts = hosts;
+ key = { algo = "rsa"; inherit size; };
+ }}") // { inherit name; }
+ );
+
+ createClientCertKey = { ca, cn, groups ? [], size ? 2048, name ? cn }:
+ noCSR (
+ (runWithCFSSL name "gencert -ca=${writeFile ca.cert} -ca-key=${writeFile ca.key} -profile=client -config=${writeFile ca.config} ${writeFile {
+ CN = cn;
+ names = map (group: {O = group;}) groups;
+ hosts = [""];
+ key = { algo = "rsa"; inherit size; };
+ }}") // { inherit name; }
+ );
+
+ createSigningCertKey = { C ? "xx", ST ? "x", L ? "x", O ? "x", OU ? "x", CN ? "ca", emailAddress ? "x", expiry ? "43800h", size ? 2048, name ? CN }:
+ (noCSR (runWithCFSSL CN "genkey -initca ${writeFile {
+ key = { algo = "rsa"; inherit size; };
+ names = [{ inherit C ST L O OU CN emailAddress; }];
+ }}")) // {
+ inherit name;
+ config.signing = {
+ default.expiry = expiry;
+ profiles = {
+ server = {
+ inherit expiry;
+ usages = [
+ "signing"
+ "key encipherment"
+ "server auth"
+ ];
+ };
+ client = {
+ inherit expiry;
+ usages = [
+ "signing"
+ "key encipherment"
+ "client auth"
+ ];
+ };
+ peer = {
+ inherit expiry;
+ usages = [
+ "signing"
+ "key encipherment"
+ "server auth"
+ "client auth"
+ ];
+ };
+ };
+ };
+ };
+
+ ca = createSigningCertKey {};
+
+ kube-apiserver = createServingCertKey {
+ inherit ca;
+ cn = "kube-apiserver";
+ hosts = ["kubernetes.default" "kubernetes.default.svc" "localhost" "api.${externalDomain}" serviceClusterIp];
+ };
+
+ kubelet = createServingCertKey {
+ inherit ca;
+ cn = "kubelet";
+ hosts = ["*.${externalDomain}"];
+ };
+
+ service-accounts = createServingCertKey {
+ inherit ca;
+ cn = "kube-service-accounts";
+ };
+
+ etcd = createServingCertKey {
+ inherit ca;
+ cn = "etcd";
+ hosts = ["etcd.${externalDomain}"];
+ };
+
+ etcd-client = createClientCertKey {
+ inherit ca;
+ cn = "etcd-client";
+ };
+
+ kubelet-client = createClientCertKey {
+ inherit ca;
+ cn = "kubelet-client";
+ groups = ["system:masters"];
+ };
+
+ apiserver-client = {
+ kubelet = createClientCertKey {
+ inherit ca;
+ cn = "apiserver-client-kubelet";
+ groups = ["system:nodes"];
+ };
+
+ kube-proxy = createClientCertKey {
+ inherit ca;
+ name = "apiserver-client-kube-proxy";
+ cn = "system:kube-proxy";
+ groups = ["system:kube-proxy" "system:nodes"];
+ };
+
+ kube-controller-manager = createClientCertKey {
+ inherit ca;
+ name = "apiserver-client-kube-controller-manager";
+ cn = "system:kube-controller-manager";
+ groups = ["system:masters"];
+ };
+
+ kube-scheduler = createClientCertKey {
+ inherit ca;
+ name = "apiserver-client-kube-scheduler";
+ cn = "system:kube-scheduler";
+ groups = ["system:kube-scheduler"];
+ };
+
+ admin = createClientCertKey {
+ inherit ca;
+ cn = "admin";
+ groups = ["system:masters"];
+ };
+ };
+in {
+ master = pkgs.buildEnv {
+ name = "master-keys";
+ paths = [
+ (writeCFSSL (noKey ca))
+ (writeCFSSL kube-apiserver)
+ (writeCFSSL kubelet-client)
+ (writeCFSSL apiserver-client.kube-controller-manager)
+ (writeCFSSL apiserver-client.kube-scheduler)
+ (writeCFSSL service-accounts)
+ (writeCFSSL etcd)
+ ];
+ };
+
+ worker = pkgs.buildEnv {
+ name = "worker-keys";
+ paths = [
+ (writeCFSSL (noKey ca))
+ (writeCFSSL kubelet)
+ (writeCFSSL apiserver-client.kubelet)
+ (writeCFSSL apiserver-client.kube-proxy)
+ (writeCFSSL etcd-client)
+ ];
+ };
+
+ admin = writeCFSSL apiserver-client.admin;
+}
diff --git a/nixos/tests/kubernetes/default.nix b/nixos/tests/kubernetes/default.nix
new file mode 100644
index 000000000000..a801759bf582
--- /dev/null
+++ b/nixos/tests/kubernetes/default.nix
@@ -0,0 +1,7 @@
+{ system ? builtins.currentSystem }:
+{
+ dns = import ./dns.nix { inherit system; };
+ # e2e = import ./e2e.nix { inherit system; }; # TODO: make it pass
+ # the following test(s) can be removed when e2e is working:
+ rbac = import ./rbac.nix { inherit system; };
+}
diff --git a/nixos/tests/kubernetes/dns.nix b/nixos/tests/kubernetes/dns.nix
new file mode 100644
index 000000000000..74d98dabec8d
--- /dev/null
+++ b/nixos/tests/kubernetes/dns.nix
@@ -0,0 +1,127 @@
+{ system ? builtins.currentSystem, pkgs ? import { inherit system; } }:
+with import ./base.nix { inherit system; };
+let
+ domain = "my.zyx";
+
+ certs = import ./certs.nix { externalDomain = domain; };
+
+ redisPod = pkgs.writeText "redis-pod.json" (builtins.toJSON {
+ kind = "Pod";
+ apiVersion = "v1";
+ metadata.name = "redis";
+ metadata.labels.name = "redis";
+ spec.containers = [{
+ name = "redis";
+ image = "redis";
+ args = ["--bind" "0.0.0.0"];
+ imagePullPolicy = "Never";
+ ports = [{
+ name = "redis-server";
+ containerPort = 6379;
+ }];
+ }];
+ });
+
+ redisService = pkgs.writeText "redis-service.json" (builtins.toJSON {
+ kind = "Service";
+ apiVersion = "v1";
+ metadata.name = "redis";
+ spec = {
+ ports = [{port = 6379; targetPort = 6379;}];
+ selector = {name = "redis";};
+ };
+ });
+
+ redisImage = pkgs.dockerTools.buildImage {
+ name = "redis";
+ tag = "latest";
+ contents = [ pkgs.redis pkgs.bind.host ];
+ config.Entrypoint = "/bin/redis-server";
+ };
+
+ probePod = pkgs.writeText "probe-pod.json" (builtins.toJSON {
+ kind = "Pod";
+ apiVersion = "v1";
+ metadata.name = "probe";
+ metadata.labels.name = "probe";
+ spec.containers = [{
+ name = "probe";
+ image = "probe";
+ args = [ "-f" ];
+ tty = true;
+ imagePullPolicy = "Never";
+ }];
+ });
+
+ probeImage = pkgs.dockerTools.buildImage {
+ name = "probe";
+ tag = "latest";
+ contents = [ pkgs.bind.host pkgs.busybox ];
+ config.Entrypoint = "/bin/tail";
+ };
+
+ extraConfiguration = { config, pkgs, lib, nodes, ... }: {
+ environment.systemPackages = [ pkgs.bind.host ];
+ # virtualisation.docker.extraOptions = "--dns=${config.services.kubernetes.addons.dns.clusterIp}";
+ services.dnsmasq.enable = true;
+ services.dnsmasq.servers = [
+ "/cluster.local/${config.services.kubernetes.addons.dns.clusterIp}#53"
+ ];
+ };
+
+ base = {
+ name = "dns";
+ inherit domain certs extraConfiguration;
+ };
+
+ singleNodeTest = {
+ test = ''
+ # prepare machine1 for test
+ $machine1->waitUntilSucceeds("kubectl get node machine1.${domain} | grep -w Ready");
+ $machine1->execute("docker load < ${redisImage}");
+ $machine1->waitUntilSucceeds("kubectl create -f ${redisPod}");
+ $machine1->waitUntilSucceeds("kubectl create -f ${redisService}");
+ $machine1->execute("docker load < ${probeImage}");
+ $machine1->waitUntilSucceeds("kubectl create -f ${probePod}");
+
+ # check if pods are running
+ $machine1->waitUntilSucceeds("kubectl get pod redis | grep Running");
+ $machine1->waitUntilSucceeds("kubectl get pod probe | grep Running");
+ $machine1->waitUntilSucceeds("kubectl get pods -n kube-system | grep 'kube-dns.*3/3'");
+
+ # check dns on host (dnsmasq)
+ $machine1->succeed("host redis.default.svc.cluster.local");
+
+ # check dns inside the container
+ $machine1->succeed("kubectl exec -ti probe -- /bin/host redis.default.svc.cluster.local");
+ '';
+ };
+
+ multiNodeTest = {
+ test = ''
+ # prepare machines for test
+ $machine1->waitUntilSucceeds("kubectl get node machine1.${domain} | grep -w Ready");
+ $machine1->waitUntilSucceeds("kubectl get node machine2.${domain} | grep -w Ready");
+ $machine2->execute("docker load < ${redisImage}");
+ $machine1->waitUntilSucceeds("kubectl create -f ${redisPod}");
+ $machine1->waitUntilSucceeds("kubectl create -f ${redisService}");
+ $machine2->execute("docker load < ${probeImage}");
+ $machine1->waitUntilSucceeds("kubectl create -f ${probePod}");
+
+ # check if pods are running
+ $machine1->waitUntilSucceeds("kubectl get pod redis | grep Running");
+ $machine1->waitUntilSucceeds("kubectl get pod probe | grep Running");
+ $machine1->waitUntilSucceeds("kubectl get pods -n kube-system | grep 'kube-dns.*3/3'");
+
+ # check dns on hosts (dnsmasq)
+ $machine1->succeed("host redis.default.svc.cluster.local");
+ $machine2->succeed("host redis.default.svc.cluster.local");
+
+ # check dns inside the container
+ $machine1->succeed("kubectl exec -ti probe -- /bin/host redis.default.svc.cluster.local");
+ '';
+ };
+in {
+ singlenode = mkKubernetesSingleNodeTest (base // singleNodeTest);
+ multinode = mkKubernetesMultiNodeTest (base // multiNodeTest);
+}
diff --git a/nixos/tests/kubernetes/e2e.nix b/nixos/tests/kubernetes/e2e.nix
new file mode 100644
index 000000000000..d9d7ba9bb2cc
--- /dev/null
+++ b/nixos/tests/kubernetes/e2e.nix
@@ -0,0 +1,40 @@
+{ system ? builtins.currentSystem, pkgs ? import { inherit system; } }:
+with import ./base.nix { inherit system; };
+let
+ domain = "my.zyx";
+ certs = import ./certs.nix { externalDomain = domain; };
+ kubeconfig = pkgs.writeText "kubeconfig.json" (builtins.toJSON {
+ apiVersion = "v1";
+ kind = "Config";
+ clusters = [{
+ name = "local";
+ cluster.certificate-authority = "${certs.master}/ca.pem";
+ cluster.server = "https://api.${domain}";
+ }];
+ users = [{
+ name = "kubelet";
+ user = {
+ client-certificate = "${certs.admin}/admin.pem";
+ client-key = "${certs.admin}/admin-key.pem";
+ };
+ }];
+ contexts = [{
+ context = {
+ cluster = "local";
+ user = "kubelet";
+ };
+ current-context = "kubelet-context";
+ }];
+ });
+
+ base = {
+ name = "e2e";
+ inherit domain certs;
+ test = ''
+ $machine1->succeed("e2e.test -kubeconfig ${kubeconfig} -provider local -ginkgo.focus '\\[Conformance\\]' -ginkgo.skip '\\[Flaky\\]|\\[Serial\\]'");
+ '';
+ };
+in {
+ singlenode = mkKubernetesSingleNodeTest base;
+ multinode = mkKubernetesMultiNodeTest base;
+}
diff --git a/nixos/tests/kubernetes/kubernetes-common.nix b/nixos/tests/kubernetes/kubernetes-common.nix
new file mode 100644
index 000000000000..00a5c9aba4e3
--- /dev/null
+++ b/nixos/tests/kubernetes/kubernetes-common.nix
@@ -0,0 +1,59 @@
+{ roles, config, pkgs, certs }:
+with pkgs.lib;
+let
+ base = {
+ inherit roles;
+ featureGates = ["AllAlpha"];
+ flannel.enable = true;
+ addons.dashboard.enable = true;
+ verbose = true;
+
+ caFile = "${certs.master}/ca.pem";
+ apiserver = {
+ tlsCertFile = "${certs.master}/kube-apiserver.pem";
+ tlsKeyFile = "${certs.master}/kube-apiserver-key.pem";
+ kubeletClientCertFile = "${certs.master}/kubelet-client.pem";
+ kubeletClientKeyFile = "${certs.master}/kubelet-client-key.pem";
+ serviceAccountKeyFile = "${certs.master}/kube-service-accounts.pem";
