ext filesystems are only supported unconditionally if the systemd initrd
is NOT used. Since the systemd initrd was recently enabled by default,
the default ISO image configuration is now missing support for ext
filesystems, which means that one cannot e.g. boot into a live ISO image
and run `fsck.ext4`.
This commit adds ext2, ext3 and ext4 as explicitly supported file
systems in the base profile, which ensures that the associated tools are
always available.
Convert all remaining boot.postBootCommands that call
nix-store --load-db into register-nix-paths systemd services for
consistency with qemu-vm.nix and to make the ordering dependency
with nix-channel-init explicit.
All services use the same unit name (register-nix-paths) and the
same sysinit.target ordering, so nix-channel-init's
after=register-nix-paths.service dependency works uniformly across
all platforms.
Platform-specific logic (netboot password setup, sd-image partition
expansion) is kept in the service script or in boot.postBootCommands
as appropriate.
- It lacks a consistent and transparent baseline or standard,
- It may introduce unexpected breakage or degrade performance without clear benefit,
- It is difficult to manage user expectations, especially since the implications of enabling it are not always obvious,
- and as multiple contributors have noted, it is often more of a “grab bag” of settings than a cohesive security policy.
Replace `writeShellScriptBin` + `overrideAttrs` with a direct
`writeTextFile` call, which accepts `meta` and `passthru` natively.
This removes the need for both `overrideAttrs` and `pos = __curPos`.
docker: move /init symlink creation from activationScript to installBootLoader,
which is the mechanism switch-to-configuration already uses for this purpose.
lxc: remove redundant activation script.
The installBootLoader hook was already handling /sbin/init.
incus: replace activationScript with a oneshot systemd service that uses
ConditionPathExists to create /etc/nixos/configuration.nix only on first
boot.
See: https://github.com/NixOS/nixpkgs/issues/475305
The version suffix (`lib.trivial.versionSuffix`) differs between channel
trees and Git trees, which results in users using channels not getting
the cached builds of the system derivation, as Hydra uses a Git checkout.
The linger-users systemd unit runs a Bash script. To allow this to be
avoided for the bashless profile, provide an option to have NixOS not
manage lingering for any users.
To make this feasible, add the possibility for each individual user
account to not have its lingering configuration managed by NixOS at all,
and make this the default from 26.05. In practice, this won't result in
a change of behaviour except for people who manually use `loginctl
enable-linger` commands to add lingering for some user accounts, then
rely on NixOS to disable lingering the next time the systemd units are
restarted.
There are a bunch of components such as incus or LXC that also use
`boot.isContainer`, so we'd have to differentiate between "OS container"
and "actually nspawn".
This became necessary for the file-systems part where nspawn takes care
of setting up special filesystems like `/proc`, `/dev` etc., but others
don't.
To allow for a `boot.isContainer` being less overloaded, this introduces
`boot.isNspawnContainer` that is exclusively used for nspawn-specific
things. When `true`, `boot.isContainer = true;` is implied.
The commit 01e8f570c6 unpinned the
LLVM version, which led to the following warnings whenever Scudo
is loaded (basically whenever a command is started when used
system-wide):
Scudo WARNING: found 3 unrecognized flag(s):
DeleteSizeMismatch=0:DeallocationTypeMismatch=0
DeallocationTypeMismatch=0
ZeroContents=1
According to the current Scudo documentation [1] the options are
now spelled differently. This commit keeps all existing options
and only updates the spelling.
[1] https://llvm.org/docs/ScudoHardenedAllocator.html
Reported-by: CUB3D <callumthom11@gmail.com>
A basic NixOS system shouldn’t require `stdenv` to install, and
it adds something like 45 MiB of build tools to the installer
closure. This doesn’t really help much at present since
WebKitGTK(?!) has a dodgy reference to GCC, but it’s a step in the
right direction.
With networkmanager we can provide a much more welcoming network setup
experience in the installer and it costs us less than 10 MB with this
configuration on the minimal ISO.
By default, for new profiles it will enable DHCP and RA and allow
interactive reconfiguration through `nmtui` or `nmcli`. Especially the
TUI interface is very easy to pick up and removes the need for typing in
manual commands when setting up the WLAN connection.
Resolution still fails when on VPN with no IPv6 DNS servers. We'll need
to investigate further why the fix doesn't help in this case.
This reverts commit f90236a8f2.
Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Martin Weinelt