Commit graph

786 commits

Author SHA1 Message Date
Jörg Thalheim
9b962429be
Merge pull request #133014 from Mic92/fix-pam
nixos: reduce pam files rebuilds on updates
2021-08-20 23:23:42 +01:00
Jörg Thalheim
1645acf1d3 nixos: reduce pam files rebuilds on updates
Before whenever environment variables changed, pam files had to be
rebuild.

This is expensive since each file needs its own sandbox set up.
2021-08-20 23:43:30 +02:00
Nikolay Amiantov
bd18e491a9 fontconfig service: drop dpi option
Recommend to use services.xserver.dpi option instead. Mention in the
documentation that it's a sledgehammer approach and monitor settings should be
used instead.

Also don't set DPI in fontconfig settings; fontconfig should use Xft settings
by default so let's not override one value in multiple places. For example,
user now can set DPI via ~/.Xresources properly.
2021-08-20 16:55:07 +00:00
Robert Hensing
fbafeb7ad5 treewide: runCommandNoCC -> runCommand
This has been synonymous for ~5y.
2021-08-15 17:36:41 +02:00
Ben Siraphob
b63a54f81c
Merge pull request #110742 from siraben/deprecate-fold 2021-07-27 15:13:31 +07:00
Jörg Thalheim
e2561ba61f
Merge pull request #129408 from kurnevsky/swap-luks-discards
nixos/swap: allow luks discards if swap discards are enabled
2021-07-23 11:11:04 +01:00
Robert Hensing
98352288bd
Merge pull request #128032 from Artturin/add-swap-options
nixos/swap: add options option
2021-07-23 10:45:53 +02:00
Artturin
c971de97c4 nixos/swap: add options option 2021-07-20 20:51:27 +03:00
Florian Klink
c1536f5c78 nixos/systemd: fix NSS database ordering
- The order of NSS (host) modules has been brought in line with upstream
  recommendations:

  - The `myhostname` module is placed before the `resolve` (optional) and `dns`
    entries, but after `file` (to allow overriding via `/etc/hosts` /
    `networking.extraHosts`, and prevent ISPs with catchall-DNS resolvers from
    hijacking `.localhost` domains)
  - The `mymachines` module, which provides hostname resolution for local
    containers (registered with `systemd-machined`) is placed to the front, to
    make sure its mappings are preferred over other resolvers.
  - If systemd-networkd is enabled, the `resolve` module is placed before
    `files` and `myhostname`, as it provides the same logic internally, with
    caching.
  - The `mdns(_minimal)` module has been updated to the new priorities.

  If you use your own NSS host modules, make sure to update your priorities
  according to these rules:

  - NSS modules which should be queried before `resolved` DNS resolution should
    use mkBefore.
  - NSS modules which should be queried after `resolved`, `files` and
    `myhostname`, but before `dns` should use the default priority
  - NSS modules which should come after `dns` should use mkAfter.
2021-07-17 23:55:35 +02:00
Evgeny Kurnevsky
11c0384bf0
nixos/swap: allow luks discards if swap discards are enabled 2021-07-06 10:18:58 +03:00
Jacob Hrbek
55a211ae31 Removed wrong comment 2021-06-30 21:32:08 +02:00
Jacob Hrbek
67af267cf7 Update nixos/modules/config/shells-environment.nix
lgtm