+ };
+ etcd = {
+ servers = ["https://etcd.${config.networking.domain}:2379"];
+ certFile = "${certs.worker}/etcd-client.pem";
+ keyFile = "${certs.worker}/etcd-client-key.pem";
+ };
+ kubeconfig = {
+ server = "https://api.${config.networking.domain}";
+ };
+ kubelet = {
+ tlsCertFile = "${certs.worker}/kubelet.pem";
+ tlsKeyFile = "${certs.worker}/kubelet-key.pem";
+ hostname = "${config.networking.hostName}.${config.networking.domain}";
+ kubeconfig = {
+ certFile = "${certs.worker}/apiserver-client-kubelet.pem";
+ keyFile = "${certs.worker}/apiserver-client-kubelet-key.pem";
+ };
+ };
+ controllerManager = {
+ serviceAccountKeyFile = "${certs.master}/kube-service-accounts-key.pem";
+ kubeconfig = {
+ certFile = "${certs.master}/apiserver-client-kube-controller-manager.pem";
+ keyFile = "${certs.master}/apiserver-client-kube-controller-manager-key.pem";
+ };
+ };
+ scheduler = {
+ kubeconfig = {
+ certFile = "${certs.master}/apiserver-client-kube-scheduler.pem";
+ keyFile = "${certs.master}/apiserver-client-kube-scheduler-key.pem";
+ };
+ };
+ proxy = {
+ kubeconfig = {
+ certFile = "${certs.worker}/apiserver-client-kube-proxy.pem";
+ keyFile = "${certs.worker}//apiserver-client-kube-proxy-key.pem";
+ };
+ };
+ };
+
+in {
+ services.kubernetes = base;
+}
diff --git a/nixos/tests/kubernetes/rbac.nix b/nixos/tests/kubernetes/rbac.nix
new file mode 100644
index 000000000000..1966fed3a5fb
--- /dev/null
+++ b/nixos/tests/kubernetes/rbac.nix
@@ -0,0 +1,137 @@
+{ system ? builtins.currentSystem, pkgs ? import { inherit system; } }:
+with import ./base.nix { inherit system; };
+let
+
+ roServiceAccount = pkgs.writeText "ro-service-account.json" (builtins.toJSON {
+ kind = "ServiceAccount";
+ apiVersion = "v1";
+ metadata = {
+ name = "read-only";
+ namespace = "default";
+ };
+ });
+
+ roRoleBinding = pkgs.writeText "ro-role-binding.json" (builtins.toJSON {
+ apiVersion = "rbac.authorization.k8s.io/v1beta1";
+ kind = "RoleBinding";
+ metadata = {
+ name = "read-pods";
+ namespace = "default";
+ };
+ roleRef = {
+ apiGroup = "rbac.authorization.k8s.io";
+ kind = "Role";
+ name = "pod-reader";
+ };
+ subjects = [{
+ kind = "ServiceAccount";
+ name = "read-only";
+ namespace = "default";
+ }];
+ });
+
+ roRole = pkgs.writeText "ro-role.json" (builtins.toJSON {
+ apiVersion = "rbac.authorization.k8s.io/v1beta1";
+ kind = "Role";
+ metadata = {
+ name = "pod-reader";
+ namespace = "default";
+ };
+ rules = [{
+ apiGroups = [""];
+ resources = ["pods"];
+ verbs = ["get" "list" "watch"];
+ }];
+ });
+
+ kubectlPod = pkgs.writeText "kubectl-pod.json" (builtins.toJSON {
+ kind = "Pod";
+ apiVersion = "v1";
+ metadata.name = "kubectl";
+ metadata.namespace = "default";
+ metadata.labels.name = "kubectl";
+ spec.serviceAccountName = "read-only";
+ spec.containers = [{
+ name = "kubectl";
+ image = "kubectl:latest";
+ command = ["/bin/tail" "-f"];
+ imagePullPolicy = "Never";
+ tty = true;
+ }];
+ });
+
+ kubectlPod2 = pkgs.writeTextDir "kubectl-pod-2.json" (builtins.toJSON {
+ kind = "Pod";
+ apiVersion = "v1";
+ metadata.name = "kubectl-2";
+ metadata.namespace = "default";
+ metadata.labels.name = "kubectl-2";
+ spec.serviceAccountName = "read-only";
+ spec.containers = [{
+ name = "kubectl-2";
+ image = "kubectl:latest";
+ command = ["/bin/tail" "-f"];
+ imagePullPolicy = "Never";
+ tty = true;
+ }];
+ });
+
+ kubectl = pkgs.runCommand "copy-kubectl" { buildInputs = [ pkgs.kubernetes ]; } ''
+ mkdir -p $out/bin
+ cp ${pkgs.kubernetes}/bin/kubectl $out/bin/kubectl
+ '';
+
+ kubectlImage = pkgs.dockerTools.buildImage {
+ name = "kubectl";
+ tag = "latest";
+ contents = [ kubectl pkgs.busybox kubectlPod2 ];
+ config.Entrypoint = "/bin/sh";
+ };
+
+ base = {
+ name = "rbac";
+ };
+
+ singlenode = base // {
+ test = ''
+ $machine1->waitUntilSucceeds("kubectl get node machine1.my.zyx | grep -w Ready");
+
+ $machine1->execute("docker load < ${kubectlImage}");
+
+ $machine1->waitUntilSucceeds("kubectl apply -f ${roServiceAccount}");
+ $machine1->waitUntilSucceeds("kubectl apply -f ${roRole}");
+ $machine1->waitUntilSucceeds("kubectl apply -f ${roRoleBinding}");
+ $machine1->waitUntilSucceeds("kubectl create -f ${kubectlPod}");
+
+ $machine1->waitUntilSucceeds("kubectl get pod kubectl | grep Running");
+
+ $machine1->succeed("kubectl exec -ti kubectl -- kubectl get pods");
+ $machine1->fail("kubectl exec -ti kubectl -- kubectl create -f /kubectl-pod-2.json");
+ $machine1->fail("kubectl exec -ti kubectl -- kubectl delete pods -l name=kubectl");
+ '';
+ };
+
+ multinode = base // {
+ test = ''
+ $machine1->waitUntilSucceeds("kubectl get node machine1.my.zyx | grep -w Ready");
+ $machine1->waitUntilSucceeds("kubectl get node machine2.my.zyx | grep -w Ready");
+
+ $machine2->execute("docker load < ${kubectlImage}");
+
+ $machine1->waitUntilSucceeds("kubectl apply -f ${roServiceAccount}");
+ $machine1->waitUntilSucceeds("kubectl apply -f ${roRole}");
+ $machine1->waitUntilSucceeds("kubectl apply -f ${roRoleBinding}");
+ $machine1->waitUntilSucceeds("kubectl create -f ${kubectlPod}");
+
+ $machine1->waitUntilSucceeds("kubectl get pod kubectl | grep Running");
+
+ $machine1->succeed("kubectl exec -ti kubectl -- kubectl get pods");
+ $machine1->fail("kubectl exec -ti kubectl -- kubectl create -f /kubectl-pod-2.json");
+ $machine1->fail("kubectl exec -ti kubectl -- kubectl delete pods -l name=kubectl");
+ '';
+ };
+
+in {
+ singlenode = mkKubernetesSingleNodeTest singlenode;
+ multinode = mkKubernetesMultiNodeTest multinode;
+}
diff --git a/nixos/tests/mesos.nix b/nixos/tests/mesos.nix
index 6e9af126f032..34671df047c8 100644
--- a/nixos/tests/mesos.nix
+++ b/nixos/tests/mesos.nix
@@ -56,9 +56,7 @@ import ./make-test.nix ({ pkgs, ...} : rec {
src = ./mesos_test.py;
phases = [ "installPhase" "fixupPhase" ];
installPhase = ''
- mkdir $out
- cp $src $out/mesos_test.py
- chmod +x $out/mesos_test.py
+ install -Dvm 0755 $src $out/bin/mesos_test.py
echo "done" > test.result
tar czf $out/test.tar.gz test.result
@@ -74,18 +72,18 @@ import ./make-test.nix ({ pkgs, ...} : rec {
$master->waitForOpenPort(5050);
$slave->waitForOpenPort(5051);
- # is slave registred?
+ # is slave registered?
$master->waitUntilSucceeds("curl -s --fail http://master:5050/master/slaves".
" | grep -q \"\\\"hostname\\\":\\\"slave\\\"\"");
- # try to run docker image
+ # try to run docker image
$master->succeed("${pkgs.mesos}/bin/mesos-execute --master=master:5050".
" --resources=\"cpus:0.1;mem:32\" --name=simple-docker".
" --containerizer=mesos --docker_image=echo:latest".
" --shell=true --command=\"echo done\" | grep -q TASK_FINISHED");
# simple command with .tar.gz uri
- $master->succeed("${testFramework}/mesos_test.py master ".
+ $master->succeed("${testFramework}/bin/mesos_test.py master ".
"${testFramework}/test.tar.gz");
'';
})
diff --git a/nixos/tests/mysql-backup.nix b/nixos/tests/mysql-backup.nix
new file mode 100644
index 000000000000..f5bcc460cba7
--- /dev/null
+++ b/nixos/tests/mysql-backup.nix
@@ -0,0 +1,42 @@
+# Test whether mysqlBackup option works
+import ./make-test.nix ({ pkgs, ... } : {
+ name = "mysql-backup";
+ meta = with pkgs.stdenv.lib.maintainers; {
+ maintainers = [ rvl ];
+ };
+
+ nodes = {
+ master = { config, pkgs, ... }: {
+ services.mysql = {
+ enable = true;
+ initialDatabases = [ { name = "testdb"; schema = ./testdb.sql; } ];
+ package = pkgs.mysql;
+ };
+
+ services.mysqlBackup = {
+ enable = true;
+ databases = [ "doesnotexist" "testdb" ];
+ };
+ };
+ };
+
+ testScript =
+ '' startAll;
+
+ # Need to have mysql started so that it can be populated with data.
+ $master->waitForUnit("mysql.service");
+
+ # Wait for testdb to be populated.
+ $master->sleep(10);
+
+ # Do a backup and wait for it to finish.
+ $master->startJob("mysql-backup.service");
+ $master->waitForJob("mysql-backup.service");
+
+ # Check that data appears in backup
+ $master->succeed("${pkgs.gzip}/bin/zcat /var/backup/mysql/testdb.gz | grep hello");
+
+ # Check that a failed backup is logged
+ $master->succeed("journalctl -u mysql-backup.service | grep 'fail.*doesnotexist' > /dev/null");
+ '';
+})
diff --git a/nixos/tests/radicale.nix b/nixos/tests/radicale.nix
index 2c888469d0a4..f694fc75ef77 100644
--- a/nixos/tests/radicale.nix
+++ b/nixos/tests/radicale.nix
@@ -43,6 +43,7 @@ in
});
})
];
+ system.stateVersion = "17.03";
};
radicale1_export = lib.recursiveUpdate radicale1 {
services.radicale.extraArgs = [
diff --git a/nixos/tests/testdb.sql b/nixos/tests/testdb.sql
index 4fb28fea3df9..3c68c49ae82c 100644
--- a/nixos/tests/testdb.sql
+++ b/nixos/tests/testdb.sql
@@ -8,3 +8,4 @@ insert into tests values (1, 'a');
insert into tests values (2, 'b');
insert into tests values (3, 'c');
insert into tests values (4, 'd');
+insert into tests values (5, 'hello');
diff --git a/pkgs/applications/altcoins/bitcoin-abc.nix b/pkgs/applications/altcoins/bitcoin-abc.nix
new file mode 100644
index 000000000000..d3800062b119
--- /dev/null
+++ b/pkgs/applications/altcoins/bitcoin-abc.nix
@@ -0,0 +1,43 @@
+{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
+, zlib, miniupnpc, qt5, utillinux, protobuf, qrencode, libevent
+, withGui }:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+
+ name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
+ version = "0.15.0";
+
+ src = fetchFromGitHub {
+ owner = "bitcoin-ABC";
+ repo = "bitcoin-abc";
+ rev = "v${version}";
+ sha256 = "1fygn6cc99iasg5g5jyps5ps873hfnn4ln4hsmcwlwiqd591qxyv";
+ };
+
+ patches = [ ./fix-bitcoin-qt-build.patch ];
+
+ nativeBuildInputs = [ pkgconfig autoreconfHook ];
+ buildInputs = [ openssl db48 boost zlib
+ miniupnpc utillinux protobuf libevent ]
+ ++ optionals withGui [ qt5.qtbase qt5.qttools qrencode ];
+
+ configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
+ ++ optionals withGui [ "--with-gui=qt5" ];
+
+ meta = {
+ description = "Peer-to-peer electronic cash system (Cash client)";
+ longDescription= ''
+ Bitcoin ABC is the name of open source software which enables the use of Bitcoin.
+ It is designed to facilite a hard fork to increase Bitcoin's block size limit.
+ "ABC" stands for "Adjustable Blocksize Cap".
+
+ Bitcoin ABC is a fork of the Bitcoin Core software project.
