gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'master' into tracee-use-new-wrapper

Browse Source
This commit is contained in:
Guillaume Girol
2022-10-11 09:57:23 +00:00
committed by GitHub
parent 1a90756aa7 93dc85b485
commit 6fe43abcfc
1612 changed files with 64122 additions and 23467 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/ISSUE_TEMPLATE/missing_documentation.md
+1 -1
View File
@@ -15,7 +15,7 @@ assignees: ''
<!-- make sure this issue is not redundant or obsolete -->
- [ ] checked [latest Nixpkgs manual] \([source][nixpkgs-source]) and [latest NixOS manual]] \([source][nixos-source])
- [ ] checked [latest Nixpkgs manual] \([source][nixpkgs-source]) and [latest NixOS manual] \([source][nixos-source])
- [ ] checked [open documentation issues] for possible duplicates
- [ ] checked [open documentation pull requests] for possible solutions
.github/workflows/update-terraform-providers.yml
+9 -14
View File
@@ -1,8 +1,8 @@
name: "Update terraform-providers"
on:
#schedule:
# - cron: "14 3 * * 0"
schedule:
- cron: "0 3 * * *"
workflow_dispatch:
permissions:
@@ -28,10 +28,13 @@ jobs:
run: |
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config user.name "github-actions[bot]"
pushd pkgs/applications/networking/cluster/terraform-providers
./update-all-providers --no-build
git commit -m "${{ steps.setup.outputs.title }}" providers.json
popd
echo | nix-shell \
maintainers/scripts/update.nix \
--argstr commit true \
--argstr keep-going true \
--argstr max-workers 2 \
--argstr path terraform-providers
git clean -f
- name: create PR
uses: peter-evans/create-pull-request@v4
with:
@@ -44,13 +47,5 @@ jobs:
```
branch: terraform-providers-update
delete-branch: false
labels: "2.status: work-in-progress"
title: ${{ steps.setup.outputs.title }}
token: ${{ secrets.GITHUB_TOKEN }}
- name: comment on failure
uses: peter-evans/create-or-update-comment@v2
if: ${{ failure() }}
with:
issue-number: 153416
body: |
Automatic update of terraform providers [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
doc/builders/images.xml
+1
View File
@@ -9,4 +9,5 @@
<xi:include href="images/dockertools.section.xml" />
<xi:include href="images/ocitools.section.xml" />
<xi:include href="images/snaptools.section.xml" />
<xi:include href="images/portableservice.section.xml" />
</chapter>
doc/builders/images/portableservice.section.md
+81
View File
@@ -0,0 +1,81 @@
# pkgs.portableService {#sec-pkgs-portableService}
`pkgs.portableService` is a function to create _portable service images_,
as read-only, immutable, `squashfs` archives.
systemd supports a concept of [Portable Services](https://systemd.io/PORTABLE_SERVICES/).
Portable Services are a delivery method for system services that uses two specific features of container management:
* Applications are bundled. I.e. multiple services, their binaries and
all their dependencies are packaged in an image, and are run directly from it.
* Stricter default security policies, i.e. sandboxing of applications.
This allows using Nix to build images which can be run on many recent Linux distributions.
The primary tool for interacting with Portable Services is `portablectl`,
and they are managed by the `systemd-portabled` system service.
:::{.note}
Portable services are supported starting with systemd 239 (released on 2018-06-22).
:::
A very simple example of using `portableService` is described below:
[]{#ex-pkgs-portableService}
```nix
pkgs.portableService {
pname = "demo";
version = "1.0";
units = [ demo-service demo-socket ];
}
```
The above example will build an squashfs archive image in `result/$pname_$version.raw`. The image will contain the
file system structure as required by the portable service specification, and a subset of the Nix store with all the
dependencies of the two derivations in the `units` list.
`units` must be a list of derivations, and their names must be prefixed with the service name (`"demo"` in this case).
Otherwise `systemd-portabled` will ignore them.
:::{.Note}
The `.raw` file extension of the image is required by the portable services specification.
:::
Some other options available are:
- `description`, `homepage`
Are added to the `/etc/os-release` in the image and are shown by the portable services tooling.
Default to empty values, not added to os-release.
- `symlinks`
A list of attribute sets {object, symlink}. Symlinks will be created in the root filesystem of the image to
objects in the Nix store. Defaults to an empty list.
- `contents`
A list of additional derivations to be included in the image Nix store, as-is. Defaults to an empty list.
- `squashfsTools`
Defaults to `pkgs.squashfsTools`, allows you to override the package that provides `mksquashfs`.
- `squash-compression`, `squash-block-size`
Options to `mksquashfs`. Default to `"xz -Xdict-size 100%"` and `"1M"` respectively.
A typical usage of `symlinks` would be:
```nix
symlinks = [
{ object = "${pkgs.cacert}/etc/ssl"; symlink = "/etc/ssl"; }
{ object = "${pkgs.bash}/bin/bash"; symlink = "/bin/sh"; }
{ object = "${pkgs.php}/bin/php"; symlink = "/usr/bin/php"; }
];
```
to create these symlinks for legacy applications that assume them existing globally.
Once the image is created, and deployed on a host in `/var/lib/portables/`, you can attach the image and run the service. As root run:
```console
portablectl attach demo_1.0.raw
systemctl enable --now demo.socket
systemctl enable --now demo.service
```
:::{.Note}
See the [man page](https://www.freedesktop.org/software/systemd/man/portablectl.html) of `portablectl` for more info on its usage.
:::
doc/languages-frameworks/coq.section.md
+3 -3
View File
@@ -31,7 +31,7 @@ The recommended way of defining a derivation for a Coq library, is to use the `c
* `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
* `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
* `namePrefix` (optional, defaults to `[ "coq" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
* `nativeBuildInputs` (optional), is a list of executables that are required to build the current derivation, in addition to the default ones (namely `which`, `dune` and `ocaml` depending on whether `useDune2`, `useDune2ifVersion` and `mlPlugin` are set).
* `nativeBuildInputs` (optional), is a list of executables that are required to build the current derivation, in addition to the default ones (namely `which`, `dune` and `ocaml` depending on whether `useDune`, `useDuneifVersion` and `mlPlugin` are set).
* `extraNativeBuildInputs` (optional, deprecated), an additional list of derivation to add to `nativeBuildInputs`,
* `overrideNativeBuildInputs` (optional) replaces the default list of derivation to which `nativeBuildInputs` and `extraNativeBuildInputs` adds extra elements,
* `buildInputs` (optional), is a list of libraries and dependencies that are required to build and run the current derivation, in addition to the default one `[ coq ]`,
@@ -39,8 +39,8 @@ The recommended way of defining a derivation for a Coq library, is to use the `c
* `overrideBuildInputs` (optional) replaces the default list of derivation to which `buildInputs` and `extraBuildInputs` adds extras elements,
* `propagatedBuildInputs` (optional) is passed as is to `mkDerivation`, we recommend to use this for Coq libraries and Coq plugin dependencies, as this makes sure the paths of the compiled libraries and plugins will always be added to the build environements of subsequent derivation, which is necessary for Coq packages to work correctly,
* `mlPlugin` (optional, defaults to `false`). Some extensions (plugins) might require OCaml and sometimes other OCaml packages. Standard dependencies can be added by setting the current option to `true`. For a finer grain control, the `coq.ocamlPackages` attribute can be used in `nativeBuildInputs`, `buildInputs`, and `propagatedBuildInputs` to depend on the same package set Coq was built against.
* `useDune2ifVersion` (optional, default to `(x: false)` uses Dune2 to build the package if the provided predicate evaluates to true on the version, e.g. `useDune2ifVersion = versions.isGe "1.1"` will use dune if the version of the package is greater or equal to `"1.1"`,
* `useDune2` (optional, defaults to `false`) uses Dune2 to build the package if set to true, the presence of this attribute overrides the behavior of the previous one.
* `useDuneifVersion` (optional, default to `(x: false)` uses Dune to build the package if the provided predicate evaluates to true on the version, e.g. `useDuneifVersion = versions.isGe "1.1"` will use dune if the version of the package is greater or equal to `"1.1"`,
* `useDune` (optional, defaults to `false`) uses Dune to build the package if set to true, the presence of this attribute overrides the behavior of the previous one.
* `opam-name` (optional, defaults to concatenating with a dash separator the components of `namePrefix` and `pname`), name of the Dune package to build.
* `enableParallelBuilding` (optional, defaults to `true`), since it is activated by default, we provide a way to disable it.
* `extraInstallFlags` (optional), allows to extend `installFlags` which initializes the variable `COQMF_COQLIB` so as to install in the proper subdirectory. Indeed Coq libraries should be installed in `$(out)/lib/coq/${coq.coq-version}/user-contrib/`. Such directories are automatically added to the `$COQPATH` environment variable by the hook defined in the Coq derivation.
lib/attrsets.nix
+14
View File
@@ -622,6 +622,20 @@ rec {
dontRecurseIntoAttrs =
attrs: attrs // { recurseForDerivations = false; };
/* `unionOfDisjoint x y` is equal to `x // y // z` where the
attrnames in `z` are the intersection of the attrnames in `x` and
`y`, and all values `assert` with an error message. This
operator is commutative, unlike (//). */
unionOfDisjoint = x: y:
let
intersection = builtins.intersectAttrs x y;
collisions = lib.concatStringsSep " " (builtins.attrNames intersection);
mask = builtins.mapAttrs (name: value: builtins.throw
"unionOfDisjoint: collision on ${name}; complete list: ${collisions}")
intersection;
in
(x // y) // mask;
/*** deprecated stuff ***/
zipWithNames = zipAttrsWithNames;
lib/licenses.nix
+10
View File
@@ -174,6 +174,11 @@ in mkLicense lset) ({
free = false;
};
cal10 = {
fullName = "Cryptographic Autonomy License version 1.0 (CAL-1.0)";
url = "https://opensource.org/licenses/CAL-1.0";
};
capec = {
fullName = "Common Attack Pattern Enumeration and Classification";
url = "https://capec.mitre.org/about/termsofuse.html";
@@ -588,6 +593,11 @@ in mkLicense lset) ({
fullName = "PNG Reference Library version 2";
};
libssh2 = {
fullName = "libssh2 License";
url = "https://www.libssh2.org/license.html";
};
libtiff = {
spdxId = "libtiff";
fullName = "libtiff License";
maintainers/maintainer-list.nix
+89 -7
View File
@@ -1922,6 +1922,12 @@
githubId = 2506621;
name = "Brayden Willenborg";
};
brendanreis = {
email = "brendanreis@gmail.com";
name = "Brendan Reis";
github = "brendanreis";
githubId = 10686906;
};
brian-dawn = {
email = "brian.t.dawn@gmail.com";
github = "brian-dawn";
@@ -2877,6 +2883,12 @@
githubId = 1382175;
name = "Oliver Matthews";
};
cwyc = {
email = "hello@cwyc.page";
github = "cwyc";
githubId = 16950437;
name = "cwyc";
};
cyounkins = {
name = "Craig Younkins";
email = "cyounkins@gmail.com";
@@ -4833,6 +4845,15 @@
fingerprint = "386E D1BF 848A BB4A 6B4A 3C45 FC83 907C 125B C2BC";
}];
};
georgesalkhouri = {
name = "Georges Alkhouri";
email = "incense.stitch_0w@icloud.com";
github = "GeorgesAlkhouri";
githubId = 6077574;
keys = [{
fingerprint = "1608 9E8D 7C59 54F2 6A7A 7BD0 8BD2 09DC C54F D339";
}];
};
georgewhewell = {
email = "georgerw@gmail.com";
github = "georgewhewell";
@@ -6486,6 +6507,12 @@
githubId = 297653;
name = "Joe Salisbury";
};
john-shaffer = {
email = "jdsha@proton.me";
github = "john-shaffer";
githubId = 53870456;
name = "John Shaffer";
};
johanot = {
email = "write@ownrisk.dk";
github = "johanot";
@@ -9381,6 +9408,12 @@
githubId = 1222539;
name = "Roman Naumann";
};
naphta = {
email = "naphta@noreply.github.com";
github = "naphta";
githubId = 6709831;
name = "Jake Hill";
};
nasirhm = {
email = "nasirhussainm14@gmail.com";
github = "nasirhm";
@@ -9528,12 +9561,25 @@
githubId = 23743547;
name = "Akshay Oppiliappan";
};
ners = {
name = "ners";
email = "ners@gmx.ch";
matrix = "@ners:ners.ch";
github = "ners";
githubId = 50560955;
};
nessdoor = {
name = "Tomas Antonio Lopez";
email = "entropy.overseer@protonmail.com";
github = "nessdoor";
githubId = 25993494;
};
net-mist = {
email = "archimist.linux@gmail.com";
github = "Net-Mist";
githubId = 13920346;
name = "Sébastien Iooss";
};
netali = {
name = "Jennifer Graul";
email = "me@netali.de";
@@ -9875,6 +9921,12 @@
githubId = 1809198;
name = "Victor Roest";
};
nullishamy = {
email = "amy.codes@null.net";
name = "nullishamy";
github = "nullishamy";
githubId = 99221043;
};
numinit = {
email = "me@numin.it";
github = "numinit";
@@ -10148,6 +10200,15 @@
fingerprint = "F90F FD6D 585C 2BA1 F13D E8A9 7571 654C F88E 31C2";
}];
};
oxapentane = {
email = "blame@oxapentane.com";
github = "oxapentane";
githubId = 1297357;
name = "Grigory Shipunov";
keys = [{
fingerprint = "DD09 98E6 CDF2 9453 7FC6 04F9 91FA 5E5B F9AA 901C";
}];
};
oxij = {
email = "oxij@oxij.org";
github = "oxij";
@@ -10666,6 +10727,16 @@
githubId = 178496;
name = "Philipp Middendorf";
};
pmw = {
email = "philip@mailworks.org";
matrix = "@philip4g:matrix.org";
name = "Philip White";
github = "philipmw";
githubId = 1379645;
keys = [{
fingerprint = "9AB0 6C94 C3D1 F9D0 B9D9 A832 BC54 6FB3 B16C 8B0B";
}];
};
pmy = {
email = "pmy@xqzp.net";
github = "pmeiyu";
@@ -10836,6 +10907,12 @@
}
];
};
prtzl = {
email = "matej.blagsic@protonmail.com";
github = "prtzl";
githubId = 32430344;
name = "Matej Blagsic";
};
ProducerMatt = {
name = "Matthew Pherigo";
email = "ProducerMatt42@gmail.com";
@@ -11936,6 +12013,12 @@
github = "sioodmy";
githubId = 81568712;
};
siph = {
name = "Chris Dawkins";
email = "dawkins.chris.dev@gmail.com";
github = "siph";
githubId = 6619112;
};
schmitthenner = {
email = "development@schmitthenner.eu";
github = "fkz";
@@ -12848,13 +12931,6 @@
githubId = 2666479;
name = "Y Nguyen";
};
superherointj = {
name = "Sérgio G.";
email = "5861043+superherointj@users.noreply.github.com";
matrix = "@superherointj:matrix.org";
github = "superherointj";
githubId = 5861043;
};
SuperSandro2000 = {
email = "sandro.jaeckel@gmail.com";
matrix = "@sandro:supersandro.de";
@@ -15396,6 +15472,12 @@
github = "jali-clarke";
githubId = 17733984;
};
wesleyjrz = {
email = "wesleyjr2002@gmail.com";
name = "Wesley V. Santos Jr.";
github = "wesleyjrz";
githubId = 60184588;
};
npatsakula = {
email = "nikita.patsakula@gmail.com";
name = "Patsakula Nikita";
maintainers/scripts/luarocks-packages.csv
+3 -1
View File
@@ -20,6 +20,7 @@ fluent,,,,,,alerque
gitsigns.nvim,https://github.com/lewis6991/gitsigns.nvim.git,,,,5.1,
http,,,,0.3-0,,vcunat
inspect,,,,,,
jsregexp,,,,,,
ldbus,,,http://luarocks.org/dev,,,
ldoc,https://github.com/stevedonovan/LDoc.git,,,,,
lgi,,,,,,
@@ -86,7 +87,7 @@ mediator_lua,,,,,,
mpack,,,,,,
moonscript,https://github.com/leafo/moonscript.git,dev-1,,,,arobyn
nvim-client,https://github.com/neovim/lua-client.git,,,,,
nvim-cmp,,,,,
nvim-cmp,,,,,,
penlight,https://github.com/lunarmodules/Penlight.git,,,,,alerque
plenary.nvim,https://github.com/nvim-lua/plenary.nvim.git,,,,5.1,
rapidjson,https://github.com/xpol/lua-rapidjson.git,,,,,
@@ -100,3 +101,4 @@ std.normalize,https://github.com/lua-stdlib/normalize.git,,,,,
stdlib,,,,41.2.2,,vyp
tl,,,,,,mephistophiles
vstruct,https://github.com/ToxicFrog/vstruct.git,,,,,
vusted,,,,,,figsoda
1 name src ref server version luaversion maintainers
20 gitsigns.nvim https://github.com/lewis6991/gitsigns.nvim.git 5.1
21 http 0.3-0 vcunat
22 inspect
23 jsregexp
24 ldbus http://luarocks.org/dev
25 ldoc https://github.com/stevedonovan/LDoc.git
26 lgi
87 mpack
88 moonscript https://github.com/leafo/moonscript.git dev-1 arobyn
89 nvim-client https://github.com/neovim/lua-client.git
90 nvim-cmp
91 penlight https://github.com/lunarmodules/Penlight.git alerque
92 plenary.nvim https://github.com/nvim-lua/plenary.nvim.git 5.1
93 rapidjson https://github.com/xpol/lua-rapidjson.git
101 stdlib 41.2.2 vyp
102 tl mephistophiles
103 vstruct https://github.com/ToxicFrog/vstruct.git
104 vusted figsoda
maintainers/scripts/nix-generate-from-cpan.nix
+3 -1
View File
@@ -3,8 +3,10 @@
stdenv.mkDerivation {
name = "nix-generate-from-cpan-3";
nativeBuildInputs = [ makeWrapper ];
buildInputs = with perlPackages; [
makeWrapper perl GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
perl GetoptLongDescriptive CPANPLUS Readonly LogLog4perl
];
phases = [ "installPhase" ];
maintainers/team-list.nix
+26 -10
View File
@@ -15,6 +15,8 @@
- `scope` describes the scope of the group.
- `shortName` short human-readable name
- `enableFeatureFreezePing` will ping this team during the Feature Freeze announcements on releases
- There is limited mention capacity in a single post, so this should be reserved for critical components
or larger ecosystems within nixpkgs.