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
2021-06-30 21:27:56 +02:00
Jacob Hrbek
9e166662e0 localBinInPath: Initial commit 2021-06-27 07:31:45 +00:00
Minijackson
f4dd218c7c
nixos/xdg/portal/wlr: init 2021-06-20 11:53:45 +02:00
Sandro
2b49e4e735
Merge pull request #107728 from nessdoor/master 2021-06-15 14:40:21 +02:00
Naïm Favier
39bc736382
nixos/console: allow console.font to be a path
As for console.keyMap, all uses of this option are compatible with paths. This allows doing things like `console.font = pkgs.runCommand ...`.
2021-06-12 13:24:32 +02:00
Vladimír Čunát
2ee781417e
nixos/*: replace alsa* aliases
The attributes got renamed in PR #126440 and in some places this caused
evaluation errors, e.g. the tarball job was saying (locally)
> attribute 'alsaUtils' missing, at /build/source/nixos/modules/services/audio/alsa.nix:6:4
and I suspect that trunk-combined jobset's failure to evaluate was also caused.
2021-06-10 09:46:55 +02:00
Tomas Antonio Lopez
b922fa959b nixos/swap: add discardPolicy option
Add option for activating discards on swap partitions (none, once, pages and both).
2021-05-19 21:23:35 +09:00
Michael Raskin
d04f1c4314
Merge pull request #101071 from ju1m/apparmor
apparmor: try again to fix and improve
2021-04-24 11:24:26 +00:00
davidak
fabdd46503 kbdKeymaps: remove
dvp and neo are now included in kbd

includes documentation in release notes and alias
2021-04-23 16:41:06 +02:00
Julien Moutinho
05d334cfe2 Revert "Revert "apparmor: fix and improve the service""
This reverts commit 420f89ceb2.
2021-04-23 07:17:55 +02:00
Alyssa Ross
9e400a8b93 nixos/users-groups: check format of passwd entries
Things will get quite broken if an /etc/passwd entry contains a
colon (which terminates a field), or a newline (which terminates a
record).  I know because I just accidentally made a user whose home
directory path contained a newline!

So let's make sure that can't happen.
2021-04-22 13:18:38 +00:00
Bernardo Meurer
411d6aeb06
nixos/modules/config/iproute2: avoid using iproute alias 2021-04-20 01:01:33 -07:00
Symphorien Gibol
7a87973b4c nixos/users: require one of users.users.name.{isSystemUser,isNormalUser}
As the only consequence of isSystemUser is that if the uid is null then
it's allocated below 500, if a user has uid = something below 500 then
we don't require isSystemUser to be set.

Motivation: https://github.com/NixOS/nixpkgs/issues/112647
2021-04-14 20:40:00 +02:00
Jan Tojnar
c04a14edd6 Merge branch 'master' into staging-next 2021-04-06 16:01:14 +02:00
Lassulus
e2080b39e6
Merge pull request #89951 from KoviRobi/nixos-user-name-not-attr-name
nixos/users-groups: Use user name not attribute name for /etc/profiles/…
2021-04-05 13:52:25 +02:00
rnhmjoj
61b7cab481
treewide: use perl.withPackages when possible
Since 03eaa48 added perl.withPackages, there is a canonical way to
create a perl interpreter from a list of libraries, for use in script
shebangs or generic build inputs. This method is declarative (what we
are doing is clear), produces short shebangs[1] and needs not to wrap
existing scripts.

Unfortunately there are a few exceptions that I've found:

  1. Scripts that are calling perl with the -T switch. This makes perl
  ignore PERL5LIB, which is what perl.withPackages is using to inform
  the interpreter of the library paths.

  2. Perl packages that depends on libraries in their own path. This
  is not possible because perl.withPackages works at build time. The
  workaround is to add `-I $out/${perl.libPrefix}` to the shebang.

In all other cases I propose to switch to perl.withPackages.

[1]: https://lwn.net/Articles/779997/
2021-03-31 21:35:37 +02:00
Samuel Gräfenstein
e6cd793a74
nixos/config: move nano to defaultPackages
Some people already have another editor installed and may want to
get rid of applications they don't use.
2021-03-30 11:50:03 +02:00
Jaakko Luttinen
099a9e809c nixos/update-users-groups: read access to /etc/shadow for group shadow 2021-03-18 00:08:35 -07:00
Kovacsics Robert
af4adb1dd2 nixos/users-groups: Use user name not attribute name for /etc/profiles/...
This cropped up, because I have a set-up where my work username is
different to my home desktop username, and I am using a parameterized
config for both, so I have something akin to

    config.users.users.default-user = ...;

and using

    config.users.users.default-user.{name, home}

in certain places to cope with this. Noticed my home-manager bought in
packages (which use the users.users.<name>.packages hence NixOS issue
not home-manager) weren't present.
2021-02-27 12:45:49 +00:00
Florian Klink
47589ade46
Merge pull request #113804 from rnhmjoj/no-udev-settle-2
nixos/console: fix console setting reloading
2021-02-22 23:22:04 +01:00
rnhmjoj
9be0529210
nixos/console: fix console setting reloading
It's a dull and boring day, it's cold outside and I'm stuck at home: let
me tell you the story of systemd-vconsole-setup.