+ '';
+ homepage = https://bitcoinabc.org/;
+ maintainers = with maintainers; [ lassulus ];
+ license = licenses.mit;
+ platforms = platforms.unix;
+ };
+}
diff --git a/pkgs/applications/altcoins/bitcoin.nix b/pkgs/applications/altcoins/bitcoin.nix
index d2083f4ecfb2..23c9ffe3a09c 100644
--- a/pkgs/applications/altcoins/bitcoin.nix
+++ b/pkgs/applications/altcoins/bitcoin.nix
@@ -5,13 +5,11 @@
with stdenv.lib;
stdenv.mkDerivation rec{
name = "bitcoin" + (toString (optional (!withGui) "d")) + "-" + version;
- version = "0.15.0";
+ version = "0.15.0.1";
src = fetchurl {
- urls = [ "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
- "mirror://sourceforge/bitcoin/Bitcoin/bitcoin-${version}/bitcoin-${version}.tar.gz"
- ];
- sha256 = "18gj5gdscarv2a1hdgjps50czwi4hrmrrmhssaag55ysh94zbdjl";
+ url = "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz";
+ sha256 = "16si3skhm6jhw1pkniv2b9y1kkdhjmhj392palphir0qc1srwzmm";
};
nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/applications/altcoins/default.nix b/pkgs/applications/altcoins/default.nix
index 2c97a3a53102..c604a9370a84 100644
--- a/pkgs/applications/altcoins/default.nix
+++ b/pkgs/applications/altcoins/default.nix
@@ -5,6 +5,9 @@ rec {
bitcoin = callPackage ./bitcoin.nix { withGui = true; };
bitcoind = callPackage ./bitcoin.nix { withGui = false; };
+ bitcoin-abc = callPackage ./bitcoin-abc.nix { withGui = true; };
+ bitcoind-abc = callPackage ./bitcoin-abc.nix { withGui = false; };
+
bitcoin-unlimited = callPackage ./bitcoin-unlimited.nix { withGui = true; };
bitcoind-unlimited = callPackage ./bitcoin-unlimited.nix { withGui = false; };
diff --git a/pkgs/applications/altcoins/fix-bitcoin-qt-build.patch b/pkgs/applications/altcoins/fix-bitcoin-qt-build.patch
new file mode 100644
index 000000000000..cbbfd85fe5bf
--- /dev/null
+++ b/pkgs/applications/altcoins/fix-bitcoin-qt-build.patch
@@ -0,0 +1,15 @@
+--- bitcoin-abc-v0.15.0-src/build-aux/m4/bitcoin_qt.m4 1970-01-01 01:00:01.000000000 +0100
++++ bitcoin-abc-v0.15.0-src.org/build-aux/m4/bitcoin_qt.m4 2017-09-27 23:38:44.748384197 +0100
+@@ -35,11 +35,7 @@
+ dnl Output: $1 is set to the path of $2 if found. $2 are searched in order.
+ AC_DEFUN([BITCOIN_QT_PATH_PROGS],[
+ BITCOIN_QT_CHECK([
+- if test "x$3" != "x"; then
+- AC_PATH_PROGS($1,$2,,$3)
+- else
+- AC_PATH_PROGS($1,$2)
+- fi
++ AC_PATH_PROGS($1,$2)
+ if test "x$$1" = "x" && test "x$4" != "xyes"; then
+ BITCOIN_QT_FAIL([$1 not found])
+ fi
diff --git a/pkgs/applications/audio/mp3info/default.nix b/pkgs/applications/audio/mp3info/default.nix
index 5f1d2bfa93d5..1a1ebc56a841 100644
--- a/pkgs/applications/audio/mp3info/default.nix
+++ b/pkgs/applications/audio/mp3info/default.nix
@@ -39,6 +39,6 @@ stdenv.mkDerivation rec {
license = stdenv.lib.licenses.gpl2Plus;
maintainers = [ ];
- platforms = stdenv.lib.platforms.unix;
+ platforms = stdenv.lib.platforms.linux;
};
}
diff --git a/pkgs/applications/audio/playbar2/default.nix b/pkgs/applications/audio/playbar2/default.nix
new file mode 100644
index 000000000000..16d5eb69cb97
--- /dev/null
+++ b/pkgs/applications/audio/playbar2/default.nix
@@ -0,0 +1,37 @@
+{ stdenv
+, cmake
+, extra-cmake-modules
+, plasma-framework
+, kwindowsystem
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+ name = "playbar2-${version}";
+ version = "2.5";
+
+ src = fetchFromGitHub {
+ owner = "audoban";
+ repo = "PlayBar2";
+ rev = "v${version}";
+ sha256 = "0iv2m4flgaz2r0k7f6l0ca8p6cw8j8j2gin1gci2pg3l5g5khbch";
+ };
+
+ nativeBuildInputs = [
+ cmake
+ extra-cmake-modules
+ ];
+
+ buildInputs = [
+ plasma-framework
+ kwindowsystem
+ ];
+
+ meta = with stdenv.lib; {
+ description = "Mpris2 Client for Plasma5";
+ homepage = https://github.com/audoban/PlayBar2;
+ license = licenses.gpl3;
+ platforms = platforms.linux;
+ maintainers = with maintainers; [ pjones ];
+ };
+}
diff --git a/pkgs/applications/editors/emacs/clean-env.patch b/pkgs/applications/editors/emacs/clean-env.patch
new file mode 100644
index 000000000000..f80efeeef706
--- /dev/null
+++ b/pkgs/applications/editors/emacs/clean-env.patch
@@ -0,0 +1,15 @@
+Dump temacs in an empty environment to prevent -dev paths from ending
+up in the dumped image.
+
+diff -ru -x '*~' emacs-25.3/src/Makefile.in emacs-25.3-new/src/Makefile.in
+--- emacs-25.3/src/Makefile.in 2017-04-14 17:02:47.000000000 +0200
++++ emacs-25.3-new/src/Makefile.in 2017-09-25 19:03:02.173861038 +0200
+@@ -532,7 +532,7 @@
+ ifeq ($(CANNOT_DUMP),yes)
+ ln -f temacs$(EXEEXT) $@
+ else
+- LC_ALL=C $(RUN_TEMACS) -batch -l loadup dump
++ env -i LC_ALL=C $(RUN_TEMACS) -batch -l loadup dump
+ ifneq ($(PAXCTL_dumped),)
+ $(PAXCTL_dumped) $@
+ endif
diff --git a/pkgs/applications/editors/emacs/default.nix b/pkgs/applications/editors/emacs/default.nix
index a00826b98214..af3298a5883e 100644
--- a/pkgs/applications/editors/emacs/default.nix
+++ b/pkgs/applications/editors/emacs/default.nix
@@ -34,7 +34,11 @@ stdenv.mkDerivation rec {
sha256 = "02y00y9q42g1iqgz5qhmsja75hwxd88yrn9zp14lanay0zkwafi5";
};
- patches = (lib.optional stdenv.isDarwin ./at-fdcwd.patch);
+ enableParallelBuilding = true;
+
+ patches =
+ [ ./clean-env.patch ]
+ ++ lib.optional stdenv.isDarwin ./at-fdcwd.patch;
nativeBuildInputs = [ pkgconfig ]
++ lib.optionals srcRepo [ autoconf automake texinfo ]
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index d7f71af65293..65721361cd6b 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -53,6 +53,9 @@ let
patchelf --set-interpreter $interp \
--set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc.lib zlib ]}:$lldbLibPath" \
bin/clang/clang-tidy
+
+ wrapProgram $out/bin/clion \
+ --set CL_JDK "${jdk}"
)
'';
});
@@ -229,15 +232,15 @@ in
datagrip = buildDataGrip rec {
name = "datagrip-${version}";
- version = "2017.1.5"; /* updated by script */
+ version = "2017.2.2"; /* updated by script */
description = "Your Swiss Army Knife for Databases and SQL";
license = stdenv.lib.licenses.unfree;
src = fetchurl {
url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
- sha256 = "8847c35761fcf6fc7a1d3f2bed0fa3971fbf28721c144f41d21feb473bb212dc"; /* updated by script */
+ sha256 = "1l8y65fw9g5ckzwpcgigm2qwy8fhpw2hil576rphsnx6qvnh4swn"; /* updated by script */
};
wmClass = "jetbrains-datagrip";
- update-channel = "datagrip_2017_1";
+ update-channel = "datagrip_2017_2";
};
gogland = buildGogland rec {
diff --git a/pkgs/applications/editors/jetbrains/update.pl b/pkgs/applications/editors/jetbrains/update.pl
index 0c551d994a94..a0479fc91125 100755
--- a/pkgs/applications/editors/jetbrains/update.pl
+++ b/pkgs/applications/editors/jetbrains/update.pl
@@ -27,46 +27,61 @@ sub get_latest_versions {
next unless $latest_build;
# version as in download url
+ my ($version) = $latest_build =~ /^]*version="([^"]+)"/;
+ my ($fullNumber) = $latest_build =~ /^]*fullNumber="([^"]+)"/;
+ my $latest_version_full1 = "$version-$fullNumber";
+ $latest_version_full1 =~ s/\s*EAP//;
+
my ($latest_version) = $latest_build =~ /^]*version="([^"]+)"/;
($latest_version) = $latest_build =~ /^]*fullNumber="([^"]+)"/ if $latest_version =~ / /;
$h{$id} = $latest_version;
+ $h{"full1_" . $id} = $latest_version_full1;
}
return %h;
}
my %latest_versions = get_latest_versions();
-#for my $ch (sort keys %latest_versions) {
+# for my $ch (sort keys %latest_versions) {
# print("$ch $latest_versions{$ch}\n");
-#}
+# }
sub update_nix_block {
my ($block) = @_;
my ($channel) = $block =~ /update-channel\s*=\s*"([^"]+)"/;
if ($channel) {
- die "unknown update-channel $channel" unless $latest_versions{$channel};
- my ($version) = $block =~ /version\s*=\s*"([^"]+)"/;
- die "no version in $block" unless $version;
- if ($version eq $latest_versions{$channel}) {
- print("$channel is up to date at $version\n");
+ if ($latest_versions{$channel}) {
+ my ($version) = $block =~ /version\s*=\s*"([^"]+)"/;
+ die "no version in $block" unless $version;
+ if ($version eq $latest_versions{$channel}) {
+ print("$channel is up to date at $version\n");
+ } else {
+ print("updating $channel: $version -> $latest_versions{$channel}\n");
+ my ($url) = $block =~ /url\s*=\s*"([^"]+)"/;
+ # try to interpret some nix
+ my ($name) = $block =~ /name\s*=\s*"([^"]+)"/;
+ $name =~ s/\$\{version\}/$latest_versions{$channel}/;
+ $url =~ s/\$\{name\}/$name/;
+ $url =~ s/\$\{version\}/$latest_versions{$channel}/;
+ die "$url still has some interpolation" if $url =~ /\$/;
+ my ($sha256) = get("$url.sha256") =~ /^([0-9a-f]{64})/;
+ my $version_string = $latest_versions{$channel};
+ unless ( $sha256 ) {
+ my $full_version = $latest_versions{"full1_" . $channel};
+ $url =~ s/$version_string/$full_version/;
+ ($sha256) = get("$url.sha256") =~ /^([0-9a-f]{64})/;
+ $version_string = $full_version;
+ }
+ die "invalid sha256 in $url.sha256" unless $sha256;
+ my ($sha256Base32) = readpipe("nix-hash --type sha256 --to-base32 $sha256");
+ chomp $sha256Base32;
+ print "Jetbrains published SHA256: $sha256\n";
+ print "Conversion into base32 yields: $sha256Base32\n";
+ $block =~ s#version\s*=\s*"([^"]+)".+$#version = "$version_string"; /* updated by script */#m;
+ $block =~ s#sha256\s*=\s*"([^"]+)".+$#sha256 = "$sha256Base32"; /* updated by script */#m;
+ }
} else {
- print("updating $channel: $version -> $latest_versions{$channel}\n");
- my ($url) = $block =~ /url\s*=\s*"([^"]+)"/;
- # try to interpret some nix
- my ($name) = $block =~ /name\s*=\s*"([^"]+)"/;
- $name =~ s/\$\{version\}/$latest_versions{$channel}/;
- $url =~ s/\$\{name\}/$name/;
- $url =~ s/\$\{version\}/$latest_versions{$channel}/;
- die "$url still has some interpolation" if $url =~ /\$/;
-
- my ($sha256) = get("$url.sha256") =~ /^([0-9a-f]{64})/;
- my ($sha256Base32) = readpipe("nix-hash --type sha256 --to-base32 $sha256");
- chomp $sha256Base32;
- print "Jetbrains published SHA256: $sha256\n";
- print "Conversion into base32 yeilds: $sha256Base32\n";
-
- $block =~ s#version\s*=\s*"([^"]+)".+$#version = "$latest_versions{$channel}"; /* updated by script */#m;
- $block =~ s#sha256\s*=\s*"([^"]+)".+$#sha256 = "$sha256Base32"; /* updated by script */#m;
+ warn "unknown update-channel $channel";
}
}
return $block;
diff --git a/pkgs/applications/editors/mg/default.nix b/pkgs/applications/editors/mg/default.nix
index b8bfd40c079b..f4bdee830e19 100644
--- a/pkgs/applications/editors/mg/default.nix
+++ b/pkgs/applications/editors/mg/default.nix
@@ -1,33 +1,30 @@
-{ fetchurl, stdenv, ncurses, pkgconfig, libbsd }:
+{ stdenv, fetchurl, pkgconfig, libbsd, ncurses }:
+
stdenv.mkDerivation rec {
name = "mg-${version}";
- version = "20161005";
+ version = "20170828";
src = fetchurl {
url = "http://homepage.boetes.org/software/mg/${name}.tar.gz";
- sha256 = "0qaydk2cy765n9clghmi5gdnpwn15y2v0fj6r0jcm0v7d89vbz5p";
+ sha256 = "139nc58l5ifj3d3478nhqls0lic52skmxfxggznzxaz9camqd20z";
};
- NIX_CFLAGS_COMPILE = "-Wno-error";
-
- preConfigure = ''
- substituteInPlace GNUmakefile \
- --replace /usr/bin/pkg-config ${pkgconfig}/bin/pkg-config
- '';
+ enableParallelBuilding = true;
+
+ makeFlags = [ "PKG_CONFIG=${pkgconfig}/bin/pkg-config" ];
installPhase = ''
- mkdir -p $out/bin
- cp mg $out/bin
- mkdir -p $out/share/man/man1
- cp mg.1 $out/share/man/man1
+ install -m 555 -Dt $out/bin mg
+ install -m 444 -Dt $out/share/man/man1 mg.1
'';
nativeBuildInputs = [ pkgconfig ];
- buildInputs = [ ncurses libbsd ];
+
+ buildInputs = [ libbsd ncurses ];
meta = with stdenv.lib; {
- homepage = http://homepage.boetes.org/software/mg/;
description = "Micro GNU/emacs, a portable version of the mg maintained by the OpenBSD team";
+ homepage = "https://homepage.boetes.org/software/mg";
license = licenses.publicDomain;
platforms = platforms.all;
};
diff --git a/pkgs/applications/editors/tecoc/default.nix b/pkgs/applications/editors/tecoc/default.nix
index a3f58012e534..1c5730838ff1 100644
--- a/pkgs/applications/editors/tecoc/default.nix
+++ b/pkgs/applications/editors/tecoc/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
'';
homepage = https://github.com/blakemcbride/TECOC;
maintainers = [ maintainers.AndersonTorres ];
- platforms = platforms.unix;
+ platforms = platforms.linux;
};
}
# TODO: test in other platforms - especially Darwin
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 1d661014c772..18e1df4575da 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
{ lib, fetchFromGitHub }:
rec {
- version = "8.0.0442";
+ version = "8.0.1150";
src = fetchFromGitHub {
owner = "vim";
repo = "vim";
rev = "v${version}";
- sha256 = "1pyyrkb7k5vhm1ijrh4v2f50lxhrgga5mm0gvmz4v704z0h585yg";
+ sha256 = "1k1qkmb2jbymqikrp99q1yjagdf508xzabrw7b08dlh926b2v23j";
};
enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index cd99861ea7b6..a70a67d548f5 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -14,8 +14,8 @@ let
else throw "ImageMagick is not supported on this platform.";
cfg = {
- version = "7.0.6-4";
- sha256 = "0fvkx9lf8g0sa9bccd9s5qyhcy0g1mqnkbpqly55ryxyg1ywxqaz";
+ version = "7.0.7-4";
+ sha256 = "074w4jm5s98b8dxwjl8lljvdhmm3mbg1ikgjy1mw3c1sb08z3nc8";
patches = [];
};
in
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 1cf08f286ef3..d01bfa1d9507 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -14,8 +14,8 @@ let
else throw "ImageMagick is not supported on this platform.";
cfg = {
- version = "6.9.9-7";
- sha256 = "1lwsz9b8clygdppgawv2hsry4aykgmawjlwhg3fj70rndv4a8rw4";
+ version = "6.9.9-15";
+ sha256 = "0bxgdc1qiyvag6a2iiqcbwp4ak0m1mzi9qhs51fbrvv6syy12m6c";
patches = [];