- `githubTeams` will ping specified GitHub teams as well
More fields may be added in the future.
@@ -38,6 +40,7 @@ with lib.maintainers; {
];
scope = "Maintain ACME-related packages and modules.";
shortName = "ACME";
enableFeatureFreezePing = true;
};
bazel = {
@@ -90,7 +93,6 @@ with lib.maintainers; {
];
scope = "Maintain Blockchain packages and modules.";
shortName = "Blockchains";
enableFeatureFreezePing = true;
};
c = {
@@ -108,10 +110,10 @@ with lib.maintainers; {
astro
SuperSandro2000
revol-xut
oxapentane
];
scope = "Maintain packages used in the C3D2 hackspace";
shortName = "c3d2";
enableFeatureFreezePing = true;
};
cinnamon = {
@@ -202,7 +204,6 @@ with lib.maintainers; {
];
scope = "Maintain Docker and related tools.";
shortName = "DockerTools";
enableFeatureFreezePing = true;
};
docs = {
@@ -220,7 +221,6 @@ with lib.maintainers; {
];
scope = "Maintain the Emacs editor and packages.";
shortName = "Emacs";
enableFeatureFreezePing = true;
};
enlightenment = {
@@ -364,6 +364,17 @@ with lib.maintainers; {
shortName = "Kodi";
};
libretro = {
members = [
aanderse
edwtjo
MP2E
thiagokokada
];
scope = "Maintain Libretro, RetroArch and related packages.";
shortName = "Libretro";
};
linux-kernel = {
members = [
TredwellGit
@@ -385,6 +396,15 @@ with lib.maintainers; {
shortName = "Lumiguide employees";
};
lua = {
githubTeams = [
"lua"
];
scope = "Maintain the lua ecosystem.";
shortName = "lua";
enableFeatureFreezePing = true;
};
lumina = {
members = [
romildo
@@ -426,6 +446,7 @@ with lib.maintainers; {
];
scope = "Maintain Mate desktop environment and related packages.";
shortName = "MATE";
enableFeatureFreezePing = true;
};
matrix = {
@@ -448,7 +469,6 @@ with lib.maintainers; {
];
scope = "Maintain Mobile NixOS.";
shortName = "Mobile";
enableFeatureFreezePing = true;
};
nix = {
@@ -483,7 +503,6 @@ with lib.maintainers; {
tazjin
zimbatm
];
enableFeatureFreezePing = true;
scope = "Group registration for Numtide team members who collectively maintain packages.";
shortName = "Numtide team";
};
@@ -548,7 +567,6 @@ with lib.maintainers; {
];
scope = "Maintain Podman and CRI-O related packages and modules.";
shortName = "Podman";
enableFeatureFreezePing = true;
};
postgres = {
@@ -557,7 +575,6 @@ with lib.maintainers; {
];
scope = "Maintain the PostgreSQL package and plugins along with the NixOS module.";
shortName = "PostgreSQL";
enableFeatureFreezePing = true;
};
python = {
@@ -610,7 +627,6 @@ with lib.maintainers; {
];
scope = "Manage the current nixpkgs/NixOS release.";
shortName = "Release";
enableFeatureFreezePing = true;
};
ruby = {
@@ -699,7 +715,6 @@ with lib.maintainers; {
];
scope = "Maintain the vim and neovim text editors and related packages.";
shortName = "Vim/Neovim";
enableFeatureFreezePing = true;
};
xfce = {
@@ -708,5 +723,6 @@ with lib.maintainers; {
];
scope = "Maintain Xfce desktop environment and related packages.";
shortName = "Xfce";
enableFeatureFreezePing = true;
};
}
nixos/doc/manual/default.nix
+1
View File
@@ -63,6 +63,7 @@ let
};
documentType = "none";
variablelistId = "test-options-list";
optionIdPrefix = "test-opt-";
};
sources = lib.sourceFilesBySuffices ./. [".xml"];
nixos/doc/manual/development/running-nixos-tests-interactively.section.md
+2 -2
View File
@@ -39,11 +39,11 @@ directory.
## Interactive-only test configuration {#sec-nixos-test-interactive-configuration}
The `.driverInteractive` attribute combines the regular test configuration with
definitions from the [`interactive` submodule](#opt-interactive). This gives you
definitions from the [`interactive` submodule](#test-opt-interactive). This gives you
a more usable, graphical, but slightly different configuration.
You can add your own interactive-only test configuration by adding extra
configuration to the [`interactive` submodule](#opt-interactive).
configuration to the [`interactive` submodule](#test-opt-interactive).
To interactively run only the regular configuration, build the `<test>.driver` attribute
instead, and call it with the flag `result/bin/nixos-test-driver --interactive`.
nixos/doc/manual/development/writing-nixos-tests.section.md
+6 -6
View File
@@ -22,12 +22,12 @@ A NixOS test is a module that has the following structure:
```
We refer to the whole test above as a test module, whereas the values
in [`nodes.<name>`](#opt-nodes) are NixOS modules themselves.
in [`nodes.<name>`](#test-opt-nodes) are NixOS modules themselves.
The option [`testScript`](#opt-testScript) is a piece of Python code that executes the
The option [`testScript`](#test-opt-testScript) is a piece of Python code that executes the
test (described below). During the test, it will start one or more
virtual machines, the configuration of which is described by
the option [`nodes`](#opt-nodes).
the option [`nodes`](#test-opt-nodes).
An example of a single-node test is
[`login.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix).
@@ -171,7 +171,7 @@ The following methods are available on machine objects:
least one will be returned.
::: {.note}
This requires [`enableOCR`](#opt-enableOCR) to be set to `true`.
This requires [`enableOCR`](#test-opt-enableOCR) to be set to `true`.
:::
`get_screen_text`
@@ -180,7 +180,7 @@ The following methods are available on machine objects:
machine\'s screen using optical character recognition.
::: {.note}
This requires [`enableOCR`](#opt-enableOCR) to be set to `true`.
This requires [`enableOCR`](#test-opt-enableOCR) to be set to `true`.
:::
`send_monitor_command`
@@ -291,7 +291,7 @@ The following methods are available on machine objects:
`get_screen_text` and `get_screen_text_variants`).
::: {.note}
This requires [`enableOCR`](#opt-enableOCR) to be set to `true`.
This requires [`enableOCR`](#test-opt-enableOCR) to be set to `true`.
:::
`wait_for_console_text`
nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml
+2 -2
View File
@@ -44,14 +44,14 @@ $ ./result/bin/nixos-test-driver --keep-vm-state
<para>
The <literal>.driverInteractive</literal> attribute combines the
regular test configuration with definitions from the
<link linkend="opt-interactive"><literal>interactive</literal>
<link linkend="test-opt-interactive"><literal>interactive</literal>
submodule</link>. This gives you a more usable, graphical, but
slightly different configuration.
</para>
<para>
You can add your own interactive-only test configuration by adding
extra configuration to the
<link linkend="opt-interactive"><literal>interactive</literal>
<link linkend="test-opt-interactive"><literal>interactive</literal>
submodule</link>.
</para>
<para>
nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml
+6 -6
View File
@@ -24,16 +24,16 @@
<para>
We refer to the whole test above as a test module, whereas the
values in
<link linkend="opt-nodes"><literal>nodes.&lt;name&gt;</literal></link>
<link linkend="test-opt-nodes"><literal>nodes.&lt;name&gt;</literal></link>
are NixOS modules themselves.
</para>
<para>
The option
<link linkend="opt-testScript"><literal>testScript</literal></link>
<link linkend="test-opt-testScript"><literal>testScript</literal></link>
is a piece of Python code that executes the test (described below).
During the test, it will start one or more virtual machines, the
configuration of which is described by the option
<link linkend="opt-nodes"><literal>nodes</literal></link>.
<link linkend="test-opt-nodes"><literal>nodes</literal></link>.
</para>
<para>
An example of a single-node test is
@@ -263,7 +263,7 @@ start_all()
<note>
<para>
This requires
<link linkend="opt-enableOCR"><literal>enableOCR</literal></link>
<link linkend="test-opt-enableOCR"><literal>enableOCR</literal></link>
to be set to <literal>true</literal>.
</para>
</note>
@@ -281,7 +281,7 @@ start_all()
<note>
<para>
This requires
<link linkend="opt-enableOCR"><literal>enableOCR</literal></link>
<link linkend="test-opt-enableOCR"><literal>enableOCR</literal></link>
to be set to <literal>true</literal>.
</para>
</note>
@@ -522,7 +522,7 @@ start_all()
<note>
<para>
This requires
<link linkend="opt-enableOCR"><literal>enableOCR</literal></link>
<link linkend="test-opt-enableOCR"><literal>enableOCR</literal></link>
to be set to <literal>true</literal>.
</para>
</note>
nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+46 -9
View File
@@ -194,6 +194,13 @@
<link linkend="opt-services.komga.enable">services.komga</link>.
</para>
</listitem>
<listitem>
<para>
<link xlink:href="https://tandoor.dev">Tandoor Recipes</link>,
a self-hosted multi-tenant recipe collection. Available as
<link xlink:href="options.html#opt-services.tandoor-recipes.enable">services.tandoor-recipes</link>.
</para>
</listitem>
<listitem>
<para>
<link xlink:href="https://hbase.apache.org/">HBase
@@ -261,6 +268,13 @@
<link linkend="opt-services.alps.enable">services.alps</link>.
</para>
</listitem>
<listitem>
<para>
<link xlink:href="https://github.com/shizunge/endlessh-go">endlessh-go</link>,
an SSH tarpit that exposes Prometheus metrics. Available as
<link linkend="opt-services.endlessh-go.enable">services.endlessh-go</link>.
</para>
</listitem>
<listitem>
<para>
<link xlink:href="https://netbird.io">netbird</link>, a zero
@@ -313,6 +327,15 @@
<link linkend="opt-services.go-autoconfig.enable">services.go-autoconfig</link>.
</para>
</listitem>
<listitem>
<para>
<link xlink:href="https://github.com/tmate-io/tmate-ssh-server">tmate-ssh-server</link>,
server side part of
<link xlink:href="https://tmate.io/">tmate</link>. Available
as
<link linkend="opt-services.tmate-ssh-server.enable">services.tmate-ssh-server</link>.
</para>
</listitem>
<listitem>
<para>
<link xlink:href="https://www.grafana.com/oss/tempo/">Grafana
@@ -465,6 +488,16 @@
instead.
</para>
</listitem>
<listitem>
<para>
The <literal>p4</literal> package now only includes the
open-source Perforce Helix Core command-line client and APIs.
It no longer installs the unfree Helix Core Server binaries
<literal>p4d</literal>, <literal>p4broker</literal>, and
<literal>p4p</literal>. To install the Helix Core Server
binaries, use the <literal>p4d</literal> package instead.
</para>
</listitem>
<listitem>
<para>
The <literal>coq</literal> package and versioned variants
@@ -485,7 +518,9 @@
<listitem>
<para>
<literal>pkgs.cosign</literal> does not provide the
<literal>cosigned</literal> binary anymore.
<literal>cosigned</literal> binary anymore. The
<literal>sget</literal> binary has been moved into its own
package.
</para>
</listitem>
<listitem>
@@ -503,14 +538,6 @@
maintainer to update the package.
</para>
</listitem>
<listitem>
<para>
The (previously undocumented) Nixpkgs configuration option
<literal>checkMeta</literal> now defaults to
<literal>true</literal>. This may cause evaluation failures
for packages with incorrect <literal>meta</literal> attribute.
</para>
</listitem>
<listitem>
<para>
xow package removed along with the
@@ -528,6 +555,16 @@
<literal>services.datadog-agent</literal> module.
</para>
</listitem>
<listitem>
<para>
<literal>teleport</literal> has been upgraded to major version
10. Please see upstream
<link xlink:href="https://goteleport.com/docs/ver/10.0/management/operations/upgrading/">upgrade
instructions</link> and
<link xlink:href="https://goteleport.com/docs/ver/10.0/changelog/#1000">release
notes</link>.
</para>
</listitem>
<listitem>
<para>
lemmy module option
nixos/doc/manual/release-notes/rl-2211.section.md
+11 -4
View File
@@ -72,6 +72,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- [Komga](https://komga.org/), a free and open source comics/mangas media server. Available as [services.komga](#opt-services.komga.enable).
- [Tandoor Recipes](https://tandoor.dev), a self-hosted multi-tenant recipe collection. Available as [services.tandoor-recipes](options.html#opt-services.tandoor-recipes.enable).
- [HBase cluster](https://hbase.apache.org/), a distributed, scalable, big data store. Available as [services.hadoop.hbase](options.html#opt-services.hadoop.hbase.enable).
- [Sachet](https://github.com/messagebird/sachet/), an SMS alerting tool for the Prometheus Alertmanager. Available as [services.prometheus.sachet](#opt-services.prometheus.sachet.enable).
@@ -93,6 +95,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- [alps](https://git.sr.ht/~migadu/alps), a simple and extensible webmail. Available as [services.alps](#opt-services.alps.enable).
- [endlessh-go](https://github.com/shizunge/endlessh-go), an SSH tarpit that exposes Prometheus metrics. Available as [services.endlessh-go](#opt-services.endlessh-go.enable).
- [netbird](https://netbird.io), a zero configuration VPN.
Available as [services.netbird](options.html#opt-services.netbird.enable).
@@ -108,6 +112,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- [go-autoconfig](https://github.com/L11R/go-autoconfig), IMAP/SMTP autodiscover server. Available as [services.go-autoconfig](#opt-services.go-autoconfig.enable).
- [tmate-ssh-server](https://github.com/tmate-io/tmate-ssh-server), server side part of [tmate](https://tmate.io/). Available as [services.tmate-ssh-server](#opt-services.tmate-ssh-server.enable).
- [Grafana Tempo](https://www.grafana.com/oss/tempo/), a distributed tracing store. Available as [services.tempo](#opt-services.tempo.enable).
- [AusweisApp2](https://www.ausweisapp.bund.de/), the authentication software for the German ID card. Available as [programs.ausweisapp](#opt-programs.ausweisapp.enable).
@@ -156,6 +162,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
- `services.hbase` has been renamed to `services.hbase-standalone`.
For production HBase clusters, use `services.hadoop.hbase` instead.
- The `p4` package now only includes the open-source Perforce Helix Core command-line client and APIs. It no longer installs the unfree Helix Core Server binaries `p4d`, `p4broker`, and `p4p`. To install the Helix Core Server binaries, use the `p4d` package instead.
- The `coq` package and versioned variants starting at `coq_8_14` no
longer include CoqIDE, which is now available through
`coqPackages.coqide`. It is still possible to get CoqIDE as part of
@@ -165,20 +173,19 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
- PHP 7.4 is no longer supported due to upstream not supporting this
version for the entire lifecycle of the 22.11 release.
- `pkgs.cosign` does not provide the `cosigned` binary anymore.
- `pkgs.cosign` does not provide the `cosigned` binary anymore. The `sget` binary has been moved into its own package.
- Emacs now uses the Lucid toolkit by default instead of GTK because of stability and compatibility issues.
Users who still wish to remain using GTK can do so by using `emacs-gtk`.
- riak package removed along with `services.riak` module, due to lack of maintainer to update the package.
- The (previously undocumented) Nixpkgs configuration option `checkMeta` now defaults to `true`. This may cause evaluation
failures for packages with incorrect `meta` attribute.
- xow package removed along with the `hardware.xow` module, due to the project being deprecated in favor of `xone`, which is available via the `hardware.xone` module.
- dd-agent package removed along with the `services.dd-agent` module, due to the project being deprecated in favor of `datadog-agent`, which is available via the `services.datadog-agent` module.
- `teleport` has been upgraded to major version 10. Please see upstream [upgrade instructions](https://goteleport.com/docs/ver/10.0/management/operations/upgrading/) and [release notes](https://goteleport.com/docs/ver/10.0/changelog/#1000).
- lemmy module option `services.lemmy.settings.database.createLocally`
moved to `services.lemmy.database.createLocally`.
nixos/lib/make-options-doc/default.nix
+3
View File
@@ -26,6 +26,8 @@
# If you include more than one option list into a document, you need to
# provide different ids.
, variablelistId ? "configuration-variable-list"
# Strig to prefix to the option XML/HTML id attributes.
, optionIdPrefix ? "opt-"
, revision ? "" # Specify revision for the options
# a set of options the docs we are generating will be merged into, as if by recursiveUpdate.
# used to split the options doc build into a static part (nixos/modules) and a dynamic part
@@ -183,6 +185,7 @@ in rec {
--stringparam documentType '${documentType}' \
--stringparam revision '${revision}' \
--stringparam variablelistId '${variablelistId}' \
--stringparam optionIdPrefix '${optionIdPrefix}' \
-o intermediate.xml ${./options-to-docbook.xsl} sorted.xml
${pkgs.libxslt.bin}/bin/xsltproc \
-o "$out" ${./postprocess-option-descriptions.xsl} intermediate.xml
nixos/lib/make-options-doc/options-to-docbook.xsl
+2 -1
View File
@@ -15,6 +15,7 @@
<xsl:param name="documentType" />
<xsl:param name="program" />
<xsl:param name="variablelistId" />
<xsl:param name="optionIdPrefix" />
<xsl:template match="/expr/list">
@@ -36,7 +37,7 @@
<xsl:attribute name="id" namespace="http://www.w3.org/XML/1998/namespace"><xsl:value-of select="$variablelistId"/></xsl:attribute>
<xsl:for-each select="attrs">
<xsl:variable name="id" select="
concat('opt-',
concat($optionIdPrefix,
translate(
attr[@name = 'name']/string/@value,
'*&lt; >[]:',
nixos/lib/qemu-common.nix
+1 -1
View File
@@ -19,7 +19,7 @@ rec {
];
qemuSerialDevice =
if pkgs.stdenv.hostPlatform.isx86 || pkgs.stdenv.hostPlatform.isRiscV then "ttyS0"
if with pkgs.stdenv.hostPlatform; isx86 || isMips64 || isRiscV then "ttyS0"
else if (with pkgs.stdenv.hostPlatform; isAarch || isPower) then "ttyAMA0"
else throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";
nixos/lib/testing/driver.nix
+3 -3
View File
@@ -120,7 +120,7 @@ in
};
qemu.package = mkOption {
description = mdDoc "Which qemu package to use for the virtualisation of [{option}`nodes`](#opt-nodes).";
description = mdDoc "Which qemu package to use for the virtualisation of [{option}`nodes`](#test-opt-nodes).";
type = types.package;
default = hostPkgs.qemu_test;
defaultText = "hostPkgs.qemu_test";
@@ -152,7 +152,7 @@ in
description = mdDoc ''
Extra arguments to pass to the test driver.
