gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/*: convert options with listings

Browse Source 
minor rendering changes.
This commit is contained in:
pennae
2022-08-30 14:08:50 +02:00
parent 722b99bc0e
commit f2ea09ecbe
32 changed files with 192 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
nixos/modules/hardware/tuxedo-keyboard.nix
View File

@@ -8,23 +8,23 @@ let
in in
{ {
options.hardware.tuxedo-keyboard = { options.hardware.tuxedo-keyboard = {
enable = mkEnableOption '' enable = mkEnableOption (lib.mdDoc ''
Enables the tuxedo-keyboard driver. Enables the tuxedo-keyboard driver.
To configure the driver, pass the options to the <option>boot.kernelParams</option> configuration. To configure the driver, pass the options to the {option}`boot.kernelParams` configuration.
There are several parameters you can change. It's best to check at the source code description which options are supported. There are several parameters you can change. It's best to check at the source code description which options are supported.
You can find all the supported parameters at: <link xlink:href="https://github.com/tuxedocomputers/tuxedo-keyboard#kernelparam"/> You can find all the supported parameters at: <https://github.com/tuxedocomputers/tuxedo-keyboard#kernelparam>
In order to use the <literal>custom</literal> lighting with the maximumg brightness and a color of <literal>0xff0a0a</literal> one would put pass <option>boot.kernelParams</option> like this: In order to use the `custom` lighting with the maximumg brightness and a color of `0xff0a0a` one would put pass {option}`boot.kernelParams` like this:
<programlisting> ```
boot.kernelParams = [ boot.kernelParams = [
"tuxedo_keyboard.mode=0" "tuxedo_keyboard.mode=0"
"tuxedo_keyboard.brightness=255" "tuxedo_keyboard.brightness=255"
"tuxedo_keyboard.color_left=0xff0a0a" "tuxedo_keyboard.color_left=0xff0a0a"
]; ];
</programlisting> ```
''; '');
}; };
config = mkIf cfg.enable config = mkIf cfg.enable

24
nixos/modules/misc/label.nix
View File

@@ -12,7 +12,7 @@ in
nixos.label = mkOption { nixos.label = mkOption {
type = types.strMatching "[a-zA-Z0-9:_\\.-]*"; type = types.strMatching "[a-zA-Z0-9:_\\.-]*";
description = '' description = lib.mdDoc ''
NixOS version name to be used in the names of generated NixOS version name to be used in the names of generated
outputs and boot labels. outputs and boot labels.
@@ -20,26 +20,26 @@ in
this is the option for you. this is the option for you.
It can only contain letters, numbers and the following symbols: It can only contain letters, numbers and the following symbols:
<literal>:</literal>, <literal>_</literal>, <literal>.</literal> and <literal>-</literal>. `:`, `_`, `.` and `-`.
The default is <option>system.nixos.tags</option> separated by The default is {option}`system.nixos.tags` separated by
"-" + "-" + <envar>NIXOS_LABEL_VERSION</envar> environment "-" + "-" + {env}`NIXOS_LABEL_VERSION` environment
variable (defaults to the value of variable (defaults to the value of
<option>system.nixos.version</option>). {option}`system.nixos.version`).
Can be overriden by setting <envar>NIXOS_LABEL</envar>. Can be overriden by setting {env}`NIXOS_LABEL`.
Useful for not loosing track of configurations built from different Useful for not loosing track of configurations built from different
nixos branches/revisions, e.g.: nixos branches/revisions, e.g.:
<programlisting> ```
#!/bin/sh #!/bin/sh
today=`date +%Y%m%d` today=`date +%Y%m%d`
branch=`(cd nixpkgs ; git branch 2>/dev/null | sed -n '/^\* / { s|^\* ||; p; }')` branch=`(cd nixpkgs ; git branch 2>/dev/null | sed -n '/^\* / { s|^\* ||; p; }')`
revision=`(cd nixpkgs ; git rev-parse HEAD)` revision=`(cd nixpkgs ; git rev-parse HEAD)`
export NIXOS_LABEL_VERSION="$today.$branch-''${revision:0:7}" export NIXOS_LABEL_VERSION="$today.$branch-''${revision:0:7}"
nixos-rebuild switch nixos-rebuild switch
</programlisting> ```
''; '';
}; };
@@ -47,19 +47,19 @@ in
type = types.listOf types.str; type = types.listOf types.str;
default = []; default = [];
example = [ "with-xen" ]; example = [ "with-xen" ];
description = '' description = lib.mdDoc ''
Strings to prefix to the default Strings to prefix to the default
<option>system.nixos.label</option>. {option}`system.nixos.label`.
Useful for not loosing track of configurations built with Useful for not loosing track of configurations built with
different options, e.g.: different options, e.g.:
<programlisting> ```
{ {
system.nixos.tags = [ "with-xen" ]; system.nixos.tags = [ "with-xen" ];
virtualisation.xen.enable = true; virtualisation.xen.enable = true;
} }
</programlisting> ```
''; '';
}; };

