diff --git a/doc/builders/fetchers.chapter.md b/doc/builders/fetchers.chapter.md
index 28388ba685d8..d9f22b062827 100644
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@@ -72,6 +72,10 @@ Used with Mercurial. Expects `url`, `rev`, and `sha256`.
A number of fetcher functions wrap part of `fetchurl` and `fetchzip`. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.
+## `fetchFromGitea` {#fetchfromgitea}
+
+`fetchFromGitea` expects five arguments. `domain` is the gitea server name. `owner` is a string corresponding to the Gitea user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every Gitea HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. Finally, `sha256` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available but `sha256` is currently preferred.
+
## `fetchFromGitHub` {#fetchfromgithub}
`fetchFromGitHub` expects four arguments. `owner` is a string corresponding to the GitHub user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every GitHub HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. Finally, `sha256` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available but `sha256` is currently preferred.
diff --git a/doc/languages-frameworks/texlive.section.md b/doc/languages-frameworks/texlive.section.md
index 6b505cefcc95..060f5c647c29 100644
--- a/doc/languages-frameworks/texlive.section.md
+++ b/doc/languages-frameworks/texlive.section.md
@@ -6,7 +6,7 @@ Since release 15.09 there is a new TeX Live packaging that lives entirely under
- For basic usage just pull `texlive.combined.scheme-basic` for an environment with basic LaTeX support.
-- It typically won't work to use separately installed packages together. Instead, you can build a custom set of packages like this:
+- It typically won't work to use separately installed packages together. Instead, you can build a custom set of packages like this. Most CTAN packages should be available:
```nix
texlive.combine {
diff --git a/lib/default.nix b/lib/default.nix
index 6f7930c53430..0e94e821bea5 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -68,7 +68,8 @@ let
bitNot boolToString mergeAttrs flip mapNullable inNixShell isFloat min max
importJSON importTOML warn warnIf throwIfNot checkListOfEnum
info showWarnings nixpkgsVersion version isInOldestRelease
- mod compare splitByAndCompare functionArgs setFunctionArgs isFunction
+ mod compare splitByAndCompare
+ functionArgs setFunctionArgs isFunction toFunction
toHexString toBaseDigits;
inherit (self.fixedPoints) fix fix' converge extends composeExtensions
composeManyExtensions makeExtensible makeExtensibleWithCustomName;
@@ -113,7 +114,7 @@ let
commitIdFromGitRepo cleanSourceWith pathHasContext
canCleanSource pathIsRegularFile pathIsGitRepo;
inherit (self.modules) evalModules setDefaultModuleLocation
- unifyModuleSyntax applyIfFunction mergeModules
+ unifyModuleSyntax applyModuleArgsIfFunction mergeModules
mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
pushDownProperties dischargeProperties filterOverrides
sortProperties fixupOptionType mkIf mkAssert mkMerge mkOverride
diff --git a/lib/modules.nix b/lib/modules.nix
index 9bb8bfbbdf14..35c93d22baf9 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -282,11 +282,11 @@ rec {
# Like unifyModuleSyntax, but also imports paths and calls functions if necessary
loadModule = args: fallbackFile: fallbackKey: m:
if isFunction m || isAttrs m then
- unifyModuleSyntax fallbackFile fallbackKey (applyIfFunction fallbackKey m args)
+ unifyModuleSyntax fallbackFile fallbackKey (applyModuleArgsIfFunction fallbackKey m args)
else if isList m then
let defs = [{ file = fallbackFile; value = m; }]; in
throw "Module imports can't be nested lists. Perhaps you meant to remove one level of lists? Definitions: ${showDefs defs}"
- else unifyModuleSyntax (toString m) (toString m) (applyIfFunction (toString m) (import m) args);
+ else unifyModuleSyntax (toString m) (toString m) (applyModuleArgsIfFunction (toString m) (import m) args);
/*
Collects all modules recursively into the form
@@ -383,7 +383,7 @@ rec {
config = addFreeformType (addMeta (removeAttrs m ["_file" "key" "disabledModules" "require" "imports" "freeformType"]));
};
- applyIfFunction = key: f: args@{ config, options, lib, ... }: if isFunction f then
+ applyModuleArgsIfFunction = key: f: args@{ config, options, lib, ... }: if isFunction f then
let
# Module arguments are resolved in a strict manner when attribute set
# deconstruction is used. As the arguments are now defined with the
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 543680a10801..18616a189c26 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -441,6 +441,25 @@ rec {
isFunction = f: builtins.isFunction f ||
(f ? __functor && isFunction (f.__functor f));
+ /*
+ Turns any non-callable values into constant functions.