}
# Freeze version on mingw so we don't need to port the patch too often.
diff --git a/pkgs/applications/graphics/giv/build.patch b/pkgs/applications/graphics/giv/build.patch
index ec343c902386..f57689fd3fa9 100644
--- a/pkgs/applications/graphics/giv/build.patch
+++ b/pkgs/applications/graphics/giv/build.patch
@@ -2,16 +2,21 @@ Get the environment propagated to scons forked childs, and correct the dicom plu
a typedef of size_t that failed at least on x86_64-linux.
diff --git a/SConstruct b/SConstruct
-index 16eccd9..603e931 100644
+index 9e752d6..f93f27f 100644
--- a/SConstruct
+++ b/SConstruct
-@@ -7,8 +7,7 @@ else:
- cppflags = ['-O2']
- variant = 'Release'
+@@ -9,13 +9,7 @@ else:
+
+ commit_id = os.popen('git rev-parse HEAD').read().replace('\n','')
-env = Environment(LIBPATH=[],
-- CPPFLAGS = cppflags)
+- CPPFLAGS = cppflags + ['-Wno-deprecated-declarations',
+- '-Wno-reorder',
+- '-Wno-unused-but-set-variable',
+- '-Wno-unused-function'],
+- CXXFLAGS=['-std=c++1y']
+- )
+env = Environment(ENV = os.environ)
env['SBOX'] = False
-
+ env['COMMITIDSHORT'] = commit_id[0:6]
diff --git a/pkgs/applications/graphics/giv/default.nix b/pkgs/applications/graphics/giv/default.nix
index 6c892f1bfd4e..5c15c98e482b 100644
--- a/pkgs/applications/graphics/giv/default.nix
+++ b/pkgs/applications/graphics/giv/default.nix
@@ -2,13 +2,14 @@
pcre, cfitsio, perl, gob2, vala_0_23, libtiff, json_glib }:
stdenv.mkDerivation rec {
- name = "giv-20150811-git";
+ name = "giv-${version}";
+ version = "0.9.26";
src = fetchFromGitHub {
owner = "dov";
repo = "giv";
- rev = "64648bfbbf10ec4a9adfbc939c96c7d1dbdce57a";
- sha256 = "1sz2n7jbmg3g97bs613xxjpzqbsl5rvpg6v7g3x3ycyd35r8vsfp";
+ rev = "v${version}";
+ sha256 = "1sfm8j3hvqij6z3h8xz724d7hjqqbzljl2a6pp4yjpnnrxksnic2";
};
hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index 8736721b43d5..730f809eef40 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -1,40 +1,46 @@
-{ fetchurl, stdenv, cmake, qt4
-, hdf5
-, mpich2
-, python
-, libxml2
-, mesa, libXt
-}:
+{stdenv, fetchFromGitHub, cmake
+,full, python, mesa, libXt }:
stdenv.mkDerivation rec {
- name = "paraview-4.0.1";
- src = fetchurl {
- url = "http://paraview.org/files/v4.0/ParaView-v4.0.1-source.tgz";
- sha256 = "1qj8dq8gqpsw75sv4sdc7xm1xcpv0ilsddnrcfhha0zfhp0gq10y";
+ name = "paraview-${version}";
+ version = "5.4.0";
+
+ # fetching from GitHub instead of taking an "official" source
+ # tarball because of missing submodules there
+ src = fetchFromGitHub {
+ owner = "Kitware";
+ repo = "ParaView";
+ rev = "v${version}";
+ sha256 = "0h1vkgwm10mc5mnr3djp81lxr5pi0hyj776z77hiib6xm5596q9n";
+ fetchSubmodules = true;
};
- # [ 5%] Generating vtkGLSLShaderLibrary.h
- # ../../../bin/ProcessShader: error while loading shared libraries: libvtksys.so.pv3.10: cannot open shared object file: No such file or directory
- preConfigure = ''
- export NIX_LDFLAGS="$NIX_LDFLAGS -rpath $out/lib/paraview-3.98 -rpath ../../../../../../lib -rpath ../../../../../lib -rpath ../../../../lib -rpath ../../../lib -rpath ../../lib -rpath ../lib"
- '';
- cmakeFlags = [
- "-DPARAVIEW_USE_SYSTEM_HDF5:BOOL=ON"
- "-DVTK_USE_SYSTEM_LIBXML2:BOOL=ON"
- "-DPARAVIEW_ENABLE_PYTHON:BOOL=ON"
-# use -DPARAVIEW_INSTALL_THIRD_PARTY_LIBRARIES:BOOL=OFF \ to fix make install error: http://www.cmake.org/pipermail/paraview/2011-February/020268.html
- "-DPARAVIEW_INSTALL_THIRD_PARTY_LIBRARIES:BOOL=OFF"
- "-DCMAKE_SKIP_BUILD_RPATH=ON"
- "-DVTK_USE_RPATH:BOOL=ON"
- "-DPARAVIEW_INSTALL_DEVELOPMENT=ON"
- ];
+ cmakeFlags = [
+ "-DPARAVIEW_ENABLE_PYTHON=ON"
+ "-DPARAVIEW_INSTALL_DEVELOPMENT_FILES=ON"
+ ];
- # https://bugzilla.redhat.com/show_bug.cgi?id=1138466
- NIX_CFLAGS_COMPILE = "-DGLX_GLXEXT_LEGACY";
+ # During build, binaries are called that rely on freshly built
+ # libraries. These reside in build/lib, and are not found by
+ # default.
+ preBuild = ''
+ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
+ '';
enableParallelBuilding = true;
- buildInputs = [ cmake qt4 hdf5 mpich2 python libxml2 mesa libXt ];
+ buildInputs = [ cmake
+ python
+ mesa
+ libXt
+
+ # theoretically the following should be fine, but there is an error
+ # due to missing libqminimal when not using qt5.full
+
+ # qtbase qtx11extras qttools
+ full
+ ];
+
meta = {
homepage = http://www.paraview.org/;
diff --git a/pkgs/applications/graphics/pqiv/default.nix b/pkgs/applications/graphics/pqiv/default.nix
index 7e375367a2d2..202bbb5b13f4 100644
--- a/pkgs/applications/graphics/pqiv/default.nix
+++ b/pkgs/applications/graphics/pqiv/default.nix
@@ -21,6 +21,6 @@ stdenv.mkDerivation (rec {
homepage = http://www.pberndt.com/Programme/Linux/pqiv;
license = licenses.gpl3;
maintainers = [ maintainers.ndowens ];
- platforms = platforms.unix;
+ platforms = platforms.linux;
};
})
diff --git a/pkgs/applications/kde/default.nix b/pkgs/applications/kde/default.nix
index bbef7e9618b7..2053d183ff1d 100644
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@@ -145,6 +145,7 @@ let
okteta = callPackage ./okteta.nix {};
okular = callPackage ./okular.nix {};
pimcommon = callPackage ./pimcommon.nix {};
+ pim-data-exporter = callPackage ./pim-data-exporter.nix {};
pim-sieve-editor = callPackage ./pim-sieve-editor.nix {};
print-manager = callPackage ./print-manager.nix {};
spectacle = callPackage ./spectacle.nix {};
diff --git a/pkgs/applications/kde/dolphin-plugins.nix b/pkgs/applications/kde/dolphin-plugins.nix
index eb823641ae44..5580952f40a0 100644
--- a/pkgs/applications/kde/dolphin-plugins.nix
+++ b/pkgs/applications/kde/dolphin-plugins.nix
@@ -14,4 +14,5 @@ mkDerivation {
propagatedBuildInputs = [
dolphin kdelibs4support ki18n kio kxmlgui
];
+ outputs = [ "out" "dev" ];
}
diff --git a/pkgs/applications/kde/filelight.nix b/pkgs/applications/kde/filelight.nix
index 6eb219d8da96..a3be5be7f0a2 100644
--- a/pkgs/applications/kde/filelight.nix
+++ b/pkgs/applications/kde/filelight.nix
@@ -14,4 +14,5 @@ mkDerivation {
propagatedBuildInputs = [
kio kparts kxmlgui qtscript solid
];
+ outputs = [ "out" "dev" ];
}
diff --git a/pkgs/applications/kde/pim-data-exporter.nix b/pkgs/applications/kde/pim-data-exporter.nix
new file mode 100644
index 000000000000..10123944e3a6
--- /dev/null
+++ b/pkgs/applications/kde/pim-data-exporter.nix
@@ -0,0 +1,22 @@
+{
+ mkDerivation, lib, kdepimTeam,
+ extra-cmake-modules, kdoctools,
+ akonadi, kcmutils, kcrash, kdbusaddons, kidentitymanagement, kldap,
+ kmailtransport, knewstuff, knotifications, knotifyconfig, kparts, kross, ktexteditor,
+ kwallet, libkdepim, libkleo, pimcommon, qttools,
+ karchive, mailcommon, messagelib, pim-data-exporter
+}:
+
+mkDerivation {
+ name = "pim-data-exporter";
+ meta = {
+ license = with lib.licenses; [ gpl2 lgpl21 fdl12 ];
+ maintainers = kdepimTeam;
+ };
+ nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+ buildInputs = [
+ akonadi kcmutils kcrash kdbusaddons kidentitymanagement kldap kmailtransport
+ knewstuff knotifications knotifyconfig kparts kross ktexteditor kwallet libkdepim
+ libkleo pimcommon qttools karchive mailcommon messagelib
+ ];
+}
diff --git a/pkgs/applications/kde/print-manager.nix b/pkgs/applications/kde/print-manager.nix
index 085b53de0f39..8ace4562cbd7 100644
--- a/pkgs/applications/kde/print-manager.nix
+++ b/pkgs/applications/kde/print-manager.nix
@@ -19,4 +19,5 @@ mkDerivation {
kconfig kconfigwidgets kdbusaddons kiconthemes kcmutils knotifications
kwidgetsaddons kitemviews kio kwindowsystem plasma-framework qtdeclarative
];
+ outputs = [ "out" "dev" ];
}
diff --git a/pkgs/applications/misc/gnuradio/default.nix b/pkgs/applications/misc/gnuradio/default.nix
index e10cb30d1874..bd951c2a9a76 100644
--- a/pkgs/applications/misc/gnuradio/default.nix
+++ b/pkgs/applications/misc/gnuradio/default.nix
@@ -41,8 +41,14 @@ stdenv.mkDerivation rec {
enableParallelBuilding = true;
+ postPatch = ''
+ substituteInPlace \
+ gr-fec/include/gnuradio/fec/polar_decoder_common.h \
+ --replace BOOST_CONSTEXPR_OR_CONST const
+ '';
+
preConfigure = ''
- export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-unused-variable"
+ export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-unused-variable -std=c++11"
'';
# - Ensure we get an interactive backend for matplotlib. If not the gr_plot_*
diff --git a/pkgs/applications/misc/gpx-viewer/default.nix b/pkgs/applications/misc/gpx-viewer/default.nix
new file mode 100644
index 000000000000..a7485c4ee681
--- /dev/null
+++ b/pkgs/applications/misc/gpx-viewer/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchurl, intltool, pkgconfig, gnome3, shared_mime_info, desktop_file_utils, wrapGAppsHook }:
+
+stdenv.mkDerivation rec {
+ name = "gpx-viewer-${version}";
+ version = "0.4.0";
+
+ src = fetchurl {
+ url = "https://launchpad.net/gpx-viewer/trunk/${version}/+download/${name}.tar.gz";
+ sha256 = "956acfaf870ac436300cd9953dece630df7fd7dff8e4ae2577a6002884466f80";
+ };
+
+ patches = fetchurl {
+ url = "https://code.launchpad.net/~chkr/gpx-viewer/gtk3-bugfix/+merge/260766/+preview-diff/628965/+files/preview.diff";
+ sha256 = "1yl7jk7skkcx10nny5zdixswcymjd9s9c1zhm1i5y3aqhchvmfs7";
+ };
+ patchFlags = [ "-p0" ];
+
+ nativeBuildInputs = [
+ intltool pkgconfig
+ shared_mime_info # For update-mime-database
+ desktop_file_utils # For update-desktop-database
+ wrapGAppsHook # Fix error: GLib-GIO-ERROR **: No GSettings schemas are installed on the system
+ ];
+ buildInputs = with gnome3; [ gdl libchamplain defaultIconTheme ];
+
+ meta = with stdenv.lib; {
+ homepage = https://blog.sarine.nl/tag/gpxviewer/;
+ description = "Simple tool to visualize tracks and waypoints stored in a gpx file";
+ platforms = with platforms; linux;
+ license = licenses.gpl2Plus;
+ maintainers = with maintainers; [ dotlambda ];
+ };
+}
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index 6da16545aa71..00735624ad96 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -2,13 +2,13 @@
