gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'master' into tailwindcss_4

Browse Source
This commit is contained in:
adamjhf
2025-02-16 09:48:52 +11:00
parent 57d4ad52cc d60e490d92
commit 326f719bd3
2309 changed files with 40365 additions and 96942 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/backport.yml
+1 -1
View File
@@ -19,7 +19,7 @@ jobs:
steps:
# Use a GitHub App to create the PR so that CI gets triggered
# The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
- uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
- uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
id: app-token
with:
app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
.github/workflows/codeowners-v2.yml
+2 -2
View File
@@ -63,7 +63,7 @@ jobs:
- name: Build codeowners validator
run: nix-build base/ci -A codeownersValidator
- uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
- uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
id: app-token
with:
app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -96,7 +96,7 @@ jobs:
# This is intentional, because we need to request the review of owners as declared in the base branch.
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
- uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
id: app-token
with:
app-id: ${{ vars.OWNER_APP_ID }}
.github/workflows/eval-lib-tests.yml
+1
View File
@@ -4,6 +4,7 @@ on:
pull_request_target:
paths:
- 'lib/**'
- 'maintainers/**'
permissions: {}
.github/workflows/eval.yml
+1 -1
View File
@@ -241,7 +241,7 @@ jobs:
steps:
# See ./codeowners-v2.yml, reuse the same App because we need the same permissions
# Can't use the token received from permissions above, because it can't get enough permissions
- uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
- uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
id: app-token
with:
app-id: ${{ vars.OWNER_APP_ID }}
.github/workflows/periodic-merge.yml
+1 -1
View File
@@ -19,7 +19,7 @@ jobs:
steps:
# Use a GitHub App to create the PR so that CI gets triggered
# The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
- uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
- uses: actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v1.11.3
id: app-token
with:
app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
.mailmap
+1
View File
@@ -5,6 +5,7 @@ Christina Sørensen <christina@cafkafk.com>
Christina Sørensen <christina@cafkafk.com> <christinaafk@gmail.com>
Christina Sørensen <christina@cafkafk.com> <89321978+cafkafk@users.noreply.github.com>
Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
Ethan Carter Edwards <ethan@ethancedwards.com> Ethan Edwards <ethancarteredwards@gmail.com>
Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
Fiona Behrens <me@kloenk.dev>
Fiona Behrens <me@kloenk.dev> <me@kloenk.de>
ci/OWNERS
+1
View File
@@ -253,6 +253,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
/nixos/tests/postgresql @NixOS/postgres
# MySQL/MariaDB and related stuff
/nixos/modules/services/databases/mysql.nix @6543
/nixos/modules/services/backup/mysql-backup.nix @6543
# Hardened profile & related modules
ci/eval/compare/maintainers.nix
+5 -2
View File
@@ -24,8 +24,11 @@ let
pkg:
if (lib.attrsets.hasAttrByPath pkg.path pkgs) then
(
if (builtins.tryEval (lib.attrsets.attrByPath pkg.path null pkgs)).success then
true
let
value = lib.attrsets.attrByPath pkg.path null pkgs;
in
if (builtins.tryEval value).success then
if value != null then true else builtins.trace "${pkg.name} exists but is null" false
else
builtins.trace "Failed to access ${pkg.name} even though it exists" false
)
ci/eval/default.nix
+11 -3
View File
@@ -87,8 +87,10 @@ let
export NIX_SHOW_STATS_PATH="$outputDir/stats/$myChunk"
echo "Chunk $myChunk on $system start"
set +e
command time -f "Chunk $myChunk on $system done [%MKB max resident, %Es elapsed] %C" \
command time -o "$outputDir/timestats/$myChunk" \
-f "Chunk $myChunk on $system done [%MKB max resident, %Es elapsed] %C" \
nix-env -f "${nixpkgs}/pkgs/top-level/release-attrpaths-parallel.nix" \
--eval-system "$system" \
--option restrict-eval true \
--option allow-import-from-derivation false \
--query --available \
@@ -102,13 +104,19 @@ let
--arg includeBroken ${lib.boolToString includeBroken} \
-I ${nixpkgs} \
-I ${attrpathFile} \
> "$outputDir/result/$myChunk"
> "$outputDir/result/$myChunk" \
2> "$outputDir/stderr/$myChunk"
exitCode=$?
set -e
cat "$outputDir/stderr/$myChunk"
cat "$outputDir/timestats/$myChunk"
if (( exitCode != 0 )); then
echo "Evaluation failed with exit code $exitCode"
# This immediately halts all xargs processes
kill $PPID
elif [[ -s "$outputDir/stderr/$myChunk" ]]; then
echo "Nixpkgs on $system evaluated with warnings, aborting"
kill $PPID
fi
'';
in
@@ -164,7 +172,7 @@ let
''}
chunkOutputDir=$(mktemp -d)
mkdir "$chunkOutputDir"/{result,stats}
mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}
seq -w 0 "$seq_end" |
command time -f "%e" -o "$out/total-time" \
doc/languages-frameworks/rust.section.md
-11
View File
@@ -461,17 +461,6 @@ also be used:
the `Cargo.lock`/`Cargo.toml` files need to be patched before
vendoring.
In case the lockfile contains cargo `git` dependencies, you can use
`fetchCargoVendor` instead.
```nix
{
cargoDeps = rustPlatform.fetchCargoVendor {
inherit src;
hash = "sha256-RqPVFovDaD2rW31HyETJfQ0qVwFxoGEvqkIgag3H6KU=";
};
}
```
If a `Cargo.lock` file is available, you can alternatively use the
`importCargoLock` function. In contrast to `fetchCargoVendor`, this
function does not require a hash (unless git dependencies are used)
doc/module-system/module-system.chapter.md
+9
View File
@@ -31,6 +31,15 @@ An attribute set of module arguments that can be used in `imports`.
This is in contrast to `config._module.args`, which is only available after all `imports` have been resolved.
::: {.warning}
You may be tempted to use `specialArgs.lib` to provide extra library functions. Doing so limits the interoperability of modules, as well as the interoperability of Module System applications.
`lib` is reserved for the Nixpkgs library, and should not be used for custom functions.
Instead, you may create a new attribute in `specialArgs` to provide custom functions.
This clarifies their origin and avoids incompatibilities.
:::
#### `class` {#module-system-lib-evalModules-param-class}
If the `class` attribute is set and non-`null`, the module system will reject `imports` with a different `_class` declaration.
doc/redirects.json
+3
View File
@@ -86,6 +86,9 @@
"index.html#building-a-titanium-app",
"index.html#emulating-or-simulating-the-app"
],
"sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded": [
"release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded"
],
"sec-nixpkgs-release-25.05-lib": [
"release-notes.html#sec-nixpkgs-release-25.05-lib"
],
doc/release-notes/rl-2505.section.md
+10
View File
@@ -18,6 +18,16 @@
- `titaniumenv`, `titanium`, and `titanium-alloy` have been removed due to lack of maintenance in Nixpkgs.
### NexusMods.App upgraded {#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded}
- `nexusmods-app` has been upgraded from version 0.6.3 to 0.7.3.
- Before upgrading, you **must reset all app state** (mods, games, settings, etc). NexusMods.App will crash if any state from a version older than 0.7.0 is still present.
- Typically, you can can reset to a clean state by running `NexusMods.App uninstall-app`. See Nexus Mod's [how to uninstall the app](https://nexus-mods.github.io/NexusMods.App/users/Uninstall) documentation for more detail and alternative methods.
- This should not be necessary going forward, because loading app state from 0.7.0 or newer is now supported. This is documented in the [0.7.1 changelog](https://github.com/Nexus-Mods/NexusMods.App/releases/tag/v0.7.1).
## Nixpkgs Library {#sec-nixpkgs-release-25.05-lib}
### Breaking changes {#sec-nixpkgs-release-25.05-lib-breaking}
flake.nix
+2
View File
@@ -24,6 +24,8 @@
- `lib.nixos` for other NixOS-provided functionality, such as [`runTest`](https://nixos.org/manual/nixos/unstable/#sec-call-nixos-test-outside-nixos)
*/
# DON'T USE lib.extend TO ADD NEW FUNCTIONALITY.
# THIS WAS A MISTAKE. See the warning in lib/default.nix.
lib = lib.extend (final: prev: {
/**
lib/attrsets.nix
+2 -2
View File
@@ -17,7 +17,7 @@ rec {
/**
Return an attribute from nested attribute sets.
Nix has an [attribute selection operator `. or`](https://nixos.org/manual/nix/stable/language/operators#attribute-selection) which is sufficient for such queries, as long as the number of attributes is static. For example:
Nix has an [attribute selection operator `.`](https://nixos.org/manual/nix/stable/language/operators#attribute-selection) which is sufficient for such queries, as long as the number of attributes is static. For example:
```nix
(x.a.b or 6) == attrByPath ["a" "b"] 6 x
@@ -319,7 +319,7 @@ rec {
getAttrFromPath =
attrPath:
set:
attrByPath attrPath (abort ("cannot find attribute `" + concatStringsSep "." attrPath + "'")) set;
attrByPath attrPath (abort ("cannot find attribute '" + concatStringsSep "." attrPath + "'")) set;
/**
Map each attribute in the given set and merge them into a new attribute set.
lib/default.nix
+34 -2
View File
@@ -5,9 +5,41 @@
*/
let
inherit (import ./fixed-points.nix { inherit lib; }) makeExtensible;
# A copy of `lib.makeExtensible'` in order to document `extend`.
# It has been leading to some trouble, so we have to document it specially.
makeExtensible' =
rattrs:
let self = rattrs self // {
/**
Patch the Nixpkgs library
lib = makeExtensible (self: let
A function that applies patches onto the nixpkgs library.
Usage is discouraged for most scenarios.
:::{.note}
The name `extends` is a bit misleading, as it doesn't actually extend the library, but rather patches it.
It is merely a consequence of being implemented by `makeExtensible`.
:::
# Inputs
- An "extension function" `f` that returns attributes that will be updated in the returned Nixpkgs library.
# Output
A patched Nixpkgs library.
:::{.warning}
This functionality is intended as an escape hatch for when the provided version of the Nixpkgs library has a flaw.
If you were to use it to add new functionality, you will run into compatibility and interoperability issues.
:::
*/
extend = f: lib.makeExtensible (lib.extends f rattrs);
};
in self;
lib = makeExtensible' (self: let
callLibs = file: import file { lib = self; };
in {
lib/modules.nix
+8 -1
View File
@@ -367,7 +367,14 @@ let
if m._class == null || m._class == class
then m
else
throw "The module ${m._file or m.key} was imported into ${class} instead of ${m._class}."
throw ''
The module `${m._file or m.key}` (class: ${lib.strings.escapeNixString m._class}) cannot be imported into a module evaluation that expects class ${lib.strings.escapeNixString class}.
Help:
- Ensure that you are importing the correct module.
- Verify that the module's `_class`, ${lib.strings.escapeNixString m._class} matches the expected `class` ${lib.strings.escapeNixString class}.
- If you are using a custom class, make sure it is correctly defined and used consistently across your modules.
''
else
m: m;
lib/systems/architectures.nix
+2
View File
@@ -40,6 +40,7 @@ rec {
znver2 = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2" "fma" ];
znver3 = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2" "fma" ];
znver4 = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2" "avx512" "fma" ];
znver5 = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2" "avx512" "fma" ];
# other
armv5te = [ ];
armv6 = [ ];
@@ -113,6 +114,7 @@ rec {
znver2 = [ "znver1" ] ++ inferiors.znver1;
znver3 = [ "znver2" ] ++ inferiors.znver2;
znver4 = lib.unique ([ "znver3" "x86-64-v4" ] ++ inferiors.znver3 ++ inferiors.x86-64-v4);
znver5 = [ "znver4" ] ++ inferiors.znver4;
# other
armv5te = [ ];
lib/tests/misc.nix
+41
View File
@@ -2612,4 +2612,45 @@ runTests {
};
expected = "c";
};
testMergeTypesSimple =
let
mergedType = types.mergeTypes types.str types.str;
in
{
expr = mergedType.name;
expected = "str";
};
testMergeTypesFail =
let
mergedType = types.mergeTypes types.str types.int;
in
{
expr = types.isType "merge-error" mergedType;
expected = true;
};
testMergeTypesEnum =
let
enumAB = lib.types.enum ["A" "B"];
enumXY = lib.types.enum ["X" "Y"];
merged = lib.types.mergeTypes enumAB enumXY; # -> enum [ "A" "B" "X" "Y" ]
in
{
expr = {
checkA = merged.check "A";
checkB = merged.check "B";
checkX = merged.check "X";
checkY = merged.check "Y";
checkC = merged.check "C";
};
expected = {
checkA = true;
checkB = true;
checkX = true;
checkY = true;
checkC = false;
};
};
}
lib/tests/modules.sh
+3 -3
View File
@@ -538,12 +538,12 @@ checkConfigOutput '^1$' config.sub.specialisation.value ./extendModules-168767-i
# Class checks, evalModules
checkConfigOutput '^{}$' config.ok.config ./class-check.nix
checkConfigOutput '"nixos"' config.ok.class ./class-check.nix
checkConfigError 'The module .*/module-class-is-darwin.nix was imported into nixos instead of darwin.' config.fail.config ./class-check.nix
checkConfigError 'The module foo.nix#darwinModules.default was imported into nixos instead of darwin.' config.fail-anon.config ./class-check.nix
checkConfigError 'The module `.*/module-class-is-darwin.nix`.*?expects class "nixos".' config.fail.config ./class-check.nix
checkConfigError 'The module `foo.nix#darwinModules.default`.*?expects class "nixos".' config.fail-anon.config ./class-check.nix
# Class checks, submoduleWith
checkConfigOutput '^{}$' config.sub.nixosOk ./class-check.nix
checkConfigError 'The module .*/module-class-is-darwin.nix was imported into nixos instead of darwin.' config.sub.nixosFail.config ./class-check.nix
checkConfigError 'The module `.*/module-class-is-darwin.nix`.*?expects class "nixos".' config.sub.nixosFail.config ./class-check.nix
# submoduleWith type merge with different class
checkConfigError 'A submoduleWith option is declared multiple times with conflicting class values "darwin" and "nixos".' config.sub.mergeFail.config ./class-check.nix
lib/types.nix
+47
View File
@@ -1125,6 +1125,53 @@ rec {
addCheck = elemType: check: elemType // { check = x: elemType.check x && check x; };
};
/**
Merges two option types together.
:::{.note}
Uses the type merge function of the first type, to merge it with the second type.
Usually types can only be merged if they are of the same type
:::
# Inputs
: `a` (option type): The first option type.
: `b` (option type): The second option type.
# Returns
- The merged option type.
- `{ _type = "merge-error"; error = "Cannot merge types"; }` if the types can't be merged.
