gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge c0874d923d into haskell-updates

Browse Source
This commit is contained in:
nixpkgs-ci[bot]
2025-06-28 00:23:08 +00:00
committed by GitHub
parent 278781962d c0874d923d
commit 2357040aaf
750 changed files with 15477 additions and 5376 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/labeler.yml
+1
View File
@@ -586,6 +586,7 @@
- any:
- changed-files:
- any-glob-to-any-file:
- doc/release-notes/**/*
- nixos/doc/manual/release-notes/**/*
"8.has: maintainer-list (update)":
.github/workflows/backport.yml
+1 -1
View File
@@ -50,7 +50,7 @@ jobs:
- name: Create backport PRs
id: backport
uses: korthout/backport-action@436145e922f9561fc5ea157ff406f21af2d6b363 # v3.2.0
uses: korthout/backport-action@0193454f0c5947491d348f33a275c119f30eb736 # v3.2.1
with:
# Config README: https://github.com/korthout/backport-action#backport-action
copy_labels_pattern: 'severity:\ssecurity'
.github/workflows/labels.yml
+3 -3
View File
@@ -65,6 +65,7 @@ jobs:
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
github-token: ${{ steps.app-token.outputs.token || github.token }}
retries: 3
script: |
const Bottleneck = require('bottleneck')
const path = require('node:path')
@@ -147,8 +148,6 @@ jobs:
...context.repo,
workflow_id: 'pr.yml',
event: 'pull_request_target',
// In pull_request contexts the workflow is still running.
status: context.payload.pull_request ? undefined : 'success',
exclude_pull_requests: true,
head_sha: pull_request.head.sha
})).data.workflow_runs[0]?.id ??
@@ -247,6 +246,7 @@ jobs:
.sort((a,b) => b-a)
.at(0) ?? item.created_at
)
log('latest_event_at', latest_event_at.toISOString())
const stale_at = new Date(new Date().setDate(new Date().getDate() - 180))
@@ -390,7 +390,7 @@ jobs:
// so it should certainly be hit on the next iteration.
// TODO: Evaluate after a while, whether the above holds still true and potentially implement
// an overlap between runs.
page: total_runs % Math.ceil(total_pulls / 100)
page: (total_runs % Math.ceil(total_pulls / 100)) + 1
})).data
// Some items might be in both search results, so filtering out duplicates as well.
README.md
+2 -2
View File
@@ -52,9 +52,9 @@ Nixpkgs and NixOS are built and tested by our continuous integration
system, [Hydra](https://hydra.nixos.org/).
* [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
* [Continuous package builds for the NixOS 24.11 release](https://hydra.nixos.org/jobset/nixos/release-24.11)
* [Continuous package builds for the NixOS 25.05 release](https://hydra.nixos.org/jobset/nixos/release-25.05)
* [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
* [Tests for the NixOS 24.11 release](https://hydra.nixos.org/job/nixos/release-24.11/tested#tabs-constituents)
* [Tests for the NixOS 25.05 release](https://hydra.nixos.org/job/nixos/release-25.05/tested#tabs-constituents)
Artifacts successfully built with Hydra are published to cache at
https://cache.nixos.org/. When successful build and test criteria are
ci/check-cherry-picks.sh
+3 -1
View File
@@ -66,9 +66,11 @@ while read -r new_commit_sha ; do
git rev-list --max-count=1 --format=medium "$new_commit_sha"
echo "-------------------------------------------------"
# Using the last line with "cherry" + hash, because a chained backport
# can result in multiple of those lines. Only the last one counts.
original_commit_sha=$(
git rev-list --max-count=1 --format=format:%B "$new_commit_sha" \
| grep -Ei -m1 "cherry.*[0-9a-f]{40}" \
| grep -Ei "cherry.*[0-9a-f]{40}" | tail -n1 \
| grep -Eoi -m1 '[0-9a-f]{40}' || true
)
if [ -z "$original_commit_sha" ] ; then
doc/languages-frameworks/beam.section.md
+3 -3
View File
@@ -259,13 +259,13 @@ in
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
"postgresql.service"
"postgresql.target"
];
# note that if you are connecting to a postgres instance on a different host
# postgresql.service should not be included in the requires.
# postgresql.target should not be included in the requires.
requires = [
"network-online.target"
"postgresql.service"
"postgresql.target"
];
description = "my app";
environment = {
maintainers/maintainer-list.nix
+41 -85
View File
@@ -211,12 +211,6 @@
github = "365tuwe";
githubId = 10263091;
};
_3699n = {
email = "nicholas@nvk.pm";
github = "3699n";
githubId = 7414843;
name = "Nicholas von Klitzing";
};
_3JlOy-PYCCKUi = {
name = "3JlOy-PYCCKUi";
email = "3jl0y_pycckui@riseup.net";
@@ -241,14 +235,6 @@
githubId = 1714287;
name = "Owen Shepherd";
};
_4825764518 = {
email = "4825764518@purelymail.com";
matrix = "@kenzie:matrix.kenzi.dev";
github = "4825764518";
githubId = 100122841;
name = "Kenzie";
keys = [ { fingerprint = "D292 365E 3C46 A5AA 75EE B30B 78DB 7EDE 3540 794B"; } ];
};
_4ever2 = {
email = "eske@cs.au.dk";
github = "4ever2";
@@ -5311,13 +5297,6 @@
name = "Carl Richard Theodor Schneider";
keys = [ { fingerprint = "2017 E152 BB81 5C16 955C E612 45BC C1E2 709B 1788"; } ];
};
cryo = {
email = "cryo@disroot.org";
github = "cry0ice";
githubId = 176274027;
name = "Cryo";
keys = [ { fingerprint = "2CF7 F8E8 2258 5751 2591 F97F 4B12 E34A 25A9 AB35"; } ];
};
Cryolitia = {
name = "Cryolitia PukNgae";
email = "Cryolitia@gmail.com";
@@ -5411,12 +5390,6 @@
keys = [ { fingerprint = "BBED 1B08 8CED 7F95 8917 FBE8 5004 F0FA D051 576D"; } ];
};
cyewashish = {
name = "Cyewashish";
email = "wawashish@cyekaivy.dev";
github = "cyewashish";
githubId = 180875322;
};
cynerd = {
name = "Karel Kočí";
email = "cynerd@email.cz";
@@ -8187,6 +8160,16 @@
githubId = 26925347;
keys = [ { fingerprint = "0797 D238 9769 CA1E 57B7 2ED9 2BA7 8116 87C9 0DE4"; } ];
};
felipe-9 = {
name = "Felipe Pinto";
email = "felipealexandrepinto@icloud.com";
github = "Felipe-9";
githubId = 32753781;
keys = [
{ fingerprint = "1533 0D57 3312 0936 AB38 3C9B 7D36 1E4B 83CD AEFB"; }
{ fingerprint = "2BD0 AD01 F91D A0DC 47DF 0AEE 7AA1 649F 6B71 42F2"; }
];
};
felipeqq2 = {
name = "Felipe Silva";
email = "nixpkgs@felipeqq2.rocks";
@@ -10842,14 +10825,6 @@
name = "Silvan Mosberger";
keys = [ { fingerprint = "6C2B 55D4 4E04 8266 6B7D DA1A 422E 9EDA E015 7170"; } ];
};
infinitivewitch = {
name = "Infinitive Witch";
email = "infinitivewitch@disroot.org";
matrix = "@infinitivewitch:fedora.im";
github = "infinitivewitch";
githubId = 128256833;
keys = [ { fingerprint = "CF3D F4AD C7BD 1FDB A88B E4B3 CA2D 43DA 939D 94FB"; } ];
};
ingenieroariel = {
email = "ariel@nunez.co";
github = "ingenieroariel";
@@ -11385,6 +11360,17 @@
githubId = 6789916;
name = "Jason Odoom";
};
jaspersurmont = {
email = "jasper@surmont.dev";
github = "jaspersurmont";
githubId = 28810440;
name = "Jasper Surmont";
keys = [
{
fingerprint = "D70D 66E3 3D82 C3F8 0F31 BE15 D213 BED5 67B1 9AF5";
}
];
};
javaes = {
email = "jan+dev@vanesdonk.de";
github = "javaes";
@@ -12652,6 +12638,12 @@
github = "juliadin";
githubId = 7837969;
};
juliamertz = {
email = "info@juliamertz.nl";
name = "Julia Mertz";
github = "juliamertz";
githubId = 35079666;
};
JulianFP = {
name = "Julian Partanen";
github = "JulianFP";
@@ -12778,6 +12770,7 @@
github = "jwiegley";
githubId = 8460;
name = "John Wiegley";
keys = [ { fingerprint = "4710 CF98 AF9B 327B B80F 60E1 46C4 BD1A 7AC1 4BA2"; } ];
};
jwijenbergh = {
email = "jeroenwijenbergh@protonmail.com";
@@ -13128,12 +13121,6 @@
githubId = 59027018;
name = "Andrey Khorokhorin";
};
kho-dialga = {
email = "ivandashenyou@gmail.com";
github = "Kho-Dialga";
githubId = 55767703;
name = "Iván Brito";
};
khumba = {
email = "bog@khumba.net";
github = "khumba";
@@ -14278,12 +14265,6 @@
name = "Liassica";
keys = [ { fingerprint = "83BE 3033 6164 B971 FA82 7036 0D34 0E59 4980 7BDD"; } ];
};
liberatys = {
email = "liberatys@hey.com";
name = "Nick Anthony Flueckiger";
github = "liberatys";
githubId = 35100156;
};
liberodark = {
email = "liberodark@gmail.com";
github = "liberodark";
@@ -14973,12 +14954,6 @@
githubId = 208297;
name = "Luz";
};
lw = {
email = "lw@fmap.me";
github = "lolwat97";
githubId = 2057309;
name = "Sergey Sofeychuk";
};
lx = {
email = "alex@adnab.me";
github = "Alexis211";
@@ -16626,12 +16601,6 @@
githubId = 24192522;
name = "MithicSpirit";
};
mjanczyk = {
email = "m@dragonvr.pl";
github = "mjanczyk";
githubId = 1001112;
name = "Marcin Janczyk";
};
mjm = {
email = "matt@mattmoriarity.com";
github = "mjm";
@@ -17596,12 +17565,6 @@
githubId = 137805;
name = "Alexander Tsvyashchenko";
};
ne9z = {
email = "yuchen@apvc.uk";
github = "ne9z";
githubId = 77314501;
name = "Maurice Zhou";
};
nealfennimore = {
email = "hi@neal.codes";
github = "nealfennimore";
@@ -19511,12 +19474,6 @@
github = "petee";
githubId = 89916;
};
petercommand = {
email = "petercommand@gmail.com";
github = "ptrcmd";
githubId = 1260660;
name = "petercommand";
};
peterhoeg = {
email = "peter@hoeg.com";
matrix = "@peter:hoeg.com";
@@ -20805,6 +20762,13 @@
github = "DaRacci";
githubId = 90304606;
};
RadxaYuntian = {
# This is the work account for @MakiseKurisu
name = "ZHANG Yuntian";
