diff options
Diffstat (limited to 'nixos')
41 files changed, 2075 insertions, 1082 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index 0a9fec3d4c8..8c8a8151965 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -16,6 +16,8 @@ In addition to numerous new and upgraded packages, this release has the followin It's recommended to use `nixos-rebuild boot` and `reboot`, rather than `nixos-rebuild switch` - since in some rare cases the switch of a live system might fail. + - glibc: 2.35 -\> 2.37 + - Cinnamon has been updated to 5.6, see [the pull request](https://github.com/NixOS/nixpkgs/pull/201328#issue-1449910204) for what is changed. - GNOME has been upgraded to version 44. Please see the [release notes](https://release.gnome.org/44/) for details. @@ -47,6 +49,10 @@ In addition to numerous new and upgraded packages, this release has the followin - [gmediarender](https://github.com/hzeller/gmrender-resurrect), a simple, headless UPnP/DLNA renderer. Available as [services.gmediarender](options.html#opt-services.gmediarender.enable). +- [hyprland](https://github.com/hyprwm/hyprland), a dynamic tiling Wayland compositor that doesn't sacrifice on its looks. Available as [programs.hyprland](#opt-programs.hyprland.enable). + +- [minipro](https://gitlab.com/DavidGriffith/minipro/), an open source program for controlling the MiniPRO TL866xx series of chip programmers. Available as [programs.minipro](options.html#opt-programs.minipro.enable). + - [stevenblack-blocklist](https://github.com/StevenBlack/hosts), A unified hosts file with base extensions for blocking unwanted websites. Available as [networking.stevenblack](options.html#opt-networking.stevenblack.enable). - [Budgie Desktop](https://github.com/BuddiesOfBudgie/budgie-desktop), a familiar, modern desktop environment. Availabe as [services.xserver.desktopManager.budgie](options.html#opt-services.xserver.desktopManager.budgie). @@ -75,6 +81,8 @@ In addition to numerous new and upgraded packages, this release has the followin - [v2rayA](https://v2raya.org), a Linux web GUI client of Project V which supports V2Ray, Xray, SS, SSR, Trojan and Pingtunnel. Available as [services.v2raya](options.html#opt-services.v2raya.enable). +- [wstunnel](https://github.com/erebe/wstunnel), a proxy tunnelling arbitrary TCP or UDP traffic through a WebSocket connection. Instances may be configured via [services.wstunnel](options.html#opt-services.wstunnel.enable). + - [ulogd](https://www.netfilter.org/projects/ulogd/index.html), a userspace logging daemon for netfilter/iptables related logging. Available as [services.ulogd](options.html#opt-services.ulogd.enable). - [jellyseerr](https://github.com/Fallenbagel/jellyseerr), a web-based requests manager for Jellyfin, forked from Overseerr. Available as [services.jellyseerr](#opt-services.jellyseerr.enable). @@ -89,12 +97,18 @@ In addition to numerous new and upgraded packages, this release has the followin - [nimdow](https://github.com/avahe-kellenberger/nimdow), a window manager written in Nim, inspired by dwm. +- [trurl](https://github.com/curl/trurl), a command line tool for URL parsing and manipulation. + - [woodpecker-agents](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-agents](#opt-services.woodpecker-agents.agents._name_.enable). - [woodpecker-server](https://woodpecker-ci.org/), a simple CI engine with great extensibility. Available as [services.woodpecker-server](#opt-services.woodpecker-server.enable). - [ReGreet](https://github.com/rharish101/ReGreet), a clean and customizable greeter for greetd. Available as [programs.regreet](#opt-programs.regreet.enable). +- [v4l2-relayd](https://git.launchpad.net/v4l2-relayd), a streaming relay for v4l2loopback using gstreamer. Available as [services.v4l2-relayd](#opt-services.v4l2-relayd.instances._name_.enable). + +- [hardware.ipu6](#opt-hardware.ipu6.enable) adds support for ipu6 based webcams on intel tiger lake and alder lake. + ## Backward Incompatibilities {#sec-release-23.05-incompatibilities} <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> @@ -132,6 +146,8 @@ In addition to numerous new and upgraded packages, this release has the followin - The [services.unifi-video.openFirewall](#opt-services.unifi-video.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall. +- The option `i18n.inputMethod.fcitx5.enableRimeData` has been removed. Default RIME data is now included in `fcitx5-rime` by default, and can be customized using `fcitx5-rime.override { rimeDataPkgs = [ pkgs.rime-data, package2, ... ]; }` + - Kime has been updated from 2.5.6 to 3.0.2 and the `i18n.inputMethod.kime.config` option has been removed. Users should use `daemonModules`, `iconColor`, and `extraConfig` options under `i18n.inputMethod.kime` instead. - `tut` has been updated from 1.0.34 to 2.0.0, and now uses the TOML format for the configuration file instead of INI. Additional information can be found [here](https://github.com/RasmusLindroth/tut/releases/tag/2.0.0). @@ -211,6 +227,9 @@ In addition to numerous new and upgraded packages, this release has the followin - `go-ethereum` package has been updated to v1.11.5 and the `puppeth` command is no longer available as of v1.11.0. +- The `pnpm` package has be updated to from version 7.29.1 to version 8.1.1 and Node.js 14 support has been discontinued (though, there are workarounds if Node.js 14 is still required) + - Migration instructions: ["Before updating pnpm to v8 in your CI, regenerate your pnpm-lock.yaml. To upgrade your lockfile, run pnpm install and commit the changes. Existing dependencies will not be updated; however, due to configuration changes in pnpm v8, some missing peer dependencies may be added to the lockfile and some packages may get deduplicated. You can commit the new lockfile even before upgrading Node.js in the CI, as pnpm v7 already supports the new lockfile format."](https://github.com/pnpm/pnpm/releases/tag/v8.0.0) + ## Other Notable Changes {#sec-release-23.05-notable-changes} <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> @@ -235,6 +254,10 @@ In addition to numerous new and upgraded packages, this release has the followin - `services.openssh.ciphers` to `services.openssh.settings.Ciphers` - `services.openssh.gatewayPorts` to `services.openssh.settings.GatewayPorts` +- `netbox` was updated to 3.4. NixOS' `services.netbox.package` still defaults to 3.3 if `stateVersion` is earlier than 23.05. Please review upstream's [breaking changes](https://github.com/netbox-community/netbox/releases/tag/v3.4.0), and upgrade NetBox by changing `services.netbox.package`. Database migrations will be run automatically. + +- `services.netbox` now support RFC42-style options, through `services.netbox.settings`. + - `services.mastodon` gained a tootctl wrapped named `mastodon-tootctl` similar to `nextcloud-occ` which can be executed from any user and switches to the configured mastodon user with sudo and sources the environment variables. - DocBook option documentation, which has been deprecated since 22.11, will now cause a warning when documentation is built. Out-of-tree modules should migrate to using CommonMark documentation as outlined in [](#sec-option-declarations) to silence this warning. @@ -245,6 +268,12 @@ In addition to numerous new and upgraded packages, this release has the followin - `services.borgmatic` now allows for multiple configurations, placed in `/etc/borgmatic.d/`, you can define them with `services.borgmatic.configurations`. +- `service.openafsServer` features a new backup server `pkgs.fabs` as a + replacement for openafs's own `buserver`. See + [FABS](https://github.com/openafs-contrib/fabs) to check if this is an viable + replacement. It stores backups as volume dump files and thus better integrates + into contemporary backup solutions. + - The `dnsmasq` service now takes configuration via the `services.dnsmasq.settings` attribute set. The option `services.dnsmasq.extraConfig` will be deprecated when NixOS 22.11 reaches @@ -317,6 +346,8 @@ In addition to numerous new and upgraded packages, this release has the followin - Enabling global redirect in `services.nginx.virtualHosts` now allows one to add exceptions with the `locations` option. +- A new option `proxyCachePath` has been added to `services.nginx`. Learn more about proxy_cache_path: <https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_path>. + - A new option `recommendedBrotliSettings` has been added to `services.nginx`. Learn more about compression in Brotli format [here](https://github.com/google/ngx_brotli/blob/master/README.md). - Updated recommended settings in `services.nginx.recommendedGzipSettings`: @@ -369,12 +400,17 @@ In addition to numerous new and upgraded packages, this release has the followin - The option `services.prometheus.exporters.pihole.interval` does not exist anymore and has been removed. +- The option `services.gpsd.device` has been replaced with + `services.gpsd.devices`, which supports multiple devices. + - `k3s` can now be configured with an EnvironmentFile for its systemd service, allowing secrets to be provided without ending up in the Nix Store. - `boot.initrd.luks.device.<name>` has a new `tryEmptyPassphrase` option, this is useful for OEM's who need to install an encrypted disk with a future settable passphrase - Lisp gained a [manual section](https://nixos.org/manual/nixpkgs/stable/#lisp), documenting a new and backwards incompatible interface. The previous interface will be removed in a future release. +- The `bind` module now allows the per-zone `allow-query` setting to be configured (previously it was hard-coded to `any`; it still defaults to `any` to retain compatibility). + ## Detailed migration information {#sec-release-23.05-migration} ### Pipewire configuration overrides {#sec-release-23.05-migration-pipewire} diff --git a/nixos/modules/hardware/opengl.nix b/nixos/modules/hardware/opengl.nix index 7b5e669d47f..9108bcbd165 100644 --- a/nixos/modules/hardware/opengl.nix +++ b/nixos/modules/hardware/opengl.nix @@ -69,48 +69,19 @@ in package = mkOption { type = types.package; internal = true; - default = cfg.mesaPackage; description = lib.mdDoc '' The package that provides the OpenGL implementation. - - The default is Mesa's drivers which should cover all OpenGL-capable - hardware. If you want to use another Mesa version, adjust - {option}`mesaPackage`. ''; }; + package32 = mkOption { type = types.package; internal = true; - default = cfg.mesaPackage32; - description = lib.mdDoc '' - Same as {option}`package` but for the 32-bit OpenGL implementation on - 64-bit systems. Used when {option}`driSupport32Bit` is set. - ''; - }; - - mesaPackage = mkOption { - type = types.package; - default = pkgs.mesa; - defaultText = literalExpression "pkgs.mesa"; - example = literalExpression "pkgs.mesa_22"; description = lib.mdDoc '' - The Mesa driver package used for rendering support on the system. - - You should only need to adjust this if you require a newer Mesa - version for your hardware or because you need to patch a bug. + The package that provides the 32-bit OpenGL implementation on + 64-bit systems. Used when {option}`driSupport32Bit` is + set. ''; - apply = mesa: mesa.drivers or (throw "`mesa` package must have a `drivers` output."); - }; - mesaPackage32 = mkOption { - type = types.package; - default = pkgs.pkgsi686Linux.mesa; - defaultText = literalExpression "pkgs.pkgsi686Linux.mesa"; - example = literalExpression "pkgs.pkgsi686Linux.mesa_22"; - description = lib.mdDoc '' - Same as {option}`mesaPackage` but for the 32-bit Mesa on 64-bit - systems. Used when {option}`driSupport32Bit` is set. - ''; - apply = mesa: mesa.drivers or (throw "`mesa` package must have a `drivers` output."); }; extraPackages = mkOption { @@ -126,6 +97,7 @@ in ::: ''; }; + extraPackages32 = mkOption { type = types.listOf types.package; default = []; @@ -181,6 +153,9 @@ in environment.sessionVariables.LD_LIBRARY_PATH = mkIf cfg.setLdLibraryPath ([ "/run/opengl-driver/lib" ] ++ optional cfg.driSupport32Bit "/run/opengl-driver-32/lib"); + hardware.opengl.package = mkDefault pkgs.mesa.drivers; + hardware.opengl.package32 = mkDefault pkgs.pkgsi686Linux.mesa.drivers; + boot.extraModulePackages = optional (elem "virtualbox" videoDrivers) kernelPackages.virtualboxGuestAdditions; }; } diff --git a/nixos/modules/hardware/video/webcam/ipu6.nix b/nixos/modules/hardware/video/webcam/ipu6.nix new file mode 100644 index 00000000000..fce78cda34c --- /dev/null +++ b/nixos/modules/hardware/video/webcam/ipu6.nix @@ -0,0 +1,57 @@ +{ config, lib, pkgs, ... }: +let + + inherit (lib) mkDefault mkEnableOption mkIf mkOption optional types; + + cfg = config.hardware.ipu6; + +in +{ + + options.hardware.ipu6 = { + + enable = mkEnableOption (lib.mdDoc "support for Intel IPU6/MIPI cameras"); + + platform = mkOption { + type = types.enum [ "ipu6" "ipu6ep" ]; + description = lib.mdDoc '' + Choose the version for your hardware platform. + + Use `ipu6` for Tiger Lake and `ipu6ep` for Alder Lake respectively. + ''; + }; + + }; + + config = mkIf cfg.enable { + + boot.extraModulePackages = with config.boot.kernelPackages; [ + ipu6-drivers + ]; + + hardware.firmware = with pkgs; [ ] + ++ optional (cfg.platform == "ipu6") ipu6-camera-bin + ++ optional (cfg.platform == "ipu6ep") ipu6ep-camera-bin; + + services.udev.extraRules = '' + SUBSYSTEM=="intel-ipu6-psys", MODE="0660", GROUP="video" + ''; + + services.v4l2-relayd.instances.ipu6 = { + enable = mkDefault true; + + cardLabel = mkDefault "Intel MIPI Camera"; + + extraPackages = with pkgs.gst_all_1; [ ] + ++ optional (cfg.platform == "ipu6") icamerasrc-ipu6 + ++ optional (cfg.platform == "ipu6ep") icamerasrc-ipu6ep; + + input = { + pipeline = "icamerasrc"; + format = mkIf (cfg.platform == "ipu6ep") (mkDefault "NV12"); + }; + }; + + }; + +} diff --git a/nixos/modules/i18n/input-method/fcitx5.nix b/nixos/modules/i18n/input-method/fcitx5.nix index aa816c90a3d..7251240d26a 100644 --- a/nixos/modules/i18n/input-method/fcitx5.nix +++ b/nixos/modules/i18n/input-method/fcitx5.nix @@ -5,10 +5,9 @@ with lib; let im = config.i18n.inputMethod; cfg = im.fcitx5; - addons = cfg.addons ++ optional cfg.enableRimeData pkgs.rime-data; - fcitx5Package = pkgs.fcitx5-with-addons.override { inherit addons; }; - whetherRimeDataDir = any (p: p.pname == "fcitx5-rime") cfg.addons; -in { + fcitx5Package = pkgs.fcitx5-with-addons.override { inherit (cfg) addons; }; +in +{ options = { i18n.inputMethod.fcitx5 = { addons = mkOption { @@ -19,30 +18,23 @@ in { Enabled Fcitx5 addons. ''; }; - - enableRimeData = mkEnableOption (lib.mdDoc "default rime-data with fcitx5-rime"); }; }; + imports = [ + (mkRemovedOptionModule [ "i18n" "inputMethod" "fcitx5" "enableRimeData" ] '' + RIME data is now included in `fcitx5-rime` by default, and can be customized using `fcitx5-rime.override { rimeDataPkgs = ...; }` + '') + ]; + config = mkIf (im.enabled == "fcitx5") { i18n.inputMethod.package = fcitx5Package; - environment = mkMerge [{ - variables = { - GTK_IM_MODULE = "fcitx"; - QT_IM_MODULE = "fcitx"; - XMODIFIERS = "@im=fcitx"; - QT_PLUGIN_PATH = [ "${fcitx5Package}/${pkgs.qt6.qtbase.qtPluginPrefix}" ]; - }; - } - (mkIf whetherRimeDataDir { - pathsToLink = [ - "/share/rime-data" - ]; - - variables = { - NIX_RIME_DATA_DIR = "/run/current-system/sw/share/rime-data"; - }; - })]; + environment.variables = { + GTK_IM_MODULE = "fcitx"; + QT_IM_MODULE = "fcitx"; + XMODIFIERS = "@im=fcitx"; + QT_PLUGIN_PATH = [ "${fcitx5Package}/${pkgs.qt6.qtbase.qtPluginPrefix}" ]; + }; }; } diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix index bed50b81604..5b278b5e806 100644 --- a/nixos/modules/misc/ids.nix +++ b/nixos/modules/misc/ids.nix @@ -233,7 +233,7 @@ in # nix-serve = 199; # unused, removed 2020-12-12 #tvheadend = 200; # dynamically allocated as of 2021-09-18 uwsgi = 201; - gitit = 202; + # gitit = 202; # unused, module was removed 2023-04-03 riemanntools = 203; subsonic = 204; # riak = 205; # unused, remove 2022-07-22 diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index e10eea50114..bac096efac2 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -99,6 +99,7 @@ ./hardware/video/switcheroo-control.nix ./hardware/video/uvcvideo/default.nix ./hardware/video/webcam/facetimehd.nix + ./hardware/video/webcam/ipu6.nix ./hardware/wooting.nix ./hardware/xone.nix ./hardware/xpadneo.nix @@ -179,6 +180,7 @@ ./programs/haguichi.nix ./programs/hamster.nix ./programs/htop.nix + ./programs/hyprland.nix ./programs/iay.nix ./programs/iftop.nix ./programs/i3lock.nix @@ -195,6 +197,7 @@ ./programs/mdevctl.nix ./programs/mepo.nix ./programs/mininet.nix + ./programs/minipro.nix ./programs/miriway.nix ./programs/mosh.nix ./programs/msmtp.nix @@ -276,6 +279,7 @@ ./security/doas.nix ./security/duosec.nix ./security/google_oslogin.nix + ./security/ipa.nix ./security/lock-kernel-modules.nix ./security/misc.nix ./security/oath.nix @@ -612,7 +616,6 @@ ./services/misc/gammu-smsd.nix ./services/misc/geoipupdate.nix ./services/misc/gitea.nix - # ./services/misc/gitit.nix ./services/misc/gitlab.nix ./services/misc/gitolite.nix ./services/misc/gitweb.nix @@ -1039,6 +1042,7 @@ ./services/networking/wg-quick.nix ./services/networking/wireguard.nix ./services/networking/wpa_supplicant.nix + ./services/networking/wstunnel.nix ./services/networking/x2goserver.nix ./services/networking/xandikos.nix ./services/networking/xinetd.nix @@ -1128,6 +1132,7 @@ ./services/video/replay-sorcery.nix ./services/video/rtsp-simple-server.nix ./services/video/unifi-video.nix + ./services/video/v4l2-relayd.nix ./services/wayland/cage.nix ./services/web-apps/akkoma.nix ./services/web-apps/alps.nix diff --git a/nixos/modules/profiles/installation-device.nix b/nixos/modules/profiles/installation-device.nix index 980720691a4..32884f4b875 100644 --- a/nixos/modules/profiles/installation-device.nix +++ b/nixos/modules/profiles/installation-device.nix @@ -52,9 +52,9 @@ with lib; services.getty.helpLine = '' The "nixos" and "root" accounts have empty passwords. - An ssh daemon is running. You then must set a password - for either "root" or "nixos" with `passwd` or add an ssh key - to /home/nixos/.ssh/authorized_keys be able to login. + To log in over ssh you must set a password for either "nixos" or "root" + with `passwd` (prefix with `sudo` for "root"), or add your public key to + /home/nixos/.ssh/authorized_keys or /root/.ssh/authorized_keys. If you need a wireless connection, type `sudo systemctl start wpa_supplicant` and configure a @@ -65,8 +65,8 @@ with lib; start the graphical user interface. ''; - # We run sshd by default. Login via root is only possible after adding a - # password via "passwd" or by adding a ssh key to /home/nixos/.ssh/authorized_keys. + # We run sshd by default. Login is only possible after adding a + # password via "passwd" or by adding a ssh key to ~/.ssh/authorized_keys. # The latter one is particular useful if keys are manually added to # installation device for head-less systems i.e. arm boards by manually # mounting the storage in a different system. diff --git a/nixos/modules/profiles/macos-builder.nix b/nixos/modules/profiles/macos-builder.nix index 4a5359582bc..768c673e7f3 100644 --- a/nixos/modules/profiles/macos-builder.nix +++ b/nixos/modules/profiles/macos-builder.nix @@ -7,6 +7,8 @@ let keyType = "ed25519"; + cfg = config.virtualisation.darwin-builder; + in { @@ -24,156 +26,214 @@ in } ]; - # The builder is not intended to be used interactively - documentation.enable = false; - - environment.etc = { - "ssh/ssh_host_ed25519_key" = { - mode = "0600"; - - source = ./keys/ssh_host_ed25519_key; + options.virtualisation.darwin-builder = with lib; { + diskSize = mkOption { + default = 20 * 1024; + type = types.int; + example = 30720; + description = "The maximum disk space allocated to the runner in MB"; }; - - "ssh/ssh_host_ed25519_key.pub" = { - mode = "0644"; - - source = ./keys/ssh_host_ed25519_key.pub; + memorySize = mkOption { + default = 3 * 1024; + type = types.int; + example = 8192; + description = "The runner's memory in MB"; + }; + min-free = mkOption { + default = 1024 * 1024 * 1024; + type = types.int; + example = 1073741824; + description = '' + The threshold (in bytes) of free disk space left at which to + start garbage collection on the runner + ''; + }; + max-free = mkOption { + default = 3 * 1024 * 1024 * 1024; + type = types.int; + example = 3221225472; + description = '' + The threshold (in bytes) of free disk space left at which to + stop garbage collection on the runner + ''; + }; + workingDirectory = mkOption { + default = "."; + type = types.str; + example = "/var/lib/darwin-builder"; + description = '' + The working directory to use to run the script. When running + as part of a flake will need to be set to a non read-only filesystem. + ''; + }; + hostPort = mkOption { + default = 22; + type = types.int; + example = 31022; + description = '' + The localhost host port to forward TCP to the guest port. + ''; }; }; - # DNS fails for QEMU user networking (SLiRP) on macOS. See: - # - # https://github.com/utmapp/UTM/issues/2353 - # - # This works around that by using a public DNS server other than the DNS - # server that QEMU provides (normally 10.0.2.3) - networking.nameservers = [ "8.8.8.8" ]; + config = { + # The builder is not intended to be used interactively + documentation.enable = false; - nix.settings = { - auto-optimise-store = true; + environment.etc = { + "ssh/ssh_host_ed25519_key" = { + mode = "0600"; - min-free = 1024 * 1024 * 1024; + source = ./keys/ssh_host_ed25519_key; + }; - max-free = 3 * 1024 * 1024 * 1024; + "ssh/ssh_host_ed25519_key.pub" = { + mode = "0644"; - trusted-users = [ "root" user ]; - }; + source = ./keys/ssh_host_ed25519_key.pub; + }; + }; - services = { - getty.autologinUser = user; + # DNS fails for QEMU user networking (SLiRP) on macOS. See: + # + # https://github.com/utmapp/UTM/issues/2353 + # + # This works around that by using a public DNS server other than the DNS + # server that QEMU provides (normally 10.0.2.3) + networking.nameservers = [ "8.8.8.8" ]; - openssh = { - enable = true; + nix.settings = { + auto-optimise-store = true; - authorizedKeysFiles = [ "${keysDirectory}/%u_${keyType}.pub" ]; - }; - }; + min-free = cfg.min-free; - system.build.macos-builder-installer = - let - privateKey = "/etc/nix/${user}_${keyType}"; + max-free = cfg.max-free; - publicKey = "${privateKey}.pub"; + trusted-users = [ "root" user ]; + }; - # This installCredentials script is written so that it's as easy as - # possible for a user to audit before confirming the `sudo` - installCredentials = hostPkgs.writeShellScript "install-credentials" '' - KEYS="''${1}" - INSTALL=${hostPkgs.coreutils}/bin/install - "''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey} - "''${INSTALL}" -g nixbld -m 644 "''${KEYS}/${user}_${keyType}.pub" ${publicKey} - ''; + services = { + getty.autologinUser = user; - hostPkgs = config.virtualisation.host.pkgs; - - script = hostPkgs.writeShellScriptBin "create-builder" '' - KEYS="''${KEYS:-./keys}" - ${hostPkgs.coreutils}/bin/mkdir --parent "''${KEYS}" - PRIVATE_KEY="''${KEYS}/${user}_${keyType}" - PUBLIC_KEY="''${PRIVATE_KEY}.pub" - if [ ! -e "''${PRIVATE_KEY}" ] || [ ! -e "''${PUBLIC_KEY}" ]; then - ${hostPkgs.coreutils}/bin/rm --force -- "''${PRIVATE_KEY}" "''${PUBLIC_KEY}" - ${hostPkgs.openssh}/bin/ssh-keygen -q -f "''${PRIVATE_KEY}" -t ${keyType} -N "" -C 'builder@localhost' - fi - if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then - (set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}") - fi - KEYS="$(nix-store --add "$KEYS")" ${config.system.build.vm}/bin/run-nixos-vm - ''; + openssh = { + enable = true; - in - script.overrideAttrs (old: { - meta = (old.meta or { }) // { - platforms = lib.platforms.darwin; + authorizedKeysFiles = [ "${keysDirectory}/%u_${keyType}.pub" ]; }; - }); - - system = { - # To prevent gratuitous rebuilds on each change to Nixpkgs - nixos.revision = null; + }; - stateVersion = lib.mkDefault (throw '' - The macOS linux builder should not need a stateVersion to be set, but a module - has accessed stateVersion nonetheless. - Please inspect the trace of the following command to figure out which module - has a dependency on stateVersion. + system.build.macos-builder-installer = + let + privateKey = "/etc/nix/${user}_${keyType}"; + + publicKey = "${privateKey}.pub"; + + # This installCredentials script is written so that it's as easy as + # possible for a user to audit before confirming the `sudo` + installCredentials = hostPkgs.writeShellScript "install-credentials" '' + KEYS="''${1}" + INSTALL=${hostPkgs.coreutils}/bin/install + "''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey} + "''${INSTALL}" -g nixbld -m 644 "''${KEYS}/${user}_${keyType}.pub" ${publicKey} + ''; + + hostPkgs = config.virtualisation.host.pkgs; + + script = hostPkgs.writeShellScriptBin "create-builder" ( + # When running as non-interactively as part of a DarwinConfiguration the working directory + # must be set to a writeable directory. + (if cfg.workingDirectory != "." then '' + ${hostPkgs.coreutils}/bin/mkdir --parent "${cfg.workingDirectory}" + cd "${cfg.workingDirectory}" + '' else "") + '' + KEYS="''${KEYS:-./keys}" + ${hostPkgs.coreutils}/bin/mkdir --parent "''${KEYS}" + PRIVATE_KEY="''${KEYS}/${user}_${keyType}" + PUBLIC_KEY="''${PRIVATE_KEY}.pub" + if [ ! -e "''${PRIVATE_KEY}" ] || [ ! -e "''${PUBLIC_KEY}" ]; then + ${hostPkgs.coreutils}/bin/rm --force -- "''${PRIVATE_KEY}" "''${PUBLIC_KEY}" + ${hostPkgs.openssh}/bin/ssh-keygen -q -f "''${PRIVATE_KEY}" -t ${keyType} -N "" -C 'builder@localhost' + fi + if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then + (set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}") + fi + KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${config.system.build.vm}/bin/run-nixos-vm + ''); + + in + script.overrideAttrs (old: { + meta = (old.meta or { }) // { + platforms = lib.platforms.darwin; + }; + }); + + system = { + # To prevent gratuitous rebuilds on each change to Nixpkgs + nixos.revision = null; + + stateVersion = lib.mkDefault (throw '' + The macOS linux builder should not need a stateVersion to be set, but a module + has accessed stateVersion nonetheless. + Please inspect the trace of the following command to figure out which module + has a dependency on stateVersion. + + nix-instantiate --attr darwin.builder --show-trace + ''); + }; - nix-instantiate --attr darwin.builder --show-trace - ''); - }; + users.users."${user}" = { + isNormalUser = true; + }; - users.users."${user}" = { - isNormalUser = true; - }; + security.polkit.enable = true; - security.polkit.enable = true; + security.polkit.extraConfig = '' + polkit.addRule(function(action, subject) { + if (action.id === "org.freedesktop.login1.power-off" && subject.user === "${user}") { + return "yes"; + } else { + return "no"; + } + }) + ''; - security.polkit.extraConfig = '' - polkit.addRule(function(action, subject) { - if (action.id === "org.freedesktop.login1.power-off" && subject.user === "${user}") { - return "yes"; - } else { - return "no"; - } - }) - ''; + virtualisation = { + diskSize = cfg.diskSize; - virtualisation = { - diskSize = 20 * 1024; + memorySize = cfg.memorySize; - memorySize = 3 * 1024; + forwardPorts = [ + { from = "host"; guest.port = 22; host.port = cfg.hostPort; } + ]; - forwardPorts = [ - { from = "host"; guest.port = 22; host.port = 22; } - ]; + # Disable graphics for the builder since users will likely want to run it + # non-interactively in the background. + graphics = false; - # Disable graphics for the builder since users will likely want to run it - # non-interactively in the background. - graphics = false; + sharedDirectories.keys = { + source = "\"$KEYS\""; + target = keysDirectory; + }; - sharedDirectories.keys = { - source = "\"$KEYS\""; - target = keysDirectory; + # If we don't enable this option then the host will fail to delegate builds + # to the guest, because: + # + # - The host will lock the path to build + # - The host will delegate the build to the guest + # - The guest will attempt to lock the same path and fail because + # the lockfile on the host is visible on the guest + # + # Snapshotting the host's /nix/store as an image isolates the guest VM's + # /nix/store from the host's /nix/store, preventing this problem. + useNixStoreImage = true; + + # Obviously the /nix/store needs to be writable on the guest in order for it + # to perform builds. + writableStore = true; + + # This ensures that anything built on the guest isn't lost when the guest is + # restarted. + writableStoreUseTmpfs = false; }; - - # If we don't enable this option then the host will fail to delegate builds - # to the guest, because: - # - # - The host will lock the path to build - # - The host will delegate the build to the guest - # - The guest will attempt to lock the same path and fail because - # the lockfile on the host is visible on the guest - # - # Snapshotting the host's /nix/store as an image isolates the guest VM's - # /nix/store from the host's /nix/store, preventing this problem. - useNixStoreImage = true; - - # Obviously the /nix/store needs to be writable on the guest in order for it - # to perform builds. - writableStore = true; - - # This ensures that anything built on the guest isn't lost when the guest is - # restarted. - writableStoreUseTmpfs = false; }; } diff --git a/nixos/modules/programs/hyprland.nix b/nixos/modules/programs/hyprland.nix new file mode 100644 index 00000000000..b14f1f77fcf --- /dev/null +++ b/nixos/modules/programs/hyprland.nix @@ -0,0 +1,84 @@ +{ config +, lib +, pkgs +, ... +}: +with lib; let + cfg = config.programs.hyprland; + + defaultHyprlandPackage = pkgs.hyprland.override { + enableXWayland = cfg.xwayland.enable; + hidpiXWayland = cfg.xwayland.hidpi; + nvidiaPatches = cfg.nvidiaPatches; + }; +in +{ + options.programs.hyprland = { + enable = mkEnableOption null // { + description = mdDoc '' + Hyprland, the dynamic tiling Wayland compositor that doesn't sacrifice on its looks. + + You can manually launch Hyprland by executing {command}`Hyprland` on a TTY. + + A configuration file will be generated in {file}`~/.config/hypr/hyprland.conf`. + See <https://wiki.hyprland.org> for more information. + ''; + }; + + package = mkOption { + type = types.path; + default = defaultHyprlandPackage; + defaultText = literalExpression '' + pkgs.hyprland.override { + enableXWayland = config.programs.hyprland.xwayland.enable; + hidpiXWayland = config.programs.hyprland.xwayland.hidpi; + nvidiaPatches = config.programs.hyprland.nvidiaPatches; + } + ''; + example = literalExpression "<Hyprland flake>.packages.<system>.default"; + description = mdDoc '' + The Hyprland package to use. + Setting this option will make {option}`programs.hyprland.xwayland` and + {option}`programs.hyprland.nvidiaPatches` not work. + ''; + }; + + xwayland = { + enable = mkEnableOption (mdDoc "XWayland") // { default = true; }; + hidpi = mkEnableOption null // { + description = mdDoc '' + Enable HiDPI XWayland, based on [XWayland MR 733](https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/733). + See <https://wiki.hyprland.org/Nix/Options-Overrides/#xwayland-hidpi> for more info. + ''; + }; + }; + + nvidiaPatches = mkEnableOption (mdDoc "patching wlroots for better Nvidia support"); + }; + + config = mkIf cfg.enable { + environment = { + systemPackages = [ cfg.package ]; + + }; + + fonts.enableDefaultFonts = mkDefault true; + hardware.opengl.enable = mkDefault true; + + programs = { + dconf.enable = mkDefault true; + xwayland.enable = mkDefault true; + }; + + security.polkit.enable = true; + + services.xserver.displayManager.sessionPackages = [ cfg.package ]; + + xdg.portal = { + enable = mkDefault true; + extraPortals = [ + pkgs.xdg-desktop-portal-hyprland + ]; + }; + }; +} diff --git a/nixos/modules/programs/minipro.nix b/nixos/modules/programs/minipro.nix new file mode 100644 index 00000000000..a947f83f2ee --- /dev/null +++ b/nixos/modules/programs/minipro.nix @@ -0,0 +1,29 @@ +{ config, lib, pkgs, ... }: + +let + cfg = config.programs.minipro; +in +{ + options = { + programs.minipro = { + enable = lib.mkEnableOption (lib.mdDoc "minipro") // { + description = lib.mdDoc '' + Installs minipro and its udev rules. + Users of the `plugdev` group can interact with connected MiniPRO chip programmers. + ''; + }; + + package = lib.mkPackageOptionMD pkgs "minipro" { }; + }; + }; + + config = lib.mkIf cfg.enable { + users.groups.plugdev = { }; + environment.systemPackages = [ cfg.package ]; + services.udev.packages = [ cfg.package ]; + }; + + meta = { + maintainers = with lib.maintainers; [ infinidoge ]; + }; +} diff --git a/nixos/modules/programs/tsm-client.nix b/nixos/modules/programs/tsm-client.nix index 7adff7cd28c..41560544c2c 100644 --- a/nixos/modules/programs/tsm-client.nix +++ b/nixos/modules/programs/tsm-client.nix @@ -6,7 +6,7 @@ let inherit (lib.attrsets) attrNames filterAttrs hasAttr mapAttrs mapAttrsToList optionalAttrs; inherit (lib.modules) mkDefault mkIf; inherit (lib.options) literalExpression mkEnableOption mkOption; - inherit (lib.strings) concatStringsSep optionalString toLower; + inherit (lib.strings) concatLines optionalString toLower; inherit (lib.types) addCheck attrsOf lines nonEmptyStr nullOr package path port str strMatching submodule; # Checks if given list of strings contains unique @@ -164,7 +164,7 @@ let mkLine = k: v: k + optionalString (v!="") " ${v}"; lines = mapAttrsToList mkLine attrset; in - concatStringsSep "\n" lines; + concatLines lines; config.stanza = '' server ${config.name} ${config.text} @@ -263,7 +263,7 @@ let ${optionalString (cfg.defaultServername!