# Examples
:::{.example}
## `lib.types.mergeTypes` usage example
```nix
let
enumAB = lib.types.enum ["A" "B"];
enumXY = lib.types.enum ["X" "Y"];
# This operation could be notated as: [ A ] | [ B ] -> [ A B ]
merged = lib.types.mergeTypes enumAB enumXY; # -> enum [ "A" "B" "X" "Y" ]
in
assert merged.check "A"; # true
assert merged.check "B"; # true
assert merged.check "X"; # true
assert merged.check "Y"; # true
merged.check "C" # false
```
:::
*/
mergeTypes = a: b:
assert isOptionType a && isOptionType b;
let
merged = a.typeMerge b.functor;
in
if merged == null then
setType "merge-error" { error = "Cannot merge types"; }
else
merged;
};
in outer_types // outer_types.types
maintainers/maintainer-list.nix
+130 -8
View File
@@ -505,6 +505,18 @@
githubId = 1517066;
name = "Aiken Cairncross";
};
acaloiaro = {
email = "code@adriano.fyi";
githubId = 3331648;
github = "acaloiaro";
matrix = "@adriano@beeper.com";
name = "Adriano Caloiaro";
keys = [
{
fingerprint = "DCBD 2175 8A30 9C1F 41D7 A0FC 890F FDB1 1860 FE1C";
}
];
};
a-camarillo = {
name = "Anthony Camarillo";
email = "anthony.camarillo.96@gmail.com";
@@ -562,11 +574,6 @@
githubId = 2071575;
name = "Adam C. Stephens";
};
adamjhf = {
github = "adamjhf";
githubId = 50264672;
name = "Adam Freeth";
};
adamt = {
email = "mail@adamtulinius.dk";
github = "adamtulinius";
@@ -2024,6 +2031,12 @@
githubId = 21687187;
name = "Mirza Arnaut";
};
asappia = {
email = "asappia@gmail.com";
github = "asappia";
githubId = 891399;
name = "Alessandro Sappia";
};
asbachb = {
email = "asbachb-nixpkgs-5c2a@impl.it";
matrix = "@asbachb:matrix.org";
@@ -2740,6 +2753,12 @@
githubId = 34620799;
name = "Jacob Bachmann";
};
bcooley = {
email = "bradley.m.cooley@gmail.com";
github = "Bradley-Cooley";
githubId = 5409401;
name = "Bradley Cooley";
};
bcyran = {
email = "bazyli@cyran.dev";
github = "bcyran";
@@ -3046,6 +3065,12 @@
githubId = 19915050;
name = "binarycat";
};
binarydigitz01 = {
email = "binarydigitz01@protonmail.com";
github = "binarydigitz01";
githubId = 47600778;
name = "Arnav Vijaywargiya";
};
binary-eater = {
email = "sergeantsagara@protonmail.com";
github = "Binary-Eater";
@@ -4039,6 +4064,12 @@
githubId = 6608071;
name = "Charles Huyghues-Despointes";
};
charlieegan3 = {
email = "git@charlieegan3.com";
github = "charlieegan3";
githubId = 1774239;
name = "Charlie Egan";
};
chayleaf = {
email = "chayleaf-nix@pavluk.org";
github = "chayleaf";
@@ -7473,6 +7504,12 @@
name = "A Frederick Christensen";
keys = [ { fingerprint = "5A49 F4F9 3EDC 21E9 B7CC 4E94 9EEF 4142 5355 8AC4"; } ];
};
fazzi = {
email = "faaris.ansari@proton.me";
github = "fxzzi";
githubId = 18248986;
name = "Faaris Ansari";
};
fbeffa = {
email = "beffa@fbengineering.ch";
github = "fedeinthemix";
@@ -8197,6 +8234,12 @@
name = "Florian Brandes";
keys = [ { fingerprint = "0200 3EF8 8D2B CF2D 8F00 FFDC BBB3 E40E 5379 7FD9"; } ];
};
gaelj = {
name = "Gaël James";
email = "gaeljames@gmail.com";
github = "gaelj";
githubId = 8884632;
};
gaelreyrol = {
email = "me@gaelreyrol.dev";
matrix = "@Zevran:matrix.org";
@@ -9913,6 +9956,11 @@
github = "ilyakooo0";
githubId = 6209627;
};
ilys = {
name = "ilys";
github = "ilyist";
githubId = 185637611;
};
imadnyc = {
email = "me@imad.nyc";
github = "imadnyc";
@@ -10716,7 +10764,7 @@
name = "Jeffrey David Johnson";
};
jefflabonte = {
email = "grimsleepless@protonmail.com";
email = "jean-francois.labonte@brightonlabs.ai";
github = "JeffLabonte";
githubId = 9425955;
name = "Jean-François Labonté";
@@ -10955,6 +11003,11 @@
githubId = 691552;
name = "Jamie McClymont";
};
jjtt = {
github = "jjtt";
githubId = 3908945;
name = "Juho Törmä";
};
jk = {
email = "hello+nixpkgs@j-k.io";
matrix = "@j-k:matrix.org";
@@ -11377,6 +11430,12 @@
github = "jordanisaacs";
githubId = 19742638;
};
jorikvanveen = {
email = "vanveenjorik@protonmail.com";
github = "jorikvanveen";
githubId = 33939820;
name = "Jorik van Veen";
};
jorise = {
email = "info@jorisengbers.nl";
github = "JorisE";
@@ -12504,6 +12563,12 @@
githubId = 787421;
name = "Kevin Quick";
};
kr7x = {
name = "Carlos Reyes";
email = "carlosreyesml18@gmail.com";
github = "K4rlosReyes";
githubId = 108368394;
};
kraanzu = {
name = "Murli Tawari";
email = "kraanzu@gmail.com";
@@ -16298,6 +16363,12 @@
githubId = 1859691;
name = "Amedeo Molnár";
};
nekitdev = {
email = "nekit@nekit.dev";
github = "nekitdev";
githubId = 43587167;
name = "Nikita Tikhonov";
};
nelsonjeppesen = {
email = "nix@jeppesen.io";
github = "NelsonJeppesen";
@@ -16643,6 +16714,13 @@
github = "nipeharefa";
githubId = 12620257;
};
niraethm = {
name = "Rémi Akirazar";
email = "randormi@devcpu.co";
matrix = "@lysgonul:bark.lgbt";
github = "niraethm";
githubId = 20865531;
};
NIS = {
name = "NSC IT Solutions";
github = "dev-nis";
@@ -16923,6 +17001,13 @@
githubId = 30942198;
name = "Noah Snelson";
};
ntbbloodbath = {
email = "bloodbathalchemist@protonmail.com";
matrix = "@ntbbloodbath:matrix.org";
github = "ntbbloodbath";
githubId = 36456999;
name = "Alejandro Martin";
};
nthorne = {
email = "notrupertthorne@gmail.com";
github = "nthorne";
@@ -16944,7 +17029,7 @@
nullcube = {
email = "nullcub3@gmail.com";
name = "NullCube";
github = "nullcub3";
github = "nullcubee";
githubId = 51034487;
matrix = "@nullcube:matrix.org";
};
@@ -17223,6 +17308,12 @@
githubId = 72201;
name = "Ole Jørgen Brønner";
};
olemussmann = {
email = "nixpkgs-account@ole.mn";
github = "OleMussmann";
githubId = 14004859;
name = "Ole Mussmann";
};
olifloof = {
email = "benmoreosm@gmail.com";
github = "olifloof";
@@ -18157,6 +18248,12 @@
githubId = 301903;
name = "Chip Collier";
};
phrmendes = {
name = "Pedro Mendes";
email = "pedrohrmendes@proton.me";
github = "phrmendes";
githubId = 22376151;
};
phrogg = {
name = "Phil Roggenbuck";
email = "nixpkgs@phrogg.de";
@@ -19115,6 +19212,13 @@
githubId = 20760527;
name = "Madelyn";
};
r4v3n6101 = {
name = "r4v3n6101";
email = "raven6107@gmail.com";
github = "r4v3n6101";
githubId = 30029970;
keys = [ { fingerprint = "FA05 8A29 B45E 06C0 8FE9 4907 05D2 BE42 F3EC D7CC"; } ];
};
raboof = {
email = "arnout@bzzt.net";
matrix = "@raboof:matrix.org";
@@ -19536,6 +19640,12 @@
githubId = 93167100;
keys = [ { fingerprint = "9075 CEF8 9850 D261 6599 641A A2C9 36D5 B88C 139C"; } ];
};
renpenguin = {
email = "redpenguin777@yahoo.com";
github = "renpenguin";
githubId = 79577742;
name = "ren";
};
renzo = {
email = "renzocarbonara@gmail.com";
github = "k0001";
@@ -21176,6 +21286,12 @@
githubId = 46294732;
name = "Sharzy";
};
shavyn = {
name = "Marco Desiderati";
email = "desideratimarco@gmail.com";
github = "Shavyn";
githubId = 7593302;
};
shawn8901 = {
email = "shawn8901@googlemail.com";
github = "Shawn8901";
@@ -25190,7 +25306,7 @@
};
x123 = {
name = "x123";
email = "nix@boxchop.city";
email = "nix@nixlink.net";
github = "x123";
githubId = 5481629;
};
@@ -26029,6 +26145,12 @@
githubId = 8100652;
name = "David Mell";
};
zsenai = {
email = "zarred.f@gmail.com";
github = "ZarredFelicite";
githubId = 54928291;
name = "Zarred Felicite";
};
zshipko = {
email = "zachshipko@gmail.com";
github = "zshipko";
maintainers/scripts/kde/generate-sources.py
+24 -14
View File
@@ -5,7 +5,7 @@ import binascii
import json
import pathlib
from typing import Optional
from urllib.parse import urlparse
from urllib.parse import urljoin, urlparse
import bs4
import click
@@ -72,32 +72,42 @@ def main(set: str, version: str, nixpkgs: pathlib.Path, sources_url: Optional[st
if sources_url is None:
set_url = {
"frameworks": "kf",
"gear": "releases",
"plasma": "plasma",
"frameworks": f"frameworks/{version}/",
"gear": f"release-service/{version}/src/",
"plasma": f"plasma/{version}/",
}[set]
sources_url = f"https://kde.org/info/sources/source-{set_url}-{version}/"
sources_url = f"https://download.kde.org/stable/{set_url}"
sources = httpx.get(sources_url)
client = httpx.Client()
sources = client.get(sources_url)
sources.raise_for_status()
bs = bs4.BeautifulSoup(sources.text, features="html.parser")
results = {}
for item in bs.select("tr")[1:]:
link = item.select_one("td:nth-child(1) a")
assert link
for item in bs.select("tr")[3:]:
link = item.select_one("td:nth-child(2) a")
if not link:
continue
hash = item.select_one("td:nth-child(3) tt")
assert hash
project_name, version_and_ext = link.text.rsplit("-", maxsplit=1)
project_name, version = link.text.rsplit("-", maxsplit=1)
if project_name not in metadata.projects_by_name:
print(f"Warning: unknown tarball: {project_name}")
if version_and_ext.endswith(".sig"):
continue
version = version_and_ext.removesuffix(".tar.xz")
url = urljoin(sources_url, link.attrs["href"])
hash = client.get(url + ".sha256").text.split(" ", maxsplit=1)[0]
assert hash
results[project_name] = {
"version": version,
"url": "mirror://kde" + urlparse(link.attrs["href"]).path,
"hash": to_sri(hash.text)
"url": "mirror://kde" + urlparse(url).path,
"hash": to_sri(hash)
}
pkg_dir = set_dir / project_name
maintainers/scripts/luarocks-packages.csv
+1
View File
@@ -121,6 +121,7 @@ neotest,,,,,,mrcjkb
nlua,,,,,,teto
nui.nvim,,,,,,mrcjkb
nvim-cmp,https://raw.githubusercontent.com/hrsh7th/nvim-cmp/main/nvim-cmp-scm-1.rockspec,,,,,
nvim-dbee,,,,,,perchun
nvim-nio,,,,,,mrcjkb
orgmode,,,,,,
papis-nvim,,,,,,GaetanLepage
1 name rockspec ref server version luaversion maintainers
121 nlua teto
122 nui.nvim mrcjkb
123 nvim-cmp https://raw.githubusercontent.com/hrsh7th/nvim-cmp/main/nvim-cmp-scm-1.rockspec
124 nvim-dbee perchun
125 nvim-nio mrcjkb
126 orgmode
127 papis-nvim GaetanLepage
maintainers/team-list.nix
-1
View File
@@ -770,7 +770,6 @@ with lib.maintainers;
mguentner
ralith
dandellion
sumnerevans
nickcao
teutat3s
];
nixos/doc/manual/redirects.json
+3
View File
@@ -1922,6 +1922,9 @@
"index.html#building-a-titanium-app",
"index.html#emulating-or-simulating-the-app"
],
"sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded": [
"release-notes.html#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded"
],
"sec-nixpkgs-release-25.05-lib": [
"release-notes.html#sec-nixpkgs-release-25.05-lib"
],
nixos/doc/manual/release-notes/rl-2505.section.md
+17 -2
View File
@@ -113,10 +113,14 @@
- [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).
- [nfc-nci](https://github.com/StarGate01/ifdnfc-nci), an alternative NFC stack and PC/SC driver for the NXP PN54x chipset, commonly found in Lenovo systems as NXP1001 (NPC300). Available as [hardware.nfc-nci](#opt-hardware.nfc-nci.enable).
- [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](options.html#opt-services.duckdns.enable)
- [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).
- [Prometheus Node Cert Exporter](https://github.com/amimof/node-cert-exporter), a prometheus exporter to check for SSL cert expiry. Available under [services.prometheus.exporters.node-cert](#opt-services.prometheus.exporters.node-cert.enable).
- [Actual Budget](https://actualbudget.org/), a local-first personal finance app. Available as [services.actual](#opt-services.actual.enable).
- [immich-public-proxy](https://github.com/alangrainger/immich-public-proxy), a proxy for sharing Immich albums without exposing the Immich API. Available as [services.immich-public-proxy](#opt-services.immich-public-proxy.enable).
@@ -261,6 +265,8 @@
- `poac` has been renamed to `cabinpkg` to match the upstream name change but an alias has been added. See the [new name announcement](https://github.com/orgs/cabinpkg/discussions/1052) for more details.
- `serious-sans` has been removed because upstream changed its name to Serious Shanns, which is not currently packaged.
- `racket_7_9` has been removed, as it is insecure. It is recommended to use Racket 8 instead.
- `services.mongodb.initialRootPassword` has been replaced with the more secure option [`services.mongodb.initialRootPasswordFile`](#opt-services.mongodb.initialRootPasswordFile)
@@ -284,6 +290,8 @@
- The behavior of the `networking.nat.externalIP` and `networking.nat.externalIPv6` options has been changed. `networking.nat.forwardPorts` now only forwards packets destined for the specified IP addresses.
- `python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained.
- `python3Packages.jaeger-client` was removed because it was deprecated upstream. [OpenTelemetry](https://opentelemetry.io) is the recommended replacement.
- `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel.