email = "yt@radxa.com";
github = "RadxaYuntian";
githubId = 95260730;
};
raehik = {
email = "thefirstmuffinman@gmail.com";
github = "raehik";
@@ -23600,14 +23564,6 @@
github = "SnO2WMaN";
githubId = 15155608;
};
snowflake = {
email = "snowflake@pissmail.com";
name = "Snowflake";
github = "snf1k";
githubId = 149651684;
matrix = "@snowflake:mozilla.org";
keys = [ { fingerprint = "8223 7B6F 2FF4 8F16 B652 6CA3 934F 9E5F 9701 2C0B"; } ];
};
snpschaaf = {
email = "philipe.schaaf@secunet.com";
name = "Philippe Schaaf";
@@ -25969,6 +25925,12 @@
github = "TyberiusPrime";
githubId = 1257580;
};
tye-exe = {
name = "Tye";
email = "nixpkgs-fr@tye-home.xyz";
github = "tye-exe";
githubId = 131195812;
};
Tygo-van-den-Hurk = {
name = "Tygo van den Hurk";
github = "Tygo-van-den-Hurk";
@@ -26364,12 +26326,6 @@
github = "vdot0x23";
githubId = 40716069;
};
vector1dev = {
name = "vector1dev";
matrix = "@vector1dev:vector1.dev";
github = "vector1dev";
githubId = 127302590;
};
vedantmgoyal9 = {
name = "Vedant Mohan Goyal";
matrix = "@vedantmgoyal:beeper.com";
nixos/doc/manual/redirects.json
+5 -13
View File
@@ -1316,22 +1316,14 @@
"module-services-postgres-initializing-extra-permissions": [
"index.html#module-services-postgres-initializing-extra-permissions"
],
"module-services-postgres-initializing-extra-permissions-superuser": [
"index.html#module-services-postgres-initializing-extra-permissions-superuser"
],
"module-services-postgres-initializing-extra-permissions-superuser-post-start": [
"index.html#module-services-postgres-initializing-extra-permissions-superuser-post-start"
],
"module-services-postgres-initializing-extra-permissions-superuser-oneshot": [
"index.html#module-services-postgres-initializing-extra-permissions-superuser-oneshot"
],
"module-services-postgres-initializing-extra-permissions-service-user": [
"index.html#module-services-postgres-initializing-extra-permissions-superuser-post-start",
"index.html#module-services-postgres-initializing-extra-permissions-superuser",
"index.html#module-services-postgres-initializing-extra-permissions-service-user-pre-start",
"index.html#module-services-postgres-initializing-extra-permissions-service-user"
],
"module-services-postgres-initializing-extra-permissions-service-user-pre-start": [
"index.html#module-services-postgres-initializing-extra-permissions-service-user-pre-start"
],
"module-services-postgres-initializing-extra-permissions-service-user-oneshot": [
"module-services-postgres-initializing-extra-permissions-superuser-oneshot": [
"index.html#module-services-postgres-initializing-extra-permissions-superuser-oneshot",
"index.html#module-services-postgres-initializing-extra-permissions-service-user-oneshot"
],
"module-services-postgres-authentication": [
nixos/doc/manual/release-notes/rl-2511.section.md
+4
View File
@@ -64,8 +64,12 @@
- The `yeahwm` package and `services.xserver.windowManager.yeahwm` module were removed due to the package being broken and unmaintained upstream.
- The `services.postgresql` module now sets up a systemd unit `postgresql.target`. Depending on `postgresql.target` guarantees that postgres is in read-write mode and initial/ensure scripts were executed. Depending on `postgresql.service` only guarantees a read-only connection.
- The `services.siproxd` module has been removed as `siproxd` is unmaintained and broken with libosip 5.x.
- `netbox-manage` script created by the `netbox` module no longer uses `sudo -u netbox` internally. It can be run as root and will change it's user to `netbox` using `runuser`
- `services.dwm-status.extraConfig` was replaced by [RFC0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant [](#opt-services.dwm-status.settings), which is used to generate the config file. `services.dwm-status.order` is now moved to [](#opt-services.dwm-status.settings.order), as it's a part of the config file.
- `gitversion` was updated to 6.3.0, which includes a number of breaking changes, old configurations may need updating or they will cause the tool to fail to run.
nixos/modules/image/repart-image.nix
+1
View File
@@ -189,6 +189,7 @@ stdenvNoCC.mkDerivation (
dontUnpack = true;
dontConfigure = true;
dontFixup = true;
doCheck = false;
patchPhase = ''
nixos/modules/module-list.nix
+1
View File
@@ -1197,6 +1197,7 @@
./services/networking/lambdabot.nix
./services/networking/legit.nix
./services/networking/libreswan.nix
./services/networking/livekit-ingress.nix
./services/networking/livekit.nix
./services/networking/lldpd.nix
./services/networking/logmein-hamachi.nix
nixos/modules/programs/neovim.nix
+4 -1
View File
@@ -73,7 +73,10 @@ in
example = lib.literalExpression ''
{
customRC = '''
" here your custom configuration goes!
" here your custom VimScript configuration goes!
''';
customLuaRC = '''
-- here your custom Lua configuration goes!
''';
packages.myVimPackage = with pkgs.vimPlugins; {
# loaded on launch
nixos/modules/services/admin/pgadmin.nix
+1 -1
View File
@@ -182,7 +182,7 @@ in
requires = [ "network.target" ];
# we're adding this optionally so just in case there's any race it'll be caught
# in case postgres doesn't start, pgadmin will just start normally
wants = [ "postgresql.service" ];
wants = [ "postgresql.target" ];
path = [
config.services.postgresql.package
nixos/modules/services/backup/bacula.nix
+1 -1
View File
@@ -720,7 +720,7 @@ in
systemd.services.bacula-dir = mkIf dir_cfg.enable {
after = [
"network.target"
"postgresql.service"
"postgresql.target"
];
description = "Bacula Director Daemon";
wantedBy = [ "multi-user.target" ];
nixos/modules/services/backup/postgresql-backup.nix
+1 -1
View File
@@ -35,7 +35,7 @@ let
description = "Backup of ${db} database(s)";
requires = [ "postgresql.service" ];
requires = [ "postgresql.target" ];
path = [
pkgs.coreutils
nixos/modules/services/continuous-integration/hydra/default.nix
+2 -2
View File
@@ -334,8 +334,8 @@ in
systemd.services.hydra-init = {
wantedBy = [ "multi-user.target" ];
requires = lib.optional haveLocalDB "postgresql.service";
after = lib.optional haveLocalDB "postgresql.service";
requires = lib.optional haveLocalDB "postgresql.target";
after = lib.optional haveLocalDB "postgresql.target";
environment = env // {
HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-init";
};
nixos/modules/services/databases/pgmanage.nix
+2 -2
View File
@@ -185,8 +185,8 @@ in
config = lib.mkIf cfg.enable {
systemd.services.pgmanage = {
description = "pgmanage - PostgreSQL Administration for the web";
wants = [ "postgresql.service" ];
after = [ "postgresql.service" ];
wants = [ "postgresql.target" ];
after = [ "postgresql.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
User = pgmanage;
nixos/modules/services/databases/postgres-websockets.nix
+1 -1
View File
@@ -156,7 +156,7 @@ in
wants = [ "network-online.target" ];
after = [
"network-online.target"
"postgresql.service"
"postgresql.target"
];
environment =
nixos/modules/services/databases/postgresql.md
+18 -59
View File
@@ -89,29 +89,29 @@ database migrations.
**NOTE:** please make sure that any added migrations are idempotent (re-runnable).
#### as superuser {#module-services-postgres-initializing-extra-permissions-superuser}
#### in database's setup `postStart` {#module-services-postgres-initializing-extra-permissions-superuser-post-start}
**Advantage:** compatible with postgres < 15, because it's run
as the database superuser `postgres`.
##### in database `postStart` {#module-services-postgres-initializing-extra-permissions-superuser-post-start}
**Disadvantage:** need to take care of ordering yourself. In this
example, `mkAfter` ensures that permissions are assigned after any
databases from `ensureDatabases` and `extraUser1` from `ensureUsers`
are already created.
`ensureUsers` is run in `postgresql-setup`, so this is where `postStart` must be added to:
```nix
{
systemd.services.postgresql.postStart = lib.mkAfter ''
$PSQL service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
$PSQL service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
systemd.services.postgresql-setup.postStart = ''
psql service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
psql service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
# ....
'';
}
```
##### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-superuser-oneshot}
#### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-superuser-oneshot}
Make sure to run this service after `postgresql.target`, not `postgresql.service`.
They differ in two aspects:
- `postgresql.target` includes `postgresql-setup`, so users managed via `ensureUsers` are already created.
- `postgresql.target` will wait until PostgreSQL is in read-write mode after restoring from backup, while `postgresql.service` will already be ready when PostgreSQL is still recovering in read-only mode.
Both can lead to unexpected errors either during initial database creation or restore, when using `postgresql.service`.
