59 Commits
Author SHA1 Message Date
ChanningHe ba380a05c9 nixos/komodo-periphery: v2.0.0+ support 2026-06-29 11:57:09 +09:00
ChanningHe c58c765fa5 nixos/komodo-periphery: init module 2025-12-12 15:30:03 +09:00
gadorandGitHub 9768ddcc51 nixos/pgadmin: Apply more hardening settings (#449299) 2025-10-14 04:58:50 +00:00
Felix Singer cc38ed4577 nixos/pgadmin: Use lib.mkEnableOption where possible
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 16:03:09 +02:00
Felix Singer 3d4b08cd40 nixos/pgadmin: Set ProtectProc to invisble in service config
For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectProc=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:43:12 +02:00
Felix Singer c268ff5f26 nixos/pgadmin: Set ProtectControlGroups to strict in service config
For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectControlGroups=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:42:41 +02:00
Felix Singer f0f0fcee17 nixos/pgadmin: Enable PrivateUsers hardening in service config
For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#PrivateUsers=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:42:06 +02:00
Felix Singer 915cb926cf nixos/pgadmin: Enable MountAPIVFS hardening in service config
This setting is already implied by others, but add it for completeness
as well. For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#MountAPIVFS=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:41:07 +02:00
Felix Singer 7e86ecfaf0 nixos/pgadmin: Ensure proper permissions for state directory
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 02:33:24 +02:00
Felix Singer 1d41699431 nixos/pgadmin: Ensure proper permissions for logs directory
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 02:32:40 +02:00
gadorandGitHub 5a8b8b2b9d nixos/pgadmin: Apply hardening options (#441052) 2025-09-22 06:31:41 +00:00
Johannes Kirschbauer 30b647732c nixos/modules: meshcentral use correct type in freeformType 2025-09-14 11:37:18 +02:00
Felix Singer 35693b3279 nixos/pgadmin: Apply hardening options
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-09-11 07:20:07 +02:00
Joachim Ernst f976e53564 nixos/oxidized: allow for providing config by other means
- especially usefull, when secrets are used in configFile
  and `replace-secret` or `scalpel` should be used
2025-08-07 14:26:35 +02:00
Wolfgang Walther 5a0711127c treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
Wolfgang WaltherandMarcel 41c5662cbe nixos/postgresql: move postStart into separate unit
This avoids restarting the postgresql server, when only ensureDatabases
or ensureUsers have been changed. It will also allow to properly wait
for recovery to finish later.

To wait for "postgresql is ready" in other services, we now provide a
postgresql.target.

Resolves #400018

Co-authored-by: Marcel <me@m4rc3l.de>
2025-06-24 15:26:47 +02:00
liberodark 99bdbcbd01 oxidized: fix symlink 2025-05-30 11:05:47 +02:00
liberodark 5fffaee9e9 oxidized: switch to tmpfiles 2025-05-07 16:03:33 +02:00
Silvan Mosberger 4f0dadbf38 treewide: format all inactive Nix files
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.

Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.

A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.

This commit was automatically created and can be verified using

    nix-build https://github.com/infinisil/treewide-nixpkgs-reformat-script/archive/a08b3a4d199c6124ac5b36a889d9099b4383463f.tar.gz \
      --argstr baseRev b32a094368
    result/bin/apply-formatting $NIXPKGS_PATH
2024-12-10 20:26:33 +01:00
Felix Buehler 5a670b332a nixos/services.salt.minion: remove with lib; 2024-11-27 22:26:57 +01:00
Felix Buehler 503fd3014a nixos/services.oxidized: remove with lib; 2024-11-27 22:26:57 +01:00
Felix BuehlerandJörg Thalheim 5e67f3e4c8 nixos/services.pgadmin: remove with lib; 2024-09-15 10:43:46 +02:00
Felix Buehler 3e47355b3f nixos/services.salt.master: remove with lib; 2024-08-30 00:30:38 +02:00
éclairevoyant aeee4fc133 treewide: replace mkPackageOptionMD with mkPackageOption 2024-06-26 23:05:42 -04:00
Linus Heckemann e5adf0b547 maintainers: drop lheckemann 2024-06-21 15:54:54 +02:00
Maciej Krüger a4776f9fc9 nixos/docuum: add missing options 2024-06-19 19:10:36 +02:00
4582b524ba pgadmin: Use systemd's LoadCredential for password files (#312569)
* pgadmin: Use systemd's LoadCredential for password files

* Update nixos/modules/services/admin/pgadmin.nix

---------

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
2024-05-19 00:16:00 +02:00
stuebinmandJonathan Ringer 6afb255d97 nixos: remove all uses of lib.mdDoc
these changes were generated with nixq 0.0.2, by running

  nixq ">> lib.mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> Inherit >> mdDoc[remove]" --batchmode nixos/**.nix

two mentions of the mdDoc function remain in nixos/, both of which
are inside of comments.