=null) "defaultserver ${cfg.defaultServername}"} - ${concatStringsSep "\n" (mapAttrsToList (k: v: v.stanza) cfg.servers)} + ${concatLines (mapAttrsToList (k: v: v.stanza) cfg.servers)} ''; in diff --git a/nixos/modules/security/ipa.nix b/nixos/modules/security/ipa.nix new file mode 100644 index 00000000000..7075be95040 --- /dev/null +++ b/nixos/modules/security/ipa.nix @@ -0,0 +1,258 @@ +{ + config, + lib, + pkgs, + ... +}: +with lib; let + cfg = config.security.ipa; + pyBool = x: + if x + then "True" + else "False"; + + ldapConf = pkgs.writeText "ldap.conf" '' + # Turning this off breaks GSSAPI used with krb5 when rdns = false + SASL_NOCANON on + + URI ldaps://${cfg.server} + BASE ${cfg.basedn} + TLS_CACERT /etc/ipa/ca.crt + ''; + nssDb = + pkgs.runCommand "ipa-nssdb" + { + nativeBuildInputs = [pkgs.nss.tools]; + } '' + mkdir -p $out + certutil -d $out -N --empty-password + certutil -d $out -A --empty-password -n "${cfg.realm} IPA CA" -t CT,C,C -i ${cfg.certificate} + ''; +in { + options = { + security.ipa = { + enable = mkEnableOption (lib.mdDoc "FreeIPA domain integration"); + + certificate = mkOption { + type = types.package; + description = lib.mdDoc '' + IPA server CA certificate. + + Use `nix-prefetch-url http://$server/ipa/config/ca.crt` to + obtain the file and the hash. + ''; + example = literalExpression '' + pkgs.fetchurl { + url = http://ipa.example.com/ipa/config/ca.crt; + sha256 = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; + }; + ''; + }; + + domain = mkOption { + type = types.str; + example = "example.com"; + description = lib.mdDoc "Domain of the IPA server."; + }; + + realm = mkOption { + type = types.str; + example = "EXAMPLE.COM"; + description = lib.mdDoc "Kerberos realm."; + }; + + server = mkOption { + type = types.str; + example = "ipa.example.com"; + description = lib.mdDoc "IPA Server hostname."; + }; + + basedn = mkOption { + type = types.str; + example = "dc=example,dc=com"; + description = lib.mdDoc "Base DN to use when performing LDAP operations."; + }; + + offlinePasswords = mkOption { + type = types.bool; + default = true; + description = lib.mdDoc "Whether to store offline passwords when the server is down."; + }; + + cacheCredentials = mkOption { + type = types.bool; + default = true; + description = lib.mdDoc "Whether to cache credentials."; + }; + + ifpAllowedUids = mkOption { + type = types.listOf types.string; + default = ["root"]; + description = lib.mdDoc "A list of users allowed to access the ifp dbus interface."; + }; + + dyndns = { + enable = mkOption { + type = types.bool; + default = true; + description = lib.mdDoc "Whether to enable FreeIPA automatic hostname updates."; + }; + + interface = mkOption { + type = types.str; + example = "eth0"; + default = "*"; + description = lib.mdDoc "Network interface to perform hostname updates through."; + }; + }; + + chromiumSupport = mkOption { + type = types.bool; + default = true; + description = lib.mdDoc "Whether to whitelist the FreeIPA domain in Chromium."; + }; + }; + }; + + config = mkIf cfg.enable { + assertions = [ + { + assertion = !config.krb5.enable; + message = "krb5 must be disabled through `krb5.enable` for FreeIPA integration to work."; + } + { + assertion = !config.users.ldap.enable; + message = "ldap must be disabled through `users.ldap.enable` for FreeIPA integration to work."; + } + ]; + + environment.systemPackages = with pkgs; [krb5Full freeipa]; + + environment.etc = { + "ipa/default.conf".text = '' + [global] + basedn = ${cfg.basedn} + realm = ${cfg.realm} + domain = ${cfg.domain} + server = ${cfg.server} + host = ${config.networking.hostName} + xmlrpc_uri = https://${cfg.server}/ipa/xml + enable_ra = True + ''; + + "ipa/nssdb".source = nssDb; + + "krb5.conf".text = '' + [libdefaults] + default_realm = ${cfg.realm} + dns_lookup_realm = false + dns_lookup_kdc = true + rdns = false + ticket_lifetime = 24h + forwardable = true + udp_preference_limit = 0 + + [realms] + ${cfg.realm} = { + kdc = ${cfg.server}:88 + master_kdc = ${cfg.server}:88 + admin_server = ${cfg.server}:749 + default_domain = ${cfg.domain} + pkinit_anchors = FILE:/etc/ipa/ca.crt + } + + [domain_realm] + .${cfg.domain} = ${cfg.realm} + ${cfg.domain} = ${cfg.realm} + ${cfg.server} = ${cfg.realm} + + [dbmodules] + ${cfg.realm} = { + db_library = ${pkgs.freeipa}/lib/krb5/plugins/kdb/ipadb.so + } + ''; + + "openldap/ldap.conf".source = ldapConf; + }; + + environment.etc."chromium/policies/managed/freeipa.json" = mkIf cfg.chromiumSupport { + text = '' + { "AuthServerWhitelist": "*.${cfg.domain}" } + ''; + }; + + system.activationScripts.ipa = stringAfter ["etc"] '' + # libcurl requires a hard copy of the certificate + if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then + rm -f /etc/ipa/ca.crt + cp ${cfg.certificate} /etc/ipa/ca.crt + fi + + if [ ! -f /etc/krb5.keytab ]; then + cat <<EOF + + In order to complete FreeIPA integration, please join the domain by completing the following steps: + 1. Authenticate as an IPA user authorized to join new hosts, e.g. kinit admin@${cfg.realm} + 2. Join the domain and obtain the keytab file: ipa-join + 3. Install the keytab file: sudo install -m 600 krb5.keytab /etc/ + 4. Restart sssd systemd service: sudo systemctl restart sssd + + EOF + fi + ''; + + services.sssd.config = '' + [domain/${cfg.domain}] + id_provider = ipa + auth_provider = ipa + access_provider = ipa + chpass_provider = ipa + + ipa_domain = ${cfg.domain} + ipa_server = _srv_, ${cfg.server} + ipa_hostname = ${config.networking.hostName}.${cfg.domain} + + cache_credentials = ${pyBool cfg.cacheCredentials} + krb5_store_password_if_offline = ${pyBool cfg.offlinePasswords} + ${optionalString ((toLower cfg.domain) != (toLower cfg.realm)) + "krb5_realm = ${cfg.realm}"} + + dyndns_update = ${pyBool cfg.dyndns.enable} + dyndns_iface = ${cfg.dyndns.interface} + + ldap_tls_cacert = /etc/ipa/ca.crt + ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname, telephoneNumber:telephoneNumber, lock:nsaccountlock + + [sssd] + debug_level = 65510 + services = nss, sudo, pam, ssh, ifp + domains = ${cfg.domain} + + [nss] + homedir_substring = /home + + [pam] + pam_pwd_expiration_warning = 3 + pam_verbosity = 3 + + [sudo] + debug_level = 65510 + + [autofs] + + [ssh] + + [pac] + + [ifp] + user_attributes = +mail, +telephoneNumber, +givenname, +sn, +lock + allowed_uids = ${concatStringsSep ", " cfg.ifpAllowedUids} + ''; + + services.ntp.servers = singleton cfg.server; + services.sssd.enable = true; + services.ntp.enable = true; + + security.pki.certificateFiles = singleton cfg.certificate; + }; +} diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix index bc2d79ac10a..08a2967e9c7 100644 --- a/nixos/modules/services/backup/borgbackup.nix +++ b/nixos/modules/services/backup/borgbackup.nix @@ -66,6 +66,7 @@ let ${mkKeepArgs cfg} \ ${optionalString (cfg.prune.prefix != null) "--glob-archives ${escapeShellArg "${cfg.prune.prefix}*"}"} \ $extraPruneArgs + borg compact $extraArgs $extraCompactArgs ${cfg.postPrune} ''); @@ -638,6 +639,15 @@ in { example = "--save-space"; }; + extraCompactArgs = mkOption { + type = types.str; + description = lib.mdDoc '' + Additional arguments for {command}`borg compact`. + Can also be set at runtime using `$extraCompactArgs`. + ''; + default = ""; + example = "--cleanup-commits"; + }; }; } )); diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix index 5666199c484..595374ea1e5 100644 --- a/nixos/modules/services/continuous-integration/buildbot/master.nix +++ b/nixos/modules/services/continuous-integration/buildbot/master.nix @@ -8,7 +8,8 @@ let cfg = config.services.buildbot-master; opt = options.services.buildbot-master; - python = cfg.package.pythonModule; + package = pkgs.python3.pkgs.toPythonModule cfg.package; + python = package.pythonModule; escapeStr = escape [ "'" ]; @@ -212,10 +213,10 @@ in { package = mkOption { type = types.package; - default = pkgs.python3Packages.buildbot-full; - defaultText = literalExpression "pkgs.python3Packages.buildbot-full"; + default = pkgs.buildbot-full; + defaultText = literalExpression "pkgs.buildbot-full"; description = lib.mdDoc "Package to use for buildbot."; - example = literalExpression "pkgs.python3Packages.buildbot"; + example = literalExpression "pkgs.buildbot"; }; packages = mkOption { @@ -255,7 +256,7 @@ in { after = [ "network-online.target" ]; wantedBy = [ "multi-user.target" ]; path = cfg.packages ++ cfg.pythonPackages python.pkgs; - environment.PYTHONPATH = "${python.withPackages (self: cfg.pythonPackages self ++ [ cfg.package ])}/${python.sitePackages}"; + environment.PYTHONPATH = "${python.withPackages (self: cfg.pythonPackages self ++ [ package ])}/${python.sitePackages}"; preStart = '' mkdir -vp "${cfg.buildbotDir}" diff --git a/nixos/modules/services/continuous-integration/buildbot/worker.nix b/nixos/modules/services/continuous-integration/buildbot/worker.nix index 52c41c4a758..7e78b8935f8 100644 --- a/nixos/modules/services/continuous-integration/buildbot/worker.nix +++ b/nixos/modules/services/continuous-integration/buildbot/worker.nix @@ -8,7 +8,8 @@ let cfg = config.services.buildbot-worker; opt = options.services.buildbot-worker; - python = cfg.package.pythonModule; + package = pkgs.python3.pkgs.toPythonModule cfg.package; + python = package.pythonModule; tacFile = pkgs.writeText "aur-buildbot-worker.tac" '' import os @@ -129,7 +130,7 @@ in { package = mkOption { type = types.package; - default = pkgs.python3Packages.buildbot-worker; + default = pkgs.buildbot-worker; defaultText = literalExpression "pkgs.python3Packages.buildbot-worker"; description = lib.mdDoc "Package to use for buildbot worker."; example = literalExpression "pkgs.python2Packages.buildbot-worker"; @@ -168,7 +169,7 @@ in { after = [ "network.target" "buildbot-master.service" ]; wantedBy = [ "multi-user.target" ]; path = cfg.packages; - environment.PYTHONPATH = "${python.withPackages (p: [ cfg.package ])}/${python.sitePackages}"; + environment.PYTHONPATH = "${python.withPackages (p: [ package ])}/${python.sitePackages}"; preStart = '' mkdir -vp "${cfg.buildbotDir}/info" diff --git a/nixos/modules/services/hardware/auto-cpufreq.nix b/nixos/modules/services/hardware/auto-cpufreq.nix index 9698e72eb31..df7c01ae54e 100644 --- a/nixos/modules/services/hardware/auto-cpufreq.nix +++ b/nixos/modules/services/hardware/auto-cpufreq.nix @@ -2,10 +2,26 @@ with lib; let cfg = config.services.auto-cpufreq; + cfgFilename = "auto-cpufreq.conf"; + cfgFile = format.generate cfgFilename cfg.settings; + + format = pkgs.formats.ini {}; in { options = { services.auto-cpufreq = { enable = mkEnableOption (lib.mdDoc "auto-cpufreq daemon"); + + settings = mkOption { + description = lib.mdDoc '' + Configuration for `auto-cpufreq`. + + See its [example configuration file] for supported settings. + [example configuration file]: https://github.com/AdnanHodzic/auto-cpufreq/blob/master/auto-cpufreq.conf-example + ''; + + default = {}; + type = types.submodule { freeformType = format.type; }; + }; }; }; @@ -18,6 +34,11 @@ in { # Workaround for https://github.com/NixOS/nixpkgs/issues/81138 wantedBy = [ "multi-user.target" ]; path = with pkgs; [ bash coreutils ]; + + serviceConfig.ExecStart = [ + "" + "${lib.getExe pkgs.auto-cpufreq} --config ${cfgFile}" + ]; }; }; }; diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix index cea8a2b14cc..ac905a274af 100644 --- a/nixos/modules/services/home-automation/home-assistant.nix +++ b/nixos/modules/services/home-automation/home-assistant.nix @@ -35,7 +35,10 @@ let # ... # } ]; usedPlatforms = config: - if isAttrs config then + # don't recurse into derivations possibly creating an infinite recursion + if isDerivation config then + [ ] + else if isAttrs config then optional (config ? platform) config.platform ++ concatMap usedPlatforms (attrValues config) else if isList config then @@ -505,6 +508,7 @@ in { "mysensors" "nad" "numato" + "otbr" "rflink" "rfxtrx" "scsgate" diff --git a/nixos/modules/services/matrix/dendrite.nix b/nixos/modules/services/matrix/dendrite.nix index a8006547fc6..244c15fbf7a 100644 --- a/nixos/modules/services/matrix/dendrite.nix +++ b/nixos/modules/services/matrix/dendrite.nix @@ -159,6 +159,15 @@ in ''; }; }; + options.relay_api.database = { + connection_string = lib.mkOption { + type = lib.types.str; + default = "file:relayapi.db"; + description = lib.mdDoc '' + Database for the Relay Server. + ''; + }; + }; options.media_api = { database = { connection_string = lib.mkOption { @@ -294,7 +303,7 @@ in -o /run/dendrite/dendrite.yaml '']; ExecStart = lib.strings.concatStringsSep " " ([ - "${pkgs.dendrite}/bin/dendrite-monolith-server" + "${pkgs.dendrite}/bin/dendrite" "--config /run/dendrite/dendrite.yaml" ] ++ lib.optionals (cfg.httpPort != null) [ "--http-bind-address :${builtins.toString cfg.httpPort}" diff --git a/nixos/modules/services/misc/gitit.nix b/nixos/modules/services/misc/gitit.nix deleted file mode 100644 index 0fafa76b548..00000000000 --- a/nixos/modules/services/misc/gitit.nix +++ /dev/null @@ -1,725 +0,0 @@ -{ config, lib, pkgs, ... }: - -with lib; - -let - - cfg = config.services.gitit; - - homeDir = "/var/lib/gitit"; - - toYesNo = b: if b then "yes" else "no"; - - gititShared = with cfg.haskellPackages; gitit + "/share/" + ghc.targetPrefix + ghc.haskellCompilerName + "/" + gitit.pname + "-" + gitit.version; - - gititWithPkgs = hsPkgs: extras: hsPkgs.ghcWithPackages (self: with self; [ gitit ] ++ (extras self)); - - gititSh = hsPkgs: extras: with pkgs; let - env = gititWithPkgs hsPkgs extras; - in writeScript "gitit" '' - #!${runtimeShell} - cd $HOME - export NIX_GHC="${env}/bin/ghc" - export NIX_GHCPKG="${env}/bin/ghc-pkg" - export NIX_GHC_DOCDIR="${env}/share/doc/ghc/html" - export NIX_GHC_LIBDIR=$( $NIX_GHC --print-libdir ) - ${env}/bin/gitit -f ${configFile} - ''; - - gititOptions = { - - enable = mkOption { - type = types.bool; - default = false; - description = lib.mdDoc "Enable the gitit service."; - }; - - haskellPackages = mkOption { - default = pkgs.haskellPackages; - defaultText = literalExpression "pkgs.haskellPackages"; - example = literalExpression "pkgs.haskell.packages.ghc784"; - description = lib.mdDoc "haskellPackages used to build gitit and plugins."; - }; - - extraPackages = mkOption { - type = types.functionTo (types.listOf types.package); - default = self: []; - example = literalExpression '' - haskellPackages: [ - haskellPackages.wreq - ] - ''; - description = lib.mdDoc '' - Extra packages available to ghc when running gitit. The - value must be a function which receives the attrset defined - in {var}`haskellPackages` as the sole argument. - ''; - }; - - address = mkOption { - type = types.str; - default = "0.0.0.0"; - description = lib.mdDoc "IP address on which the web server will listen."; - }; - - port = mkOption { - type = types.int; - default = 5001; - description = lib.mdDoc "Port on which the web server will run."; - }; - - wikiTitle = mkOption { - type = types.str; - default = "Gitit!"; - description = lib.mdDoc "The wiki title."; - }; - - repositoryType = mkOption { - type = types.enum ["git" "darcs" "mercurial"]; - default = "git"; - description = lib.mdDoc "Specifies the type of repository used for wiki content."; - }; - - repositoryPath = mkOption { - type = types.path; - default = homeDir + "/wiki"; - description = lib.mdDoc '' - Specifies the path of the repository directory. If it does not - exist, gitit will create it on startup. - ''; - }; - - requireAuthentication = mkOption { - type = types.enum [ "none" "modify" "read" ]; - default = "modify"; - description = lib.mdDoc '' - If 'none', login is never required, and pages can be edited - anonymously. If 'modify', login is required to modify the wiki - (edit, add, delete pages, upload files). If 'read', login is - required to see any wiki pages. - ''; - }; - - authenticationMethod = mkOption { - type = types.enum [ "form" "http" "generic" "github" ]; - default = "form"; - description = lib.mdDoc '' - 'form' means that users will be logged in and registered using forms - in the gitit web interface. 'http' means that gitit will assume that - HTTP authentication is in place and take the logged in username from - the "Authorization" field of the HTTP request header (in addition, - the login/logout and registration links will be suppressed). - 'generic' means that gitit will assume that some form of - authentication is in place that directly sets REMOTE_USER to the name - of the authenticated user (e.g. mod_auth_cas on apache). 