2009-05-29 16:25:56 +02:00
|
|
|
# This module defines the global list of uids and gids. We keep a
|
2013-08-10 23:07:13 +02:00
|
|
|
# central list to prevent id collisions.
|
2009-05-29 16:25:56 +02:00
|
|
|
|
2014-05-05 20:58:51 +02:00
|
|
|
{ config, pkgs, lib, ... }:
|
2009-05-29 16:25:56 +02:00
|
|
|
|
2013-09-04 13:05:09 +02:00
|
|
|
{
|
2009-05-29 16:25:56 +02:00
|
|
|
options = {
|
|
|
|
|
2014-05-05 20:58:51 +02:00
|
|
|
ids.uids = lib.mkOption {
|
2013-10-30 17:37:45 +01:00
|
|
|
internal = true;
|
2009-05-29 16:25:56 +02:00
|
|
|
description = ''
|
|
|
|
The user IDs used in NixOS.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2014-05-05 20:58:51 +02:00
|
|
|
ids.gids = lib.mkOption {
|
2013-10-30 17:37:45 +01:00
|
|
|
internal = true;
|
2009-05-29 16:25:56 +02:00
|
|
|
description = ''
|
|
|
|
The group IDs used in NixOS.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
};
|
|
|
|
|
2011-09-14 20:20:50 +02:00
|
|
|
|
2013-09-04 13:05:09 +02:00
|
|
|
config = {
|
2007-06-08 17:41:12 +02:00
|
|
|
|
2013-09-04 13:05:09 +02:00
|
|
|
ids.uids = {
|
|
|
|
root = 0;
|
2015-03-08 21:35:04 +01:00
|
|
|
#wheel = 1; # unused
|
|
|
|
#kmem = 2; # unused
|
|
|
|
#tty = 3; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
messagebus = 4; # D-Bus
|
|
|
|
haldaemon = 5;
|
2015-03-08 21:35:04 +01:00
|
|
|
#disk = 6; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
vsftpd = 7;
|
|
|
|
ftp = 8;
|
|
|
|
bitlbee = 9;
|
|
|
|
avahi = 10;
|
2015-03-08 21:35:04 +01:00
|
|
|
nagios = 11;
|
2013-09-04 13:05:09 +02:00
|
|
|
atd = 12;
|
2015-03-08 21:35:04 +01:00
|
|
|
postfix = 13;
|
|
|
|
#postdrop = 14; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
dovecot = 15;
|
|
|
|
tomcat = 16;
|
2015-03-08 21:35:04 +01:00
|
|
|
#audio = 17; # unused
|
|
|
|
#floppy = 18; # unused
|
|
|
|
#uucp = 19; # unused
|
|
|
|
#lp = 20; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
pulseaudio = 22; # must match `pulseaudio' GID
|
|
|
|
gpsd = 23;
|
2015-03-08 21:35:04 +01:00
|
|
|
#cdrom = 24; # unused
|
|
|
|
#tape = 25; # unused
|
|
|
|
#video = 26; # unused
|
|
|
|
#dialout = 27; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
polkituser = 28;
|
2015-03-08 21:35:04 +01:00
|
|
|
#utmp = 29; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
ddclient = 30;
|
|
|
|
davfs2 = 31;
|
|
|
|
privoxy = 32;
|
2015-03-08 21:35:04 +01:00
|
|
|
#disnix = 33; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
osgi = 34;
|
|
|
|
tor = 35;
|
|
|
|
cups = 36;
|
2014-04-29 10:51:42 +02:00
|
|
|
foldingathome = 37;
|
2013-09-04 13:05:09 +02:00
|
|
|
sabnzbd = 38;
|
|
|
|
kdm = 39;
|
2014-04-29 10:51:42 +02:00
|
|
|
ghostone = 40;
|
2013-09-04 13:05:09 +02:00
|
|
|
git = 41;
|
2014-04-29 10:51:42 +02:00
|
|
|
fourstore = 42;
|
|
|
|
fourstorehttp = 43;
|
2013-09-04 13:05:09 +02:00
|
|
|
virtuoso = 44;
|
|
|
|
rtkit = 45;
|
|
|
|
dovecot2 = 46;
|
|
|
|
dovenull2 = 47;
|
|
|
|