+ Returns callable values as is.
+
+ Example:
+
+ nix-repl> lib.toFunction 1 2
+ 1
+
+ nix-repl> lib.toFunction (x: x + 1) 2
+ 3
+ */
+ toFunction =
+ # Any value
+ v:
+ if isFunction v
+ then v
+ else k: v;
+
/* Convert the given positive integer to a string of its hexadecimal
representation. For example:
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index b3856142cecd..8b25a19d5ede 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -475,6 +475,15 @@
its reliance on python2.
+
+
+ services.ipfs.extraFlags is now escaped
+ with utils.escapeSystemdExecArgs. If you
+ rely on systemd interpolating extraFlags in
+ the service ExecStart, this will no longer
+ work.
+
+
The matrix-synapse service
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 815e791d63e5..08644654f666 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -159,6 +159,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- The `mailpile` email webclient (`services.mailpile`) has been removed due to its reliance on python2.
+- `services.ipfs.extraFlags` is now escaped with `utils.escapeSystemdExecArgs`. If you rely on systemd interpolating `extraFlags` in the service `ExecStart`, this will no longer work.
+
- The `matrix-synapse` service (`services.matrix-synapse`) has been converted to use the `settings` option defined in RFC42.
This means that options that are part of your `homeserver.yaml` configuration, and that were specified at the top-level of the
module (`services.matrix-synapse`) now need to be moved into `services.matrix-synapse.settings`. And while not all options you
diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
index 0d3c3a89e783..facc7a253a75 100644
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@@ -146,26 +146,28 @@ rec {
# Make a full-blown test
makeTest =
- { testScript
+ { machine ? null
+ , nodes ? {}
+ , testScript
, enableOCR ? false
, name ? "unnamed"
# Skip linting (mainly intended for faster dev cycles)
, skipLint ? false
, passthru ? {}
+ , meta ? {}
, # For meta.position
pos ? # position used in error messages and for meta.position
- (if t.meta.description or null != null
- then builtins.unsafeGetAttrPos "description" t.meta
+ (if meta.description or null != null
+ then builtins.unsafeGetAttrPos "description" meta
else builtins.unsafeGetAttrPos "testScript" t)
- , ...
} @ t:
let
- nodes = qemu_pkg:
+ mkNodes = qemu_pkg:
let
testScript' =
# Call the test script with the computed nodes.
if lib.isFunction testScript
- then testScript { nodes = nodes qemu_pkg; }
+ then testScript { nodes = mkNodes qemu_pkg; }
else testScript;
build-vms = import ./build-vms.nix {
@@ -205,33 +207,29 @@ rec {
};
in
build-vms.buildVirtualNetwork (
- t.nodes or (if t ? machine then { machine = t.machine; } else { })
+ nodes // lib.optionalAttrs (machine != null) { inherit machine; }
);
driver = setupDriverForTest {
inherit testScript enableOCR skipLint passthru;
testName = name;
qemu_pkg = pkgs.qemu_test;
- nodes = nodes pkgs.qemu_test;
+ nodes = mkNodes pkgs.qemu_test;
};
driverInteractive = setupDriverForTest {
inherit testScript enableOCR skipLint passthru;
testName = name;
qemu_pkg = pkgs.qemu;
- nodes = nodes pkgs.qemu;
+ nodes = mkNodes pkgs.qemu;
interactive = true;
};
- test =
- let
- passMeta = drv: drv // lib.optionalAttrs (t ? meta) {
- meta = (drv.meta or { }) // t.meta;
- };
- in passMeta (runTests { inherit driver pos driverInteractive; });
+ test = lib.addMetaAttrs meta (runTests { inherit driver pos driverInteractive; });
in
test // {
- inherit test driver driverInteractive nodes;
+ inherit test driver driverInteractive;
+ inherit (driver) nodes;
};
abortForFunction = functionName: abort ''The ${functionName} function was
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index 71aaf7f253d9..2e088b977710 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -117,7 +117,7 @@ in
'';
};
- config = lib.mkIf (!config.system.disableInstallerTools) {
+ config = lib.mkIf (config.nix.enable && !config.system.disableInstallerTools) {
system.nixos-generate-config.configuration = mkDefault ''
# Edit this configuration file to define what should be installed on
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e80c6cf90f54..93172aa08246 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -777,6 +777,7 @@
./services/networking/headscale.nix
./services/networking/hostapd.nix
./services/networking/htpdate.nix
+ ./services/networking/https-dns-proxy.nix
./services/networking/hylafax/default.nix
./services/networking/i2pd.nix
./services/networking/i2p.nix
diff --git a/nixos/modules/services/logging/graylog.nix b/nixos/modules/services/logging/graylog.nix
index e6a23233ba28..28e2d18bf031 100644
--- a/nixos/modules/services/logging/graylog.nix
+++ b/nixos/modules/services/logging/graylog.nix
@@ -132,7 +132,7 @@ in
description = "Graylog server daemon user";
};
};
- users.groups = mkIf (cfg.user == "graylog") {};
+ users.groups = mkIf (cfg.user == "graylog") { graylog = {}; };
systemd.tmpfiles.rules = [
"d '${cfg.messageJournalDir}' - ${cfg.user} - - -"
diff --git a/nixos/modules/services/misc/nix-gc.nix b/nixos/modules/services/misc/nix-gc.nix
index a7a6a3b59644..b4b4b55a6c82 100644
--- a/nixos/modules/services/misc/nix-gc.nix
+++ b/nixos/modules/services/misc/nix-gc.nix
@@ -81,8 +81,14 @@ in
###### implementation
config = {
+ assertions = [
+ {
+ assertion = cfg.automatic -> config.nix.enable;
+ message = ''nix.gc.automatic requires nix.enable'';
+ }
+ ];
- systemd.services.nix-gc = {
+ systemd.services.nix-gc = lib.mkIf config.nix.enable {
description = "Nix Garbage Collector";
script = "exec ${config.nix.package.out}/bin/nix-collect-garbage ${cfg.options}";
startAt = optional cfg.automatic cfg.dates;
diff --git a/nixos/modules/services/misc/nix-optimise.nix b/nixos/modules/services/misc/nix-optimise.nix
index e02026d5f76c..acf8177b146a 100644
--- a/nixos/modules/services/misc/nix-optimise.nix
+++ b/nixos/modules/services/misc/nix-optimise.nix
@@ -37,8 +37,14 @@ in
###### implementation
config = {
+ assertions = [
+ {
+ assertion = cfg.automatic -> config.nix.enable;
+ message = ''nix.optimise.automatic requires nix.enable'';
+ }
+ ];
- systemd.services.nix-optimise =