18
nixos/modules/misc/nixpkgs.nix
View File

@@ -311,26 +311,26 @@ in
defaultText = lib.literalMD '' defaultText = lib.literalMD ''
Traditionally `builtins.currentSystem`, but unset when invoking NixOS through `lib.nixosSystem`. Traditionally `builtins.currentSystem`, but unset when invoking NixOS through `lib.nixosSystem`.
''; '';
description = '' description = lib.mdDoc ''
This option does not need to be specified for NixOS configurations This option does not need to be specified for NixOS configurations
with a recently generated <literal>hardware-configuration.nix</literal>. with a recently generated `hardware-configuration.nix`.
Specifies the Nix platform type on which NixOS should be built. Specifies the Nix platform type on which NixOS should be built.
It is better to specify <literal>nixpkgs.localSystem</literal> instead. It is better to specify `nixpkgs.localSystem` instead.
<programlisting> ```
{ {
nixpkgs.system = ..; nixpkgs.system = ..;
} }
</programlisting> ```
is the same as is the same as
<programlisting> ```
{ {
nixpkgs.localSystem.system = ..; nixpkgs.localSystem.system = ..;
} }
</programlisting> ```
See <literal>nixpkgs.localSystem</literal> for more information. See `nixpkgs.localSystem` for more information.
Ignored when <literal>nixpkgs.pkgs</literal>, <literal>nixpkgs.localSystem</literal> or <literal>nixpkgs.hostPlatform</literal> is set. Ignored when `nixpkgs.pkgs`, `nixpkgs.localSystem` or `nixpkgs.hostPlatform` is set.
''; '';
}; };
}; };

8
nixos/modules/services/backup/duplicity.nix
View File

@@ -54,15 +54,15 @@ in
secretFile = mkOption { secretFile = mkOption {
type = types.nullOr types.path; type = types.nullOr types.path;
default = null; default = null;
description = '' description = lib.mdDoc ''
Path of a file containing secrets (gpg passphrase, access key...) in Path of a file containing secrets (gpg passphrase, access key...) in
the format of EnvironmentFile as described by the format of EnvironmentFile as described by
<citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. For example: {manpage}`systemd.exec(5)`. For example:
<programlisting> ```
PASSPHRASE=«...» PASSPHRASE=«...»
AWS_ACCESS_KEY_ID=«...» AWS_ACCESS_KEY_ID=«...»
AWS_SECRET_ACCESS_KEY=«...» AWS_SECRET_ACCESS_KEY=«...»
</programlisting> ```
''; '';
}; };

6
nixos/modules/services/databases/cockroachdb.nix
View File

@@ -58,7 +58,7 @@ in
locality = mkOption { locality = mkOption {
type = types.nullOr types.str; type = types.nullOr types.str;
default = null; default = null;
description = '' description = lib.mdDoc ''
An ordered, comma-separated list of key-value pairs that describe the An ordered, comma-separated list of key-value pairs that describe the
topography of the machine. Topography might include country, topography of the machine. Topography might include country,
datacenter or rack designations. Data is automatically replicated to datacenter or rack designations. Data is automatically replicated to
@@ -68,12 +68,12 @@ in
like datacenter. The tiers and order must be the same on all nodes. like datacenter. The tiers and order must be the same on all nodes.
Including more tiers is better than including fewer. For example: Including more tiers is better than including fewer. For example:
<programlisting> ```
country=us,region=us-west,datacenter=us-west-1b,rack=12 country=us,region=us-west,datacenter=us-west-1b,rack=12
country=ca,region=ca-east,datacenter=ca-east-2,rack=4 country=ca,region=ca-east,datacenter=ca-east-2,rack=4
planet=earth,province=manitoba,colo=secondary,power=3 planet=earth,province=manitoba,colo=secondary,power=3
</programlisting> ```
''; '';
}; };

10
nixos/modules/services/development/zammad.nix
View File

@@ -149,20 +149,20 @@ in
type = types.nullOr types.path; type = types.nullOr types.path;
default = null; default = null;
example = "/run/keys/secret_key_base"; example = "/run/keys/secret_key_base";
description = '' description = lib.mdDoc ''
The path to a file containing the The path to a file containing the
<literal>secret_key_base</literal> secret. `secret_key_base` secret.
Zammad uses <literal>secret_key_base</literal> to encrypt Zammad uses `secret_key_base` to encrypt
the cookie store, which contains session data, and to digest the cookie store, which contains session data, and to digest
user auth tokens. user auth tokens.
Needs to be a 64 byte long string of hexadecimal Needs to be a 64 byte long string of hexadecimal
characters. You can generate one by running characters. You can generate one by running
<programlisting> ```
openssl rand -hex 64 >/path/to/secret_key_base_file openssl rand -hex 64 >/path/to/secret_key_base_file
</programlisting> ```
This should be a string, not a nix path, since nix paths are This should be a string, not a nix path, since nix paths are
copied into the world-readable nix store. copied into the world-readable nix store.

12
nixos/modules/services/hardware/lcd.nix
View File

@@ -61,20 +61,20 @@ in with lib; {
usbPermissions = mkOption { usbPermissions = mkOption {
type = bool; type = bool;
default = false; default = false;
description = '' description = lib.mdDoc ''
Set group-write permissions on a USB device. Set group-write permissions on a USB device.
A USB connected LCD panel will most likely require having its A USB connected LCD panel will most likely require having its
permissions modified for lcdd to write to it. Enabling this option permissions modified for lcdd to write to it. Enabling this option
sets group-write permissions on the device identified by sets group-write permissions on the device identified by
<option>services.hardware.lcd.usbVid</option> and {option}`services.hardware.lcd.usbVid` and
<option>services.hardware.lcd.usbPid</option>. In order to find the {option}`services.hardware.lcd.usbPid`. In order to find the
values, you can run the <command>lsusb</command> command. Example values, you can run the {command}`lsusb` command. Example
output: output:
<programlisting> ```
Bus 005 Device 002: ID 0403:c630 Future Technology Devices International, Ltd lcd2usb interface Bus 005 Device 002: ID 0403:c630 Future Technology Devices International, Ltd lcd2usb interface
</programlisting> ```
In this case the vendor id is 0403 and the product id is c630. In this case the vendor id is 0403 and the product id is c630.
''; '';

