Merge branch 'master' into staging-next
There ver very many conflicts, basically all due to name -> pname+version. Fortunately, almost everything was auto-resolved by kdiff3, and for now I just fixed up a couple evaluation problems, as verified by the tarball job. There might be some fallback to these conflicts, but I believe it should be minimal. Hydra nixpkgs: ?compare=1538299
This commit is contained in:
commit
2e6bf42a22
|
@ -185,10 +185,9 @@ with import <nixpkgs> {};
|
|||
|
||||
androidenv.emulateApp {
|
||||
name = "emulate-MyAndroidApp";
|
||||
platformVersion = "24";
|
||||
abiVersion = "armeabi-v7a"; # mips, x86 or x86_64
|
||||
systemImageType = "default";
|
||||
useGoogleAPIs = false;
|
||||
platformVersion = "28";
|
||||
abiVersion = "x86_64"; # armeabi-v7a, mips, x86
|
||||
systemImageType = "google_apis_playstore";
|
||||
}
|
||||
```
|
||||
|
||||
|
@ -201,7 +200,7 @@ with import <nixpkgs> {};
|
|||
androidenv.emulateApp {
|
||||
name = "emulate-MyAndroidApp";
|
||||
platformVersion = "24";
|
||||
abiVersion = "armeabi-v7a"; # mips, x86 or x86_64
|
||||
abiVersion = "armeabi-v7a"; # mips, x86, x86_64
|
||||
systemImageType = "default";
|
||||
useGoogleAPIs = false;
|
||||
app = ./MyApp.apk;
|
||||
|
|
|
@ -75,7 +75,8 @@ foo = import ../path/to/foo.nix {
|
|||
It adds the contents of the <envar>PERL5LIB</envar> environment variable
|
||||
to <literal>#! .../bin/perl</literal> line of Perl scripts as
|
||||
<literal>-I<replaceable>dir</replaceable></literal> flags. This ensures
|
||||
that a script can find its dependencies.
|
||||
that a script can find its dependencies. (This can cause this shebang line
|
||||
to become too long for Darwin to handle; see the note below.)
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
|
@ -137,6 +138,36 @@ ClassC3Componentised = buildPerlPackage rec {
|
|||
</programlisting>
|
||||
</para>
|
||||
|
||||
<para>
|
||||
On Darwin, if a script has too many
|
||||
<literal>-I<replaceable>dir</replaceable></literal> flags in its first line
|
||||
(its “shebang line”), it will not run. This can be worked around by calling
|
||||
the <literal>shortenPerlShebang</literal> function from the
|
||||
<literal>postInstall</literal> phase:
|
||||
<programlisting>
|
||||
{ stdenv, buildPerlPackage, fetchurl, shortenPerlShebang }:
|
||||
|
||||
ImageExifTool = buildPerlPackage {
|
||||
pname = "Image-ExifTool";
|
||||
version = "11.50";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://www.sno.phy.queensu.ca/~phil/exiftool/Image-ExifTool-11.50.tar.gz";
|
||||
sha256 = "0d8v48y94z8maxkmw1rv7v9m0jg2dc8xbp581njb6yhr7abwqdv3";
|
||||
};
|
||||
|
||||
buildInputs = stdenv.lib.optional stdenv.isDarwin shortenPerlShebang;
|
||||
postInstall = stdenv.lib.optional stdenv.isDarwin ''
|
||||
shortenPerlShebang $out/bin/exiftool
|
||||
'';
|
||||
};
|
||||
</programlisting>
|
||||
This will remove the <literal>-I</literal> flags from the shebang line,
|
||||
rewrite them in the <literal>use lib</literal> form, and put them on the next
|
||||
line instead. This function can be given any number of Perl scripts as
|
||||
arguments; it will modify them in-place.