unbound = 48;
|
|
|
|
prayer = 49;
|
|
|
|
mpd = 50;
|
|
|
|
clamav = 51;
|
|
|
|
fprot = 52;
|
|
|
|
bind = 53;
|
|
|
|
wwwrun = 54;
|
2015-03-08 21:35:04 +01:00
|
|
|
#adm = 55; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
spamd = 56;
|
2015-03-08 21:35:04 +01:00
|
|
|
#networkmanager = 57; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
nslcd = 58;
|
2015-03-08 21:35:04 +01:00
|
|
|
#scanner = 59; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
nginx = 60;
|
|
|
|
chrony = 61;
|
2015-03-08 21:35:04 +01:00
|
|
|
#systemd-journal = 62; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
smtpd = 63;
|
|
|
|
smtpq = 64;
|
|
|
|
supybot = 65;
|
|
|
|
iodined = 66;
|
2015-03-08 21:35:04 +01:00
|
|
|
#libvirtd = 67; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
graphite = 68;
|
|
|
|
statsd = 69;
|
|
|
|
transmission = 70;
|
|
|
|
postgres = 71;
|
2015-03-08 21:35:04 +01:00
|
|
|
#vboxusers = 72; # unused
|
|
|
|
#vboxsf = 73; # unused
|
2014-09-06 00:45:47 +02:00
|
|
|
smbguest = 74; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
varnish = 75;
|
2014-05-02 07:43:27 +02:00
|
|
|
datadog = 76;
|
2013-09-04 13:05:09 +02:00
|
|
|
lighttpd = 77;
|
|
|
|
lightdm = 78;
|
|
|
|
freenet = 79;
|
|
|
|
ircd = 80;
|
|
|
|
bacula = 81;
|
|
|
|
almir = 82;
|
|
|
|
deluge = 83;
|
|
|
|
mysql = 84;
|
|
|
|
rabbitmq = 85;
|
|
|
|
activemq = 86;
|
|
|
|
gnunet = 87;
|
|
|
|
oidentd = 88;
|
|
|
|
quassel = 89;
|
|
|
|
amule = 90;
|
|
|
|
minidlna = 91;
|
|
|
|
elasticsearch = 92;
|
2013-09-17 11:22:31 +02:00
|
|
|
tcpcryptd = 93; # tcpcryptd uses a hard-coded uid. We patch it in Nixpkgs to match this choice.
|
2015-03-08 21:35:04 +01:00
|
|
|
#connman = 94; # unused
|
2013-10-05 23:07:22 +02:00
|
|
|
firebird = 95;
|
2015-03-08 21:35:04 +01:00
|
|
|
#keys = 96; # unused
|
2013-10-29 15:55:25 +01:00
|
|
|
haproxy = 97;
|
2013-11-07 11:25:14 +01:00
|
|
|
mongodb = 98;
|
2013-11-28 22:21:50 +01:00
|
|
|
openldap = 99;
|
2015-03-08 21:35:04 +01:00
|
|
|
#users = 100; # unused
|
2014-01-13 00:18:05 +01:00
|
|
|
cgminer = 101;
|
2014-02-07 23:08:15 +01:00
|
|
|
munin = 102;
|
2014-02-11 14:19:06 +01:00
|
|
|
logcheck = 103;
|
2014-02-20 18:34:54 +01:00
|
|
|
nix-ssh = 104;
|
2014-02-21 12:40:05 +01:00
|
|
|
dictd = 105;
|
2014-02-27 14:33:30 +01:00
|
|
|
couchdb = 106;
|
2014-03-07 20:09:59 +01:00
|
|
|
searx = 107;
|
2014-03-12 08:32:56 +01:00
|
|
|
kippo = 108;
|
2014-02-10 21:07:12 +01:00
|
|
|
jenkins = 109;
|
2014-03-15 00:16:59 +01:00
|
|
|
systemd-journal-gateway = 110;
|
2016-01-07 04:34:31 +01:00
|
|
|
#notbit = 111; # unused
|
2014-03-20 03:04:35 +01:00
|
|
|
ngircd = 112;
|
2014-02-21 20:05:12 +01:00
|
|
|
btsync = 113;
|
2014-03-29 10:48:33 +01:00
|
|
|
minecraft = 114;
|
2014-04-01 19:20:33 +02:00
|
|
|
monetdb = 115;
|
2014-04-05 20:23:29 +02:00
|
|
|
rippled = 116;
|
2014-04-05 21:18:14 +02:00
|
|
|
murmur = 117;
|
2014-04-02 18:01:25 +02:00
|