They become part of [{option}`driver`](#opt-driver) via `wrapProgram`.
They become part of [{option}`driver`](#test-opt-driver) via `wrapProgram`.
'';
type = types.listOf types.str;
default = [];
@@ -172,7 +172,7 @@ in
description = mdDoc ''
Disable type checking. This must not be enabled for new NixOS tests.
This may speed up your iteration cycle, unless you're working on the [{option}`testScript`](#opt-testScript).
This may speed up your iteration cycle, unless you're working on the [{option}`testScript`](#test-opt-testScript).
'';
};
};
nixos/lib/testing/meta.nix
+2 -2
View File
@@ -24,14 +24,14 @@ in
type = types.nullOr types.int;
default = null; # NOTE: null values are filtered out by `meta`.
description = mdDoc ''
The [{option}`test`](#opt-test)'s [`meta.timeout`](https://nixos.org/manual/nixpkgs/stable/#var-meta-timeout) in seconds.
The [{option}`test`](#test-opt-test)'s [`meta.timeout`](https://nixos.org/manual/nixpkgs/stable/#var-meta-timeout) in seconds.
'';
};
broken = lib.mkOption {
type = types.bool;
default = false;
description = mdDoc ''
Sets the [`meta.broken`](https://nixos.org/manual/nixpkgs/stable/#var-meta-broken) attribute on the [{option}`test`](#opt-test) derivation.
Sets the [`meta.broken`](https://nixos.org/manual/nixpkgs/stable/#var-meta-broken) attribute on the [{option}`test`](#test-opt-test) derivation.
'';
};
};
nixos/lib/testing/name.nix
+1 -1
View File
@@ -7,7 +7,7 @@ in
description = mdDoc ''
The name of the test.
This is used in the derivation names of the [{option}`driver`](#opt-driver) and [{option}`test`](#opt-test) runner.
This is used in the derivation names of the [{option}`driver`](#test-opt-driver) and [{option}`test`](#test-opt-test) runner.
'';
type = types.str;
};
nixos/lib/testing/nodes.nix
+4 -4
View File
@@ -44,7 +44,7 @@ in
description = mdDoc ''
An attribute set of NixOS configuration modules.
The configurations are augmented by the [`defaults`](#opt-defaults) option.
The configurations are augmented by the [`defaults`](#test-opt-defaults) option.
They are assigned network addresses according to the `nixos/lib/testing/network.nix` module.
@@ -54,7 +54,7 @@ in
defaults = mkOption {
description = mdDoc ''
NixOS configuration that is applied to all [{option}`nodes`](#opt-nodes).
NixOS configuration that is applied to all [{option}`nodes`](#test-opt-nodes).
'';
type = types.deferredModule;
default = { };
@@ -62,7 +62,7 @@ in
extraBaseModules = mkOption {
description = mdDoc ''
NixOS configuration that, like [{option}`defaults`](#opt-defaults), is applied to all [{option}`nodes`](#opt-nodes) and can not be undone with [`specialisation.<name>.inheritParentConfig`](https://search.nixos.org/options?show=specialisation.%3Cname%3E.inheritParentConfig&from=0&size=50&sort=relevance&type=packages&query=specialisation).
NixOS configuration that, like [{option}`defaults`](#test-opt-defaults), is applied to all [{option}`nodes`](#test-opt-nodes) and can not be undone with [`specialisation.<name>.inheritParentConfig`](https://search.nixos.org/options?show=specialisation.%3Cname%3E.inheritParentConfig&from=0&size=50&sort=relevance&type=packages&query=specialisation).
'';
type = types.deferredModule;
default = { };
@@ -82,7 +82,7 @@ in
type = types.bool;
default = false;
description = mdDoc ''
Enable to configure all [{option}`nodes`](#opt-nodes) to run with a minimal kernel.
Enable to configure all [{option}`nodes`](#test-opt-nodes) to run with a minimal kernel.
'';
};
nixos/lib/utils.nix
+9 -5
View File
@@ -102,7 +102,11 @@ rec {
if item ? ${attr} then
nameValuePair prefix item.${attr}
else if isAttrs item then
map (name: recurse (prefix + "." + name) item.${name}) (attrNames item)
map (name:
let
escapedName = ''"${replaceChars [''"'' "\\"] [''\"'' "\\\\"] name}"'';
in
recurse (prefix + "." + escapedName) item.${name}) (attrNames item)
else if isList item then
imap0 (index: item: recurse (prefix + "[${toString index}]") item) item
else
@@ -182,13 +186,13 @@ rec {
'')
(attrNames secrets))
+ "\n"
+ "${pkgs.jq}/bin/jq >'${output}' '"
+ concatStringsSep
+ "${pkgs.jq}/bin/jq >'${output}' "
+ lib.escapeShellArg (concatStringsSep
" | "
(imap1 (index: name: ''${name} = $ENV.secret${toString index}'')
(attrNames secrets))
(attrNames secrets)))
+ ''
' <<'EOF'
<<'EOF'
${builtins.toJSON set}
EOF
(( ! $inherit_errexit_enabled )) && shopt -u inherit_errexit
nixos/modules/config/pulseaudio.nix
+2 -1
View File
@@ -102,7 +102,7 @@ in {
each user that tries to use the sound system. The server runs
with user privileges. If true, one system-wide PulseAudio
server is launched on boot, running as the user "pulse", and
only users in the "audio" group will have access to the server.
only users in the "pulse-access" group will have access to the server.
Please read the PulseAudio documentation for more details.
Don't enable this option unless you know what you are doing.
@@ -310,6 +310,7 @@ in {
};
users.groups.pulse.gid = gid;
users.groups.pulse-access = {};
systemd.services.pulseaudio = {
description = "PulseAudio System-Wide Server";
nixos/modules/hardware/ckb-next.nix
+1 -1
View File
@@ -48,6 +48,6 @@ in
};
meta = {
maintainers = with lib.maintainers; [ superherointj ];
maintainers = with lib.maintainers; [ ];
};
}
nixos/modules/hardware/video/uvcvideo/uvcdynctrl-udev-rules.nix
+3 -1
View File
@@ -23,8 +23,10 @@ in
runCommand "uvcdynctrl-udev-rules-${version}"
{
inherit dataPath;
buildInputs = [
nativeBuildInputs = [
makeWrapper
];
buildInputs = [
libwebcam
];
dontPatchELF = true;
nixos/modules/module-list.nix
+4 -1
View File
@@ -653,6 +653,7 @@
./services/misc/svnserve.nix
./services/misc/synergy.nix
./services/misc/sysprof.nix
./services/misc/tandoor-recipes.nix
./services/misc/taskserver
./services/misc/tiddlywiki.nix
./services/misc/tp-auto-kbbl.nix
@@ -721,7 +722,7 @@
./services/network-filesystems/drbd.nix
./services/network-filesystems/glusterfs.nix
./services/network-filesystems/kbfs.nix
./services/network-filesystems/ipfs.nix
./services/network-filesystems/kubo.nix
./services/network-filesystems/litestream/default.nix
./services/network-filesystems/netatalk.nix
./services/network-filesystems/nfsd.nix
@@ -959,6 +960,7 @@
./services/networking/tinc.nix
./services/networking/tinydns.nix
./services/networking/tftpd.nix
./services/networking/tmate-ssh-server.nix
./services/networking/trickster.nix
./services/networking/tox-bootstrapd.nix
./services/networking/tox-node.nix
@@ -1002,6 +1004,7 @@
./services/security/certmgr.nix
./services/security/cfssl.nix
./services/security/clamav.nix
./services/security/endlessh-go.nix
./services/security/fail2ban.nix
./services/security/fprintd.nix
./services/security/haka.nix
nixos/modules/profiles/base.nix
+4 -2
View File
@@ -1,7 +1,7 @@
# This module defines the software packages included in the "minimal"
# installation CD. It might be useful elsewhere.
{ lib, pkgs, ... }:
{ config, lib, pkgs, ... }:
{
# Include some utilities that are useful for installing or repairing
@@ -51,7 +51,9 @@
];
# Include support for various filesystems.
boot.supportedFilesystems = [ "btrfs" "reiserfs" "vfat" "f2fs" "xfs" "zfs" "ntfs" "cifs" ];
boot.supportedFilesystems =
[ "btrfs" "reiserfs" "vfat" "f2fs" "xfs" "ntfs" "cifs" ] ++
lib.optional (lib.meta.availableOn pkgs.stdenv.hostPlatform config.boot.zfs.package) "zfs";
# Configure host id for ZFS to work
networking.hostId = lib.mkDefault "8425e349";
nixos/modules/programs/mininet.nix
+1 -1
View File
@@ -14,7 +14,7 @@ let
pyEnv = pkgs.python.withPackages(ps: [ ps.mininet-python ]);
mnexecWrapped = pkgs.runCommand "mnexec-wrapper"
{ buildInputs = [ pkgs.makeWrapper pkgs.pythonPackages.wrapPython ]; }
{ nativeBuildInputs = [ pkgs.makeWrapper pkgs.pythonPackages.wrapPython ]; }
''
makeWrapper ${pkgs.mininet}/bin/mnexec \
$out/bin/mnexec \
nixos/modules/programs/ssh.nix
+1
View File
@@ -14,6 +14,7 @@ let
''
#! ${pkgs.runtimeShell} -e
export DISPLAY="$(systemctl --user show-environment | ${pkgs.gnused}/bin/sed 's/^DISPLAY=\(.*\)/\1/; t; d')"
export WAYLAND_DISPLAY="$(systemctl --user show-environment | ${pkgs.gnused}/bin/sed 's/^WAYLAND_DISPLAY=\(.*\)/\1/; t; d')"
exec ${askPassword} "$@"
'';
nixos/modules/security/acme/default.nix
+5 -3
View File
@@ -190,7 +190,7 @@ let
);
renewOpts = escapeShellArgs (
commonOpts
++ [ "renew" ]
++ [ "renew" "--no-random-sleep" ]
++ optionals data.ocspMustStaple [ "--must-staple" ]
++ data.extraLegoRenewFlags
);
@@ -223,9 +223,9 @@ let
# have many certificates, the renewals are distributed over
# the course of the day to avoid rate limits.
AccuracySec = "${toString (_24hSecs / numCerts)}s";
# Skew randomly within the day, per https://letsencrypt.org/docs/integration-guide/.
RandomizedDelaySec = "24h";
FixedRandomDelay = true;
};
};
@@ -325,6 +325,7 @@ let
'');
} // optionalAttrs (data.listenHTTP != null && toInt (elemAt (splitString ":" data.listenHTTP) 1) < 1024) {
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
};
# Working directory will be /tmp
@@ -376,7 +377,8 @@ let
# Check if we can renew.
# We can only renew if the list of domains has not changed.
if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(ls -1 accounts)" ]; then
# We also need an account key. Avoids #190493
if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(find accounts -name '${data.email}.key')" ]; then
# Even if a cert is not expired, it may be revoked by the CA.
# Try to renew, and silently fail if the cert is not expired.
nixos/modules/security/acme/doc.xml
+6 -5
View File
@@ -237,8 +237,8 @@ services.bind = {
<programlisting>
systemd.services.dns-rfc2136-conf = {
requiredBy = ["acme-example.com.service", "bind.service"];
before = ["acme-example.com.service", "bind.service"];
requiredBy = ["acme-example.com.service" "bind.service"];
before = ["acme-example.com.service" "bind.service"];
unitConfig = {
ConditionPathExists = "!/var/lib/secrets/dnskeys.conf";
};
@@ -249,18 +249,19 @@ systemd.services.dns-rfc2136-conf = {
path = [ pkgs.bind ];
script = ''
mkdir -p /var/lib/secrets
chmod 755 /var/lib/secrets
tsig-keygen rfc2136key.example.com &gt; /var/lib/secrets/dnskeys.conf
chown named:root /var/lib/secrets/dnskeys.conf
chmod 400 /var/lib/secrets/dnskeys.conf
# Copy the secret value from the dnskeys.conf, and put it in
# RFC2136_TSIG_SECRET below
# extract secret value from the dnskeys.conf
while read x y; do if [ "$x" = "secret" ]; then secret="''${y:1:''${#y}-3}"; fi; done &lt; /var/lib/secrets/dnskeys.conf
cat &gt; /var/lib/secrets/certs.secret &lt;&lt; EOF
RFC2136_NAMESERVER='127.0.0.1:53'
RFC2136_TSIG_ALGORITHM='hmac-sha256.'
RFC2136_TSIG_KEY='rfc2136key.example.com'
RFC2136_TSIG_SECRET='your secret key'
RFC2136_TSIG_SECRET='$secret'
EOF
chmod 400 /var/lib/secrets/certs.secret
'';
nixos/modules/services/audio/mopidy.nix
+1 -1
View File
@@ -14,7 +14,7 @@ let
name = "mopidy-with-extensions-${mopidy.version}";
paths = closePropagation cfg.extensionPackages;
pathsToLink = [ "/${mopidyPackages.python.sitePackages}" ];
buildInputs = [ makeWrapper ];
nativeBuildInputs = [ makeWrapper ];
postBuild = ''
makeWrapper ${mopidy}/bin/mopidy $out/bin/mopidy \
--prefix PYTHONPATH : $out/${mopidyPackages.python.sitePackages}
nixos/modules/services/backup/borgbackup.nix
+1 -1
View File
@@ -116,7 +116,7 @@ let
original, name, set ? {}
}:
pkgs.runCommand "${name}-wrapper" {
buildInputs = [ pkgs.makeWrapper ];
nativeBuildInputs = [ pkgs.makeWrapper ];
} (with lib; ''
makeWrapper "${original}" "$out/bin/${name}" \
${concatStringsSep " \\\n " (mapAttrsToList (name: value: ''--set ${name} "${value}"'') set)}
nixos/modules/services/continuous-integration/github-runner.nix
+50 -31
View File
@@ -200,46 +200,65 @@ in
${lines}
'';
currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" ] cfg;
newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
newConfigTokenFilename = ".new-token";
currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
newConfigTokenPath= "$STATE_DIRECTORY/.new-token";
currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}";
runnerCredFiles = [
".credentials"
".credentials_rsaparams"
".runner"
];
unconfigureRunner = writeScript "unconfigure" ''
differs=
if [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then
# State directory is not empty
# Set `differs = 1` if current and new runner config differ or if `currentConfigPath` does not exist
${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 || differs=1
# Also trigger a registration if the token content changed
${pkgs.diffutils}/bin/diff -q \
"$STATE_DIRECTORY"/${currentConfigTokenFilename} \
${escapeShellArg cfg.tokenFile} \
>/dev/null 2>&1 || differs=1
# If .credentials does not exist, assume a previous run de-registered the runner on stop (ephemeral mode)
[[ ! -f "$STATE_DIRECTORY/.credentials" ]] && differs=1
fi
if [[ -n "$differs" ]]; then
echo "Config has changed, removing old runner state."
# In ephemeral mode, the runner deletes the `.credentials` file after de-registering it with GitHub
[[ -f "$STATE_DIRECTORY/.credentials" ]] && echo "The old runner will still appear in the GitHub Actions UI." \
"You have to remove it manually."
find "$STATE_DIRECTORY/" -mindepth 1 -delete
copy_tokens() {
# Copy the configured token file to the state dir and allow the service user to read the file
install --mode=666 ${escapeShellArg cfg.tokenFile} "$STATE_DIRECTORY/${newConfigTokenFilename}"
install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}"
# Also copy current file to allow for a diff on the next start
install --mode=600 ${escapeShellArg cfg.tokenFile} "$STATE_DIRECTORY/${currentConfigTokenFilename}"
install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}"
}
clean_state() {
find "$STATE_DIRECTORY/" -mindepth 1 -delete
copy_tokens
}
diff_config() {
changed=0
# Check for module config changes
[[ -f "${currentConfigPath}" ]] \
&& ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \
|| changed=1
# Also check the content of the token file
[[ -f "${currentConfigTokenPath}" ]] \
&& ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \
|| changed=1
# If the config has changed, remove old state and copy tokens
if [[ "$changed" -eq 1 ]]; then
echo "Config has changed, removing old runner state."
echo "The old runner will still appear in the GitHub Actions UI." \
"You have to remove it manually."
clean_state
fi
}
if [[ "${optionalString cfg.ephemeral "1"}" ]]; then
# In ephemeral mode, we always want to start with a clean state
clean_state
elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then
# There are state files from a previous run; diff them to decide if we need a new registration
diff_config
else
# The state directory is entirely empty which indicates a first start
copy_tokens
fi
'';
configureRunner = writeScript "configure" ''
if [[ -e "$STATE_DIRECTORY/${newConfigTokenFilename}" ]]; then
if [[ -e "${newConfigTokenPath}" ]]; then
echo "Configuring GitHub Actions Runner"
args=(
@@ -256,7 +275,7 @@ in
# If the token file contains a PAT (i.e., it starts with "ghp_"), we have to use the --pat option,
# if it is not a PAT, we assume it contains a registration token and use the --token option
token=$(<"$STATE_DIRECTORY/${newConfigTokenFilename}")
token=$(<"${newConfigTokenPath}")
if [[ "$token" =~ ^ghp_* ]]; then
args+=(--pat "$token")
else
@@ -271,7 +290,7 @@ in
rm -rf "$STATE_DIRECTORY/_diag/"
# Cleanup token from config
rm "$STATE_DIRECTORY/${newConfigTokenFilename}"
rm "${newConfigTokenPath}"
# Symlink to new config
ln -s '${newConfigPath}' "${currentConfigPath}"
@@ -305,8 +324,8 @@ in
WorkingDirectory = runtimeDir;
InaccessiblePaths = [
# Token file path given in the configuration
cfg.tokenFile
# Token file path given in the configuration, if visible to the service
"-${cfg.tokenFile}"
# Token file in the state directory
"${stateDir}/${currentConfigTokenFilename}"
];
nixos/modules/services/continuous-integration/hydra/default.nix
+1 -1
View File
@@ -42,7 +42,7 @@ let
makeWrapperArgs = concatStringsSep " " (mapAttrsToList (key: value: "--set \"${key}\" \"${value}\"") hydraEnv);
in pkgs.buildEnv rec {
name = "hydra-env";
buildInputs = [ pkgs.makeWrapper ];
nativeBuildInputs = [ pkgs.makeWrapper ];
paths = [ cfg.package ];
postBuild = ''
nixos/modules/services/hardware/fwupd.nix
+27 -10
View File
@@ -33,18 +33,26 @@ let
mkEtcFile = p: nameValuePair (mkName p) { source = p; };
in listToAttrs (map mkEtcFile cfg.extraTrustedKeys);
# We cannot include the file in $out and rely on filesInstalledToEtc
# to install it because it would create a cyclic dependency between
# the outputs. We also need to enable the remote,
# which should not be done by default.
testRemote = if cfg.enableTestRemote then {
"fwupd/remotes.d/fwupd-tests.conf" = {
source = pkgs.runCommand "fwupd-tests-enabled.conf" {} ''
enableRemote = base: remote: {
"fwupd/remotes.d/${remote}.conf" = {
source = pkgs.runCommand "${remote}-enabled.conf" {} ''
sed "s,^Enabled=false,Enabled=true," \
"${cfg.package.installedTests}/etc/fwupd/remotes.d/fwupd-tests.conf" > "$out"
"${base}/etc/fwupd/remotes.d/${remote}.conf" > "$out"
'';
};
} else {};
};
remotes = (foldl'
(configFiles: remote: configFiles // (enableRemote cfg.package remote))
{}
cfg.extraRemotes
) // (
# We cannot include the file in $out and rely on filesInstalledToEtc
# to install it because it would create a cyclic dependency between
# the outputs. We also need to enable the remote,
# which should not be done by default.
if cfg.enableTestRemote then (enableRemote cfg.package.installedTests "fwupd-tests") else {}
);
in {
###### interface
@@ -86,6 +94,15 @@ in {
'';
};
extraRemotes = mkOption {
type = with types; listOf str;
default = [];
example = [ "lvfs-testing" ];
description = lib.mdDoc ''
Enables extra remotes in fwupd. See `/etc/fwupd/remotes.d`.