```nix
{
@@ -119,54 +119,13 @@ are already created.
serviceConfig.Type = "oneshot";
requiredBy = "service1.service";
before = "service1.service";
after = "postgresql.service";
after = "postgresql.target";
serviceConfig.User = "postgres";
environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
environment.PGPORT = toString services.postgresql.settings.port;
path = [ postgresql ];
script = ''
$PSQL service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
$PSQL service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
# ....
'';
};
}
```
#### as service user {#module-services-postgres-initializing-extra-permissions-service-user}
**Advantage:** re-uses systemd's dependency ordering;
**Disadvantage:** relies on service user having grant permission. To be combined with `ensureDBOwnership`.
##### in service `preStart` {#module-services-postgres-initializing-extra-permissions-service-user-pre-start}
```nix
{
environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
path = [ postgresql ];
systemd.services."service1".preStart = ''
$PSQL -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
$PSQL -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
# ....
'';
}
```
##### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-service-user-oneshot}
```nix
{
systemd.services."migrate-service1-db1" = {
serviceConfig.Type = "oneshot";
requiredBy = "service1.service";
before = "service1.service";
after = "postgresql.service";
serviceConfig.User = "service1";
environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
path = [ postgresql ];
script = ''
$PSQL -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
$PSQL -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
psql service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
psql service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
# ....
'';
};
nixos/modules/services/databases/postgresql.nix
+79 -48
View File
@@ -751,12 +751,23 @@ in
cfg.checkConfig && pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform
) configFileCheck;
systemd.targets.postgresql = {
description = "PostgreSQL";
wantedBy = [ "multi-user.target" ];
bindsTo = [
"postgresql.service"
"postgresql-setup.service"
];
};
systemd.services.postgresql = {
description = "PostgreSQL Server";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
# To trigger the .target also on "systemctl start postgresql".
bindsTo = [ "postgresql.target" ];
environment.PGDATA = cfg.dataDir;
path = [ cfg.finalPackage ];
@@ -776,49 +787,6 @@ in
ln -sfn "${configFile}/postgresql.conf" "${cfg.dataDir}/postgresql.conf"
'';
# Wait for PostgreSQL to be ready to accept connections.
postStart =
''
PSQL="psql --port=${builtins.toString cfg.settings.port}"
while ! $PSQL -d postgres -c "" 2> /dev/null; do
if ! kill -0 "$MAINPID"; then exit 1; fi
sleep 0.1
done
if test -e "${cfg.dataDir}/.first_startup"; then
${optionalString (cfg.initialScript != null) ''
$PSQL -f "${cfg.initialScript}" -d postgres
''}
rm -f "${cfg.dataDir}/.first_startup"
fi
''
+ optionalString (cfg.ensureDatabases != [ ]) ''
${concatMapStrings (database: ''
$PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${database}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${database}"'
'') cfg.ensureDatabases}
''
+ ''
${concatMapStrings (
user:
let
dbOwnershipStmt = optionalString user.ensureDBOwnership ''$PSQL -tAc 'ALTER DATABASE "${user.name}" OWNER TO "${user.name}";' '';
filteredClauses = filterAttrs (name: value: value != null) user.ensureClauses;
clauseSqlStatements = attrValues (mapAttrs (n: v: if v then n else "no${n}") filteredClauses);
userClauses = ''$PSQL -tAc 'ALTER ROLE "${user.name}" ${concatStringsSep " " clauseSqlStatements}' '';
in
''
$PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"'
${userClauses}
${dbOwnershipStmt}
''
) cfg.ensureUsers}
'';
serviceConfig = mkMerge [
{
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
@@ -891,11 +859,74 @@ in
unitConfig.RequiresMountsFor = "${cfg.dataDir}";
};
systemd.services.postgresql-setup = {
description = "PostgreSQL Setup Scripts";
requires = [ "postgresql.service" ];
after = [ "postgresql.service" ];
serviceConfig = {
User = "postgres";
Group = "postgres";
Type = "oneshot";
RemainAfterExit = true;
};
path = [ cfg.finalPackage ];
environment.PGPORT = builtins.toString cfg.settings.port;
# Wait for PostgreSQL to be ready to accept connections.
script =
''
check-connection() {
psql -d postgres -v ON_ERROR_STOP=1 <<-' EOF'
SELECT pg_is_in_recovery() \gset
\if :pg_is_in_recovery
\i still-recovering
\endif
EOF
}
while ! check-connection 2> /dev/null; do
if ! systemctl is-active --quiet postgresql.service; then exit 1; fi
sleep 0.1
done
if test -e "${cfg.dataDir}/.first_startup"; then
${optionalString (cfg.initialScript != null) ''
psql -f "${cfg.initialScript}" -d postgres
''}
rm -f "${cfg.dataDir}/.first_startup"
fi
''
+ optionalString (cfg.ensureDatabases != [ ]) ''
${concatMapStrings (database: ''
psql -tAc "SELECT 1 FROM pg_database WHERE datname = '${database}'" | grep -q 1 || psql -tAc 'CREATE DATABASE "${database}"'
'') cfg.ensureDatabases}
''
+ ''
${concatMapStrings (
user:
let
dbOwnershipStmt = optionalString user.ensureDBOwnership ''psql -tAc 'ALTER DATABASE "${user.name}" OWNER TO "${user.name}";' '';
filteredClauses = filterAttrs (name: value: value != null) user.ensureClauses;
clauseSqlStatements = attrValues (mapAttrs (n: v: if v then n else "no${n}") filteredClauses);
userClauses = ''psql -tAc 'ALTER ROLE "${user.name}" ${concatStringsSep " " clauseSqlStatements}' '';
in
''
psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || psql -tAc 'CREATE USER "${user.name}"'
${userClauses}
${dbOwnershipStmt}
''
) cfg.ensureUsers}
'';
};
};
meta.doc = ./postgresql.md;
meta.maintainers = with lib.maintainers; [
thoughtpolice
danbst
];
meta.maintainers = pkgs.postgresql.meta.maintainers;
}
nixos/modules/services/databases/postgrest.nix
+1 -1
View File
@@ -256,7 +256,7 @@ in
wants = [ "network-online.target" ];
after = [
"network-online.target"
"postgresql.service"
"postgresql.target"
];
serviceConfig = {
nixos/modules/services/development/zammad.nix
+2 -2
View File
@@ -275,13 +275,13 @@ in
"systemd-tmpfiles-setup.service"
]
++ lib.optionals (cfg.database.createLocally) [
"postgresql.service"
"postgresql.target"
]
++ lib.optionals cfg.redis.createLocally [
"redis-${cfg.redis.name}.service"
];
requires = lib.optionals (cfg.database.createLocally) [
"postgresql.service"
"postgresql.target"
];
description = "Zammad web";
wantedBy = [ "multi-user.target" ];
nixos/modules/services/finance/libeufin/common.nix
+2 -2
View File
@@ -123,8 +123,8 @@ libeufinComponent:
echo "Bank initialisation complete"
fi
'';
requires = lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
after = [ "network.target" ] ++ lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
requires = lib.optionals cfg.createLocalDatabase [ "postgresql.target" ];
after = [ "network.target" ] ++ lib.optionals cfg.createLocalDatabase [ "postgresql.target" ];
};
};
nixos/modules/services/finance/odoo.nix
+2 -2
View File
@@ -119,13 +119,13 @@ in
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
"postgresql.service"
"postgresql.target"
];
# pg_dump
path = [ config.services.postgresql.package ];
requires = [ "postgresql.service" ];
requires = [ "postgresql.target" ];
serviceConfig = {
ExecStart = "${cfg.package}/bin/odoo";
nixos/modules/services/finance/taler/common.nix
+2 -2
View File
@@ -89,8 +89,8 @@ in
Restart = "on-failure";
RestartSec = "5s";
};
requires = [ "postgresql.service" ];
after = [ "postgresql.service" ];
requires = [ "postgresql.target" ];
after = [ "postgresql.target" ];
};
}
];
nixos/modules/services/home-automation/home-assistant.nix
+1 -1
View File
@@ -623,7 +623,7 @@ in
# prevent races with database creation
"mysql.service"
"postgresql.service"
"postgresql.target"
];
reloadTriggers =
optionals (cfg.config != null) [ configFile ]
nixos/modules/services/mail/dspam.nix
+1 -1
View File
@@ -107,7 +107,7 @@ in
systemd.services.dspam = {
description = "dspam spam filtering daemon";
wantedBy = [ "multi-user.target" ];
after = [ "postgresql.service" ];
after = [ "postgresql.target" ];
restartTriggers = [ cfgfile ];
serviceConfig = {
nixos/modules/services/mail/listmonk.nix
+1 -1
View File
@@ -193,7 +193,7 @@ in
systemd.services.listmonk = {
description = "Listmonk - newsletter and mailing list manager";
after = [ "network.target" ] ++ lib.optional cfg.database.createLocally "postgresql.service";
after = [ "network.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "exec";
nixos/modules/services/mail/mailman.nix
+6 -6
View File
@@ -575,9 +575,9 @@ in
after =
[ "network.target" ]
++ lib.optional cfg.enablePostfix "postfix-setup.service"
++ lib.optional withPostgresql "postgresql.service";
++ lib.optional withPostgresql "postgresql.target";
restartTriggers = [ mailmanCfgFile ];
requires = lib.optional withPostgresql "postgresql.service";
requires = lib.optional withPostgresql "postgresql.target";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${mailmanEnv}/bin/mailman start";
@@ -609,8 +609,8 @@ in
"hyperkitty.service"
];
path = with pkgs; [ jq ];
after = lib.optional withPostgresql "postgresql.service";
requires = lib.optional withPostgresql "postgresql.service";
after = lib.optional withPostgresql "postgresql.target";
requires = lib.optional withPostgresql "postgresql.target";
serviceConfig.RemainAfterExit = true;
serviceConfig.Type = "oneshot";
script = ''
@@ -709,11 +709,11 @@ in
in
{
wantedBy = [ "multi-user.target" ];
after = lib.optional withPostgresql "postgresql.service";
after = lib.optional withPostgresql "postgresql.target";
requires = [
"mailman-uwsgi.socket"
"mailman-web-setup.service"
] ++ lib.optional withPostgresql "postgresql.service";
] ++ lib.optional withPostgresql "postgresql.target";
restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
serviceConfig = {
# Since the mailman-web settings.py obstinately creates a logs
nixos/modules/services/mail/postfixadmin.nix
+2 -2
View File
@@ -148,8 +148,8 @@ in
# objects owners and extensions; for now we tack on what's needed
# here.
systemd.services.postfixadmin-postgres = lib.mkIf localDB {
after = [ "postgresql.service" ];
bindsTo = [ "postgresql.service" ];
after = [ "postgresql.target" ];
bindsTo = [ "postgresql.target" ];
wantedBy = [ "multi-user.target" ];
path = [
pgsql.package
nixos/modules/services/mail/roundcube.nix
+2 -2
View File
@@ -273,8 +273,8 @@ in
systemd.services.roundcube-setup = lib.mkMerge [
(lib.mkIf localDB {
requires = [ "postgresql.service" ];
after = [ "postgresql.service" ];
requires = [ "postgresql.target" ];
after = [ "postgresql.target" ];
})
{
wants = [ "network-online.target" ];
nixos/modules/services/matrix/appservice-irc.nix
+1 -1
View File
@@ -196,7 +196,7 @@ in
description = "Matrix-IRC bridge";
before = [ "matrix-synapse.service" ]; # So the registration can be used by Synapse
after = lib.optionals (cfg.settings.database.engine == "postgres") [
"postgresql.service"
"postgresql.target"
];
wantedBy = [ "multi-user.target" ];
nixos/modules/services/matrix/maubot.nix
+1 -1
View File
@@ -440,7 +440,7 @@ in
systemd.services.maubot = rec {
description = "maubot - a plugin-based Matrix bot system written in Python";
after = [ "network.target" ] ++ wants ++ lib.optional hasLocalPostgresDB "postgresql.service";
after = [ "network.target" ] ++ wants ++ lib.optional hasLocalPostgresDB "postgresql.target";
# all plugins get automatically disabled if maubot starts before synapse
wants = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
wantedBy = [ "multi-user.target" ];
nixos/modules/services/matrix/synapse-auto-compressor.nix
+1 -1
View File
@@ -119,7 +119,7 @@ in
systemd.services.synapse-auto-compressor = {
description = "synapse-auto-compressor";
requires = lib.optionals synapseUsesLocalPostgresql [
"postgresql.service"
"postgresql.target"
];
inherit (cfg) startAt;
serviceConfig = {
nixos/modules/services/matrix/synapse.nix
+4 -4
View File
@@ -1439,7 +1439,7 @@ in
systemd.targets.matrix-synapse = lib.mkIf hasWorkers {
description = "Synapse Matrix parent target";
wants = [ "network-online.target" ];
after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.target";
wantedBy = [ "multi-user.target" ];
};
@@ -1451,13 +1451,13 @@ in
partOf = [ "matrix-synapse.target" ];
wantedBy = [ "matrix-synapse.target" ];
unitConfig.ReloadPropagatedFrom = "matrix-synapse.target";
requires = optional hasLocalPostgresDB "postgresql.service";
requires = optional hasLocalPostgresDB "postgresql.target";
}
else
{
wants = [ "network-online.target" ];
after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
requires = optional hasLocalPostgresDB "postgresql.service";
after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.target";
requires = optional hasLocalPostgresDB "postgresql.target";
wantedBy = [ "multi-user.target" ];
};
baseServiceConfig = {
nixos/modules/services/misc/atuin.nix
+3 -3
View File
@@ -92,13 +92,13 @@ in
systemd.services.atuin = {
description = "atuin server";
requires = lib.optionals cfg.database.createLocally [ "postgresql.service" ];
requires = lib.optionals cfg.database.createLocally [ "postgresql.target" ];
after = [
"network-online.target"
] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
] ++ lib.optionals cfg.database.createLocally [ "postgresql.target" ];
wants = [
"network-online.target"
] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
] ++ lib.optionals cfg.database.createLocally [ "postgresql.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
nixos/modules/services/misc/disnix.nix
+1 -1
View File
@@ -77,7 +77,7 @@ in
[ "dbus.service" ]
++ lib.optional config.services.httpd.enable "httpd.service"
++ lib.optional config.services.mysql.enable "mysql.service"
++ lib.optional config.services.postgresql.enable "postgresql.service"
++ lib.optional config.services.postgresql.enable "postgresql.target"
++ lib.optional config.services.tomcat.enable "tomcat.service"
++ lib.optional config.services.svnserve.enable "svnserve.service"
++ lib.optional config.services.mongodb.enable "mongodb.service"
nixos/modules/services/misc/forgejo.nix
+2 -2
View File
@@ -663,7 +663,7 @@ in
"network.target"
]
++ optionals usePostgresql [
"postgresql.service"
"postgresql.target"
]
++ optionals useMysql [
"mysql.service"
@@ -673,7 +673,7 @@ in
];
requires =
optionals (cfg.database.createDatabase && usePostgresql) [
"postgresql.service"
"postgresql.target"
]
++ optionals (cfg.database.createDatabase && useMysql) [
"mysql.service"
nixos/modules/services/misc/gammu-smsd.nix
+1 -1
View File
@@ -238,7 +238,7 @@ in
wants =
with cfg.backend;
[ ] ++ lib.optionals (service == "sql" && sql.driver == "native_pgsql") [ "postgresql.service" ];
[ ] ++ lib.optionals (service == "sql" && sql.driver == "native_pgsql") [ "postgresql.target" ];
preStart =
with cfg.backend;
nixos/modules/services/misc/gitea.nix
+2 -2
View File
@@ -758,10 +758,10 @@ in
description = "gitea";
after =
[ "network.target" ]
++ optional usePostgresql "postgresql.service"
++ optional usePostgresql "postgresql.target"
++ optional useMysql "mysql.service";
requires =
optional (cfg.database.createDatabase && usePostgresql) "postgresql.service"
optional (cfg.database.createDatabase && usePostgresql) "postgresql.target"
++ optional (cfg.database.createDatabase && useMysql) "mysql.service";
wantedBy = [ "multi-user.target" ];
path = [
nixos/modules/services/misc/gitlab.nix
+9 -9
View File
@@ -1295,8 +1295,8 @@ in
pgsql = config.services.postgresql;
in
mkIf databaseActuallyCreateLocally {
after = [ "postgresql.service" ];
bindsTo = [ "postgresql.service" ];
after = [ "postgresql.target" ];
bindsTo = [ "postgresql.target" ];
wantedBy = [ "gitlab.target" ];
partOf = [ "gitlab.target" ];
path = [
@@ -1561,12 +1561,12 @@ in
systemd.services.gitlab-db-config = {
after = [
"gitlab-config.service"
"gitlab-postgresql.service"
"postgresql.service"
"gitlab-postgresql.target"
"postgresql.target"
];
wants =
optional (cfg.databaseHost == "") "postgresql.service"
++ optional databaseActuallyCreateLocally "gitlab-postgresql.service";
optional (cfg.databaseHost == "") "postgresql.target"
++ optional databaseActuallyCreateLocally "gitlab-postgresql.target";
bindsTo = [ "gitlab-config.service" ];
wantedBy = [ "gitlab.target" ];
partOf = [ "gitlab.target" ];
@@ -1596,7 +1596,7 @@ in
after = [
"network.target"
"redis-gitlab.service"
"postgresql.service"
"postgresql.target"
"gitlab-config.service"
"gitlab-db-config.service"
];
@@ -1604,7 +1604,7 @@ in
"gitlab-config.service"
"gitlab-db-config.service"
];
wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.service";
wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.target";
wantedBy = [ "gitlab.target" ];
partOf = [ "gitlab.target" ];
environment =
@@ -1847,7 +1847,7 @@ in
"gitlab-config.service"
"gitlab-db-config.service"
];
wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.service";
wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.target";
requiredBy = [ "gitlab.target" ];
partOf = [ "gitlab.target" ];
environment = gitlabEnv;
nixos/modules/services/misc/paperless.nix
+8 -8
View File
@@ -491,18 +491,18 @@ in
fi
fi
'';
requires = lib.optional cfg.database.createLocally "postgresql.service";
requires = lib.optional cfg.database.createLocally "postgresql.target";
after =
lib.optional enableRedis "redis-paperless.service"
++ lib.optional cfg.database.createLocally "postgresql.service";
++ lib.optional cfg.database.createLocally "postgresql.target";
};
systemd.services.paperless-task-queue = {
description = "Paperless Celery Workers";
requires = lib.optional cfg.database.createLocally "postgresql.service";
requires = lib.optional cfg.database.createLocally "postgresql.target";
after = [
"paperless-scheduler.service"
] ++ lib.optional cfg.database.createLocally "postgresql.service";
] ++ lib.optional cfg.database.createLocally "postgresql.target";
serviceConfig = defaultServiceConfig // {
User = cfg.user;
ExecStart = "${cfg.package}/bin/celery --app paperless worker --loglevel INFO";
@@ -520,10 +520,10 @@ in
# Bind to `paperless-scheduler` so that the consumer never runs
# during migrations
bindsTo = [ "paperless-scheduler.service" ];
requires = lib.optional cfg.database.createLocally "postgresql.service";
requires = lib.optional cfg.database.createLocally "postgresql.target";
after = [
"paperless-scheduler.service"
] ++ lib.optional cfg.database.createLocally "postgresql.service";
] ++ lib.optional cfg.database.createLocally "postgresql.target";
serviceConfig = defaultServiceConfig // {
User = cfg.user;
ExecStart = "${cfg.package}/bin/paperless-ngx document_consumer";
@@ -541,10 +541,10 @@ in
# Bind to `paperless-scheduler` so that the web server never runs
# during migrations
bindsTo = [ "paperless-scheduler.service" ];
requires = lib.optional cfg.database.createLocally "postgresql.service";
requires = lib.optional cfg.database.createLocally "postgresql.target";
after = [
"paperless-scheduler.service"
] ++ lib.optional cfg.database.createLocally "postgresql.service";
] ++ lib.optional cfg.database.createLocally "postgresql.target";