|
|
foundationdb = 118;
|
|
|
|
newrelic = 119;
|
|
|
|
starbound = 120;
|
2015-03-08 21:35:04 +01:00
|
|
|
#grsecurity = 121; # unused
|
2014-04-29 10:45:06 +02:00
|
|
|
hydra = 122;
|
|
|
|
spiped = 123;
|
2014-03-29 01:40:30 +01:00
|
|
|
teamspeak = 124;
|
2014-05-27 22:54:43 +02:00
|
|
|
influxdb = 125;
|
2014-06-12 11:20:43 +02:00
|
|
|
nsd = 126;
|
2014-06-26 05:32:45 +02:00
|
|
|
gitolite = 127;
|
2014-07-03 18:30:11 +02:00
|
|
|
znc = 128;
|
2014-07-15 16:16:58 +02:00
|
|
|
polipo = 129;
|
2014-07-28 19:52:32 +02:00
|
|
|
mopidy = 130;
|
2015-03-08 21:35:04 +01:00
|
|
|
#docker = 131; # unused
|
2014-04-02 18:21:00 +02:00
|
|
|
gdm = 132;
|
2014-06-25 10:28:53 +02:00
|
|
|
dhcpd = 133;
|
2014-07-10 20:08:38 +02:00
|
|
|
siproxd = 134;
|
2014-07-09 00:43:26 +02:00
|
|
|
mlmmj = 135;
|
2014-08-16 23:53:26 +02:00
|
|
|
neo4j = 136;
|
2014-08-23 17:04:34 +02:00
|
|
|
riemann = 137;
|
2014-08-23 17:39:45 +02:00
|
|
|
riemanndash = 138;
|
2014-06-27 08:45:04 +02:00
|
|
|
radvd = 139;
|
2014-08-24 17:43:45 +02:00
|
|
|
zookeeper = 140;
|
2014-07-03 00:59:35 +02:00
|
|
|
dnsmasq = 141;
|
2014-09-01 08:53:00 +02:00
|
|
|
uhub = 142;
|
2014-09-26 10:44:09 +02:00
|
|
|
yandexdisk = 143;
|
|
|
|
collectd = 144;
|
|
|
|
consul = 145;
|
2014-09-26 10:03:29 +02:00
|
|
|
mailpile = 146;
|
2014-10-07 10:53:01 +02:00
|
|
|
redmine = 147;
|
2014-10-06 21:25:10 +02:00
|
|
|
seeks = 148;
|
2014-10-20 17:22:01 +02:00
|
|
|
prosody = 149;
|
2014-11-09 09:44:47 +01:00
|
|
|
i2pd = 150;
|
2014-11-11 20:12:28 +01:00
|
|
|
dnscrypt-proxy = 151;
|
2014-11-20 00:01:44 +01:00
|
|
|
systemd-network = 152;
|
|
|
|
systemd-resolve = 153;
|
|
|
|
systemd-timesync = 154;
|
2014-11-20 23:30:24 +01:00
|
|
|
liquidsoap = 155;
|
2014-11-15 16:27:27 +01:00
|
|
|
etcd = 156;
|
2014-11-21 17:20:14 +01:00
|
|
|
docker-registry = 157;
|
2014-11-20 12:29:07 +01:00
|
|
|
hbase = 158;
|
2014-11-20 13:00:53 +01:00
|
|
|
opentsdb = 159;
|
2014-11-20 15:38:04 +01:00
|
|
|
scollector = 160;
|
2014-11-20 15:49:45 +01:00
|
|
|
bosun = 161;
|
2014-11-29 16:46:39 +01:00
|
|
|
kubernetes = 162;
|
2014-12-01 16:40:42 +01:00
|
|
|
peerflix = 163;
|
2014-12-03 15:49:14 +01:00
|
|
|
chronos = 164;
|
2014-10-25 18:22:49 +02:00
|
|
|
gitlab = 165;
|
2014-12-20 23:38:52 +01:00
|
|
|
tox-bootstrapd = 166;
|
2014-12-28 20:21:41 +01:00
|
|
|
cadvisor = 167;
|
2015-01-14 22:08:19 +01:00
|
|
|
nylon = 168;
|
2015-01-28 23:07:27 +01:00
|
|
|
apache-kafka = 169;
|
2014-12-08 10:02:57 +01:00
|
|
|
panamax = 170;
|
2015-02-18 19:55:07 +01:00
|
|
|
exim = 172;
|
2015-03-08 21:35:04 +01:00
|
|
|
#fleet = 173; # unused
|
|
|
|
#input = 174; # unused
|
2015-03-02 18:58:35 +01:00
|
|
|
sddm = 175;
|
2015-03-08 21:35:04 +01:00
|
|
|
tss = 176;
|
|
|
|
memcached = 177;
|
|
|
|
ntp = 179;
|
|
|
|
zabbix = 180;
|
|
|
|
redis = 181;
|
|
|
|
unifi = 183;
|
|
|
|
uptimed = 184;
|
|
|
|
zope2 = 185;
|
2015-03-22 23:12:11 +01:00
|
|
|