stdenv.mkDerivation rec {
name = "gpxsee-${version}";
- version = "4.9";
+ version = "4.14";
src = fetchFromGitHub {
owner = "tumic0";
repo = "GPXSee";
rev = version;
- sha256 = "0jk99yhrms1wzqpcnsjydcl2nysidv639s2j7l53yp60g0zz8174";
+ sha256 = "0yv3hcs5b8a88mp24h8r2sn69phwrahdff5pp74lz24270il3jgb";
};
nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/misc/latte-dock/default.nix b/pkgs/applications/misc/latte-dock/default.nix
index e013754e097e..2695ac1ef7d5 100644
--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@@ -1,7 +1,7 @@
{ mkDerivation, lib, cmake, xorg, plasma-framework, fetchFromGitHub
-, extra-cmake-modules, karchive, kwindowsystem, qtx11extras }:
+, extra-cmake-modules, karchive, kwindowsystem, qtx11extras, kcrash }:
-let version = "0.6.0"; in
+let version = "0.7.1"; in
mkDerivation {
name = "latte-dock-${version}";
@@ -10,13 +10,13 @@ mkDerivation {
owner = "psifidotos";
repo = "Latte-Dock";
rev = "v${version}";
- sha256 = "1967hx4lavy96vvik8d5m2c6ycd2mlf9cmhrv40zr0784ni0ikyv";
+ sha256 = "0vdmsjj1qqlzz26mznb56znv5x7akbvw65ybbzakclp4q1xrsrm2";
};
- buildInputs = [ plasma-framework xorg.libpthreadstubs xorg.libXdmcp ];
+ buildInputs = [ plasma-framework xorg.libpthreadstubs xorg.libXdmcp xorg.libSM ];
nativeBuildInputs = [ extra-cmake-modules cmake karchive kwindowsystem
- qtx11extras ];
+ qtx11extras kcrash ];
meta = with lib; {
description = "Dock-style app launcher based on Plasma frameworks";
diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index da5f3c3bf128..9fe275b490c1 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -1,6 +1,8 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig
-, zlib, freetype, libjpeg, jbig2dec, openjpeg
-, libX11, libXcursor, libXrandr, libXinerama, libXext, harfbuzz, mesa }:
+{ stdenv, lib, fetchurl, fetchpatch, pkgconfig
+, freetype, harfbuzz, openjpeg, jbig2dec
+, enableX11 ? true, libX11, libXext
+, enableCurl ? true, curl, openssl
+}:
stdenv.mkDerivation rec {
version = "1.11";
@@ -28,7 +30,9 @@ stdenv.mkDerivation rec {
makeFlags = [ "prefix=$(out)" ];
nativeBuildInputs = [ pkgconfig ];
- buildInputs = [ zlib libX11 libXcursor libXext harfbuzz mesa libXrandr libXinerama freetype libjpeg jbig2dec openjpeg ];
+ buildInputs = [ freetype harfbuzz openjpeg jbig2dec ]
+ ++ lib.optionals enableX11 [ libX11 libXext ]
+ ++ lib.optionals enableCurl [ curl openssl ];
outputs = [ "bin" "dev" "out" "man" "doc" ];
preConfigure = ''
diff --git a/pkgs/applications/misc/octoprint/m33-fio-one-library.patch b/pkgs/applications/misc/octoprint/m33-fio-one-library.patch
index 87b00f3ab705..24c9c4a80f5d 100644
--- a/pkgs/applications/misc/octoprint/m33-fio-one-library.patch
+++ b/pkgs/applications/misc/octoprint/m33-fio-one-library.patch
@@ -1,18 +1,18 @@
-From 0defcf6ec155899c414f66524b7df629f59327f0 Mon Sep 17 00:00:00 2001
+From 314bcebfcd1759981ce12255be29d8ae68cd400b Mon Sep 17 00:00:00 2001
From: Nikolay Amiantov
Date: Wed, 23 Nov 2016 00:40:48 +0300
Subject: [PATCH] Build and use one version of preprocessor library
---
- octoprint_m33fio/__init__.py | 67 ++----------------------------------------
- shared library source/Makefile | 62 +++-----------------------------------
- 2 files changed, 6 insertions(+), 123 deletions(-)
+ octoprint_m33fio/__init__.py | 73 ++----------------------------------------
+ shared library source/Makefile | 62 +++--------------------------------
+ 2 files changed, 6 insertions(+), 129 deletions(-)
diff --git a/octoprint_m33fio/__init__.py b/octoprint_m33fio/__init__.py
-index 4b43c59..d1259e4 100755
+index 054870a..4d5ecc1 100755
--- a/octoprint_m33fio/__init__.py
+++ b/octoprint_m33fio/__init__.py
-@@ -1062,71 +1062,8 @@ class M33FioPlugin(
+@@ -1189,78 +1189,9 @@ class M33FioPlugin(
# Check if using shared library or checking if it is usable
if self._settings.get_boolean(["UseSharedLibrary"]) or isUsable :
@@ -54,7 +54,9 @@ index 4b43c59..d1259e4 100755
-
- # Otherwise check if running on Windows and using an i386 or x86-64 device
- elif platform.uname()[0].startswith("Windows") and (platform.uname()[4].endswith("86") or platform.uname()[4].endswith("64")) :
--
++ # Set shared library
++ self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace('\\', '/') + "/static/libraries/libpreprocessor.so")
+
- # Check if Python is running as 32-bit
- if platform.architecture()[0].startswith("32") :
-
@@ -81,11 +83,16 @@ index 4b43c59..d1259e4 100755
-
- # Set shared library
- self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_x86-64.dylib")
-+ # Set shared library
-+ self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace('\\', '/') + "/static/libraries/libpreprocessor.so")
-
+-
+- # Otherwise check if running FreeBSD
+- elif platform.uname()[0].startswith("FreeBSD") :
+-
+- # TODO: Compile FreeBSD shared library pre-processors
+- pass
+-
# Check if shared library was set
if self.sharedLibrary :
+
diff --git a/shared library source/Makefile b/shared library source/Makefile
index 792b4f4..4c74f5c 100755
--- a/shared library source/Makefile
@@ -164,5 +171,5 @@ index 792b4f4..4c74f5c 100755
clean:
rm -f ../octoprint_m33fio/static/libraries/$(PROG)
--
-2.11.0
+2.14.1
diff --git a/pkgs/applications/misc/octoprint/plugins.nix b/pkgs/applications/misc/octoprint/plugins.nix
index c09e8d2f5e66..0a1d26012a80 100644
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@@ -12,13 +12,13 @@ let
m33-fio = buildPlugin rec {
name = "M33-Fio-${version}";
- version = "1.20";
+ version = "1.21";
src = fetchFromGitHub {
owner = "donovan6000";
repo = "M33-Fio";
rev = "V${version}";
- sha256 = "1ng7lzlkqsjcr1w7wgzwsqkkvcvpajcj2cwqlffh95916sw8n767";
+ sha256 = "1la3611kkqn8yiwjn6cizc45ri8pnk6ckld1na4nk6mqk88jvjq7";
};
patches = [
diff --git a/pkgs/applications/misc/stupidterm/default.nix b/pkgs/applications/misc/stupidterm/default.nix
new file mode 100644
index 000000000000..5701997fd299
--- /dev/null
+++ b/pkgs/applications/misc/stupidterm/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, pkgconfig, vte, gtk }:
+
+stdenv.mkDerivation rec {
+ name = "stupidterm-2017-03-15";
+
+ nativeBuildInputs = [ pkgconfig ];
+
+ buildInputs = [ vte gtk ];
+
+ src = fetchFromGitHub {
+ owner = "esmil";
+ repo = "stupidterm";
+ rev = "752316a783f52317ffd9f05d32e208dbcafc5ba6";
+ sha256 = "1d8fyhr9sgpxgkwzkyiws0kvhmqfwwyycvcr1qf2wjldiax222lv";
+ };
+
+ makeFlags = "PKGCONFIG=${pkgconfig}/bin/pkg-config binary=stupidterm";
+
+ installPhase = ''
+ mkdir -p $out/bin $out/share/applications $out/share/stupidterm
+ cp stupidterm $out/bin
+ substituteAll ${./stupidterm.desktop} $out/share/applications/stupidterm.desktop
+ substituteAll stupidterm.ini $out/share/stupidterm/stupidterm.ini
+ '';
+
+ meta = with stdenv.lib; {
+ description = "Simple wrapper around the VTE terminal emulator widget for GTK+";
+ longDescription = ''
+ Simple wrapper around the VTE terminal emulator widget for GTK+
+ '';
+ homepage = https://github.com/esmil/stupidterm;
+ license = licenses.lgpl3Plus;
+ maintainers = [ maintainers.etu ];
+ platforms = platforms.linux;
+ };
+}
diff --git a/pkgs/applications/misc/stupidterm/stupidterm.desktop b/pkgs/applications/misc/stupidterm/stupidterm.desktop
new file mode 100644
index 000000000000..c26d46060183
--- /dev/null
+++ b/pkgs/applications/misc/stupidterm/stupidterm.desktop
@@ -0,0 +1,9 @@
+[Desktop Entry]
+Version=20170315
+Name=stupidterm
+Comment=VTE based terminal emulator
+Exec=stupidterm
+Icon=utilities-terminal
+Terminal=false
+Type=Application
+Categories=System;TerminalEmulator;
diff --git a/pkgs/applications/misc/termite/default.nix b/pkgs/applications/misc/termite/default.nix
index 837d736d10dd..cf99304473c1 100644
--- a/pkgs/applications/misc/termite/default.nix
+++ b/pkgs/applications/misc/termite/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchgit, pkgconfig, vte, gtk3, ncurses, makeWrapper, symlinkJoin
+{ stdenv, fetchgit, pkgconfig, vte, gtk3, ncurses, makeWrapper, wrapGAppsHook, symlinkJoin
, configFile ? null
}:
-let
+let
version = "12";
termite = stdenv.mkDerivation {
name = "termite-${version}";
@@ -17,7 +17,9 @@ let
makeFlags = [ "VERSION=v${version}" "PREFIX=" "DESTDIR=$(out)" ];
- buildInputs = [ pkgconfig vte gtk3 ncurses ];
+ buildInputs = [ vte gtk3 ncurses ];
+
+ nativeBuildInputs = [ wrapGAppsHook pkgconfig ];
outputs = [ "out" "terminfo" ];
diff --git a/pkgs/applications/misc/topydo/default.nix b/pkgs/applications/misc/topydo/default.nix
new file mode 100644
index 000000000000..34952b9c0f4d
--- /dev/null
+++ b/pkgs/applications/misc/topydo/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, python3Packages, fetchFromGitHub, glibcLocales }:
+
+with python3Packages;
+
+buildPythonApplication rec {
+ pname = "topydo";
+ version = "0.13";
+ name = "${pname}-${version}";
+
+ src = fetchFromGitHub {
+ owner = "bram85";
+ repo = pname;
+ rev = version;
+ sha256 = "0b3dz137lpbvpjvfy42ibqvj3yk526x4bpn819fd11lagn77w69r";
+ };
+
+ propagatedBuildInputs = [
+ arrow
+ icalendar
+ glibcLocales
+ prompt_toolkit
+ urwid
+ watchdog
+ ];
+
+ checkInputs = [ mock freezegun coverage green pylint ];
+
+ LC_ALL="en_US.UTF-8";
+
+ meta = with stdenv.lib; {
+ description = "A cli todo application compatible with the todo.txt format";
+ homepage = "https://github.com/bram85/topydo";
+ license = licenses.gpl3;
+ };
+}
diff --git a/pkgs/applications/misc/xpad/default.nix b/pkgs/applications/misc/xpad/default.nix
new file mode 100644
index 000000000000..01df5d32ab1a
--- /dev/null
+++ b/pkgs/applications/misc/xpad/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchurl
+, autoreconfHook, pkgconfig, wrapGAppsHook
+, glib, intltool, gtk3, gtksourceview }:
+
+stdenv.mkDerivation rec {
+ name = "xpad-${version}";
+ version = "5.0.0";
+
+ src = fetchurl {