'';
};
enableTestRemote = mkOption {
type = types.bool;
default = false;
@@ -119,7 +136,7 @@ in {
environment.systemPackages = [ cfg.package ];
# customEtc overrides some files from the package
environment.etc = originalEtc // customEtc // extraTrustedKeys // testRemote;
environment.etc = originalEtc // customEtc // extraTrustedKeys // remotes;
services.dbus.packages = [ cfg.package ];
nixos/modules/services/hardware/udev.nix
+3 -3
View File
@@ -171,10 +171,10 @@ let
mv etc/udev/hwdb.bin $out
'';
compressFirmware = if config.boot.kernelPackages.kernelAtLeast "5.3" then
pkgs.compressFirmwareXz
compressFirmware = firmware: if (config.boot.kernelPackages.kernelAtLeast "5.3" && (firmware.compressFirmware or true)) then
pkgs.compressFirmwareXz firmware
else
id;
id firmware;
# Udev has a 512-character limit for ENV{PATH}, so create a symlink
# tree to work around this.
nixos/modules/services/matrix/dendrite.nix
+19
View File
@@ -195,6 +195,25 @@ in
'';
};
};
options.sync_api.search = {
enable = lib.mkEnableOption (lib.mdDoc "Dendrite's full-text search engine");
index_path = lib.mkOption {
type = lib.types.str;
default = "${workingDir}/searchindex";
description = lib.mdDoc ''
The path the search index will be created in.
'';
};
language = lib.mkOption {
type = lib.types.str;
default = "en";
description = lib.mdDoc ''
The language most likely to be used on the server - used when indexing, to
ensure the returned results match expectations. A full list of possible languages
can be found at https://github.com/blevesearch/bleve/tree/master/analysis/lang
'';
};
};
options.user_api = {
account_database = {
connection_string = lib.mkOption {
nixos/modules/services/misc/etebase-server.nix
+1 -1
View File
@@ -162,7 +162,7 @@ in
environment.systemPackages = with pkgs; [
(runCommand "etebase-server" {
buildInputs = [ makeWrapper ];
nativeBuildInputs = [ makeWrapper ];
} ''
makeWrapper ${pythonEnv}/bin/etebase-server \
$out/bin/etebase-server \
nixos/modules/services/misc/gitlab.nix
+82 -17
View File
@@ -6,6 +6,9 @@ let
cfg = config.services.gitlab;
opt = options.services.gitlab;
toml = pkgs.formats.toml {};
yaml = pkgs.formats.yaml {};
ruby = cfg.packages.gitlab.ruby;
postgresqlPackage = if config.services.postgresql.enable then
@@ -89,17 +92,18 @@ let
repos_path = "${cfg.statePath}/repositories";
secret_file = "${cfg.statePath}/gitlab_shell_secret";
log_file = "${cfg.statePath}/log/gitlab-shell.log";
redis = {
bin = "${pkgs.redis}/bin/redis-cli";
host = "127.0.0.1";
port = config.services.redis.servers.gitlab.port;
database = 0;
namespace = "resque:gitlab";
};
};
redisConfig.production.url = cfg.redisUrl;
cableYml = yaml.generate "cable.yml" {
production = {
adapter = "redis";
url = cfg.redisUrl;
channel_prefix = "gitlab_production";
};
};
pagesArgs = [
"-pages-domain" gitlabConfig.production.pages.host
"-pages-root" "${gitlabConfig.production.shared.path}/pages"
@@ -188,16 +192,27 @@ let
MALLOC_ARENA_MAX = "2";
} // cfg.extraEnv;
runtimeDeps = with pkgs; [
nodejs
gzip
git
gnutar
postgresqlPackage
coreutils
procps
findutils # Needed for gitlab:cleanup:orphan_job_artifact_files
];
gitlab-rake = pkgs.stdenv.mkDerivation {
name = "gitlab-rake";
buildInputs = [ pkgs.makeWrapper ];
nativeBuildInputs = [ pkgs.makeWrapper ];
dontBuild = true;
dontUnpack = true;
installPhase = ''
mkdir -p $out/bin
makeWrapper ${cfg.packages.gitlab.rubyEnv}/bin/rake $out/bin/gitlab-rake \
${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") gitlabEnv)} \
--set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip pkgs.git pkgs.gnutar postgresqlPackage pkgs.coreutils pkgs.procps ]}:$PATH' \
--set PATH '${lib.makeBinPath runtimeDeps}:$PATH' \
--set RAKEOPT '-f ${cfg.packages.gitlab}/share/gitlab/Rakefile' \
--chdir '${cfg.packages.gitlab}/share/gitlab'
'';
@@ -205,14 +220,14 @@ let
gitlab-rails = pkgs.stdenv.mkDerivation {
name = "gitlab-rails";
buildInputs = [ pkgs.makeWrapper ];
nativeBuildInputs = [ pkgs.makeWrapper ];
dontBuild = true;
dontUnpack = true;
installPhase = ''
mkdir -p $out/bin
makeWrapper ${cfg.packages.gitlab.rubyEnv}/bin/rails $out/bin/gitlab-rails \
${concatStrings (mapAttrsToList (name: value: "--set ${name} '${value}' ") gitlabEnv)} \
--set PATH '${lib.makeBinPath [ pkgs.nodejs pkgs.gzip pkgs.git pkgs.gnutar postgresqlPackage pkgs.coreutils pkgs.procps ]}:$PATH' \
--set PATH '${lib.makeBinPath runtimeDeps}:$PATH' \
--chdir '${cfg.packages.gitlab}/share/gitlab'
'';
};
@@ -468,9 +483,9 @@ in {
redisUrl = mkOption {
type = types.str;
default = "redis://localhost:${toString config.services.redis.servers.gitlab.port}/";
defaultText = literalExpression ''redis://localhost:''${toString config.services.redis.servers.gitlab.port}/'';
description = lib.mdDoc "Redis URL for all GitLab services except gitlab-shell";
default = "unix:/run/gitlab/redis.sock";
example = "redis://localhost:6379/";
description = lib.mdDoc "Redis URL for all GitLab services.";
};
extraGitlabRb = mkOption {
@@ -867,8 +882,41 @@ in {
};
};
workhorse.config = mkOption {
type = toml.type;
default = {};
example = literalExpression ''
{
object_storage.provider = "AWS";
object_storage.s3 = {
aws_access_key_id = "AKIAXXXXXXXXXXXXXXXX";
aws_secret_access_key = { _secret = "/var/keys/aws_secret_access_key"; };
};
};
'';
description = lib.mdDoc ''
Configuration options to add to Workhorse's configuration
file.
See
<https://gitlab.com/gitlab-org/gitlab/-/blob/master/workhorse/config.toml.example>
and
<https://docs.gitlab.com/ee/development/workhorse/configuration.html>
for examples and option documentation.
Options containing secret data should be set to an attribute
set containing the attribute `_secret` - a string pointing
to a file containing the value the option should be set
to. See the example to get a better picture of this: in the
resulting configuration file, the
`object_storage.s3.aws_secret_access_key` key will be set to
the contents of the {file}`/var/keys/aws_secret_access_key`
file.
'';
};
extraConfig = mkOption {
type = types.attrs;
type = yaml.type;
default = {};
example = literalExpression ''
{
@@ -972,8 +1020,9 @@ in {
# Redis is required for the sidekiq queue runner.
services.redis.servers.gitlab = {
enable = mkDefault true;
port = mkDefault 31636;
bind = mkDefault "127.0.0.1";
user = mkDefault cfg.user;
unixSocket = mkDefault "/run/gitlab/redis.sock";
unixSocketPerm = mkDefault 770;
};
# We use postgres as the main data store.
@@ -1062,6 +1111,7 @@ in {
# Ensure Docker Registry launches after the certificate generation job
systemd.services.docker-registry = optionalAttrs cfg.registry.enable {
wants = [ "gitlab-registry-cert.service" ];
after = [ "gitlab-registry-cert.service" ];
};
# Enable Docker Registry, if GitLab-Container Registry is enabled
@@ -1115,6 +1165,7 @@ in {
"d ${gitlabConfig.production.shared.path}/lfs-objects 0750 ${cfg.user} ${cfg.group} -"
"d ${gitlabConfig.production.shared.path}/packages 0750 ${cfg.user} ${cfg.group} -"
"d ${gitlabConfig.production.shared.path}/pages 0750 ${cfg.user} ${cfg.group} -"
"d ${gitlabConfig.production.shared.path}/registry 0750 ${cfg.user} ${cfg.group} -"
"d ${gitlabConfig.production.shared.path}/terraform_state 0750 ${cfg.user} ${cfg.group} -"
"L+ /run/gitlab/config - - - - ${cfg.statePath}/config"
"L+ /run/gitlab/log - - - - ${cfg.statePath}/log"
@@ -1168,6 +1219,7 @@ in {
cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
ln -sf ${extraGitlabRb} ${cfg.statePath}/config/initializers/extra-gitlab.rb
ln -sf ${cableYml} ${cfg.statePath}/config/cable.yml
${cfg.packages.gitlab-shell}/bin/install
@@ -1357,6 +1409,7 @@ in {
wantedBy = [ "gitlab.target" ];
partOf = [ "gitlab.target" ];
path = with pkgs; [
remarshal
exiftool
gitPackage
gnutar
@@ -1371,6 +1424,17 @@ in {
TimeoutSec = "infinity";
Restart = "on-failure";
WorkingDirectory = gitlabEnv.HOME;
ExecStartPre = pkgs.writeShellScript "gitlab-workhorse-pre-start" ''
set -o errexit -o pipefail -o nounset
shopt -s dotglob nullglob inherit_errexit
${utils.genJqSecretsReplacementSnippet
cfg.workhorse.config
"${cfg.statePath}/config/gitlab-workhorse.json"}
json2toml "${cfg.statePath}/config/gitlab-workhorse.json" "${cfg.statePath}/config/gitlab-workhorse.toml"
rm "${cfg.statePath}/config/gitlab-workhorse.json"
'';
ExecStart =
"${cfg.packages.gitlab-workhorse}/bin/workhorse "
+ "-listenUmask 0 "
@@ -1378,6 +1442,7 @@ in {
+ "-listenAddr /run/gitlab/gitlab-workhorse.socket "
+ "-authSocket ${gitlabSocket} "
+ "-documentRoot ${cfg.packages.gitlab}/share/gitlab/public "
+ "-config ${cfg.statePath}/config/gitlab-workhorse.toml "
+ "-secretPath ${cfg.statePath}/.gitlab_workhorse_secret";
};
};
nixos/modules/services/misc/gitolite.nix
+9 -1
View File
@@ -101,6 +101,14 @@ in
'';
};
description = mkOption {
type = types.str;
default = "Gitolite user";
description = lib.mdDoc ''
Gitolite user account's description.
'';
};
group = mkOption {
type = types.str;
default = "gitolite";
@@ -145,7 +153,7 @@ in
'';
users.users.${cfg.user} = {
description = "Gitolite user";
description = cfg.description;
home = cfg.dataDir;
uid = config.ids.uids.gitolite;
group = cfg.group;
nixos/modules/services/misc/tandoor-recipes.nix
+144
View File
@@ -0,0 +1,144 @@
{ config, pkgs, lib, ... }:
with lib;
let
cfg = config.services.tandoor-recipes;
pkg = cfg.package;
# SECRET_KEY through an env file
env = {
GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}";
DEBUG = "0";
MEDIA_ROOT = "/var/lib/tandoor-recipes";
} // optionalAttrs (config.time.timeZone != null) {
TIMEZONE = config.time.timeZone;
} // (
lib.mapAttrs (_: toString) cfg.extraConfig
);
manage =
let
setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
in
pkgs.writeShellScript "manage" ''
${setupEnv}
exec ${pkg}/bin/tandoor-recipes "$@"
'';
in
{
meta.maintainers = with maintainers; [ ambroisie ];
options.services.tandoor-recipes = {
enable = mkOption {
type = lib.types.bool;
default = false;
description = lib.mdDoc ''
Enable Tandoor Recipes.
When started, the Tandoor Recipes database is automatically created if
it doesn't exist and updated if the package has changed. Both tasks are
achieved by running a Django migration.
A script to manage the instance (by wrapping Django's manage.py) is linked to
`/var/lib/tandoor-recipes/tandoor-recipes-manage`.
'';
};
address = mkOption {
type = types.str;
default = "localhost";
description = lib.mdDoc "Web interface address.";
};
port = mkOption {
type = types.port;
default = 8080;
description = lib.mdDoc "Web interface port.";
};
extraConfig = mkOption {
type = types.attrs;
default = { };
description = lib.mdDoc ''
Extra tandoor recipes config options.
See [the example dot-env file](https://raw.githubusercontent.com/vabene1111/recipes/master/.env.template)
for available options.
'';
example = {
ENABLE_SIGNUP = "1";
};
};
package = mkOption {
type = types.package;
default = pkgs.tandoor-recipes;
defaultText = literalExpression "pkgs.tandoor-recipes";
description = lib.mdDoc "The Tandoor Recipes package to use.";
};
};
config = mkIf cfg.enable {
systemd.services.tandoor-recipes = {
description = "Tandoor Recipes server";
serviceConfig = {
ExecStart = ''
${pkg.python.pkgs.gunicorn}/bin/gunicorn recipes.wsgi
'';
Restart = "on-failure";
User = "tandoor_recipes";
DynamicUser = true;
StateDirectory = "tandoor-recipes";
WorkingDirectory = "/var/lib/tandoor-recipes";
RuntimeDirectory = "tandoor-recipes";
BindReadOnlyPaths = [
"${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
builtins.storeDir
"-/etc/resolv.conf"
"-/etc/nsswitch.conf"
"-/etc/hosts"
"-/etc/localtime"
"-/run/postgresql"
];
CapabilityBoundingSet = "";
LockPersonality = true;
MemoryDenyWriteExecute = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
SystemCallArchitectures = "native";
# gunicorn needs setuid
SystemCallFilter = [ "@system-service" "~@privileged" "@resources" "@setuid" "@keyring" ];
UMask = "0066";
} // lib.optionalAttrs (cfg.port < 1024) {
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
};
wantedBy = [ "multi-user.target" ];
preStart = ''
ln -sf ${manage} tandoor-recipes-manage
# Let django migrate the DB as needed
${pkg}/bin/tandoor-recipes migrate
'';
environment = env // {
PYTHONPATH = "${pkg.python.pkgs.makePythonPath pkg.propagatedBuildInputs}:${pkg}/lib/tandoor-recipes";
};
};
};
}
nixos/modules/services/network-filesystems/ipfs.nix → nixos/modules/services/network-filesystems/kubo.nix
+44 -21
View File
@@ -1,9 +1,9 @@
{ config, lib, pkgs, utils, ... }:
with lib;
let
cfg = config.services.ipfs;
cfg = config.services.kubo;
ipfsFlags = utils.escapeSystemdExecArgs (
kuboFlags = utils.escapeSystemdExecArgs (
optional cfg.autoMount "--mount" ++
optional cfg.enableGC "--enable-gc" ++
optional (cfg.serviceFdlimit != null) "--manage-fdlimit=false" ++
@@ -50,27 +50,27 @@ in
options = {
services.ipfs = {
services.kubo = {
enable = mkEnableOption (lib.mdDoc "Interplanetary File System (WARNING: may cause severe network degredation)");
package = mkOption {
type = types.package;
default = pkgs.ipfs;
defaultText = literalExpression "pkgs.ipfs";
description = lib.mdDoc "Which IPFS package to use.";
default = pkgs.kubo;
defaultText = literalExpression "pkgs.kubo";
description = lib.mdDoc "Which Kubo package to use.";
};
user = mkOption {
type = types.str;
default = "ipfs";
description = lib.mdDoc "User under which the IPFS daemon runs";
description = lib.mdDoc "User under which the Kubo daemon runs";
};
group = mkOption {
type = types.str;
default = "ipfs";
description = lib.mdDoc "Group under which the IPFS daemon runs";
description = lib.mdDoc "Group under which the Kubo daemon runs";
};
dataDir = mkOption {
@@ -84,7 +84,7 @@ in
then "/var/lib/ipfs"
else "/var/lib/ipfs/.ipfs"
'';
description = lib.mdDoc "The data dir for IPFS";
description = lib.mdDoc "The data dir for Kubo";
};
defaultMode = mkOption {
@@ -96,13 +96,13 @@ in
autoMount = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc "Whether IPFS should try to mount /ipfs and /ipns at startup.";
description = lib.mdDoc "Whether Kubo should try to mount /ipfs and /ipns at startup.";
};
autoMigrate = mkOption {
type = types.bool;
default = true;
description = lib.mdDoc "Whether IPFS should try to run the fs-repo-migration at startup.";
description = lib.mdDoc "Whether Kubo should try to run the fs-repo-migration at startup.";
};
ipfsMountDir = mkOption {
@@ -126,7 +126,7 @@ in
apiAddress = mkOption {
type = types.str;
default = "/ip4/127.0.0.1/tcp/5001";
description = lib.mdDoc "Where IPFS exposes its API to";
description = lib.mdDoc "Where Kubo exposes its API to";
};
swarmAddress = mkOption {
@@ -137,7 +137,7 @@ in
"/ip4/0.0.0.0/udp/4001/quic"
"/ip6/::/udp/4001/quic"
];
description = lib.mdDoc "Where IPFS listens for incoming p2p connections";
description = lib.mdDoc "Where Kubo listens for incoming p2p connections";
};
enableGC = mkOption {
@@ -174,14 +174,14 @@ in
extraFlags = mkOption {
type = types.listOf types.str;
description = lib.mdDoc "Extra flags passed to the IPFS daemon";
description = lib.mdDoc "Extra flags passed to the Kubo daemon";
default = [ ];
};
localDiscovery = mkOption {
type = types.bool;
description = lib.mdDoc ''Whether to enable local discovery for the ipfs daemon.