ripple-data-api = 186;
|
2015-03-27 11:48:50 +01:00
|
|
|
mediatomb = 187;
|
2015-04-05 06:20:04 +02:00
|
|
|
rdnssd = 188;
|
2015-04-11 00:09:31 +02:00
|
|
|
ihaskell = 189;
|
2015-04-15 12:52:06 +02:00
|
|
|
i2p = 190;
|
2015-04-14 01:06:37 +02:00
|
|
|
lambdabot = 191;
|
2015-04-17 00:53:26 +02:00
|
|
|
asterisk = 192;
|
2015-04-16 20:15:59 +02:00
|
|
|
plex = 193;
|
2015-05-16 23:22:35 +02:00
|
|
|
bird = 195;
|
2015-04-25 16:02:44 +02:00
|
|
|
grafana = 196;
|
2015-06-08 13:36:05 +02:00
|
|
|
skydns = 197;
|
2015-06-08 12:58:33 +02:00
|
|
|
ripple-rest = 198;
|
2015-06-18 04:10:23 +02:00
|
|
|
nix-serve = 199;
|
2015-06-20 22:33:57 +02:00
|
|
|
tvheadend = 200;
|
2015-06-24 16:42:43 +02:00
|
|
|
uwsgi = 201;
|
2015-06-09 00:11:24 +02:00
|
|
|
gitit = 202;
|
2015-07-01 14:44:38 +02:00
|
|
|
riemanntools = 203;
|
2015-07-04 02:42:16 +02:00
|
|
|
subsonic = 204;
|
2015-07-21 12:16:18 +02:00
|
|
|
riak = 205;
|
2015-08-01 01:15:18 +02:00
|
|
|
shout = 206;
|
2015-07-31 06:22:44 +02:00
|
|
|
gateone = 207;
|
2015-09-08 19:24:40 +02:00
|
|
|
namecoin = 208;
|
2015-09-10 18:10:06 +02:00
|
|
|
dnschain = 209;
|
2015-09-14 08:27:31 +02:00
|
|
|
#lxd = 210; # unused
|
2015-09-19 00:18:43 +02:00
|
|
|
kibana = 211;
|
2015-09-13 14:49:19 +02:00
|
|
|
xtreemfs = 212;
|
2015-09-28 05:31:17 +02:00
|
|
|
calibre-server = 213;
|
2015-11-16 15:26:07 +01:00
|
|
|
heapster = 214;
|
2015-10-21 14:45:27 +02:00
|
|
|
bepasty = 215;
|
2015-11-29 22:28:29 +01:00
|
|
|
pumpio = 216;
|
2015-12-08 17:46:57 +01:00
|
|
|
nm-openvpn = 217;
|
2015-09-08 09:17:21 +02:00
|
|
|
mathics = 218;
|
2016-01-03 03:36:19 +01:00
|
|
|
ejabberd = 219;
|
2016-01-06 04:04:50 +01:00
|
|
|
postsrsd = 220;
|
2016-01-06 23:10:56 +01:00
|
|
|
opendkim = 221;
|
2016-01-07 02:17:42 +01:00
|
|
|
dspam = 222;
|
2015-08-03 19:04:10 +02:00
|
|
|
gale = 223;
|
2016-01-08 15:12:00 +01:00
|
|
|
matrix-synapse = 224;
|
2016-01-12 10:06:46 +01:00
|
|
|
rspamd = 225;
|
2016-01-14 10:17:27 +01:00
|
|
|
rmilter = 226;
|
2016-01-17 13:11:09 +01:00
|
|
|
cfdyndns = 227;
|
2016-02-16 17:40:00 +01:00
|
|
|
gammu-smsd = 228;
|
2016-02-16 18:35:01 +01:00
|
|
|
pdnsd = 229;
|
2016-02-14 12:58:09 +01:00
|
|
|
octoprint = 230;
|
2016-02-26 03:28:56 +01:00
|
|
|
avahi-autoipd = 231;
|
2016-02-26 15:19:46 +01:00
|
|
|
nntp-proxy = 232;
|
2016-03-12 15:38:13 +01:00
|
|
|
mjpg-streamer = 233;
|
2014-12-08 10:02:57 +01:00
|
|
|
|
2014-04-29 10:45:06 +02:00
|
|
|
# When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
|
2008-03-06 18:11:22 +01:00
|
|
|
|
2013-09-04 13:05:09 +02:00
|
|
|
nixbld = 30000; # start of range of uids
|
|
|
|
nobody = 65534;
|
|
|
|
};
|
|
|
|
|
|
|
|
ids.gids = {
|
|
|
|
root = 0;
|
|
|
|
wheel = 1;
|
|
|
|
kmem = 2;
|
|
|
|
tty = 3;
|
|
|
|
messagebus = 4; # D-Bus
|
|
|
|
haldaemon = 5;
|
|
|
|
disk = 6;
|
|
|
|
vsftpd = 7;
|
|
|
|
ftp = 8;
|
|
|
|
bitlbee = 9;
|
|
|
|
avahi = 10;
|
2015-03-08 21:35:04 +01:00