12
nixos/modules/services/logging/awstats.nix
View File

@@ -25,26 +25,26 @@ let
logFile = mkOption { logFile = mkOption {
type = types.str; type = types.str;
example = "/var/log/nginx/access.log"; example = "/var/log/nginx/access.log";
description = '' description = lib.mdDoc ''
The log file to be scanned. The log file to be scanned.
For mail, set this to For mail, set this to
<programlisting> ```
journalctl $OLD_CURSOR -u postfix.service | ''${pkgs.perl}/bin/perl ''${pkgs.awstats.out}/share/awstats/tools/maillogconvert.pl standard | journalctl $OLD_CURSOR -u postfix.service | ''${pkgs.perl}/bin/perl ''${pkgs.awstats.out}/share/awstats/tools/maillogconvert.pl standard |
</programlisting> ```
''; '';
}; };
logFormat = mkOption { logFormat = mkOption {
type = types.str; type = types.str;
default = "1"; default = "1";
description = '' description = lib.mdDoc ''
The log format being used. The log format being used.
For mail, set this to For mail, set this to
<programlisting> ```
%time2 %email %email_r %host %host_r %method %url %code %bytesd %time2 %email %email_r %host %host_r %method %url %code %bytesd
</programlisting> ```
''; '';
}; };

14
nixos/modules/services/matrix/dendrite.nix
View File

@@ -50,26 +50,26 @@ in
type = lib.types.nullOr lib.types.path; type = lib.types.nullOr lib.types.path;
example = "/var/lib/dendrite/registration_secret"; example = "/var/lib/dendrite/registration_secret";
default = null; default = null;
description = '' description = lib.mdDoc ''
Environment file as defined in <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. Environment file as defined in {manpage}`systemd.exec(5)`.
Secrets may be passed to the service without adding them to the world-readable Secrets may be passed to the service without adding them to the world-readable
Nix store, by specifying placeholder variables as the option value in Nix and Nix store, by specifying placeholder variables as the option value in Nix and
setting these variables accordingly in the environment file. Currently only used setting these variables accordingly in the environment file. Currently only used
for the registration secret to allow secure registration when for the registration secret to allow secure registration when
client_api.registration_disabled is true. client_api.registration_disabled is true.
<programlisting> ```
# snippet of dendrite-related config # snippet of dendrite-related config
services.dendrite.settings.client_api.registration_shared_secret = "$REGISTRATION_SHARED_SECRET"; services.dendrite.settings.client_api.registration_shared_secret = "$REGISTRATION_SHARED_SECRET";
</programlisting> ```
<programlisting> ```
# content of the environment file # content of the environment file
REGISTRATION_SHARED_SECRET=verysecretpassword REGISTRATION_SHARED_SECRET=verysecretpassword
</programlisting> ```
Note that this file needs to be available on the host on which Note that this file needs to be available on the host on which
<literal>dendrite</literal> is running. `dendrite` is running.
''; '';
}; };
loadCredential = lib.mkOption { loadCredential = lib.mkOption {

8
nixos/modules/services/misc/gitit.nix
View File

@@ -348,14 +348,14 @@ let
mimeTypesFile = mkOption { mimeTypesFile = mkOption {
type = types.path; type = types.path;
default = "/etc/mime/types.info"; default = "/etc/mime/types.info";
description = '' description = lib.mdDoc ''
Specifies the path of a file containing mime type mappings. Each Specifies the path of a file containing mime type mappings. Each
line of the file should contain two fields, separated by whitespace. line of the file should contain two fields, separated by whitespace.
The first field is the mime type, the second is a file extension. The first field is the mime type, the second is a file extension.
For example: For example:
<programlisting> ```
video/x-ms-wmx wmx video/x-ms-wmx wmx
</programlisting> ```
If the file is not found, some simple defaults will be used. If the file is not found, some simple defaults will be used.
''; '';
}; };

14
nixos/modules/services/misc/sssd.nix
View File

@@ -54,25 +54,23 @@ in {
environmentFile = mkOption { environmentFile = mkOption {
type = types.nullOr types.path; type = types.nullOr types.path;
default = null; default = null;
description = '' description = lib.mdDoc ''
Environment file as defined in <citerefentry> Environment file as defined in {manpage}`systemd.exec(5)`.
<refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
</citerefentry>.
Secrets may be passed to the service without adding them to the world-readable Secrets may be passed to the service without adding them to the world-readable
Nix store, by specifying placeholder variables as the option value in Nix and Nix store, by specifying placeholder variables as the option value in Nix and
setting these variables accordingly in the environment file. setting these variables accordingly in the environment file.
<programlisting> ```
# snippet of sssd-related config # snippet of sssd-related config
[domain/LDAP] [domain/LDAP]
ldap_default_authtok = $SSSD_LDAP_DEFAULT_AUTHTOK ldap_default_authtok = $SSSD_LDAP_DEFAULT_AUTHTOK
</programlisting> ```
<programlisting> ```
# contents of the environment file # contents of the environment file
SSSD_LDAP_DEFAULT_AUTHTOK=verysecretpassword SSSD_LDAP_DEFAULT_AUTHTOK=verysecretpassword
</programlisting> ```
''; '';
}; };
}; };