@@ -294,9 +302,10 @@
Read the [release blog post](https://prometheus.io/blog/2024/11/14/prometheus-3-0/) and
[migration guide](https://prometheus.io/docs/prometheus/3.1/migration/).
- `kanata` was updated to v1.7.0, which introduces several breaking changes.
- `kanata` was updated to v1.8.0, which introduces several breaking changes.
See the release notes of
[v1.7.0](https://github.com/jtroo/kanata/releases/tag/v1.7.0)
[v1.7.0](https://github.com/jtroo/kanata/releases/tag/v1.7.0) and
[v1.8.0](https://github.com/jtroo/kanata/releases/tag/v1.8.0)
for more information.
- `ags` was updated to v2, which is just a CLI for Astal now. Components are available as a different package set `astal.*`.
@@ -352,6 +361,8 @@
- `borgmatic` has been updated from 1.8.14 to 1.9.5, please check the [upstream changelog](https://projects.torsion.org/borgmatic-collective/borgmatic/releases) for more details, especially for a few possibly breaking changes noted in the [1.9.0 changelog](https://projects.torsion.org/borgmatic-collective/borgmatic/releases/tag/1.9.0).
- `programs.xonsh.package` now gets overrided internally with `extraPackages` to support `programs.xonsh.extraPackages`. See `programs.xonsh.extraPackages` for more details.
- `nodePackages.ganache` has been removed, as the package has been deprecated by upstream.
- `virtualisation.azure.agent` option provided by `azure-agent.nix` is replaced by `services.waagent`, and will be removed in a future release.
@@ -448,6 +459,8 @@
- Overriding Wayland compositor is possible using `enableWaylandSession` option, but you might need to take care [`xfce4-session`](https://gitlab.xfce.org/xfce/xfce4-session/-/merge_requests/49), [`dbus-update-activation-environment`](https://github.com/labwc/labwc/blob/eaf11face68ee1f1bcc7ce1498304ca8c108c8ba/src/config/session.c#L234) and [`systemctl --user import-environment`](https://github.com/labwc/labwc/blob/eaf11face68ee1f1bcc7ce1498304ca8c108c8ba/src/config/session.c#L239) on startup.
- For new Xfce installations, default panel layout has [changed](https://gitlab.xfce.org/xfce/xfce4-panel/-/merge_requests/158/diffs) to not include external panel plugins by default. You can still add them yourself using the "Panel Preferences" dialog.
- [`system.stateVersion`](#opt-system.stateVersion) is now validated and must be in the `"YY.MM"` format, ideally corresponding to a prior NixOS release.
- GOverlay has been updated to 1.2, please check the [upstream changelog](https://github.com/benjamimgois/goverlay/releases) for more details.
- [`services.mongodb`](#opt-services.mongodb.enable) is now compatible with the `mongodb-ce` binary package. To make use of it, set [`services.mongodb.package`](#opt-services.mongodb.package) to `pkgs.mongodb-ce`.
@@ -456,6 +469,8 @@
- `networking.wireguard` now has an optional networkd backend. It is enabled by default when `networking.useNetworkd` is enabled, and it can be enabled alongside scripted networking with `networking.wireguard.useNetworkd`. Some `networking.wireguard` options have slightly different behavior with the networkd and script-based backends, documented in each option.
- `services.rss-bridge` now has a `package` option as well as support for `caddy` as reverse proxy.
- `services.avahi.ipv6` now defaults to true.
- The Home Assistant module has new options {option}`services.home-assistant.blueprints.automation`, `services.home-assistant.blueprints.script`, and {option}`services.home-assistant.blueprints.template` that allow for the declarative installation of [blueprints](https://www.home-assistant.io/docs/blueprint/) into the appropriate configuration directories.
nixos/lib/test-driver/src/test_driver/machine.py
+1 -1
View File
@@ -772,7 +772,7 @@ class Machine:
retry(tty_matches, timeout)
def send_chars(self, chars: str, delay: float | None = 0.01) -> None:
"""
r"""
Simulate typing a sequence of characters on the virtual keyboard,
e.g., `send_chars("foobar\n")` will type the string `foobar`
followed by the Enter key.
nixos/lib/utils.nix
+1 -1
View File
@@ -377,7 +377,7 @@ let
<<'EOF'
${toJSON set}
EOF
(( ! $inherit_errexit_enabled )) && shopt -u inherit_errexit
(( ! inherit_errexit_enabled )) && shopt -u inherit_errexit
'';
/*
nixos/modules/config/nix.nix
+15 -15
View File
@@ -27,7 +27,6 @@ let
literalExpression
mapAttrsToList
mkAfter
mkDefault
mkIf
mkOption
mkRenamedOptionModuleWith
@@ -316,15 +315,25 @@ in
system-features = mkOption {
type = types.listOf types.str;
example = [ "kvm" "big-parallel" "gccarch-skylake" ];
default =
[
"nixos-test"
"benchmark"
"big-parallel"
"kvm"
]
++ optionals (pkgs.stdenv.hostPlatform ? gcc.arch) (
# a builder can run code for `gcc.arch` and inferior architectures
[ "gccarch-${pkgs.stdenv.hostPlatform.gcc.arch}" ]
++ map (x: "gccarch-${x}") (
systems.architectures.inferiors.${pkgs.stdenv.hostPlatform.gcc.arch} or [ ]
)
);
defaultText = literalExpression ''[ "nixos-test" "benchmark" "big-parallel" "kvm" "gccarch-<arch>" ]'';
description = ''
The set of features supported by the machine. Derivations
can express dependencies on system features through the
`requiredSystemFeatures` attribute.
By default, pseudo-features `nixos-test`, `benchmark`,
and `big-parallel` used in Nixpkgs are set, `kvm`
is also included if it is available.
'';
};
@@ -350,7 +359,6 @@ in
use-sandbox = true;
show-trace = true;
system-features = [ "big-parallel" "kvm" "recursive-nix" ];
sandbox-paths = [ "/bin/sh=''${pkgs.busybox-sandbox-shell.out}/bin/busybox" ];
}
'';
@@ -377,14 +385,6 @@ in
trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
trusted-users = [ "root" ];
substituters = mkAfter [ "https://cache.nixos.org/" ];
system-features = mkDefault (
[ "nixos-test" "benchmark" "big-parallel" "kvm" ] ++
optionals (pkgs.stdenv.hostPlatform ? gcc.arch) (
# a builder can run code for `gcc.arch` and inferior architectures
[ "gccarch-${pkgs.stdenv.hostPlatform.gcc.arch}" ] ++
map (x: "gccarch-${x}") (systems.architectures.inferiors.${pkgs.stdenv.hostPlatform.gcc.arch} or [])
)
);
};
};
}
nixos/modules/config/swap.nix
+2 -2
View File
@@ -46,7 +46,7 @@ let
If not specified, the amount of data to read from `source` will be
determined by cryptsetup.
See `{manpage}`cryptsetup-open(8)`` for details.
See {manpage}`cryptsetup-open(8)` for details.
'';
};
@@ -60,7 +60,7 @@ let
If not specified, the default sector size is determined from the
underlying block device.
See `{manpage}`cryptsetup-open(8)`` for details.
See {manpage}`cryptsetup-open(8)` for details.
'';
};
nixos/modules/hardware/nfc-nci.nix
+205
View File
@@ -0,0 +1,205 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.hardware.nfc-nci;
# To understand these settings in more detail, refer to the upstream configuration templates
# available at https://github.com/NXPNFCLinux/linux_libnfc-nci/tree/master/conf .
# Settings in curly braces are NCI commands, the "NFC Controller Interface Specification"
# as well as the "NFC Digital Protocol Technical Specification" can be found online.
# These default settings have been specifically engineered for the Lenovo NXP1001 (NPC300) chipset.
defaultSettings = {
# This block will be emitted into /etc/libnfc-nci.conf
nci = {
# Set up general logging
APPL_TRACE_LEVEL = "0x01";
PROTOCOL_TRACE_LEVEL = "0x01";
# Set up which NFC technologies are enabled (due to e.g. local regulation or patent law)
HOST_LISTEN_TECH_MASK = "0x07";
POLLING_TECH_MASK = "0xEF";
P2P_LISTEN_TECH_MASK = "0xC5";
};
# This block will be emitted into /etc/libnfc-nxp-init.conf
init = {
# Setup logging of the individual userland library components
NXPLOG_GLOBAL_LOGLEVEL = "0x01";
NXPLOG_EXTNS_LOGLEVEL = "0x01";
NXPLOG_NCIHAL_LOGLEVEL = "0x01";
NXPLOG_NCIX_LOGLEVEL = "0x01";
NXPLOG_NCIR_LOGLEVEL = "0x01";
NXPLOG_FWDNLD_LOGLEVEL = "0x00";
NXPLOG_TML_LOGLEVEL = "0x01";
# Where to find the kernel device node
NXP_NFC_DEV_NODE = ''"/dev/pn544"'';
# Enable the NXP proprietary features of the chip
NXP_ACT_PROP_EXTN = "{2F, 02, 00}";
# Configure the NFC Forum profile:
# 0xA0 0x44: POLL_PROFILE_SEL_CFG = 0x00 (Use NFC Forum profile default configuration values. Specifically, not EMVCo.)
NXP_NFC_PROFILE_EXTN = ''
{20, 02, 05, 01,
A0, 44, 01, 00
}
'';
# Enable chip standby mode
NXP_CORE_STANDBY = "{2F, 00, 01, 01}";
# Enable NCI packet fragmentation on the I2C bus
NXP_I2C_FRAGMENTATION_ENABLED = "0x01";
};
# This block will be emitted into /etc/libnfc-nxp-pn547.conf as well as /etc/libnfc-nxp-pn548.conf
# Which file is actually used is decided by the library at runtime depending on chip variant, both files are required.
pn54x = {
# Enable Mifare Classic reader functionality
MIFARE_READER_ENABLE = "0x01";
# Configure clock source - use XTAL (hardware crystal) instead of PLL (synthetic clock)
NXP_SYS_CLK_SRC_SEL = "0x01";
NXP_SYS_CLK_FREQ_SEL = "0x00";
NXP_SYS_CLOCK_TO_CFG = "0x01";
# Configure the non-propriety NCI settings in EEPROM:
# 0x28: PN_NFC_DEP_SPEED = 0x00 (Data exchange: Highest Available Bit Rates)
# 0x21: PI_BIT_RATE = 0x00 (Maximum allowed bit rate: 106 Kbit/s)
# 0x30: LA_BIT_FRAME_SDD = 0x08 (Bit Frame SDD value to be sent in Byte 1 of SENS_RES)
# 0x31: LA_PLATFORM_CONFIG = 0x03 (Platform Configuration value to be sent in Byte 2 of SENS_RES)
# 0x33: LA_NFCID1 = [ 0x04 0x03 0x02 0x01 ] ("Unique" NFCID1 ID in SENS_RES)
# 0x54: LF_CON_BITR_F = 0x06 (Bit rates to listen for: Both)
# 0x50: LF_PROTOCOL_TYPE = 0x02 (Protocols supported in Listen Mode for NFC-F: NFC-DEP)
# 0x5B: LI_BIT_RATE = 0x00 (Maximum supported bit rate: 106 Kbit/s)
# 0x60: LN_WT = 0x0E (Waiting Time NFC-DEP WT_MAX default for Initiator)
# 0x80: RF_FIELD_INFO = 0x01 (Chip is allowed to emit RF Field Information Notifications)
# 0x81: RF_NFCEE_ACTION = 0x01 (Chip should send trigger notification for the default set of NFCEE actions)
# 0x82: NFCDEP_OP = 0x0E (NFC-DEP protocol behavior: Default flags, but also enable RTOX requests)
# 0x18: PF_BIT_RATE = 0x01 (NFC-F discovery polling initial bit rate: 106 Kbit/s)
NXP_CORE_CONF = ''
{20, 02, 2B, 0D,
28, 01, 00,
21, 01, 00,
30, 01, 08,
31, 01, 03,
33, 04, 04, 03, 02, 01,
54, 01, 06,
50, 01, 02,
5B, 01, 00,
60, 01, 0E,
80, 01, 01,
81, 01, 01,
82, 01, 0E,
18, 01, 01
}
'';
# Configure the proprietary NXP extension to the NCI standard in EEPROM:
# 0xA0 0x5E: JEWEL_RID_CFG = 0x01 (Enable sending RID to T1T on RF)
# 0xA0 0x40: TAG_DETECTOR_CFG = 0x00 (Tag detector: Disable both AGC based detection and trace mode)
# 0xA0 0x43: TAG_DETECTOR_FALLBACK_CNT_CFG = 0x00 (Tag detector: Disable hybrid mode, only use LPCD to initiate polling)
# 0xA0 0x0F: DH_EEPROM_AREA_1 = [ 32 bytes of opaque Lenovo data ] (Custom configuration for the Lenovo customized chip firmware)
# See also https://github.com/nfc-tools/libnfc/issues/455#issuecomment-2221979571
NXP_CORE_CONF_EXTN = ''
{20, 02, 30, 04,
A0, 5E, 01, 01,
A0, 40, 01, 00,
A0, 43, 01, 00,
A0, 0F, 20,
00, 03, 1D, 01, 03, 00, 02, 00,
01, 00, 01, 00, 00, 00, 00, 00,
00, 00, 00, 00, 00, 00, 00, 00,
00, 00, 00, 00, 00, 00, 00, 00
}
'';
# Firmware-specific protocol configuration parameters (one byte per protocol)
NXP_NFC_PROPRIETARY_CFG = "{05:FF:FF:06:81:80:70:FF:FF}";
# Configure power supply of chip, use Lenovo driver configuration, which deviates a bit from the spec:
# 0xA0 0x0E: PMU_CFG = [ 0x16, 0x09, 0x00 ] (VBAT1 connected to 5V, TVDD monitoring: 3.6V, TxLDO Voltage in reader and card mode: 3.3V)
NXP_EXT_TVDD_CFG = "0x01";
NXP_EXT_TVDD_CFG_1 = ''
{20, 02, 07, 01,
A0, 0E, 03, 16, 09, 00
}
'';
# Use the default for NFA_EE_MAX_EE_SUPPORTED stack size (concerns HCI)
NXP_NFC_MAX_EE_SUPPORTED = "0x00";
};
};
generateSettings =
cfgName:
let
toKeyValueLines =
obj: builtins.concatStringsSep "\n" (map (key: "${key}=${obj.${key}}") (builtins.attrNames obj));
in
toKeyValueLines (defaultSettings.${cfgName} // (cfg.settings.${cfgName} or { }));
in
{
options.hardware.nfc-nci = {
enable = lib.mkEnableOption "PN5xx kernel module with udev rules, libnfc-nci userland, and optional ifdnfc-nci PC/SC driver";
settings = lib.mkOption {
default = defaultSettings;
description = ''
Configuration to be written to the libncf-nci configuration files.
To understand the configuration format, refer to https://github.com/NXPNFCLinux/linux_libnfc-nci/tree/master/conf.