|
|
|
#nagios = 11; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
atd = 12;
|
|
|
|
postfix = 13;
|
|
|
|
postdrop = 14;
|
|
|
|
dovecot = 15;
|
2015-03-08 21:35:04 +01:00
|
|
|
tomcat = 16;
|
2013-09-04 13:05:09 +02:00
|
|
|
audio = 17;
|
|
|
|
floppy = 18;
|
|
|
|
uucp = 19;
|
|
|
|
lp = 20;
|
|
|
|
pulseaudio = 22; # must match `pulseaudio' UID
|
|
|
|
gpsd = 23;
|
|
|
|
cdrom = 24;
|
|
|
|
tape = 25;
|
|
|
|
video = 26;
|
|
|
|
dialout = 27;
|
2013-11-09 16:29:18 +01:00
|
|
|
#polkituser = 28; # currently unused, polkitd doesn't need a group
|
2013-09-04 13:05:09 +02:00
|
|
|
utmp = 29;
|
2015-03-08 21:35:04 +01:00
|
|
|
#ddclient = 30; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
davfs2 = 31;
|
|
|
|
privoxy = 32;
|
|
|
|
disnix = 33;
|
|
|
|
osgi = 34;
|
2014-12-06 10:37:31 +01:00
|
|
|
tor = 35;
|
2015-03-08 21:35:04 +01:00
|
|
|
#cups = 36; # unused
|
|
|
|
#foldingathome = 37; # unused
|
|
|
|
#sabnzd = 38; # unused
|
|
|
|
#kdm = 39; # unused
|
|
|
|
ghostone = 40;
|
2013-09-04 13:05:09 +02:00
|
|
|
git = 41;
|
2014-04-29 10:51:42 +02:00
|
|
|
fourstore = 42;
|
2015-03-08 21:35:04 +01:00
|
|
|
fourstorehttp = 43;
|
2013-09-04 13:05:09 +02:00
|
|
|
virtuoso = 44;
|
2015-03-08 21:35:04 +01:00
|
|
|
#rtkit = 45; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
dovecot2 = 46;
|
2015-03-08 21:35:04 +01:00
|
|
|
#dovenull = 47; # unused
|
|
|
|
#unbound = 48; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
prayer = 49;
|
|
|
|
mpd = 50;
|
|
|
|
clamav = 51;
|
|
|
|
fprot = 52;
|
2015-03-08 21:35:04 +01:00
|
|
|
#bind = 53; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
wwwrun = 54;
|
|
|
|
adm = 55;
|
|
|
|
spamd = 56;
|
|
|
|
networkmanager = 57;
|
|
|
|
nslcd = 58;
|
|
|
|
scanner = 59;
|
|
|
|
nginx = 60;
|
2015-07-12 07:13:04 +02:00
|
|
|
chrony = 61;
|
2013-09-04 13:05:09 +02:00
|
|
|
systemd-journal = 62;
|
|
|
|
smtpd = 63;
|
|
|
|
smtpq = 64;
|
|
|
|
supybot = 65;
|
|
|
|
iodined = 66;
|
|
|
|
libvirtd = 67;
|
|
|
|
graphite = 68;
|
2015-03-08 21:35:04 +01:00
|
|
|
#statsd = 69; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
transmission = 70;
|
|
|
|
postgres = 71;
|
|
|
|
vboxusers = 72;
|
|
|
|
vboxsf = 73;
|
2014-09-06 00:45:47 +02:00
|
|
|
smbguest = 74; # unused
|
2013-09-04 13:05:09 +02:00
|
|
|
varnish = 75;
|
2014-05-02 07:43:27 +02:00
|
|
|
datadog = 76;
|
2013-09-04 13:05:09 +02:00
|
|
|
lighttpd = 77;
|
|
|
|
lightdm = 78;
|
|
|
|
freenet = 79;
|
|
|
|
ircd = 80;
|
|
|
|
bacula = 81;
|
|
|
|
almir = 82;
|
|
|
|
deluge = 83;
|
|
|
|
mysql = 84;
|
|
|
|
rabbitmq = 85;
|
|
|
|
activemq = 86;
|
|
|
|
gnunet = 87;
|
|
|
|
oidentd = 88;
|
|
|
|
quassel = 89;
|
|
|
|
amule = 90;
|
|
|
|
minidlna = 91;
|
2015-03-08 21:35:04 +01:00
|
|
|
#elasticsearch = 92; # unused
|
|
|
|
#tcpcryptd = 93; # unused
|
2014-01-04 01:13:26 +01:00
|
|
|
connman = 94;
|
2015-03-08 21:35:04 +01:00
|
|
|
firebird = 95;
|
2014-02-11 13:00:10 +01:00