10
nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix
View File

@@ -19,19 +19,19 @@ in
type = types.path; type = types.path;
default = "/var/run/dovecot/stats"; default = "/var/run/dovecot/stats";
example = "/var/run/dovecot2/old-stats"; example = "/var/run/dovecot2/old-stats";
description = '' description = lib.mdDoc ''
Path under which the stats socket is placed. Path under which the stats socket is placed.
The user/group under which the exporter runs, The user/group under which the exporter runs,
should be able to access the socket in order should be able to access the socket in order
to scrape the metrics successfully. to scrape the metrics successfully.
Please keep in mind that the stats module has changed in Please keep in mind that the stats module has changed in
<link xlink:href="https://wiki2.dovecot.org/Upgrading/2.3">Dovecot 2.3+</link> which [Dovecot 2.3+](https://wiki2.dovecot.org/Upgrading/2.3) which
is not <link xlink:href="https://github.com/kumina/dovecot_exporter/issues/8">compatible with this exporter</link>. is not [compatible with this exporter](https://github.com/kumina/dovecot_exporter/issues/8).
The following extra config has to be passed to Dovecot to ensure that recent versions The following extra config has to be passed to Dovecot to ensure that recent versions
work with this exporter: work with this exporter:
<programlisting> ```
{ {
services.prometheus.exporters.dovecot.enable = true; services.prometheus.exporters.dovecot.enable = true;
services.prometheus.exporters.dovecot.socketPath = "/var/run/dovecot2/old-stats"; services.prometheus.exporters.dovecot.socketPath = "/var/run/dovecot2/old-stats";
@@ -60,7 +60,7 @@ in
} }
'''; ''';
} }
</programlisting> ```
''; '';
}; };
scopes = mkOption { scopes = mkOption {

8
nixos/modules/services/monitoring/prometheus/exporters/mail.nix
View File

@@ -112,14 +112,14 @@ let
detectionDir = "/path/to/Maildir/new"; detectionDir = "/path/to/Maildir/new";
} ] } ]
''; '';
description = '' description = lib.mdDoc ''
List of servers that should be probed. List of servers that should be probed.
<emphasis>Note:</emphasis> if your mailserver has <citerefentry><refentrytitle>rspamd</refentrytitle><manvolnum>8</manvolnum></citerefentry> configured, *Note:* if your mailserver has {manpage}`rspamd(8)` configured,
it can happen that emails from this exporter are marked as spam. it can happen that emails from this exporter are marked as spam.
It's possible to work around the issue with a config like this: It's possible to work around the issue with a config like this:
<programlisting> ```
{ {
services.rspamd.locals."multimap.conf".text = ''' services.rspamd.locals."multimap.conf".text = '''
ALLOWLIST_PROMETHEUS { ALLOWLIST_PROMETHEUS {
@@ -130,7 +130,7 @@ let
} }
'''; ''';
} }
</programlisting> ```
''; '';
}; };
}; };

8
nixos/modules/services/monitoring/prometheus/exporters/openldap.nix
View File

@@ -10,16 +10,16 @@ in {
ldapCredentialFile = mkOption { ldapCredentialFile = mkOption {
type = types.path; type = types.path;
example = "/run/keys/ldap_pass"; example = "/run/keys/ldap_pass";
description = '' description = lib.mdDoc ''
Environment file to contain the credentials to authenticate against Environment file to contain the credentials to authenticate against
<literal>openldap</literal>. `openldap`.
The file should look like this: The file should look like this:
<programlisting> ```
--- ---
ldapUser: "cn=monitoring,cn=Monitor" ldapUser: "cn=monitoring,cn=Monitor"
ldapPass: "secret" ldapPass: "secret"
</programlisting> ```
''; '';
}; };
protocol = mkOption { protocol = mkOption {

10
nixos/modules/services/monitoring/prometheus/exporters/postgres.nix
View File

@@ -36,8 +36,8 @@ in
type = types.nullOr types.path; type = types.nullOr types.path;
default = null; default = null;
example = "/root/prometheus-postgres-exporter.env"; example = "/root/prometheus-postgres-exporter.env";
description = '' description = lib.mdDoc ''
Environment file as defined in <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. Environment file as defined in {manpage}`systemd.exec(5)`.
Secrets may be passed to the service without adding them to the Secrets may be passed to the service without adding them to the
world-readable Nix store, by specifying placeholder variables as world-readable Nix store, by specifying placeholder variables as
@@ -46,7 +46,7 @@ in
Environment variables from this file will be interpolated into the Environment variables from this file will be interpolated into the
config file using envsubst with this syntax: config file using envsubst with this syntax:
<literal>$ENVIRONMENT ''${VARIABLE}</literal> `$ENVIRONMENT ''${VARIABLE}`
The main use is to set the DATA_SOURCE_NAME that contains the The main use is to set the DATA_SOURCE_NAME that contains the
postgres password postgres password
@@ -54,10 +54,10 @@ in
note that contents from this file will override dataSourceName note that contents from this file will override dataSourceName
if you have set it from nix. if you have set it from nix.
<programlisting> ```
# Content of the environment file # Content of the environment file
DATA_SOURCE_NAME=postgresql://username:password@localhost:5432/postgres?sslmode=disable DATA_SOURCE_NAME=postgresql://username:password@localhost:5432/postgres?sslmode=disable
</programlisting> ```
Note that this file needs to be available on the host on which Note that this file needs to be available on the host on which
this exporter is running. this exporter is running.

8
nixos/modules/services/network-filesystems/litestream/default.nix
View File

@@ -40,8 +40,8 @@ in
type = types.nullOr types.path; type = types.nullOr types.path;
default = null; default = null;
example = "/run/secrets/litestream"; example = "/run/secrets/litestream";
description = '' description = lib.mdDoc ''
Environment file as defined in <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. Environment file as defined in {manpage}`systemd.exec(5)`.
Secrets may be passed to the service without adding them to the Secrets may be passed to the service without adding them to the
world-readable Nix store, by specifying placeholder variables as world-readable Nix store, by specifying placeholder variables as
@@ -54,11 +54,11 @@ in
variable values. If no value is set then it will be replaced with an variable values. If no value is set then it will be replaced with an
empty string. empty string.
<programlisting> ```
# Content of the environment file # Content of the environment file
LITESTREAM_ACCESS_KEY_ID=AKIAxxxxxxxxxxxxxxxx LITESTREAM_ACCESS_KEY_ID=AKIAxxxxxxxxxxxxxxxx
LITESTREAM_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxx LITESTREAM_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxx
</programlisting> ```
Note that this file needs to be available on the host on which Note that this file needs to be available on the host on which
this exporter is running. this exporter is running.