+ url = "https://launchpad.net/xpad/trunk/${version}/+download/xpad-${version}.tar.bz2";
+ sha256 = "02yikxg6z9bwla09ka001ppjlpbv5kbza3za9asazm5aiz376mkb";
+ };
+
+ nativeBuildInputs = [ autoreconfHook pkgconfig wrapGAppsHook ];
+
+ buildInputs = [ glib intltool gtk3 gtksourceview ];
+
+ autoreconfPhase = ''
+ ./autogen.sh
+ '';
+
+ meta = with stdenv.lib; {
+ description = "A sticky note application for jotting down things to remember";
+ homepage = https://launchpad.net/xpad;
+ license = licenses.gpl3;
+ platforms = platforms.linux;
+ maintainers = with maintainers; [ michalrus ];
+ };
+}
diff --git a/pkgs/applications/networking/browsers/firefox/no-buildconfig.patch b/pkgs/applications/networking/browsers/firefox/no-buildconfig.patch
new file mode 100644
index 000000000000..83f9a1329bea
--- /dev/null
+++ b/pkgs/applications/networking/browsers/firefox/no-buildconfig.patch
@@ -0,0 +1,25 @@
+diff -ru -x '*~' firefox-55.0.3-orig/docshell/base/nsAboutRedirector.cpp firefox-55.0.3/docshell/base/nsAboutRedirector.cpp
+--- firefox-55.0.3-orig/docshell/base/nsAboutRedirector.cpp 2017-07-31 18:20:51.000000000 +0200
++++ firefox-55.0.3/docshell/base/nsAboutRedirector.cpp 2017-09-26 22:02:00.814151731 +0200
+@@ -40,10 +40,6 @@
+ nsIAboutModule::ALLOW_SCRIPT
+ },
+ {
+- "buildconfig", "chrome://global/content/buildconfig.html",
+- nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT
+- },
+- {
+ "checkerboard", "chrome://global/content/aboutCheckerboard.xhtml",
+ nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
+ nsIAboutModule::ALLOW_SCRIPT
+diff -ru -x '*~' firefox-55.0.3-orig/toolkit/content/jar.mn firefox-55.0.3/toolkit/content/jar.mn
+--- firefox-55.0.3-orig/toolkit/content/jar.mn 2017-07-31 18:20:52.000000000 +0200
++++ firefox-55.0.3/toolkit/content/jar.mn 2017-09-26 22:01:42.383350314 +0200
+@@ -40,7 +40,6 @@
+ content/global/plugins.css
+ content/global/browser-child.js
+ content/global/browser-content.js
+-* content/global/buildconfig.html
+ content/global/contentAreaUtils.js
+ #ifndef MOZ_FENNEC
+ content/global/customizeToolbar.css
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 83eb563a8e7e..e2a8e201fef7 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -12,10 +12,12 @@ rec {
sha512 = "3cacc87b97871f3a8c5e97c17ef7025079cb5c81f32377d9402cdad45815ac6c4c4762c79187f1e477910161c2377c42d41de62a50b6741d5d7c1cd70e8c6416";
};
- patches = lib.optional stdenv.isi686 (fetchpatch {
- url = "https://hg.mozilla.org/mozilla-central/raw-rev/15517c5a5d37";
- sha256 = "1ba487p3hk4w2w7qqfxgv1y57vp86b8g3xhav2j20qd3j3phbbn7";
- });
+ patches =
+ [ ./no-buildconfig.patch ]
+ ++ lib.optional stdenv.isi686 (fetchpatch {
+ url = "https://hg.mozilla.org/mozilla-central/raw-rev/15517c5a5d37";
+ sha256 = "1ba487p3hk4w2w7qqfxgv1y57vp86b8g3xhav2j20qd3j3phbbn7";
+ });
meta = {
description = "A web browser built from Firefox source tree";
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 1dd5c9191f00..2413f1cfdca8 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -129,6 +129,8 @@ in stdenv.mkDerivation {
passthru = { unwrapped = browser; };
+ disallowedRequisites = [ stdenv.cc ];
+
meta = browser.meta // {
description =
browser.meta.description
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index b91b789a22b9..29a73beeec8f 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -23,10 +23,11 @@
, pango
, audioSupport ? mediaSupport
-, pulseaudioSupport ? audioSupport
+, pulseaudioSupport ? false
, libpulseaudio
+, apulse
-# Media support (implies pulseaudio support)
+# Media support (implies audio support)
, mediaSupport ? false
, gstreamer
, gst-plugins-base
@@ -44,6 +45,10 @@
, hicolor_icon_theme
, shared_mime_info
+# Whether to disable multiprocess support to work around crashing tabs
+# TODO: fix the underlying problem instead of this terrible work-around
+, disableContentSandbox ? true
+
# Extra preferences
, extraPrefs ? ""
}:
@@ -154,6 +159,11 @@ stdenv.mkDerivation rec {
# and torLibPath for accuracy, but this is more convenient ...
libPath=${libPath}:$TBB_IN_STORE:$TBB_IN_STORE/TorBrowser/Tor
+ # apulse uses a non-standard library path. For now special-case it.
+ ${optionalString (audioSupport && !pulseaudioSupport) ''
+ libPath=${apulse}/lib/apulse:$libPath
+ ''}
+
# Fixup paths to pluggable transports.
sed -i TorBrowser/Data/Tor/torrc-defaults \
-e "s,./TorBrowser,$TBB_IN_STORE/TorBrowser,g"
@@ -210,6 +220,17 @@ stdenv.mkDerivation rec {
lockPref("extensions.torlauncher.control_port_use_ipc", true);
lockPref("extensions.torlauncher.socks_port_use_ipc", true);
+ // Optionally disable multiprocess support. We always set this to ensure that
+ // toggling the pref takes effect.
+ lockPref("browser.tabs.remote.autostart.2", ${if disableContentSandbox then "false" else "true"});
+
+ // Allow sandbox access to sound devices if using ALSA directly
+ ${if (audioSupport && !pulseaudioSupport) then ''
+ pref("security.sandbox.content.write_path_whitelist", "/dev/snd/");
+ '' else ''
+ clearPref("security.sandbox.content.write_path_whitelist");
+ ''}
+
${optionalString (extraPrefs != "") ''
${extraPrefs}
''}
@@ -328,6 +349,8 @@ stdenv.mkDerivation rec {
PULSE_SERVER="\''${PULSE_SERVER:-}" \
PULSE_COOKIE="\''${PULSE_COOKIE:-}" \
\
+ APULSE_PLAYBACK_DEVICE="\''${APULSE_PLAYBACK_DEVICE:-plug:dmix}" \
+ \
TOR_SKIP_LAUNCH="\''${TOR_SKIP_LAUNCH:-}" \
TOR_CONTROL_PORT="\''${TOR_CONTROL_PORT:-}" \
TOR_SOCKS_PORT="\''${TOR_SOCKS_PORT:-}" \
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
new file mode 100644
index 000000000000..16182c8e4e71
--- /dev/null
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle/default.nix
@@ -0,0 +1,254 @@
+{ stdenv
+, lib
+, fetchurl
+, fetchgit
+, symlinkJoin
+
+, tor
+, tor-browser-unwrapped
+
+# Wrapper runtime
+, coreutils
+, hicolor_icon_theme
+, shared_mime_info
+, noto-fonts
+, noto-fonts-emoji
+
+# Extensions, common
+, zip
+
+# HTTPS Everywhere
+, git
+, libxml2 # xmllint
+, python27
+, python27Packages
+, rsync
+
+# Customization
+, extraPrefs ? ""
+, extraExtensions ? [ ]
+}:
+
+let
+ tor-browser-build_src = fetchgit {
+ url = "https://git.torproject.org/builders/tor-browser-build.git";
+ rev = "refs/tags/tbb-7.5a5-build5";
+ sha256 = "0j37mqldj33fnzghxifvy6v8vdwkcz0i4z81prww64md5s8qcsa9";
+ };
+
+ firefoxExtensions = import ./extensions.nix {
+ inherit stdenv fetchurl fetchgit zip
+ git libxml2 python27 python27Packages rsync;
+ };
+
+ extensionsEnv = symlinkJoin {
+ name = "tor-browser-extensions";
+ paths = with firefoxExtensions; [
+ https-everywhere
+ noscript
+ torbutton
+ tor-launcher
+ ] ++ extraExtensions;
+ };
+
+ fontsEnv = symlinkJoin {
+ name = "tor-browser-fonts";
+ paths = [ noto-fonts noto-fonts-emoji ];
+ };
+
+ fontsDir = "${fontsEnv}/share/fonts";
+in
+stdenv.mkDerivation rec {
+ name = "tor-browser-bundle-${version}";
+ version = tor-browser-unwrapped.version;
+
+ buildInputs = [ tor-browser-unwrapped tor ];
+
+ unpackPhase = ":";
+
+ buildPhase = ":";
+
+ installPhase = ''
+ TBBUILD=${tor-browser-build_src}/projects/tor-browser
+ TBDATA_PATH=TorBrowser-Data
+
+ self=$out/lib/tor-browser
+ mkdir -p $self && cd $self
+
+ TBDATA_IN_STORE=$self/$TBDATA_PATH
+
+ cp -dR ${tor-browser-unwrapped}/lib"/"*"/"* .
+ chmod -R +w .
+
+ # Prepare for autoconfig
+ cat >defaults/pref/autoconfig.js <mozilla.cfg <> $TBDATA_PATH/torrc-defaults
+ cat \
+ $bundleData/$bundlePlatform/Data/Browser/profile.default/preferences/extension-overrides.js \
+ >> defaults/pref/extension-overrides.js
+
+ # Hard-code path to TBB fonts; xref: FONTCONFIG_FILE in the wrapper below
+ sed $bundleData/$bundlePlatform/Data/fontconfig/fonts.conf \
+ -e "s,fonts,${fontsDir}," \
+ > $TBDATA_PATH/fonts.conf
+
+ # Generate a suitable wrapper
+ wrapper_PATH=${lib.makeBinPath [ coreutils ]}
+ wrapper_XDG_DATA_DIRS=${lib.concatMapStringsSep ":" (x: "${x}/share") [
+ hicolor_icon_theme
+ shared_mime_info
+ ]}
+
+ mkdir -p $out/bin
+ cat >$out/bin/tor-browser <&2
+ exit 1
+ fi
+
+ mkdir -p "\$TBB_HOME"
+
+ HOME=\$TBB_HOME
+ cd "\$HOME"
+
+ # Re-init XDG basedir envvars
+ XDG_CACHE_HOME=\$HOME/.cache
+ XDG_CONFIG_HOME=\$HOME/.config
+ XDG_DATA_HOME=\$HOME/.local/share
+
+ # Initialize empty TBB runtime state directory hierarchy. Mirror the
+ # layout used by the official TBB, to avoid the hassle of working
+ # against the assumptions made by tor-launcher & co.
+ mkdir -p "\$HOME/TorBrowser" "\$HOME/TorBrowser/Data"
+
+ # Initialize the Tor data directory.
+ mkdir -p "\$HOME/TorBrowser/Data/Tor"
+
+ # TBB fails if ownership is too permissive
+ chmod 0700 "\$HOME/TorBrowser/Data/Tor"
+
+ # Initialize the browser profile state. Expect TBB to generate all data.
+ mkdir -p "\$HOME/TorBrowser/Data/Browser/profile.default"
+
+ # Files that capture store paths; re-generated by firefox at startup
+ rm -rf "\$HOME/TorBrowser/Data/Browser/profile.default"/{compatibility.ini,extensions.ini,extensions.json,startupCache}
+
+ # Clear out fontconfig caches
+ rm -f "\$HOME/.cache/fontconfig/"*.cache-*
+
+ # Lift-off!
+ #
+ # TZ is set to avoid stat()ing /etc/localtime over and over ...
+ #
+ # DBUS_SESSION_BUS_ADDRESS is inherited to avoid auto-launching a new
+ # dbus instance; to prevent using the session bus, set the envvar to
+ # an empty/invalid value prior to running tor-browser.
+ #
+ # FONTCONFIG_FILE is required to make fontconfig read the TBB
+ # fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024
+ # indicates the system fonts.conf being used instead.
+ #
+ # HOME, TMPDIR, XDG_*_HOME are set as a form of soft confinement;
+ # ideally, tor-browser should not write to any path outside TBB_HOME
+ # and should run even under strict confinement to TBB_HOME.
+ #
+ # XDG_DATA_DIRS is set to prevent searching system directories for
+ # mime and icon data.
+ #
+ # Parameters lacking a default value below are *required* (enforced by
+ # -o nounset).