|
||||
</para>
|
||||
|
||||
<section xml:id="ssec-generation-from-CPAN">
|
||||
<title>Generation from CPAN</title>
|
||||
|
||||
|
|
|
@ -71,7 +71,7 @@ let
|
|||
zipAttrsWithNames zipAttrsWith zipAttrs recursiveUpdateUntil
|
||||
recursiveUpdate matchAttrs overrideExisting getOutput getBin
|
||||
getLib getDev chooseDevOutputs zipWithNames zip;
|
||||
inherit (lists) singleton foldr fold foldl foldl' imap0 imap1
|
||||
inherit (lists) singleton forEach foldr fold foldl foldl' imap0 imap1
|
||||
concatMap flatten remove findSingle findFirst any all count
|
||||
optional optionals toList range partition zipListsWith zipLists
|
||||
reverseList listDfs toposort sort naturalSort compareLists take
|
||||
|
|
|
@ -21,6 +21,19 @@ rec {
|
|||
*/
|
||||
singleton = x: [x];
|
||||
|
||||
/* Apply the function to each element in the list. Same as `map`, but arguments
|
||||
flipped.
|
||||
|
||||
Type: forEach :: [a] -> (a -> b) -> [b]
|
||||
|
||||
Example:
|
||||
forEach [ 1 2 ] (x:
|
||||
toString x
|
||||
)
|
||||
=> [ "1" "2" ]
|
||||
*/
|
||||
forEach = xs: f: map f xs;
|
||||
|
||||
/* “right fold” a binary function `op` between successive elements of
|
||||
`list` with `nul' as the starting value, i.e.,
|
||||
`foldr op nul [x_1 x_2 ... x_n] == op x_1 (op x_2 ... (op x_n nul))`.
|
||||
|
|
|
@ -40,6 +40,12 @@
|
|||
See `./scripts/check-maintainer-github-handles.sh` for an example on how to work with this data.
|
||||
*/
|
||||
{
|
||||
"00-matt" = {
|
||||
name = "Matt Smith";
|
||||
email = "matt@offtopica.uk";
|
||||
github = "00-matt";
|
||||
githubId = 48835712;
|
||||
};
|
||||
"0x4A6F" = {
|
||||
email = "0x4A6F@shackspace.de";
|
||||
name = "Joachim Ernst";
|
||||
|
@ -296,6 +302,11 @@
|
|||
githubId = 17208985;
|
||||
name = "Alex Rice";
|
||||
};
|
||||
alexbakker = {
|
||||
email = "ab@alexbakker.me";
|
||||
github = "alexbakker";
|
||||
name = "Alexander Bakker";
|
||||
};
|
||||
alexchapman = {
|
||||
email = "alex@farfromthere.net";
|
||||
github = "AJChapman";
|
||||
|
@ -571,6 +582,12 @@
|
|||
githubId = 816777;
|
||||
name = "Ashley Gillman";
|
||||
};
|
||||
ashkitten = {
|
||||
email = "ashlea@protonmail.com";
|
||||
github = "ashkitten";
|
||||
githubId = 9281956;
|
||||
name = "ash lea";
|
||||
};
|
||||
aske = {
|
||||
email = "aske@fmap.me";
|
||||
github = "aske";
|
||||
|
@ -2738,6 +2755,11 @@
|
|||
githubId = 26877687;
|
||||
name = "Yurii Izorkin";
|
||||
};
|
||||
jasoncarr = {
|
||||
email = "jcarr250@gmail.com";
|
||||
github = "jasoncarr0";
|
||||
name = "Jason Carr";
|
||||
};
|
||||
j-keck = {
|
||||
email = "jhyphenkeck@gmail.com";
|
||||
github = "j-keck";
|
||||
|
@ -3218,6 +3240,11 @@
|
|||
githubId = 6282557;
|
||||
name = "Kiloreux Emperex";
|
||||
};
|
||||
kim0 = {
|
||||
email = "email.ahmedkamal@googlemail.com";
|
||||
github = "kim0";
|
||||
name = "Ahmed Kamal";
|
||||
};
|
||||
kimburgess = {
|
||||
email = "kim@acaprojects.com";
|
||||
github = "kimburgess";
|
||||
|
@ -3236,6 +3263,11 @@
|
|||
githubId = 451835;
|
||||
name = "Kirill Elagin";
|
||||
};
|
||||
kirikaza = {
|
||||
email = "k@kirikaza.ru";
|
||||
github = "kirikaza";
|
||||
name = "Kirill Kazakov";
|
||||
};
|
||||
kisonecat = {
|
||||
email = "kisonecat@gmail.com";
|
||||
github = "kisonecat";
|
||||
|
@ -5897,6 +5929,12 @@
|
|||
githubId = 231788;
|
||||
name = "Stephen Weinberg";
|
||||
};
|
||||
sterfield = {
|
||||
email = "sterfield@gmail.com";
|
||||
github = "sterfield";
|
||||
githubId = 5747061;
|
||||
name = "Guillaume Loetscher";
|
||||
};
|
||||
sternenseemann = {
|
||||
email = "post@lukasepple.de";
|
||||
github = "sternenseemann";