|
|
|
keys = 96;
|
2015-03-08 21:35:04 +01:00
|
|
|
haproxy = 97;
|
|
|
|
#mongodb = 98; # unused
|
|
|
|
openldap = 99;
|
|
|
|
munin = 102;
|
|
|
|
#logcheck = 103; # unused
|
|
|
|
#nix-ssh = 104; # unused
|
2014-02-21 12:40:05 +01:00
|
|
|
dictd = 105;
|
2014-02-27 14:33:30 +01:00
|
|
|
couchdb = 106;
|
2014-03-07 20:09:59 +01:00
|
|
|
searx = 107;
|
2014-03-12 08:32:56 +01:00
|
|
|
kippo = 108;
|
2014-02-10 21:07:12 +01:00
|
|
|
jenkins = 109;
|
2014-03-15 00:16:59 +01:00
|
|
|
systemd-journal-gateway = 110;
|
2016-01-07 04:34:31 +01:00
|
|
|
#notbit = 111; # unused
|
2015-03-08 21:35:04 +01:00
|
|
|
#ngircd = 112; # unused
|
2014-12-28 12:47:12 +01:00
|
|
|
btsync = 113;
|
2015-03-08 21:35:04 +01:00
|
|
|
#minecraft = 114; # unused
|
2014-04-01 19:41:37 +02:00
|
|
|
monetdb = 115;
|
2015-03-08 21:35:04 +01:00
|
|
|
#ripped = 116; # unused
|
|
|
|
#murmur = 117; # unused
|
2014-04-02 18:01:25 +02:00
|
|
|
foundationdb = 118;
|
|
|
|
newrelic = 119;
|
|
|
|
starbound = 120;
|
nixos: add grsecurity module (#1875)
This module implements a significant refactoring in grsecurity
configuration for NixOS, making it far more usable by default and much
easier to configure.
- New security.grsecurity NixOS attributes.
- All grsec kernels supported
- Allows default 'auto' grsec configuration, or custom config
- Supports custom kernel options through kernelExtraConfig
- Defaults to high-security - user must choose kernel, server/desktop
mode, and any virtualisation software. That's all.
- kptr_restrict is fixed under grsecurity (it's unwriteable)
- grsecurity patch creation is now significantly abstracted
- only need revision, version, and SHA1
- kernel version requirements are asserted for sanity
- built kernels can have the uname specify the exact grsec version
for development or bug reports. Off by default (requires
`security.grsecurity.config.verboseVersion = true;`)
- grsecurity sysctl support
- By default, disabled.
- For people who enable it, NixOS deploys a 'grsec-lock' systemd
service which runs at startup. You are expected to configure sysctl
through NixOS like you regularly would, which will occur before the
service is started. As a result, changing sysctl settings requires
a reboot.
- New default group: 'grsecurity'
- Root is a member by default
- GRKERNSEC_PROC_GID is implicitly set to the 'grsecurity' GID,
making it possible to easily add users to this group for /proc
access
- AppArmor is now automatically enabled where it wasn't before, despite
implying features.apparmor = true
The most trivial example of enabling grsecurity in your kernel is by
specifying:
security.grsecurity.enable = true;
security.grsecurity.testing = true; # testing 3.13 kernel
security.grsecurity.config.system = "desktop"; # or "server"
This specifies absolutely no virtualisation support. In general, you
probably at least want KVM host support, which is a little more work.
