summary refs log tree commit diff
path: root/nixos/modules/services/web-servers
Commit message (Collapse)AuthorAge
* Merge pull request #266270 from Ma27/postgresql-ownership-15Ryan Lahfa2023-11-17
|\
| * nixos/postgresql: drop ensurePermissions, fix ensureUsers for postgresql15Maximilian Bosch2023-11-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes #216989 First of all, a bit of context: in PostgreSQL, newly created users don't have the CREATE privilege on the public schema of a database even with `ALL PRIVILEGES` granted via `ensurePermissions` which is how most of the DB users are currently set up "declaratively"[1]. This means e.g. a freshly deployed Nextcloud service will break early because Nextcloud itself cannot CREATE any tables in the public schema anymore. The other issue here is that `ensurePermissions` is a mere hack. It's effectively a mixture of SQL code (e.g. `DATABASE foo` is relying on how a value is substituted in a query. You'd have to parse a subset of SQL to actually know which object are permissions granted to for a user). After analyzing the existing modules I realized that in every case with a single exception[2] the UNIX system user is equal to the db user is equal to the db name and I don't see a compelling reason why people would change that in 99% of the cases. In fact, some modules would even break if you'd change that because the declarations of the system user & the db user are mixed up[3]. So I decided to go with something new which restricts the ways to use `ensure*` options rather than expanding those[4]. Effectively this means that * The DB user _must_ be equal to the DB name. * Permissions are granted via `ensureDBOwnerhip` for an attribute-set in `ensureUsers`. That way, the user is actually the owner and can perform `CREATE`. * For such a postgres user, a database must be declared in `ensureDatabases`. For anything else, a custom state management should be implemented. This can either be `initialScript`, doing it manual, outside of the module or by implementing proper state management for postgresql[5], but the current state of `ensure*` isn't even declarative, but a convergent tool which is what Nix actually claims to _not_ do. Regarding existing setups: there are effectively two options: * Leave everything as-is (assuming that system user == db user == db name): then the DB user will automatically become the DB owner and everything else stays the same. * Drop the `createDatabase = true;` declarations: nothing will change because a removal of `ensure*` statements is ignored, so it doesn't matter at all whether this option is kept after the first deploy (and later on you'd usually restore from backups anyways). The DB user isn't the owner of the DB then, but for an existing setup this is irrelevant because CREATE on the public schema isn't revoked from existing users (only not granted for new users). [1] not really declarative though because removals of these statements are simply ignored for instance: https://github.com/NixOS/nixpkgs/issues/206467 [2] `services.invidious`: I removed the `ensure*` part temporarily because it IMHO falls into the category "manage the state on your own" (see the commit message). See also https://github.com/NixOS/nixpkgs/pull/265857 [3] e.g. roundcube had `"DATABASE ${cfg.database.username}" = "ALL PRIVILEGES";` [4] As opposed to other changes that are considered a potential fix, but also add more things like collation for DBs or passwords that are _never_ touched again when changing those. [5] As suggested in e.g. https://github.com/NixOS/nixpkgs/issues/206467
* | Merge master into staging-nextgithub-actions[bot]2023-11-11
|\|
| * treewide: fix redirected and broken URLsAnthony Roussel2023-11-11
| | | | | | | | Using the script in maintainers/scripts/update-redirected-urls.sh
* | Merge master into staging-nextgithub-actions[bot]2023-10-28
|\|
| * Merge pull request #263203 from nikstur/replace-activationLinus Heckemann2023-10-28
| |\ | | | | | | Replace simple activationScripts
| | * nixos/stargazer: replace activationScript via tmpfilesnikstur2023-10-26
| | |
* | | Merge master into staging-nextgithub-actions[bot]2023-10-28
|\| |
| * | Merge pull request #254386 from erikarvstedt/nginx-js-mime-typeArtturi2023-10-27
| |\ \
| | * | nixos/nginx: add `application/javascript` to `compressMimeTypes`Erik Arvstedt2023-09-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Although deprecated, this MIME type is still used by various applications and web frameworks which are potentially proxied by nginx. Examples: - Apps based on ASP.NET Core - Apps based on http.server (Python)
* | | | Merge master into staging-nextgithub-actions[bot]2023-10-27
|\| | |
| * | | nixos/garage: set `StateDirectory` if used at allCharles Hall2023-10-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes the `mkIf` to trigger if *either* `data_dir`/`metadata_dir` use `/var/lib/garage`, not only if both do. This is useful to me because I want to store metadata in `/var/lib/garage` but I also want to store data in a different mountpoint (via `data_dir` and `ReadWritePaths`).