|
||||
|
|
|
@ -1,4 +1,5 @@
|
|||
# nix name, luarocks name, server, version,luaversion,maintainers
|
||||
alt-getopt,,,,,arobyn
|
||||
ansicolors,,,,,
|
||||
argparse,,,,,
|
||||
basexx,,,,,
|
||||
|
@ -56,6 +57,7 @@ luv,,,,,
|
|||
markdown,,,,,
|
||||
mediator_lua,,,,,
|
||||
mpack,,,,,
|
||||
moonscript,,,,,arobyn
|
||||
nvim-client,,,,,
|
||||
penlight,,,,,
|
||||
rapidjson,,,,,
|
||||
|
|
|
|
@ -237,6 +237,12 @@
|
|||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The <literal>shibboleth-sp</literal> package has been updated to version 3.
|
||||
It is largely backward compatible, for further information refer to the
|
||||
<link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/ReleaseNotes">release notes</link>
|
||||
and <link xlink:href="https://wiki.shibboleth.net/confluence/display/SP3/UpgradingFromV2">upgrade guide</link>.
|
||||
</para>
|
||||
<para>
|
||||
Nodejs 8 is scheduled EOL under the lifetime of 19.09 and has been dropped.
|
||||
</para>
|
||||
|
@ -263,6 +269,21 @@
|
|||
<literal>false</literal>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The <option>services.systemhealth</option> module has been removed from nixpkgs due to lack of maintainer.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The <option>services.mantisbt</option> module has been removed from nixpkgs due to lack of maintainer.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Squid 3 has been removed and the <option>squid</option> derivation now refers to Squid 4.
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
|
@ -424,6 +445,67 @@
|
|||
installer after creating <literal>/var/lib/nextcloud</literal>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
There exists now <literal>lib.forEach</literal>, which is like <literal>map</literal>, but with
|
||||
arguments flipped. When mapping function body spans many lines (or has nested
|
||||
<literal>map</literal>s), it is often hard to follow which list is modified.
|
||||
</para>
|
||||
<para>
|
||||
Previous solution to this problem was either to use <literal>lib.flip map</literal>
|
||||
idiom or extract that anonymous mapping function to a named one. Both can still be used
|
||||
but <literal>lib.forEach</literal> is preferred over <literal>lib.flip map</literal>.
|
||||
</para>
|
||||
<para>
|
||||
The <literal>/etc/sysctl.d/nixos.conf</literal> file containing all the options set via
|
||||
<link linkend="opt-boot.kernel.sysctl">boot.kernel.sysctl</link> was moved to
|
||||
<literal>/etc/sysctl.d/60-nixos.conf</literal>, as
|
||||
<citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
||||
recommends prefixing all filenames in <literal>/etc/sysctl.d</literal> with a
|
||||
two-digit number and a dash to simplify the ordering of the files.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
We now install the sysctl snippets shipped with systemd.
|
||||
<itemizedlist>
|
||||
<para>This enables:</para>
|
||||
<listitem>
|
||||
<para>Loose reverse path filtering</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>Source route filtering</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<literal>fq_codel</literal> as a packet scheduler (this helps to fight bufferbloat)
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
This also configures the kernel to pass coredumps to <literal>systemd-coredump</literal>.
|
||||
These sysctl snippets can be found in <literal>/etc/sysctl.d/50-*.conf</literal>,
|
||||
and overridden via <link linkend="opt-boot.kernel.sysctl">boot.kernel.sysctl</link>
|
||||
(which will place the parameters in <literal>/etc/sysctl.d/60-nixos.conf</literal>).