# Setup PAPERLESS_SECRET_KEY.
# If this environment variable is left unset, paperless-ngx defaults
# to a well-known value, which is insecure.
nixos/modules/services/misc/redmine.nix
+1 -1
View File
@@ -374,7 +374,7 @@ in
after =
[ "network.target" ]
++ lib.optional mysqlLocal "mysql.service"
++ lib.optional pgsqlLocal "postgresql.service";
++ lib.optional pgsqlLocal "postgresql.target";
wantedBy = [ "multi-user.target" ];
environment.RAILS_ENV = "production";
environment.RAILS_CACHE = "${cfg.stateDir}/cache";
nixos/modules/services/misc/sourcehut/service.nix
+5 -7
View File
@@ -52,10 +52,10 @@ let
{
after =
[ "network.target" ]
++ optional cfg.postgresql.enable "postgresql.service"
++ optional cfg.postgresql.enable "postgresql.target"
++ optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service";
requires =
optional cfg.postgresql.enable "postgresql.service"
optional cfg.postgresql.enable "postgresql.target"
++ optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service";
path = [ pkgs.gawk ];
environment.HOME = runDir;
@@ -482,11 +482,9 @@ in
&& lib.strings.versionAtLeast config.services.postgresql.package.version "15.0"
)
{
postgresql.postStart = (
lib.mkAfter ''
$PSQL -tAc 'ALTER DATABASE "${srvCfg.postgresql.database}" OWNER TO "${srvCfg.user}";'
''
);
postgresql-setup.postStart = ''
psql -tAc 'ALTER DATABASE "${srvCfg.postgresql.database}" OWNER TO "${srvCfg.user}";'
'';
}
)
];
nixos/modules/services/monitoring/grafana.nix
+1 -1
View File
@@ -2020,7 +2020,7 @@ in
wantedBy = [ "multi-user.target" ];
after =
[ "networking.target" ]
++ lib.optional usePostgresql "postgresql.service"
++ lib.optional usePostgresql "postgresql.target"
++ lib.optional useMysql "mysql.service";
script = ''
set -o errexit -o pipefail -o nounset -o errtrace
nixos/modules/services/monitoring/zabbix-proxy.nix
+1 -1
View File
@@ -337,7 +337,7 @@ in
description = "Zabbix Proxy";
wantedBy = [ "multi-user.target" ];
after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
path = [ "/run/wrappers" ] ++ cfg.extraPackages;
preStart =
nixos/modules/services/monitoring/zabbix-server.nix
+2 -2
View File
@@ -328,7 +328,7 @@ in
description = "Zabbix Server";
wantedBy = [ "multi-user.target" ];
after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
path = [ "/run/wrappers" ] ++ cfg.extraPackages;
preStart =
@@ -374,7 +374,7 @@ in
systemd.services.httpd.after =
optional (config.services.zabbixWeb.enable && mysqlLocal) "mysql.service"
++ optional (config.services.zabbixWeb.enable && pgsqlLocal) "postgresql.service";
++ optional (config.services.zabbixWeb.enable && pgsqlLocal) "postgresql.target";
};
nixos/modules/services/networking/atticd.nix
+2 -2
View File
@@ -169,8 +169,8 @@ in
systemd.services.atticd = {
wantedBy = [ "multi-user.target" ];
after = [ "network-online.target" ] ++ lib.optionals hasLocalPostgresDB [ "postgresql.service" ];
requires = lib.optionals hasLocalPostgresDB [ "postgresql.service" ];
after = [ "network-online.target" ] ++ lib.optionals hasLocalPostgresDB [ "postgresql.target" ];
requires = lib.optionals hasLocalPostgresDB [ "postgresql.target" ];
wants = [ "network-online.target" ];
serviceConfig = {
nixos/modules/services/networking/firezone/server.nix
+2 -2
View File
@@ -1105,8 +1105,8 @@ in
systemd.services.firezone-initialize = {
description = "Backend initialization service for the Firezone zero-trust access platform";
after = mkIf cfg.enableLocalDB [ "postgresql.service" ];
requires = mkIf cfg.enableLocalDB [ "postgresql.service" ];
after = mkIf cfg.enableLocalDB [ "postgresql.target" ];
requires = mkIf cfg.enableLocalDB [ "postgresql.target" ];
wantedBy = [ "firezone.target" ];
partOf = [ "firezone.target" ];
nixos/modules/services/networking/livekit-ingress.nix
+181
View File
@@ -0,0 +1,181 @@
{
config,
lib,
pkgs,
utils,
...
}:
let
cfg = config.services.livekit.ingress;
format = pkgs.formats.yaml { };
settings = lib.filterAttrsRecursive (_: v: v != null) cfg.settings;
isLocallyDistributed = config.services.livekit.enable;
in
{
meta.maintainers = with lib.maintainers; [ k900 ];
options.services.livekit.ingress = {
enable = lib.mkEnableOption "the livekit ingress service";
package = lib.mkPackageOption pkgs "livekit-ingress" { };
openFirewall = {
rtc = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open WebRTC ports in the firewall.";
};
rtmp = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open RTMP port in the firewall.";
};
whip = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open WHIP port in the firewall.";
};
};
settings = lib.mkOption {
type = lib.types.submodule {
freeformType = format.type;
options = {
rtmp_port = lib.mkOption {
type = lib.types.port;
default = 1935;
description = "TCP port for RTMP connections";
};
whip_port = lib.mkOption {
type = lib.types.port;
default = 8080;
description = "TCP port for WHIP connections";
};
redis = {
address = lib.mkOption {
type = with lib.types; nullOr str;
default =
if isLocallyDistributed then
"${config.services.livekit.redis.host}:${toString config.services.livekit.redis.port}"
else
null;
example = "redis.example.com:6379";
defaultText = "Host and port of the local livekit redis instance, if enabled, or null";
description = "Address or hostname and port for redis connection";
};
};
rtc_config = {
port_range_start = lib.mkOption {
type = lib.types.int;
default = 50000;
description = "Start of UDP port range for WebRTC";
};
port_range_end = lib.mkOption {
type = lib.types.int;
default = 51000;
description = "End of UDP port range for WebRTC";
};
use_external_ip = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
When set to true, attempts to discover the host's public IP via STUN.
This is useful for cloud environments such as AWS & Google where hosts have an internal IP that maps to an external one.
'';
};
};
};
};
default = { };
description = ''
LiveKit Ingress configuration.
See <https://github.com/livekit/ingress?tab=readme-ov-file#config> for possible options.
'';
example = {
prometheus_port = 9039;
cpu_cost = {
rtmp_cpu_cost = 3.0;
whip_cpu_cost = 1.0;
};
};
};
environmentFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
Environment file as defined in {manpage}`systemd.exec(5)` passed to the service.
Use this to specify `LIVEKIT_API_KEY` and `LIVEKIT_API_SECRET`.
'';
};
};
config = lib.mkIf cfg.enable {
networking.firewall = {
allowedTCPPorts = lib.mkMerge [
(lib.mkIf cfg.openFirewall.rtmp [ cfg.settings.rtmp_port ])
(lib.mkIf cfg.openFirewall.whip [ cfg.settings.whip_port ])
];
allowedUDPPortRanges = lib.mkIf cfg.openFirewall.rtc [
{
from = cfg.settings.rtc_config.port_range_start;
to = cfg.settings.rtc_config.port_range_end;
}
];
};
systemd.services.livekit-ingress = {
description = "LiveKit Ingress server";
documentation = [ "https://docs.livekit.io/home/self-hosting/ingress/" ];
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
serviceConfig = {
ExecStart = utils.escapeSystemdExecArgs [
(lib.getExe cfg.package)
"--config=${format.generate "ingress.yaml" settings}"
];
EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
DynamicUser = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateUsers = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_NETLINK"
];
RestrictNamespaces = true;
RestrictRealtime = true;
ProtectHome = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
];
Restart = "on-failure";
RestartSec = 5;
UMask = "077";
};
};
};
}
nixos/modules/services/networking/livekit.nix
+56 -1
View File
@@ -8,6 +8,9 @@
let
cfg = config.services.livekit;
format = pkgs.formats.json { };
settings = lib.filterAttrsRecursive (_: v: v != null) cfg.settings;
isLocallyDistributed = config.services.livekit.ingress.enable;
in
{
meta.maintainers = with lib.maintainers; [ quadradical ];
@@ -34,6 +37,32 @@ in
description = "Opens port range for LiveKit on the firewall.";
};
redis = {
createLocally = lib.mkOption {
type = lib.types.bool;
default = isLocallyDistributed;
defaultText = "true if any other Livekit component is enabled locally else false";
description = "Whether to set up a local redis instance.";
};
host = lib.mkOption {
type = with lib.types; nullOr str;
default = if cfg.redis.createLocally then "127.0.0.1" else null;
defaultText = "127.0.0.1 if config.services.livekit.redis.createLocally else null";
description = ''
Address to bind local redis instance to.
'';
};
port = lib.mkOption {
type = with lib.types; nullOr port;
default = null;
description = ''
Port to bind local redis instance to.
'';
};
};
settings = lib.mkOption {
type = lib.types.submodule {
freeformType = format.type;
@@ -44,6 +73,16 @@ in
description = "Main TCP port for RoomService and RTC endpoint.";
};
redis = {
address = lib.mkOption {
type = with lib.types; nullOr str;
default = if isLocallyDistributed then "${cfg.redis.host}:${toString cfg.redis.port}" else null;
defaultText = lib.literalExpression "Local Redis host/port when a local ingress component is enabled else null";
example = "redis.example.com:6379";
description = "Host and port used to connect to a redis instance.";
};
};
rtc = {
port_range_start = lib.mkOption {
type = lib.types.int;
@@ -79,6 +118,15 @@ in
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = cfg.redis.createLocally -> cfg.redis.port != null;
message = ''
When `services.livekit.redis.createLocally` is enabled `services.livekit.redis.port` must be configured.