In the beginnings of NixOS[1], systemd-vconsole-setup was a powerful
sysinit.target unit, installed and running at boot to set up fonts
keyboard layouts and even colors of the virtual consoles. If needed, the
service would also be restarted after a configuration change, consoles
were happy and everything was good, well, almost.

Since the service had no way to specify the dependency "ttys are ready",
modesetting could sometimes happen *after* systemd-vconsole-setup had
started, leaving the console in a broken state. So abbradar worked
around that by putting a systemd-udev-settle `After=`.

In the meanwhile, probably realizing their mistake, systemd added a
shiny udev rule to start the systemd-udev-settle at the right time[2].
However, the rule bypassed systemd by directly running the binary
`systemd-udev-settle`, and the service - though still installed - fell
into disuse.

Two years would pass before a good samaritan, seeing the poor jobless
systemd-udev-settle service, decided to give it the coup de grâs[3] by
unlisting it from the installed units.
This, combined with another bug, caused quite a commotion[4] in NixOS;
to see why remember the fact that `WantedBy=` in upstream units doesn't
work[5], so it had to be added manually in cc542110, but while systemd
removed it, the NixOS unit continued to install and restart the service,
making a lot of fuss when switching configuration.

After at least thee different tentative fixes, deedrah realised[6] what
the root cause was and fpletz put the final nail[7] in the coffin of
systemd-udev-settle. The service would never see the light of a boot
again, NixOS would not restart it all the time but thanks to udev
consoles would still get their pretty fonts and playful colors.

The En..

..no, wait! You should ask what came of systemd-udev-settle, first.
And why is the service even around if udev is doing all the work?

Udev-settle, like the deceitful snake that he is, laid hidden for years.
He looks innocuous doesn't it? A little hack. Only until it leaves his
den and a poor user[8] drops dead. Obviously, it serves no purpose, as
the service is not part of the boot process anymore, so let's remove it
for good!

About the service, it may not be useful at boot, but it can be started
to pick up changes in vconsole.conf and set the consoles accordingly.
But wait, this doesn't work anymore: the service is never started at
boot (remember f76d2aa6), so switch-to-configuration.pl will not restart
it. Fortunately it can be repaired: here I install a new unit which
does *nothing* on start, but restarts the real service when reloaded.
This perfectly reproduces the original behavior, hopefully without the
original bugs too.

The End?