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Coredumps are now acquired by <literal>systemd-coredump</literal> by default.
|
||||
<literal>systemd-coredump</literal> behaviour can still be modified via
|
||||
<option>systemd.coredump.extraConfig</option>.
|
||||
To stick to the old behaviour (having the kernel dump to a file called <literal>core</literal>
|
||||
in the working directory), without piping it through <literal>systemd-coredump</literal>, set
|
||||
<option>boot.kernel.sysctl."kernel.core_pattern"</option> to <literal>"core"</literal>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<literal>systemd.packages</literal> option now also supports generators and
|
||||
shutdown scripts. Old <literal>systemd.generator-packages</literal> option has
|
||||
been removed.
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
</section>
|
||||
|
|
|
@ -54,11 +54,11 @@ rec {
|
|||
|
||||
machinesNumbered = zipLists machines (range 1 254);
|
||||
|
||||
nodes_ = flip map machinesNumbered (m: nameValuePair m.fst
|
||||
nodes_ = forEach machinesNumbered (m: nameValuePair m.fst
|
||||
[ ( { config, nodes, ... }:
|
||||
let
|
||||
interfacesNumbered = zipLists config.virtualisation.vlans (range 1 255);
|
||||
interfaces = flip map interfacesNumbered ({ fst, snd }:
|
||||
interfaces = forEach interfacesNumbered ({ fst, snd }:
|
||||
nameValuePair "eth${toString snd}" { ipv4.addresses =
|
||||
[ { address = "192.168.${toString fst}.${toString m.snd}";
|
||||
prefixLength = 24;
|
||||
|
@ -88,7 +88,7 @@ rec {
|
|||
"${config.networking.hostName}\n"));
|
||||
|
||||
virtualisation.qemu.options =
|
||||
flip map interfacesNumbered
|
||||
forEach interfacesNumbered
|
||||
({ fst, snd }: qemuNICFlags snd fst m.snd);
|
||||
};
|
||||
}
|
||||
|
|
|
@ -102,7 +102,7 @@ let
|
|||
# builtins multiply by 4 the memory usage and the time used to compute
|
||||
# each options.
|
||||
tryCollectOptions = moduleResult:
|
||||
flip map (excludeOptions (collect isOption moduleResult)) (opt:
|
||||
forEach (excludeOptions (collect isOption moduleResult)) (opt:
|
||||
{ name = showOption opt.loc; } // builtins.tryEval (strict opt.value));
|
||||
in
|
||||
keepNames (
|
||||
|
|
|
@ -52,85 +52,11 @@ let
|
|||
</fontconfig>
|
||||
'';
|
||||
|
||||
# local configuration file
|
||||
localConf = pkgs.writeText "fc-local.conf" cfg.localConf;
|
||||
|
||||
# The configuration to be included in /etc/font/
|
||||
penultimateConf = pkgs.runCommand "font-penultimate-conf" {
|
||||
preferLocalBuild = true;
|
||||
} ''
|
||||
support_folder=$out/etc/fonts/conf.d
|
||||
latest_folder=$out/etc/fonts/${latestVersion}/conf.d
|
||||
|
||||
mkdir -p $support_folder
|
||||
mkdir -p $latest_folder
|
||||
|
||||
ln -s ${supportFontsConf} $support_folder/../fonts.conf
|
||||
ln -s ${latestPkg.out}/etc/fonts/fonts.conf \
|
||||
$latest_folder/../fonts.conf
|
||||
|
||||
# fontconfig-penultimate various configuration files
|
||||
ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
|
||||
$support_folder
|
||||
ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
|
||||
$latest_folder
|
||||
|
||||
ln -s ${cacheConfSupport} $support_folder/00-nixos-cache.conf