'rpx' means - that gitit will attempt to log in through https://rpxnow.com. This - requires that 'rpx-domain', 'rpx-key', and 'base-url' be set below, - and that 'curl' be in the system path. - ''; - }; - - userFile = mkOption { - type = types.path; - default = homeDir + "/gitit-users"; - description = lib.mdDoc '' - Specifies the path of the file containing user login information. If - it does not exist, gitit will create it (with an empty user list). - This file is not used if 'http' is selected for - authentication-method. - ''; - }; - - sessionTimeout = mkOption { - type = types.int; - default = 60; - description = lib.mdDoc '' - Number of minutes of inactivity before a session expires. - ''; - }; - - staticDir = mkOption { - type = types.path; - default = gititShared + "/data/static"; - description = lib.mdDoc '' - Specifies the path of the static directory (containing javascript, - css, and images). If it does not exist, gitit will create it and - populate it with required scripts, stylesheets, and images. - ''; - }; - - defaultPageType = mkOption { - type = types.enum [ "markdown" "rst" "latex" "html" "markdown+lhs" "rst+lhs" "latex+lhs" ]; - default = "markdown"; - description = lib.mdDoc '' - Specifies the type of markup used to interpret pages in the wiki. - Possible values are markdown, rst, latex, html, markdown+lhs, - rst+lhs, and latex+lhs. (the +lhs variants treat the input as - literate Haskell. See pandoc's documentation for more details.) If - Markdown is selected, pandoc's syntax extensions (for footnotes, - delimited code blocks, etc.) will be enabled. Note that pandoc's - restructuredtext parser is not complete, so some pages may not be - rendered correctly if rst is selected. The same goes for latex and - html. - ''; - }; - - math = mkOption { - type = types.enum [ "mathml" "raw" "mathjax" "jsmath" "google" ]; - default = "mathml"; - description = lib.mdDoc '' - Specifies how LaTeX math is to be displayed. Possible values are - mathml, raw, mathjax, jsmath, and google. If mathml is selected, - gitit will convert LaTeX math to MathML and link in a script, - MathMLinHTML.js, that allows the MathML to be seen in Gecko browsers, - IE + mathplayer, and Opera. In other browsers you may get a jumble of - characters. If raw is selected, the LaTeX math will be displayed as - raw LaTeX math. If mathjax is selected, gitit will link to the - remote mathjax script. If jsMath is selected, gitit will link to the - script /js/jsMath/easy/load.js, and will assume that jsMath has been - installed into the js/jsMath directory. This is the most portable - solution. If google is selected, the google chart API is called to - render the formula as an image. This requires a connection to google, - and might raise a technical or a privacy problem. - ''; - }; - - mathJaxScript = mkOption { - type = types.str; - default = "https://d3eoax9i5htok0.cloudfront.net/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML"; - description = lib.mdDoc '' - Specifies the path to MathJax rendering script. You might want to - use your own MathJax script to render formulas without Internet - connection or if you want to use some special LaTeX packages. Note: - path specified there cannot be an absolute path to a script on your - hdd, instead you should run your (local if you wish) HTTP server - which will serve the MathJax.js script. You can easily (in four lines - of code) serve MathJax.js using - http://happstack.com/docs/crashcourse/FileServing.html Do not forget - the "http://" prefix (e.g. http://localhost:1234/MathJax.js). - ''; - }; - - showLhsBirdTracks = mkOption { - type = types.bool; - default = false; - description = lib.mdDoc '' - Specifies whether to show Haskell code blocks in "bird style", with - "> " at the beginning of each line. - ''; - }; - - templatesDir = mkOption { - type = types.path; - default = gititShared + "/data/templates"; - description = lib.mdDoc '' - Specifies the path of the directory containing page templates. If it - does not exist, gitit will create it with default templates. Users - may wish to edit the templates to customize the appearance of their - wiki. The template files are HStringTemplate templates. Variables to - be interpolated appear between $\'s. Literal $\'s must be - backslash-escaped. - ''; - }; - - logFile = mkOption { - type = types.path; - default = homeDir + "/gitit.log"; - description = lib.mdDoc '' - Specifies the path of gitit's log file. If it does not exist, gitit - will create it. The log is in Apache combined log format. - ''; - }; - - logLevel = mkOption { - type = types.enum [ "DEBUG" "INFO" "NOTICE" "WARNING" "ERROR" "CRITICAL" "ALERT" "EMERGENCY" ]; - default = "ERROR"; - description = lib.mdDoc '' - Determines how much information is logged. Possible values (from - most to least verbose) are DEBUG, INFO, NOTICE, WARNING, ERROR, - CRITICAL, ALERT, EMERGENCY. - ''; - }; - - frontPage = mkOption { - type = types.str; - default = "Front Page"; - description = lib.mdDoc '' - Specifies which wiki page is to be used as the wiki's front page. - Gitit creates a default front page on startup, if one does not exist - already. - ''; - }; - - noDelete = mkOption { - type = types.str; - default = "Front Page, Help"; - description = lib.mdDoc '' - Specifies pages that cannot be deleted through the web interface. - (They can still be deleted directly using git or darcs.) A - comma-separated list of page names. Leave blank to allow every page - to be deleted. - ''; - }; - - noEdit = mkOption { - type = types.str; - default = "Help"; - description = lib.mdDoc '' - Specifies pages that cannot be edited through the web interface. - Leave blank to allow every page to be edited. - ''; - }; - - defaultSummary = mkOption { - type = types.str; - default = ""; - description = lib.mdDoc '' - Specifies text to be used in the change description if the author - leaves the "description" field blank. If default-summary is blank - (the default), the author will be required to fill in the description - field. - ''; - }; - - tableOfContents = mkOption { - type = types.bool; - default = true; - description = lib.mdDoc '' - Specifies whether to print a tables of contents (with links to - sections) on each wiki page. - ''; - }; - - plugins = mkOption { - type = with types; listOf str; - default = [ (gititShared + "/plugins/Dot.hs") ]; - description = lib.mdDoc '' - Specifies a list of plugins to load. Plugins may be specified either - by their path or by their module name. If the plugin name starts - with Gitit.Plugin., gitit will assume that the plugin is an installed - module and will not try to find a source file. - ''; - }; - - useCache = mkOption { - type = types.bool; - default = false; - description = lib.mdDoc '' - Specifies whether to cache rendered pages. Note that if use-feed is - selected, feeds will be cached regardless of the value of use-cache. - ''; - }; - - cacheDir = mkOption { - type = types.path; - default = homeDir + "/cache"; - description = lib.mdDoc "Path where rendered pages will be cached."; - }; - - maxUploadSize = mkOption { - type = types.str; - default = "1000K"; - description = lib.mdDoc '' - Specifies an upper limit on the size (in bytes) of files uploaded - through the wiki's web interface. To disable uploads, set this to - 0K. This will result in the uploads link disappearing and the - _upload url becoming inactive. - ''; - }; - - maxPageSize = mkOption { - type = types.str; - default = "1000K"; - description = lib.mdDoc "Specifies an upper limit on the size (in bytes) of pages."; - }; - - debugMode = mkOption { - type = types.bool; - default = false; - description = lib.mdDoc "Causes debug information to be logged while gitit is running."; - }; - - compressResponses = mkOption { - type = types.bool; - default = true; - description = lib.mdDoc "Specifies whether HTTP responses should be compressed."; - }; - - mimeTypesFile = mkOption { - type = types.path; - default = "/etc/mime/types.info"; - description = lib.mdDoc '' - Specifies the path of a file containing mime type mappings. Each - line of the file should contain two fields, separated by whitespace. - The first field is the mime type, the second is a file extension. - For example: - ``` - video/x-ms-wmx wmx - ``` - If the file is not found, some simple defaults will be used. - ''; - }; - - useReCaptcha = mkOption { - type = types.bool; - default = false; - description = lib.mdDoc '' - If true, causes gitit to use the reCAPTCHA service - (http://recaptcha.net) to prevent bots from creating accounts. - ''; - }; - - reCaptchaPrivateKey = mkOption { - type = with types; nullOr str; - default = null; - description = lib.mdDoc '' - Specifies the private key for the reCAPTCHA service. To get - these, you need to create an account at http://recaptcha.net. - ''; - }; - - reCaptchaPublicKey = mkOption { - type = with types; nullOr str; - default = null; - description = lib.mdDoc '' - Specifies the public key for the reCAPTCHA service. To get - these, you need to create an account at http://recaptcha.net. - ''; - }; - - accessQuestion = mkOption { - type = types.str; - default = "What is the code given to you by Ms. X?"; - description = lib.mdDoc '' - Specifies a question that users must answer when they attempt to - create an account - ''; - }; - - accessQuestionAnswers = mkOption { - type = types.str; - default = "RED DOG, red dog"; - description = lib.mdDoc '' - Specifies a question that users must answer when they attempt to - create an account, along with a comma-separated list of acceptable - answers. This can be used to institute a rudimentary password for - signing up as a user on the wiki, or as an alternative to reCAPTCHA. - Example: - access-question: What is the code given to you by Ms. X? - access-question-answers: RED DOG, red dog - ''; - }; - - rpxDomain = mkOption { - type = with types; nullOr str; - default = null; - description = lib.mdDoc '' - Specifies the domain and key of your RPX account. The domain is just - the prefix of the complete RPX domain, so if your full domain is - 'https://foo.rpxnow.com/', use 'foo' as the value of rpx-domain. - ''; - }; - - rpxKey = mkOption { - type = with types; nullOr str; - default = null; - description = lib.mdDoc "RPX account access key."; - }; - - mailCommand = mkOption { - type = types.str; - default = "sendmail %s"; - description = lib.mdDoc '' - Specifies the command to use to send notification emails. '%s' will - be replaced by the destination email address. The body of the - message will be read from stdin. If this field is left blank, - password reset will not be offered. - ''; - }; - - resetPasswordMessage = mkOption { - type = types.lines; - default = '' - > From: gitit@$hostname$ - > To: $useremail$ - > Subject: Wiki password reset - > - > Hello $username$, - > - > To reset your password, please follow the link below: - > http://$hostname$:$port$$resetlink$ - > - > Regards - ''; - description = lib.mdDoc '' - Gives the text of the message that will be sent to the user should - she want to reset her password, or change other registration info. - The lines must be indented, and must begin with '>'. The initial - spaces and '> ' will be stripped off. $username$ will be replaced by - the user's username, $useremail$ by her email address, $hostname$ by - the hostname on which the wiki is running (as returned by the - hostname system call), $port$ by the port on which the wiki is - running, and $resetlink$ by the relative path of a reset link derived - from the user's existing hashed password. If your gitit wiki is being - proxied to a location other than the root path of $port$, you should - change the link to reflect this: for example, to - http://$hostname$/path/to/wiki$resetlink$ or - http://gitit.$hostname$$resetlink$ - ''; - }; - - useFeed = mkOption { - type = types.bool; - default = false; - description = lib.mdDoc '' - Specifies whether an ATOM feed should be enabled (for the site and - for individual pages). - ''; - }; - - baseUrl = mkOption { - type = with types; nullOr str; - default = null; - description = lib.mdDoc '' - The base URL of the wiki, to be used in constructing feed IDs and RPX - token_urls. Set this if useFeed is false or authentication-method - is 'rpx'. - ''; - }; - - absoluteUrls = mkOption { - type = types.bool; - default = false; - description = lib.mdDoc '' - Make wikilinks absolute with respect to the base-url. So, for - example, in a wiki served at the base URL '/wiki', on a page - Sub/Page, the wikilink `[Cactus]()` will produce a link to - '/wiki/Cactus' if absoluteUrls is true, and a relative link to - 'Cactus' (referring to '/wiki/Sub/Cactus') if absolute-urls is 'no'. - ''; - }; - - feedDays = mkOption { - type = types.int; - default = 14; - description = lib.mdDoc "Number of days to be included in feeds."; - }; - - feedRefreshTime = mkOption { - type = types.int; - default = 60; - description = lib.mdDoc "Number of minutes to cache feeds before refreshing."; - }; - - pdfExport = mkOption { - type = types.bool; - default = false; - description = lib.mdDoc '' - If true, PDF will appear in export options. PDF will be created using - pdflatex, which must be installed and in the path. Note that PDF - exports create significant additional server load. - ''; - }; - - pandocUserData = mkOption { - type = with types; nullOr path; - default = null; - description = lib.mdDoc '' - If a directory is specified, this will be searched for pandoc - customizations. These can include a templates/ directory for custom - templates for various export formats, an S5 directory for custom S5 - styles, and a reference.odt for ODT exports. If no directory is - specified, $HOME/.pandoc will be searched. See pandoc's README for - more information. - ''; - }; - - xssSanitize = mkOption { - type = types.bool; - default = true; - description = lib.mdDoc '' - If true, all HTML (including that produced by pandoc) is filtered - through xss-sanitize. Set to no only if you trust all of your users. - ''; - }; - - oauthClientId = mkOption { - type = with types; nullOr str; - default = null; - description = lib.mdDoc "OAuth client ID"; - }; - - oauthClientSecret = mkOption { - type = with types; nullOr str; - default = null; - description = lib.mdDoc "OAuth client secret"; - }; - - oauthCallback = mkOption { - type = with types; nullOr str; - default = null; - description = lib.mdDoc "OAuth callback URL"; - }; - - oauthAuthorizeEndpoint = mkOption { - type = with types; nullOr str; - default = null; - description = lib.mdDoc "OAuth authorize endpoint"; - }; - - oauthAccessTokenEndpoint = mkOption { - type = with types; nullOr str; - default = null; - description = lib.mdDoc "OAuth access token endpoint"; - }; - - githubOrg = mkOption { - type = with types; nullOr str; - default = null; - description = lib.mdDoc "Github organization"; - }; - }; - - configFile = pkgs.writeText "gitit.conf" '' - address: ${cfg.address} - port: ${toString cfg.port} - wiki-title: ${cfg.wikiTitle} - repository-type: ${cfg.repositoryType} - repository-path: ${cfg.repositoryPath} - require-authentication: ${cfg.requireAuthentication} - authentication-method: ${cfg.authenticationMethod} - user-file: ${cfg.userFile} - session-timeout: ${toString cfg.sessionTimeout} - static-dir: ${cfg.staticDir} - default-page-type: ${cfg.defaultPageType} - math: ${cfg.math} - mathjax-script: ${cfg.mathJaxScript} - show-lhs-bird-tracks: ${toYesNo cfg.showLhsBirdTracks} - templates-dir: ${cfg.templatesDir} - log-file: ${cfg.logFile} - log-level: ${cfg.logLevel} - front-page: ${cfg.frontPage} - no-delete: ${cfg.noDelete} - no-edit: ${cfg.noEdit} - default-summary: ${cfg.defaultSummary} - table-of-contents: ${toYesNo cfg.tableOfContents} - plugins: ${concatStringsSep "," cfg.plugins} - use-cache: ${toYesNo cfg.useCache} - cache-dir: ${cfg.cacheDir} - max-upload-size: ${cfg.maxUploadSize} - max-page-size: ${cfg.maxPageSize} - debug-mode: ${toYesNo cfg.debugMode} - compress-responses: ${toYesNo cfg.compressResponses} - mime-types-file: ${cfg.mimeTypesFile} - use-recaptcha: ${toYesNo cfg.useReCaptcha} - recaptcha-private-key: ${toString cfg.reCaptchaPrivateKey} - recaptcha-public-key: ${toString cfg.reCaptchaPublicKey} - access-question: ${cfg.accessQuestion} - access-question-answers: ${cfg.accessQuestionAnswers} - rpx-domain: ${toString cfg.rpxDomain} - rpx-key: ${toString cfg.rpxKey} - mail-command: ${cfg.mailCommand} - reset-password-message: ${cfg.resetPasswordMessage} - use-feed: ${toYesNo cfg.useFeed} - base-url: ${toString cfg.baseUrl} - absolute-urls: ${toYesNo cfg.absoluteUrls} - feed-days: ${toString cfg.feedDays} - feed-refresh-time: ${toString cfg.feedRefreshTime} - pdf-export: ${toYesNo cfg.pdfExport} - pandoc-user-data: ${toString cfg.pandocUserData} - xss-sanitize: ${toYesNo cfg.xssSanitize} - - [Github] - oauthclientid: ${toString cfg.oauthClientId} - oauthclientsecret: ${toString cfg.oauthClientSecret} - oauthcallback: ${toString cfg.oauthCallback} - oauthauthorizeendpoint: ${toString cfg.oauthAuthorizeEndpoint} - oauthaccesstokenendpoint: ${toString cfg.oauthAccessTokenEndpoint} - github-org: ${toString cfg.githubOrg} - ''; - -in - -{ - - options.services.gitit = gititOptions; - - config = mkIf cfg.enable { - - users.users.gitit = { - group = config.users.groups.gitit.name; - description = "Gitit user"; - home = homeDir; - createHome = true; - uid = config.ids.uids.gitit; - }; - - users.groups.gitit.gid = config.ids.gids.gitit; - - systemd.services.gitit = let - uid = toString config.ids.uids.gitit; - gid = toString config.ids.gids.gitit; - in { - description = "Git and Pandoc Powered Wiki"; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - path = with pkgs; [ curl ] - ++ optional cfg.pdfExport texlive.combined.scheme-basic - ++ optional (cfg.repositoryType == "darcs") darcs - ++ optional (cfg.repositoryType == "mercurial") mercurial - ++ optional (cfg.repositoryType == "git") git; - - preStart = let - gm = "gitit@${config.networking.hostName}"; - in - with cfg; '' - chown ${uid}:${gid} -R ${homeDir} - for dir in ${repositoryPath} ${staticDir} ${templatesDir} ${cacheDir} - do - if [ ! -d $dir ] - then - mkdir -p $dir - find $dir -type d -exec chmod 0750 {} + - find $dir -type f -exec chmod 0640 {} + - fi - done - cd ${repositoryPath} - ${ - if repositoryType == "darcs" then - '' - if [ ! -d _darcs ] - then - darcs initialize - echo "${gm}" > _darcs/prefs/email - '' - else if repositoryType == "mercurial" then - '' - if [ ! -d .hg ] - then - hg init - cat >> .hg/hgrc <<NAMED -[ui] -username = gitit ${gm} -NAMED - '' - else - '' - if [ ! -d .git ] - then - git init - git config user.email "${gm}" - git config user.name "gitit" - ''} - chown ${uid}:${gid} -R ${repositoryPath} - fi - cd - - ''; - - serviceConfig = { - User = config.users.users.gitit.name; - Group = config.users.groups.gitit.name; - ExecStart = with cfg; gititSh haskellPackages extraPackages; - }; - }; - }; -} diff --git a/nixos/modules/services/misc/gpsd.nix b/nixos/modules/services/misc/gpsd.nix index 9b03b6f9662..ce0f9bb3ba2 100644 --- a/nixos/modules/services/misc/gpsd.nix +++ b/nixos/modules/services/misc/gpsd.nix @@ -1,4 +1,4 @@ -{ config, lib, pkgs, ... }: +{ config, lib, pkgs, utils, ... }: with lib; @@ -8,12 +8,15 @@ let gid = config.ids.gids.gpsd; cfg = config.services.gpsd; -in - -{ +in { ###### interface + imports = [ + (lib.mkRemovedOptionModule [ "services" "gpsd" "device" ] + "Use `services.gpsd.devices` instead.") + ]; + options = { services.gpsd = { @@ -26,13 +29,17 @@ in ''; }; - device = mkOption { - type = types.str; - default = "/dev/ttyUSB0"; + devices = mkOption { + type = types.listOf types.str; + default = [ "/dev/ttyUSB0" ]; description = lib.mdDoc '' - A device may be a local serial device for GPS input, or a URL of the form: - `[{dgpsip|ntrip}://][user:passwd@]host[:port][/stream]` - in which case it specifies an input source for DGPS or ntrip data. + List of devices that `gpsd` should subscribe to. + + A device may be a local serial device for GPS input, or a + URL of the form: + `[{dgpsip|ntrip}://][user:passwd@]host[:port][/stream]` in + which case it specifies an input source for DGPS or ntrip + data. ''; }; @@ -89,17 +96,16 @@ in }; - ###### implementation config = mkIf cfg.enable { - users.users.gpsd = - { inherit uid; - group = "gpsd"; - description = "gpsd daemon user"; - home = "/var/empty"; - }; + users.users.gpsd = { + inherit uid; + group = "gpsd"; + description = "gpsd daemon user"; + home = "/var/empty"; + }; users.groups.gpsd = { inherit gid; }; @@ -109,13 +115,15 @@ in after = [ "network.target" ]; serviceConfig = { Type = "forking"; - ExecStart = '' + ExecStart = let + devices = utils.escapeSystemdExecArgs cfg.devices; + in '' ${pkgs.gpsd}/sbin/gpsd -D "${toString cfg.debugLevel}" \ -S "${toString cfg.port}" \ ${optionalString cfg.readonly "-b"} \ ${optionalString cfg.nowait "-n"} \ ${optionalString cfg.listenany "-G"} \ - "${cfg.device}" + ${devices} ''; }; }; diff --git a/nixos/modules/services/network-filesystems/openafs/server.nix b/nixos/modules/services/network-filesystems/openafs/server.nix index 1c615d3bfb6..ad0fd783567 100644 --- a/nixos/modules/services/network-filesystems/openafs/server.nix +++ b/nixos/modules/services/network-filesystems/openafs/server.nix @@ -4,7 +4,8 @@ with import ./lib.nix { inherit config lib pkgs; }; let - inherit (lib) concatStringsSep literalExpression mkIf mkOption optionalString types; + inherit (lib) concatStringsSep literalExpression mkIf mkOption mkEnableOption + optionalString types; bosConfig = pkgs.writeText "BosConfig" ('' restrictmode 1 @@ -24,9 +25,15 @@ let parm ${openafsSrv}/libexec/openafs/salvageserver ${cfg.roles.fileserver.salvageserverArgs} parm ${openafsSrv}/libexec/openafs/dasalvager ${cfg.roles.fileserver.salvagerArgs} end - '') + (optionalString (cfg.roles.database.enable && cfg.roles.backup.enable) '' + '') + (optionalString (cfg.roles.database.enable && cfg.roles.backup.enable && (!cfg.roles.backup.enableFabs)) '' bnode simple buserver 1 - parm ${openafsSrv}/libexec/openafs/buserver ${cfg.roles.backup.buserverArgs} ${optionalString (cfg.roles.backup.cellServDB != []) "-cellservdb /etc/openafs/backup/"} + parm ${openafsSrv}/libexec/openafs/buserver ${cfg.roles.backup.buserverArgs} ${optionalString useBuCellServDB "-cellservdb /etc/openafs/backup/"} + end + '') + (optionalString (cfg.roles.database.enable && + cfg.roles.backup.enable && + cfg.roles.backup.enableFabs) '' + bnode simple buserver 1 + parm ${lib.getBin pkgs.fabs}/bin/fabsys server --config ${fabsConfFile} ${cfg.roles.backup.fabsArgs} end '')); @@ -34,12 +41,27 @@ let pkgs.writeText "NetInfo" ((concatStringsSep "\nf " cfg.advertisedAddresses) + "\n") else null; - buCellServDB = pkgs.writeText "backup-cellServDB-${cfg.cellName}" (mkCellServDB cfg.cellName cfg.roles.backup.cellServDB); + buCellServDB = pkgs.writeText "backup-cellServDB-${cfg.cellName}" + (mkCellServDB cfg.cellName cfg.roles.backup.cellServDB); + + useBuCellServDB = (cfg.roles.backup.cellServDB != []) && (!cfg.roles.backup.enableFabs); cfg = config.services.openafsServer; udpSizeStr = toString cfg.udpPacketSize; + fabsConfFile = pkgs.writeText "fabs.yaml" (builtins.toJSON ({ + afs = { + aklog = cfg.package + "/bin/aklog"; + cell = cfg.cellName; + dumpscan = cfg.package + "/bin/afsdump_scan"; + fs = cfg.package + "/bin/fs"; + pts = cfg.package + "/bin/pts"; + vos = cfg.package + "/bin/vos"; + }; + k5start.command = (lib.getBin pkgs.kstart) + "/bin/k5start"; + } // cfg.roles.backup.fabsExtraConfig)); + in { options = { @@ -80,8 +102,8 @@ in { }; package = mkOption { - default = pkgs.openafs.server or pkgs.openafs; - defaultText = literalExpression "pkgs.openafs.server or pkgs.openafs"; + default = pkgs.openafs; + defaultText = literalExpression "pkgs.openafs"; type = types.package; description = lib.mdDoc "OpenAFS package for the server binaries"; }; @@ -154,16 +176,20 @@ in { }; backup = { - enable = mkOption { - default = false; - type = types.bool; - description = lib.mdDoc '' - Backup server role. Use in conjunction with the - `database` role to maintain the Backup - Database. Normally only used in conjunction with tape storage - or IBM's Tivoli Storage Manager. - ''; - }; + enable = mkEnableOption (lib.mdDoc '' + Backup server role. When using OpenAFS built-in buserver, use in conjunction with the + `database` role to maintain the Backup + Database. Normally only used in conjunction with tape storage + or IBM's Tivoli Storage Manager. + + For a modern backup server, enable this role and see + {option}`enableFabs`. + ''); + + enableFabs = mkEnableOption (lib.mdDoc '' + FABS, the flexible AFS backup system. It stores volumes as dump files, relying on other + pre-existing backup solutions for handling them. + ''); buserverArgs = mkOption { default = ""; @@ -181,6 +207,30 @@ in { other database server machines. ''; }; + + fabsArgs = mkOption { + default = ""; + type = types.str; + description = lib.mdDoc '' + Arguments to the fabsys process. See + {manpage}`fabsys_server(1)` and + {manpage}`fabsys_config(1)`. + ''; + }; + + fabsExtraConfig = mkOption { + default = {}; + type = types.attrs; + description = lib.mdDoc '' + Additional configuration parameters for the FABS backup server. + ''; + example = literalExpression '' + { + afs.localauth = true; + afs.keytab = config.sops.secrets.fabsKeytab.path; + } + ''; + }; }; }; @@ -239,7 +289,7 @@ in { mode = "0644"; }; buCellServDB = { - enable = (cfg.roles.backup.cellServDB != []); + enable = useBuCellServDB; text = mkCellServDB cfg.cellName cfg.roles.backup.cellServDB; target = "openafs/backup/CellServDB"; }; @@ -257,7 +307,7 @@ in { preStart = '' mkdir -m 0755 -p /var/openafs ${optionalString (netInfo != null) "cp ${netInfo} /var/openafs/netInfo"} - ${optionalString (cfg.roles.backup.cellServDB != []) "cp ${buCellServDB}"} + ${optionalString useBuCellServDB "cp ${buCellServDB}"} ''; serviceConfig = { ExecStart = "${openafsBin}/bin/bosserver -nofork"; diff --git a/nixos/modules/services/networking/bind.nix b/nixos/modules/services/networking/bind.nix index f963e341546..f1829747bb1 100644 --- a/nixos/modules/services/networking/bind.nix +++ b/nixos/modules/services/networking/bind.nix @@ -36,6 +36,17 @@ let description = lib.mdDoc "Addresses who may request zone transfers."; default = [ ]; }; + allowQuery = mkOption { + type = types.listOf types.str; + description = lib.mdDoc '' + List of address ranges allowed to query this zone. Instead of the address(es), this may instead + contain the single string "any". + + NOTE: This overrides the global-level `allow-query` setting, which is set to the contents + of `cachenetworks`. + ''; + default = [ "any" ]; + }; extraConfig = mkOption { type = types.str; description = lib.mdDoc "Extra zone config to be appended at the end of the zone section."; @@ -69,7 +80,7 @@ let ${cfg.extraConfig} ${ concatMapStrings - ({ name, file, master ? true, slaves ? [], masters ? [], extraConfig ? "" }: + ({ name, file, master ? true, slaves ? [], masters ? [], allowQuery ? [], extraConfig ? "" }: '' zone "${name}" { type ${if master then "master" else "slave"}; @@ -87,7 +98,7 @@ let }; '' } - allow-query { any; }; + allow-query { ${concatMapStrings (ip: "${ip}; ") allowQuery}}; ${extraConfig} }; '') @@ -120,7 +131,9 @@ in description = lib.mdDoc '' What networks are allowed to use us as a resolver. Note that this is for recursive queries -- all networks are - allowed to query zones configured with the `zones` option. + allowed to query zones configured with the `zones` option + by default (although this may be overridden within each + zone's configuration, via the `allowQuery` option). It is recommended that you limit cacheNetworks to avoid your server being used for DNS amplification attacks. ''; diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix index 5e6f5217c0c..7caee8a8eb3 100644 --- a/nixos/modules/services/networking/ddclient.nix +++ b/nixos/modules/services/networking/ddclient.nix @@ -29,9 +29,9 @@ let configFile = if (cfg.configFile != null) then cfg.configFile else configFile'; preStart = '' - install ${configFile} /run/${RuntimeDirectory}/ddclient.conf + install --mode=600 --owner=$USER ${configFile} /run/${RuntimeDirectory}/ddclient.conf ${lib.optionalString (cfg.configFile == null) (if (cfg.protocol == "nsupdate") then '' - install ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key + install --mode=600 --owner=$USER ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key '' else if (cfg.passwordFile != null) then '' "${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "${cfg.passwordFile}" "/run/${RuntimeDirectory}/ddclient.conf" '' else '' diff --git a/nixos/modules/services/networking/dhcpd.nix b/nixos/modules/services/networking/dhcpd.nix index 0bd5e4ef553..a981a255c3e 100644 --- a/nixos/modules/services/networking/dhcpd.nix +++ b/nixos/modules/services/networking/dhcpd.nix @@ -218,6 +218,13 @@ in systemd.services = dhcpdService "4" cfg4 // dhcpdService "6" cfg6; + warnings = [ + '' + The dhcpd4 and dhcpd6 modules will be removed from NixOS 23.11, because ISC DHCP reached its end of life. + See https://www.isc.org/blogs/isc-dhcp-eol/ for details. + Please switch to a different implementation like kea, systemd-networkd or dnsmasq. + '' + ]; }; } diff --git a/nixos/modules/services/networking/smokeping.nix b/nixos/modules/services/networking/smokeping.nix index 2e67f8b77c0..c2c2a370cb0 100644 --- a/nixos/modules/services/networking/smokeping.nix +++ b/nixos/modules/services/networking/smokeping.nix @@ -42,7 +42,7 @@ let configPath = pkgs.writeText "smokeping.conf" configFile; cgiHome = pkgs.writeScript "smokeping.fcgi" '' #!${pkgs.bash}/bin/bash - ${cfg.package}/bin/smokeping_cgi ${configPath} + ${cfg.package}/bin/smokeping_cgi /etc/smokeping.conf ''; in @@ -307,6 +307,7 @@ in source = "${pkgs.fping}/bin/fping"; }; }; + environment.etc."smokeping.conf".source = configPath; environment.systemPackages = [ pkgs.fping ]; users.users.${cfg.user} = { isNormalUser = false; @@ -327,18 +328,23 @@ in # Thus, we need to make `smokepingHome` (which is given to `thttpd -d` below) `755`. homeMode = "755"; }; - users.groups.${cfg.user} = {}; + users.groups.${cfg.user} = { }; systemd.services.smokeping = { - requiredBy = [ "multi-user.target"]; + reloadTriggers = [ configPath ]; + requiredBy = [ "multi-user.target" ]; serviceConfig = { User = cfg.user; Restart = "on-failure"; - ExecStart = "${cfg.package}/bin/smokeping --config=${configPath} --nodaemon"; + ExecStart = "${cfg.package}/bin/smokeping --config=/etc/smokeping.conf --nodaemon"; }; preStart = '' mkdir -m 0755 -p ${smokepingHome}/cache ${smokepingHome}/data rm -f ${smokepingHome}/cropper ln -s ${cfg.package}/htdocs/cropper ${smokepingHome}/cropper + rm -f ${smokepingHome}/css + ln -s ${cfg.package}/htdocs/css ${smokepingHome}/css + rm -f ${smokepingHome}/js + ln -s ${cfg.package}/htdocs/js ${smokepingHome}/js rm -f ${smokepingHome}/smokeping.fcgi ln -s ${cgiHome} ${smokepingHome}/smokeping.fcgi ${cfg.package}/bin/smokeping --check --config=${configPath} diff --git a/nixos/modules/services/networking/wstunnel.nix b/nixos/modules/services/networking/wstunnel.nix new file mode 100644 index 00000000000..440b617f60a --- /dev/null +++ b/nixos/modules/services/networking/wstunnel.nix @@ -0,0 +1,429 @@ +{ config, lib, options, pkgs, utils, ... }: +with lib; +let + cfg = config.services.wstunnel; + attrsToArgs = attrs: utils.escapeSystemdExecArgs ( + mapAttrsToList + (name: value: if value == true then "--${name}" else "--${name}=${value}") + attrs + ); + hostPortSubmodule = { + options = { + host = mkOption { + description = mdDoc "The hostname."; + type = types.str; + }; + port = mkOption { + description = mdDoc "The port."; + type = types.port; + }; + }; + }; + localRemoteSubmodule = { + options = { + local = mkOption { + description = mdDoc "Local address and port to listen on."; + type = types.submodule hostPortSubmodule; + example = { + host = "127.0.0.1"; + port = 51820; + }; + }; + remote = mkOption { + description = mdDoc "Address and port on remote to forward traffic to."; + type = types.submodule hostPortSubmodule; + example = { + host = "127.0.0.1"; + port = 51820; + }; + }; + }; + }; + hostPortToString = { host, port }: "${host}:${builtins.toString port}"; + localRemoteToString = { local, remote }: utils.escapeSystemdExecArg "${hostPortToString local}:${hostPortToString remote}"; + commonOptions = { + enable = mkOption { + description = mdDoc "Whether to enable this `wstunnel` instance."; + type = types.bool; + default = true; + }; + + package = mkPackageOptionMD pkgs "wstunnel" {}; + + autoStart = mkOption { + description = mdDoc "Whether this tunnel server should be started automatically."; + type = types.bool; + default = true; + }; + + extraArgs = mkOption { + description = mdDoc "Extra command line arguments to pass to `wstunnel`. Attributes of the form `argName = true;` will be translated to `--argName`, and `argName = \"value\"` to `--argName=value`."; + type = with types; attrsOf (either str bool); + default = {}; + example = { + "someNewOption" = true; + "someNewOptionWithValue" = "someValue"; + }; + }; + + verboseLogging = mkOption { + description = mdDoc "Enable verbose logging."; + type = types.bool; + default = false; + }; + + environmentFile = mkOption { + description = mdDoc "Environment file to be passed to the systemd service. Useful for passing secrets to the service to prevent them from being world-readable in the Nix store. Note however that the secrets are passed to `wstunnel` through the command line, which makes them locally readable for all users of the system at runtime."; + type = types.nullOr types.path; + default = null; + example = "/var/lib/secrets/wstunnelSecrets"; + }; + }; + + serverSubmodule = { config, ...