+ exec env -i \
+ TZ=":" \
+ \
+ DISPLAY="\$DISPLAY" \
+ XAUTHORITY="\$XAUTHORITY" \
+ DBUS_SESSION_BUS_ADDRESS="\$DBUS_SESSION_BUS_ADDRESS" \
+ \
+ HOME="\$HOME" \
+ TMPDIR="\$XDG_CACHE_HOME/tmp" \
+ XDG_CONFIG_HOME="\$XDG_CONFIG_HOME" \
+ XDG_DATA_HOME="\$XDG_DATA_HOME" \
+ XDG_CACHE_HOME="\$XDG_CACHE_HOME" \
+ \
+ XDG_DATA_DIRS="$wrapper_XDG_DATA_DIRS" \
+ \
+ FONTCONFIG_FILE="$TBDATA_IN_STORE/fonts.conf" \
+ \
+ $self/firefox \
+ -no-remote \
+ -profile "\$HOME/TorBrowser/Data/Browser/profile.default" \
+ "\$@"
+ EOF
+ chmod +x $out/bin/tor-browser
+
+ echo "Syntax checking wrapper ..."
+ bash -n $out/bin/tor-browser
+
+ echo "Checking wrapper ..."
+ DISPLAY="" XAUTHORITY="" DBUS_SESSION_BUS_ADDRESS="" TBB_HOME=$TMPDIR/tbb \
+ $out/bin/tor-browser -version >/dev/null
+ '';
+
+ meta = with stdenv.lib; {
+ description = "An unofficial version of the tor browser bundle, built from source";
+ homepage = https://torproject.org/;
+ license = licenses.unfreeRedistributable; # TODO: check this
+ platforms = [ "x86_64-linux" ];
+ hydraPlatforms = [ ];
+ maintainers = with maintainers; [ joachifm ];
+ };
+}
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle/extensions.nix b/pkgs/applications/networking/browsers/tor-browser-bundle/extensions.nix
new file mode 100644
index 000000000000..4adf99365ba3
--- /dev/null
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle/extensions.nix
@@ -0,0 +1,122 @@
+{ stdenv
+, fetchgit
+, fetchurl
+
+# common
+, zip
+
+# HTTPS Everywhere
+, git
+, libxml2 # xmllint
+, python27
+, python27Packages
+, rsync
+}:
+
+{
+ https-everywhere = stdenv.mkDerivation rec {
+ name = "https-everywhere-${version}";
+ version = "5.2.21";
+
+ extid = "https-everywhere-eff@eff.org";
+
+ src = fetchgit {
+ url = "https://git.torproject.org/https-everywhere.git";
+ rev = "refs/tags/${version}";
+ sha256 = "0z9madihh4b4z4blvfmh6w1hsv8afyi0x7b243nciq9r4w55xgfa";
+ };
+
+ nativeBuildInputs = [
+ git
+ libxml2 # xmllint
+ python27
+ python27Packages.lxml
+ rsync
+ zip
+ ];
+
+ unpackPhase = ''
+ cp -dR --no-preserve=mode "$src" src && cd src
+ '';
+
+ buildPhase = ''
+ $shell ./makexpi.sh ${version} --no-recurse
+ '';
+
+ installPhase = ''
+ install -m 444 -D pkg/https-everywhere-$version-eff.xpi "$out/$extid.xpi"
+ '';
+ };
+
+ noscript = stdenv.mkDerivation rec {
+ name = "noscript-${version}";
+ version = "5.0.10";
+
+ extid = "{73a6fe31-595d-460b-a920-fcc0f8843232}";
+
+ src = fetchurl {
+ url = "https://secure.informaction.com/download/releases/noscript-${version}.xpi";
+ sha256 = "18k5karbaj5mhd9cyjbqgik6044bw88rjalkh6anjanxbn503j6g";
+ };
+
+ unpackPhase = ":";
+
+ installPhase = ''
+ install -m 444 -D $src "$out/$extid.xpi"
+ '';
+ };
+
+ torbutton = stdenv.mkDerivation rec {
+ name = "torbutton-${version}";
+ version = "1.9.8.1";
+
+ extid = "torbutton@torproject.org";
+
+ src = fetchgit {
+ url = "https://git.torproject.org/torbutton.git";
+ rev = "refs/tags/${version}";
+ sha256 = "1amp0c9ky0a7fsa0bcbi6n6ginw7s2g3an4rj7kvc1lxmrcsm65l";
+ };
+
+ nativeBuildInputs = [ zip ];
+
+ unpackPhase = ''
+ cp -dR --no-preserve=mode "$src" src && cd src
+ '';
+
+ buildPhase = ''
+ $shell ./makexpi.sh
+ '';
+
+ installPhase = ''
+ install -m 444 -D pkg/torbutton-$version.xpi "$out/$extid.xpi"
+ '';
+ };
+
+ tor-launcher = stdenv.mkDerivation rec {
+ name = "tor-launcher-${version}";
+ version = "0.2.12.3";
+
+ extid = "tor-launcher@torproject.org";
+
+ src = fetchgit {
+ url = "https://git.torproject.org/tor-launcher.git";
+ rev = "refs/tags/${version}";
+ sha256 = "0126x48pjiy2zm4l8jzhk70w24hviaz560ffp4lb9x0ar615bc9q";
+ };
+
+ nativeBuildInputs = [ zip ];
+
+ unpackPhase = ''
+ cp -dR --no-preserve=mode "$src" src && cd src
+ '';
+
+ buildPhase = ''
+ make package
+ '';
+
+ installPhase = ''
+ install -m 444 -D pkg/tor-launcher-$version.xpi "$out/$extid.xpi"
+ '';
+ };
+}
diff --git a/pkgs/applications/networking/cluster/cni/default.nix b/pkgs/applications/networking/cluster/cni/default.nix
index bdff04cb0738..a7205f1bc7af 100644
--- a/pkgs/applications/networking/cluster/cni/default.nix
+++ b/pkgs/applications/networking/cluster/cni/default.nix
@@ -2,13 +2,13 @@
stdenv.mkDerivation rec {
name = "cni-${version}";
- version = "0.3.0";
+ version = "0.5.2";
src = fetchFromGitHub {
owner = "containernetworking";
repo = "cni";
rev = "v${version}";
- sha256 = "1nvixvf5slnsdrfpfs2km64x680wf83jbyp7il12bcim37q2az7m";
+ sha256 = "0n2sc5xf1h0i54am80kj7imrvawddn0kxvgi65w0194dpmyrg5al";
};
buildInputs = [ go ];
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
outputs = ["out" "plugins"];
buildPhase = ''
- patchShebangs build
- ./build
+ patchShebangs build.sh
+ ./build.sh
'';
installPhase = ''
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index 0ac872c35c90..6767a0bd7240 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -4,10 +4,10 @@ let
then "linux-amd64"
else "darwin-amd64";
checksum = if stdenv.isLinux
- then "1hkr5s1c72sqf156lk6gsnbfs75jnpqs42f64a7mz046c06kv98f"
- else "00xw0c66x58g915989fc72mwliysxi5glrkdafi3gcfmlhrnc68i";
+ then "1i22givr52kgr76dd2azcg9avgh70wiw5dcpmmyychms2ynxi42y"
+ else "0phhy3si86ilc6051zfgn8jnniy5lygf1r2gysjpcyfbrc5pw3hj";
pname = "helm";
- version = "2.5.1";
+ version = "2.6.1";
in
stdenv.mkDerivation {
name = "${pname}-${version}";
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index 69fe6a1730aa..e76d3cf5d08c 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -8,9 +8,9 @@
"cmd/kube-controller-manager"
"cmd/kube-proxy"
"plugin/cmd/kube-scheduler"
- "cmd/kube-dns"
"federation/cmd/federation-apiserver"
"federation/cmd/federation-controller-manager"
+ "test/e2e/e2e.test"
]
}:
@@ -18,13 +18,13 @@ with lib;
stdenv.mkDerivation rec {
name = "kubernetes-${version}";
- version = "1.5.6";
+ version = "1.7.1";
src = fetchFromGitHub {
owner = "kubernetes";
repo = "kubernetes";
rev = "v${version}";
- sha256 = "0mkg4vgz9szgq1k5ignkdr5gmg703xlq8zsrr422a1qfqb8zp15w";
+ sha256 = "1frf2nxk45lsbkq73fj72gxgr76icqdrsdqh20f5gpwiqn23n7c3";
};
buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
@@ -55,6 +55,10 @@ stdenv.mkDerivation rec {
cp build/pause/pause "$pause/bin/pause"
cp -R docs/man/man1 "$man/share/man"
+ cp cluster/addons/addon-manager/kube-addons.sh $out/bin/kube-addons
+ patchShebangs $out/bin/kube-addons
+ wrapProgram $out/bin/kube-addons --set "KUBECTL_BIN" "$out/bin/kubectl"
+
$out/bin/kubectl completion bash > $out/share/bash-completion/completions/kubectl
'';
diff --git a/pkgs/applications/networking/cluster/mesos/default.nix b/pkgs/applications/networking/cluster/mesos/default.nix
index 0506f7c154d2..712b1376845b 100644
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, lib, makeWrapper, fetchurl, curl, sasl, openssh, autoconf
-, automake, libtool, unzip, gnutar, jdk, maven, python, wrapPython
+{ stdenv, lib, makeWrapper, fetchurl, curl, sasl, openssh
+, unzip, gnutar, jdk, python, wrapPython
, setuptools, boto, pythonProtobuf, apr, subversion, gzip, systemd
, leveldb, glog, perf, utillinux, libnl, iproute, openssl, libevent
-, ethtool, coreutils, which, iptables
-, bash
+, ethtool, coreutils, which, iptables, maven
+, bash, autoreconfHook
}:
let
@@ -21,7 +21,7 @@ let
});
in stdenv.mkDerivation rec {
- version = "1.1.1";
+ version = "1.4.0";
name = "mesos-${version}";
enableParallelBuilding = true;
@@ -29,7 +29,7 @@ in stdenv.mkDerivation rec {
src = fetchurl {
url = "mirror://apache/mesos/${version}/${name}.tar.gz";
- sha256 = "0f46ebb130d2d4a9732f95d0a71d80c8c5967f3c172b110f2ece316e05922115";
+ sha256 = "0c08kd226nrjwm2z2drpq4vi97h9r8b1xkdvkgh1114fxg7cyvys";
};
patches = [
@@ -40,11 +40,13 @@ in stdenv.mkDerivation rec {
# see https://github.com/cstrahan/mesos/tree/nixos-${version}
./nixos.patch
];
-
+ nativeBuildInputs = [
+ autoreconfHook
+ ];
buildInputs = [
- makeWrapper autoconf automake libtool curl sasl jdk maven
+ makeWrapper curl sasl jdk
python wrapPython boto setuptools leveldb
- subversion apr glog openssl libevent
+ subversion apr glog openssl libevent maven
] ++ lib.optionals stdenv.isLinux [
libnl
];
@@ -52,10 +54,6 @@ in stdenv.mkDerivation rec {
propagatedBuildInputs = [
pythonProtobuf
];
-
- # note that we *must* statically link libprotobuf.
- # if we dynamically link the lib, we get these errors:
- # https://github.com/NixOS/nixpkgs/pull/19064#issuecomment-255082684
preConfigure = ''
# https://issues.apache.org/jira/browse/MESOS-6616
configureFlagsArray+=(
@@ -66,13 +64,10 @@ in stdenv.mkDerivation rec {
# instead of
sed 1i'#include ' -i src/linux/fs.cpp
sed 1i'#include ' -i src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
-
substituteInPlace 3rdparty/stout/include/stout/os/posix/chown.hpp \
--subst-var-by chown ${coreutils}/bin/chown
substituteInPlace 3rdparty/stout/Makefile.am \
- --replace "-lprotobuf" \
- "${pythonProtobuf.protobuf}/lib/libprotobuf.so"
substituteInPlace 3rdparty/stout/include/stout/os/posix/fork.hpp \
--subst-var-by sh ${bash}/bin/bash
@@ -99,8 +94,6 @@ in stdenv.mkDerivation rec {
--subst-var-by mesos-resolve $out/bin/mesos-resolve
substituteInPlace src/python/native_common/ext_modules.py.in \
- --replace "-lprotobuf" \
- "${pythonProtobuf.protobuf}/lib/libprotobuf.so"
substituteInPlace src/slave/containerizer/mesos/isolators/gpu/volume.cpp \
--subst-var-by cp ${coreutils}/bin/cp \
@@ -124,8 +117,6 @@ in stdenv.mkDerivation rec {
substituteInPlace src/Makefile.am \
--subst-var-by mavenRepo ${mavenRepo} \
- --replace "-lprotobuf" \
- "${pythonProtobuf.protobuf}/lib/libprotobuf.so"
'' + lib.optionalString stdenv.isLinux ''
@@ -179,7 +170,7 @@ in stdenv.mkDerivation rec {
"--enable-libevent"
"--with-libevent=${libevent.dev}"
"--with-protobuf=${pythonProtobuf.protobuf}"
- "PROTOBUF_JAR=${mavenRepo}/com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.jar"
+ "PROTOBUF_JAR=${mavenRepo}/com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.jar"
] ++ lib.optionals stdenv.isLinux [
"--with-network-isolator"
"--with-nl=${libnl.dev}"
diff --git a/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh b/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh
index f4a4588dbe41..cf7318ecb273 100644
--- a/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh
+++ b/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh
@@ -1127,10 +1127,12 @@ fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.pom
fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.pom.sha1
fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.jar
fetchArtifact org/vafer/jdependency/0.7/jdependency-0.7.jar.sha1
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.pom
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.pom.sha1
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.jar
-fetchArtifact com/google/protobuf/protobuf-java/2.6.1/protobuf-java-2.6.1.jar.sha1
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.pom
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.pom.sha1
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.jar
+fetchArtifact com/google/protobuf/protobuf-java/3.3.0/protobuf-java-3.3.0.jar.sha1
+fetchArtifact com/google/protobuf/protobuf-parent/3.3.0/protobuf-parent-3.3.0.pom
+fetchArtifact com/google/protobuf/protobuf-parent/3.3.0/protobuf-parent-3.3.0.pom.sha1
fetchArtifact com/google/google/1/google-1.pom
fetchArtifact com/google/google/1/google-1.pom.sha1
fetchArtifact com/google/guava/guava/11.0.2/guava-11.0.2.pom
diff --git a/pkgs/applications/networking/cluster/mesos/mesos-deps.nix b/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
index 1edb4a755d89..642c660edb69 100644
--- a/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
+++ b/pkgs/applications/networking/cluster/mesos/mesos-deps.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
outputHashAlgo = "sha256";
outputHashMode = "recursive";
- outputHash = "066ikswavq3l37x1s3pfdncyj77pvpa0kj14ax5dqb9njmsg0s11";
+ outputHash = "10h0qs7svw0cqjkyxs8z6s3qraa8ga920zfrr59rdlanbwg4klly";
buildInputs = [ curl ];
diff --git a/pkgs/applications/networking/cluster/mesos/nixos.patch b/pkgs/applications/networking/cluster/mesos/nixos.patch
index 78e374b8d6bc..a6fea024b087 100644
--- a/pkgs/applications/networking/cluster/mesos/nixos.patch
+++ b/pkgs/applications/networking/cluster/mesos/nixos.patch
@@ -1,20 +1,7 @@
-diff --git a/3rdparty/stout/include/stout/os/posix/chown.hpp b/3rdparty/stout/include/stout/os/posix/chown.hpp
-index c82e2e574..15d332107 100644
---- a/3rdparty/stout/include/stout/os/posix/chown.hpp
-+++ b/3rdparty/stout/include/stout/os/posix/chown.hpp
-@@ -34,7 +34,7 @@ inline Try chown(
- // TODO(bmahler): Consider walking the file tree instead. We would need
- // to be careful to not miss dotfiles.