|
||||
ln -s ${cacheConfLatest} $latest_folder/00-nixos-cache.conf
|
||||
|
||||
rm $support_folder/10-antialias.conf $latest_folder/10-antialias.conf
|
||||
ln -s ${antialiasConf} $support_folder/10-antialias.conf
|
||||
ln -s ${antialiasConf} $latest_folder/10-antialias.conf
|
||||
|
||||
rm $support_folder/10-hinting.conf $latest_folder/10-hinting.conf
|
||||
ln -s ${hintingConf} $support_folder/10-hinting.conf
|
||||
ln -s ${hintingConf} $latest_folder/10-hinting.conf
|
||||
|
||||
${optionalString cfg.useEmbeddedBitmaps ''
|
||||
rm $support_folder/10-no-embedded-bitmaps.conf
|
||||
rm $latest_folder/10-no-embedded-bitmaps.conf
|
||||
''}
|
||||
|
||||
rm $support_folder/10-subpixel.conf $latest_folder/10-subpixel.conf
|
||||
ln -s ${subpixelConf} $support_folder/10-subpixel.conf
|
||||
ln -s ${subpixelConf} $latest_folder/10-subpixel.conf
|
||||
|
||||
${optionalString (cfg.dpi != 0) ''
|
||||
ln -s ${dpiConf} $support_folder/11-dpi.conf
|
||||
ln -s ${dpiConf} $latest_folder/11-dpi.conf
|
||||
''}
|
||||
|
||||
${optionalString (!cfg.includeUserConf) ''
|
||||
rm $support_folder/50-user.conf
|
||||
rm $latest_folder/50-user.conf
|
||||
''}
|
||||
|
||||
# 51-local.conf
|
||||
rm $latest_folder/51-local.conf
|
||||
substitute \
|
||||
${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/51-local.conf \
|
||||
$latest_folder/51-local.conf \
|
||||
--replace local.conf /etc/fonts/${latestVersion}/local.conf
|
||||
|
||||
# local.conf (indirect priority 51)
|
||||
${optionalString (cfg.localConf != "") ''
|
||||
ln -s ${localConf} $out/etc/fonts/local.conf
|
||||
ln -s ${localConf} $out/etc/fonts/${latestVersion}/local.conf
|
||||
''}
|
||||
|
||||
ln -s ${defaultFontsConf} $support_folder/52-default-fonts.conf
|
||||
ln -s ${defaultFontsConf} $latest_folder/52-default-fonts.conf
|
||||
|
||||
${optionalString cfg.allowBitmaps ''
|
||||
rm $support_folder/53-no-bitmaps.conf
|
||||
rm $latest_folder/53-no-bitmaps.conf
|
||||
''}
|
||||
|
||||
${optionalString (!cfg.allowType1) ''
|
||||
ln -s ${rejectType1} $support_folder/53-no-type1.conf
|
||||
ln -s ${rejectType1} $latest_folder/53-no-type1.conf
|
||||
''}
|
||||
'';
|
||||
|
||||
# rendering settings configuration files
|
||||
# priority 10
|
||||
hintingConf = pkgs.writeText "fc-10-hinting.conf" ''
|
||||
<?xml version='1.0'?>
|
||||
<!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
|
||||
|
@ -199,6 +125,8 @@ let
|
|||
</fontconfig>
|
||||
'';
|
||||
|
||||
# default fonts configuration file
|
||||
# priority 52
|
||||
defaultFontsConf =
|
||||
let genDefault = fonts: name:
|
||||
optionalString (fonts != []) ''
|
||||
|
@ -228,7 +156,9 @@ let
|
|||
</fontconfig>
|
||||
'';
|
||||
|
||||
rejectType1 = pkgs.writeText "fc-53-no-type1.conf" ''
|
||||
# reject Type 1 fonts
|
||||
# priority 53
|
||||
rejectType1 = pkgs.writeText "fc-53-nixos-reject-type1.conf" ''
|
||||
<?xml version="1.0"?>
|
||||
<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
|
||||
<fontconfig>
|
||||
|
@ -245,6 +175,88 @@ let
|
|||
</fontconfig>
|
||||
'';
|
||||
|
||||
# The configuration to be included in /etc/font/
|
||||
