diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md index 7b4080ea3f39..7f2e0f622c62 100644 --- a/nixos/doc/manual/release-notes/rl-2405.section.md +++ b/nixos/doc/manual/release-notes/rl-2405.section.md @@ -178,7 +178,7 @@ The pre-existing `services.ankisyncd` has been marked deprecated and will be dro - [Scrutiny](https://github.com/AnalogJ/scrutiny), a S.M.A.R.T monitoring tool for hard disks with a web frontend. Available as [services.scrutiny](#opt-services.scrutiny.enable). -- [SimpleSAMLphp](https://simplesamlphp.org/), an application written in native PHP that deals with authentication (SQL, .htpasswd, YubiKey, LDAP, PAPI, Radius). Available as [services.simplesamlphp](#opt-services.simplesamlphp). +- [SimpleSAMLphp](https://simplesamlphp.org/), an application written in native PHP that deals with authentication (SQL, .htpasswd, YubiKey, LDAP, PAPI, Radius). Available as `services.simplesamlphp`. - `systemd`'s `gateway`, `upload`, and `remote` services, which provide ways of sending journals across the network. Enable using [services.journald.gateway](#opt-services.journald.gateway.enable), [services.journald.upload](#opt-services.journald.upload.enable), and [services.journald.remote](#opt-services.journald.remote.enable). diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index 72a784afab78..16ce699c53f2 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -350,6 +350,8 @@ - `services.gitea` supports sending notifications with sendmail again. To do this, activate the parameter `services.gitea.mailerUseSendmail` and configure SMTP server. +- `simplesamlphp` has been removed since the package was severely outdated, unmaintained in nixpkgs and having known vulnerabilities. + - `networking.wireless.networks.` now has an option to specify SSID, hence allowing duplicated SSID setup. The BSSID option is added along side with this. - Revamp of the ACME certificate acquisication and renewal process to help scale systems with lots (100+) of certificates. diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index f00d30e89ccb..457d7923fd63 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1704,7 +1704,6 @@ ./services/web-apps/shiori.nix ./services/web-apps/sillytavern.nix ./services/web-apps/silverbullet.nix - ./services/web-apps/simplesamlphp.nix ./services/web-apps/slskd.nix ./services/web-apps/snipe-it.nix ./services/web-apps/snips-sh.nix diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix index 4c156727e6df..aede85d7eee8 100644 --- a/nixos/modules/rename.nix +++ b/nixos/modules/rename.nix @@ -408,6 +408,9 @@ in services.postfixadmin has been removed since it was unmaintained in nixpkgs and the version available only supported PHP 8.1 which is EOL. '') + (mkRemovedOptionModule [ "services" "simplesamlphp" ] '' + services.simplesamlphp has been vulnerable and unmaintained in nixpkgs. + '') # Do NOT add any option renames here, see top of the file ]; } diff --git a/nixos/modules/services/web-apps/simplesamlphp.nix b/nixos/modules/services/web-apps/simplesamlphp.nix deleted file mode 100644 index 46d8b69a174b..000000000000 --- a/nixos/modules/services/web-apps/simplesamlphp.nix +++ /dev/null @@ -1,128 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.services.simplesamlphp; - - format = pkgs.formats.php { finalVariable = "config"; }; - - generateConfig = - opts: - pkgs.runCommand "simplesamlphp-config" { } '' - mkdir $out - cp ${format.generate "config.php" opts.settings} $out/config.php - cp ${format.generate "authsources.php" opts.authSources} $out/authsources.php - ''; -in -{ - meta = { - maintainers = with lib.maintainers; [ nhnn ]; - }; - - options.services.simplesamlphp = - with lib; - mkOption { - type = types.attrsOf ( - types.submodule ( - { config, ... }: - { - options = { - package = mkPackageOption pkgs "simplesamlphp" { }; - configureNginx = mkOption { - type = types.bool; - default = true; - description = "Configure nginx as a reverse proxy for SimpleSAMLphp."; - }; - phpfpmPool = mkOption { - type = types.str; - description = "The PHP-FPM pool that serves SimpleSAMLphp