Since lib.mdDoc is already defined as just id, this commit is a no-op as
far as Nix (and the built manual) is concerned.
2024-04-13 10:07:35 -07:00
Bjørn Forsman a29010fe79 nixos: improve many 'enable' descriptions 2024-04-09 07:10:17 +02:00
Maciej KrügerandMartin Weinelt 94d6d4e93a nixos/docuum: add module for docuum package
Co-Authored-By: Martin Weinelt <mweinelt@users.noreply.github.com>
2024-03-23 18:25:55 +01:00
gador 1c1ca56266 pgadmin: 8.1 -> 8.2
Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2024-01-13 09:54:32 +01:00
Maciej KrügerandGitHub 6ba04cc302 Merge pull request #270876 from gador/pgadmin-check-pw
nixos/pgadmin: add minimumPasswordLength setting and check
2024-01-12 21:00:40 +01:00
MarcelandMarcel 0be0d8a860 nixos/pgadmin: disable upgrade check 2024-01-11 16:22:28 +01:00
gador bc21d288f4 nixos/pgadmin: apply review suggestions
Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2024-01-11 11:32:32 +01:00
boozedogandMaciej Krüger 0b522b2429 nixos/pgadmin: add package option 2023-12-26 11:56:25 +01:00
gador 010a6250db nixos/pgadmin: add passwordLength setting
pgadmin by default checks the length of the password
and will fail with passwords < 6 characters.
The produced error message is buried in python tracebacks
and hard to find and debug.

Therefore this adds the setting, and also adds a check
in the pre-start script of pgadmin.

The nixos/pgadmin tests have been modified, also.

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2023-11-29 10:21:52 +01:00
h7x4 0a37316d6c treewide: use mkPackageOption
This commit replaces a lot of usages of `mkOption` with the package
type, to be `mkPackageOption`, in order to reduce the amount of code.
2023-11-27 01:28:36 +01:00
gadorandSandro 73f09f2145 pgadmin4: 6.12 -> 6.13
- Add update script
- Add email options to pgadmin4 nixOS module
- Add override for flask 2.2

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2022-09-22 17:42:20 +02:00
pennae ef176dcf7e nixos/*: automatically convert option descriptions
conversions were done using https://github.com/pennae/nix-doc-munge
using (probably) rev f34e145 running

    nix-doc-munge nixos/**/*.nix
    nix-doc-munge --import nixos/**/*.nix

the tool ensures that only changes that could affect the generated
manual *but don't* are committed, other changes require manual review
and are discarded.
2022-08-31 16:32:53 +02:00
pennae c915b915b5 nixos/*: md-convert options with unordered lists
mostly no rendering changes. some lists (like simplelist) don't have an
exact translation to markdown, so we use a comma-separated list of
literals instead.
2022-08-31 16:32:53 +02:00
pennae 2e751c0772 treewide: automatically md-convert option descriptions
the conversion procedure is simple:

 - find all things that look like options, ie calls to either `mkOption`
   or `lib.mkOption` that take an attrset. remember the attrset as the
   option
 - for all options, find a `description` attribute who's value is not a
   call to `mdDoc` or `lib.mdDoc`
 - textually convert the entire value of the attribute to MD with a few
   simple regexes (the set from mdize-module.sh)
 - if the change produced a change in the manual output, discard
 - if the change kept the manual unchanged, add some text to the
   description to make sure we've actually found an option. if the
   manual changes this time, keep the converted description

this procedure converts 80% of nixos options to markdown. around 2000
options remain to be inspected, but most of those fail the "does not
change the manual output check": currently the MD conversion process
does not faithfully convert docbook tags like <code> and <package>, so
any option using such tags will not be converted at all.
2022-07-30 15:16:34 +02:00
Maciej Krüger 42a5831e62 nixos/pgadmin: init 2022-02-26 14:30:14 +01:00
Naïm Favier 2ddc335e6f nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
Linus Heckemann a175be0e7e nixos/meshcentral: init module 2021-07-29 11:42:42 +02:00
Graham Christensen bc49a0815a utillinux: rename to util-linux 2020-11-24 12:42:06 -05:00
Flakebi e0ea4826f4 salt: remove aneeshusa and add Flakebi as maintainer 2020-10-23 19:48:48 +02:00
WilliButz 482b39a7e5 nixos/oxidized: add missing slash to PIDFile path 2020-01-06 16:58:54 +01:00
WilliButz 727f2e9a3e nixos/oxidized: specify PID file in service 2019-12-12 23:19:07 +01:00
Janne Heß d6c08776ba treewide: Switch to system users 2019-10-12 22:25:28 +02:00
Tristan Helmich (omniIT) 02dfc07a04 nixos/oxidized: Use symlinks for config files
The old `cp` suffers from a permission issue on the 2nd start of the
service. The files were copied from the read-only nix store. On the 2nd
start of the service the `cp` failed.
The new version force creates a symlink which does not suffer from this.
2019-08-14 09:30:51 +00:00