'';
type = lib.types.attrs;
};
enableIFD = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Register ifdnfc-nci as a serial reader with pcscd.
'';
};
};
config = lib.mkIf cfg.enable {
environment.systemPackages =
[
pkgs.libnfc-nci
]
++ lib.optionals cfg.enableIFD [
pkgs.ifdnfc-nci
];
environment.etc = {
"libnfc-nci.conf".text = generateSettings "nci";
"libnfc-nxp-init.conf".text = generateSettings "init";
"libnfc-nxp-pn547.conf".text = generateSettings "pn54x";
"libnfc-nxp-pn548.conf".text = generateSettings "pn54x";
};
services.udev.packages = [
config.boot.kernelPackages.nxp-pn5xx
];
boot.blacklistedKernelModules = [
"nxp_nci_i2c"
"nxp_nci"
];
boot.extraModulePackages = [
config.boot.kernelPackages.nxp-pn5xx
];
boot.kernelModules = [
"nxp-pn5xx"
];
services.pcscd.readerConfigs = lib.mkIf cfg.enableIFD [
''
FRIENDLYNAME "NFC NCI"
LIBPATH ${pkgs.ifdnfc-nci}/lib/libifdnfc-nci.so
CHANNELID 0
''
];
# NFC chip looses power when system goes to sleep / hibernate,
# and needs to be re-initialized upon wakeup
powerManagement.resumeCommands = lib.mkIf cfg.enableIFD ''
systemctl restart pcscd.service
'';
};
meta.maintainers = with lib.maintainers; [ stargate01 ];
}
nixos/modules/misc/version.nix
+22
View File
@@ -16,6 +16,7 @@ let
toLower
optionalString
literalExpression
match
mkRenamedOptionModule
mkDefault
mkOption
@@ -263,6 +264,27 @@ in
config = {
assertions = [
{
assertion = match "[0-9]{2}\\.[0-9]{2}" config.system.stateVersion != null;
message = ''
${config.system.stateVersion} is an invalid value for 'system.stateVersion'; it must be in the format "YY.MM",
which corresponds to a prior release of NixOS.
If you want to switch releases or switch to unstable, you should change your channel and/or flake input URLs only.
*DO NOT* touch the 'system.stateVersion' option, as it will not help you upgrade.
Leave it exactly on the previous value, which is likely the value you had for it when you installed your system.
If you're unsure which value to set it to, use "${
if match "[0-9]{2}\\.[0-9]{2}" options.system.stateVersion.default != null then
options.system.stateVersion.default
else
options.system.nixos.release.default
}" as a default.
'';
}
];
system.nixos = {
# These defaults are set here rather than up there so that
# changing them would not rebuild the manual
nixos/modules/module-list.nix
+1 -1
View File
@@ -85,6 +85,7 @@
./hardware/network/eg25-manager.nix
./hardware/network/intel-2200bg.nix
./hardware/new-lg4ff.nix
./hardware/nfc-nci.nix
./hardware/nitrokey.nix
./hardware/onlykey/default.nix
./hardware/openrazer.nix
@@ -736,7 +737,6 @@
./services/matrix/hebbot.nix
./services/matrix/hookshot.nix
./services/matrix/maubot.nix
./services/matrix/mautrix-facebook.nix
./services/matrix/mautrix-meta.nix
./services/matrix/mautrix-signal.nix
./services/matrix/mautrix-telegram.nix
nixos/modules/programs/nix-required-mounts.nix
+4 -4
View File
@@ -50,10 +50,10 @@ let
pkgs.addDriverRunpath.driverLink
# mesa:
config.hardware.opengl.package
config.hardware.graphics.package
# nvidia_x11, etc:
] ++ config.hardware.opengl.extraPackages; # nvidia_x11
] ++ config.hardware.graphics.extraPackages; # nvidia_x11
defaults = {
nvidia-gpu.onFeatures = package.allowedPatterns.nvidia-gpu.onFeatures;
@@ -82,8 +82,8 @@ in
default = { };
defaultText = lib.literalExpression ''
{
opengl.paths = config.hardware.opengl.extraPackages ++ [
config.hardware.opengl.package
opengl.paths = config.hardware.graphics.extraPackages ++ [
config.graphics.opengl.package
pkgs.addDriverRunpath.driverLink
"/dev/dri"
];
nixos/modules/programs/wayland/sway.nix
+1 -1
View File
@@ -159,7 +159,7 @@ in
# https://github.com/emersion/xdg-desktop-portal-wlr/pull/315
xdg.portal.config.sway = {
# Use xdg-desktop-portal-gtk for every portal interface...
default = "gtk";
default = [ "gtk" ];
# ... except for the ScreenCast, Screenshot and Secret
"org.freedesktop.impl.portal.ScreenCast" = "wlr";
"org.freedesktop.impl.portal.Screenshot" = "wlr";
nixos/modules/programs/xonsh.nix
+18 -3
View File
@@ -5,7 +5,7 @@
let
cfg = config.programs.xonsh;
package = cfg.package.override { inherit (cfg) extraPackages; };
in
{
@@ -32,6 +32,21 @@ in
type = lib.types.lines;
};
extraPackages = lib.mkOption {
default = (ps: [ ]);
type = with lib.types; coercedTo (listOf lib.types.package) (v: (_: v)) (functionTo (listOf lib.types.package));
description = ''
Add the specified extra packages to the xonsh package.
Preferred over using `programs.xonsh.package` as it composes with `programs.xonsh.xontribs`.
Take care in using this option along with manually defining the package
option above, as the two can result in conflicting sets of build dependencies.
This option assumes that the package option has an overridable argument
called `extraPackages`, so if you override the package option but also
intend to use this option, be sure that your resulting package still honors
the necessary option.
'';
};
};
};
@@ -64,11 +79,11 @@ in
${cfg.config}
'';
environment.systemPackages = [ cfg.package ];
environment.systemPackages = [ package ];
environment.shells = [
"/run/current-system/sw/bin/xonsh"
"${lib.getExe cfg.package}"
"${lib.getExe package}"
];
};
}
nixos/modules/security/wrappers/default.nix
+10 -4
View File
@@ -1,7 +1,9 @@
{ config, lib, pkgs, ... }:
let
inherit (config.security) wrapperDir wrappers;
inherit (config.security) wrapperDir;
wrappers = lib.filterAttrs (name: value: value.enable) config.security.wrappers;
parentWrapperDir = dirOf wrapperDir;
@@ -41,6 +43,11 @@ let
// { description = "file mode string"; };
wrapperType = lib.types.submodule ({ name, config, ... }: {
options.enable = lib.mkOption
{ type = lib.types.bool;
default = true;
description = "Whether to enable the wrapper.";
};
options.source = lib.mkOption
{ type = lib.types.path;
description = "The absolute path to the program to be wrapped.";
@@ -203,9 +210,8 @@ in
description = ''
This option effectively allows adding setuid/setgid bits, capabilities,
changing file ownership and permissions of a program without directly
modifying it. This works by creating a wrapper program under the
{option}`security.wrapperDir` directory, which is then added to
the shell `PATH`.
modifying it. This works by creating a wrapper program in a directory
(not configurable), which is then added to the shell `PATH`.
'';
};
nixos/modules/services/backup/mysql-backup.nix
+32 -3
View File
@@ -8,6 +8,18 @@ let
cfg = config.services.mysqlBackup;
defaultUser = "mysqlbackup";
# Newer mariadb versions warn of the usage of 'mysqldump' and recommend 'mariadb-dump' (https://mariadb.com/kb/en/mysqldump/)
dumpBinary =
if
(
lib.getName config.services.mysql.package == lib.getName pkgs.mariadb
&& lib.versionAtLeast config.services.mysql.package.version "11.0.0"
)
then
"${config.services.mysql.package}/bin/mariadb-dump"
else
"${config.services.mysql.package}/bin/mysqldump";
compressionAlgs = {
gzip = rec {
pkg = pkgs.gzip;
@@ -39,6 +51,13 @@ let
selectedAlg = compressionAlgs.${cfg.compressionAlg};
compressionCmd = selectedAlg.cmd compressionLevelFlag;
shouldUseSingleTransaction =
db:
if lib.isBool cfg.singleTransaction then
cfg.singleTransaction
else
lib.elem db cfg.singleTransaction;
backupScript = ''
set -o pipefail
failed=""
@@ -51,7 +70,7 @@ let
backupDatabaseScript = db: ''
dest="${cfg.location}/${db}${selectedAlg.ext}"
if ${pkgs.mariadb}/bin/mysqldump ${lib.optionalString cfg.singleTransaction "--single-transaction"} ${db} | ${compressionCmd} > $dest.tmp; then
if ${dumpBinary} ${lib.optionalString (shouldUseSingleTransaction db) "--single-transaction"} ${db} | ${compressionCmd} > $dest.tmp; then
mv $dest.tmp $dest
echo "Backed up to $dest"
else
@@ -126,9 +145,13 @@ in
singleTransaction = lib.mkOption {
default = false;
type = lib.types.bool;
type = lib.types.oneOf [
lib.types.bool
(lib.types.listOf lib.types.str)
];
description = ''
Whether to create database dump in a single transaction
Whether to create database dump in a single transaction.
Can be either a boolean for all databases or a list of database names.
'';
};
@@ -153,6 +176,12 @@ in
|| selectedAlg.minLevel <= cfg.compressionLevel && cfg.compressionLevel <= selectedAlg.maxLevel;
message = "${cfg.compressionAlg} compression level must be between ${toString selectedAlg.minLevel} and ${toString selectedAlg.maxLevel}";
}
{
assertion =
!(lib.isList cfg.singleTransaction)
|| lib.all (db: lib.elem db cfg.databases) cfg.singleTransaction;
message = "All databases in singleTransaction must be included in the databases option";
}
];
# ensure unix user to be used to perform backup exist.
nixos/modules/services/databases/mysql.nix
+187 -138
View File
@@ -1,4 +1,9 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.mysql;
@@ -8,8 +13,7 @@ let
# Oracle MySQL has supported "notify" service type since 8.0
hasNotify = isMariaDB || (isOracle && lib.versionAtLeast cfg.package.version "8.0");
mysqldOptions =
"--user=${cfg.user} --datadir=${cfg.dataDir} --basedir=${cfg.package}";
mysqldOptions = "--user=${cfg.user} --datadir=${cfg.dataDir} --basedir=${cfg.package}";
format = pkgs.formats.ini { listsAsDuplicateKeys = true; };
configFile = format.generate "my.cnf" cfg.settings;
@@ -18,11 +22,31 @@ in
{
imports = [
(lib.mkRemovedOptionModule [ "services" "mysql" "pidDir" ] "Don't wait for pidfiles, describe dependencies through systemd.")
(lib.mkRemovedOptionModule [ "services" "mysql" "rootPassword" ] "Use socket authentication or set the password outside of the nix store.")
(lib.mkRemovedOptionModule [ "services" "mysql" "extraOptions" ] "Use services.mysql.settings.mysqld instead.")
(lib.mkRemovedOptionModule [ "services" "mysql" "bind" ] "Use services.mysql.settings.mysqld.bind-address instead.")
(lib.mkRemovedOptionModule [ "services" "mysql" "port" ] "Use services.mysql.settings.mysqld.port instead.")
(lib.mkRemovedOptionModule [
"services"
"mysql"
"pidDir"
] "Don't wait for pidfiles, describe dependencies through systemd.")
(lib.mkRemovedOptionModule [
"services"
"mysql"
"rootPassword"
] "Use socket authentication or set the password outside of the nix store.")
(lib.mkRemovedOptionModule [
"services"
"mysql"
"extraOptions"
] "Use services.mysql.settings.mysqld instead.")
(lib.mkRemovedOptionModule [
"services"
"mysql"
"bind"
] "Use services.mysql.settings.mysqld.bind-address instead.")
(lib.mkRemovedOptionModule [
"services"
"mysql"
"port"
] "Use services.mysql.settings.mysqld.port instead.")
];
###### interface
@@ -106,7 +130,7 @@ in
settings = lib.mkOption {
type = format.type;
default = {};
default = { };
description = ''
MySQL configuration. Refer to
<https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html>,
@@ -137,25 +161,27 @@ in
};
initialDatabases = lib.mkOption {
type = lib.types.listOf (lib.types.submodule {
options = {
name = lib.mkOption {
type = lib.types.str;
description = ''
The name of the database to create.
'';
type = lib.types.listOf (
lib.types.submodule {
options = {
name = lib.mkOption {
type = lib.types.str;
description = ''
The name of the database to create.
'';
};
schema = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
The initial schema of the database; if null (the default),
an empty database is created.
'';
};
};
schema = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
The initial schema of the database; if null (the default),
an empty database is created.
'';
};
};
});
default = [];
}
);
default = [ ];
description = ''
List of database names and their initial schemas that should be used to create databases on the first startup
of MySQL. The schema attribute is optional: If not specified, an empty database is created.
@@ -176,7 +202,7 @@ in
ensureDatabases = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [];
default = [ ];
description = ''
Ensures that the specified databases exist.
This option will never delete existing databases, especially not when the value of this
@@ -190,39 +216,41 @@ in
};
ensureUsers = lib.mkOption {
type = lib.types.listOf (lib.types.submodule {
options = {
name = lib.mkOption {
type = lib.types.str;
description = ''
Name of the user to ensure.
'';
};
ensurePermissions = lib.mkOption {
type = lib.types.attrsOf lib.types.str;
default = {};
description = ''
Permissions to ensure for the user, specified as attribute set.
The attribute names specify the database and tables to grant the permissions for,
separated by a dot. You may use wildcards here.
The attribute values specfiy the permissions to grant.
You may specify one or multiple comma-separated SQL privileges here.
type = lib.types.listOf (
lib.types.submodule {
options = {
name = lib.mkOption {
type = lib.types.str;
description = ''
Name of the user to ensure.
'';
};
ensurePermissions = lib.mkOption {
type = lib.types.attrsOf lib.types.str;
default = { };
description = ''
Permissions to ensure for the user, specified as attribute set.
The attribute names specify the database and tables to grant the permissions for,
separated by a dot. You may use wildcards here.
The attribute values specfiy the permissions to grant.
You may specify one or multiple comma-separated SQL privileges here.
For more information on how to specify the target
and on which privileges exist, see the
[GRANT syntax](https://mariadb.com/kb/en/library/grant/).
The attributes are used as `GRANT ''${attrName} ON ''${attrValue}`.
'';
example = lib.literalExpression ''
{
"database.*" = "ALL PRIVILEGES";
"*.*" = "SELECT, LOCK TABLES";
}
'';
For more information on how to specify the target
and on which privileges exist, see the
[GRANT syntax](https://mariadb.com/kb/en/library/grant/).
The attributes are used as `GRANT ''${attrName} ON ''${attrValue}`.
'';
example = lib.literalExpression ''
{
"database.*" = "ALL PRIVILEGES";
"*.*" = "SELECT, LOCK TABLES";
}
'';
};
};
};
});
default = [];
}
);
default = [ ];
description = ''
Ensures that the specified users exist and have at least the ensured permissions.