'';
}
];
networking.firewall = lib.mkIf cfg.openFirewall {
allowedTCPPorts = [
cfg.settings.port
@@ -91,6 +139,13 @@ in
];
};
# Provision a redis instance, when livekit-ingress (or later livekit-egress) are enabled on the same host
services.redis.servers.livekit = lib.mkIf cfg.redis.createLocally {
enable = true;
bind = cfg.redis.host;
port = cfg.redis.port;
};
systemd.services.livekit = {
description = "LiveKit SFU server";
documentation = [ "https://docs.livekit.io" ];
@@ -102,7 +157,7 @@ in
LoadCredential = [ "livekit-secrets:${cfg.keyFile}" ];
ExecStart = utils.escapeSystemdExecArgs [
(lib.getExe cfg.package)
"--config=${format.generate "livekit.json" cfg.settings}"
"--config=${format.generate "livekit.json" settings}"
"--key-file=/run/credentials/livekit.service/livekit-secrets"
];
DynamicUser = true;
nixos/modules/services/networking/netbird.nix
+20 -1
View File
@@ -12,6 +12,7 @@ let
escapeShellArgs
filterAttrs
getExe
listToAttrs
literalExpression
maintainers
makeBinPath
@@ -28,6 +29,7 @@ let
optional
optionalAttrs
optionalString
optionals
toShellVars
versionAtLeast
versionOlder
@@ -471,6 +473,16 @@ in
toClientList (client: optional client.openFirewall client.port)
);
# Ports opened on a specific
networking.firewall.interfaces = listToAttrs (
toClientList (client: {
name = client.interface;
value.allowedUDPPorts = optionals client.openFirewall [
5353 # required for the DNS forwarding/routing to work
];
})
);
systemd.network.networks = mkIf config.networking.useNetworkd (
toClientAttrs (
client:
@@ -504,7 +516,14 @@ in
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
path = optional (!config.services.resolved.enable) pkgs.openresolv;
path =
optionals (!config.services.resolved.enable) [ pkgs.openresolv ]
# useful for `netbird debug` system info gathering
++ optionals config.networking.nftables.enable [ pkgs.nftables ]
++ optionals (!config.networking.nftables.enable) [
pkgs.iptables
pkgs.ipset
];
serviceConfig = {
ExecStart = "${getExe client.wrapper} service run";
nixos/modules/services/networking/pleroma.nix
+1 -1
View File
@@ -122,7 +122,7 @@ in
wants = [ "network-online.target" ];
after = [
"network-online.target"
"postgresql.service"
"postgresql.target"
];
wantedBy = [ "pleroma.service" ];
environment.RELEASE_COOKIE = "/var/lib/pleroma/.cookie";
nixos/modules/services/networking/powerdns.nix
+1 -1
View File
@@ -53,7 +53,7 @@ in
after = [
"network.target"
"mysql.service"
"postgresql.service"
"postgresql.target"
"openldap.service"
];
nixos/modules/services/networking/quassel.nix
+1 -1
View File
@@ -120,7 +120,7 @@ in
wantedBy = [ "multi-user.target" ];
after =
[ "network.target" ]
++ optional config.services.postgresql.enable "postgresql.service"
++ optional config.services.postgresql.enable "postgresql.target"
++ optional config.services.mysql.enable "mysql.service";
serviceConfig = {
nixos/modules/services/security/canaille.nix
+2 -2
View File
@@ -283,7 +283,7 @@ in
systemd.services.canaille-install = {
# We want this on boot, not on socket activation
wantedBy = [ "multi-user.target" ];
after = optional createLocalPostgresqlDb "postgresql.service";
after = optional createLocalPostgresqlDb "postgresql.target";
serviceConfig = commonServiceConfig // {
Type = "oneshot";
ExecStart = "${getExe finalPackage} install";
@@ -296,7 +296,7 @@ in
after = [
"network.target"
"canaille-install.service"
] ++ optional createLocalPostgresqlDb "postgresql.service";
] ++ optional createLocalPostgresqlDb "postgresql.target";
requires = [
"canaille-install.service"
"canaille.socket"
nixos/modules/services/torrent/bitmagnet.nix
+2 -2
View File
@@ -127,8 +127,8 @@ in
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
] ++ optional cfg.useLocalPostgresDB "postgresql.service";
requires = optional cfg.useLocalPostgresDB "postgresql.service";
] ++ optional cfg.useLocalPostgresDB "postgresql.target";
requires = optional cfg.useLocalPostgresDB "postgresql.target";
serviceConfig = {
Type = "simple";
DynamicUser = true;
nixos/modules/services/web-apps/akkoma.nix
+2 -2
View File
@@ -1231,7 +1231,7 @@ in
requiredBy = [ "akkoma.service" ];
after = [
"akkoma-config.service"
"postgresql.service"
"postgresql.target"
];
before = [ "akkoma.service" ];
@@ -1269,7 +1269,7 @@ in
"akkoma-config.target"
"network.target"
"network-online.target"
"postgresql.service"
"postgresql.target"
];
confinement.packages = mkIf isConfined runtimeInputs;
nixos/modules/services/web-apps/crabfit.nix
+1 -1
View File
@@ -109,7 +109,7 @@ in
description = "The API for Crab Fit.";
wantedBy = [ "multi-user.target" ];
after = [ "postgresql.service" ];
after = [ "postgresql.target" ];
serviceConfig = {
# TODO: harden
nixos/modules/services/web-apps/davis.nix
+3 -3
View File
@@ -444,11 +444,11 @@ in
before = [ "phpfpm-davis.service" ];
after =
lib.optional mysqlLocal "mysql.service"
++ lib.optional pgsqlLocal "postgresql.service"
++ lib.optional pgsqlLocal "postgresql.target"
++ [ "davis-env-setup.service" ];
requires =
lib.optional mysqlLocal "mysql.service"
++ lib.optional pgsqlLocal "postgresql.service"
++ lib.optional pgsqlLocal "postgresql.target"
++ [ "davis-env-setup.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = defaultServiceConfig // {
@@ -483,7 +483,7 @@ in
"davis-db-migrate.service"
]
++ lib.optional mysqlLocal "mysql.service"
++ lib.optional pgsqlLocal "postgresql.service";
++ lib.optional pgsqlLocal "postgresql.target";
systemd.services.phpfpm-davis.serviceConfig.ReadWritePaths = [ cfg.dataDir ];
services.nginx = lib.mkIf (cfg.nginx != null) {
nixos/modules/services/web-apps/dependency-track.nix
+3 -3
View File
@@ -535,9 +535,9 @@ in
};
systemd.services.dependency-track-postgresql-init = lib.mkIf cfg.database.createLocally {
after = [ "postgresql.service" ];
after = [ "postgresql.target" ];
before = [ "dependency-track.service" ];
bindsTo = [ "postgresql.service" ];
bindsTo = [ "postgresql.target" ];
path = [ config.services.postgresql.package ];
serviceConfig = {
Type = "oneshot";
@@ -572,7 +572,7 @@ in
if cfg.database.createLocally then
[
"dependency-track-postgresql-init.service"
"postgresql.service"
"postgresql.target"
]
else
[ ];
nixos/modules/services/web-apps/dex.nix
+1 -1
View File
@@ -100,7 +100,7 @@ in
wantedBy = [ "multi-user.target" ];
after = [
"networking.target"
] ++ (optional (cfg.settings.storage.type == "postgres") "postgresql.service");
] ++ (optional (cfg.settings.storage.type == "postgres") "postgresql.target");
path = with pkgs; [ replace-secret ];
restartTriggers = restartTriggers;
serviceConfig =
nixos/modules/services/web-apps/discourse.nix
+6 -6
View File
@@ -705,8 +705,8 @@ in
pgsql = config.services.postgresql;
in
lib.mkIf databaseActuallyCreateLocally {
after = [ "postgresql.service" ];
bindsTo = [ "postgresql.service" ];
after = [ "postgresql.target" ];
bindsTo = [ "postgresql.target" ];
wantedBy = [ "discourse.service" ];
partOf = [ "discourse.service" ];
path = [
@@ -732,16 +732,16 @@ in
wantedBy = [ "multi-user.target" ];
after = [
"redis-discourse.service"
"postgresql.service"
"discourse-postgresql.service"
"postgresql.target"
"discourse-postgresql.target"
];
bindsTo =
[
"redis-discourse.service"
]
++ lib.optionals (cfg.database.host == null) [
"postgresql.service"
"discourse-postgresql.service"
"postgresql.target"
"discourse-postgresql.target"
];
path = cfg.package.runtimeDeps ++ [
postgresqlPackage
nixos/modules/services/web-apps/fider.nix
+2 -2
View File
@@ -87,8 +87,8 @@ in
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
] ++ lib.optionals (cfg.database.url == "local") [ "postgresql.service" ];
requires = lib.optionals (cfg.database.url == "local") [ "postgresql.service" ];
] ++ lib.optionals (cfg.database.url == "local") [ "postgresql.target" ];
requires = lib.optionals (cfg.database.url == "local") [ "postgresql.target" ];
environment =
let
localPostgresqlUrl = "postgres:///fider?host=/run/postgresql";
nixos/modules/services/web-apps/filesender.nix
+1 -1
View File
@@ -227,7 +227,7 @@ in
"multi-user.target"
"phpfpm-filesender.service"
];
after = [ "postgresql.service" ];
after = [ "postgresql.target" ];
restartIfChanged = true;
nixos/modules/services/web-apps/firefly-iii.nix
+2 -2
View File
@@ -308,7 +308,7 @@ in
systemd.services.firefly-iii-setup = {
after = [
"postgresql.service"
"postgresql.target"
"mysql.service"
];
requiredBy = [ "phpfpm-firefly-iii.service" ];
@@ -325,7 +325,7 @@ in
systemd.services.firefly-iii-cron = {
after = [
"firefly-iii-setup.service"
"postgresql.service"
"postgresql.target"
"mysql.service"
];
wants = [ "firefly-iii-setup.service" ];
nixos/modules/services/web-apps/froide-govplan.nix
+3 -3
View File
@@ -163,9 +163,9 @@ in
systemd = {
services = {
postgresql.serviceConfig.ExecStartPost =
postgresql-setup.serviceConfig.ExecStartPost =
let
sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" ''
sqlFile = pkgs.writeText "froide-govplan-postgis-setup.sql" ''
CREATE EXTENSION IF NOT EXISTS postgis;
'';
in
@@ -184,7 +184,7 @@ in
Group = "govplan";
};
after = [
"postgresql.service"
"postgresql.target"
"network.target"
"systemd-tmpfiles-setup.service"
];
nixos/modules/services/web-apps/gancio.nix
+1 -1
View File
@@ -211,7 +211,7 @@ in
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.service";
] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.target";
environment = {
NODE_ENV = "production";
nixos/modules/services/web-apps/glitchtip.nix
+2 -2
View File
@@ -171,11 +171,11 @@ in
wants = [ "network-online.target" ];
requires =
lib.optional cfg.database.createLocally "postgresql.service"
lib.optional cfg.database.createLocally "postgresql.target"
++ lib.optional cfg.redis.createLocally "redis-glitchtip.service";
after =
[ "network-online.target" ]
++ lib.optional cfg.database.createLocally "postgresql.service"
++ lib.optional cfg.database.createLocally "postgresql.target"
++ lib.optional cfg.redis.createLocally "redis-glitchtip.service";
inherit environment;
nixos/modules/services/web-apps/gotosocial.nix
+2 -2
View File
@@ -144,8 +144,8 @@ in
systemd.services.gotosocial = {
description = "ActivityPub social network server";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ] ++ lib.optional cfg.setupPostgresqlDB "postgresql.service";
requires = lib.optional cfg.setupPostgresqlDB "postgresql.service";