+ systemd.services.nix-optimise = lib.mkIf config.nix.enable
{ description = "Nix Store Optimiser";
# No point this if the nix daemon (and thus the nix store) is outside
unitConfig.ConditionPathIsReadWrite = "/nix/var/nix/daemon-socket";
diff --git a/nixos/modules/services/network-filesystems/ipfs.nix b/nixos/modules/services/network-filesystems/ipfs.nix
index 655785b99d87..7e96179b3cab 100644
--- a/nixos/modules/services/network-filesystems/ipfs.nix
+++ b/nixos/modules/services/network-filesystems/ipfs.nix
@@ -1,16 +1,17 @@
-{ config, lib, pkgs, options, ... }:
+{ config, lib, pkgs, options, utils, ... }:
with lib;
let
cfg = config.services.ipfs;
opt = options.services.ipfs;
- ipfsFlags = toString ([
- (optionalString cfg.autoMount "--mount")
- (optionalString cfg.enableGC "--enable-gc")
- (optionalString (cfg.serviceFdlimit != null) "--manage-fdlimit=false")
- (optionalString (cfg.defaultMode == "offline") "--offline")
- (optionalString (cfg.defaultMode == "norouting") "--routing=none")
- ] ++ cfg.extraFlags);
+ ipfsFlags = utils.escapeSystemdExecArgs (
+ optional cfg.autoMount "--mount" ++
+ optional cfg.enableGC "--enable-gc" ++
+ optional (cfg.serviceFdlimit != null) "--manage-fdlimit=false" ++
+ optional (cfg.defaultMode == "offline") "--offline" ++
+ optional (cfg.defaultMode == "norouting") "--routing=none" ++
+ cfg.extraFlags
+ );
profile =
if cfg.localDiscovery
diff --git a/nixos/modules/services/networking/https-dns-proxy.nix b/nixos/modules/services/networking/https-dns-proxy.nix
new file mode 100644
index 000000000000..85d6c362b466
--- /dev/null
+++ b/nixos/modules/services/networking/https-dns-proxy.nix
@@ -0,0 +1,128 @@
+{ config, lib, pkgs, ... }:
+
+let
+ inherit (lib)
+ concatStringsSep
+ mkEnableOption mkIf mkOption types;
+
+ cfg = config.services.https-dns-proxy;
+
+ providers = {
+ cloudflare = {
+ ips = [ "1.1.1.1" "1.0.0.1" ];
+ url = "https://cloudflare-dns.com/dns-query";
+ };
+ google = {
+ ips = [ "8.8.8.8" "8.8.4.4" ];
+ url = "https://dns.google/dns-query";
+ };
+ quad9 = {
+ ips = [ "9.9.9.9" "149.112.112.112" ];
+ url = "https://dns.quad9.net/dns-query";
+ };
+ };
+
+ defaultProvider = "quad9";
+
+ providerCfg =
+ let
+ isCustom = cfg.provider.kind == "custom";
+ in
+ lib.concatStringsSep " " [
+ "-b"
+ (concatStringsSep "," (if isCustom then cfg.provider.ips else providers."${cfg.provider.kind}".ips))
+ "-r"
+ (if isCustom then cfg.provider.url else providers."${cfg.provider.kind}".url)
+ ];
+
+in
+{
+ meta.maintainers = with lib.maintainers; [ peterhoeg ];
+
+ ###### interface
+
+ options.services.https-dns-proxy = {
+ enable = mkEnableOption "https-dns-proxy daemon";
+
+ address = mkOption {
+ description = "The address on which to listen";
+ type = types.str;
+ default = "127.0.0.1";
+ };
+
+ port = mkOption {
+ description = "The port on which to listen";
+ type = types.port;
+ default = 5053;
+ };
+
+ provider = {
+ kind = mkOption {
+ description = ''
+ The upstream provider to use or custom in case you do not trust any of
+ the predefined providers or just want to use your own.
+
+ The default is ${defaultProvider} and there are privacy and security trade-offs
+ when using any upstream provider. Please consider that before using any
+ of them.
+
+ If you pick a custom provider, you will need to provide the bootstrap
+ IP addresses as well as the resolver https URL.
+ '';
+ type = types.enum ((builtins.attrNames providers) ++ [ "custom" ]);
+ default = defaultProvider;
+ };
+
+ ips = mkOption {
+ description = "The custom provider IPs";
+ type = types.listOf types.str;
+ };
+
+ url = mkOption {
+ description = "The custom provider URL";
+ type = types.str;
+ };
+ };
+
+ preferIPv4 = mkOption {
+ description = ''
+ https_dns_proxy will by default use IPv6 and fail if it is not available.
+ To play it safe, we choose IPv4.