penultimateConf = pkgs.runCommand "fontconfig-penultimate-conf" {
|
||||
preferLocalBuild = true;
|
||||
} ''
|
||||
support_folder=$out/etc/fonts/conf.d
|
||||
latest_folder=$out/etc/fonts/${latestVersion}/conf.d
|
||||
|
||||
mkdir -p $support_folder
|
||||
mkdir -p $latest_folder
|
||||
|
||||
# fonts.conf
|
||||
ln -s ${supportFontsConf} $support_folder/../fonts.conf
|
||||
ln -s ${latestPkg.out}/etc/fonts/fonts.conf \
|
||||
$latest_folder/../fonts.conf
|
||||
|
||||
# fontconfig-penultimate various configuration files
|
||||
ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
|
||||
$support_folder
|
||||
ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
|
||||
$latest_folder
|
||||
|
||||
ln -s ${cacheConfSupport} $support_folder/00-nixos-cache.conf
|
||||
ln -s ${cacheConfLatest} $latest_folder/00-nixos-cache.conf
|
||||
|
||||
rm $support_folder/10-antialias.conf $latest_folder/10-antialias.conf
|
||||
ln -s ${antialiasConf} $support_folder/10-antialias.conf
|
||||
ln -s ${antialiasConf} $latest_folder/10-antialias.conf
|
||||
|
||||
rm $support_folder/10-hinting.conf $latest_folder/10-hinting.conf
|
||||
ln -s ${hintingConf} $support_folder/10-hinting.conf
|
||||
ln -s ${hintingConf} $latest_folder/10-hinting.conf
|
||||
|
||||
${optionalString cfg.useEmbeddedBitmaps ''
|
||||
rm $support_folder/10-no-embedded-bitmaps.conf
|
||||
rm $latest_folder/10-no-embedded-bitmaps.conf
|
||||
''}
|
||||
|
||||
rm $support_folder/10-subpixel.conf $latest_folder/10-subpixel.conf
|
||||
ln -s ${subpixelConf} $support_folder/10-subpixel.conf
|
||||
ln -s ${subpixelConf} $latest_folder/10-subpixel.conf
|
||||
|
||||
${optionalString (cfg.dpi != 0) ''
|
||||
ln -s ${dpiConf} $support_folder/11-dpi.conf
|
||||
ln -s ${dpiConf} $latest_folder/11-dpi.conf
|
||||
''}
|
||||
|
||||
# 50-user.conf
|
||||
${optionalString (!cfg.includeUserConf) ''
|
||||
rm $support_folder/50-user.conf
|
||||
rm $latest_folder/50-user.conf
|
||||
''}
|
||||
|
||||
# 51-local.conf
|
||||
rm $latest_folder/51-local.conf
|
||||
substitute \
|
||||
${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/51-local.conf \
|
||||
$latest_folder/51-local.conf \
|
||||
--replace local.conf /etc/fonts/${latestVersion}/local.conf
|
||||
|
||||
# local.conf (indirect priority 51)
|
||||
${optionalString (cfg.localConf != "") ''
|
||||
ln -s ${localConf} $support_folder/../local.conf
|
||||
ln -s ${localConf} $latest_folder/../local.conf
|
||||
''}
|
||||
|
||||
# 52-nixos-default-fonts.conf
|
||||
ln -s ${defaultFontsConf} $support_folder/52-nixos-default-fonts.conf
|
||||
ln -s ${defaultFontsConf} $latest_folder/52-nixos-default-fonts.conf
|
||||
|
||||
# 53-no-bitmaps.conf
|
||||
${optionalString cfg.allowBitmaps ''
|
||||
rm $support_folder/53-no-bitmaps.conf
|
||||
rm $latest_folder/53-no-bitmaps.conf
|
||||
''}
|
||||
|
||||
${optionalString (!cfg.allowType1) ''
|
||||
# 53-nixos-reject-type1.conf
|
||||
ln -s ${rejectType1} $support_folder/53-nixos-reject-type1.conf
|
||||
ln -s ${rejectType1} $latest_folder/53-nixos-reject-type1.conf
|
||||
''}
|
||||
'';
|
||||
|
||||
in
|
||||
{
|
||||
|
||||
|
|
|
@ -14,11 +14,12 @@ Low number means high priority.