after = [ "network.target" ] ++ lib.optional cfg.setupPostgresqlDB "postgresql.target";
requires = lib.optional cfg.setupPostgresqlDB "postgresql.target";
restartTriggers = [ configFile ];
serviceConfig = {
nixos/modules/services/web-apps/homebox.nix
+2 -2
View File
@@ -81,8 +81,8 @@ in
];
};
systemd.services.homebox = {
requires = lib.optional cfg.database.createLocally "postgresql.service";
after = lib.optional cfg.database.createLocally "postgresql.service";
requires = lib.optional cfg.database.createLocally "postgresql.target";
after = lib.optional cfg.database.createLocally "postgresql.target";
environment = cfg.settings;
serviceConfig = {
User = "homebox";
nixos/modules/services/web-apps/immich.nix
+1 -1
View File
@@ -254,7 +254,7 @@ in
search_path = "\"$user\", public, vectors";
};
};
systemd.services.postgresql.serviceConfig.ExecStartPost =
systemd.services.postgresql-setup.serviceConfig.ExecStartPost =
let
sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" ''
CREATE EXTENSION IF NOT EXISTS unaccent;
nixos/modules/services/web-apps/invidious.nix
+2 -2
View File
@@ -19,8 +19,8 @@ let
commonInvidousServiceConfig = {
description = "Invidious (An alternative YouTube front-end)";
wants = [ "network-online.target" ];
after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.service";
requires = lib.optional cfg.database.createLocally "postgresql.service";
after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
requires = lib.optional cfg.database.createLocally "postgresql.target";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
nixos/modules/services/web-apps/keycloak.nix
+3 -3
View File
@@ -602,9 +602,9 @@ in
];
systemd.services.keycloakPostgreSQLInit = mkIf createLocalPostgreSQL {
after = [ "postgresql.service" ];
after = [ "postgresql.target" ];
before = [ "keycloak.service" ];
bindsTo = [ "postgresql.service" ];
bindsTo = [ "postgresql.target" ];
path = [ config.services.postgresql.package ];
serviceConfig = {
Type = "oneshot";
@@ -690,7 +690,7 @@ in
if createLocalPostgreSQL then
[
"keycloakPostgreSQLInit.service"
"postgresql.service"
"postgresql.target"
]
else if createLocalMySQL then
[
nixos/modules/services/web-apps/lasuite-docs.nix
+4 -4
View File
@@ -350,10 +350,10 @@ in
description = "Docs from SuiteNumérique";
after =
[ "network.target" ]
++ (optional cfg.postgresql.createLocally "postgresql.service")
++ (optional cfg.postgresql.createLocally "postgresql.target")
++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
wants =
(optional cfg.postgresql.createLocally "postgresql.service")
(optional cfg.postgresql.createLocally "postgresql.target")
++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
wantedBy = [ "multi-user.target" ];
@@ -398,10 +398,10 @@ in
description = "Docs Celery broker from SuiteNumérique";
after =
[ "network.target" ]
++ (optional cfg.postgresql.createLocally "postgresql.service")
++ (optional cfg.postgresql.createLocally "postgresql.target")
++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
wants =
(optional cfg.postgresql.createLocally "postgresql.service")
(optional cfg.postgresql.createLocally "postgresql.target")
++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
wantedBy = [ "multi-user.target" ];
nixos/modules/services/web-apps/lemmy.nix
+2 -2
View File
@@ -325,9 +325,9 @@ in
wantedBy = [ "multi-user.target" ];
after = [ "pict-rs.service" ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
after = [ "pict-rs.service" ] ++ lib.optionals cfg.database.createLocally [ "postgresql.target" ];
requires = lib.optionals cfg.database.createLocally [ "postgresql.service" ];
requires = lib.optionals cfg.database.createLocally [ "postgresql.target" ];
# substitute secrets and prevent others from reading the result
# if somehow $CREDENTIALS_DIRECTORY is not set we fail
nixos/modules/services/web-apps/limesurvey.nix
+2 -2
View File
@@ -413,7 +413,7 @@ in
systemd.services.limesurvey-init = {
wantedBy = [ "multi-user.target" ];
before = [ "phpfpm-limesurvey.service" ];
after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
environment.DBENGINE = "${cfg.database.dbEngine}";
environment.LIMESURVEY_CONFIG = limesurveyConfig;
script = ''
@@ -444,7 +444,7 @@ in
systemd.services.httpd.after =
optional mysqlLocal "mysql.service"
++ optional pgsqlLocal "postgresql.service";
++ optional pgsqlLocal "postgresql.target";
users.users.${user} = {
group = group;
nixos/modules/services/web-apps/mastodon.nix
+11 -11
View File
@@ -126,10 +126,10 @@ let
SystemCallArchitectures = "native";
};
# Services that all Mastodon units After= and Requires= on
commonServices =
# Units that all Mastodon units After= and Requires= on
commonUnits =
lib.optional redisActuallyCreateLocally "redis-mastodon.service"
++ lib.optional databaseActuallyCreateLocally "postgresql.service"
++ lib.optional databaseActuallyCreateLocally "postgresql.target"
++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
envFile = pkgs.writeText "mastodon.env" (
@@ -170,8 +170,8 @@ let
after = [
"network.target"
"mastodon-init-dirs.service"
] ++ commonServices;
requires = [ "mastodon-init-dirs.service" ] ++ commonServices;
] ++ commonUnits;
requires = [ "mastodon-init-dirs.service" ] ++ commonUnits;
description = "Mastodon sidekiq${jobClassLabel}";
wantedBy = [ "mastodon.target" ];
environment = env // {
@@ -209,8 +209,8 @@ let
after = [
"network.target"
"mastodon-init-dirs.service"
] ++ commonServices;
requires = [ "mastodon-init-dirs.service" ] ++ commonServices;
] ++ commonUnits;
requires = [ "mastodon-init-dirs.service" ] ++ commonUnits;
wantedBy = [
"mastodon.target"
"mastodon-streaming.target"
@@ -998,18 +998,18 @@ in
after = [
"network.target"
"mastodon-init-dirs.service"
] ++ lib.optional databaseActuallyCreateLocally "postgresql.service";
] ++ lib.optional databaseActuallyCreateLocally "postgresql.target";
requires = [
"mastodon-init-dirs.service"
] ++ lib.optional databaseActuallyCreateLocally "postgresql.service";
] ++ lib.optional databaseActuallyCreateLocally "postgresql.target";
};
systemd.services.mastodon-web = {
after = [
"network.target"
"mastodon-init-dirs.service"
] ++ commonServices;
requires = [ "mastodon-init-dirs.service" ] ++ commonServices;
] ++ commonUnits;
requires = [ "mastodon-init-dirs.service" ] ++ commonUnits;
wantedBy = [ "mastodon.target" ];
description = "Mastodon web";
environment =
nixos/modules/services/web-apps/mattermost.nix
+2 -2
View File
@@ -840,7 +840,7 @@ in
wantedBy = [ "multi-user.target" ];
after = mkMerge [
[ "network.target" ]
(mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.service" ])
(mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.target" ])
(mkIf (cfg.database.driver == "mysql" && cfg.database.create) [ "mysql.service" ])
];
requires = after;
@@ -946,7 +946,7 @@ in
];
unitConfig.JoinsNamespaceOf = mkMerge [
(mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.service" ])
(mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.target" ])
(mkIf (cfg.database.driver == "mysql" && cfg.database.create) [ "mysql.service" ])
];
};
nixos/modules/services/web-apps/mealie.nix
+2 -2
View File
@@ -66,8 +66,8 @@ in
systemd.services.mealie = {
description = "Mealie, a self hosted recipe manager and meal planner";
after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.service";
requires = lib.optional cfg.database.createLocally "postgresql.service";
after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
requires = lib.optional cfg.database.createLocally "postgresql.target";
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
nixos/modules/services/web-apps/mediagoblin.nix
+2 -2
View File
@@ -339,11 +339,11 @@ in
mediagoblin-paster = lib.recursiveUpdate serviceDefaults {
after = [
"mediagoblin-celeryd.service"
"postgresql.service"
"postgresql.target"
];
requires = [
"mediagoblin-celeryd.service"
"postgresql.service"
"postgresql.target"
];
preStart = ''
cp --remove-destination ${pasteConfig} /var/lib/mediagoblin/paste.ini
nixos/modules/services/web-apps/mediawiki.nix
+2 -2
View File
@@ -707,7 +707,7 @@ in
before = [ "phpfpm-mediawiki.service" ];
after =
optional (cfg.database.type == "mysql" && cfg.database.createLocally) "mysql.service"
++ optional (cfg.database.type == "postgres" && cfg.database.createLocally) "postgresql.service";
++ optional (cfg.database.type == "postgres" && cfg.database.createLocally) "postgresql.target";
script = ''
if ! test -e "${stateDir}/secret.key"; then
tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c 64 > ${stateDir}/secret.key
@@ -754,7 +754,7 @@ in
) "mysql.service"
++ optional (
cfg.webserver == "apache" && cfg.database.createLocally && cfg.database.type == "postgres"
) "postgresql.service";
) "postgresql.target";
users.users.${user} = {
inherit group;
nixos/modules/services/web-apps/miniflux.nix
+3 -3
View File
@@ -107,10 +107,10 @@ in
systemd.services.miniflux-dbsetup = lib.mkIf cfg.createDatabaseLocally {
description = "Miniflux database setup";
requires = [ "postgresql.service" ];
requires = [ "postgresql.target" ];
after = [
"network.target"
"postgresql.service"
"postgresql.target"
];
serviceConfig = {
Type = "oneshot";
@@ -126,7 +126,7 @@ in
after =
[ "network.target" ]
++ lib.optionals cfg.createDatabaseLocally [
"postgresql.service"
"postgresql.target"
"miniflux-dbsetup.service"
];
nixos/modules/services/web-apps/misskey.nix
+1 -1
View File
@@ -319,7 +319,7 @@ in
systemd.services.misskey = {
after = [
"network-online.target"
"postgresql.service"
"postgresql.target"
];
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
nixos/modules/services/web-apps/mobilizon.nix
+1 -1
View File
@@ -366,7 +366,7 @@ in
systemd.services.mobilizon-postgresql = mkIf isLocalPostgres {
description = "Mobilizon PostgreSQL setup";
after = [ "postgresql.service" ];
after = [ "postgresql.target" ];
before = [
"mobilizon.service"
"mobilizon-setup-secrets.service"
nixos/modules/services/web-apps/moodle.nix
+2 -2
View File
@@ -351,7 +351,7 @@ in
systemd.services.moodle-init = {
wantedBy = [ "multi-user.target" ];
before = [ "phpfpm-moodle.service" ];
after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
environment.MOODLE_CONFIG = moodleConfig;
script = ''
${phpExt}/bin/php ${cfg.package}/share/moodle/admin/cli/check_database_schema.php && rc=$? || rc=$?