+ '';
+ type = types.bool;
+ default = true;
+ };
+
+ extraArgs = mkOption {
+ description = "Additional arguments to pass to the process.";
+ type = types.listOf types.str;
+ default = [ "-v" ];
+ };
+ };
+
+ ###### implementation
+
+ config = lib.mkIf cfg.enable {
+ systemd.services.https-dns-proxy = {
+ description = "DNS to DNS over HTTPS (DoH) proxy";
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+ serviceConfig = rec {
+ Type = "exec";
+ DynamicUser = true;
+ ExecStart = lib.concatStringsSep " " (
+ [
+ "${pkgs.https-dns-proxy}/bin/https_dns_proxy"
+ "-a ${toString cfg.address}"
+ "-p ${toString cfg.port}"
+ "-l -"
+ providerCfg
+ ]
+ ++ lib.optional cfg.preferIPv4 "-4"
+ ++ cfg.extraArgs
+ );
+ Restart = "on-failure";
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/system/earlyoom.nix b/nixos/modules/services/system/earlyoom.nix
index ddd5bcebcdd5..629358559890 100644
--- a/nixos/modules/services/system/earlyoom.nix
+++ b/nixos/modules/services/system/earlyoom.nix
@@ -5,8 +5,8 @@ let
inherit (lib)
mkDefault mkEnableOption mkIf mkOption types
- mkRemovedOptionModule
- concatStringsSep optional;
+ mkRemovedOptionModule literalExpression
+ escapeShellArg concatStringsSep optional optionalString;
in
{
@@ -17,10 +17,26 @@ in
type = types.ints.between 1 100;
default = 10;
description = ''
- Minimum of availabe memory (in percent).
- If the free memory falls below this threshold and the analog is true for
-
- the killing begins.
+ Minimum available memory (in percent).
+
+ If the available memory falls below this threshold (and the analog is true for
+ ) the killing begins.
+ SIGTERM is sent first to the process that uses the most memory; then, if the available
+ memory falls below (and the analog is true for
+ ), SIGKILL is sent.
+
+ See README for details.
+ '';
+ };
+
+ freeMemKillThreshold = mkOption {
+ type = types.nullOr (types.ints.between 1 100);
+ default = null;
+ description = ''
+ Minimum available memory (in percent) before sending SIGKILL.
+ If unset, this defaults to half of .
+
+ See the description of .
'';
};
@@ -28,19 +44,20 @@ in
type = types.ints.between 1 100;
default = 10;
description = ''
- Minimum of availabe swap space (in percent).
- If the available swap space falls below this threshold and the analog
- is true for
- the killing begins.
+ Minimum free swap space (in percent) before sending SIGTERM.
+
+ See the description of .
'';
};
- # TODO: remove or warn after 1.7 (https://github.com/rfjakob/earlyoom/commit/7ebc4554)
- ignoreOOMScoreAdjust = mkOption {
- type = types.bool;
- default = false;
+ freeSwapKillThreshold = mkOption {
+ type = types.nullOr (types.ints.between 1 100);
+ default = null;
description = ''
- Ignore oom_score_adjust values of processes.
+ Minimum free swap space (in percent) before sending SIGKILL.
+ If unset, this defaults to half of .
+
+ See the description of .
'';
};
@@ -63,12 +80,43 @@ in
local user to DoS your session by spamming notifications.
To actually see the notifications in your GUI session, you need to have
- systembus-notify running as your user which this
- option handles.
+ systembus-notify running as your user, which this
+ option handles by enabling .
See README for details.
'';
};
+
+ killHook = mkOption {
+ type = types.nullOr types.path;
+ default = null;
+ example = literalExpression ''
+ pkgs.writeShellScript "earlyoom-kill-hook" '''
+ echo "Process $EARLYOOM_NAME ($EARLYOOM_PID) was killed" >> /path/to/log
+ '''
+ '';
+ description = ''
+ An absolute path to an executable to be run for each process killed.
+ Some environment variables are available, see
+ README and
+ the man page
+ for details.
