26 Commits
Author SHA1 Message Date
gadorandGitHub 9768ddcc51 nixos/pgadmin: Apply more hardening settings (#449299) 2025-10-14 04:58:50 +00:00
Felix Singer cc38ed4577 nixos/pgadmin: Use lib.mkEnableOption where possible
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 16:03:09 +02:00
Felix Singer 3d4b08cd40 nixos/pgadmin: Set ProtectProc to invisble in service config
For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectProc=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:43:12 +02:00
Felix Singer c268ff5f26 nixos/pgadmin: Set ProtectControlGroups to strict in service config
For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectControlGroups=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:42:41 +02:00
Felix Singer f0f0fcee17 nixos/pgadmin: Enable PrivateUsers hardening in service config
For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#PrivateUsers=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:42:06 +02:00
Felix Singer 915cb926cf nixos/pgadmin: Enable MountAPIVFS hardening in service config
This setting is already implied by others, but add it for completeness
as well. For documentation see
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#MountAPIVFS=

Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 15:41:07 +02:00
Felix Singer 7e86ecfaf0 nixos/pgadmin: Ensure proper permissions for state directory
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 02:33:24 +02:00
Felix Singer 1d41699431 nixos/pgadmin: Ensure proper permissions for logs directory
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-10-07 02:32:40 +02:00
Felix Singer 35693b3279 nixos/pgadmin: Apply hardening options
Signed-off-by: Felix Singer <felixsinger@posteo.net>
2025-09-11 07:20:07 +02:00
Wolfgang Walther 5a0711127c treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
Wolfgang WaltherandMarcel 41c5662cbe nixos/postgresql: move postStart into separate unit
This avoids restarting the postgresql server, when only ensureDatabases
or ensureUsers have been changed. It will also allow to properly wait
for recovery to finish later.

To wait for "postgresql is ready" in other services, we now provide a
postgresql.target.

Resolves #400018

Co-authored-by: Marcel <me@m4rc3l.de>
2025-06-24 15:26:47 +02:00
Silvan Mosberger 4f0dadbf38 treewide: format all inactive Nix files
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.

Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.

A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.

This commit was automatically created and can be verified using

    nix-build https://github.com/infinisil/treewide-nixpkgs-reformat-script/archive/a08b3a4d199c6124ac5b36a889d9099b4383463f.tar.gz \
      --argstr baseRev b32a094368
    result/bin/apply-formatting $NIXPKGS_PATH
2024-12-10 20:26:33 +01:00
Felix BuehlerandJörg Thalheim 5e67f3e4c8 nixos/services.pgadmin: remove with lib; 2024-09-15 10:43:46 +02:00
éclairevoyant aeee4fc133 treewide: replace mkPackageOptionMD with mkPackageOption 2024-06-26 23:05:42 -04:00
4582b524ba pgadmin: Use systemd's LoadCredential for password files (#312569)
* pgadmin: Use systemd's LoadCredential for password files

* Update nixos/modules/services/admin/pgadmin.nix

---------

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
2024-05-19 00:16:00 +02:00
stuebinmandJonathan Ringer 6afb255d97 nixos: remove all uses of lib.mdDoc
these changes were generated with nixq 0.0.2, by running

  nixq ">> lib.mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix
  nixq ">> Inherit >> mdDoc[remove]" --batchmode nixos/**.nix

two mentions of the mdDoc function remain in nixos/, both of which
are inside of comments.

Since lib.mdDoc is already defined as just id, this commit is a no-op as
far as Nix (and the built manual) is concerned.
2024-04-13 10:07:35 -07:00
gador 1c1ca56266 pgadmin: 8.1 -> 8.2
Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2024-01-13 09:54:32 +01:00
Maciej KrügerandGitHub 6ba04cc302 Merge pull request #270876 from gador/pgadmin-check-pw
nixos/pgadmin: add minimumPasswordLength setting and check
2024-01-12 21:00:40 +01:00
MarcelandMarcel 0be0d8a860 nixos/pgadmin: disable upgrade check 2024-01-11 16:22:28 +01:00
gador bc21d288f4 nixos/pgadmin: apply review suggestions
Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2024-01-11 11:32:32 +01:00
boozedogandMaciej Krüger 0b522b2429 nixos/pgadmin: add package option 2023-12-26 11:56:25 +01:00
gador 010a6250db nixos/pgadmin: add passwordLength setting
pgadmin by default checks the length of the password
and will fail with passwords < 6 characters.
The produced error message is buried in python tracebacks
and hard to find and debug.

Therefore this adds the setting, and also adds a check
in the pre-start script of pgadmin.

The nixos/pgadmin tests have been modified, also.

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2023-11-29 10:21:52 +01:00
gadorandSandro 73f09f2145 pgadmin4: 6.12 -> 6.13
- Add update script
- Add email options to pgadmin4 nixOS module
- Add override for flask 2.2

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
2022-09-22 17:42:20 +02:00
pennae ef176dcf7e nixos/*: automatically convert option descriptions
conversions were done using https://github.com/pennae/nix-doc-munge
using (probably) rev f34e145 running

    nix-doc-munge nixos/**/*.nix
    nix-doc-munge --import nixos/**/*.nix

the tool ensures that only changes that could affect the generated
manual *but don't* are committed, other changes require manual review
and are discarded.
2022-08-31 16:32:53 +02:00
pennae 2e751c0772 treewide: automatically md-convert option descriptions
the conversion procedure is simple:

 - find all things that look like options, ie calls to either `mkOption`
   or `lib.mkOption` that take an attrset. remember the attrset as the
   option
 - for all options, find a `description` attribute who's value is not a
   call to `mdDoc` or `lib.mdDoc`
 - textually convert the entire value of the attribute to MD with a few
   simple regexes (the set from mdize-module.sh)
 - if the change produced a change in the manual output, discard
 - if the change kept the manual unchanged, add some text to the
   description to make sure we've actually found an option. if the
   manual changes this time, keep the converted description

this procedure converts 80% of nixos options to markdown. around 2000
options remain to be inspected, but most of those fail the "does not
change the manual output check": currently the MD conversion process
does not faithfully convert docbook tags like <code> and <package>, so
any option using such tags will not be converted at all.
2022-07-30 15:16:34 +02:00
Maciej Krüger 42a5831e62 nixos/pgadmin: init 2022-02-26 14:30:14 +01:00