|
|||
|
||||
*/
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let cfg = config.fonts.fontconfig;
|
||||
let
|
||||
cfg = config.fonts.fontconfig;
|
||||
|
||||
fcBool = x: "<bool>" + (boolToString x) + "</bool>";
|
||||
|
||||
|
@ -108,7 +109,6 @@ let cfg = config.fonts.fontconfig;
|
|||
'';
|
||||
|
||||
# local configuration file
|
||||
# priority 51
|
||||
localConf = pkgs.writeText "fc-local.conf" cfg.localConf;
|
||||
|
||||
# default fonts configuration file
|
||||
|
@ -144,7 +144,7 @@ let cfg = config.fonts.fontconfig;
|
|||
|
||||
# bitmap font options
|
||||
# priority 53
|
||||
rejectBitmaps = pkgs.writeText "fc-53-nixos-bitmaps.conf" ''
|
||||
rejectBitmaps = pkgs.writeText "fc-53-no-bitmaps.conf" ''
|
||||
<?xml version="1.0"?>
|
||||
<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
|
||||
<fontconfig>
|
||||
|
@ -190,64 +190,66 @@ let cfg = config.fonts.fontconfig;
|
|||
'';
|
||||
|
||||
# fontconfig configuration package
|
||||
confPkg = pkgs.runCommand "fontconfig-conf" { preferLocalBuild = true; } ''
|
||||
support_folder=$out/etc/fonts
|
||||
latest_folder=$out/etc/fonts/${latestVersion}
|
||||
confPkg = pkgs.runCommand "fontconfig-conf" {
|
||||
preferLocalBuild = true;
|
||||
} ''
|
||||
support_folder=$out/etc/fonts/conf.d
|
||||
latest_folder=$out/etc/fonts/${latestVersion}/conf.d
|
||||
|
||||
mkdir -p $support_folder/conf.d
|
||||
mkdir -p $latest_folder/conf.d
|
||||
mkdir -p $support_folder
|
||||
mkdir -p $latest_folder
|
||||
|
||||
# fonts.conf
|
||||
ln -s ${supportFontsConf} $support_folder/fonts.conf
|
||||
ln -s ${supportFontsConf} $support_folder/../fonts.conf
|
||||
ln -s ${latestPkg.out}/etc/fonts/fonts.conf \
|
||||
$latest_folder/fonts.conf
|
||||
$latest_folder/../fonts.conf
|
||||
|
||||
# fontconfig default config files
|
||||
ln -s ${supportPkg.out}/etc/fonts/conf.d/*.conf \
|
||||
$support_folder/conf.d/
|
||||
$support_folder/
|
||||
ln -s ${latestPkg.out}/etc/fonts/conf.d/*.conf \
|
||||
$latest_folder/conf.d/
|
||||
$latest_folder/
|
||||
|
||||
# update latest 51-local.conf path to look at the latest local.conf
|
||||
rm $latest_folder/conf.d/51-local.conf
|
||||
rm $latest_folder/51-local.conf
|
||||
|
||||
substitute ${latestPkg.out}/etc/fonts/conf.d/51-local.conf \
|
||||
$latest_folder/conf.d/51-local.conf \
|
||||
$latest_folder/51-local.conf \
|
||||
--replace local.conf /etc/fonts/${latestVersion}/local.conf
|
||||
|
||||
# 00-nixos-cache.conf
|
||||
ln -s ${cacheConfSupport} \
|
||||
$support_folder/conf.d/00-nixos-cache.conf
|
||||
ln -s ${cacheConfLatest} $latest_folder/conf.d/00-nixos-cache.conf
|
||||
$support_folder/00-nixos-cache.conf
|
||||
ln -s ${cacheConfLatest} $latest_folder/00-nixos-cache.conf
|
||||
|
||||
# 10-nixos-rendering.conf
|
||||
ln -s ${renderConf} $support_folder/conf.d/10-nixos-rendering.conf
|
||||