[1]: cc54211069
[2]: f6ba8671d8 (diff-84849fddcef81458f69725dc18c6614aade5c4f41a032b6908ebcf1ee6740636)
[3]: 8125e8d38e
[4]: https://web.archive.org/web/20180603130107/https://github.com/NixOS/nixpkgs/issues/22470
[5]: https://github.com/NixOS/nixpkgs/issues/81138
[6]: https://web.archive.org/web/20180603130107/https://github.com/NixOS/nixpkgs/issues/22470#issuecomment-330930456
[7]: f76d2aa6e3
[8]: https://github.com/NixOS/nixpkgs/issues/107341
2021-02-21 10:27:34 +01:00
nicoo
c8dcbfc047 nixos/swap: Remove dependency on rngd (module removed) 2021-02-21 01:33:50 +01:00
Lassulus
2489d95c1c
Merge pull request #110627 from 4z3/use-real-user-name-for-per-user-packages
nixos/users: use proper name for per-user packages
2021-02-15 12:45:24 +01:00
Ben Siraphob
1c2a2b0a08 treewide: fold -> foldr 2021-01-26 10:57:07 +07:00
Yorick van Pelt
9df9c1992b
beam-packages: move wxSupport arg up to package set, add beam_nox
This allows us to override the erlang wxSupport argument globally from
an overlay, fixing builds for e.g. rabbitmq with noXlibs set.
2021-01-24 21:04:52 +01:00
volth
bc0d605cf1 treewide: fix double quoted strings in meta.description
Signed-off-by: Ben Siraphob <bensiraphob@gmail.com>
2021-01-24 19:56:59 +07:00
tv
530d3ffbcc nixos/users: use proper name for per-user packages
Fixes #107353
2021-01-23 21:36:14 +01:00
Scriptkiddi
1572940688
networking, chrony, ntpd, timesyncd: add timeServers option type 2021-01-20 10:54:24 +01:00
WORLDofPEACE
35ad1687a7
Merge pull request #109060 from MetaDark/nixos/xdg/portal
nixos/xdg/portal: fix loading portals from systemd service
2021-01-20 03:29:16 -05:00
Pavol Rusnak
66dc9dbb59
nixos/modules: stdenv.lib -> lib 2021-01-17 21:40:51 +01:00
Kira Bruneau
a13064ae27 nixos/xdg/portal: fix loading portals from systemd service 2021-01-11 19:22:22 -05:00
Masanori Ogino
d1d6403cb5 nixos/networking: make /etc/netgroup by default
This will prevent nscd from complaining /etc/netgroup being absent.

Signed-off-by: Masanori Ogino <167209+omasanori@users.noreply.github.com>
2021-01-10 11:01:48 +09:00
Benjamin Asbach
e02bf0737b nufraw: init at 0.43-3
`nufraw` is used to manipulate raw images.
`nufraw-thumbnailer` is used to generate thumbnails for raw images.

relates #108444
2021-01-07 22:41:34 +01:00
Florian Klink
88738dd72d
Merge pull request #106787 from flokli/console-optional-display-manager
nixos/console: fix Before= on the systemd-vconsole-setup unit
2021-01-02 11:04:14 +01:00
Niklas Hambüchen
9206c0d115
Merge pull request #41966 from aneeshusa/allow-mutable-shells-for-declarative-users
nixos/users: Allow mutable shells for declarative users
2020-12-31 02:03:22 +01:00
rnhmjoj
9728907cd3
console: remove console.extraTTYs option
This closes issue #88085
2020-12-17 21:29:33 +01:00
Klemens Nanni
8833983f26 nixos/users-groups: createHome: Ensure HOME permissions, fix description
configuration.nix(1) states

    users.extraUsers.<name>.createHome
        [...] If [...] the home directory already exists but is not
        owned by the user, directory owner and group will be changed to
        match the user.

i.e. ownership would change only if the user mismatched;  the code
however ignores the owner, it is sufficient to enable `createHome`:

    if ($u->{createHome}) {
        make_path($u->{home}, { mode => 0700 }) if ! -e $u->{home};
        chown $u->{uid}, $u->{gid}, $u->{home};
    }

Furthermore, permissions are ignored on already existing directories and
therefore may allow others to read private data eventually.

Given that createHome already acts as switch to not only create but
effectively own the home directory, manage permissions in the same
manner to ensure the intended default and cover all primary attributes.

Avoid yet another configuration option to have administrators make a
clear and simple choice between securely managing home directories
and optionally defering management to own code (taking care of custom
location, ownership, mode, extended attributes, etc.).

While here, simplify and thereby fix misleading documentation.
2020-12-16 03:40:29 +01:00
Florian Klink
536988b35e nixos/console: fix Before= on the systemd-vconsole-setup unit
Only set Before=display-manager.service if it is actually present.

On headless systems, `systemctl list-units --state not-found` will
otherwise show display-manager.service.

Reported-In: https://github.com/NixOS/nixpkgs/issues/88597
2020-12-12 21:21:51 +01:00
Linus Heckemann
f448ec3365
Merge pull request #98731 from mayflower/ldap-nss-optional
config.users.ldap: do not include nss module if turned off
2020-12-12 10:53:39 +01:00