The MySQL users will be identified using Unix socket authentication. This authenticates the Unix user with the
@@ -251,7 +279,11 @@ in
replication = {
role = lib.mkOption {
type = lib.types.enum [ "master" "slave" "none" ];
type = lib.types.enum [
"master"
"slave"
"none"
];
default = "none";
description = "Role of the MySQL server instance.";
};
@@ -292,14 +324,13 @@ in
};
###### implementation
config = lib.mkIf cfg.enable {
services.mysql.dataDir =
lib.mkDefault (if lib.versionAtLeast config.system.stateVersion "17.09" then "/var/lib/mysql"
else "/var/mysql");
services.mysql.dataDir = lib.mkDefault (
if lib.versionAtLeast config.system.stateVersion "17.09" then "/var/lib/mysql" else "/var/mysql"
);
services.mysql.settings.mysqld = lib.mkMerge [
{
@@ -311,7 +342,11 @@ in
log-bin-index = "mysql-bin-${toString cfg.replication.serverId}.index";
relay-log = "mysql-relay-bin";
server-id = cfg.replication.serverId;
binlog-ignore-db = [ "information_schema" "performance_schema" "mysql" ];
binlog-ignore-db = [
"information_schema"
"performance_schema"
"mysql"
];
})
(lib.mkIf (!isMariaDB) {
plugin-load-add = [ "auth_socket.so" ];
@@ -355,17 +390,21 @@ in
pkgs.nettools
];
preStart = if isMariaDB then ''
if ! test -e ${cfg.dataDir}/mysql; then
${cfg.package}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${mysqldOptions}
touch ${cfg.dataDir}/mysql_init
fi
'' else ''
if ! test -e ${cfg.dataDir}/mysql; then
${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} --initialize-insecure
touch ${cfg.dataDir}/mysql_init
fi
'';
preStart =
if isMariaDB then
''
if ! test -e ${cfg.dataDir}/mysql; then
${cfg.package}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${mysqldOptions}
touch ${cfg.dataDir}/mysql_init
fi
''
else
''
if ! test -e ${cfg.dataDir}/mysql; then
${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} --initialize-insecure
touch ${cfg.dataDir}/mysql_init
fi
'';
script = ''
# https://mariadb.com/kb/en/getting-started-with-mariadb-galera-cluster/#systemd-and-galera-recovery
@@ -379,52 +418,55 @@ in
exec ${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION
'';
postStart = let
# The super user account to use on *first* run of MySQL server
superUser = if isMariaDB then cfg.user else "root";
in ''
${lib.optionalString (!hasNotify) ''
# Wait until the MySQL server is available for use
while [ ! -e /run/mysqld/mysqld.sock ]
do
echo "MySQL daemon not yet started. Waiting for 1 second..."
sleep 1
done
''}
postStart =
let
# The super user account to use on *first* run of MySQL server
superUser = if isMariaDB then cfg.user else "root";
in
''
${lib.optionalString (!hasNotify) ''
# Wait until the MySQL server is available for use
while [ ! -e /run/mysqld/mysqld.sock ]
do
echo "MySQL daemon not yet started. Waiting for 1 second..."
sleep 1
done
''}
if [ -f ${cfg.dataDir}/mysql_init ]
then
# While MariaDB comes with a 'mysql' super user account since 10.4.x, MySQL does not
# Since we don't want to run this service as 'root' we need to ensure the account exists on first run
( echo "CREATE USER IF NOT EXISTS '${cfg.user}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
echo "GRANT ALL PRIVILEGES ON *.* TO '${cfg.user}'@'localhost' WITH GRANT OPTION;"
) | ${cfg.package}/bin/mysql -u ${superUser} -N
if [ -f ${cfg.dataDir}/mysql_init ]
then
# While MariaDB comes with a 'mysql' super user account since 10.4.x, MySQL does not
# Since we don't want to run this service as 'root' we need to ensure the account exists on first run
( echo "CREATE USER IF NOT EXISTS '${cfg.user}'@'localhost' IDENTIFIED WITH ${
if isMariaDB then "unix_socket" else "auth_socket"
};"
echo "GRANT ALL PRIVILEGES ON *.* TO '${cfg.user}'@'localhost' WITH GRANT OPTION;"
) | ${cfg.package}/bin/mysql -u ${superUser} -N
${lib.concatMapStrings (database: ''
# Create initial databases
if ! test -e "${cfg.dataDir}/${database.name}"; then
echo "Creating initial database: ${database.name}"
( echo 'create database `${database.name}`;'
${lib.concatMapStrings (database: ''
# Create initial databases
if ! test -e "${cfg.dataDir}/${database.name}"; then
echo "Creating initial database: ${database.name}"
( echo 'create database `${database.name}`;'
${lib.optionalString (database.schema != null) ''
echo 'use `${database.name}`;'
${lib.optionalString (database.schema != null) ''
echo 'use `${database.name}`;'
# TODO: this silently falls through if database.schema does not exist,
# we should catch this somehow and exit, but can't do it here because we're in a subshell.
if [ -f "${database.schema}" ]
then
cat ${database.schema}
elif [ -d "${database.schema}" ]
then
cat ${database.schema}/mysql-databases/*.sql
fi
''}
) | ${cfg.package}/bin/mysql -u ${superUser} -N
fi
'') cfg.initialDatabases}
# TODO: this silently falls through if database.schema does not exist,
# we should catch this somehow and exit, but can't do it here because we're in a subshell.
if [ -f "${database.schema}" ]
then
cat ${database.schema}
elif [ -d "${database.schema}" ]
then
cat ${database.schema}/mysql-databases/*.sql
fi
''}
) | ${cfg.package}/bin/mysql -u ${superUser} -N
fi
'') cfg.initialDatabases}
${lib.optionalString (cfg.replication.role == "master")
''
${lib.optionalString (cfg.replication.role == "master") ''
# Set up the replication master
( echo "use mysql;"
@@ -434,8 +476,7 @@ in
) | ${cfg.package}/bin/mysql -u ${superUser} -N
''}
${lib.optionalString (cfg.replication.role == "slave")
''
${lib.optionalString (cfg.replication.role == "slave") ''
# Set up the replication slave
( echo "stop slave;"
@@ -444,34 +485,36 @@ in
) | ${cfg.package}/bin/mysql -u ${superUser} -N
''}
${lib.optionalString (cfg.initialScript != null)
''
${lib.optionalString (cfg.initialScript != null) ''
# Execute initial script
# using toString to avoid copying the file to nix store if given as path instead of string,
# as it might contain credentials
cat ${toString cfg.initialScript} | ${cfg.package}/bin/mysql -u ${superUser} -N
''}
rm ${cfg.dataDir}/mysql_init
fi
rm ${cfg.dataDir}/mysql_init
fi
${lib.optionalString (cfg.ensureDatabases != []) ''
(
${lib.concatMapStrings (database: ''
echo "CREATE DATABASE IF NOT EXISTS \`${database}\`;"
'') cfg.ensureDatabases}
) | ${cfg.package}/bin/mysql -N
''}
${lib.optionalString (cfg.ensureDatabases != [ ]) ''
(
${lib.concatMapStrings (database: ''
echo "CREATE DATABASE IF NOT EXISTS \`${database}\`;"
'') cfg.ensureDatabases}
) | ${cfg.package}/bin/mysql -N
''}
${lib.concatMapStrings (user:
''
( echo "CREATE USER IF NOT EXISTS '${user.name}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
${lib.concatStringsSep "\n" (lib.mapAttrsToList (database: permission: ''
echo "GRANT ${permission} ON ${database} TO '${user.name}'@'localhost';"
'') user.ensurePermissions)}
${lib.concatMapStrings (user: ''
( echo "CREATE USER IF NOT EXISTS '${user.name}'@'localhost' IDENTIFIED WITH ${
if isMariaDB then "unix_socket" else "auth_socket"
};"
${lib.concatStringsSep "\n" (
lib.mapAttrsToList (database: permission: ''
echo "GRANT ${permission} ON ${database} TO '${user.name}'@'localhost';"
'') user.ensurePermissions
)}
) | ${cfg.package}/bin/mysql -N
'') cfg.ensureUsers}
'';
'';
serviceConfig = lib.mkMerge [
{
@@ -500,7 +543,11 @@ in
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
RestrictAddressFamilies = [
"AF_UNIX"
"AF_INET"
"AF_INET6"
];
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
@@ -516,4 +563,6 @@ in
];
};
};
meta.maintainers = [ lib.maintainers._6543 ];
}
nixos/modules/services/desktop-managers/lomiri.nix
+41 -23
View File
@@ -95,6 +95,7 @@ in
lomiri-gallery-app
lomiri-history-service
lomiri-mediaplayer-app
lomiri-music-app
lomiri-polkit-agent
lomiri-schemas # exposes some required dbus interfaces
lomiri-session # wrappers to properly launch the session
@@ -198,37 +199,54 @@ in
"/share/sounds"
];
systemd.user.services = {
# Unconditionally run service that collects system-installed URL handlers before LUD
# TODO also run user-installed one?
"lomiri-url-dispatcher-update-system-dir" = {
description = "Lomiri URL dispatcher system directory updater";
wantedBy = [ "lomiri-url-dispatcher.service" ];
before = [ "lomiri-url-dispatcher.service" ];
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.lomiri.lomiri-url-dispatcher}/libexec/lomiri-url-dispatcher/lomiri-update-directory /run/current-system/sw/share/lomiri-url-dispatcher/urls/";
};
};
"lomiri-polkit-agent" = rec {
description = "Lomiri Polkit agent";
wantedBy = [
systemd.user.services =
let
lomiriServiceNames = [
"lomiri.service"
"lomiri-full-greeter.service"
"lomiri-full-shell.service"
"lomiri-greeter.service"
"lomiri-shell.service"
];
after = [ "graphical-session.target" ];
partOf = wantedBy;
serviceConfig = {
Type = "simple";
Restart = "always";
ExecStart = "${pkgs.lomiri.lomiri-polkit-agent}/libexec/lomiri-polkit-agent/policykit-agent";
in
{
# Unconditionally run service that collects system-installed URL handlers before LUD
# TODO also run user-installed one?
"lomiri-url-dispatcher-update-system-dir" = {
description = "Lomiri URL dispatcher system directory updater";
wantedBy = [ "lomiri-url-dispatcher.service" ];
before = [ "lomiri-url-dispatcher.service" ];
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.lomiri.lomiri-url-dispatcher}/libexec/lomiri-url-dispatcher/lomiri-update-directory /run/current-system/sw/share/lomiri-url-dispatcher/urls/";
};
};
"lomiri-polkit-agent" = {
description = "Lomiri Polkit agent";
wantedBy = lomiriServiceNames;
after = [ "graphical-session.target" ];
partOf = lomiriServiceNames;
serviceConfig = {
Type = "simple";
Restart = "always";
ExecStart = "${pkgs.lomiri.lomiri-polkit-agent}/libexec/lomiri-polkit-agent/policykit-agent";
};
};
"mediascanner-2.0" = {
description = "Media Scanner";
wantedBy = lomiriServiceNames;
before = lomiriServiceNames;
partOf = lomiriServiceNames;
serviceConfig = {
Type = "dbus";
BusName = "com.lomiri.MediaScanner2.Daemon";
Restart = "on-failure";
ExecStart = "${lib.getExe pkgs.lomiri.mediascanner2}";
};
};
};
};
systemd.services = {
"dbus-com.lomiri.UserMetrics" = {
nixos/modules/services/games/mchprs.nix
+1 -1
View File
@@ -78,7 +78,7 @@ in
Automatically restart the server after
{option}`services.mchprs.maxRuntime`.
The time span format is described here:
https://www.freedesktop.org/software/systemd/man/systemd.time.html#Parsing%20Time%20Spans.
<https://www.freedesktop.org/software/systemd/man/systemd.time.html#Parsing%20Time%20Spans>.
If `null`, then the server is not restarted automatically.
'';
};
nixos/modules/services/hardware/asusd.nix
+6 -6
View File
@@ -64,7 +64,7 @@ in
default = null;
description = ''
The content of /etc/asusd/anime.ron.
See https://asus-linux.org/asusctl/#anime-control.
See <https://asus-linux.org/asusctl/#anime-control>.
'';
};
@@ -73,7 +73,7 @@ in
default = null;
description = ''
The content of /etc/asusd/asusd.ron.
See https://asus-linux.org/asusctl/.
See <https://asus-linux.org/asusctl/>.
'';
};
@@ -82,7 +82,7 @@ in
default = { };
description = ''
The content of /etc/asusd/aura_<name>.ron.
See https://asus-linux.org/asusctl/#led-keyboard-control.
See <https://asus-linux.org/asusctl/#led-keyboard-control>.
'';
};
@@ -91,7 +91,7 @@ in
default = null;
description = ''
The content of /etc/asusd/profile.ron.
See https://asus-linux.org/asusctl/#profiles.
See <https://asus-linux.org/asusctl/#profiles>.
'';
};
@@ -100,7 +100,7 @@ in
default = null;
description = ''
The content of /etc/asusd/fan_curves.ron.
See https://asus-linux.org/asusctl/#fan-curves.
See <https://asus-linux.org/asusctl/#fan-curves>.
'';
};
@@ -109,7 +109,7 @@ in
default = null;
description = ''
The content of /etc/asusd/asusd-user-ledmodes.ron.
See https://asus-linux.org/asusctl/#led-keyboard-control.
See <https://asus-linux.org/asusctl/#led-keyboard-control>.
'';
};
};
nixos/modules/services/hardware/display.nix
+2 -2
View File
@@ -63,7 +63,7 @@ in
type = with lib.types; attrsOf (listOf str);
default = { };
description = ''
Exposes EDID files from users-sourced database at https://github.com/linuxhw/EDID
Exposes EDID files from users-sourced database at <https://github.com/linuxhw/EDID>
Attribute names will be mapped to EDID filenames `<NAME>.bin`.
@@ -100,7 +100,7 @@ in
Attribute set of XFree86 Modelines automatically converted
and exposed as `edid/<name>.bin` files in initrd.