+ '';
+ };
+
+ reportInterval = mkOption {
+ type = types.int;
+ default = 3600;
+ example = 0;
+ description = "Interval (in seconds) at which a memory report is printed (set to 0 to disable).";
+ };
+
+ extraArgs = mkOption {
+ type = types.listOf types.str;
+ default = [];
+ example = [ "-g" "--prefer '(^|/)(java|chromium)$'" ];
+ description = "Extra command-line arguments to be passed to earlyoom.";
+ };
};
imports = [
@@ -76,7 +124,11 @@ in
This option is deprecated and ignored by earlyoom since 1.2.
'')
(mkRemovedOptionModule [ "services" "earlyoom" "notificationsCommand" ] ''
- This option is deprecated and ignored by earlyoom since 1.6.
+ This option was removed in earlyoom 1.6, but was reimplemented in 1.7
+ and is available as the new option `services.earlyoom.killHook`.
+ '')
+ (mkRemovedOptionModule [ "services" "earlyoom" "ignoreOOMScoreAdjust" ] ''
+ This option is deprecated and ignored by earlyoom since 1.7.
'')
];
@@ -91,12 +143,16 @@ in
StandardError = "journal";
ExecStart = concatStringsSep " " ([
"${pkgs.earlyoom}/bin/earlyoom"
- "-m ${toString cfg.freeMemThreshold}"
- "-s ${toString cfg.freeSwapThreshold}"
+ ("-m ${toString cfg.freeMemThreshold}"
+ + optionalString (cfg.freeMemKillThreshold != null) ",${toString cfg.freeMemKillThreshold}")
+ ("-s ${toString cfg.freeSwapThreshold}"
+ + optionalString (cfg.freeSwapKillThreshold != null) ",${toString cfg.freeSwapKillThreshold}")
+ "-r ${toString cfg.reportInterval}"
]
- ++ optional cfg.ignoreOOMScoreAdjust "-i"
++ optional cfg.enableDebugInfo "-d"
++ optional cfg.enableNotifications "-n"
+ ++ optional (cfg.killHook != null) "-N ${escapeShellArg cfg.killHook}"
+ ++ cfg.extraArgs
);
};
};
diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 19f2be2c4a25..b0f160c1dbf9 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -535,6 +535,7 @@ let
createGreDevice = n: v: nameValuePair "${n}-netdev"
(let
deps = deviceDependency v.dev;
+ ttlarg = if lib.hasPrefix "ip6" v.type then "hoplimit" else "ttl";
in
{ description = "GRE Tunnel Interface ${n}";
wantedBy = [ "network-setup.service" (subsystemDevice n) ];
@@ -551,6 +552,7 @@ let
ip link add name "${n}" type ${v.type} \
${optionalString (v.remote != null) "remote \"${v.remote}\""} \
${optionalString (v.local != null) "local \"${v.local}\""} \
+ ${optionalString (v.ttl != null) "${ttlarg} ${toString v.ttl}"} \
${optionalString (v.dev != null) "dev \"${v.dev}\""}
ip link set "${n}" up
'';
diff --git a/nixos/modules/tasks/network-interfaces-systemd.nix b/nixos/modules/tasks/network-interfaces-systemd.nix
index 8a5e1b5af114..8654539b6629 100644
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@@ -318,6 +318,8 @@ in
Remote = gre.remote;
}) // (optionalAttrs (gre.local != null) {
Local = gre.local;
+ }) // (optionalAttrs (gre.ttl != null) {
+ TTL = gre.ttl;
});
};
networks = mkIf (gre.dev != null) {
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 01980b80f1cf..60b5a48b2e62 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1020,12 +1020,14 @@ in
local = "10.0.0.22";
dev = "enp4s0f0";
type = "tap";
+ ttl = 255;
};
gre6Tunnel = {
remote = "fd7a:5634::1";
local = "fd7a:5634::2";
dev = "enp4s0f0";
type = "tun6";
+ ttl = 255;
};
}
'';
@@ -1063,6 +1065,15 @@ in
'';
};
+ ttl = mkOption {
+ type = types.nullOr types.int;
+ default = null;
+ example = 255;
+ description = ''
+ The time-to-live/hoplimit of the connection to the remote tunnel endpoint.