This will allow ipfs to scan ports on your local network. Some hosting services will ban you if you do this.
description = lib.mdDoc ''Whether to enable local discovery for the Kubo daemon.
This will allow Kubo to scan ports on your local network. Some hosting services will ban you if you do this.
'';
default = false;
};
@@ -189,14 +189,14 @@ in
serviceFdlimit = mkOption {
type = types.nullOr types.int;
default = null;
description = lib.mdDoc "The fdlimit for the IPFS systemd unit or `null` to have the daemon attempt to manage it";
description = lib.mdDoc "The fdlimit for the Kubo systemd unit or `null` to have the daemon attempt to manage it";
example = 64 * 1024;
};
startWhenNeeded = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc "Whether to use socket activation to start IPFS when needed.";
description = lib.mdDoc "Whether to use socket activation to start Kubo when needed.";
};
};
@@ -223,7 +223,7 @@ in
uid = config.ids.uids.ipfs;
description = "IPFS daemon user";
packages = [
pkgs.ipfs-migrator
pkgs.kubo-migrator
];
};
};
@@ -255,7 +255,7 @@ in
# After an unclean shutdown this file may exist which will cause the config command to attempt to talk to the daemon. This will hang forever if systemd is holding our sockets open.
rm -vf "$IPFS_PATH/api"
'' + optionalString cfg.autoMigrate ''
${pkgs.ipfs-migrator}/bin/fs-repo-migrations -to '${cfg.package.repoVersion}' -y
${pkgs.kubo-migrator}/bin/fs-repo-migrations -to '${cfg.package.repoVersion}' -y
'' + ''
ipfs --offline config profile apply ${profile} >/dev/null
fi
@@ -279,7 +279,7 @@ in
| ipfs --offline config replace -
'';
serviceConfig = {
ExecStart = [ "" "${cfg.package}/bin/ipfs daemon ${ipfsFlags}" ];
ExecStart = [ "" "${cfg.package}/bin/ipfs daemon ${kuboFlags}" ];
User = cfg.user;
Group = cfg.group;
StateDirectory = "";
@@ -320,4 +320,27 @@ in
meta = {
maintainers = with lib.maintainers; [ Luflosi ];
};
imports = [
(mkRenamedOptionModule [ "services" "ipfs" "enable" ] [ "services" "kubo" "enable" ])
(mkRenamedOptionModule [ "services" "ipfs" "package" ] [ "services" "kubo" "package" ])
(mkRenamedOptionModule [ "services" "ipfs" "user" ] [ "services" "kubo" "user" ])
(mkRenamedOptionModule [ "services" "ipfs" "group" ] [ "services" "kubo" "group" ])
(mkRenamedOptionModule [ "services" "ipfs" "dataDir" ] [ "services" "kubo" "dataDir" ])
(mkRenamedOptionModule [ "services" "ipfs" "defaultMode" ] [ "services" "kubo" "defaultMode" ])
(mkRenamedOptionModule [ "services" "ipfs" "autoMount" ] [ "services" "kubo" "autoMount" ])
(mkRenamedOptionModule [ "services" "ipfs" "autoMigrate" ] [ "services" "kubo" "autoMigrate" ])
(mkRenamedOptionModule [ "services" "ipfs" "ipfsMountDir" ] [ "services" "kubo" "ipfsMountDir" ])
(mkRenamedOptionModule [ "services" "ipfs" "ipnsMountDir" ] [ "services" "kubo" "ipnsMountDir" ])
(mkRenamedOptionModule [ "services" "ipfs" "gatewayAddress" ] [ "services" "kubo" "gatewayAddress" ])
(mkRenamedOptionModule [ "services" "ipfs" "apiAddress" ] [ "services" "kubo" "apiAddress" ])
(mkRenamedOptionModule [ "services" "ipfs" "swarmAddress" ] [ "services" "kubo" "swarmAddress" ])
(mkRenamedOptionModule [ "services" "ipfs" "enableGC" ] [ "services" "kubo" "enableGC" ])
(mkRenamedOptionModule [ "services" "ipfs" "emptyRepo" ] [ "services" "kubo" "emptyRepo" ])
(mkRenamedOptionModule [ "services" "ipfs" "extraConfig" ] [ "services" "kubo" "extraConfig" ])
(mkRenamedOptionModule [ "services" "ipfs" "extraFlags" ] [ "services" "kubo" "extraFlags" ])
(mkRenamedOptionModule [ "services" "ipfs" "localDiscovery" ] [ "services" "kubo" "localDiscovery" ])
(mkRenamedOptionModule [ "services" "ipfs" "serviceFdlimit" ] [ "services" "kubo" "serviceFdlimit" ])
(mkRenamedOptionModule [ "services" "ipfs" "startWhenNeeded" ] [ "services" "kubo" "startWhenNeeded" ])
];
}
nixos/modules/services/networking/coturn.nix
+4 -3
View File
@@ -335,9 +335,10 @@ in {
preStart = ''
cat ${configFile} > ${runConfig}
${optionalString (cfg.static-auth-secret-file != null) ''
STATIC_AUTH_SECRET="$(head -n1 ${cfg.static-auth-secret-file} || :)"
sed -e "s,#static-auth-secret#,$STATIC_AUTH_SECRET,g" \
-i ${runConfig}
${pkgs.replace-secret}/bin/replace-secret \
"#static-auth-secret#" \
${cfg.static-auth-secret-file} \
${runConfig}
'' }
chmod 640 ${runConfig}
'';
nixos/modules/services/networking/firefox-syncserver.nix
+4 -5
View File
@@ -19,6 +19,9 @@ let
fxa_email_domain = "api.accounts.firefox.com";
fxa_oauth_server_url = "https://oauth.accounts.firefox.com/v1";
run_migrations = true;
# if JWK caching is not enabled the token server must verify tokens
# using the fxa api, on a thread pool with a static size.
additional_blocking_threads_for_fxa_requests = 10;
} // lib.optionalAttrs cfg.singleNode.enable {
# Single-node mode is likely to be used on small instances with little
# capacity. The default value (0.1) can only ever release capacity when
@@ -309,11 +312,7 @@ in
enableACME = cfg.singleNode.enableTLS;
forceSSL = cfg.singleNode.enableTLS;
locations."/" = {
proxyPass = "http://localhost:${toString cfg.settings.port}";
# source mentions that this header should be set
extraConfig = ''
add_header X-Content-Type-Options nosniff;
'';
proxyPass = "http://127.0.0.1:${toString cfg.settings.port}";
};
};
};
nixos/modules/services/networking/iwd.nix
+1 -1
View File
@@ -67,5 +67,5 @@ in
};
};
meta.maintainers = with lib.maintainers; [ mic92 dtzWill ];
meta.maintainers = with lib.maintainers; [ dtzWill ];
}
nixos/modules/services/networking/jitsi-videobridge.nix
+1 -1
View File
@@ -70,7 +70,7 @@ in
description = lib.mdDoc ''
Videobridge configuration.
See <https://github.com/jitsi/jitsi-videobridge/blob/master/src/main/resources/reference.conf>
See <https://github.com/jitsi/jitsi-videobridge/blob/master/jvb/src/main/resources/reference.conf>
for default configuration with comments.
'';
};
nixos/modules/services/networking/knot.nix
+1 -1
View File
@@ -18,7 +18,7 @@ let
knot-cli-wrappers = pkgs.stdenv.mkDerivation {
name = "knot-cli-wrappers";
buildInputs = [ pkgs.makeWrapper ];
nativeBuildInputs = [ pkgs.makeWrapper ];
buildCommand = ''
mkdir -p $out/bin
makeWrapper ${cfg.package}/bin/knotc "$out/bin/knotc" \
nixos/modules/services/networking/pptpd.nix
+1 -1
View File
@@ -82,7 +82,7 @@ with lib;
ppp-pptpd-wrapped = pkgs.stdenv.mkDerivation {
name = "ppp-pptpd-wrapped";
phases = [ "installPhase" ];
buildInputs = with pkgs; [ makeWrapper ];
nativeBuildInputs = with pkgs; [ makeWrapper ];
installPhase = ''
mkdir -p $out/bin
makeWrapper ${pkgs.ppp}/bin/pppd $out/bin/pppd \
nixos/modules/services/networking/tinc.nix
+1 -1
View File
@@ -410,7 +410,7 @@ in
environment.systemPackages = let
cli-wrappers = pkgs.stdenv.mkDerivation {
name = "tinc-cli-wrappers";
buildInputs = [ pkgs.makeWrapper ];
nativeBuildInputs = [ pkgs.makeWrapper ];
buildCommand = ''
mkdir -p $out/bin
${concatStringsSep "\n" (mapAttrsToList (network: data:
nixos/modules/services/networking/tmate-ssh-server.nix
+122
View File
@@ -0,0 +1,122 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.tmate-ssh-server;
defaultKeysDir = "/etc/tmate-ssh-server-keys";
edKey = "${defaultKeysDir}/ssh_host_ed25519_key";
rsaKey = "${defaultKeysDir}/ssh_host_rsa_key";
keysDir =
if cfg.keysDir == null
then defaultKeysDir
else cfg.keysDir;
domain = config.networking.domain;
in
{
options.services.tmate-ssh-server = {
enable = mkEnableOption (mdDoc "tmate ssh server");
package = mkOption {
type = types.package;
description = mdDoc "The package containing tmate-ssh-server";
defaultText = literalExpression "pkgs.tmate-ssh-server";
default = pkgs.tmate-ssh-server;
};
host = mkOption {
type = types.str;
description = mdDoc "External host name";
defaultText = lib.literalExpression "config.networking.domain or config.networking.hostName ";
default =
if domain == null then
config.networking.hostName
else
domain;
};
port = mkOption {
type = types.port;
description = mdDoc "Listen port for the ssh server";
default = 2222;
};
openFirewall = mkOption {
type = types.bool;
default = true;
description = mdDoc "Whether to automatically open the specified ports in the firewall.";
};
advertisedPort = mkOption {
type = types.port;
description = mdDoc "External port advertised to clients";
};
keysDir = mkOption {
type = with types; nullOr str;
description = mdDoc "Directory containing ssh keys, defaulting to auto-generation";
default = null;
};
};
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = optionals cfg.openFirewall [ cfg.port ];
services.tmate-ssh-server = {
advertisedPort = mkDefault cfg.port;
};
environment.systemPackages =
let
tmate-config = pkgs.writeText "tmate.conf"
''
set -g tmate-server-host "${cfg.host}"
set -g tmate-server-port ${toString cfg.port}
set -g tmate-server-ed25519-fingerprint "@ed25519_fingerprint@"
set -g tmate-server-rsa-fingerprint "@rsa_fingerprint@"
'';
in
[
(pkgs.writeShellApplication {
name = "tmate-client-config";
runtimeInputs = with pkgs;[ openssh coreutils sd ];
text = ''
RSA_SIG="$(ssh-keygen -l -E SHA256 -f "${keysDir}/ssh_host_rsa_key.pub" | cut -d ' ' -f 2)"
ED25519_SIG="$(ssh-keygen -l -E SHA256 -f "${keysDir}/ssh_host_ed25519_key.pub" | cut -d ' ' -f 2)"
sd -sp '@ed25519_fingerprint@' "$ED25519_SIG" ${tmate-config} | \
sd -sp '@rsa_fingerprint@' "$RSA_SIG"
'';
})
];
systemd.services.tmate-ssh-server = {
description = "tmate SSH Server";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${cfg.package}/bin/tmate-ssh-server -h ${cfg.host} -p ${toString cfg.port} -q ${toString cfg.advertisedPort} -k ${keysDir}";
};
preStart = mkIf (cfg.keysDir == null) ''
if [[ ! -d ${defaultKeysDir} ]]
then
mkdir -p ${defaultKeysDir}
fi
if [[ ! -f ${edKey} ]]
then
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f ${edKey} -N ""
fi
if [[ ! -f ${rsaKey} ]]
then
${pkgs.openssh}/bin/ssh-keygen -t rsa -f ${rsaKey} -N ""
fi
'';
};
};
meta = {
maintainers = with maintainers; [ jlesquembre ];
};
}
nixos/modules/services/networking/xl2tpd.nix
+1 -1
View File
@@ -84,7 +84,7 @@ with lib;
xl2tpd-ppp-wrapped = pkgs.stdenv.mkDerivation {
name = "xl2tpd-ppp-wrapped";
phases = [ "installPhase" ];
buildInputs = with pkgs; [ makeWrapper ];
nativeBuildInputs = with pkgs; [ makeWrapper ];
installPhase = ''
mkdir -p $out/bin
nixos/modules/services/security/endlessh-go.nix
+138
View File
@@ -0,0 +1,138 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.endlessh-go;
in
{
options.services.endlessh-go = {
enable = mkEnableOption (mdDoc "endlessh-go service");
listenAddress = mkOption {
type = types.str;
default = "0.0.0.0";
example = "[::]";
description = mdDoc ''
Interface address to bind the endlessh-go daemon to SSH connections.
'';
};
port = mkOption {
type = types.port;
default = 2222;
example = 22;
description = mdDoc ''
Specifies on which port the endlessh-go daemon listens for SSH
connections.
Setting this to `22` may conflict with {option}`services.openssh`.
'';
};
prometheus = {
enable = mkEnableOption (mdDoc "Prometheus integration");
listenAddress = mkOption {
type = types.str;
default = "0.0.0.0";
example = "[::]";
description = mdDoc ''
Interface address to bind the endlessh-go daemon to answer Prometheus
queries.
'';
};
port = mkOption {
type = types.port;
default = 2112;
example = 9119;
description = mdDoc ''
Specifies on which port the endlessh-go daemon listens for Prometheus
queries.
'';
};
};
extraOptions = mkOption {
type = with types; listOf str;
default = [ ];
example = [ "-conn_type=tcp4" "-max_clients=8192" ];
description = mdDoc ''
Additional command line options to pass to the endlessh-go daemon.
'';
};
openFirewall = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc ''
Whether to open a firewall port for the SSH listener.
'';
};
};
config = mkIf cfg.enable {
systemd.services.endlessh-go = {
description = "SSH tarpit";
requires = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig =
let
needsPrivileges = cfg.port < 1024 || cfg.prometheus.port < 1024;
capabilities = [ "" ] ++ optionals needsPrivileges [ "CAP_NET_BIND_SERVICE" ];
rootDirectory = "/run/endlessh-go";
in
{
Restart = "always";
ExecStart = with cfg; concatStringsSep " " ([
"${pkgs.endlessh-go}/bin/endlessh-go"
"-logtostderr"
"-host=${listenAddress}"
"-port=${toString port}"
] ++ optionals prometheus.enable [
"-enable_prometheus"
"-prometheus_host=${prometheus.listenAddress}"
"-prometheus_port=${toString prometheus.port}"
] ++ extraOptions);
DynamicUser = true;
RootDirectory = rootDirectory;
BindReadOnlyPaths = [ builtins.storeDir ];
InaccessiblePaths = [ "-+${rootDirectory}" ];
RuntimeDirectory = baseNameOf rootDirectory;
RuntimeDirectoryMode = "700";
AmbientCapabilities = capabilities;
CapabilityBoundingSet = capabilities;
UMask = "0077";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = !needsPrivileges;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
ProtectProc = "noaccess";
ProcSubset = "pid";
RemoveIPC = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
};
};
networking.firewall.allowedTCPPorts = with cfg;
optionals openFirewall [ port prometheus.port ];
};
meta.maintainers = with maintainers; [ azahi ];
}
nixos/modules/services/security/fail2ban.nix
+11 -2
View File
@@ -91,8 +91,9 @@ in
example = "nftables-multiport";
description = lib.mdDoc ''
Default banning action (e.g. iptables, iptables-new, iptables-multiport,
shorewall, etc) It is used to define action_* variables. Can be overridden
globally or per section within jail.local file
iptables-ipset-proto6-allports, shorewall, etc) It is used to
define action_* variables. Can be overridden globally or per
section within jail.local file
'';
};
@@ -212,10 +213,18 @@ in
filter = apache-nohome
action = iptables-multiport[name=HTTP, port="http,https"]
logpath = /var/log/httpd/error_log*
backend = auto
findtime = 600
bantime = 600
maxretry = 5
''';
dovecot = '''
# block IPs which failed to log-in
# aggressive mode add blocking for aborted connections
enabled = true
filter = dovecot[mode=aggressive]
maxretry = 3
''';
}
'';
type = types.attrsOf types.lines;
nixos/modules/services/security/privacyidea.nix
+93 -1
View File
@@ -61,6 +61,12 @@ let
(flip mapAttrs cfg.ldap-proxy.settings
(const (mapAttrs (const renderValue)))));
privacyidea-token-janitor = pkgs.writeShellScriptBin "privacyidea-token-janitor" ''
exec -a privacyidea-token-janitor \
/run/wrappers/bin/sudo -u ${cfg.user} \
env PRIVACYIDEA_CONFIGFILE=${cfg.stateDir}/privacyidea.cfg \
${penv}/bin/privacyidea-token-janitor $@
'';
in
{
@@ -178,6 +184,42 @@ in
description = lib.mdDoc "Group account under which PrivacyIDEA runs.";
};
tokenjanitor = {
enable = mkEnableOption (lib.mdDoc "automatic runs of the token janitor");
interval = mkOption {
default = "quarterly";
type = types.str;
description = lib.mdDoc ''
Interval in which the cleanup program is supposed to run.
See {manpage}`systemd.time(7)` for further information.
