scanservjs has been ignoring the configuration options set by the NixOS
module since the v3.0.4 upgrade. This fixes it.
Create dirs/files in the NixOS module as needed by the new scanservjs
build.
Fixes: 7432e50d62 ("scanservjs: 2.27.1 -> 3.0.4")
Fixes: https://github.com/NixOS/nixpkgs/issues/475043 ("nixos/scanservjs: settings (host/port) ignored in v3.0.4")
Co-authored-by: Bjørn Forsman <bjorn.forsman@gmail.com>
Upstream's intended bypass is TrustedUids in fwupd.conf, but on NixOS
the fwupd-refresh uid is allocated at activation time and is not known
during evaluation. Add a polkit rule keyed on the user name instead.
Scope:
- Combination of
- Textual matches of "baseNameOf (toString"
- Redundant toString calls I've found with my latest
"lazy paths" nix branch as they force lazy fetches into
the store. More info and new PR soon.
- Only cases I believe are worthwhile or easily determined
I've determined the validity by
- testing llvmPackages instantiation
- figuring out which types can pass into any particular
toString call - "human fuzzy type checker"
Behavior considerations by type:
- `path`: converted back to a string *without* context
`baseNameOf` does not copy things to the store on its own,
equivalent to its behavior for string inputs
- `null`: converted to `""` -> may be valid input!
ok if "" would not have been acceptable anyway
- `string` itself: passed through identically -> trivial
- `attrset` with `outPath`: same coercion as built into
the `baseNameOf` function -> trivial
- other atomic types: generally not sensible inputs to
`baseNameOf` -> fuzzy but true
This service is essentially a random sleep() call that old software that
is unable to properly handle modern hardware initialisation being
asynchronous can use to *mostly* get by.
Over the years is has caused so many issues in NixOS, like introducing
long delays in the boot process[1], complete deadlocks[2] and even failures
when reloading services or activating a new configuration[3].
systemd has been discouraging its use since 2011 (15 years ago!), then
it officially deprecated it in 2018 and since 2020 it started to show on
every boot a huge wall of text calling out all the offending services
that still use it.
Around 2021 we managed to fix around 15 NixOS modules[4] that were
relying on systemd-udev-settle and practically ZFS[5] was the only
remaining one. However, since then, people have actually started to
bring it back with new services[6][7][8]. This is not acceptable.
So, to prevent any more (lazy) uses of systemd-udev-settle, we stop
providing the systemd-udev-settle.service unit entirely. For existing
modules that unfortunately still need it, we replace it with the command
`udevadm settle --timeout=180`, which is all that the service does.
Hopefully this will also increase the awareness that it's bad and
something to be fixed.
Note: I tested this change using
- `nixosTests.zfs`,
- `nixosTests.ifstate`,
- `nixosTests.misc`,
- `nixosTests.openvswitch`,
- `nixosTests.predictable-interface-names`
- `nixosTests.nvidia-container-toolkit`
and making sure that none of the 165 packages that provide upstream
units (via the `systemd.packages` option) had a dependency on
systemd-udev-settle.service.
[1]: https://github.com/NixOS/nixpkgs/pull/25311
[2]: https://github.com/NixOS/nixpkgs/issues/107341
[3]: https://github.com/NixOS/nixpkgs/pull/113804
[4]: https://github.com/NixOS/nixpkgs/issues/73095
[5]: https://github.com/openzfs/zfs/issues/10891
[6]: https://github.com/NixOS/nixpkgs/pull/257525#discussion_r1442702970
[7]: https://github.com/NixOS/nixpkgs/pull/460075
[8]: https://github.com/NixOS/nixpkgs/pull/284507
Fixes `nixos.tests.hibernate` nondeterministic failure.
The documentation in `systemd.special(7)` recommends using this
`StopWhenUnneeded` method, rather than using custom unit logic
post-resume. This method is sufficiently general, and matches
systemd's typical model of using `ExecStart` and `ExecStop` as duals
that mirror each others processes across symmetric events in the
system's life cycle, e.g. bootup / shutdown.
This involved removing `post-resume.target`. This was introduced in
d5604f0b22 as a way to notify services
of resume events, but as discussed, this is not the typical model.
See: https://github.com/NixOS/nixpkgs/pull/488429/changes#r3038005884