12
nixos/modules/services/networking/3proxy.nix
View File

@@ -18,26 +18,26 @@ in {
type = types.nullOr types.path; type = types.nullOr types.path;
default = null; default = null;
example = "/var/lib/3proxy/3proxy.passwd"; example = "/var/lib/3proxy/3proxy.passwd";
description = '' description = lib.mdDoc ''
Load users and passwords from this file. Load users and passwords from this file.
Example users file with plain-text passwords: Example users file with plain-text passwords:
<programlisting> ```
test1:CL:password1 test1:CL:password1
test2:CL:password2 test2:CL:password2
</programlisting> ```
Example users file with md5-crypted passwords: Example users file with md5-crypted passwords:
<programlisting> ```
test1:CR:$1$tFkisVd2$1GA8JXkRmTXdLDytM/i3a1 test1:CR:$1$tFkisVd2$1GA8JXkRmTXdLDytM/i3a1
test2:CR:$1$rkpibm5J$Aq1.9VtYAn0JrqZ8M.1ME. test2:CR:$1$rkpibm5J$Aq1.9VtYAn0JrqZ8M.1ME.
</programlisting> ```
You can generate md5-crypted passwords via https://unix4lyfe.org/crypt/ You can generate md5-crypted passwords via https://unix4lyfe.org/crypt/
Note that htpasswd tool generates incompatible md5-crypted passwords. Note that htpasswd tool generates incompatible md5-crypted passwords.
Consult <link xlink:href="https://github.com/z3APA3A/3proxy/wiki/How-To-(incomplete)#USERS">documentation</link> for more information. Consult [documentation](https://github.com/z3APA3A/3proxy/wiki/How-To-%28incomplete%29#USERS) for more information.
''; '';
}; };
services = mkOption { services = mkOption {

10
nixos/modules/services/networking/firefox-syncserver.nix
View File

@@ -34,22 +34,22 @@ in
{ {
options = { options = {
services.firefox-syncserver = { services.firefox-syncserver = {
enable = lib.mkEnableOption '' enable = lib.mkEnableOption (lib.mdDoc ''
the Firefox Sync storage service. the Firefox Sync storage service.
Out of the box this will not be very useful unless you also configure at least Out of the box this will not be very useful unless you also configure at least
one service and one nodes by inserting them into the mysql database manually, e.g. one service and one nodes by inserting them into the mysql database manually, e.g.
by running by running
<programlisting> ```
INSERT INTO `services` (`id`, `service`, `pattern`) VALUES ('1', 'sync-1.5', '{node}/1.5/{uid}'); INSERT INTO `services` (`id`, `service`, `pattern`) VALUES ('1', 'sync-1.5', '{node}/1.5/{uid}');
INSERT INTO `nodes` (`id`, `service`, `node`, `available`, `current_load`, INSERT INTO `nodes` (`id`, `service`, `node`, `available`, `current_load`,
`capacity`, `downed`, `backoff`) `capacity`, `downed`, `backoff`)
VALUES ('1', '1', 'https://mydomain.tld', '1', '0', '10', '0', '0'); VALUES ('1', '1', 'https://mydomain.tld', '1', '0', '10', '0', '0');
</programlisting> ```
<option>${opt.singleNode.enable}</option> does this automatically when enabled {option}`${opt.singleNode.enable}` does this automatically when enabled
''; '');
package = lib.mkOption { package = lib.mkOption {
type = lib.types.package; type = lib.types.package;

12
nixos/modules/services/networking/hylafax/options.nix
View File

@@ -172,23 +172,23 @@ in
userAccessFile = mkOption { userAccessFile = mkOption {
type = path; type = path;
default = "/etc/hosts.hfaxd"; default = "/etc/hosts.hfaxd";
description = '' description = lib.mdDoc ''
The <filename>hosts.hfaxd</filename> The {file}`hosts.hfaxd`
file entry in the spooling area file entry in the spooling area
will be symlinked to the location given here. will be symlinked to the location given here.
This file must exist and be This file must exist and be
readable only by the <literal>uucp</literal> user. readable only by the `uucp` user.
See hosts.hfaxd(5) for details. See hosts.hfaxd(5) for details.
This configuration permits access for all users: This configuration permits access for all users:
<programlisting> ```
environment.etc."hosts.hfaxd" = { environment.etc."hosts.hfaxd" = {
mode = "0600"; mode = "0600";
user = "uucp"; user = "uucp";
text = ".*"; text = ".*";
}; };
</programlisting> ```
Note that host-based access can be controlled with Note that host-based access can be controlled with
<option>config.systemd.sockets.hylafax-hfaxd.listenStreams</option>; {option}`config.systemd.sockets.hylafax-hfaxd.listenStreams`;
by default, only 127.0.0.1 is permitted to connect. by default, only 127.0.0.1 is permitted to connect.
''; '';
}; };

14
nixos/modules/services/networking/murmur.nix
View File

@@ -261,25 +261,25 @@ in
type = types.nullOr types.path; type = types.nullOr types.path;
default = null; default = null;
example = "/var/lib/murmur/murmurd.env"; example = "/var/lib/murmur/murmurd.env";
description = '' description = lib.mdDoc ''
Environment file as defined in <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. Environment file as defined in {manpage}`systemd.exec(5)`.
Secrets may be passed to the service without adding them to the world-readable Secrets may be passed to the service without adding them to the world-readable
Nix store, by specifying placeholder variables as the option value in Nix and Nix store, by specifying placeholder variables as the option value in Nix and
setting these variables accordingly in the environment file. setting these variables accordingly in the environment file.
<programlisting> ```
# snippet of murmur-related config # snippet of murmur-related config
services.murmur.password = "$MURMURD_PASSWORD"; services.murmur.password = "$MURMURD_PASSWORD";
</programlisting> ```
<programlisting> ```
# content of the environment file # content of the environment file
MURMURD_PASSWORD=verysecretpassword MURMURD_PASSWORD=verysecretpassword
</programlisting> ```
Note that this file needs to be available on the host on which Note that this file needs to be available on the host on which
<literal>murmur</literal> is running. `murmur` is running.
''; '';
}; };
}; };