'';
};
action = mkOption {
type = types.enum [ "delete" "mark" "disable" "unassign" ];
description = lib.mdDoc ''
Which action to take for matching tokens.
'';
};
unassigned = mkOption {
default = false;
type = types.bool;
description = lib.mdDoc ''
Whether to search for **unassigned** tokens
and apply [](#opt-services.privacyidea.tokenjanitor.action)
onto them.
'';
};
orphaned = mkOption {
default = true;
type = types.bool;
description = lib.mdDoc ''
Whether to search for **orphaned** tokens
and apply [](#opt-services.privacyidea.tokenjanitor.action)
onto them.
'';
};
};
ldap-proxy = {
enable = mkEnableOption (lib.mdDoc "PrivacyIDEA LDAP Proxy");
@@ -228,10 +270,60 @@ in
(mkIf cfg.enable {
environment.systemPackages = [ pkgs.privacyidea ];
assertions = [
{
assertion = cfg.tokenjanitor.enable -> (cfg.tokenjanitor.orphaned || cfg.tokenjanitor.unassigned);
message = ''
privacyidea-token-janitor has no effect if neither orphaned nor unassigned tokens
are to be searched.
'';
}
];
environment.systemPackages = [ pkgs.privacyidea (hiPrio privacyidea-token-janitor) ];
services.postgresql.enable = mkDefault true;
systemd.services.privacyidea-tokenjanitor = mkIf cfg.tokenjanitor.enable {
environment.PRIVACYIDEA_CONFIGFILE = "${cfg.stateDir}/privacyidea.cfg";
path = [ penv ];
serviceConfig = {
CapabilityBoundingSet = [ "" ];
ExecStart = "${pkgs.writeShellScript "pi-token-janitor" ''
${optionalString cfg.tokenjanitor.orphaned ''
echo >&2 "Removing orphaned tokens..."
privacyidea-token-janitor find \
--orphaned true \
--action ${cfg.tokenjanitor.action}
''}
${optionalString cfg.tokenjanitor.unassigned ''
echo >&2 "Removing unassigned tokens..."
privacyidea-token-janitor find \
--assigned false \
--action ${cfg.tokenjanitor.action}
''}
''}";
Group = cfg.group;
LockPersonality = true;
MemoryDenyWriteExecute = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
ReadWritePaths = cfg.stateDir;
Type = "oneshot";
User = cfg.user;
WorkingDirectory = cfg.stateDir;
};
};
systemd.timers.privacyidea-tokenjanitor = mkIf cfg.tokenjanitor.enable {
wantedBy = [ "timers.target" ];
timerConfig.OnCalendar = cfg.tokenjanitor.interval;
timerConfig.Persistent = true;
};
systemd.services.privacyidea = let
piuwsgi = pkgs.writeText "uwsgi.json" (builtins.toJSON {
uwsgi = {
nixos/modules/services/web-apps/mediawiki.nix
+1 -1
View File
@@ -35,7 +35,7 @@ let
};
mediawikiScripts = pkgs.runCommand "mediawiki-scripts" {
buildInputs = [ pkgs.makeWrapper ];
nativeBuildInputs = [ pkgs.makeWrapper ];
preferLocalBuild = true;
} ''
mkdir -p $out/bin
nixos/modules/services/x11/desktop-managers/gnome.nix
+7 -35
View File
@@ -22,42 +22,14 @@ let
favorite-apps=[ 'org.gnome.Epiphany.desktop', 'org.gnome.Geary.desktop', 'org.gnome.Calendar.desktop', 'org.gnome.Music.desktop', 'org.gnome.Photos.desktop', 'org.gnome.Nautilus.desktop' ]
'';
nixos-background-ligtht = pkgs.nixos-artwork.wallpapers.simple-blue;
nixos-background-light = pkgs.nixos-artwork.wallpapers.simple-blue;
nixos-background-dark = pkgs.nixos-artwork.wallpapers.simple-dark-gray;
nixos-gsettings-desktop-schemas = let
defaultPackages = with pkgs; [ gsettings-desktop-schemas gnome.gnome-shell ];
in
pkgs.runCommand "nixos-gsettings-desktop-schemas" { preferLocalBuild = true; }
''
mkdir -p $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas
${concatMapStrings
(pkg: "cp -rf ${pkg}/share/gsettings-schemas/*/glib-2.0/schemas/*.xml $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas\n")
(defaultPackages ++ cfg.extraGSettingsOverridePackages)}
cp -f ${pkgs.gnome.gnome-shell}/share/gsettings-schemas/*/glib-2.0/schemas/*.gschema.override $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas
${optionalString flashbackEnabled ''
cp -f ${pkgs.gnome.gnome-flashback}/share/gsettings-schemas/*/glib-2.0/schemas/*.gschema.override $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas
''}
chmod -R a+w $out/share/gsettings-schemas/nixos-gsettings-overrides
cat - > $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas/nixos-defaults.gschema.override <<- EOF
[org.gnome.desktop.background]
picture-uri='file://${nixos-background-ligtht.gnomeFilePath}'
picture-uri-dark='file://${nixos-background-dark.gnomeFilePath}'
[org.gnome.desktop.screensaver]
picture-uri='file://${nixos-background-dark.gnomeFilePath}'
${cfg.favoriteAppsOverride}
${cfg.extraGSettingsOverrides}
EOF
${pkgs.glib.dev}/bin/glib-compile-schemas $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas/
'';
# TODO: Having https://github.com/NixOS/nixpkgs/issues/54150 would supersede this
nixos-gsettings-desktop-schemas = pkgs.gnome.nixos-gsettings-overrides.override {
inherit (cfg) extraGSettingsOverrides extraGSettingsOverridePackages favoriteAppsOverride;
inherit flashbackEnabled nixos-background-dark nixos-background-light;
};
nixos-background-info = pkgs.writeTextFile rec {
name = "nixos-background-info";
@@ -67,7 +39,7 @@ let
<wallpapers>
<wallpaper deleted="false">
<name>Blobs</name>
<filename>${nixos-background-ligtht.gnomeFilePath}</filename>
<filename>${nixos-background-light.gnomeFilePath}</filename>
<filename-dark>${nixos-background-dark.gnomeFilePath}</filename-dark>
<options>zoom</options>
<shade_type>solid</shade_type>
nixos/modules/services/x11/hardware/libinput.nix
+10
View File
@@ -156,6 +156,14 @@ let cfg = config.services.xserver.libinput;
'';
};
tappingButtonMap = mkOption {
type = types.nullOr (types.enum [ "lrm" "lmr" ]);
default = null;
description = lib.mdDoc ''
Set the button mapping for 1/2/3-finger taps to left/right/middle or left/middle/right, respectively.
'';
};
tappingDragLock = mkOption {
type = types.bool;
default = true;
@@ -220,6 +228,7 @@ let cfg = config.services.xserver.libinput;
Option "HorizontalScrolling" "${xorgBool cfg.${deviceType}.horizontalScrolling}"
Option "SendEventsMode" "${cfg.${deviceType}.sendEventsMode}"
Option "Tapping" "${xorgBool cfg.${deviceType}.tapping}"
${optionalString (cfg.${deviceType}.tappingButtonMap != null) ''Option "TappingButtonMap" "${cfg.${deviceType}.tappingButtonMap}"''}
Option "TappingDragLock" "${xorgBool cfg.${deviceType}.tappingDragLock}"
Option "DisableWhileTyping" "${xorgBool cfg.${deviceType}.disableWhileTyping}"
${cfg.${deviceType}.additionalOptions}
@@ -241,6 +250,7 @@ in {
"horizontalScrolling"
"sendEventsMode"
"tapping"
"tappingButtonMap"
"tappingDragLock"
"transformationMatrix"
"disableWhileTyping"
nixos/modules/system/boot/systemd.nix
+2 -2
View File
@@ -325,8 +325,8 @@ in
type = types.lines;
example = "DefaultLimitCORE=infinity";
description = lib.mdDoc ''
Extra config options for systemd. See man systemd-system.conf for
available options.
Extra config options for systemd. See systemd-system.conf(5) man page
for available options.
'';
};
nixos/modules/system/boot/systemd/initrd.nix
+2
View File
@@ -372,6 +372,8 @@ in {
"/etc/os-release".source = config.boot.initrd.osRelease;
"/etc/initrd-release".source = config.boot.initrd.osRelease;
} // optionalAttrs (config.environment.etc ? "modprobe.d/nixos.conf") {
"/etc/modprobe.d/nixos.conf".source = config.environment.etc."modprobe.d/nixos.conf".source;
};
storePaths = [
nixos/modules/tasks/filesystems/jfs.nix
+1 -1
View File
@@ -12,7 +12,7 @@ in
boot.initrd.kernelModules = mkIf inInitrd [ "jfs" ];
boot.initrd.extraUtilsCommands = mkIf (inInitrd && !boot.initrd.systemd.enable) ''
boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable) ''
copy_bin_and_libs ${pkgs.jfsutils}/sbin/fsck.jfs
'';
};
nixos/modules/virtualisation/azure-agent.nix
+1 -1
View File
@@ -17,7 +17,7 @@ let
patches = [ ./azure-agent-entropy.patch ];
buildInputs = [ makeWrapper python pythonPackages.wrapPython ];
nativeBuildInputs = [ makeWrapper python pythonPackages.wrapPython ];
runtimeDeps = [ findutils gnugrep gawk coreutils openssl openssh
nettools # for hostname
procps # for pidof
nixos/modules/virtualisation/virtualbox-host.nix
+11 -9
View File
@@ -104,16 +104,18 @@ in
group = "vboxusers";
setuid = true;
};
executables = [
"VBoxHeadless"
"VBoxNetAdpCtl"
"VBoxNetDHCP"
"VBoxNetNAT"
"VBoxVolInfo"
] ++ (lib.optionals (!cfg.headless) [
"VBoxSDL"
"VirtualBoxVM"
]);
in mkIf cfg.enableHardening
(builtins.listToAttrs (map (x: { name = x; value = mkSuid x; }) [
"VBoxHeadless"
"VBoxNetAdpCtl"
"VBoxNetDHCP"
"VBoxNetNAT"
"VBoxSDL"
"VBoxVolInfo"
"VirtualBoxVM"
]));
(builtins.listToAttrs (map (x: { name = x; value = mkSuid x; }) executables));
users.groups.vboxusers.gid = config.ids.gids.vboxusers;
nixos/tests/acme.nix
+59 -1
View File
@@ -41,6 +41,16 @@
inherit documentRoot;
};
simpleConfig = {
security.acme = {
certs."http.example.test" = {
listenHTTP = ":80";
};
};
networking.firewall.allowedTCPPorts = [ 80 ];
};
# Base specialisation config for testing general ACME features
webserverBasicConfig = {
services.nginx.enable = true;
@@ -173,6 +183,26 @@ in {
services.nginx.logError = "stderr info";
specialisation = {
# Tests HTTP-01 verification using Lego's built-in web server
http01lego.configuration = simpleConfig;
renew.configuration = lib.mkMerge [
simpleConfig
{
# Pebble provides 5 year long certs,
# needs to be higher than that to test renewal
security.acme.certs."http.example.test".validMinDays = 9999;
}
];
# Tests that account creds can be safely changed.
accountchange.configuration = lib.mkMerge [
simpleConfig
{
security.acme.certs."http.example.test".email = "admin@example.test";
}
];
# First derivation used to test general ACME features
general.configuration = { ... }: let
caDomain = nodes.acme.test-support.acme.caDomain;
@@ -446,7 +476,35 @@ in {
download_ca_certs(client)
# Perform general tests first
# Perform http-01 w/ lego test first
with subtest("Can request certificate with Lego's built in web server"):
switch_to(webserver, "http01lego")
webserver.wait_for_unit("acme-finished-http.example.test.target")
check_fullchain(webserver, "http.example.test")
check_issuer(webserver, "http.example.test", "pebble")
# Perform renewal test
with subtest("Can renew certificates when they expire"):
hash = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
switch_to(webserver, "renew")
webserver.wait_for_unit("acme-finished-http.example.test.target")
check_fullchain(webserver, "http.example.test")
check_issuer(webserver, "http.example.test", "pebble")
hash_after = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
assert hash != hash_after
# Perform account change test
with subtest("Handles email change correctly"):
hash = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
switch_to(webserver, "accountchange")
webserver.wait_for_unit("acme-finished-http.example.test.target")
check_fullchain(webserver, "http.example.test")
check_issuer(webserver, "http.example.test", "pebble")
hash_after = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")
# Has to do a full run to register account, which creates new certs.
assert hash != hash_after
# Perform general tests
switch_to(webserver, "general")
with subtest("Can request certificate with HTTP-01 challenge"):
nixos/tests/all-tests.nix
+5 -1
View File
@@ -180,6 +180,7 @@ in {
ejabberd = handleTest ./xmpp/ejabberd.nix {};
elk = handleTestOn ["x86_64-linux"] ./elk.nix {};
emacs-daemon = handleTest ./emacs-daemon.nix {};
endlessh-go = handleTest ./endlessh-go.nix {};
engelsystem = handleTest ./engelsystem.nix {};
enlightenment = handleTest ./enlightenment.nix {};
env = handleTest ./env.nix {};
@@ -284,7 +285,6 @@ in {
installer-systemd-stage-1 = handleTest ./installer-systemd-stage-1.nix {};
invoiceplane = handleTest ./invoiceplane.nix {};
iodine = handleTest ./iodine.nix {};
ipfs = handleTest ./ipfs.nix {};
ipv6 = handleTest ./ipv6.nix {};
iscsi-multipath-root = handleTest ./iscsi-multipath-root.nix {};
iscsi-root = handleTest ./iscsi-root.nix {};
@@ -317,6 +317,7 @@ in {
ksm = handleTest ./ksm.nix {};
kthxbye = handleTest ./kthxbye.nix {};
kubernetes = handleTestOn ["x86_64-linux"] ./kubernetes {};
kubo = handleTest ./kubo.nix {};
ladybird = handleTest ./ladybird.nix {};
languagetool = handleTest ./languagetool.nix {};
latestKernel.login = handleTest ./login.nix { latestKernel = true; };
@@ -597,6 +598,7 @@ in {
systemd-initrd-btrfs-raid = handleTest ./systemd-initrd-btrfs-raid.nix {};
systemd-initrd-luks-keyfile = handleTest ./systemd-initrd-luks-keyfile.nix {};
systemd-initrd-luks-password = handleTest ./systemd-initrd-luks-password.nix {};
systemd-initrd-modprobe = handleTest ./systemd-initrd-modprobe.nix {};
systemd-initrd-shutdown = handleTest ./systemd-shutdown.nix { systemdStage1 = true; };
systemd-initrd-simple = handleTest ./systemd-initrd-simple.nix {};
systemd-initrd-swraid = handleTest ./systemd-initrd-swraid.nix {};
@@ -612,6 +614,7 @@ in {
systemd-shutdown = handleTest ./systemd-shutdown.nix {};
systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
systemd-misc = handleTest ./systemd-misc.nix {};
tandoor-recipes = handleTest ./tandoor-recipes.nix {};
taskserver = handleTest ./taskserver.nix {};
teeworlds = handleTest ./teeworlds.nix {};
telegraf = handleTest ./telegraf.nix {};
@@ -624,6 +627,7 @@ in {
tinc = handleTest ./tinc {};
tinydns = handleTest ./tinydns.nix {};
tinywl = handleTest ./tinywl.nix {};
tmate-ssh-server = handleTest ./tmate-ssh-server.nix { };
tomcat = handleTest ./tomcat.nix {};
tor = handleTest ./tor.nix {};
# traefik test relies on docker-containers
nixos/tests/endlessh-go.nix
+58
View File
@@ -0,0 +1,58 @@
import ./make-test-python.nix ({ lib, pkgs, ... }:
{
name = "endlessh-go";
meta.maintainers = with lib.maintainers; [ azahi ];
nodes = {
server = { ... }: {
services.endlessh-go = {
enable = true;
prometheus.enable = true;
openFirewall = true;
};
specialisation = {
unprivileged.configuration = {
services.endlessh-go = {
port = 2222;
prometheus.port = 9229;
};
};
privileged.configuration = {
services.endlessh-go = {
port = 22;
prometheus.port = 92;
};
};
};
};
client = { pkgs, ... }: {
environment.systemPackages = with pkgs; [ curl netcat ];
};
};
testScript = ''
def activate_specialisation(name: str):
server.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
start_all()
with subtest("Unprivileged"):
activate_specialisation("unprivileged")
server.wait_for_unit("endlessh-go.service")
server.wait_for_open_port(2222)
server.wait_for_open_port(9229)
client.succeed("nc -dvW5 server 2222")
client.succeed("curl -kv server:9229/metrics")
with subtest("Privileged"):
activate_specialisation("privileged")
server.wait_for_unit("endlessh-go.service")
server.wait_for_open_port(22)
server.wait_for_open_port(92)
client.succeed("nc -dvW5 server 22")
client.succeed("curl -kv server:92/metrics")
'';
})
nixos/tests/hydra/common.nix
+1 -1
View File
@@ -16,7 +16,7 @@
createTrivialProject = pkgs.stdenv.mkDerivation {
name = "create-trivial-project";
dontUnpack = true;
buildInputs = [ pkgs.makeWrapper ];
nativeBuildInputs = [ pkgs.makeWrapper ];
installPhase = "install -m755 -D ${./create-trivial-project.sh} $out/bin/create-trivial-project.sh";
postFixup = ''
wrapProgram "$out/bin/create-trivial-project.sh" --prefix PATH ":" ${pkgs.lib.makeBinPath [ pkgs.curl ]} --set EXPR_PATH ${trivialJob}
nixos/tests/k3s/multi-node.nix
+21 -4
View File
@@ -1,4 +1,4 @@
import ../make-test-python.nix ({ pkgs, ... }:
import ../make-test-python.nix ({ pkgs, lib, ... }:
let
imageEnv = pkgs.buildEnv {
name = "k3s-pause-image-env";
@@ -54,7 +54,15 @@ import ../make-test-python.nix ({ pkgs, ... }:
role = "server";
package = pkgs.k3s;
clusterInit = true;
extraFlags = "--no-deploy coredns,servicelb,traefik,local-storage,metrics-server --pause-image test.local/pause:local --node-ip 192.168.1.1";
extraFlags = ''
--disable coredns \
--disable local-storage \
--disable metrics-server \
--disable servicelb \
--disable traefik \
--node-ip 192.168.1.1 \
--pause-image test.local/pause:local
'';
};
networking.firewall.allowedTCPPorts = [ 2379 2380 6443 ];
networking.firewall.allowedUDPPorts = [ 8472 ];
@@ -76,7 +84,15 @@ import ../make-test-python.nix ({ pkgs, ... }:
enable = true;
serverAddr = "https://192.168.1.1:6443";
clusterInit = false;
extraFlags = "--no-deploy coredns,servicelb,traefik,local-storage,metrics-server --pause-image test.local/pause:local --node-ip 192.168.1.3";
extraFlags = ''
--disable coredns \
--disable local-storage \
--disable metrics-server \
--disable servicelb \
--disable traefik \
--node-ip 192.168.1.3 \
--pause-image test.local/pause:local
'';
};
networking.firewall.allowedTCPPorts = [ 2379 2380 6443 ];
networking.firewall.allowedUDPPorts = [ 8472 ];
@@ -123,7 +139,8 @@ import ../make-test-python.nix ({ pkgs, ... }:
server.wait_until_succeeds("k3s kubectl get node agent")
for m in machines:
m.succeed("k3s check-config")
'' # Fix-Me: Tests fail for 'aarch64-linux' as: "CONFIG_CGROUP_FREEZER: missing (fail)"
+ lib.optionalString (!pkgs.stdenv.isAarch64) ''m.succeed("k3s check-config")'' + ''
m.succeed(
"${pauseImage} | k3s ctr image import -"
)
nixos/tests/k3s/single-node.nix
+12 -3
View File
@@ -1,4 +1,4 @@
import ../make-test-python.nix ({ pkgs, ... }:
import ../make-test-python.nix ({ pkgs, lib, ... }:
let
imageEnv = pkgs.buildEnv {
name = "k3s-pause-image-env";
@@ -40,7 +40,15 @@ import ../make-test-python.nix ({ pkgs, ... }:
services.k3s.role = "server";
services.k3s.package = pkgs.k3s;
# Slightly reduce resource usage
services.k3s.extraFlags = "--no-deploy coredns,servicelb,traefik,local-storage,metrics-server --pause-image test.local/pause:local";
services.k3s.extraFlags = ''
--disable coredns \
--disable local-storage \
--disable metrics-server \
--disable servicelb \
--disable traefik \
--pause-image \
test.local/pause:local
'';
users.users = {
noprivs = {
@@ -57,7 +65,8 @@ import ../make-test-python.nix ({ pkgs, ... }:
machine.wait_for_unit("k3s")
machine.succeed("k3s kubectl cluster-info")
machine.fail("sudo -u noprivs k3s kubectl cluster-info")
machine.succeed("k3s check-config")
'' # Fix-Me: Tests fail for 'aarch64-linux' as: "CONFIG_CGROUP_FREEZER: missing (fail)"
+ lib.optionalString (!pkgs.stdenv.isAarch64) ''machine.succeed("k3s check-config")'' + ''
machine.succeed(
"${pauseImage} | k3s ctr image import -"
nixos/tests/kubernetes/base.nix
+1 -1
View File
@@ -18,7 +18,7 @@ let
${master.ip} api.${domain}
${concatMapStringsSep "\n" (machineName: "${machines.${machineName}.ip} ${machineName}.${domain}") (attrNames machines)}
'';
wrapKubectl = with pkgs; runCommand "wrap-kubectl" { buildInputs = [ makeWrapper ]; } ''
wrapKubectl = with pkgs; runCommand "wrap-kubectl" { nativeBuildInputs = [ makeWrapper ]; } ''
mkdir -p $out/bin
makeWrapper ${pkgs.kubernetes}/bin/kubectl $out/bin/kubectl --set KUBECONFIG "/etc/kubernetes/cluster-admin.kubeconfig"
'';
nixos/tests/ipfs.nix → nixos/tests/kubo.nix
+3 -3
View File
@@ -1,11 +1,11 @@
import ./make-test-python.nix ({ pkgs, ...} : {
name = "ipfs";
name = "kubo";
meta = with pkgs.lib.maintainers; {
maintainers = [ mguentner ];
};
nodes.machine = { ... }: {
services.ipfs = {
services.kubo = {
enable = true;