So:
security.grsecurity.enable = true;
security.grsecurity.stable = true; # enable stable 3.2 kernel
security.grsecurity.config = {
system = "server";
priority = "security";
virtualisationConfig = "host";
virtualisationSoftware = "kvm";
hardwareVirtualisation = true;
}
This module has primarily been tested on Hetzner EX40 & VQ7 servers
using NixOps.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-06 21:18:12 +02:00
|
|
|
grsecurity = 121;
|
2014-04-15 09:28:01 +02:00
|
|
|
hydra = 122;
|
2014-04-15 10:21:53 +02:00
|
|
|
spiped = 123;
|
2014-03-29 01:40:30 +01:00
|
|
|
teamspeak = 124;
|
2014-05-27 22:54:43 +02:00
|
|
|
influxdb = 125;
|
2014-06-12 11:20:43 +02:00
|
|
|
nsd = 126;
|
2015-03-08 21:35:04 +01:00
|
|
|
#gitolite = 127; # unused
|
2014-07-03 18:30:11 +02:00
|
|
|
znc = 128;
|
2014-07-15 16:16:58 +02:00
|
|
|
polipo = 129;
|
2014-07-28 19:52:32 +02:00
|
|
|
mopidy = 130;
|
2014-07-28 00:00:59 +02:00
|
|
|
docker = 131;
|
2014-04-02 18:21:00 +02:00
|
|
|
gdm = 132;
|
2015-03-08 21:35:04 +01:00
|
|
|
#dhcpcd = 133; # unused
|
2014-07-10 20:08:38 +02:00
|
|
|
siproxd = 134;
|
2014-07-09 00:43:26 +02:00
|
|
|
mlmmj = 135;
|
2015-03-08 21:35:04 +01:00
|
|
|
#neo4j = 136; # unused
|
2014-08-23 17:04:34 +02:00
|
|
|
riemann = 137;
|
2014-08-23 17:39:45 +02:00
|
|
|
riemanndash = 138;
|
2015-03-08 21:35:04 +01:00
|
|
|
#radvd = 139; # unused
|
|
|
|
#zookeeper = 140; # unused
|
|
|
|
#dnsmasq = 141; # unused
|
2014-09-01 08:53:00 +02:00
|
|
|
uhub = 142;
|
2015-03-08 21:35:04 +01:00
|
|
|
#yandexdisk = 143; # unused
|
|
|
|
#collectd = 144; # unused
|
|
|
|
#consul = 145; # unused
|
2014-09-26 10:03:29 +02:00
|
|
|
mailpile = 146;
|
2014-10-07 10:53:01 +02:00
|
|
|
redmine = 147;
|
2014-10-06 21:25:10 +02:00
|
|
|
seeks = 148;
|
2014-10-20 17:22:01 +02:00
|
|
|
prosody = 149;
|
2014-11-09 09:44:47 +01:00
|
|
|
i2pd = 150;
|
2015-03-15 22:19:48 +01:00
|
|
|
dnscrypt-proxy = 151;
|
2014-11-20 00:01:44 +01:00
|
|
|
systemd-network = 152;
|
|
|
|
systemd-resolve = 153;
|
|
|
|
systemd-timesync = 154;
|
2014-11-20 23:30:24 +01:00
|
|
|
liquidsoap = 155;
|
2015-03-08 21:35:04 +01:00
|
|
|
#etcd = 156; # unused
|
|
|
|
#docker-registry = 157; # unused
|
2015-03-03 20:21:36 +01:00
|
|
|
hbase = 158;
|
|
|
|
opentsdb = 159;
|
2015-01-05 11:58:17 +01:00
|
|
|
scollector = 160;
|
|
|
|
bosun = 161;
|
|
|
|
kubernetes = 162;
|
2015-03-08 21:35:04 +01:00
|
|
|
#peerflix = 163; # unused
|
|
|
|
#chronos = 164; # unused
|
2015-01-05 11:58:17 +01:00
|
|
|
gitlab = 165;
|
2015-03-03 20:21:36 +01:00
|
|
|
nylon = 168;
|
2014-12-08 10:02:57 +01:00
|
|
|
panamax = 170;
|
2015-02-18 19:55:07 +01:00
|
|
|
exim = 172;
|
2015-03-03 20:21:36 +01:00
|
|
|
fleet = 173;
|
2015-03-03 20:23:32 +01:00
|
|
|
input = 174;
|
2015-03-02 18:58:35 +01:00
|
|
|
sddm = 175;
|
2015-03-08 21:35:04 +01:00
|
|
|
tss = 176;
|
|
|
|
#memcached = 177; # unused
|
|
|
|
#ntp = 179; # unused
|
|
|
|