28
nixos/modules/services/networking/ncdns.nix
View File

@@ -78,16 +78,16 @@ in
default = config.networking.hostName; default = config.networking.hostName;
defaultText = literalExpression "config.networking.hostName"; defaultText = literalExpression "config.networking.hostName";
example = "example.com"; example = "example.com";
description = '' description = lib.mdDoc ''
The hostname of this ncdns instance, which defaults to the machine The hostname of this ncdns instance, which defaults to the machine
hostname. If specified, ncdns lists the hostname as an NS record at hostname. If specified, ncdns lists the hostname as an NS record at
the zone apex: the zone apex:
<programlisting> ```
bit. IN NS ns1.example.com. bit. IN NS ns1.example.com.
</programlisting> ```
If unset ncdns will generate an internal psuedo-hostname under the If unset ncdns will generate an internal psuedo-hostname under the
zone, which will resolve to the value of zone, which will resolve to the value of
<option>services.ncdns.identity.address</option>. {option}`services.ncdns.identity.address`.
If you are only using ncdns locally you can ignore this. If you are only using ncdns locally you can ignore this.
''; '';
}; };
@@ -123,13 +123,13 @@ in
dnssec.keys.public = mkOption { dnssec.keys.public = mkOption {
type = types.path; type = types.path;
default = defaultFiles.public; default = defaultFiles.public;
description = '' description = lib.mdDoc ''
Path to the file containing the KSK public key. Path to the file containing the KSK public key.
The key can be generated using the <literal>dnssec-keygen</literal> The key can be generated using the `dnssec-keygen`
command, provided by the package <literal>bind</literal> as follows: command, provided by the package `bind` as follows:
<programlisting> ```
$ dnssec-keygen -a RSASHA256 -3 -b 2048 -f KSK bit $ dnssec-keygen -a RSASHA256 -3 -b 2048 -f KSK bit
</programlisting> ```
''; '';
}; };
@@ -144,13 +144,13 @@ in
dnssec.keys.zonePublic = mkOption { dnssec.keys.zonePublic = mkOption {
type = types.path; type = types.path;
default = defaultFiles.zonePublic; default = defaultFiles.zonePublic;
description = '' description = lib.mdDoc ''
Path to the file containing the ZSK public key. Path to the file containing the ZSK public key.
The key can be generated using the <literal>dnssec-keygen</literal> The key can be generated using the `dnssec-keygen`
command, provided by the package <literal>bind</literal> as follows: command, provided by the package `bind` as follows:
<programlisting> ```
$ dnssec-keygen -a RSASHA256 -3 -b 2048 bit $ dnssec-keygen -a RSASHA256 -3 -b 2048 bit
</programlisting> ```
''; '';
}; };

8
nixos/modules/services/networking/nix-serve.nix
View File

@@ -35,15 +35,15 @@ in
secretKeyFile = mkOption { secretKeyFile = mkOption {
type = types.nullOr types.str; type = types.nullOr types.str;
default = null; default = null;
description = '' description = lib.mdDoc ''
The path to the file used for signing derivation data. The path to the file used for signing derivation data.
Generate with: Generate with:
<programlisting> ```
nix-store --generate-binary-cache-key key-name secret-key-file public-key-file nix-store --generate-binary-cache-key key-name secret-key-file public-key-file
</programlisting> ```
For more details see <citerefentry><refentrytitle>nix-store</refentrytitle><manvolnum>1</manvolnum></citerefentry>. For more details see {manpage}`nix-store(1)`.
''; '';
}; };

10
nixos/modules/services/security/hockeypuck.nix
View File

@@ -37,10 +37,10 @@ in {
}; };
} }
''; '';
description = '' description = lib.mdDoc ''
Configuration file for hockeypuck, here you can override Configuration file for hockeypuck, here you can override
certain settings (<literal>loglevel</literal> and certain settings (`loglevel` and
<literal>openpgp.db.dsn</literal>) by just setting those values. `openpgp.db.dsn`) by just setting those values.
For other settings you need to use lib.mkForce to override them. For other settings you need to use lib.mkForce to override them.
@@ -49,7 +49,7 @@ in {
the database yourself. the database yourself.
Example: Example:
<programlisting> ```
services.postgresql = { services.postgresql = {
enable = true; enable = true;
ensureDatabases = [ "hockeypuck" ]; ensureDatabases = [ "hockeypuck" ];
@@ -58,7 +58,7 @@ in {
ensurePermissions."DATABASE hockeypuck" = "ALL PRIVILEGES"; ensurePermissions."DATABASE hockeypuck" = "ALL PRIVILEGES";
}]; }];
}; };
</programlisting> ```
''; '';
}; };
}; };

14
nixos/modules/services/security/privacyidea.nix
View File

@@ -72,19 +72,19 @@ in
type = types.nullOr types.path; type = types.nullOr types.path;
default = null; default = null;
example = "/root/privacyidea.env"; example = "/root/privacyidea.env";
description = '' description = lib.mdDoc ''
File to load as environment file. Environment variables File to load as environment file. Environment variables
from this file will be interpolated into the config file from this file will be interpolated into the config file
using <literal>envsubst</literal> which is helpful for specifying using `envsubst` which is helpful for specifying
secrets: secrets:
<programlisting> ```
{ <xref linkend="opt-services.privacyidea.secretKey"/> = "$SECRET"; } { services.privacyidea.secretKey = "$SECRET"; }
</programlisting> ```
The environment-file can now specify the actual secret key: The environment-file can now specify the actual secret key:
<programlisting> ```
SECRET=veryverytopsecret SECRET=veryverytopsecret
</programlisting> ```
''; '';
}; };