# Also will add a unix domain socket socket API address, see module.
startWhenNeeded = true;
@@ -15,7 +15,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
};
nodes.fuse = { ... }: {
services.ipfs = {
services.kubo = {
enable = true;
apiAddress = "/ip4/127.0.0.1/tcp/2324";
autoMount = true;
nixos/tests/paperless.nix
+8
View File
@@ -40,5 +40,13 @@ import ./make-test-python.nix ({ lib, ... }: {
docs = json.loads(machine.succeed("curl -u admin:admin -fs localhost:28981/api/documents/"))['results']
assert "2005-10-16" in docs[0]['created']
assert "2005-10-16" in docs[1]['created']
# Detects gunicorn issues, see PR #190888
with subtest("Document metadata can be accessed"):
metadata = json.loads(machine.succeed("curl -u admin:admin -fs localhost:28981/api/documents/1/metadata/"))
assert "original_checksum" in metadata
metadata = json.loads(machine.succeed("curl -u admin:admin -fs localhost:28981/api/documents/2/metadata/"))
assert "original_checksum" in metadata
'';
})
nixos/tests/pulseaudio.nix
+17 -8
View File
@@ -1,10 +1,10 @@
let
mkTest = { systemWide ? false }:
mkTest = { systemWide ? false , fullVersion ? false }:
import ./make-test-python.nix ({ pkgs, lib, ... }:
let
testFile = pkgs.fetchurl {
url =
"https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3";
"https://file-examples.com/storage/fe5947fd2362fc197a3c2df/2017/11/file_example_MP3_700KB.mp3";
hash = "sha256-+iggJW8s0/LfA/okfXsB550/55Q0Sq3OoIzuBrzOPJQ=";
};
@@ -22,7 +22,7 @@ let
testPlay32 = { inherit (pkgs.pkgsi686Linux) sox alsa-utils; };
};
in {
name = "pulseaudio${lib.optionalString systemWide "-systemWide"}";
name = "pulseaudio${lib.optionalString fullVersion "Full"}${lib.optionalString systemWide "-systemWide"}";
meta = with pkgs.lib.maintainers; {
maintainers = [ synthetica ] ++ pkgs.pulseaudio.meta.maintainers;
};
@@ -35,12 +35,14 @@ let
enable = true;
support32Bit = true;
inherit systemWide;
} // lib.optionalAttrs fullVersion {
package = pkgs.pulseaudioFull;
};
environment.systemPackages = [ testers.testPlay pkgs.pavucontrol ]
++ lib.optional pkgs.stdenv.isx86_64 testers.testPlay32;
} // lib.optionalAttrs systemWide {
users.users.alice.extraGroups = [ "audio" ];
users.users.alice.extraGroups = [ "pulse-access" ];
systemd.services.pulseaudio.wantedBy = [ "multi-user.target" ];
};
@@ -58,14 +60,21 @@ let
''}
machine.screenshot("testPlay")
${lib.optionalString (!systemWide) ''
machine.send_chars("pacmd info && touch /tmp/pacmd_success\n")
machine.wait_for_file("/tmp/pacmd_success")
''}
# Pavucontrol only loads when Pulseaudio is running. If it isn't, the
# text "Playback" (one of the tabs) will never show.
# text "Dummy Output" (sound device name) will never show.
machine.send_chars("pavucontrol\n")
machine.wait_for_text("Playback")
machine.wait_for_text("Dummy Output")
machine.screenshot("Pavucontrol")
'';
});
in builtins.mapAttrs (key: val: mkTest val) {
user = { systemWide = false; };
system = { systemWide = true; };
user = { systemWide = false; fullVersion = false; };
system = { systemWide = true; fullVersion = false; };
userFull = { systemWide = false; fullVersion = true; };
systemFull = { systemWide = true; fullVersion = true; };
}
nixos/tests/retroarch.nix
+2 -2
View File
@@ -2,7 +2,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
{
name = "retroarch";
meta = with pkgs.lib.maintainers; { maintainers = [ j0hax ]; };
meta = with pkgs.lib; { maintainers = teams.libretro.members ++ [ maintainers.j0hax ]; };
nodes.machine = { ... }:
@@ -11,7 +11,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
services.xserver.enable = true;
services.xserver.desktopManager.retroarch = {
enable = true;
package = pkgs.retroarchFull;
package = pkgs.retroarchBare;
};
services.xserver.displayManager = {
sddm.enable = true;
nixos/tests/seafile.nix
+3 -9
View File
@@ -79,18 +79,14 @@ import ./make-test-python.nix ({ pkgs, ... }:
f"seaf-cli download -l {libid} -s http://server -u admin\@example.com -p seafile_password -d . >&2"
)
client1.sleep(3)
client1.succeed("seaf-cli status |grep synchronized >&2")
client1.wait_until_succeeds("seaf-cli status |grep synchronized >&2")
client1.succeed("ls -la >&2")
client1.succeed("ls -la test01 >&2")
client1.execute("echo bla > test01/first_file")
client1.sleep(2)
client1.succeed("seaf-cli status |grep synchronized >&2")
client1.wait_until_succeeds("seaf-cli status |grep synchronized >&2")
with subtest("client2 sync"):
client2.wait_for_unit("default.target")
@@ -110,9 +106,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
f"seaf-cli download -l {libid} -s http://server -u admin\@example.com -p seafile_password -d . >&2"
)
client2.sleep(3)
client2.succeed("seaf-cli status |grep synchronized >&2")
client2.wait_until_succeeds("seaf-cli status |grep synchronized >&2")
client2.succeed("ls -la test01 >&2")
nixos/tests/spark/default.nix
+1
View File
@@ -7,6 +7,7 @@ import ../make-test-python.nix ({...}: {
enable = true;
master = "master:7077";
};
virtualisation.memorySize = 2048;
};
master = { config, pkgs, ... }: {
services.spark.master = {
nixos/tests/sssd-ldap.nix
+6 -1
View File
@@ -91,6 +91,11 @@ in import ./make-test-python.nix ({pkgs, ...}: {
machine.start()
machine.wait_for_unit("openldap.service")
machine.wait_for_unit("sssd.service")
machine.succeed("getent passwd ${testUser}")
result = machine.execute("getent passwd ${testUser}")
if result[0] == 0:
assert "${testUser}" in result[1]
else:
machine.wait_for_console_text("Backend is online")
machine.succeed("getent passwd ${testUser}")
'';
})
nixos/tests/systemd-initrd-modprobe.nix
+17
View File
@@ -0,0 +1,17 @@
import ./make-test-python.nix ({ lib, pkgs, ... }: {
name = "systemd-initrd-modprobe";
nodes.machine = { pkgs, ... }: {
boot.initrd.systemd.enable = true;
boot.initrd.kernelModules = [ "loop" ]; # Load module in initrd.
boot.extraModprobeConfig = ''
options loop max_loop=42
'';
};
testScript = ''
machine.wait_for_unit("multi-user.target")
max_loop = machine.succeed("cat /sys/module/loop/parameters/max_loop")
assert int(max_loop) == 42, "Parameter should be respected for initrd kernel modules"
'';
})
nixos/tests/systemd-oomd.nix
+38 -21
View File
@@ -3,35 +3,52 @@ import ./make-test-python.nix ({ pkgs, ... }:
{
name = "systemd-oomd";
# This test is a simplified version of systemd's testsuite-55.
# https://github.com/systemd/systemd/blob/v251/test/units/testsuite-55.sh
nodes.machine = { pkgs, ... }: {
systemd.oomd.extraConfig.DefaultMemoryPressureDurationSec = "1s"; # makes the test faster
# Kill cgroups when more than 1% pressure is encountered
systemd.slices."-".sliceConfig = {
ManagedOOMMemoryPressure = "kill";
ManagedOOMMemoryPressureLimit = "1%";
};
# A service to bring the system under memory pressure
systemd.services.testservice = {
serviceConfig.ExecStart = "${pkgs.coreutils}/bin/tail /dev/zero";
};
# Do not kill the backdoor
systemd.services.backdoor.serviceConfig.ManagedOOMMemoryPressure = "auto";
# Limit VM resource usage.
virtualisation.memorySize = 1024;
systemd.oomd.extraConfig.DefaultMemoryPressureDurationSec = "1s";
systemd.slices.workload = {
description = "Test slice for memory pressure kills";
sliceConfig = {
MemoryAccounting = true;
ManagedOOMMemoryPressure = "kill";
ManagedOOMMemoryPressureLimit = "10%";
};
};
systemd.services.testbloat = {
description = "Create a lot of memory pressure";
serviceConfig = {
Slice = "workload.slice";
MemoryHigh = "5M";
ExecStart = "${pkgs.coreutils}/bin/tail /dev/zero";
};
};
systemd.services.testchill = {
description = "No memory pressure";
serviceConfig = {
Slice = "workload.slice";
MemoryHigh = "3M";
ExecStart = "${pkgs.coreutils}/bin/sleep infinity";
};
};
};
testScript = ''
# Start the system
# Start the system.
machine.wait_for_unit("multi-user.target")
machine.succeed("oomctl")
# Bring the system into memory pressure
machine.succeed("echo 0 > /proc/sys/vm/panic_on_oom") # NixOS tests kill the VM when the OOM killer is invoked - override this
machine.succeed("systemctl start testservice")
machine.succeed("systemctl start testchill.service")
with subtest("OOMd should kill the bad service"):
machine.fail("systemctl start --wait testbloat.service")
assert machine.get_unit_info("testbloat.service")["Result"] == "oom-kill"
# Wait for oomd to kill something
# Matches these lines:
# systemd-oomd[508]: Killed /system.slice/systemd-udevd.service due to memory pressure for / being 3.26% > 1.00% for > 1s with reclaim activity
machine.wait_until_succeeds("journalctl -b | grep -q 'due to memory pressure for'")
with subtest("Service without memory pressure should be untouched"):
machine.require_unit_state("testchill.service", "active")
'';
})
nixos/tests/tandoor-recipes.nix
+43
View File
@@ -0,0 +1,43 @@
import ./make-test-python.nix ({ lib, ... }: {
name = "tandoor-recipes";
meta.maintainers = with lib.maintainers; [ ambroisie ];
nodes.machine = { pkgs, ... }: {
# Setup using Postgres
services.tandoor-recipes = {
enable = true;
extraConfig = {
DB_ENGINE = "django.db.backends.postgresql";
POSTGRES_HOST = "/run/postgresql";
POSTGRES_USER = "tandoor_recipes";
POSTGRES_DB = "tandoor_recipes";
};
};
services.postgresql = {
enable = true;
ensureDatabases = [ "tandoor_recipes" ];
ensureUsers = [
{
name = "tandoor_recipes";
ensurePermissions."DATABASE tandoor_recipes" = "ALL PRIVILEGES";
}
];
};
systemd.services = {
tandoor-recipes = {
after = [ "postgresql.service" ];
};
};
};
testScript = ''
machine.wait_for_unit("tandoor-recipes.service")
with subtest("Web interface gets ready"):
# Wait until server accepts connections
machine.wait_until_succeeds("curl -fs localhost:8080")
'';
})
nixos/tests/tmate-ssh-server.nix
+73
View File
@@ -0,0 +1,73 @@
import ./make-test-python.nix ({ pkgs, lib, ... }:
let
inherit (import ./ssh-keys.nix pkgs)
snakeOilPrivateKey snakeOilPublicKey;
setUpPrivateKey = name: ''
${name}.succeed(
"mkdir -p /root/.ssh",
"chown 700 /root/.ssh",
"cat '${snakeOilPrivateKey}' > /root/.ssh/id_snakeoil",
"chown 600 /root/.ssh/id_snakeoil",
)
${name}.wait_for_file("/root/.ssh/id_snakeoil")
'';
sshOpts = "-oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null -oIdentityFile=/root/.ssh/id_snakeoil";
in
{
name = "tmate-ssh-server";
nodes =
{
server = { ... }: {
services.tmate-ssh-server = {
enable = true;
port = 2223;
};
};
client = { ... }: {
environment.systemPackages = [ pkgs.tmate ];
services.openssh.enable = true;
users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
};
client2 = { ... }: {
environment.systemPackages = [ pkgs.openssh ];
};
};
testScript = ''
start_all()
server.wait_for_unit("tmate-ssh-server.service")
server.wait_for_open_port(2223)
server.wait_for_file("/etc/tmate-ssh-server-keys/ssh_host_ed25519_key.pub")
server.wait_for_file("/etc/tmate-ssh-server-keys/ssh_host_rsa_key.pub")
server.succeed("tmate-client-config > /tmp/tmate.conf")
server.wait_for_file("/tmp/tmate.conf")
${setUpPrivateKey "server"}
client.wait_for_unit("sshd.service")
client.wait_for_open_port(22)
server.succeed("scp ${sshOpts} /tmp/tmate.conf client:/tmp/tmate.conf")
client.wait_for_file("/tmp/tmate.conf")
client.send_chars("root\n")
client.sleep(2)
client.send_chars("tmate -f /tmp/tmate.conf\n")
client.sleep(2)
client.send_chars("q")
client.sleep(2)
client.send_chars("tmate display -p '#{tmate_ssh}' > /tmp/ssh_command\n")
client.wait_for_file("/tmp/ssh_command")
ssh_cmd = client.succeed("cat /tmp/ssh_command")
client2.succeed("mkdir -p ~/.ssh; ssh-keyscan -p 2223 server > ~/.ssh/known_hosts")
client2.send_chars("root\n")
client2.sleep(2)
client2.send_chars(ssh_cmd.strip() + "\n")
client2.sleep(2)
client2.send_chars("touch /tmp/client_2\n")
client.wait_for_file("/tmp/client_2")
'';
})
nixos/tests/vengi-tools.nix
+1 -3
View File
@@ -20,10 +20,8 @@ import ./make-test-python.nix ({ pkgs, ... }: {
machine.wait_for_x()
machine.execute("vengi-voxedit >&2 &")
machine.wait_for_window("voxedit")
# OCR on voxedit's window is very expensive, so we avoid wasting a try
# by letting the window load fully first
# Let the window load fully
machine.sleep(15)
machine.wait_for_text("Solid")
machine.screenshot("screen")
'';
})
pkgs/applications/audio/apple-music-electron/default.nix
-32
View File
@@ -1,32 +0,0 @@
{ appimageTools, lib, fetchurl }:
let
pname = "apple-music-electron";
version = "1.5.5";
name = "Apple.Music-${version}";
src = fetchurl {
url = "https://github.com/cryptofyre/Apple-Music-Electron/releases/download/v${version}/${name}.AppImage";
sha256 = "1gb6j3nvam9fcpsgiv56jccg9a4y14vzsyw11h3hckaigy90knpx";
};
appimageContents = appimageTools.extract { inherit name src; };
in appimageTools.wrapType2 {
inherit name src;
extraInstallCommands = ''
mv $out/bin/${name} $out/bin/${pname}
install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
substituteInPlace $out/share/applications/${pname}.desktop \
--replace 'Exec=AppRun' 'Exec=${pname}'
cp -r ${appimageContents}/usr/share/icons $out/share
'';
meta = with lib; {
description = "Unofficial Apple Music application without having to bother with a Web Browser or iTunes";
homepage = "https://github.com/iiFir3z/Apple-Music-Electron";
license = licenses.mit;
maintainers = [ maintainers.ivar ];
platforms = [ "x86_64-linux" ];
};
}
pkgs/applications/audio/audacity/default.nix
+36 -42
View File
@@ -13,6 +13,7 @@
, libjack2
, lv2
, lilv
, mpg123
, serd
, sord
, sqlite
@@ -45,52 +46,36 @@
, libsepol
, libxkbcommon
, util-linux
, wxGTK
, wavpack
, wxGTK32
, gtk3
, libpng
, libjpeg
, AppKit ? null
, AudioToolbox ? null
, AudioUnit ? null
, Carbon ? null
, Cocoa ? null
, CoreAudio ? null
, CoreAudioKit ? null
, CoreServices ? null
, wxmac
, AppKit
, AudioToolbox
, AudioUnit
, Carbon
, CoreAudio
, CoreAudioKit
, CoreServices
}:
# TODO
# 1. as of 3.0.2, GTK2 is still the recommended version ref https://www.audacityteam.org/download/source/ check if that changes in future versions
# 2. detach sbsms
# 1. detach sbsms
let
inherit (lib) optionals;
pname = "audacity";
version = "3.1.3";
wxWidgets_src = fetchFromGitHub {
owner = pname;
repo = "wxWidgets";
rev = "v${version}-${pname}";
sha256 = "sha256-KrmYYv23DHBYKIuxMYBioCQ2e4KWdgmuREnimtm0XNU=";
fetchSubmodules = true;
};
wxGTK' = wxGTK.overrideAttrs (oldAttrs: rec {
src = wxWidgets_src;
});
wxmac' = wxmac.overrideAttrs (oldAttrs: rec {
src = wxWidgets_src;
});
in stdenv.mkDerivation rec {
version = "3.2.1";
in
stdenv.mkDerivation rec {
inherit pname version;
src = fetchFromGitHub {
owner = pname;
repo = pname;
rev = "Audacity-${version}";
sha256 = "sha256-sdI4paxIHDZgoWTCekjrkFR4JFpQC6OatcnJdVXCCZk=";
sha256 = "sha256-7rfttp9LnfM2LBT5seupPyDckS7LEzWDZoqtLsGgqgI=";
};
postPatch = ''
@@ -105,9 +90,9 @@ in stdenv.mkDerivation rec {
gettext
pkg-config
python3
makeWrapper
] ++ optionals stdenv.isLinux [
linuxHeaders
makeWrapper
];
buildInputs = [
@@ -115,6 +100,7 @@ in stdenv.mkDerivation rec {
ffmpeg_4
file
flac
gtk3
lame
libid3tag
libjack2
@@ -125,6 +111,7 @@ in stdenv.mkDerivation rec {
libvorbis
lilv
lv2
mpg123
pcre
portmidi
serd
@@ -136,6 +123,8 @@ in stdenv.mkDerivation rec {
suil
twolame
portaudio
wavpack
wxGTK32
] ++ optionals stdenv.isLinux [
alsa-lib # for portaudio
at-spi2-core
@@ -149,12 +138,8 @@ in stdenv.mkDerivation rec {
libsepol
libuuid
util-linux
wxGTK'
wxGTK'.gtk
] ++ optionals stdenv.isDarwin [
wxmac'
AppKit
Cocoa
CoreAudioKit
AudioUnit AudioToolbox CoreAudio CoreServices Carbon # for portaudio
libpng
@@ -167,22 +152,33 @@ in stdenv.mkDerivation rec {
"-DDISABLE_DYNAMIC_LOADING_FFMPEG=ON"
"-Daudacity_conan_enabled=Off"
"-Daudacity_use_ffmpeg=loaded"
"-Daudacity_has_vst3=Off"
# RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
"-DCMAKE_SKIP_BUILD_RPATH=ON"
];