See for more information:
- https://en.wikipedia.org/wiki/XFree86_Modeline
- <https://en.wikipedia.org/wiki/XFree86_Modeline>
'';
example = lib.literalExpression ''
{
nixos/modules/services/hardware/pcscd.nix
+39 -15
View File
@@ -1,11 +1,16 @@
{ config, lib, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.pcscd;
cfgFile = pkgs.writeText "reader.conf" config.services.pcscd.readerConfig;
cfgFile = pkgs.writeText "reader.conf" (
builtins.concatStringsSep "\n\n" config.services.pcscd.readerConfigs
);
package = if config.security.polkit.enable
then pkgs.pcscliteWithPolkit
else pkgs.pcsclite;
package = if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite;
pluginEnv = pkgs.buildEnv {
name = "pcscd-plugins";
@@ -14,6 +19,20 @@ let
in
{
imports = [
(lib.mkChangedOptionModule
[ "services" "pcscd" "readerConfig" ]
[ "services" "pcscd" "readerConfigs" ]
(
config:
let
readerConfig = lib.getAttrFromPath [ "services" "pcscd" "readerConfig" ] config;
in
[ readerConfig ]
)
)
];
options.services.pcscd = {
enable = lib.mkEnableOption "PCSC-Lite daemon, to access smart cards using SCard API (PC/SC)";
@@ -24,15 +43,17 @@ in
description = "Plugin packages to be used for PCSC-Lite.";
};
readerConfig = lib.mkOption {
type = lib.types.lines;
default = "";
example = ''
FRIENDLYNAME "Some serial reader"
DEVICENAME /dev/ttyS0
LIBPATH /path/to/serial_reader.so
CHANNELID 1
'';
readerConfigs = lib.mkOption {
type = lib.types.listOf lib.types.lines;
default = [ ];
example = [
''
FRIENDLYNAME "Some serial reader"
DEVICENAME /dev/ttyS0
LIBPATH /path/to/serial_reader.so
CHANNELID 1
''
];
description = ''
Configuration for devices that aren't hotpluggable.
@@ -68,7 +89,10 @@ in
# around it, we force the path to the cfgFile.
#
# https://github.com/NixOS/nixpkgs/issues/121088
serviceConfig.ExecStart = [ "" "${lib.getExe package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}" ];
serviceConfig.ExecStart = [
""
"${lib.getExe package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}"
];
};
};
}
nixos/modules/services/hardware/supergfxd.nix
+1 -1
View File
@@ -19,7 +19,7 @@ in
default = null;
description = ''
The content of /etc/supergfxd.conf.
See https://gitlab.com/asus-linux/supergfxctl/#config-options-etcsupergfxdconf.
See <https://gitlab.com/asus-linux/supergfxctl/#config-options-etcsupergfxdconf>.
'';
};
};
nixos/modules/services/hardware/thinkfan.nix
+1 -1
View File
@@ -259,7 +259,7 @@ in
description = ''
Thinkfan settings. Use this option to configure thinkfan
settings not exposed in a NixOS option or to bypass one.
Before changing this, read the `{manpage}`thinkfan.conf(5)``
Before changing this, read the {manpage}`thinkfan.conf(5)`
manpage and take a look at the example config file at
<https://github.com/vmatare/thinkfan/blob/master/examples/thinkfan.yaml>
'';
nixos/modules/services/home-automation/evcc.nix
+1 -1
View File
@@ -32,7 +32,7 @@ in
description = ''
evcc configuration as a Nix attribute set.
Check for possible options in the sample [evcc.dist.yaml](https://github.com/andig/evcc/blob/${package.version}/evcc.dist.yaml].
Check for possible options in the sample [evcc.dist.yaml](https://github.com/andig/evcc/blob/${package.version}/evcc.dist.yaml).
'';
};
};
nixos/modules/services/home-automation/home-assistant.nix
+1 -1
View File
@@ -517,7 +517,7 @@ in {
description = ''
List of ${domain}
[blueprints](https://www.home-assistant.io/docs/blueprint/) to
install into {file}`''${configDir}/blueprints/${domain}`.
install into {file}`''${config.services.home-assistant.configDir}/blueprints/${domain}`.
'';
example =
if domain == "automation" then
nixos/modules/services/mail/sympa.nix
-1
View File
@@ -656,7 +656,6 @@ in
};
meta.maintainers = with lib.maintainers; [
mmilata
sorki
];
}
nixos/modules/services/matrix/conduwuit.nix
+2 -16
View File
@@ -246,22 +246,8 @@ in
RestrictRealtime = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"@resources"
"~@clock"
"@debug"
"@module"
"@mount"
"@reboot"
"@swap"
"@cpu-emulation"
"@obsolete"
"@timer"
"@chown"
"@setuid"
"@privileged"
"@keyring"
"@ipc"
"@system-service @resources"
"~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc"
];
SystemCallErrorNumber = "EPERM";
nixos/modules/services/matrix/hebbot.nix
+2 -1
View File
@@ -20,6 +20,7 @@ in
meta.maintainers = [ lib.maintainers.raitobezarius ];
options.services.hebbot = {
enable = mkEnableOption "hebbot";
package = lib.mkPackageOption pkgs "hebbot" {};
botPasswordFile = mkOption {
type = types.path;
description = ''
@@ -61,7 +62,7 @@ in
script = ''
export BOT_PASSWORD="$(cat $CREDENTIALS_DIRECTORY/bot-password-file)"
${lib.getExe pkgs.hebbot}
${lib.getExe cfg.package}
'';
serviceConfig = {
nixos/modules/services/matrix/mautrix-facebook.nix
-203
View File
@@ -1,203 +0,0 @@
{
config,
pkgs,
lib,
...
}:
let
cfg = config.services.mautrix-facebook;
settingsFormat = pkgs.formats.json { };
settingsFile = settingsFormat.generate "mautrix-facebook-config.json" cfg.settings;
puppetRegex = lib.concatStringsSep ".*" (
map lib.escapeRegex (lib.splitString "{userid}" cfg.settings.bridge.username_template)
);
in
{
options = {
services.mautrix-facebook = {
enable = lib.mkEnableOption "Mautrix-Facebook, a Matrix-Facebook hybrid puppeting/relaybot bridge";
settings = lib.mkOption rec {
apply = lib.recursiveUpdate default;
type = settingsFormat.type;
default = {
homeserver = {
address = "http://localhost:8008";
software = "standard";
};
appservice = rec {
id = "facebook";
address = "http://${hostname}:${toString port}";
hostname = "localhost";
port = 29319;
database = "postgresql://";
bot_username = "facebookbot";
};
metrics.enabled = false;
manhole.enabled = false;
bridge = {
encryption = {
allow = true;
default = true;
verification_levels = {
receive = "cross-signed-tofu";
send = "cross-signed-tofu";
share = "cross-signed-tofu";
};
};
username_template = "facebook_{userid}";
};
logging = {
version = 1;
formatters.journal_fmt.format = "%(name)s: %(message)s";
handlers.journal = {
class = "systemd.journal.JournalHandler";
formatter = "journal_fmt";
SYSLOG_IDENTIFIER = "mautrix-facebook";
};
root = {
level = "INFO";
handlers = [ "journal" ];
};
};
};
example = lib.literalExpression ''
{
homeserver = {
address = "http://localhost:8008";
domain = "mydomain.example";
};
bridge.permissions = {
"@admin:mydomain.example" = "admin";
"mydomain.example" = "user";
};
}
'';
description = ''
{file}`config.yaml` configuration as a Nix attribute set.
Configuration options should match those described in
[example-config.yaml](https://github.com/mautrix/facebook/blob/master/mautrix_facebook/example-config.yaml).
Secret tokens should be specified using {option}`environmentFile`
instead of this world-readable attribute set.
'';
};
environmentFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
File containing environment variables to be passed to the mautrix-facebook service.
Any config variable can be overridden by setting `MAUTRIX_FACEBOOK_SOME_KEY` to override the `some.key` variable.
'';
};
configurePostgresql = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Enable PostgreSQL and create a user and database for mautrix-facebook. The default `settings` reference this database, if you disable this option you must provide a database URL.
'';
};
registrationData = lib.mkOption {
type = lib.types.attrs;
default = { };
description = ''
Output data for appservice registration. Simply make any desired changes and serialize to JSON. Note that this data contains secrets so think twice before putting it into the nix store.
Currently `as_token` and `hs_token` need to be added as they are not known to this module.
'';
};
};
};
config = lib.mkIf cfg.enable {
users.groups.mautrix-facebook = { };
users.users.mautrix-facebook = {
group = "mautrix-facebook";
isSystemUser = true;
};
services.postgresql = lib.mkIf cfg.configurePostgresql {
ensureDatabases = [ "mautrix-facebook" ];
ensureUsers = [
{
name = "mautrix-facebook";
ensureDBOwnership = true;
}
];
};
systemd.services.mautrix-facebook = rec {
wantedBy = [ "multi-user.target" ];
wants =
[
"network-online.target"
]
++ lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
++ lib.optional cfg.configurePostgresql "postgresql.service";
after = wants;
serviceConfig = {
Type = "simple";
Restart = "always";
User = "mautrix-facebook";
ProtectSystem = "strict";
ProtectHome = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectControlGroups = true;
PrivateTmp = true;
EnvironmentFile = cfg.environmentFile;
ExecStart = ''
${pkgs.mautrix-facebook}/bin/mautrix-facebook --config=${settingsFile}
'';
};
};
services.mautrix-facebook = {
registrationData = {
id = cfg.settings.appservice.id;
namespaces = {
users = [
{
exclusive = true;
regex = lib.escapeRegex "@${cfg.settings.appservice.bot_username}:${cfg.settings.homeserver.domain}";
}
{
exclusive = true;
regex = "@${puppetRegex}:${lib.escapeRegex cfg.settings.homeserver.domain}";
}
];
aliases = [ ];
};
url = cfg.settings.appservice.address;
sender_localpart = "mautrix-facebook-sender";
rate_limited = false;
"de.sorunome.msc2409.push_ephemeral" = true;
push_ephemeral = true;
};
};
};
meta.maintainers = with lib.maintainers; [ kevincox ];
}
nixos/modules/services/matrix/synapse.nix
+1 -1
View File
@@ -1597,9 +1597,9 @@ in
};
meta = {
inherit (pkgs.matrix-synapse.meta) maintainers;
buildDocsInSandbox = false;
doc = ./synapse.md;
maintainers = teams.matrix.members;
};
}
nixos/modules/services/misc/autobrr.nix
+4 -3
View File
@@ -9,7 +9,7 @@ let
cfg = config.services.autobrr;
configFormat = pkgs.formats.toml { };
configTemplate = configFormat.generate "autobrr.toml" cfg.settings;
templaterCmd = "${lib.getExe pkgs.dasel} put -f '${configTemplate}' -v $(cat ${cfg.secretFile}) -o %S/autobrr/config.toml 'sessionSecret'";
templaterCmd = ''${lib.getExe pkgs.dasel} put -f '${configTemplate}' -v "$(${config.systemd.package}/bin/systemd-creds cat sessionSecret)" -o %S/autobrr/config.toml "sessionSecret"'';
in
{
options = {
@@ -31,7 +31,7 @@ in
type = lib.types.submodule { freeformType = configFormat.type; };
default = {
host = "127.0.0.1";
port = "7474";
port = 7474;
checkForUpdates = true;
};
example = {
@@ -73,9 +73,10 @@ in
serviceConfig = {
Type = "simple";
DynamicUser = true;
LoadCredential = "sessionSecret:${cfg.secretFile}";
StateDirectory = "autobrr";
ExecStartPre = "${lib.getExe pkgs.bash} -c '${templaterCmd}'";
ExecStart = "${lib.getExe pkgs.autobrr} --config %S/autobrr";
ExecStart = "${lib.getExe cfg.package} --config %S/autobrr";
Restart = "on-failure";
};
};
nixos/modules/services/misc/bepasty.nix
+1 -1
View File
@@ -64,7 +64,7 @@ in
description = ''
Extra configuration for bepasty server to be appended on the
configuration.
see https://bepasty-server.readthedocs.org/en/latest/quickstart.html#configuring-bepasty
see <https://bepasty-server.readthedocs.org/en/latest/quickstart.html#configuring-bepasty>
for all options.
'';
default = "";
nixos/modules/services/misc/dysnomia.nix
+1 -1
View File
@@ -195,7 +195,7 @@ in
modules for compatibility reasons! If you rely on these modules, consider
migrating to better alternatives.
More information: https://raw.githubusercontent.com/svanderburg/dysnomia/f65a9a84827bcc4024d6b16527098b33b02e4054/README-legacy.md
More information: <https://raw.githubusercontent.com/svanderburg/dysnomia/f65a9a84827bcc4024d6b16527098b33b02e4054/README-legacy.md>
If you have migrated already or don't rely on these Dysnomia modules, you can
disable legacy mode with the following NixOS configuration option:
nixos/modules/services/misc/gitlab.nix
+2 -2
View File
@@ -644,7 +644,7 @@ in {
authentication = mkOption {
type = with types; nullOr str;
default = null;
description = "Authentication type to use, see http://api.rubyonrails.org/classes/ActionMailer/Base.html";
description = "Authentication type to use, see <http://api.rubyonrails.org/classes/ActionMailer/Base.html>";
};
enableStartTLSAuto = mkOption {
@@ -662,7 +662,7 @@ in {
opensslVerifyMode = mkOption {
type = types.str;
default = "peer";
description = "How OpenSSL checks the certificate, see http://api.rubyonrails.org/classes/ActionMailer/Base.html";
description = "How OpenSSL checks the certificate, see <http://api.rubyonrails.org/classes/ActionMailer/Base.html>";
};
};
nixos/modules/services/misc/homepage-dashboard.nix
+9 -9
View File
@@ -38,7 +38,7 @@ in
See the upstream documentation:
https://gethomepage.dev/installation/docker/#using-environment-secrets
<https://gethomepage.dev/installation/docker/#using-environment-secrets>
'';
default = "";
};
@@ -48,7 +48,7 @@ in
description = ''
Custom CSS for styling Homepage.
See https://gethomepage.dev/configs/custom-css-js/.
See <https://gethomepage.dev/configs/custom-css-js/>.
'';
default = "";
};
@@ -58,7 +58,7 @@ in
description = ''
Custom Javascript for Homepage.
See https://gethomepage.dev/configs/custom-css-js/.
See <https://gethomepage.dev/configs/custom-css-js/>.
'';
default = "";
};
@@ -68,7 +68,7 @@ in
description = ''
Homepage bookmarks configuration.
See https://gethomepage.dev/configs/bookmarks/.
See <https://gethomepage.dev/configs/bookmarks/>.
'';
# Defaults: https://github.com/gethomepage/homepage/blob/main/src/skeleton/bookmarks.yaml
example = [
@@ -105,7 +105,7 @@ in
description = ''
Homepage services configuration.
See https://gethomepage.dev/configs/services/.
See <https://gethomepage.dev/configs/services/>.
'';
# Defaults: https://github.com/gethomepage/homepage/blob/main/src/skeleton/services.yaml
example = [
@@ -138,7 +138,7 @@ in
description = ''
Homepage widgets configuration.
See https://gethomepage.dev/widgets/.
See <https://gethomepage.dev/widgets/>.
'';
# Defaults: https://github.com/gethomepage/homepage/blob/main/src/skeleton/widgets.yaml
example = [
@@ -164,7 +164,7 @@ in
description = ''
Homepage kubernetes configuration.
See https://gethomepage.dev/configs/kubernetes/.
See <https://gethomepage.dev/configs/kubernetes/>.
'';
default = { };
};
@@ -174,7 +174,7 @@ in
description = ''
Homepage docker configuration.
See https://gethomepage.dev/configs/docker/.
See <https://gethomepage.dev/configs/docker/>.