+ '';
+ };
+
type = mkOption {
type = with types; enum [ "tun" "tap" "tun6" "tap6" ];
default = "tap";
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 514389358947..dacbb64a2dac 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -796,7 +796,7 @@ in
# allow `system.build.toplevel' to be included. (If we had a direct
# reference to ${regInfo} here, then we would get a cyclic
# dependency.)
- boot.postBootCommands =
+ boot.postBootCommands = lib.mkIf config.nix.enable
''
if [[ "$(cat /proc/cmdline)" =~ regInfo=([^ ]*) ]]; then
${config.nix.package.out}/bin/nix-store --load-db < ''${BASH_REMATCH[1]}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 8d54f78a9481..47587b1b30c0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -132,6 +132,7 @@ in
domination = handleTest ./domination.nix {};
dovecot = handleTest ./dovecot.nix {};
drbd = handleTest ./drbd.nix {};
+ earlyoom = handleTestOn ["x86_64-linux"] ./earlyoom.nix {};
ec2-config = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-config or {};
ec2-nixops = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-nixops or {};
ecryptfs = handleTest ./ecryptfs.nix {};
diff --git a/nixos/tests/boot.nix b/nixos/tests/boot.nix
index cf5565667131..ec2a9f6527c9 100644
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -38,7 +38,6 @@ let
} // extraConfig);
in
makeTest {
- inherit iso;
name = "boot-" + name;
nodes = { };
testScript =
diff --git a/nixos/tests/caddy.nix b/nixos/tests/caddy.nix
index 0902904b2086..16436ab52800 100644
--- a/nixos/tests/caddy.nix
+++ b/nixos/tests/caddy.nix
@@ -7,7 +7,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
nodes = {
webserver = { pkgs, lib, ... }: {
services.caddy.enable = true;
- services.caddy.config = ''
+ services.caddy.extraConfig = ''
http://localhost {
encode gzip
@@ -22,7 +22,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
'';
specialisation.etag.configuration = {
- services.caddy.config = lib.mkForce ''
+ services.caddy.extraConfig = lib.mkForce ''
http://localhost {
encode gzip
@@ -38,7 +38,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
};
specialisation.config-reload.configuration = {
- services.caddy.config = ''
+ services.caddy.extraConfig = ''
http://localhost:8080 {
}
'';
diff --git a/nixos/tests/ceph-multi-node.nix b/nixos/tests/ceph-multi-node.nix
index 29e7c279d69a..556546beee76 100644
--- a/nixos/tests/ceph-multi-node.nix
+++ b/nixos/tests/ceph-multi-node.nix
@@ -48,7 +48,7 @@ let
sudo
ceph
xfsprogs
- netcat-openbsd
+ libressl.nc
];
boot.kernelModules = [ "xfs" ];
diff --git a/nixos/tests/chromium.nix b/nixos/tests/chromium.nix
index 8965646bc5dc..3815dca76220 100644
--- a/nixos/tests/chromium.nix
+++ b/nixos/tests/chromium.nix
@@ -15,26 +15,9 @@
with import ../lib/testing-python.nix { inherit system pkgs; };
with pkgs.lib;
-mapAttrs (channel: chromiumPkg: makeTest rec {
- name = "chromium-${channel}";
- meta = {
- maintainers = with maintainers; [ aszlig primeos ];
- # https://github.com/NixOS/hydra/issues/591#issuecomment-435125621
- inherit (chromiumPkg.meta) timeout;
- };
-
- enableOCR = true;
-
+let
user = "alice";
- machine.imports = [ ./common/user-account.nix ./common/x11.nix ];
- machine.virtualisation.memorySize = 2047;
- machine.test-support.displayManager.auto.user = user;
- machine.environment = {
- systemPackages = [ chromiumPkg ];
- variables."XAUTHORITY" = "/home/alice/.Xauthority";
- };
-
startupHTML = pkgs.writeText "chromium-startup.html" ''
@@ -50,6 +33,25 @@ mapAttrs (channel: chromiumPkg: makeTest rec {