Merge remote-tracking branch 'origin/master' into staging-next
This commit is contained in:
@@ -68,7 +68,7 @@ let
|
||||
# Ensure a consistent umask.
|
||||
umask 0022
|
||||
|
||||
${textClosureMap id (withDrySnippets) (attrNames withDrySnippets)}
|
||||
${textClosureMap id withDrySnippets (attrNames withDrySnippets)}
|
||||
|
||||
''
|
||||
+ optionalString (!onlyDry) ''
|
||||
@@ -220,7 +220,7 @@ in
|
||||
set' = mapAttrs (n: v: if isString v then noDepEntry v else v) set;
|
||||
withHeadlines = addAttributeName set';
|
||||
in
|
||||
textClosureMap id (withHeadlines) (attrNames withHeadlines)
|
||||
textClosureMap id withHeadlines (attrNames withHeadlines)
|
||||
}
|
||||
|
||||
exit $_status
|
||||
|
||||
@@ -403,14 +403,14 @@ in
|
||||
);
|
||||
|
||||
systemd = lib.mkMerge [
|
||||
({
|
||||
{
|
||||
tmpfiles.rules = [
|
||||
"d /run/binfmt 0755 -"
|
||||
]
|
||||
++ lib.mapAttrsToList (name: interpreter: "L+ /run/binfmt/${name} - - - - ${interpreter}") (
|
||||
lib.mapAttrs mkInterpreter config.boot.binfmt.registrations
|
||||
);
|
||||
})
|
||||
}
|
||||
|
||||
(lib.mkIf (config.boot.binfmt.registrations != { }) {
|
||||
additionalUpstreamSystemUnits = [
|
||||
|
||||
@@ -28,12 +28,12 @@ in
|
||||
description = "Encrypted devices that need to be unlocked at boot using Clevis";
|
||||
default = { };
|
||||
type = lib.types.attrsOf (
|
||||
lib.types.submodule ({
|
||||
lib.types.submodule {
|
||||
options.secretFile = lib.mkOption {
|
||||
description = "Clevis JWE file used to decrypt the device at boot, in concert with the chosen pin (one of TPM2, Tang server, or SSS).";
|
||||
type = lib.types.path;
|
||||
};
|
||||
})
|
||||
}
|
||||
);
|
||||
};
|
||||
|
||||
|
||||
@@ -1249,7 +1249,7 @@ in
|
||||
devicesWithClevis = filterAttrs (device: _: (hasAttr device clevis.devices)) luks.devices;
|
||||
in
|
||||
mkIf (clevis.enable && systemd.enable) (
|
||||
(mapAttrs' (
|
||||
mapAttrs' (
|
||||
name: _:
|
||||
nameValuePair "cryptsetup-clevis-${name}" {
|
||||
wantedBy = [ "systemd-cryptsetup@${utils.escapeSystemdPath name}.service" ];
|
||||
@@ -1281,7 +1281,7 @@ in
|
||||
ExecStop = "${config.boot.initrd.systemd.package.util-linux}/bin/umount /clevis-${name}";
|
||||
};
|
||||
}
|
||||
) devicesWithClevis)
|
||||
) devicesWithClevis
|
||||
);
|
||||
|
||||
environment.systemPackages = [ pkgs.cryptsetup ];
|
||||
|
||||
@@ -746,14 +746,14 @@ let
|
||||
"both"
|
||||
"any"
|
||||
])
|
||||
(assertValueOneOf "ActivationPolicy" ([
|
||||
(assertValueOneOf "ActivationPolicy" [
|
||||
"up"
|
||||
"always-up"
|
||||
"manual"
|
||||
"always-down"
|
||||
"down"
|
||||
"bound"
|
||||
]))
|
||||
])
|
||||
];
|
||||
|
||||
sectionNetwork = checkUnitConfig "Network" [
|
||||
|
||||
@@ -5,8 +5,6 @@
|
||||
...
|
||||
}:
|
||||
|
||||
with lib;
|
||||
|
||||
{
|
||||
|
||||
# This unit saves the value of the system clock to the hardware
|
||||
|
||||
@@ -595,7 +595,7 @@ in
|
||||
enabledUnits = filterAttrs (n: v: !elem n cfg.suppressedSystemUnits) cfg.units;
|
||||
|
||||
in
|
||||
({
|
||||
{
|
||||
"systemd/system".source = generateUnits {
|
||||
type = "system";
|
||||
units = enabledUnits;
|
||||
@@ -628,7 +628,7 @@ in
|
||||
"systemd/user-preset/00-nixos.preset".text = ''
|
||||
ignore *
|
||||
'';
|
||||
});
|
||||
};
|
||||
|
||||
services.dbus.enable = true;
|
||||
|
||||
|
||||
@@ -183,9 +183,9 @@ in
|
||||
};
|
||||
|
||||
environment.etc = lib.mkMerge [
|
||||
({
|
||||
{
|
||||
"sysusers.d".source = sysusersConfig;
|
||||
})
|
||||
}
|
||||
|
||||
# Statically create the symlinks to immutablePasswordFilesLocation when
|
||||
# using an immutable /etc because we will not be able to do it at
|
||||
|
||||
Reference in New Issue
Block a user