'';
default = { };
};
@@ -184,7 +184,7 @@ in
description = ''
Homepage settings.
See https://gethomepage.dev/configs/settings/.
See <https://gethomepage.dev/configs/settings/>.
'';
# Defaults: https://github.com/gethomepage/homepage/blob/main/src/skeleton/settings.yaml
default = { };
nixos/modules/services/misc/input-remapper.nix
+1 -1
View File
@@ -12,7 +12,7 @@ in
services.input-remapper = {
enable = lib.mkEnableOption "input-remapper, an easy to use tool to change the mapping of your input device buttons";
package = lib.mkPackageOption pkgs "input-remapper" { };
enableUdevRules = lib.mkEnableOption "udev rules added by input-remapper to handle hotplugged devices. Currently disabled by default due to https://github.com/sezanzeb/input-remapper/issues/140";
enableUdevRules = lib.mkEnableOption "udev rules added by input-remapper to handle hotplugged devices. Currently disabled by default due to <https://github.com/sezanzeb/input-remapper/issues/140>";
serviceWantedBy = lib.mkOption {
default = [ "graphical.target" ];
example = [ "multi-user.target" ];
nixos/modules/services/misc/invidious-router.nix
+1 -1
View File
@@ -66,7 +66,7 @@ in
};
description = ''
Configuration for invidious-router.
Check https://gitlab.com/gaincoder/invidious-router#configuration
Check <https://gitlab.com/gaincoder/invidious-router#configuration>
for configuration options.
'';
};
nixos/modules/services/misc/languagetool.nix
+1 -1
View File
@@ -60,7 +60,7 @@ in
jvmOptions = lib.mkOption {
description = ''
Extra command line options for the JVM running languagetool.
More information can be found here: https://docs.oracle.com/en/java/javase/19/docs/specs/man/java.html#standard-options-for-java
More information can be found here: <https://docs.oracle.com/en/java/javase/19/docs/specs/man/java.html#standard-options-for-java>
'';
default = [ ];
type = lib.types.listOf lib.types.str;
nixos/modules/services/misc/metabase.nix
+3 -1
View File
@@ -15,6 +15,8 @@ in {
services.metabase = {
enable = mkEnableOption "Metabase service";
package = lib.mkPackageOption pkgs "metabase" { };
listen = {
ip = mkOption {
type = types.str;
@@ -92,7 +94,7 @@ in {
serviceConfig = {
DynamicUser = true;
StateDirectory = baseNameOf dataDir;
ExecStart = "${pkgs.metabase}/bin/metabase";
ExecStart = lib.getExe cfg.package;
};
};
nixos/modules/services/misc/nitter.nix
+2 -2
View File
@@ -318,7 +318,7 @@ in
Add settings here to override NixOS module generated settings.
Check the official repository for the available settings:
https://github.com/zedeus/nitter/blob/master/nitter.example.conf
<https://github.com/zedeus/nitter/blob/master/nitter.example.conf>
'';
};
@@ -334,7 +334,7 @@ in
{"oauth_token":"some_token","oauth_token_secret":"some_secret_key"}
See https://github.com/zedeus/nitter/wiki/Guest-Account-Branch-Deployment
See <https://github.com/zedeus/nitter/wiki/Guest-Account-Branch-Deployment>
for more information on guest accounts and how to generate them.
'';
};
nixos/modules/services/misc/ollama.nix
+1 -1
View File
@@ -158,7 +158,7 @@ in
This creates a systemd unit `ollama-model-loader.service`.
Search for models of your choice from: https://ollama.com/library
Search for models of your choice from: <https://ollama.com/library>
'';
};
openFirewall = lib.mkOption {
nixos/modules/services/misc/open-webui.nix
+1 -1
View File
@@ -56,7 +56,7 @@ in
'';
description = ''
Extra environment variables for Open-WebUI.
For more details see https://docs.openwebui.com/getting-started/advanced-topics/env-configuration/
For more details see <https://docs.openwebui.com/getting-started/advanced-topics/env-configuration/>
'';
};
nixos/modules/services/misc/pinnwand.nix
+1 -1
View File
@@ -34,7 +34,7 @@ in
default = "sqlite:////var/lib/pinnwand/pinnwand.db";
example = "sqlite:///:memory";
description = ''
Database URI compatible with [SQLAlchemyhttps://docs.sqlalchemy.org/en/14/core/engines.html#database-urls].
Database URI compatible with [SQLAlchemy](https://docs.sqlalchemy.org/en/14/core/engines.html#database-urls).
Additional packages may need to be introduced into the environment for certain databases.
'';
nixos/modules/services/misc/sourcehut/default.nix
+2 -2
View File
@@ -613,11 +613,11 @@ in
};
options."meta.sr.ht::billing" = {
enabled = mkEnableOption "the billing system";
stripe-public-key = mkOptionNullOrStr "Public key for Stripe. Get your keys at https://dashboard.stripe.com/account/apikeys";
stripe-public-key = mkOptionNullOrStr "Public key for Stripe. Get your keys at <https://dashboard.stripe.com/account/apikeys>";
stripe-secret-key =
mkOptionNullOrStr ''
An absolute file path (which should be outside the Nix-store)
to a secret key for Stripe. Get your keys at https://dashboard.stripe.com/account/apikeys
to a secret key for Stripe. Get your keys at <https://dashboard.stripe.com/account/apikeys>
''
// {
apply = mapNullable (s: "<" + toString s);
nixos/modules/services/misc/tabby.nix
+2 -1
View File
@@ -16,7 +16,8 @@ in
{
imports = [
(mkRemovedOptionModule [
"settings"
"services"
"tabby"
"indexInterval"
] "These options are now managed within the tabby WebGUI")
];
nixos/modules/services/misc/tzupdate.nix
+5 -1
View File
@@ -28,7 +28,11 @@ in {
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
script = ''
timedatectl set-timezone "$(${lib.getExe pkgs.tzupdate} --print-only)"
timezone="$(${lib.getExe pkgs.tzupdate} --print-only)"
if [[ -n "$timezone" ]]; then
echo "Setting timezone to '$timezone'"
timedatectl set-timezone "$timezone"
fi
'';
serviceConfig = {
nixos/modules/services/misc/uhub.nix
+1 -1
View File
@@ -46,7 +46,7 @@ in
inherit (settingsFormat) type;
description = ''
Configuration of uhub.
See https://www.uhub.org/doc/config.php for a list of options.
See <https://www.uhub.org/doc/config.php> for a list of options.
'';
default = { };
example = {
nixos/modules/services/monitoring/bosun.nix
+1 -1
View File
@@ -104,7 +104,7 @@ in
option.
A detailed description of the supported syntax can be found at-spi2-atk
https://bosun.org/configuration.html
<https://bosun.org/configuration.html>
'';
};
nixos/modules/services/monitoring/glances.nix
+1 -1
View File
@@ -57,7 +57,7 @@ in
description = ''
Extra command-line arguments to pass to glances.
See https://glances.readthedocs.io/en/latest/cmds.html for all available options.
See <https://glances.readthedocs.io/en/latest/cmds.html> for all available options.
'';
};
};
nixos/modules/services/monitoring/glpi-agent.nix
+10
View File
@@ -77,6 +77,16 @@ in
}
];
systemd.tmpfiles.settings."10-glpi-agent" = {
${cfg.stateDir} = {
d = {
mode = "0755";
user = "root";
group = "root";
};
};
};
systemd.services.glpi-agent = {
description = "GLPI Agent";
wantedBy = [ "multi-user.target" ];
nixos/modules/services/monitoring/librenms.nix
+3 -3
View File
@@ -344,9 +344,9 @@ in
};
description = ''
Attrset of the LibreNMS configuration.
See https://docs.librenms.org/Support/Configuration/ for reference.
See <https://docs.librenms.org/Support/Configuration/> for reference.
All possible options are listed [here](https://github.com/librenms/librenms/blob/master/misc/config_definitions.json).
See https://docs.librenms.org/Extensions/Authentication/ for setting other authentication methods.
See <https://docs.librenms.org/Extensions/Authentication/> for setting other authentication methods.
'';
default = { };
example = {
@@ -361,7 +361,7 @@ in
default = null;
description = ''
Additional config for LibreNMS that will be appended to the `config.php`. See
https://github.com/librenms/librenms/blob/master/misc/config_definitions.json
<https://github.com/librenms/librenms/blob/master/misc/config_definitions.json>
for possible options. Useful if you want to use PHP-Functions in your config.
'';
};
nixos/modules/services/monitoring/longview.nix
+2 -2
View File
@@ -30,7 +30,7 @@ in
example = "01234567-89AB-CDEF-0123456789ABCDEF";
description = ''
Longview API key. To get this, look in Longview settings which
are found at https://manager.linode.com/longview/.
are found at <https://manager.linode.com/longview/>.
Warning: this secret is stored in the world-readable Nix store!
Use {option}`apiKeyFile` instead.
@@ -44,7 +44,7 @@ in
description = ''
A file containing the Longview API key.
To get this, look in Longview settings which
are found at https://manager.linode.com/longview/.
are found at <https://manager.linode.com/longview/>.
{option}`apiKeyFile` takes precedence over {option}`apiKey`.
'';
nixos/modules/services/monitoring/opentelemetry-collector.nix
+1 -1
View File
@@ -32,7 +32,7 @@ in
description = ''
Specify the configuration for Opentelemetry Collector in Nix.
See https://opentelemetry.io/docs/collector/configuration/ for available options.
See <https://opentelemetry.io/docs/collector/configuration/> for available options.
'';
};
nixos/modules/services/monitoring/osquery.nix
+2 -2
View File
@@ -40,7 +40,7 @@ in
default = { };
description = ''
Configuration to be written to the osqueryd JSON configuration file.
To understand the configuration format, refer to https://osquery.readthedocs.io/en/stable/deployment/configuration/#configuration-components.
To understand the configuration format, refer to <https://osquery.readthedocs.io/en/stable/deployment/configuration/#configuration-components>.
'';
example = {
options.utc = false;
@@ -52,7 +52,7 @@ in
default = { };
description = ''
Attribute set of flag names and values to be written to the osqueryd flagfile.
For more information, refer to https://osquery.readthedocs.io/en/stable/installation/cli-flags.
For more information, refer to <https://osquery.readthedocs.io/en/stable/installation/cli-flags>.
'';
example = {
config_refresh = "10";
nixos/modules/services/monitoring/prometheus/default.nix
+6 -6
View File
@@ -546,7 +546,7 @@ let
authentication_method = mkDefOpt (types.enum [ "OAuth" "ManagedIdentity" ]) "OAuth" ''
The authentication method, either OAuth or ManagedIdentity.
See https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
See <https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview>
'';
subscription_id = mkOption {
@@ -973,8 +973,8 @@ let
)
) ''
Optional label and field selectors to limit the discovery process to a subset of available resources.
See https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/
and https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ to learn more about the possible
See <https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/>
and <https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/> to learn more about the possible
filters that can be used. Endpoints role supports pod, service and endpoints selectors, other roles
only support selectors matching the role itself (e.g. node role can only contain node selectors).
@@ -1210,7 +1210,7 @@ let
type = types.str;
description = ''
Puppet Query Language (PQL) query. Only resources are supported.
https://puppet.com/docs/puppetdb/latest/api/query/v4/pql.html
<https://puppet.com/docs/puppetdb/latest/api/query/v4/pql.html>
'';
};
@@ -1238,12 +1238,12 @@ let
access_key = mkOption {
type = types.str;
description = ''
Access key to use. https://console.scaleway.com/project/credentials
Access key to use. <https://console.scaleway.com/project/credentials>
'';
};
secret_key = mkOpt types.str ''
Secret key to use when listing targets. https://console.scaleway.com/project/credentials
Secret key to use when listing targets. <https://console.scaleway.com/project/credentials>
It is mutually exclusive with `secret_key_file`.
'';
nixos/modules/services/monitoring/prometheus/exporters.nix
+1
View File
@@ -66,6 +66,7 @@ let
"nginx"
"nginxlog"
"node"
"node-cert"
"nut"
"nvidia-gpu"
"pgbouncer"
nixos/modules/services/monitoring/prometheus/exporters/idrac.nix
+2 -2
View File
@@ -30,7 +30,7 @@ in
Mutually exclusive with `configuration` option.
Configuration reference: https://github.com/mrlhansen/idrac_exporter/#configuration
Configuration reference: <https://github.com/mrlhansen/idrac_exporter/#configuration>
'';
};
configuration = mkOption {
@@ -38,7 +38,7 @@ in
description = ''
Configuration for iDRAC exporter, as a nix attribute set.
Configuration reference: https://github.com/mrlhansen/idrac_exporter/#configuration
Configuration reference: <https://github.com/mrlhansen/idrac_exporter/#configuration>
Mutually exclusive with `configurationPath` option.
'';
nixos/modules/services/monitoring/prometheus/exporters/nginxlog.nix
+1 -1
View File
@@ -40,7 +40,7 @@ in
All settings of nginxlog expressed as an Nix attrset.
Check the official documentation for the corresponding YAML
settings that can all be used here: https://github.com/martin-helmich/prometheus-nginxlog-exporter
settings that can all be used here: <https://github.com/martin-helmich/prometheus-nginxlog-exporter>
The `listen` object is already generated by `port`, `listenAddress` and `metricsEndpoint` and
will be merged with the value of `settings` before writing it as JSON.
nixos/modules/services/monitoring/prometheus/exporters/node-cert.nix
+70
View File
@@ -0,0 +1,70 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.prometheus.exporters.node-cert;
inherit (lib) mkOption types concatStringsSep;
in
{
port = 9141;
extraOpts = {
paths = mkOption {
type = types.listOf types.str;
description = ''
List of paths to search for SSL certificates.
'';
};
excludePaths = mkOption {
type = types.listOf types.str;
description = ''
List of paths to exclute from searching for SSL certificates.
'';
default = [ ];
};
includeGlobs = mkOption {
type = types.listOf types.str;
description = ''
List files matching a pattern to include. Uses Go blob pattern.
'';
default = [ ];
};
excludeGlobs = mkOption {
type = types.listOf types.str;
description = ''
List files matching a pattern to include. Uses Go blob pattern.
'';
default = [ ];
};
user = mkOption {
type = types.str;
description = ''
User owning the certs.
'';
default = "acme";
};
};
serviceOpts = {
serviceConfig = {
User = cfg.user;
ExecStart = ''
${lib.getExe pkgs.prometheus-node-cert-exporter} \
--listen ${toString cfg.listenAddress}:${toString cfg.port} \
--path ${concatStringsSep "," cfg.paths} \
--exclude-path "${concatStringsSep "," cfg.excludePaths}" \
--include-glob "${concatStringsSep "," cfg.includeGlobs}" \
--exclude-glob "${concatStringsSep "," cfg.excludeGlobs}" \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
};
};
}
nixos/modules/services/monitoring/scrutiny.nix
+2 -2
View File
@@ -35,7 +35,7 @@ in
description = ''
Scrutiny settings to be rendered into the configuration file.