}: { + options = commonOptions // { + listen = mkOption { + description = mdDoc "Address and port to listen on. Setting the port to a value below 1024 will also give the process the required `CAP_NET_BIND_SERVICE` capability."; + type = types.submodule hostPortSubmodule; + default = { + address = "0.0.0.0"; + port = if config.enableHTTPS then 443 else 80; + }; + defaultText = literalExpression '' + { + address = "0.0.0.0"; + port = if enableHTTPS then 443 else 80; + } + ''; + }; + + restrictTo = mkOption { + description = mdDoc "Accepted traffic will be forwarded only to this service. Set to `null` to allow forwarding to arbitrary addresses."; + type = types.nullOr (types.submodule hostPortSubmodule); + example = { + host = "127.0.0.1"; + port = 51820; + }; + }; + + enableHTTPS = mkOption { + description = mdDoc "Use HTTPS for the tunnel server."; + type = types.bool; + default = true; + }; + + tlsCertificate = mkOption { + description = mdDoc "TLS certificate to use instead of the hardcoded one in case of HTTPS connections. Use together with `tlsKey`."; + type = types.nullOr types.path; + default = null; + example = "/var/lib/secrets/cert.pem"; + }; + + tlsKey = mkOption { + description = mdDoc "TLS key to use instead of the hardcoded on in case of HTTPS connections. Use together with `tlsCertificate`."; + type = types.nullOr types.path; + default = null; + example = "/var/lib/secrets/key.pem"; + }; + + useACMEHost = mkOption { + description = mdDoc "Use a certificate generated by the NixOS ACME module for the given host. Note that this will not generate a new certificate - you will need to do so with `security.acme.certs`."; + type = types.nullOr types.str; + default = null; + example = "example.com"; + }; + }; + }; + clientSubmodule = { config, ... }: { + options = commonOptions // { + connectTo = mkOption { + description = mdDoc "Server address and port to connect to."; + type = types.submodule hostPortSubmodule; + example = { + host = "example.com"; + }; + }; + + enableHTTPS = mkOption { + description = mdDoc "Enable HTTPS when connecting to the server."; + type = types.bool; + default = true; + }; + + localToRemote = mkOption { + description = mdDoc "Local hosts and ports to listen on, plus the hosts and ports on remote to forward traffic to. Setting a local port to a value less than 1024 will additionally give the process the required CAP_NET_BIND_SERVICE capability."; + type = types.listOf (types.submodule localRemoteSubmodule); + default = []; + example = [ { + local = { + host = "127.0.0.1"; + port = 8080; + }; + remote = { + host = "127.0.0.1"; + port = 8080; + }; + } ]; + }; + + dynamicToRemote = mkOption { + description = mdDoc "Host and port for the SOCKS5 proxy to dynamically forward traffic to. Leave this at `null` to disable the SOCKS5 proxy. Setting the port to a value less than 1024 will additionally give the service the required CAP_NET_BIND_SERVICE capability."; + type = types.nullOr (types.submodule hostPortSubmodule); + default = null; + example = { + host = "127.0.0.1"; + port = 1080; + }; + }; + + udp = mkOption { + description = mdDoc "Whether to forward UDP instead of TCP traffic."; + type = types.bool; + default = false; + }; + + udpTimeout = mkOption { + description = mdDoc "When using UDP forwarding, timeout in seconds after which the tunnel connection is closed. `-1` means no timeout."; + type = types.int; + default = 30; + }; + + httpProxy = mkOption { + description = mdDoc '' + Proxy to use to connect to the wstunnel server (`USER:PASS@HOST:PORT`). + + ::: {.warning} + Passwords specified here will be world-readable in the Nix store! To pass a password to the service, point the `environmentFile` option to a file containing `PROXY_PASSWORD=<your-password-here>` and set this option to `<user>:$PROXY_PASSWORD@<host>:<port>`. Note however that this will also locally leak the passwords at runtime via e.g. /proc/<pid>/cmdline. + + ::: + ''; + type = types.nullOr types.str; + default = null; + }; + + soMark = mkOption { + description = mdDoc "Mark network packets with the SO_MARK sockoption with the specified value. Setting this option will also enable the required `CAP_NET_ADMIN` capability for the systemd service."; + type = types.nullOr types.int; + default = null; + }; + + upgradePathPrefix = mkOption { + description = mdDoc "Use a specific HTTP path prefix that will show up in the upgrade request to the `wstunnel` server. Useful when running `wstunnel` behind a reverse proxy."; + type = types.nullOr types.str; + default = null; + example = "wstunnel"; + }; + + hostHeader = mkOption { + description = mdDoc "Use this as the HTTP host header instead of the real hostname. Useful for circumventing hostname-based firewalls."; + type = types.nullOr types.str; + default = null; + }; + + tlsSNI = mkOption { + description = mdDoc "Use this as the SNI while connecting via TLS. Useful for circumventing hostname-based firewalls."; + type = types.nullOr types.str; + default = null; + }; + + tlsVerifyCertificate = mkOption { + description = mdDoc "Whether to verify the TLS certificate of the server. It might be useful to set this to `false` when working with the `tlsSNI` option."; + type = types.bool; + default = true; + }; + + # The original argument name `websocketPingFrequency` is a misnomer, as the frequency is the inverse of the interval. + websocketPingInterval = mkOption { + description = mdDoc "Do a heartbeat ping every N seconds to keep up the websocket connection."; + type = types.nullOr types.ints.unsigned; + default = null; + }; + + upgradeCredentials = mkOption { + description = mdDoc '' + Use these credentials to authenticate during the HTTP upgrade request (Basic authorization type, `USER:[PASS]`). + + ::: {.warning} + Passwords specified here will be world-readable in the Nix store! To pass a password to the service, point the `environmentFile` option to a file containing `HTTP_PASSWORD=<your-password-here>` and set this option to `<user>:$HTTP_PASSWORD`. Note however that this will also locally leak the passwords at runtime via e.g. /proc/<pid>/cmdline. + ::: + ''; + type = types.nullOr types.str; + default = null; + }; + + customHeaders = mkOption { + description = mdDoc "Custom HTTP headers to send during the upgrade request."; + type = types.attrsOf types.str; + default = {}; + example = { + "X-Some-Header" = "some-value"; + }; + }; + }; + }; + generateServerUnit = name: serverCfg: { + name = "wstunnel-server-${name}"; + value = { + description = "wstunnel server - ${name}"; + requires = [ "network.target" "network-online.target" ]; + after = [ "network.target" "network-online.target" ]; + wantedBy = optional serverCfg.autoStart "multi-user.target"; + + serviceConfig = let + certConfig = config.security.acme.certs."${serverCfg.useACMEHost}"; + in { + Type = "simple"; + ExecStart = with serverCfg; let + resolvedTlsCertificate = if useACMEHost != null + then "${certConfig.directory}/fullchain.pem" + else tlsCertificate; + resolvedTlsKey = if useACMEHost != null + then "${certConfig.directory}/key.pem" + else tlsKey; + in '' + ${package}/bin/wstunnel \ + --server \ + ${optionalString (restrictTo != null) "--restrictTo=${utils.escapeSystemdExecArg (hostPortToString restrictTo)}"} \ + ${optionalString (resolvedTlsCertificate != null) "--tlsCertificate=${utils.escapeSystemdExecArg resolvedTlsCertificate}"} \ + ${optionalString (resolvedTlsKey != null) "--tlsKey=${utils.escapeSystemdExecArg resolvedTlsKey}"} \ + ${optionalString verboseLogging "--verbose"} \ + ${attrsToArgs extraArgs} \ + ${utils.escapeSystemdExecArg "${if enableHTTPS then "wss" else "ws"}://${hostPortToString listen}"} + ''; + EnvironmentFile = optional (serverCfg.environmentFile != null) serverCfg.environmentFile; + DynamicUser = true; + SupplementaryGroups = optional (serverCfg.useACMEHost != null) certConfig.group; + PrivateTmp = true; + AmbientCapabilities = optional (serverCfg.listen.port < 1024) [ "CAP_NET_BIND_SERVICE" ]; + NoNewPrivileges = true; + RestrictNamespaces = "uts ipc pid user cgroup"; + ProtectSystem = "strict"; + ProtectHome = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectControlGroups = true; + PrivateDevices = true; + RestrictSUIDSGID = true; + + }; + }; + }; + generateClientUnit = name: clientCfg: { + name = "wstunnel-client-${name}"; + value = { + description = "wstunnel client - ${name}"; + requires = [ "network.target" "network-online.target" ]; + after = [ "network.target" "network-online.target" ]; + wantedBy = optional clientCfg.autoStart "multi-user.target"; + + serviceConfig = { + Type = "simple"; + ExecStart = with clientCfg; '' + ${package}/bin/wstunnel \ + ${concatStringsSep " " (builtins.map (x: "--localToRemote=${localRemoteToString x}") localToRemote)} \ + ${concatStringsSep " " (mapAttrsToList (n: v: "--customHeaders=\"${n}: ${v}\"") customHeaders)} \ + ${optionalString (dynamicToRemote != null) "--dynamicToRemote=${utils.escapeSystemdExecArg (hostPortToString dynamicToRemote)}"} \ + ${optionalString udp "--udp"} \ + ${optionalString (httpProxy != null) "--httpProxy=${httpProxy}"} \ + ${optionalString (soMark != null) "--soMark=${toString soMark}"} \ + ${optionalString (upgradePathPrefix != null) "--upgradePathPrefix=${upgradePathPrefix}"} \ + ${optionalString (hostHeader != null) "--hostHeader=${hostHeader}"} \ + ${optionalString (tlsSNI != null) "--tlsSNI=${tlsSNI}"} \ + ${optionalString tlsVerifyCertificate "--tlsVerifyCertificate"} \ + ${optionalString (websocketPingInterval != null) "--websocketPingFrequency=${toString websocketPingInterval}"} \ + ${optionalString (upgradeCredentials != null) "--upgradeCredentials=${upgradeCredentials}"} \ + --udpTimeoutSec=${toString udpTimeout} \ + ${optionalString verboseLogging "--verbose"} \ + ${attrsToArgs extraArgs} \ + ${utils.escapeSystemdExecArg "${if enableHTTPS then "wss" else "ws"}://${hostPortToString connectTo}"} + ''; + EnvironmentFile = optional (clientCfg.environmentFile != null) clientCfg.environmentFile; + DynamicUser = true; + PrivateTmp = true; + AmbientCapabilities = (optional (clientCfg.soMark != null) [ "CAP_NET_ADMIN" ]) ++ (optional ((clientCfg.dynamicToRemote.port or 1024) < 1024 || (any (x: x.local.port < 1024) clientCfg.localToRemote)) [ "CAP_NET_BIND_SERVICE" ]); + NoNewPrivileges = true; + RestrictNamespaces = "uts ipc pid user cgroup"; + ProtectSystem = "strict"; + ProtectHome = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectControlGroups = true; + PrivateDevices = true; + RestrictSUIDSGID = true; + }; + }; + }; +in { + options.services.wstunnel = { + enable = mkEnableOption (mdDoc "wstunnel"); + + servers = mkOption { + description = mdDoc "`wstunnel` servers to set up."; + type = types.attrsOf (types.submodule serverSubmodule); + default = {}; + example = { + "wg-tunnel" = { + listen.port = 8080; + enableHTTPS = true; + tlsCertificate = "/var/lib/secrets/fullchain.pem"; + tlsKey = "/var/lib/secrets/key.pem"; + restrictTo = { + host = "127.0.0.1"; + port = 51820; + }; + }; + }; + }; + + clients = mkOption { + description = mdDoc "`wstunnel` clients to set up."; + type = types.attrsOf (types.submodule clientSubmodule); + default = {}; + example = { + "wg-tunnel" = { + connectTo = { + host = "example.com"; + port = 8080; + }; + enableHTTPS = true; + localToRemote = { + local = { + host = "127.0.0.1"; + port = 51820; + }; + remote = { + host = "127.0.0.1"; + port = 51820; + }; + }; + udp = true; + }; + }; + }; + }; + + config = mkIf cfg.enable { + systemd.services = (mapAttrs' generateServerUnit (filterAttrs (n: v: v.enable) cfg.servers)) // (mapAttrs' generateClientUnit (filterAttrs (n: v: v.enable) cfg.clients)); + + assertions = (mapAttrsToList (name: serverCfg: { + assertion = !(serverCfg.useACMEHost != null && (serverCfg.tlsCertificate != null || serverCfg.tlsKey != null)); + message = '' + Options services.wstunnel.servers."${name}".useACMEHost and services.wstunnel.servers."${name}".{tlsCertificate, tlsKey} are mutually exclusive. + ''; + }) cfg.servers) ++ + (mapAttrsToList (name: serverCfg: { + assertion = !((serverCfg.tlsCertificate != null || serverCfg.tlsKey != null) && !(serverCfg.tlsCertificate != null && serverCfg.tlsKey != null)); + message = '' + services.wstunnel.servers."${name}".tlsCertificate and services.wstunnel.servers."${name}".tlsKey need to be set together. + ''; + }) cfg.servers) ++ + (mapAttrsToList (name: clientCfg: { + assertion = !(clientCfg.localToRemote == [] && clientCfg.dynamicToRemote == null); + message = '' + Either one of services.wstunnel.clients."${name}".localToRemote or services.wstunnel.clients."${name}".dynamicToRemote must be set. + ''; + }) cfg.clients); + }; + + meta.maintainers = with maintainers; [ alyaeanyx ]; +} diff --git a/nixos/modules/services/video/v4l2-relayd.nix b/nixos/modules/services/video/v4l2-relayd.nix new file mode 100644 index 00000000000..2a9dbe00158 --- /dev/null +++ b/nixos/modules/services/video/v4l2-relayd.nix @@ -0,0 +1,199 @@ +{ config, lib, pkgs, utils, ... }: +let + + inherit (lib) attrValues concatStringsSep filterAttrs length listToAttrs literalExpression + makeSearchPathOutput mkEnableOption mkIf mkOption nameValuePair optionals types; + inherit (utils) escapeSystemdPath; + + cfg = config.services.v4l2-relayd; + + kernelPackages = config.boot.kernelPackages; + + gst = (with pkgs.gst_all_1; [ + gst-plugins-bad + gst-plugins-base + gst-plugins-good + gstreamer.out + ]); + + instanceOpts = { name, ... }: { + options = { + enable = mkEnableOption (lib.mdDoc "this v4l2-relayd instance"); + + name = mkOption { + type = types.str; + default = name; + description = lib.mdDoc '' + The name of the instance. + ''; + }; + + cardLabel = mkOption { + type = types.str; + description = lib.mdDoc '' + The name the camera will show up as. + ''; + }; + + extraPackages = mkOption { + type = with types; listOf package; + default = [ ]; + description = lib.mdDoc '' + Extra packages to add to {env}`GST_PLUGIN_PATH` for the instance. + ''; + }; + + input = { + pipeline = mkOption { + type = types.str; + description = lib.mdDoc '' + The gstreamer-pipeline to use for the input-stream. + ''; + }; + + format = mkOption { + type = types.str; + default = "YUY2"; + description = lib.mdDoc '' + The video-format to read from input-stream. + ''; + }; + + width = mkOption { + type = types.ints.positive; + default = 1280; + description = lib.mdDoc '' + The width to read from input-stream. + ''; + }; + + height = mkOption { + type = types.ints.positive; + default = 720; + description = lib.mdDoc '' + The height to read from input-stream. + ''; + }; + + framerate = mkOption { + type = types.ints.positive; + default = 30; + description = lib.mdDoc '' + The framerate to read from input-stream. + ''; + }; + }; + + output = { + format = mkOption { + type = types.str; + default = "YUY2"; + description = lib.mdDoc '' + The video-format to write to output-stream. + ''; + }; + }; + + }; + }; + +in +{ + + options.services.v4l2-relayd = { + + instances = mkOption { + type = with types; attrsOf (submodule instanceOpts); + default = { }; + example = literalExpression '' + { + example = { + cardLabel = "Example card"; + input.pipeline = "videotestsrc"; + }; + } + ''; + description = lib.mdDoc '' + v4l2-relayd instances to be created. + ''; + }; + + }; + + config = + let + + mkInstanceService = instance: { + description = "Streaming relay for v4l2loopback using GStreamer"; + + after = [ "modprobe@v4l2loopback.service" "systemd-logind.service" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + Type = "simple"; + Restart = "always"; + PrivateNetwork = true; + PrivateTmp = true; + LimitNPROC = 1; + }; + + environment = { + GST_PLUGIN_PATH = makeSearchPathOutput "lib" "lib/gstreamer-1.0" (gst ++ instance.extraPackages); + V4L2_DEVICE_FILE = "/run/v4l2-relayd-${instance.name}/device"; + }; + + script = + let + appsrcOptions = concatStringsSep "," [ + "caps=video/x-raw" + "format=${instance.input.format}" + "width=${toString instance.input.width}" + "height=${toString instance.input.height}" + "framerate=${toString instance.input.framerate}/1" + ]; + + outputPipeline = [ + "appsrc name=appsrc ${appsrcOptions}" + "videoconvert" + ] ++ optionals (instance.input.format != instance.output.format) [ + "video/x-raw,format=${instance.output.format}" + "queue" + ] ++ [ "v4l2sink name=v4l2sink device=$(cat $V4L2_DEVICE_FILE)" ]; + in + '' + exec ${pkgs.v4l2-relayd}/bin/v4l2-relayd -i "${instance.input.pipeline}" -o "${concatStringsSep " ! " outputPipeline}" + ''; + + preStart = '' + mkdir -p $(dirname $V4L2_DEVICE_FILE) + ${kernelPackages.v4l2loopback.bin}/bin/v4l2loopback-ctl add -x 1 -n "${instance.cardLabel}" > $V4L2_DEVICE_FILE + ''; + + postStop = '' + ${kernelPackages.v4l2loopback.bin}/bin/v4l2loopback-ctl delete $(cat $V4L2_DEVICE_FILE) + rm -rf $(dirname $V4L2_DEVICE_FILE) + ''; + }; + + mkInstanceServices = instances: listToAttrs (map + (instance: + nameValuePair "v4l2-relayd-${escapeSystemdPath instance.name}" (mkInstanceService instance) + ) + instances); + + enabledInstances = attrValues (filterAttrs (n: v: v.enable) cfg.instances); + + in + { + + boot = mkIf ((length enabledInstances) > 0) { + extraModulePackages = [ kernelPackages.v4l2loopback ]; + kernelModules = [ "v4l2loopback" ]; + }; + + systemd.services = mkInstanceServices enabledInstances; + + }; + + meta.maintainers = with lib.maintainers; [ betaboon ]; +} diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix index 1b6e1ac583a..3e1286dc475 100644 --- a/nixos/modules/services/web-apps/mastodon.nix +++ b/nixos/modules/services/web-apps/mastodon.nix @@ -48,6 +48,8 @@ let # User and group User = cfg.user; Group = cfg.group; + # Working directory + WorkingDirectory = cfg.package; # State directory and mode StateDirectory = "mastodon"; StateDirectoryMode = "0750"; @@ -110,6 +112,37 @@ let $sudo ${cfg.package}/bin/tootctl "$@" ''; + sidekiqUnits = lib.attrsets.mapAttrs' (name: processCfg: + lib.nameValuePair "mastodon-sidekiq-${name}" (let + jobClassArgs = toString (builtins.map (c: "-q ${c}") processCfg.jobClasses); + jobClassLabel = toString ([""] ++ processCfg.jobClasses); + threads = toString (if processCfg.threads == null then cfg.sidekiqThreads else processCfg.threads); + in { + after = [ "network.target" "mastodon-init-dirs.service" ] + ++ lib.optional databaseActuallyCreateLocally "postgresql.service" + ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service"; + requires = [ "mastodon-init-dirs.service" ] + ++ lib.optional databaseActuallyCreateLocally "postgresql.service" + ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service"; + description = "Mastodon sidekiq${jobClassLabel}"; + wantedBy = [ "mastodon.target" ]; + environment = env // { + PORT = toString(cfg.sidekiqPort); + DB_POOL = threads; + }; + serviceConfig = { + ExecStart = "${cfg.package}/bin/sidekiq ${jobClassArgs} -c ${threads} -r ${cfg.package}"; + Restart = "always"; + RestartSec = 20; + EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ] ++ cfg.extraEnvFiles; + WorkingDirectory = cfg.package; + # System Call Filtering + SystemCallFilter = [ ("~" + lib.concatStringsSep " " systemCallsList) "@chown" "pipe" "pipe2" ]; + } // cfgService; + path = with pkgs; [ file imagemagick ffmpeg ]; + }) + ) cfg.sidekiqProcesses; + in { options = { @@ -195,12 +228,53 @@ in { type = lib.types.port; default = 55002; }; + sidekiqThreads = lib.mkOption { - description = lib.mdDoc "Worker threads used by the mastodon-sidekiq service."; + description = lib.mdDoc "Worker threads used by the mastodon-sidekiq-all service. If `sidekiqProcesses` is configured and any processes specify null `threads`, this value is used."; type = lib.types.int; default = 25; }; + sidekiqProcesses = lib.mkOption { + description = lib.mdDoc "How many Sidekiq processes should be used to handle background jobs, and which job classes they handle. *Read the [upstream documentation](https://docs.joinmastodon.org/admin/scaling/#sidekiq) before configuring this!