#zabbix = 180; # unused
|
|
|
|
#redis = 181; # unused
|
|
|
|
#unifi = 183; # unused
|
|
|
|
#uptimed = 184; # unused
|
|
|
|
#zope2 = 185; # unused
|
2015-03-22 23:12:11 +01:00
|
|
|
#ripple-data-api = 186; #unused
|
2015-03-27 11:48:50 +01:00
|
|
|
mediatomb = 187;
|
2015-04-05 06:20:04 +02:00
|
|
|
#rdnssd = 188; # unused
|
2015-04-11 00:09:31 +02:00
|
|
|
ihaskell = 189;
|
2015-04-15 12:52:06 +02:00
|
|
|
i2p = 190;
|
2015-04-14 01:06:37 +02:00
|
|
|
lambdabot = 191;
|
2015-04-17 00:53:26 +02:00
|
|
|
#asterisk = 192; # unused
|
2015-04-16 20:15:59 +02:00
|
|
|
plex = 193;
|
2015-05-01 21:38:00 +02:00
|
|
|
sabnzbd = 194;
|
2015-05-16 23:22:35 +02:00
|
|
|
bird = 195;
|
2015-04-25 16:02:44 +02:00
|
|
|
#grafana = 196; #unused
|
2015-06-08 13:36:05 +02:00
|
|
|
#skydns = 197; #unused
|
2015-06-08 12:58:33 +02:00
|
|
|
#ripple-rest = 198; #unused
|
2015-06-18 04:10:23 +02:00
|
|
|
#nix-serve = 199; #unused
|
2015-06-20 22:33:57 +02:00
|
|
|
#tvheadend = 200; #unused
|
2015-06-24 16:42:43 +02:00
|
|
|
uwsgi = 201;
|
2015-06-09 00:11:24 +02:00
|
|
|
gitit = 202;
|
2015-07-01 14:44:38 +02:00
|
|
|
riemanntools = 203;
|
2015-07-04 02:42:16 +02:00
|
|
|
subsonic = 204;
|
2015-07-21 12:16:18 +02:00
|
|
|
riak = 205;
|
2015-08-01 01:15:18 +02:00
|
|
|
#shout = 206; #unused
|
2015-07-31 06:22:44 +02:00
|
|
|
gateone = 207;
|
2015-09-10 18:04:04 +02:00
|
|
|
namecoin = 208;
|
2015-09-10 18:10:06 +02:00
|
|
|
#dnschain = 209; #unused
|
2015-09-14 08:27:31 +02:00
|
|
|
lxd = 210; # unused
|
2015-09-19 00:18:43 +02:00
|
|
|
#kibana = 211;
|
2015-09-13 14:49:19 +02:00
|
|
|
xtreemfs = 212;
|
2015-09-28 05:31:17 +02:00
|
|
|
calibre-server = 213;
|
2015-10-21 14:45:27 +02:00
|
|
|
bepasty = 215;
|
2015-11-29 22:28:29 +01:00
|
|
|
pumpio = 216;
|
2015-12-08 17:46:57 +01:00
|
|
|
nm-openvpn = 217;
|
2015-09-08 09:17:21 +02:00
|
|
|
mathics = 218;
|
2016-01-03 03:36:19 +01:00
|
|
|
ejabberd = 219;
|
2016-01-06 04:04:50 +01:00
|
|
|
postsrsd = 220;
|
2016-01-06 23:10:56 +01:00
|
|
|
opendkim = 221;
|
2016-01-07 02:17:42 +01:00
|
|
|
dspam = 222;
|
2015-08-03 19:04:10 +02:00
|
|
|
gale = 223;
|
2016-01-08 15:12:00 +01:00
|
|
|
matrix-synapse = 224;
|
2016-01-12 10:06:46 +01:00
|
|
|
rspamd = 225;
|
2016-01-14 10:17:27 +01:00
|
|
|
rmilter = 226;
|
2016-01-17 13:11:09 +01:00
|
|
|
cfdyndns = 227;
|
2016-02-16 18:35:01 +01:00
|
|
|
pdnsd = 229;
|
2016-02-14 12:58:09 +01:00
|
|
|
octoprint = 230;
|
2014-09-02 17:08:56 +02:00
|
|
|
|
2015-01-05 11:58:17 +01:00
|
|
|
# When adding a gid, make sure it doesn't match an existing
|
|
|
|
# uid. Users and groups with the same name should have equal
|
|
|
|
# uids and gids. Also, don't use gids above 399!
|
2011-04-15 18:10:17 +02:00
|
|
|
|
2013-09-04 13:05:09 +02:00
|
|
|
users = 100;
|
|
|
|
nixbld = 30000;
|
|
|
|
nogroup = 65534;
|
|
|
|
};
|
2009-08-11 11:17:30 +02:00
|
|
|
|
2007-06-08 17:41:12 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
}
|