* | | | Merge staging-next into staginggithub-actions[bot]2023-10-23
|\| | |
| * | | nixos/nginx: document implicit default port 80Sandro2023-10-22
| | | |
* | | | Merge staging-next into staginggithub-actions[bot]2023-10-21
|\| | |
| * | | Merge pull request #257262 from dongcarl/2023-09-nginx-fixesRyan Lahfa2023-10-21
| |\ \ \ | | | | | | | | | | nixos/nginx: Allow empty port for listen directive (for unix socket)
| | * | | nixos/nginx: Allow empty port for listen directiveCarl Dong2023-10-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When listening on unix sockets, it doesn't make sense to specify a port for nginx's listen directive. Since nginx defaults to port 80 when the port isn't specified (but the address is), we can change the default for the option to null as well without changing any behaviour.
* | | | | Merge staging-next into staginggithub-actions[bot]2023-10-20
|\| | | |
| * | | | nixos: fix bad mkEnableOption descriptionsBjørn Forsman2023-10-20
| | |_|/ | |/| | | | | | | | | | | | | | Fix descriptions that don't account for (1) the "Whether to enable" prefix or (2) the automatically added trailing dot.
* | | | Merge staging-next into staginggithub-actions[bot]2023-10-19
|\| | |
| * | | nixos/lighttpd: add reload supportBjørn Forsman2023-10-19
| | | | | | | | | | | | | | | | | | | | | | | | Allow reloading the webserver, which is useful when e.g there are new certificates available that we want lighttpd to use, but don't want to completely shut down the server.
* | | | Merge staging-next into staginggithub-actions[bot]2023-10-18
|\| | |
| * | | nixos/garage: drop default packageFlorian Klink2023-10-18
| | | | | | | | | | | | | | | | | | | | This gives better control over what package of garage is running, and makes upgrades a conscious decision.
| * | | nixos/garage: nixpkgs-fmtFlorian Klink2023-10-18
| |/ /
* | | Merge remote-tracking branch 'origin/staging-next' into stagingAlyssa Ross2023-10-07
|\| | | | | | | | | | | | | | Conflicts: pkgs/top-level/linux-kernels.nix
| * | nixos/nginx: add systemd-tmpfiles exclusion of temporary directoriesMarek Beyer2023-10-06
| | | | | | | | | | | | | | | Directories used by nginx in the tmp path are only created upon startup and must not be deleted while nginx is running.
* | | treewide: refactor `.attrs.sh` detectionMaximilian Bosch2023-10-04
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When specifying the `builder` attribute in `stdenv.mkDerivation`, this will be effectively transformed into builtins.derivation { builder = stdenv.shell; args = [ "-e" builder ]; } This also means that `default-builder.sh` is never sourced and as a result it's not guaranteed that `$NIX_ATTRS_SH_FILE` is set to a correct location[1]. Also, we need to source `.attrs.sh` to source `$stdenv`. So, the following is done now: * If `$NIX_ATTRS_SH_FILE` points to a correct location, then use it. Directly using `.attrs.sh` is problematic for `nix-shell(1)` usage (see previous commit for more context), so prefer the environment variable if possible. * Otherwise, if `.attrs.sh` exists, then use it. See [1] for when this can happen. * If neither applies, it can be assumed that `__structuredAttrs` is turned off and thus nothing needs to be done. [1] It's possible that it doesn't exist at all - in case of Nix 2.3 or it can point to a wrong location on older Nix versions with a bug in `__structuredAttrs`.