# [ 57%] Generating LightThemeAsCeeCode.h...
# ../../utils/image-compiler: error while loading shared libraries:
# lib-theme.so: cannot open shared object file: No such file or directory
preBuild = ''
export LD_LIBRARY_PATH=$PWD/utils
'';
doCheck = false; # Test fails
# Replace audacity's wrapper, to:
# - put it in the right place, it shouldn't be in "$out/audacity"
# - Add the ffmpeg dynamic dependency
postInstall = lib.optionalString stdenv.isLinux ''
rm "$out/audacity"
wrapProgram "$out/bin/audacity" \
--prefix LD_LIBRARY_PATH : "$out/lib/audacity":${lib.makeLibraryPath [ ffmpeg_4 ]} \
--suffix AUDACITY_MODULES_PATH : "$out/lib/audacity/modules" \
--suffix AUDACITY_PATH : "$out/share/audacity"
'' + lib.optionalString stdenv.isDarwin ''
mkdir -p $out/{Applications,bin}
mv $out/Audacity.app $out/Applications/
makeWrapper $out/Applications/Audacity.app/Contents/MacOS/Audacity $out/bin/audacity
'';
meta = with lib; {
@@ -198,11 +194,9 @@ in stdenv.mkDerivation rec {
# Documentation.
cc-by-30
];
maintainers = with maintainers; [ lheckemann veprbl ];
maintainers = with maintainers; [ lheckemann veprbl wegank ];
platforms = platforms.unix;
# darwin-aarch due to qtbase broken for it.
# darwin-x86_64 due to
# https://logs.nix.ci/?attempt_id=5cbc4581-09b4-4148-82fe-0326411a56b3&key=nixos%2Fnixpkgs.152273.
broken = stdenv.isDarwin;
# error: unknown type name 'NSAppearanceName'
broken = stdenv.isDarwin && stdenv.isx86_64;
};
}
pkgs/applications/audio/aumix/default.nix
+5 -1
View File
@@ -28,8 +28,12 @@ stdenv.mkDerivation rec {
})
];
nativeBuildInputs = lib.optionals gtkGUI [ pkg-config ];
buildInputs = [ gettext ncurses ]
++ lib.optionals gtkGUI [ pkg-config gtk2 ];
++ lib.optionals gtkGUI [ gtk2 ];
configureFlags = lib.optionals (!gtkGUI) ["--without-gtk"];
meta = with lib; {
description = "Audio mixer for X and the console";
pkgs/applications/audio/blanket/default.nix
+4 -3
View File
@@ -4,7 +4,7 @@
, meson
, ninja
, pkg-config
, wrapGAppsHook
, wrapGAppsHook4
, desktop-file-utils
, appstream-glib
, python3Packages
@@ -30,9 +30,8 @@ python3Packages.buildPythonApplication rec {
meson
ninja
pkg-config
wrapGAppsHook
wrapGAppsHook4
desktop-file-utils
appstream-glib
];
buildInputs = [
@@ -57,6 +56,8 @@ python3Packages.buildPythonApplication rec {
postPatch = ''
patchShebangs build-aux/meson/postinstall.py
substituteInPlace build-aux/meson/postinstall.py \
--replace gtk-update-icon-cache gtk4-update-icon-cache
'';
meta = with lib; {
pkgs/applications/audio/calf/default.nix
+2 -1
View File
@@ -12,9 +12,10 @@ stdenv.mkDerivation rec {
enableParallelBuilding = true;
nativeBuildInputs = [ pkg-config ];
buildInputs = [
cairo expat fftwSinglePrec fluidsynth glib gtk2 libjack2 ladspaH
libglade lv2 pkg-config
libglade lv2
];
meta = with lib; {
pkgs/applications/audio/eartag/default.nix
+78
View File
@@ -0,0 +1,78 @@
{ stdenv
, lib
, fetchFromGitHub
, meson
, ninja
, pkg-config
, wrapGAppsHook4
, libadwaita
, gettext
, glib
, gobject-introspection
, desktop-file-utils
, appstream-glib
, gtk4
, librsvg
, python3Packages
}:
python3Packages.buildPythonApplication rec {
pname = "eartag";
version = "0.2.1";
format = "other";
src = fetchFromGitHub {
owner = "knuxify";
repo = pname;
rev = version;
sha256 = "sha256-TlY2F2y7ZZ9f+vkYYkES5zoIGcuTWP1+rOJI62wc4SU=";
};
postPatch = ''
chmod +x ./build-aux/meson/postinstall.py
patchShebangs ./build-aux/meson/postinstall.py
substituteInPlace ./build-aux/meson/postinstall.py \
--replace "gtk-update-icon-cache" "gtk4-update-icon-cache"
'';
nativeBuildInputs = [
meson
ninja
glib
desktop-file-utils
appstream-glib
pkg-config
gettext
gobject-introspection
wrapGAppsHook4
] ++ lib.optional stdenv.isDarwin gtk4; # for gtk4-update-icon-cache
buildInputs = [
librsvg
libadwaita
];
propagatedBuildInputs = with python3Packages; [
pygobject3
eyeD3
pillow
mutagen
pytaglib
python-magic
];
dontWrapGApps = true;
preFixup = ''
makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
'';
meta = with lib; {
homepage = "https://github.com/knuxify/eartag";
description = "Simple music tag editor";
# This seems to be using ICU license but we're flagging it to MIT license
# since ICU license is a modified version of MIT and to prevent it from
# being incorrectly identified as unfree software.
license = licenses.mit;
maintainers = with maintainers; [ foo-dogsquared ];
};
}
pkgs/applications/audio/exact-audio-copy/default.nix
+86
View File
@@ -0,0 +1,86 @@
{ lib
, stdenv
, fetchurl
, makeDesktopItem
, imagemagick
, p7zip
, wine
, writeShellScriptBin
, symlinkJoin
, use64 ? false
}:
let
pname = "exact-audio-copy";
version = "1.6.0";
eac_exe = fetchurl {
url = "http://www.exactaudiocopy.de/eac-${lib.versions.majorMinor version}.exe";
sha256 = "8291d33104ebab2619ba8d85744083e241330a286f5bd7d54c7b0eb08f2b84c1";
};
cygwin_dll = fetchurl {
url = "https://cygwin.com/snapshots/x86/cygwin1-20220301.dll.xz";
sha256 = "0zxn0r5q69fhciy0mrplhxj1hxwy3sq4k1wdy6n6kyassm4zyz1x";
};
patched_eac = stdenv.mkDerivation {
pname = "patched_eac";
inherit version;
nativeBuildInputs = [
imagemagick
p7zip
];
buildCommand = ''
mkdir -p $out
_tmp=$(mktemp -d)
cd $_tmp
7z x -aoa ${eac_exe}
chmod -R 755 .
cp ${cygwin_dll} cygwin1.dll.xz
xz --decompress cygwin1.dll.xz
mv cygwin1.dll CDRDAO/
cp -r * $out
7z x EAC.exe
convert .rsrc/1033/ICON/29.ico -thumbnail 128x128 -alpha on -background none -flatten "$out/eac.ico.128.png"
'';
};
wrapper = writeShellScriptBin pname ''
export WINEPREFIX="''${EXACT_AUDIO_COPY_HOME:-"''${XDG_DATA_HOME:-"''${HOME}/.local/share"}/exact-audio-copy"}/wine"
export WINEARCH=${if use64 then "win64" else "win32"}
export WINEDLLOVERRIDES="mscoree=" # disable mono
export WINEDEBUG=-all
if [ ! -d "$WINEPREFIX" ] ; then
mkdir -p "$WINEPREFIX"
${wine}/bin/wineboot -u
fi
exec ${wine}/bin/wine ${patched_eac}/EAC.exe "$@"
'';
desktopItem = makeDesktopItem {
name = pname;
exec = pname;
comment = "Audio Grabber for CDs";
desktopName = "Exact Audio Copy";
categories = [ "Audio" "AudioVideo" ];
icon = "${patched_eac}/eac.ico.128.png";
};
in
symlinkJoin {
name = "${pname}-${version}";
paths = [ wrapper desktopItem ];
meta = with lib; {
description = "A precise CD audio grabber for creating perfect quality rips using CD and DVD drives";
homepage = "https://www.exactaudiocopy.de/";
changelog = "https://www.exactaudiocopy.de/en/index.php/resources/whats-new/whats-new/";
license = licenses.unfree;
maintainers = [ maintainers.brendanreis ];
platforms = wine.meta.platforms;
};
}
pkgs/applications/audio/flac/default.nix
+4 -2
View File
@@ -2,11 +2,12 @@
stdenv.mkDerivation rec {
pname = "flac";
version = "1.3.4";
version = "1.4.1";
src = fetchurl {
url = "http://downloads.xiph.org/releases/flac/${pname}-${version}.tar.xz";
sha256 = "0dz7am8kbc97a6afml1h4yp085274prg8j7csryds8m3fmz61w4g";
# Official checksum is published at https://github.com/xiph/flac/releases/tag/${version}
sha256 = "91303c3e5dfde52c3e94e75976c0ab3ee14ced278ab8f60033a3a12db9209ae6";
};
buildInputs = [ libogg ];
@@ -20,5 +21,6 @@ stdenv.mkDerivation rec {
description = "Library and tools for encoding and decoding the FLAC lossless audio file format";
platforms = platforms.all;
license = licenses.bsd3;
maintainers = with maintainers; [ ruuda ];
};
}
pkgs/applications/audio/ft2-clone/default.nix
+2 -2
View File
@@ -13,13 +13,13 @@
stdenv.mkDerivation rec {
pname = "ft2-clone";
version = "1.58";
version = "1.59";
src = fetchFromGitHub {
owner = "8bitbubsy";
repo = "ft2-clone";
rev = "v${version}";
sha256 = "sha256-FHhASs1PKTz6G1sAKNUeft0BHbWgl44l7eiOnyQXZb8=";
sha256 = "sha256-TQJCkvPV6vbhURLcuH41i8obHnfHkrCTJG0+IuSVDos=";
};
# Adapt the linux-only CMakeLists to darwin (more reliable than make-macos.sh)
pkgs/applications/audio/gmpc/default.nix
+3 -2
View File
@@ -24,9 +24,10 @@ stdenv.mkDerivation rec {
version = "11.8.16";
libmpd = stdenv.mkDerivation {
name = "libmpd-11.8.17";
pname = "libmpd";
version = "11.8.17";
src = fetchurl {
url = "http://download.sarine.nl/Programs/gmpc/11.8/libmpd-11.8.17.tar.gz";
url = "https://download.sarine.nl/Programs/gmpc/${lib.versions.majorMinor version}/libmpd-${version}.tar.gz";
sha256 = "10vspwsgr8pwf3qp2bviw6b2l8prgdiswgv7qiqiyr0h1mmk487y";
};
patches = [ ./libmpd-11.8.17-remove-strndup.patch ];
pkgs/applications/audio/grandorgue/default.nix
+1 -1
View File
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
nativeBuildInputs = [ cmake pkg-config ];
buildInputs = [ pkg-config fftwFloat alsa-lib zlib wavpack wxGTK31 udev ]
buildInputs = [ fftwFloat alsa-lib zlib wavpack wxGTK31 udev ]
++ lib.optional jackaudioSupport libjack2;
cmakeFlags = lib.optional (!jackaudioSupport) [
pkgs/applications/audio/jamesdsp/default.nix
+7 -16
View File
@@ -13,7 +13,6 @@
, makeDesktopItem
, pkg-config
, libarchive
, fetchpatch
, copyDesktopItems
, usePipewire ? true
, usePulseaudio ? false
@@ -26,28 +25,15 @@ let
in
mkDerivation rec {
pname = "jamesdsp";
version = "2.3";
version = "2.4";
src = fetchFromGitHub rec {
owner = "Audio4Linux";
repo = "JDSP4Linux";
fetchSubmodules = true;
rev = version;
hash = "sha256-Hkzurr+s+vvSyOMCYH9kHI+nIm6mL9yORGNzY2FXslc=";
hash = "sha256-wD1JZQD8dR24cBN4QJCSrEsS4aoMD+MQmqnOIFKOeoE=";
};
patches = [
# fixing /usr install assumption, remove on version bump
(fetchpatch {
url = "https://github.com/Audio4Linux/JDSP4Linux/commit/003c9e9fc426f83e269aed6e05be3ed55273931a.patch";
hash = "sha256-crll/a7C9pUq9eL5diq8/YgC5bNC6SrdijZEBxZpJ8E=";
})
# compatibility fix for PipeWire 0.3.44+, remove on version bump
(fetchpatch {
url = "https://github.com/Audio4Linux/JDSP4Linux/commit/e04c55735cc20fc3c3ce042c5681ec80f7df3c96.patch";
hash = "sha256-o6AUtQzugykALSdkM3i3lYqRmzJX3FzmALSi0TrWuRA=";
})
];
nativeBuildInputs = [
qmake
pkg-config
@@ -86,6 +72,11 @@ in
})
];
postInstall = ''
install -D resources/icons/icon.png $out/share/pixmaps/jamesdsp.png
install -D resources/icons/icon.svg $out/share/icons/hicolor/scalable/apps/jamesdsp.svg
'';
meta = with lib;{
broken = (stdenv.isLinux && stdenv.isAarch64);
description = "An audio effect processor for PipeWire clients";
pkgs/applications/audio/ltc-tools/default.nix
+2 -1
View File
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
sha256 = "0vp25b970r1hv5ndzs4di63rgwnl31jfaj3jz5dka276kx34q4al";
};
buildInputs = [ pkg-config libltc libsndfile jack2 ];
nativeBuildInputs = [ pkg-config ];
buildInputs = [ libltc libsndfile jack2 ];
makeFlags = [ "PREFIX=$(out)" ];
pkgs/applications/audio/meterbridge/default.nix
+2 -1
View File
@@ -12,8 +12,9 @@ stdenv.mkDerivation rec {
patches = [ ./buf_rect.patch ./fix_build_with_gcc-5.patch];
nativeBuildInputs = [ pkg-config ];
buildInputs =
[ pkg-config SDL SDL_image libjack2
[ SDL SDL_image libjack2
];
meta = with lib; {

Some files were not shown because too many files have changed in this diff Show More