instance."; - }; - localDomain = mkOption { - type = types.str; - description = "The domain serving your SimpleSAMLphp instance. This option modifies only /saml route."; - }; - settings = mkOption { - type = types.submodule { - freeformType = format.type; - options = { - baseurlpath = mkOption { - type = types.str; - example = "https://filesender.example.com/saml/"; - description = "URL where SimpleSAMLphp can be reached."; - }; - }; - }; - default = { }; - description = '' - Configuration options used by SimpleSAMLphp. - See [](https://simplesamlphp.org/docs/stable/simplesamlphp-install) - for available options. - ''; - }; - - authSources = mkOption { - type = format.type; - default = { }; - description = '' - Auth sources options used by SimpleSAMLphp. - ''; - }; - - libDir = mkOption { - type = types.str; - readOnly = true; - description = '' - Path to the SimpleSAMLphp library directory. - ''; - }; - configDir = mkOption { - type = types.str; - readOnly = true; - description = '' - Path to the SimpleSAMLphp config directory. - ''; - }; - }; - config = { - libDir = "${config.package}/share/php/simplesamlphp/"; - configDir = "${generateConfig config}"; - }; - } - ) - ); - default = { }; - description = "Instances of SimpleSAMLphp. This module is designed to work with already existing PHP-FPM pool and NGINX virtualHost."; - }; - - config = lib.mkIf (cfg != { }) { - services.phpfpm.pools = lib.mapAttrs' ( - phpfpmName: opts: - lib.nameValuePair opts.phpfpmPool { phpEnv.SIMPLESAMLPHP_CONFIG_DIR = "${generateConfig opts}"; } - ) cfg; - - services.nginx.virtualHosts = lib.mapAttrs' ( - phpfpmName: opts: - lib.nameValuePair opts.localDomain ( - lib.mkIf opts.configureNginx { - locations."^~ /saml/" = { - alias = "${opts.package}/share/php/simplesamlphp/www/"; - extraConfig = '' - location ~ ^(?/saml)(?.+?\.php)(?/.*)?$ { - include ${pkgs.nginx}/conf/fastcgi.conf; - fastcgi_split_path_info ^(.+\.php)(/.+)$; - fastcgi_pass unix:${config.services.phpfpm.pools.${phpfpmName}.socket}; - fastcgi_intercept_errors on; - fastcgi_param SCRIPT_FILENAME $document_root$phpfile; - fastcgi_param SCRIPT_NAME /saml$phpfile; - fastcgi_param PATH_INFO $pathinfo if_not_empty; - } - ''; - }; - } - ) - ) cfg; - }; -} diff --git a/pkgs/by-name/si/simplesamlphp/package.nix b/pkgs/by-name/si/simplesamlphp/package.nix deleted file mode 100644 index 4345d70ca6ff..000000000000 --- a/pkgs/by-name/si/simplesamlphp/package.nix +++ /dev/null @@ -1,25 +0,0 @@ -{ - php, - fetchFromGitHub, - lib, -}: -php.buildComposerProject2 (finalAttrs: { - pname = "simplesamlphp"; - version = "1.19.7"; - - src = fetchFromGitHub { - owner = "simplesamlphp"; - repo = "simplesamlphp"; - tag = "v${finalAttrs.version}"; - hash = "sha256-Qmy9fuZq8MBqvYV6/u3Dg92pHHicuUhdNeB22u4hwwA="; - }; - - vendorHash = "sha256-kFRvOxSfqlM+xzFFlEm9YrbQDOvC4AA0BtztFQ1xxDU="; - - meta = { - description = "Application written in native PHP that deals with authentication (SQL, .htpasswd, YubiKey, LDAP, PAPI, Radius)"; - homepage = "https://simplesamlphp.org"; - license = lib.licenses.lgpl21; - maintainers = with lib.maintainers; [ nhnn ]; - }; -}) diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 051d3a593994..b3c32fff8bd5 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -2399,6 +2399,7 @@ mapAliases { signal-desktop-source = lib.warnOnInstantiate "'signal-desktop-source' is now exposed at 'signal-desktop'." signal-desktop; # Added 2025-04-16 silc_server = throw "'silc_server' has been removed because it is unmaintained"; # Added 2025-05-12 silc_client = throw "'silc_client' has been removed because it is unmaintained"; # Added 2025-05-12 + simplesamlphp = throw "'simplesamlphp' was removed because it was unmaintained in nixpkgs"; # Added 2025-10-17 siproxd = throw "'siproxd' has been removed as it was unmaintained and incompatible with newer libosip versions"; # Added 2025-05-18 sisco.lv2 = throw "'sisco.lv2' has been removed as it was unmaintained and broken"; # Added 2025-08-26 sipwitch = throw "'sipwitch' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-01