* | Merge pull request #254440 from Izorkin/add-nginx-bpfRyan Lahfa2023-09-27
|\ \
| * | nixos/nginx: allow enabling QUIC packet routing using eBPFIzorkin2023-09-19
| | |
* | | Merge pull request #257043 from Tom-Hubrecht/garage-envfileRyan Lahfa2023-09-24
|\ \ \ | |/ / |/| |
| * | nixos/garage: Add an environmentFile optionTom Hubrecht2023-09-24
| |/ | | | | | | | | | | Since garage 0.8.2, garage accepts environment variables for passing secrets, e.g. `GARAGE_RPC_SECRET` or `GARAGE_ADMIN_TOKEN`. The added `environmentFile` allows those secrets to not be present in the nix store.
* / nixos/caddy: ensure vhosts come after user-specified `cfg.extraConfig`emilylange2023-09-18
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This solves an issue, where loading the nixos-unstable module in nixos-stable using `disabledModules` and `imports` resulted in the following Caddyfile: ``` <globalConfig> <vhosts> <extraConfig> ``` instead of ``` <globalConfig> <extraConfig> <vhosts> ``` This is important in cases where `cfg.extraConfig` contains so called Caddyfile snippets. See https://caddyserver.com/docs/caddyfile/concepts#structure Co-authored-by: Lin Jian <me@linj.tech>
* nixos/nginx: fix services.nginx.defaultListen descriptionSandro2023-09-03
|
* Merge pull request #244626 from Sohalt/caddy-rfc42Emily2023-08-23
|\ | | | | nixos/caddy: Add rfc42 settings option
| * nixos/caddy: Add rfc42 settings optionsohalt2023-08-22
| |
* | nixos/rustus: add user name to enable restoring of backupshappysalada2023-08-13
| |
* | Merge pull request #241338 from bachp/minio-distributedFranz Pletz2023-08-11
|\ \
| * | nixos/minio: allow distributed nodesPascal Bach2023-07-03
| | |
* | | nixos/nginx: using new variant of http2 directiveIzorkin2023-08-03
| | |
* | | Merge pull request #245893 from h7x4/move-nginx-status-page-declarationRyan Lahfa2023-07-29
|\ \ \
| * | | nixos/nginx: move status page config to `services.nginx`h7x42023-07-28
| | | |
* | | | nixos/nginx: remove unnecessary acme locations to allow double proxied setupsoddlama2023-07-27
|/ / /
* | | Merge pull request #239624 from Stunkymonkey/use-optionalString-thenFelix Bühler2023-07-22
|\ \ \ | |_|/ |/| | treewide: use optionalString instead of 'then ""'
| * | treewide: use optionalString instead of 'then ""'Felix Buehler2023-06-24
| | |
* | | nixos/caddy: remove admin checkSylvain Fankhauser2023-07-04
| | | | | | | | | | | | Since it introduces IFD.
* | | nixos/caddy: add support for reloadSylvain Fankhauser2023-07-04
| |/ |/|
* | nixos/static-web-server: create module which uses upstream systemd unitsMac Chaffee2023-07-01
| | | | | | | | | | | | This commit creates a nixos module for static-web-server. The module uses upstream systemd units to start static-web-server. It also includes options for configuring static-web-server.
* | nixos/ttyd: fix example renderingSandro Jäckel2023-06-30
| |
* | nixos/rustus: inital modulehappysalada2023-06-25
| |
* | Merge pull request #225877 from jappeace/upgrade-keter-2.1Sandro2023-06-22
|\ \ | |/ |/| nixos/keter: 2.0 -> 2.1
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-06-04 04:31:12 +0000