See https://github.com/AnalogJ/scrutiny/blob/master/example.scrutiny.yaml.
See <https://github.com/AnalogJ/scrutiny/blob/master/example.scrutiny.yaml>.
'';
default = { };
type = submodule {
@@ -129,7 +129,7 @@ in
description = ''
Collector settings to be rendered into the collector configuration file.
See https://github.com/AnalogJ/scrutiny/blob/master/example.collector.yaml.
See <https://github.com/AnalogJ/scrutiny/blob/master/example.collector.yaml>.
'';
default = { };
type = submodule {
nixos/modules/services/network-filesystems/glusterfs.nix
+3 -3
View File
@@ -59,8 +59,8 @@ in
You may want to turn it off to reduce the attack surface for DDoS reflection attacks.
See https://davelozier.com/glusterfs-and-rpcbind-portmap-ddos-reflection-attacks/
and https://bugzilla.redhat.com/show_bug.cgi?id=1426842 for details.
See <https://davelozier.com/glusterfs-and-rpcbind-portmap-ddos-reflection-attacks/>
and <https://bugzilla.redhat.com/show_bug.cgi?id=1426842> for details.
'';
default = true;
};
@@ -123,7 +123,7 @@ in
Enabling this will create a file {file}`/var/lib/glusterd/secure-access`.
Disabling will delete this file again.
See also: https://gluster.readthedocs.io/en/latest/Administrator%20Guide/SSL/
See also: <https://gluster.readthedocs.io/en/latest/Administrator%20Guide/SSL/>
'';
default = null;
type = lib.types.nullOr (
nixos/modules/services/networking/3proxy.nix
+1 -1
View File
@@ -40,7 +40,7 @@ in
test2:CR:$1$rkpibm5J$Aq1.9VtYAn0JrqZ8M.1ME.
```
You can generate md5-crypted passwords via https://unix4lyfe.org/crypt/
You can generate md5-crypted passwords via <https://unix4lyfe.org/crypt/>
Note that htpasswd tool generates incompatible md5-crypted passwords.
Consult [documentation](https://github.com/z3APA3A/3proxy/wiki/How-To-%28incomplete%29#USERS) for more information.
'';
nixos/modules/services/networking/atticd.nix
+1 -1
View File
@@ -103,7 +103,7 @@ in
settings = lib.mkOption {
description = ''
Structured configurations of atticd.
See https://github.com/zhaofengli/attic/blob/main/server/src/config-template.toml
See <https://github.com/zhaofengli/attic/blob/main/server/src/config-template.toml>
'';
type = format.type;
default = { };
nixos/modules/services/networking/coturn.nix
+1 -1
View File
@@ -171,7 +171,7 @@ in
This feature can be used with the long-term authentication mechanism, only.
This feature purpose is to support "TURN Server REST API", see
"TURN REST API" link in the project's page
https://github.com/coturn/coturn/
<https://github.com/coturn/coturn/>
This option is used with timestamp:
nixos/modules/services/networking/ddclient.nix
+1 -1
View File
@@ -123,7 +123,7 @@ in
default = "dyndns2";
type = str;
description = ''
Protocol to use with dynamic DNS provider (see https://ddclient.net/protocols.html ).
Protocol to use with dynamic DNS provider (see <https://ddclient.net/protocols.html> ).
'';
};
nixos/modules/services/networking/ddns-updater.nix
+1 -1
View File
@@ -16,7 +16,7 @@ in
environment = lib.mkOption {
type = lib.types.attrsOf lib.types.str;
description = "Environment variables to be set for the ddns-updater service. DATADIR is ignored to enable using systemd DynamicUser. For full list see https://github.com/qdm12/ddns-updater";
description = "Environment variables to be set for the ddns-updater service. DATADIR is ignored to enable using systemd DynamicUser. For full list see <https://github.com/qdm12/ddns-updater>";
default = { };
};
};
nixos/modules/services/networking/deconz.nix
+1 -1
View File
@@ -76,7 +76,7 @@ in
];
description = ''
Extra command line arguments for deCONZ, see
https://github.com/dresden-elektronik/deconz-rest-plugin/wiki/deCONZ-command-line-parameters.
<https://github.com/dresden-elektronik/deconz-rest-plugin/wiki/deCONZ-command-line-parameters>.
'';
};
};
nixos/modules/services/networking/epmd.nix
+1 -1
View File
@@ -25,7 +25,7 @@ in
default = "[::]:4369";
description = ''
the listenStream used by the systemd socket.
see https://www.freedesktop.org/software/systemd/man/systemd.socket.html#ListenStream= for more information.
see <https://www.freedesktop.org/software/systemd/man/systemd.socket.html#ListenStream=> for more information.
use this to change the port epmd will run on.
if not defined, epmd will use "[::]:4369"
'';
nixos/modules/services/networking/firewall.nix
+1 -1
View File
@@ -245,7 +245,7 @@ in
Loading of helpers is recommended to be done through the
CT target. More info:
https://home.regit.org/netfilter-en/secure-use-of-helpers/
<https://home.regit.org/netfilter-en/secure-use-of-helpers/>
'';
};
nixos/modules/services/networking/headscale.nix
+1 -1
View File
@@ -228,7 +228,7 @@ in
default = true;
description = ''
Enable WAL mode for SQLite. This is recommended for production environments.
https://www.sqlite.org/wal.html
<https://www.sqlite.org/wal.html>
'';
example = true;
};
nixos/modules/services/networking/nats.nix
+11 -8
View File
@@ -17,14 +17,17 @@ let
validateConfig =
file:
pkgs.runCommand "validate-nats-conf"
{
nativeBuildInputs = [ pkgs.nats-server ];
}
''
nats-server --config "${configFile}" -t
ln -s "${configFile}" "$out"
'';
pkgs.callPackage (
{ runCommand, nats-server }:
runCommand "validate-nats-conf"
{
nativeBuildInputs = [ nats-server ];
}
''
nats-server --config "${configFile}" -t
ln -s "${configFile}" "$out"
''
) { };
in
{
nixos/modules/services/networking/nghttpx/backend-params-submodule.nix
+8 -8
View File
@@ -11,7 +11,7 @@
This option configures the protocol the backend server expects
to use.
Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
Please see <https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b>
for more detail.
'';
};
@@ -24,7 +24,7 @@
connection with a backend server using TLS or not. The burden
is on the backend server to provide the TLS certificate!
Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
Please see <https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b>
for more detail.
'';
};
@@ -36,7 +36,7 @@
Override the TLS SNI field value. This value (in nghttpx)
defaults to the host value of the backend configuration.
Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
Please see <https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b>
for more detail.
'';
};
@@ -50,7 +50,7 @@
balancing. If N is 0 the backend is never excluded from load
balancing.
Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
Please see <https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b>
for more detail.
'';
};
@@ -65,7 +65,7 @@
re-included in load balancing. If N is 0 a backend is never
reconsidered for load balancing once it falls.
Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
Please see <https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b>
for more detail.
'';
};
@@ -90,7 +90,7 @@
one of the backend gets unreachable, or backend settings are
reloaded or replaced by API.
Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
Please see <https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b>
for more detail.
'';
};
@@ -107,7 +107,7 @@
"dns" is true, name resolution of a backend's host name at
start up, or configuration reload is skipped.
Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
Please see <https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b>
for more detail.
'';
};
@@ -130,7 +130,7 @@
pattern. It is advised to set "redirect-if-no-tls" parameter
to all backends explicitly if this feature is desired.
Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
Please see <https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b>
for more detail.
'';
};
nixos/modules/services/networking/opengfw.nix
+1 -1
View File
@@ -172,7 +172,7 @@ in
ruleset = mkOption {
description = ''
The path to load specific local geoip/geosite db files.
If not set, they will be automatically downloaded from (Loyalsoldier/v2ray-rules-dat)[https://github.com/Loyalsoldier/v2ray-rules-dat].
If not set, they will be automatically downloaded from [Loyalsoldier/v2ray-rules-dat](https://github.com/Loyalsoldier/v2ray-rules-dat).
'';
default = { };
type = types.submodule {
nixos/modules/services/networking/wg-access-server.nix
+1 -1
View File
@@ -43,7 +43,7 @@ in
};
};
};
description = "See https://www.freie-netze.org/wg-access-server/2-configuration/ for possible options";
description = "See <https://www.freie-netze.org/wg-access-server/2-configuration/> for possible options";
};
secretsFile = mkOption {
nixos/modules/services/networking/wg-quick.nix
+52 -11
View File
@@ -11,6 +11,15 @@ let
interfaceOpts = { ... }: {
options = {
type = mkOption {
example = "amneziawg";
default = "wireguard";
type = types.enum ["wireguard" "amneziawg"];
description = ''
The type of the interface. Currently only "wireguard" and "amneziawg" are supported.
'';
};
configFile = mkOption {
example = "/secret/wg0.conf";
default = null;
@@ -151,6 +160,22 @@ let
description = "Peers linked to the interface.";
type = with types; listOf (submodule peerOpts);
};
extraOptions = mkOption {
type = with types; attrsOf (oneOf [ str int ]);
default = { };
example = {
Jc = 5;
Jmin = 10;
Jmax = 42;
S1 = 60;
S2 = 90;
H4 = 12345;
};
description = ''
Extra options to append to the interface section. Can be used to define AmneziaWG-specific options.
'';
};
};
};
@@ -230,7 +255,7 @@ let
writeScriptFile = name: text: ((pkgs.writeShellScriptBin name text) + "/bin/${name}");
generatePrivateKeyScript = privateKeyFile: ''
generatePrivateKeyScript = privateKeyFile: wgBin: ''
set -e
# If the parent dir does not already exist, create it.
@@ -239,7 +264,7 @@ let
if [ ! -f "${privateKeyFile}" ]; then
# Write private key file with atomically-correct permissions.
(set -e; umask 077; wg genkey > "${privateKeyFile}")
(set -e; umask 077; ${wgBin} genkey > "${privateKeyFile}")
fi
'';
@@ -247,11 +272,19 @@ let
assert assertMsg (values.configFile != null || ((values.privateKey != null) != (values.privateKeyFile != null))) "Only one of privateKey, configFile or privateKeyFile may be set";
assert assertMsg (values.generatePrivateKeyFile == false || values.privateKeyFile != null) "generatePrivateKeyFile requires privateKeyFile to be set";
let
generateKeyScriptFile = if values.generatePrivateKeyFile then writeScriptFile "generatePrivateKey.sh" (generatePrivateKeyScript values.privateKeyFile) else null;
wgBin = {
wireguard = "wg";
amneziawg = "awg";
}.${values.type};
generateKeyScriptFile =
if values.generatePrivateKeyFile then
writeScriptFile "generatePrivateKey.sh" (generatePrivateKeyScript values.privateKeyFile wgBin)
else
null;
preUpFile = if values.preUp != "" then writeScriptFile "preUp.sh" values.preUp else null;
postUp =
optional (values.privateKeyFile != null) "wg set ${name} private-key <(cat ${values.privateKeyFile})" ++
(concatMap (peer: optional (peer.presharedKeyFile != null) "wg set ${name} peer ${peer.publicKey} preshared-key <(cat ${peer.presharedKeyFile})") values.peers) ++
optional (values.privateKeyFile != null) "${wgBin} set ${name} private-key <(cat ${values.privateKeyFile})" ++
(concatMap (peer: optional (peer.presharedKeyFile != null) "${wgBin} set ${name} peer ${peer.publicKey} preshared-key <(cat ${peer.presharedKeyFile})") values.peers) ++
optional (values.postUp != "") values.postUp;
postUpFile = if postUp != [] then writeScriptFile "postUp.sh" (concatMapStringsSep "\n" (line: line) postUp) else null;
preDownFile = if values.preDown != "" then writeScriptFile "preDown.sh" values.preDown else null;
@@ -279,6 +312,7 @@ let
optionalString (postUpFile != null) "PostUp = ${postUpFile}\n" +
optionalString (preDownFile != null) "PreDown = ${preDownFile}\n" +
optionalString (postDownFile != null) "PostDown = ${postDownFile}\n" +
concatLines (mapAttrsToList (n: v: "${n} = ${toString v}") values.extraOptions) +
concatMapStringsSep "\n" (peer:
assert assertMsg (!((peer.presharedKeyFile != null) && (peer.presharedKey != null))) "Only one of presharedKey or presharedKeyFile may be set";
"[Peer]\n" +
@@ -304,7 +338,10 @@ let
wantedBy = optional values.autostart "multi-user.target";
environment.DEVICE = name;
path = [
pkgs.wireguard-tools
{
wireguard = pkgs.wireguard-tools;
amneziawg = pkgs.amneziawg-tools;
}.${values.type}
config.networking.firewall.package # iptables or nftables
config.networking.resolvconf.package # openresolv or systemd
];
@@ -315,11 +352,11 @@ let
};
script = ''
${optionalString (!config.boot.isContainer) "${pkgs.kmod}/bin/modprobe wireguard"}
${optionalString (!config.boot.isContainer) "${pkgs.kmod}/bin/modprobe ${values.type}"}
${optionalString (values.configFile != null) ''
cp ${values.configFile} ${configPath}
''}
wg-quick up ${configPath}
${wgBin}-quick up ${configPath}
'';
serviceConfig = {
@@ -328,7 +365,7 @@ let
};
preStop = ''
wg-quick down ${configPath}
${wgBin}-quick down ${configPath}
'';
};
in {
@@ -360,8 +397,12 @@ in {
###### implementation
config = mkIf (cfg.interfaces != {}) {
boot.extraModulePackages = optional (versionOlder kernel.kernel.version "5.6") kernel.wireguard;
environment.systemPackages = [ pkgs.wireguard-tools ];
boot.extraModulePackages =
optional (any (x: x.type == "wireguard") (attrValues cfg.interfaces) && (versionOlder kernel.kernel.version "5.6")) kernel.wireguard
++ optional (any (x: x.type == "amneziawg") (attrValues cfg.interfaces)) kernel.amneziawg;
environment.systemPackages =
optional (any (x: x.type == "wireguard") (attrValues cfg.interfaces)) pkgs.wireguard-tools
++ optional (any (x: x.type == "amneziawg") (attrValues cfg.interfaces)) pkgs.amneziawg-tools;
systemd.services = mapAttrs' generateUnit cfg.interfaces;
# Prevent networkd from clearing the rules set by wg-quick when restarted (e.g. when waking up from suspend).
nixos/modules/services/networking/wireguard-networkd.nix
+4
View File
@@ -189,6 +189,10 @@ in
assertion = interface.interfaceNamespace == null;
message = "networking.wireguard.interfaces.${name}.interfaceNamespace cannot be used with networkd.";
}
{
assertion = interface.type == "wireguard";
message = "networking.wireguard.interfaces.${name}.type value must be \"wireguard\" when used with networkd.";
}
]
++ flip concatMap interface.ips (ip: [
# IP assertions

Some files were not shown because too many files have changed in this diff Show More