10
nixos/modules/services/security/vault.nix
View File

@@ -141,17 +141,17 @@ in
extraSettingsPaths = mkOption { extraSettingsPaths = mkOption {
type = types.listOf types.path; type = types.listOf types.path;
default = []; default = [];
description = '' description = lib.mdDoc ''
Configuration files to load besides the immutable one defined by the NixOS module. Configuration files to load besides the immutable one defined by the NixOS module.
This can be used to avoid putting credentials in the Nix store, which can be read by any user. This can be used to avoid putting credentials in the Nix store, which can be read by any user.
Each path can point to a JSON- or HCL-formatted file, or a directory Each path can point to a JSON- or HCL-formatted file, or a directory
to be scanned for files with <literal>.hcl</literal> or to be scanned for files with `.hcl` or
<literal>.json</literal> extensions. `.json` extensions.
To upload the confidential file with NixOps, use for example: To upload the confidential file with NixOps, use for example:
<programlisting><![CDATA[ ```
# https://releases.nixos.org/nixops/latest/manual/manual.html#opt-deployment.keys # https://releases.nixos.org/nixops/latest/manual/manual.html#opt-deployment.keys
deployment.keys."vault.hcl" = let db = import ./db-credentials.nix; in { deployment.keys."vault.hcl" = let db = import ./db-credentials.nix; in {
text = ${"''"} text = ${"''"}
@@ -164,7 +164,7 @@ in
services.vault.extraSettingsPaths = ["/run/keys/vault.hcl"]; services.vault.extraSettingsPaths = ["/run/keys/vault.hcl"];
services.vault.storageBackend = "postgresql"; services.vault.storageBackend = "postgresql";
users.users.vault.extraGroups = ["keys"]; users.users.vault.extraGroups = ["keys"];
]]></programlisting> ```
''; '';
}; };
}; };

30
nixos/modules/services/security/vaultwarden/default.nix
View File

@@ -125,31 +125,31 @@ in {
type = with types; nullOr path; type = with types; nullOr path;
default = null; default = null;
example = "/var/lib/vaultwarden.env"; example = "/var/lib/vaultwarden.env";
description = '' description = lib.mdDoc ''
Additional environment file as defined in <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. Additional environment file as defined in {manpage}`systemd.exec(5)`.
Secrets like <envar>ADMIN_TOKEN</envar> and <envar>SMTP_PASSWORD</envar> Secrets like {env}`ADMIN_TOKEN` and {env}`SMTP_PASSWORD`
may be passed to the service without adding them to the world-readable Nix store. may be passed to the service without adding them to the world-readable Nix store.
Note that this file needs to be available on the host on which Note that this file needs to be available on the host on which
<literal>vaultwarden</literal> is running. `vaultwarden` is running.
As a concrete example, to make the Admin UI available As a concrete example, to make the Admin UI available
(from which new users can be invited initially), (from which new users can be invited initially),
the secret <envar>ADMIN_TOKEN</envar> needs to be defined as described the secret {env}`ADMIN_TOKEN` needs to be defined as described
<link xlink:href="https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page">here</link>. [here](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page).
Setting <literal>environmentFile</literal> to <literal>/var/lib/vaultwarden.env</literal> Setting `environmentFile` to `/var/lib/vaultwarden.env`
and ensuring permissions with e.g. and ensuring permissions with e.g.
<literal>chown vaultwarden:vaultwarden /var/lib/vaultwarden.env</literal> `chown vaultwarden:vaultwarden /var/lib/vaultwarden.env`
(the <literal>vaultwarden</literal> user will only exist after activating with (the `vaultwarden` user will only exist after activating with
<literal>enable = true;</literal> before this), we can set the contents of the file to have `enable = true;` before this), we can set the contents of the file to have
contents such as: contents such as:
<programlisting> ```
# Admin secret token, see # Admin secret token, see
# https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page # https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page
ADMIN_TOKEN=...copy-paste a unique generated secret token here... ADMIN_TOKEN=...copy-paste a unique generated secret token here...
</programlisting> ```
''; '';
}; };

10
nixos/modules/services/web-apps/discourse.nix
View File

@@ -57,20 +57,20 @@ in
type = with lib.types; nullOr path; type = with lib.types; nullOr path;
default = null; default = null;
example = "/run/keys/secret_key_base"; example = "/run/keys/secret_key_base";
description = '' description = lib.mdDoc ''
The path to a file containing the The path to a file containing the
<literal>secret_key_base</literal> secret. `secret_key_base` secret.
Discourse uses <literal>secret_key_base</literal> to encrypt Discourse uses `secret_key_base` to encrypt
the cookie store, which contains session data, and to digest the cookie store, which contains session data, and to digest
user auth tokens. user auth tokens.
Needs to be a 64 byte long string of hexadecimal Needs to be a 64 byte long string of hexadecimal
characters. You can generate one by running characters. You can generate one by running
<programlisting> ```
openssl rand -hex 64 >/path/to/secret_key_base_file openssl rand -hex 64 >/path/to/secret_key_base_file
</programlisting> ```
This should be a string, not a nix path, since nix paths are This should be a string, not a nix path, since nix paths are
copied into the world-readable nix store. copied into the world-readable nix store.