*"; + type = with lib.types; attrsOf (submodule { + options = { + jobClasses = lib.mkOption { + type = listOf (enum [ "default" "push" "pull" "mailers" "scheduler" "ingress" ]); + description = lib.mdDoc "If not empty, which job classes should be executed by this process. *Only one process should handle the 'scheduler' class. If left empty, this process will handle the 'scheduler' class.*"; + }; + threads = lib.mkOption { + type = nullOr int; + description = lib.mdDoc "Number of threads this process should use for executing jobs. If null, the configured `sidekiqThreads` are used."; + }; + }; + }); + default = { + all = { + jobClasses = [ ]; + threads = null; + }; + }; + example = { + all = { + jobClasses = [ ]; + threads = null; + }; + ingress = { + jobClasses = [ "ingress" ]; + threads = 5; + }; + default = { + jobClasses = [ "default" ]; + threads = 10; + }; + push-pull = { + jobClasses = [ "push" "pull" ]; + threads = 5; + }; + }; + }; + vapidPublicKeyFile = lib.mkOption { description = lib.mdDoc '' Path to file containing the public key used for Web Push @@ -482,7 +556,7 @@ in { }; }; - config = lib.mkIf cfg.enable { + config = lib.mkIf cfg.enable (lib.mkMerge [{ assertions = [ { assertion = databaseActuallyCreateLocally -> (cfg.user == cfg.database.user); @@ -517,6 +591,12 @@ in { environment.systemPackages = [ mastodonTootctl ]; + systemd.targets.mastodon = { + description = "Target for all Mastodon services"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + }; + systemd.services.mastodon-init-dirs = { script = '' umask 077 @@ -551,7 +631,7 @@ in { environment = env; serviceConfig = { Type = "oneshot"; - WorkingDirectory = cfg.package; + SyslogIdentifier = "mastodon-init-dirs"; # System Call Filtering SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" "pipe" "pipe2" ]; } // cfgService; @@ -609,7 +689,7 @@ in { requires = [ "mastodon-init-dirs.service" ] ++ lib.optional databaseActuallyCreateLocally "postgresql.service" ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service"; - wantedBy = [ "multi-user.target" ]; + wantedBy = [ "mastodon.target" ]; description = "Mastodon streaming"; environment = env // (if cfg.enableUnixSocket then { SOCKET = "/run/mastodon-streaming/streaming.socket"; } @@ -636,7 +716,7 @@ in { requires = [ "mastodon-init-dirs.service" ] ++ lib.optional databaseActuallyCreateLocally "postgresql.service" ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service"; - wantedBy = [ "multi-user.target" ]; + wantedBy = [ "mastodon.target" ]; description = "Mastodon web"; environment = env // (if cfg.enableUnixSocket then { SOCKET = "/run/mastodon-web/web.socket"; } @@ -657,31 +737,6 @@ in { path = with pkgs; [ file imagemagick ffmpeg ]; }; - systemd.services.mastodon-sidekiq = { - after = [ "network.target" "mastodon-init-dirs.service" ] - ++ lib.optional databaseActuallyCreateLocally "postgresql.service" - ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service"; - requires = [ "mastodon-init-dirs.service" ] - ++ lib.optional databaseActuallyCreateLocally "postgresql.service" - ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service"; - wantedBy = [ "multi-user.target" ]; - description = "Mastodon sidekiq"; - environment = env // { - PORT = toString(cfg.sidekiqPort); - DB_POOL = toString cfg.sidekiqThreads; - }; - serviceConfig = { - ExecStart = "${cfg.package}/bin/sidekiq -c ${toString cfg.sidekiqThreads} -r ${cfg.package}"; - Restart = "always"; - RestartSec = 20; - EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ] ++ cfg.extraEnvFiles; - WorkingDirectory = cfg.package; - # System Call Filtering - SystemCallFilter = [ ("~" + lib.concatStringsSep " " systemCallsList) "@chown" "pipe" "pipe2" ]; - } // cfgService; - path = with pkgs; [ file imagemagick ffmpeg ]; - }; - systemd.services.mastodon-media-auto-remove = lib.mkIf cfg.mediaAutoRemove.enable { description = "Mastodon media auto remove"; environment = env; @@ -757,7 +812,9 @@ in { ]; users.groups.${cfg.group}.members = lib.optional cfg.configureNginx config.services.nginx.user; - }; + } + { systemd.services = sidekiqUnits; } + ]); meta.maintainers = with lib.maintainers; [ happy-river erictapen ]; diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix index e028f16004e..0ecb20e8c2c 100644 --- a/nixos/modules/services/web-apps/netbox.nix +++ b/nixos/modules/services/web-apps/netbox.nix @@ -4,45 +4,17 @@ with lib; let cfg = config.services.netbox; + pythonFmt = pkgs.formats.pythonVars {}; staticDir = cfg.dataDir + "/static"; - configFile = pkgs.writeTextFile { - name = "configuration.py"; - text = '' - STATIC_ROOT = '${staticDir}' - MEDIA_ROOT = '${cfg.dataDir}/media' - REPORTS_ROOT = '${cfg.dataDir}/reports' - SCRIPTS_ROOT = '${cfg.dataDir}/scripts' - - ALLOWED_HOSTS = ['*'] - DATABASE = { - 'NAME': 'netbox', - 'USER': 'netbox', - 'HOST': '/run/postgresql', - } - - # Redis database settings. Redis is used for caching and for queuing background tasks such as webhook events. A separate - # configuration exists for each. Full connection details are required in both sections, and it is strongly recommended - # to use two separate database IDs. - REDIS = { - 'tasks': { - 'URL': 'unix://${config.services.redis.servers.netbox.unixSocket}?db=0', - 'SSL': False, - }, - 'caching': { - 'URL': 'unix://${config.services.redis.servers.netbox.unixSocket}?db=1', - 'SSL': False, - } - } - - with open("${cfg.secretKeyFile}", "r") as file: - SECRET_KEY = file.readline() - - ${optionalString cfg.enableLdap "REMOTE_AUTH_BACKEND = 'netbox.authentication.LDAPBackend'"} - - ${cfg.extraConfig} - ''; + + settingsFile = pythonFmt.generate "netbox-settings.py" cfg.settings; + extraConfigFile = pkgs.writeTextFile { + name = "netbox-extraConfig.py"; + text = cfg.extraConfig; }; - pkg = (pkgs.netbox.overrideAttrs (old: { + configFile = pkgs.concatText "configuration.py" [ settingsFile extraConfigFile ]; + + pkg = (cfg.package.overrideAttrs (old: { installPhase = old.installPhase + '' ln -s ${configFile} $out/opt/netbox/netbox/netbox/configuration.py '' + optionalString cfg.enableLdap '' @@ -70,6 +42,30 @@ in { ''; }; + settings = lib.mkOption { + description = lib.mdDoc '' + Configuration options to set in `configuration.py`. + See the [documentation](https://docs.netbox.dev/en/stable/configuration/) for more possible options. + ''; + + default = { }; + + type = lib.types.submodule { + freeformType = pythonFmt.type; + + options = { + ALLOWED_HOSTS = lib.mkOption { + type = with lib.types; listOf str; + default = ["*"]; + description = lib.mdDoc '' + A list of valid fully-qualified domain names (FQDNs) and/or IP + addresses that can be used to reach the NetBox service. + ''; + }; + }; + }; + }; + listenAddress = mkOption { type = types.str; default = "[::1]"; @@ -78,6 +74,17 @@ in { ''; }; + package = mkOption { + type = types.package; + default = if versionAtLeast config.system.stateVersion "23.05" then pkgs.netbox else pkgs.netbox_3_3; + defaultText = literalExpression '' + if versionAtLeast config.system.stateVersion "23.05" then pkgs.netbox else pkgs.netbox_3_3; + ''; + description = lib.mdDoc '' + NetBox package to use. + ''; + }; + port = mkOption { type = types.port; default = 8001; @@ -117,7 +124,7 @@ in { default = ""; description = lib.mdDoc '' Additional lines of configuration appended to the `configuration.py`. - See the [documentation](https://netbox.readthedocs.io/en/stable/configuration/optional-settings/) for more possible options. + See the [documentation](https://docs.netbox.dev/en/stable/configuration/) for more possible options. ''; }; @@ -138,11 +145,90 @@ in { Path to the Configuration-File for LDAP-Authentication, will be loaded as `ldap_config.py`. See the [documentation](https://netbox.readthedocs.io/en/stable/installation/6-ldap/#configuration) for possible options. ''; + example = '' + import ldap + from django_auth_ldap.config import LDAPSearch, PosixGroupType + + AUTH_LDAP_SERVER_URI = "ldaps://ldap.example.com/" + + AUTH_LDAP_USER_SEARCH = LDAPSearch( + "ou=accounts,ou=posix,dc=example,dc=com", + ldap.SCOPE_SUBTREE, + "(uid=%(user)s)", + ) + + AUTH_LDAP_GROUP_SEARCH = LDAPSearch( + "ou=groups,ou=posix,dc=example,dc=com", + ldap.SCOPE_SUBTREE, + "(objectClass=posixGroup)", + ) + AUTH_LDAP_GROUP_TYPE = PosixGroupType() + + # Mirror LDAP group assignments. + AUTH_LDAP_MIRROR_GROUPS = True + + # For more granular permissions, we can map LDAP groups to Django groups. + AUTH_LDAP_FIND_GROUP_PERMS = True + ''; }; }; config = mkIf cfg.enable { - services.netbox.plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]); + services.netbox = { + plugins = mkIf cfg.enableLdap (ps: [ ps.django-auth-ldap ]); + settings = { + STATIC_ROOT = staticDir; + MEDIA_ROOT = "${cfg.dataDir}/media"; + REPORTS_ROOT = "${cfg.dataDir}/reports"; + SCRIPTS_ROOT = "${cfg.dataDir}/scripts"; + + DATABASE = { + NAME = "netbox"; + USER = "netbox"; + HOST = "/run/postgresql"; + }; + + # Redis database settings. Redis is used for caching and for queuing + # background tasks such as webhook events. A separate configuration + # exists for each. Full connection details are required in both + # sections, and it is strongly recommended to use two separate database + # IDs. + REDIS = { + tasks = { + URL = "unix://${config.services.redis.servers.netbox.unixSocket}?db=0"; + SSL = false; + }; + caching = { + URL = "unix://${config.services.redis.servers.netbox.unixSocket}?db=1"; + SSL = false; + }; + }; + + REMOTE_AUTH_BACKEND = lib.mkIf cfg.enableLdap "netbox.authentication.LDAPBackend"; + + LOGGING = lib.mkDefault { + version = 1; + + formatters.precise.format = "[%(levelname)s@%(name)s] %(message)s"; + + handlers.console = { + class = "logging.StreamHandler"; + formatter = "precise"; + }; + + # log to console/systemd instead of file + root = { + level = "INFO"; + handlers = [ "console" ]; + }; + }; + }; + + extraConfig = '' + with open("${cfg.secretKeyFile}", "r") as file: + SECRET_KEY = file.readline() + ''; + }; services.redis.servers.netbox.enable = true; diff --git a/nixos/modules/services/web-servers/garage.nix b/nixos/modules/services/web-servers/garage.nix index df8ed96f8d9..ebd41473939 100644 --- a/nixos/modules/services/web-servers/garage.nix +++ b/nixos/modules/services/web-servers/garage.nix @@ -51,11 +51,11 @@ in default = "none"; type = types.enum ([ "none" "1" "2" "3" 1 2 3 ]); apply = v: toString v; - description = lib.mdDoc "Garage replication mode, defaults to none, see: <https://garagehq.deuxfleurs.fr/reference_manual/configuration.html#replication_mode> for reference."; + description = lib.mdDoc "Garage replication mode, defaults to none, see: <https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/#replication-mode> for reference."; }; }; }; - description = lib.mdDoc "Garage configuration, see <https://garagehq.deuxfleurs.fr/reference_manual/configuration.html> for reference."; + description = lib.mdDoc "Garage configuration, see <https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/> for reference."; }; package = mkOption { diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index f2cf7a28b11..3d19186e1a9 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -31,6 +31,7 @@ let # Mime.types values are taken from brotli sample configuration - https://github.com/google/ngx_brotli # and Nginx Server Configs - https://github.com/h5bp/server-configs-nginx + # "text/html" is implicitly included in {brotli,gzip,zstd}_types compressMimeTypes = [ "application/atom+xml" "application/geo+json" @@ -55,7 +56,6 @@ let "text/calendar" "text/css" "text/csv" - "text/html" "text/javascript" "text/markdown" "text/plain" @@ -102,6 +102,17 @@ let proxy_set_header X-Forwarded-Server $host; ''; + proxyCachePathConfig = concatStringsSep "\n" (mapAttrsToList (name: proxyCachePath: '' + proxy_cache_path ${concatStringsSep " " [ + "/var/cache/nginx/${name}" + "keys_zone=${proxyCachePath.keysZoneName}:${proxyCachePath.keysZoneSize}" + "levels=${proxyCachePath.levels}" + "use_temp_path=${if proxyCachePath.useTempPath then "on" else "off"}" + "inactive=${proxyCachePath.inactive}" + "max_size=${proxyCachePath.maxSize}" + ]}; + '') (filterAttrs (name: conf: conf.enable) cfg.proxyCachePath)); + upstreamConfig = toString (flip mapAttrsToList cfg.upstreams (name: upstream: '' upstream ${name} { ${toString (flip mapAttrsToList upstream.servers (name: server: '' @@ -241,16 +252,10 @@ let server_tokens ${if cfg.serverTokens then "on" else "off"}; - ${optionalString cfg.proxyCache.enable '' - proxy_cache_path /var/cache/nginx keys_zone=${cfg.proxyCache.keysZoneName}:${cfg.proxyCache.keysZoneSize} - levels=${cfg.proxyCache.levels} - use_temp_path=${if cfg.proxyCache.useTempPath then "on" else "off"} - inactive=${cfg.proxyCache.inactive} - max_size=${cfg.proxyCache.maxSize}; - ''} - ${cfg.commonHttpConfig} + ${proxyCachePathConfig} + ${vhosts} ${optionalString cfg.statusPage '' @@ -808,10 +813,10 @@ in ''; }; - proxyCache = mkOption { - type = types.submodule { + proxyCachePath = mkOption { + type = types.attrsOf (types.submodule ({ ... }: { options = { - enable = mkEnableOption (lib.mdDoc "Enable proxy cache"); + enable = mkEnableOption (lib.mdDoc "this proxy cache path entry"); keysZoneName = mkOption { type = types.str; @@ -869,9 +874,12 @@ in description = lib.mdDoc "Set maximum cache size"; }; }; - }; + })); default = {}; - description = lib.mdDoc "Configure proxy cache"; + description = lib.mdDoc '' + Configure a proxy cache path entry. + See <http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_path> for documentation. + ''; }; resolver = mkOption { @@ -982,6 +990,12 @@ in The Nginx log directory has been moved to /var/log/nginx, the cache directory to /var/cache/nginx. The option services.nginx.stateDir has been removed. '') + (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "inactive" ] [ "services" "nginx" "proxyCachePath" "" "inactive" ]) + (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "useTempPath" ] [ "services" "nginx" "proxyCachePath" "" "useTempPath" ]) + (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "levels" ] [ "services" "nginx" "proxyCachePath" "" "levels" ]) + (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "keysZoneSize" ] [ "services" "nginx" "proxyCachePath" "" "keysZoneSize" ]) + (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "keysZoneName" ] [ "services" "nginx" "proxyCachePath" "" "keysZoneName" ]) + (mkRenamedOptionModule [ "services" "nginx" "proxyCache" "enable" ] [ "services" "nginx" "proxyCachePath" "" "enable" ]) ]; config = mkIf cfg.enable { diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix index 0ab2a875975..4e7201833db 100644 --- a/nixos/modules/system/boot/resolved.nix +++ b/nixos/modules/system/boot/resolved.nix @@ -16,7 +16,9 @@ in default = false; type = types.bool; description = lib.mdDoc '' - Whether to enable the systemd DNS resolver daemon. + Whether to enable the systemd DNS resolver daemon, `systemd-resolved`. + + Search for `services.resolved` to see all options. ''; }; diff --git a/nixos/release-small.nix b/nixos/release-small.nix index 2b553adf2bd..6204dc731ad 100644 --- a/nixos/release-small.nix +++ b/nixos/release-small.nix @@ -85,7 +85,8 @@ in rec { stdenv subversion tarball - vim; + vim + tests-stdenv-gcc-stageCompare; }; tested = let @@ -135,6 +136,7 @@ in rec { "nixos.tests.proxy" "nixos.tests.simple" "nixpkgs.jdk" + "nixpkgs.tests-stdenv-gcc-stageCompare" ]) ]; }; diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index a155510450b..2ad1ec35022 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -123,9 +123,9 @@ in { cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; }; cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; }; cassandra_4 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_4; }; - ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {}; - ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {}; - ceph-single-node-bluestore = handleTestOn ["x86_64-linux"] ./ceph-single-node-bluestore.nix {}; + ceph-multi-node = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-multi-node.nix {}; + ceph-single-node = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-single-node.nix {}; + ceph-single-node-bluestore = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./ceph-single-node-bluestore.nix {}; certmgr = handleTest ./certmgr.nix {}; cfssl = handleTestOn ["aarch64-linux" "x86_64-linux"] ./cfssl.nix {}; cgit = handleTest ./cgit.nix {}; @@ -460,7 +460,8 @@ in { netdata = handleTest ./netdata.nix {}; networking.networkd = handleTest ./networking.nix { networkd = true; }; networking.scripted = handleTest ./networking.nix { networkd = false; }; - netbox = handleTest ./web-apps/netbox.nix {}; + netbox = handleTest ./web-apps/netbox.nix { inherit (pkgs) netbox; }; + netbox_3_3 = handleTest ./web-apps/netbox.nix { netbox = pkgs.netbox_3_3; }; # TODO: put in networking.nix after the test becomes more complete networkingProxy = handleTest ./networking-proxy.nix {}; nextcloud = handleTest ./nextcloud {}; diff --git a/nixos/tests/buildbot.nix b/nixos/tests/buildbot.nix index 977c728835f..467c8d8baff 100644 --- a/nixos/tests/buildbot.nix +++ b/nixos/tests/buildbot.nix @@ -23,7 +23,7 @@ import ./make-test-python.nix { ]; }; networking.firewall.allowedTCPPorts = [ 8010 8011 9989 ]; - environment.systemPackages = with pkgs; [ git python3Packages.buildbot-full ]; + environment.systemPackages = with pkgs; [ git buildbot-full ]; }; bbworker = { pkgs, ... }: { @@ -31,7 +31,7 @@ import ./make-test-python.nix { enable = true; masterUrl = "bbmaster:9989"; }; - environment.systemPackages = with pkgs; [ git python3Packages.buildbot-worker ]; + environment.systemPackages = with pkgs; [ git buildbot-worker ]; }; gitrepo = { pkgs, ... }: { diff --git a/nixos/tests/libreswan.nix b/nixos/tests/libreswan.nix index ff3d2344a67..aadba941fab 100644 --- a/nixos/tests/libreswan.nix +++ b/nixos/tests/libreswan.nix @@ -107,6 +107,8 @@ in with subtest("Network is up"): alice.wait_until_succeeds("ping -c1 bob") + alice.succeed("systemctl restart ipsec") + bob.succeed("systemctl restart ipsec") with subtest("Eve can eavesdrop cleartext traffic"): eavesdrop() diff --git a/nixos/tests/nginx.nix b/nixos/tests/nginx.nix index d9d073822a1..2a7e0f48d86 100644 --- a/nixos/tests/nginx.nix +++ b/nixos/tests/nginx.nix @@ -67,10 +67,10 @@ import ./make-test-python.nix ({ pkgs, ... }: { }; testScript = { nodes, ... }: let - etagSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/etagSystem"; - justReloadSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/justReloadSystem"; - reloadRestartSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/reloadRestartSystem"; - reloadWithErrorsSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/reloadWithErrorsSystem"; + etagSystem = "${nodes.webserver.system.build.toplevel}/specialisation/etagSystem"; + justReloadSystem = "${nodes.webserver.system.build.toplevel}/specialisation/justReloadSystem"; + reloadRestartSystem = "${nodes.webserver.system.build.toplevel}/specialisation/reloadRestartSystem"; + reloadWithErrorsSystem = "${nodes.webserver.system.build.toplevel}/specialisation/reloadWithErrorsSystem"; in '' url = "http://localhost/index.html" diff --git a/nixos/tests/tracee.nix b/nixos/tests/tracee.nix index 1609d3abc69..8ec86ef091e 100644 --- a/nixos/tests/tracee.nix +++ b/nixos/tests/tracee.nix @@ -1,5 +1,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { name = "tracee-integration"; + meta.maintainers = pkgs.tracee.meta.maintainers; + nodes = { machine = { config, pkgs, ... }: { # EventFilters/trace_only_events_from_new_containers and @@ -7,11 +9,11 @@ import ./make-test-python.nix ({ pkgs, ... }: { # require docker/dockerd virtualisation.docker.enable = true; - environment.systemPackages = [ + environment.systemPackages = with pkgs; [ # required by Test_EventFilters/trace_events_from_ls_and_which_binary_in_separate_scopes - pkgs.which + which # build the go integration tests as a binary - (pkgs.tracee.overrideAttrs (oa: { + (tracee.overrideAttrs (oa: { pname = oa.pname + "-integration"; postPatch = oa.postPatch or "" + '' # prepare tester.sh (which will be embedded in the test binary) @@ -20,10 +22,11 @@ import ./make-test-python.nix ({ pkgs, ... }: { # fix the test to look at nixos paths for running programs substituteInPlace tests/integration/integration_test.go \ --replace "bin=/usr/bin/" "comm=" \ + --replace "binary=/usr/bin/" "comm=" \ --replace "/usr/bin/dockerd" "dockerd" \ --replace "/usr/bin" "/run/current-system/sw/bin" ''; - nativeBuildInputs = oa.nativeBuildInputs or [ ] ++ [ pkgs.makeWrapper ]; + nativeBuildInputs = oa.nativeBuildInputs or [ ] ++ [ makeWrapper ]; buildPhase = '' runHook preBuild # just build the static lib we need for the go test binary @@ -34,6 +37,7 @@ import ./make-test-python.nix ({ pkgs, ... }: { runHook postBuild ''; doCheck = false; + outputs = [ "out" ]; installPhase = '' mkdir -p $out/bin mv $GOPATH/tracee-integration $out/bin/ diff --git a/nixos/tests/web-apps/mastodon/script.nix b/nixos/tests/web-apps/mastodon/script.nix index cdb1d4379b6..a89b4b7480e 100644 --- a/nixos/tests/web-apps/mastodon/script.nix +++ b/nixos/tests/web-apps/mastodon/script.nix @@ -9,7 +9,7 @@ ${extraInit} server.wait_for_unit("redis-mastodon.service") - server.wait_for_unit("mastodon-sidekiq.service") + server.wait_for_unit("mastodon-sidekiq-all.service") server.wait_for_unit("mastodon-streaming.service") server.wait_for_unit("mastodon-web.service") server.wait_for_open_port(55000) diff --git a/nixos/tests/web-apps/netbox.nix b/nixos/tests/web-apps/netbox.nix index 35decdd49e8..30de74f1886 100644 --- a/nixos/tests/web-apps/netbox.nix +++ b/nixos/tests/web-apps/netbox.nix @@ -1,21 +1,146 @@ -import ../make-test-python.nix ({ lib, pkgs, ... }: { +let + ldapDomain = "example.org"; + ldapSuffix = "dc=example,dc=org"; + + ldapRootUser = "admin"; + ldapRootPassword = "foobar"; + + testUser = "alice"; + testPassword = "verySecure"; + testGroup = "netbox-users"; +in import ../make-test-python.nix ({ lib, pkgs, netbox, ... }: { name = "netbox"; meta = with lib.maintainers; { - maintainers = [ n0emis ]; + maintainers = [ minijackson n0emis ]; }; - nodes.machine = { ... }: { + nodes.machine = { config, ... }: { services.netbox = { enable = true; + package = netbox; secretKeyFile = pkgs.writeText "secret" '' abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 ''; + + enableLdap = true; + ldapConfigPath = pkgs.writeText "ldap_config.py" '' + import ldap + from django_auth_ldap.config import LDAPSearch, PosixGroupType + + AUTH_LDAP_SERVER_URI = "ldap://localhost/" + + AUTH_LDAP_USER_SEARCH = LDAPSearch( + "ou=accounts,ou=posix,${ldapSuffix}", + ldap.SCOPE_SUBTREE, + "(uid=%(user)s)", + ) + + AUTH_LDAP_GROUP_SEARCH = LDAPSearch( + "ou=groups,ou=posix,${ldapSuffix}", + ldap.SCOPE_SUBTREE, + "(objectClass=posixGroup)", + ) + AUTH_LDAP_GROUP_TYPE = PosixGroupType() + + # Mirror LDAP group assignments. + AUTH_LDAP_MIRROR_GROUPS = True + + # For more granular permissions, we can map LDAP groups to Django groups. + AUTH_LDAP_FIND_GROUP_PERMS = True + ''; + }; + + services.nginx = { + enable = true; + + recommendedProxySettings = true; + + virtualHosts.netbox = { + default = true; + locations."/".proxyPass = "http://localhost:${toString config.services.netbox.port}"; + locations."/static/".alias = "/var/lib/netbox/static/"; + }; + }; + + # Adapted from the sssd-ldap NixOS test + services.openldap = { + enable = true; + settings = { + children = { + "cn=schema".includes = [ + "${pkgs.openldap}/etc/schema/core.ldif" + "${pkgs.openldap}/etc/schema/cosine.ldif" + "${pkgs.openldap}/etc/schema/inetorgperson.ldif" + "${pkgs.openldap}/etc/schema/nis.ldif" + ]; + "olcDatabase={1}mdb" = { + attrs = { + objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ]; + olcDatabase = "{1}mdb"; + olcDbDirectory = "/var/lib/openldap/db"; + olcSuffix = ldapSuffix; + olcRootDN = "cn=${ldapRootUser},${ldapSuffix}"; + olcRootPW = ldapRootPassword; + }; + }; + }; + }; + declarativeContents = { + ${ldapSuffix} = '' + dn: ${ldapSuffix} + objectClass: top + objectClass: dcObject + objectClass: organization + o: ${ldapDomain} + + dn: ou=posix,${ldapSuffix} + objectClass: top + objectClass: organizationalUnit + + dn: ou=accounts,ou=posix,${ldapSuffix} + objectClass: top + objectClass: organizationalUnit + + dn: uid=${testUser},ou=accounts,ou=posix,${ldapSuffix} + objectClass: person + objectClass: posixAccount + userPassword: ${testPassword} + homeDirectory: /home/${testUser} + uidNumber: 1234 + gidNumber: 1234 + cn: "" + sn: "" + + dn: ou=groups,ou=posix,${ldapSuffix} + objectClass: top + objectClass: organizationalUnit + + dn: cn=${testGroup},ou=groups,ou=posix,${ldapSuffix} + objectClass: posixGroup + gidNumber: 2345 + memberUid: ${testUser} + ''; + }; }; + + users.users.nginx.extraGroups = [ "netbox" ]; + + networking.firewall.allowedTCPPorts = [ 80 ]; }; - testScript = '' - machine.start() + testScript = let + changePassword = pkgs.writeText "change-password.py" '' + from django.contrib.auth.models import User + u = User.objects.get(username='netbox') + u.set_password('netbox') + u.save() + ''; + in '' + from typing import Any, Dict + import json + + start_all() machine.wait_for_unit("netbox.target") machine.wait_until_succeeds("journalctl --since -1m --unit netbox --grep Listening") @@ -26,5 +151,167 @@ import ../make-test-python.nix ({ lib, pkgs, ... }: { with subtest("Staticfiles are generated"): machine.succeed("test -e /var/lib/netbox/static/netbox.js") + + with subtest("Superuser can be created"): + machine.succeed( + "netbox-manage createsuperuser --noinput --username netbox --email netbox@example.com" + ) + # Django doesn't have a "clean" way of inputting the password from the command line + machine.succeed("cat '${changePassword}' | netbox-manage shell") + + machine.wait_for_unit("network.target") + + with subtest("Home screen loads from nginx"): + machine.succeed( + "curl -sSfL http://localhost | grep '<title>Home | NetBox</title>'" + ) + + with subtest("Staticfiles can be fetched"): + machine.succeed("curl -sSfL http://localhost/static/netbox.js") + machine.succeed("curl -sSfL http://localhost/static/docs/") + + with subtest("Can interact with API"): + json.loads( + machine.succeed("curl -sSfL -H 'Accept: application/json' 'http://localhost/api/'") + ) + + def login(username: str, password: str): + encoded_data = json.dumps({"username": username, "password": password}) + uri = "/users/tokens/provision/" + result = json.loads( + machine.succeed( + "curl -sSfL " + "-X POST " + "-H 'Accept: application/json' " + "-H 'Content-Type: application/json' " + f"'http://localhost/api{uri}' " + f"--data '{encoded_data}'" + ) + ) + return result["key"] + + with subtest("Can login"): + auth_token = login("netbox", "netbox") + + def get(uri: str): + return json.loads( + machine.succeed( + "curl -sSfL " + "-H 'Accept: application/json' " + f"-H 'Authorization: Token {auth_token}' " + f"'http://localhost/api{uri}'" + ) + ) + + def delete(uri: str): + return machine.succeed( + "curl -sSfL " + f"-X DELETE " + "-H 'Accept: application/json' " + f"-H 'Authorization: Token {auth_token}' " + f"'http://localhost/api{uri}'" + ) + + + def data_request(uri: str, method: str, data: Dict[str, Any]): + encoded_data = json.dumps(data) + return json.loads( + machine.succeed( + "curl -sSfL " + f"-X {method} " + "-H 'Accept: application/json' " + "-H 'Content-Type: application/json' " + f"-H 'Authorization: Token {auth_token}' " + f"'http://localhost/api{uri}' " + f"--data '{encoded_data}'" + ) + ) + + def post(uri: str, data: Dict[str, Any]): + return data_request(uri, "POST", data) + + def patch(uri: str, data: Dict[str, Any]): + return data_request(uri, "PATCH", data) + + with subtest("Can create objects"): + result = post("/dcim/sites/", {"name": "Test site", "slug": "test-site"}) + site_id = result["id"] + + # Example from: + # http://netbox.extra.cea.fr/static/docs/integrations/rest-api/#creating-a-new-object + post("/ipam/prefixes/", {"prefix": "192.0.2.0/24", "site": site_id}) + + result = post( + "/dcim/manufacturers/", + {"name": "Test manufacturer", "slug": "test-manufacturer"} + ) + manufacturer_id = result["id"] + + # Had an issue with device-types before NetBox 3.4.0 + result = post( + "/dcim/device-types/", + { + "model": "Test device type", + "manufacturer": manufacturer_id, + "slug": "test-device-type", + }, + ) + device_type_id = result["id"] + + with subtest("Can list objects"): + result = get("/dcim/sites/") + + assert result["count"] == 1 + assert result["results"][0]["id"] == site_id + assert result["results"][0]["name"] == "Test site" + assert result["results"][0]["description"] == "" + + result = get("/dcim/device-types/") + assert result["count"] == 1 + assert result["results"][0]["id"] == device_type_id + assert result["results"][0]["model"] == "Test device type" + + with subtest("Can update objects"): + new_description = "Test site description" + patch(f"/dcim/sites/{site_id}/", {"description": new_description}) + result = get(f"/dcim/sites/{site_id}/") + assert result["description"] == new_description + + with subtest("Can delete objects"): + # Delete a device-type since no object depends on it + delete(f"/dcim/device-types/{device_type_id}/") + + result = get("/dcim/device-types/") + assert result["count"] == 0 + + with subtest("Can use the GraphQL API"): + encoded_data = json.dumps({ + "query": "query { prefix_list { prefix, site { id, description } } }", + }) + result = json.loads( + machine.succeed( + "curl -sSfL " + "-H 'Accept: application/json' " + "-H 'Content-Type: application/json' " + f"-H 'Authorization: Token {auth_token}' " + "'http://localhost/graphql/' " + f"--data '{encoded_data}'" + ) + ) + + assert len(result["data"]["prefix_list"]) == 1 + assert result["data"]["prefix_list"][0]["prefix"] == "192.0.2.0/24" + assert result["data"]["prefix_list"][0]["site"]["id"] == str(site_id) + assert result["data"]["prefix_list"][0]["site"]["description"] == new_description + + with subtest("Can login with LDAP"): + machine.wait_for_unit("openldap.service") + login("alice", "${testPassword}") + + with subtest("Can associate LDAP groups"): + result = get("/users/users/?username=${testUser}") + + assert result["count"] == 1 + assert any(group["name"] == "${testGroup}" for group in result["results"][0]["groups"]) ''; }) diff --git a/nixos/tests/yggdrasil.nix b/nixos/tests/yggdrasil.nix index b60a0e6b06c..eaf14e29acb 100644 --- a/nixos/tests/yggdrasil.nix +++ b/nixos/tests/yggdrasil.nix @@ -10,8 +10,13 @@ let InterfacePeers = { eth1 = [ "tcp://192.168.1.200:12345" ]; }; - MulticastInterfaces = [ "eth1" ]; - LinkLocalTCPPort = 54321; + MulticastInterfaces = [ { + Regex = ".*"; + Beacon = true; + Listen = true; + Port = 54321; + Priority = 0; + } ]; PublicKey = "2b6f918b6c1a4b54d6bcde86cf74e074fb32ead4ee439b7930df2aa60c825186"; PrivateKey = "0c4a24acd3402722ce9277ed179f4a04b895b49586493c25fbaed60653d857d62b6f918b6c1a4b54d6bcde86cf74e074fb32ead4ee439b7930df2aa60c825186"; }; @@ -115,8 +120,12 @@ in import ./make-test-python.nix ({ pkgs, ...} : { settings = { IfTAPMode = true; IfName = "ygg0"; - MulticastInterfaces = [ "eth1" ]; - LinkLocalTCPPort = 43210; + MulticastInterfaces = [ + { + Port = 43210; + } + ]; + openMulticastPort = true; }; persistentKeys = true; }; |