- std::string command =
-- "chown -R " + stringify(uid) + ':' + stringify(gid) + " '" + path + "'";
-+ "@chown@ -R " + stringify(uid) + ':' + stringify(gid) + " '" + path + "'";
-
- int status = os::system(command);
- if (status != 0) {
-diff --git a/3rdparty/stout/include/stout/os/posix/fork.hpp b/3rdparty/stout/include/stout/os/posix/fork.hpp
-index a29967dcb..290b98b50 100644
---- a/3rdparty/stout/include/stout/os/posix/fork.hpp
-+++ b/3rdparty/stout/include/stout/os/posix/fork.hpp
+diff --git i/3rdparty/stout/include/stout/os/posix/fork.hpp w/3rdparty/stout/include/stout/os/posix/fork.hpp
+index a29967d..290b98b 100644
+--- i/3rdparty/stout/include/stout/os/posix/fork.hpp
++++ w/3rdparty/stout/include/stout/os/posix/fork.hpp
@@ -369,7 +369,7 @@ private:
if (exec.isSome()) {
// Execute the command (via '/bin/sh -c command').
@@ -24,11 +11,11 @@ index a29967dcb..290b98b50 100644
EXIT(EXIT_FAILURE)
<< "Failed to execute '" << command << "': " << os::strerror(errno);
} else if (wait.isSome()) {
-diff --git a/3rdparty/stout/include/stout/posix/os.hpp b/3rdparty/stout/include/stout/posix/os.hpp
-index c37e64db6..d3d87b7f0 100644
---- a/3rdparty/stout/include/stout/posix/os.hpp
-+++ b/3rdparty/stout/include/stout/posix/os.hpp
-@@ -375,7 +375,7 @@ inline Option getenv(const std::string& key)
+diff --git i/3rdparty/stout/include/stout/posix/os.hpp w/3rdparty/stout/include/stout/posix/os.hpp
+index 8511dfd..1e7be01 100644
+--- i/3rdparty/stout/include/stout/posix/os.hpp
++++ w/3rdparty/stout/include/stout/posix/os.hpp
+@@ -366,7 +366,7 @@ inline Try> pids(Option group, Option session)
inline Try tar(const std::string& path, const std::string& archive)
{
Try tarOut =
@@ -37,11 +24,11 @@ index c37e64db6..d3d87b7f0 100644
if (tarOut.isError()) {
return Error("Failed to archive " + path + ": " + tarOut.error());
-diff --git a/src/Makefile.am b/src/Makefile.am
-index 3bcc0f2df..e5cbc57e8 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -1545,7 +1545,7 @@ if HAS_JAVA
+diff --git i/src/Makefile.am w/src/Makefile.am
+index 68fff14..c572f92 100644
+--- i/src/Makefile.am
++++ w/src/Makefile.am
+@@ -1775,7 +1775,7 @@ if HAS_JAVA
$(MESOS_JAR): $(MESOS_JAR_SOURCE) $(MESOS_JAR_GENERATED) java/mesos.pom
@echo "Building mesos-$(PACKAGE_VERSION).jar ..."
@@ -50,10 +37,10 @@ index 3bcc0f2df..e5cbc57e8 100644
# Convenience library for JNI bindings.
# TODO(Charles Reiss): We really should be building the Java library
-diff --git a/src/cli/mesos-scp b/src/cli/mesos-scp
-index a71ab0708..1043d1b3c 100755
---- a/src/cli/mesos-scp
-+++ b/src/cli/mesos-scp
+diff --git i/src/cli/mesos-scp w/src/cli/mesos-scp
+index a71ab07..1043d1b 100755
+--- i/src/cli/mesos-scp
++++ w/src/cli/mesos-scp
@@ -19,7 +19,8 @@ if sys.version_info < (2,6,0):
@@ -64,11 +51,11 @@ index a71ab0708..1043d1b3c 100755
try:
process = subprocess.Popen(
cmd,
-diff --git a/src/common/command_utils.cpp b/src/common/command_utils.cpp
-index 09e805140..90bf65896 100644
---- a/src/common/command_utils.cpp
-+++ b/src/common/command_utils.cpp
-@@ -140,7 +140,7 @@ Future tar(
+diff --git i/src/common/command_utils.cpp w/src/common/command_utils.cpp
+index c50be76..388cc53 100644
+--- i/src/common/command_utils.cpp
++++ w/src/common/command_utils.cpp
+@@ -142,7 +142,7 @@ Future tar(
argv.emplace_back(input);
@@ -77,7 +64,7 @@ index 09e805140..90bf65896 100644
.then([]() { return Nothing(); });
}
-@@ -162,7 +162,7 @@ Future untar(
+@@ -164,7 +164,7 @@ Future untar(
argv.emplace_back(directory.get());
}
@@ -86,7 +73,7 @@ index 09e805140..90bf65896 100644
.then([]() { return Nothing(); });
}
-@@ -170,7 +170,7 @@ Future untar(
+@@ -172,7 +172,7 @@ Future untar(
Future sha512(const Path& input)
{
#ifdef __linux__
@@ -95,7 +82,7 @@ index 09e805140..90bf65896 100644
vector argv = {
cmd,
input // Input file to compute shasum.
-@@ -206,7 +206,7 @@ Future gzip(const Path& input)
+@@ -208,7 +208,7 @@ Future gzip(const Path& input)
input
};
@@ -104,7 +91,7 @@ index 09e805140..90bf65896 100644
.then([]() { return Nothing(); });
}
-@@ -219,7 +219,7 @@ Future decompress(const Path& input)
+@@ -221,7 +221,7 @@ Future decompress(const Path& input)
input
};
@@ -113,41 +100,45 @@ index 09e805140..90bf65896 100644
.then([]() { return Nothing(); });
}
-diff --git a/src/launcher/fetcher.cpp b/src/launcher/fetcher.cpp
-index 4456c2813..e22c8fc03 100644
---- a/src/launcher/fetcher.cpp
-+++ b/src/launcher/fetcher.cpp
-@@ -68,13 +68,13 @@ static Try extract(
+diff --git i/src/launcher/fetcher.cpp w/src/launcher/fetcher.cpp
+index 42980f5..3aebeed 100644
+--- i/src/launcher/fetcher.cpp
++++ w/src/launcher/fetcher.cpp
+@@ -80,17 +80,17 @@ static Try extract(
strings::endsWith(sourcePath, ".tar.bz2") ||
strings::endsWith(sourcePath, ".txz") ||
strings::endsWith(sourcePath, ".tar.xz")) {
-- command = "tar -C '" + destinationDirectory + "' -xf";
-+ command = "@tar@ -C '" + destinationDirectory + "' -xf";
+- command = {"tar", "-C", destinationDirectory, "-xf", sourcePath};
++ command = {"@tar@", "-C", destinationDirectory, "-xf", sourcePath};
} else if (strings::endsWith(sourcePath, ".gz")) {
string pathWithoutExtension = sourcePath.substr(0, sourcePath.length() - 3);
string filename = Path(pathWithoutExtension).basename();
-- command = "gzip -dc > '" + destinationDirectory + "/" + filename + "' <";
-+ command = "@gzip@ -dc > '" + destinationDirectory + "/" + filename + "' <";
+ string destinationPath = path::join(destinationDirectory, filename);
+
+- command = {"gunzip", "-d", "-c"};
++ command = {"@gunzip@", "-d", "-c"};
+ in = Subprocess::PATH(sourcePath);
+ out = Subprocess::PATH(destinationPath);
} else if (strings::endsWith(sourcePath, ".zip")) {
-- command = "unzip -o -d '" + destinationDirectory + "'";
-+ command = "@unzip@ -o -d '" + destinationDirectory + "'";
+- command = {"unzip", "-o", "-d", destinationDirectory, sourcePath};
++ command = {"@unzip@", "-o", "-d", destinationDirectory, sourcePath};
} else {
return false;
}
-@@ -162,7 +162,7 @@ static Try copyFile(
+@@ -193,7 +193,7 @@ static Try copyFile(
const string& sourcePath,
const string& destinationPath)
{
-- const string command = "cp '" + sourcePath + "' '" + destinationPath + "'";
-+ const string command = "@cp@ '" + sourcePath + "' '" + destinationPath + "'";
+- int status = os::spawn("cp", {"cp", sourcePath, destinationPath});
++ int status = os::spawn("cp", {"@cp@", sourcePath, destinationPath});
- LOG(INFO) << "Copying resource with command:" << command;
-
-diff --git a/src/linux/perf.cpp b/src/linux/perf.cpp
-index aa31982eb..8b5331b17 100644
---- a/src/linux/perf.cpp
-+++ b/src/linux/perf.cpp
-@@ -127,7 +127,7 @@ private:
+ if (status == -1) {
+ return ErrnoError("Failed to copy '" + sourcePath + "'");
+diff --git i/src/linux/perf.cpp w/src/linux/perf.cpp
+index b301e25..356a2cf 100644
+--- i/src/linux/perf.cpp
++++ w/src/linux/perf.cpp
+@@ -128,7 +128,7 @@ private:
// NOTE: The supervisor childhook places perf in its own process group
// and will kill the perf process when the parent dies.
Try _perf = subprocess(
@@ -156,19 +147,10 @@ index aa31982eb..8b5331b17 100644
argv,
Subprocess::PIPE(),
Subprocess::PIPE(),
-@@ -319,7 +319,7 @@ bool valid(const set& events)
- ostringstream command;
-
- // Log everything to stderr which is then redirected to /dev/null.
-- command << "perf stat --log-fd 2";
-+ command << "@perf@ stat --log-fd 2";
- foreach (const string& event, events) {
- command << " --event " << event;
- }
-diff --git a/src/linux/systemd.cpp b/src/linux/systemd.cpp
-index 6318f48fc..394d88d47 100644
---- a/src/linux/systemd.cpp
-+++ b/src/linux/systemd.cpp
+diff --git i/src/linux/systemd.cpp w/src/linux/systemd.cpp
+index 6318f48..394d88d 100644
+--- i/src/linux/systemd.cpp
++++ w/src/linux/systemd.cpp
@@ -196,13 +196,21 @@ bool exists()
// This is static as the init system should not change while we are running.
static const bool exists = []() -> bool {
@@ -209,10 +191,10 @@ index 6318f48fc..394d88d47 100644
Try daemonReload = os::shell("systemctl daemon-reload");
if (daemonReload.isError()) {
return Error("Failed to reload systemd daemon: " + daemonReload.error());
-diff --git a/src/python/cli/src/mesos/cli.py b/src/python/cli/src/mesos/cli.py
-index f342992e0..354abf443 100644
---- a/src/python/cli/src/mesos/cli.py
-+++ b/src/python/cli/src/mesos/cli.py
+diff --git i/src/python/cli/src/mesos/cli.py w/src/python/cli/src/mesos/cli.py
+index 4a9b558..c08a8b9 100644
+--- i/src/python/cli/src/mesos/cli.py
++++ w/src/python/cli/src/mesos/cli.py
@@ -40,7 +40,7 @@ def resolve(master):
import subprocess
@@ -222,10 +204,10 @@ index f342992e0..354abf443 100644
stdin=None,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
-diff --git a/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp b/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
-index af9f3736b..f8554d414 100644
---- a/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
-+++ b/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
+diff --git i/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp w/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
+index 5b630c1..d63ad69 100644
+--- i/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
++++ w/src/slave/containerizer/mesos/isolators/docker/volume/isolator.cpp
@@ -499,7 +499,7 @@ Future