14
nixos/modules/services/web-apps/hedgedoc.nix
View File

@@ -990,27 +990,27 @@ in
type = with types; nullOr path; type = with types; nullOr path;
default = null; default = null;
example = "/var/lib/hedgedoc/hedgedoc.env"; example = "/var/lib/hedgedoc/hedgedoc.env";
description = '' description = lib.mdDoc ''
Environment file as defined in <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. Environment file as defined in {manpage}`systemd.exec(5)`.
Secrets may be passed to the service without adding them to the world-readable Secrets may be passed to the service without adding them to the world-readable
Nix store, by specifying placeholder variables as the option value in Nix and Nix store, by specifying placeholder variables as the option value in Nix and
setting these variables accordingly in the environment file. setting these variables accordingly in the environment file.
<programlisting> ```
# snippet of HedgeDoc-related config # snippet of HedgeDoc-related config
services.hedgedoc.configuration.dbURL = "postgres://hedgedoc:\''${DB_PASSWORD}@db-host:5432/hedgedocdb"; services.hedgedoc.configuration.dbURL = "postgres://hedgedoc:\''${DB_PASSWORD}@db-host:5432/hedgedocdb";
services.hedgedoc.configuration.minio.secretKey = "$MINIO_SECRET_KEY"; services.hedgedoc.configuration.minio.secretKey = "$MINIO_SECRET_KEY";
</programlisting> ```
<programlisting> ```
# content of the environment file # content of the environment file
DB_PASSWORD=verysecretdbpassword DB_PASSWORD=verysecretdbpassword
MINIO_SECRET_KEY=verysecretminiokey MINIO_SECRET_KEY=verysecretminiokey
</programlisting> ```
Note that this file needs to be available on the host on which Note that this file needs to be available on the host on which
<literal>HedgeDoc</literal> is running. `HedgeDoc` is running.
''; '';
}; };

6
nixos/modules/services/web-servers/molly-brown.nix
View File

@@ -34,16 +34,16 @@ in {
certPath = mkOption { certPath = mkOption {
type = types.path; type = types.path;
example = "/var/lib/acme/example.com/cert.pem"; example = "/var/lib/acme/example.com/cert.pem";
description = '' description = lib.mdDoc ''
Path to TLS certificate. An ACME certificate and key may be Path to TLS certificate. An ACME certificate and key may be
shared with an HTTP server, but only if molly-brown has shared with an HTTP server, but only if molly-brown has
permissions allowing it to read such keys. permissions allowing it to read such keys.
As an example: As an example:
<programlisting> ```
systemd.services.molly-brown.serviceConfig.SupplementaryGroups = systemd.services.molly-brown.serviceConfig.SupplementaryGroups =
[ config.security.acme.certs."example.com".group ]; [ config.security.acme.certs."example.com".group ];
</programlisting> ```
''; '';
}; };

10
nixos/modules/system/activation/top-level.nix
View File

@@ -164,17 +164,17 @@ in
specialisation = mkOption { specialisation = mkOption {
default = {}; default = {};
example = lib.literalExpression "{ fewJobsManyCores.configuration = { nix.settings = { core = 0; max-jobs = 1; }; }; }"; example = lib.literalExpression "{ fewJobsManyCores.configuration = { nix.settings = { core = 0; max-jobs = 1; }; }; }";
description = '' description = lib.mdDoc ''
Additional configurations to build. If Additional configurations to build. If
<literal>inheritParentConfig</literal> is true, the system `inheritParentConfig` is true, the system
will be based on the overall system configuration. will be based on the overall system configuration.
To switch to a specialised configuration To switch to a specialised configuration
(e.g. <literal>fewJobsManyCores</literal>) at runtime, run: (e.g. `fewJobsManyCores`) at runtime, run:
<programlisting> ```
sudo /run/current-system/specialisation/fewJobsManyCores/bin/switch-to-configuration test sudo /run/current-system/specialisation/fewJobsManyCores/bin/switch-to-configuration test
</programlisting> ```
''; '';
type = types.attrsOf (types.submodule ( type = types.attrsOf (types.submodule (
local@{ ... }: let local@{ ... }: let

6
nixos/modules/virtualisation/lxcfs.nix
View File

@@ -15,13 +15,13 @@ in {
mkOption { mkOption {
type = types.bool; type = types.bool;
default = false; default = false;
description = '' description = lib.mdDoc ''
This enables LXCFS, a FUSE filesystem for LXC. This enables LXCFS, a FUSE filesystem for LXC.
To use lxcfs in include the following configuration in your To use lxcfs in include the following configuration in your
container configuration: container configuration:
<programlisting> ```
virtualisation.lxc.defaultConfig = "lxc.include = ''${pkgs.lxcfs}/share/lxc/config/common.conf.d/00-lxcfs.conf"; virtualisation.lxc.defaultConfig = "lxc.include = ''${pkgs.lxcfs}/share/lxc/config/common.conf.d/00-lxcfs.conf";
</programlisting> ```
''; '';
}; };
}; };

8
nixos/modules/virtualisation/lxd.nix
View File

@@ -18,17 +18,17 @@ in {
enable = mkOption { enable = mkOption {
type = types.bool; type = types.bool;
default = false; default = false;
description = '' description = lib.mdDoc ''
This option enables lxd, a daemon that manages This option enables lxd, a daemon that manages
containers. Users in the "lxd" group can interact with containers. Users in the "lxd" group can interact with
the daemon (e.g. to start or stop containers) using the the daemon (e.g. to start or stop containers) using the
<command>lxc</command> command line tool, among others. {command}`lxc` command line tool, among others.
Most of the time, you'll also want to start lxcfs, so Most of the time, you'll also want to start lxcfs, so
that containers can "see" the limits: that containers can "see" the limits:
<programlisting> ```
virtualisation.lxc.lxcfs.enable = true; virtualisation.lxc.lxcfs.enable = true;
</programlisting> ```
''; '';
}; };