@@ -394,7 +394,7 @@ in
systemd.services.httpd.after =
optional mysqlLocal "mysql.service"
++ optional pgsqlLocal "postgresql.service";
++ optional pgsqlLocal "postgresql.target";
users.users.${user} = {
group = group;
nixos/modules/services/web-apps/movim.nix
+8 -8
View File
@@ -165,9 +165,9 @@ let
fpm = config.services.phpfpm.pools.${pool};
phpExecutionUnit = "phpfpm-${pool}";
dbService =
dbUnit =
{
"postgresql" = "postgresql.service";
"postgresql" = "postgresql.target";
"mariadb" = "mysql.service";
}
.${cfg.database.type};
@@ -843,8 +843,8 @@ in
requiredBy = [ "${phpExecutionUnit}.service" ];
before = [ "${phpExecutionUnit}.service" ];
wants = [ "local-fs.target" ];
requires = lib.optional cfg.database.createLocally dbService;
after = lib.optional cfg.database.createLocally dbService;
requires = lib.optional cfg.database.createLocally dbUnit;
after = lib.optional cfg.database.createLocally dbUnit;
serviceConfig =
{
@@ -899,8 +899,8 @@ in
requiredBy = [ "movim.service" ];
before = [ "movim.service" ] ++ lib.optional (webServerService != null) webServerService;
wants = [ "network.target" ];
requires = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
after = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
requires = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbUnit;
after = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbUnit;
};
services.movim = {
@@ -915,14 +915,14 @@ in
"movim-data-setup.service"
"${phpExecutionUnit}.service"
]
++ lib.optional cfg.database.createLocally dbService
++ lib.optional cfg.database.createLocally dbUnit
++ lib.optional (webServerService != null) webServerService;
after =
[
"movim-data-setup.service"
"${phpExecutionUnit}.service"
]
++ lib.optional cfg.database.createLocally dbService
++ lib.optional cfg.database.createLocally dbUnit
++ lib.optional (webServerService != null) webServerService;
environment = {
PUBLIC_URL = "//${cfg.domain}";
nixos/modules/services/web-apps/netbox.nix
+8 -1
View File
@@ -39,7 +39,14 @@ let
(writeScriptBin "netbox-manage" ''
#!${stdenv.shell}
export PYTHONPATH=${pkg.pythonPath}
sudo -u netbox ${pkg}/bin/netbox "$@"
case "$(whoami)" in
"root")
${util-linux}/bin/runuser -u netbox -- ${pkg}/bin/netbox "$@";;
"netbox")
${pkg}/bin/netbox "$@";;
*)
echo "This must be run by either by root 'netbox' user"
esac
'');
in
nixos/modules/services/web-apps/nextcloud.nix
+2 -2
View File
@@ -1167,8 +1167,8 @@ in
wantedBy = [ "multi-user.target" ];
wants = [ "nextcloud-update-db.service" ];
before = [ "phpfpm-nextcloud.service" ];
after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
requires = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
requires = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
path = [ occ ];
restartTriggers = [ overrideConfig ];
script = ''
nixos/modules/services/web-apps/nipap.nix
+2 -2
View File
@@ -234,8 +234,8 @@ in
after = [
"network.target"
"systemd-tmpfiles-setup.service"
] ++ lib.optional (cfg.settings.nipapd.db_host == "") "postgresql.service";
requires = lib.optional (cfg.settings.nipapd.db_host == "") "postgresql.service";
] ++ lib.optional (cfg.settings.nipapd.db_host == "") "postgresql.target";
requires = lib.optional (cfg.settings.nipapd.db_host == "") "postgresql.target";
wantedBy = [ "multi-user.target" ];
preStart = lib.optionalString (cfg.settings.auth.default_backend == defaultAuthBackend) ''
# Create/upgrade local auth database
nixos/modules/services/web-apps/onlyoffice.nix
+4 -4
View File
@@ -235,12 +235,12 @@ in
after = [
"network.target"
"onlyoffice-docservice.service"
"postgresql.service"
"postgresql.target"
];
requires = [
"network.target"
"onlyoffice-docservice.service"
"postgresql.service"
"postgresql.target"
];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
@@ -314,9 +314,9 @@ in
description = "onlyoffice documentserver";
after = [
"network.target"
"postgresql.service"
"postgresql.target"
];
requires = [ "postgresql.service" ];
requires = [ "postgresql.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${cfg.package.fhs}/bin/onlyoffice-wrapper DocService/docservice /run/onlyoffice/config";
nixos/modules/services/web-apps/outline.nix
+2 -2
View File
@@ -634,10 +634,10 @@ in
wantedBy = [ "multi-user.target" ];
after =
[ "networking.target" ]
++ lib.optional (cfg.databaseUrl == "local") "postgresql.service"
++ lib.optional (cfg.databaseUrl == "local") "postgresql.target"
++ lib.optional (cfg.redisUrl == "local") "redis-outline.service";
requires =
lib.optional (cfg.databaseUrl == "local") "postgresql.service"
lib.optional (cfg.databaseUrl == "local") "postgresql.target"
++ lib.optional (cfg.redisUrl == "local") "redis-outline.service";
path = [
pkgs.openssl # Required by the preStart script
nixos/modules/services/web-apps/part-db.nix
+3 -3
View File
@@ -195,8 +195,8 @@ in
services = {
part-db-migrate = {
before = [ "phpfpm-part-db.service" ];
after = [ "postgresql.service" ];
requires = [ "postgresql.service" ];
after = [ "postgresql.target" ];
requires = [ "postgresql.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
@@ -216,7 +216,7 @@ in
after = [ "part-db-migrate.service" ];
requires = [
"part-db-migrate.service"
"postgresql.service"
"postgresql.target"
];
# ensure nginx can access the php-fpm socket
postStart = ''
nixos/modules/services/web-apps/peertube.nix
+4 -4
View File
@@ -439,9 +439,9 @@ in
description = "Initialization database for PeerTube daemon";
after = [
"network.target"
"postgresql.service"
"postgresql.target"
];
requires = [ "postgresql.service" ];
requires = [ "postgresql.target" ];
script =
let
@@ -475,13 +475,13 @@ in
[ "network.target" ]
++ lib.optional cfg.redis.createLocally "redis-peertube.service"
++ lib.optionals cfg.database.createLocally [
"postgresql.service"
"postgresql.target"
"peertube-init-db.service"
];
requires =
lib.optional cfg.redis.createLocally "redis-peertube.service"
++ lib.optionals cfg.database.createLocally [
"postgresql.service"
"postgresql.target"
"peertube-init-db.service"
];
wantedBy = [ "multi-user.target" ];
nixos/modules/services/web-apps/pixelfed.nix
+6 -6
View File
@@ -53,9 +53,9 @@ let
"mysql" = "/run/mysqld/mysqld.sock";
}
.${cfg.database.type};
dbService =
dbUnit =
{
"pgsql" = "postgresql.service";
"pgsql" = "postgresql.target";
"mysql" = "mysql.service";
}
.${cfg.database.type};
@@ -355,7 +355,7 @@ in
"pixelfed-horizon.service"
"pixelfed-data-setup.service"
]
++ lib.optional cfg.database.createLocally dbService
++ lib.optional cfg.database.createLocally dbUnit
++ lib.optional cfg.redis.createLocally redisService;
# Ensure image optimizations programs are available.
systemd.services.phpfpm-pixelfed.path = extraPrograms;
@@ -368,7 +368,7 @@ in
];
requires =
[ "pixelfed-data-setup.service" ]
++ (lib.optional cfg.database.createLocally dbService)
++ (lib.optional cfg.database.createLocally dbUnit)
++ (lib.optional cfg.redis.createLocally redisService);
wantedBy = [ "multi-user.target" ];
# Ensure image optimizations programs are available.
@@ -412,8 +412,8 @@ in
systemd.services.pixelfed-data-setup = {
description = "Pixelfed setup: migrations, environment file update, cache reload, data changes";
wantedBy = [ "multi-user.target" ];
after = lib.optional cfg.database.createLocally dbService;
requires = lib.optional cfg.database.createLocally dbService;
after = lib.optional cfg.database.createLocally dbUnit;
requires = lib.optional cfg.database.createLocally dbUnit;
path =
with pkgs;
[
nixos/modules/services/web-apps/plausible.nix
+3 -3
View File
@@ -196,13 +196,13 @@ in
after =
optional cfg.database.clickhouse.setup "clickhouse.service"
++ optionals cfg.database.postgres.setup [
"postgresql.service"
"postgresql.target"
"plausible-postgres.service"
];
requires =
optional cfg.database.clickhouse.setup "clickhouse.service"
++ optionals cfg.database.postgres.setup [
"postgresql.service"
"postgresql.target"
"plausible-postgres.service"
];
@@ -309,7 +309,7 @@ in
(mkIf cfg.database.postgres.setup {
# `plausible' requires the `citext'-extension.
plausible-postgres = {
after = [ "postgresql.service" ];
after = [ "postgresql.target" ];
partOf = [ "plausible.service" ];
serviceConfig = {
Type = "oneshot";
nixos/modules/services/web-apps/pretalx.nix
+2 -2
View File
@@ -434,7 +434,7 @@ in
"redis-pretalx.service"
]
++ lib.optionals (cfg.settings.database.backend == "postgresql") [
"postgresql.service"
"postgresql.target"
]
++ lib.optionals (cfg.settings.database.backend == "mysql") [
"mysql.service"
@@ -484,7 +484,7 @@ in
"redis-pretalx.service"
]
++ lib.optionals (cfg.settings.database.backend == "postgresql") [
"postgresql.service"
"postgresql.target"
]
++ lib.optionals (cfg.settings.database.backend == "mysql") [
"mysql.service"
nixos/modules/services/web-apps/pretix.nix
+2 -2
View File
@@ -533,7 +533,7 @@ in
after = [
"network.target"
"redis-pretix.service"
"postgresql.service"
"postgresql.target"
];
wantedBy = [ "multi-user.target" ];
preStart = ''
@@ -574,7 +574,7 @@ in
after = [
"network.target"
"redis-pretix.service"
"postgresql.service"
"postgresql.target"
];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
nixos/modules/services/web-apps/reposilite.nix
+1 -1
View File
@@ -398,7 +398,7 @@ in
after =
[ "network.target" ]
++ (lib.optional useMySQL "mysql.service")
++ (lib.optional usePostgres "postgresql.service");
++ (lib.optional usePostgres "postgresql.target");
script =
lib.optionalString (cfg.keyPasswordFile != null && cfg.settings.keyPassword == null) ''
nixos/modules/services/web-apps/shiori.nix
+1 -1
View File
@@ -62,7 +62,7 @@ in
description = "Shiori simple bookmarks manager";
wantedBy = [ "multi-user.target" ];
after = [
"postgresql.service"
"postgresql.target"
"mysql.service"
];
environment =

Some files were not shown because too many files have changed in this diff Show More