ln -s ${renderConf} $latest_folder/conf.d/10-nixos-rendering.conf
|
||||
ln -s ${renderConf} $support_folder/10-nixos-rendering.conf
|
||||
ln -s ${renderConf} $latest_folder/10-nixos-rendering.conf
|
||||
|
||||
# 50-user.conf
|
||||
${optionalString (!cfg.includeUserConf) ''
|
||||
rm $support_folder/conf.d/50-user.conf
|
||||
rm $latest_folder/conf.d/50-user.conf
|
||||
rm $support_folder/50-user.conf
|
||||
rm $latest_folder/50-user.conf
|
||||
''}
|
||||
|
||||
# local.conf (indirect priority 51)
|
||||
${optionalString (cfg.localConf != "") ''
|
||||
ln -s ${localConf} $support_folder/local.conf
|
||||
ln -s ${localConf} $latest_folder/local.conf
|
||||
ln -s ${localConf} $support_folder/../local.conf
|
||||
ln -s ${localConf} $latest_folder/../local.conf
|
||||
''}
|
||||
|
||||
# 52-nixos-default-fonts.conf
|
||||
ln -s ${defaultFontsConf} $support_folder/conf.d/52-nixos-default-fonts.conf
|
||||
ln -s ${defaultFontsConf} $latest_folder/conf.d/52-nixos-default-fonts.conf
|
||||
ln -s ${defaultFontsConf} $support_folder/52-nixos-default-fonts.conf
|
||||
ln -s ${defaultFontsConf} $latest_folder/52-nixos-default-fonts.conf
|
||||
|
||||
# 53-nixos-bitmaps.conf
|
||||
ln -s ${rejectBitmaps} $support_folder/conf.d/53-nixos-bitmaps.conf
|
||||
ln -s ${rejectBitmaps} $latest_folder/conf.d/53-nixos-bitmaps.conf
|
||||
# 53-no-bitmaps.conf
|
||||
ln -s ${rejectBitmaps} $support_folder/53-no-bitmaps.conf
|
||||
ln -s ${rejectBitmaps} $latest_folder/53-no-bitmaps.conf
|
||||
|
||||
${optionalString (!cfg.allowType1) ''
|
||||
# 53-nixos-reject-type1.conf
|
||||
ln -s ${rejectType1} $support_folder/conf.d/53-nixos-reject-type1.conf
|
||||
ln -s ${rejectType1} $latest_folder/conf.d/53-nixos-reject-type1.conf
|
||||
ln -s ${rejectType1} $support_folder/53-nixos-reject-type1.conf
|
||||
ln -s ${rejectType1} $latest_folder/53-nixos-reject-type1.conf
|
||||
''}
|
||||
'';
|
||||
|
||||
|
|
102
nixos/modules/config/qt5.nix
Normal file
102
nixos/modules/config/qt5.nix
Normal file
|
@ -0,0 +1,102 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
|
||||
cfg = config.qt5;
|
||||
|
||||
isQGnome = cfg.platformTheme == "gnome" && cfg.style == "adwaita";
|
||||
isQtStyle = cfg.platformTheme == "gtk2" && cfg.style != "adwaita";
|
||||
|
||||
packages = if isQGnome then [ pkgs.qgnomeplatform pkgs.adwaita-qt ]
|
||||
else if isQtStyle then [ pkgs.qtstyleplugins ]
|
||||
else throw "`qt5.platformTheme` ${cfg.platformTheme} and `qt5.style` ${cfg.style} are not compatible.";
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
|
||||
options = {
|
||||
qt5 = {
|
||||
|
||||
enable = mkEnableOption "Qt5 theming configuration";
|
||||
|
||||
platformTheme = mkOption {
|
||||
type = types.enum [
|
||||
"gtk2"
|
||||
"gnome"
|
||||
];
|
||||
example = "gnome";
|
||||
relatedPackages = [
|
||||
"qgnomeplatform"
|
||||
["libsForQt5" "qtstyleplugins"]
|
||||
];
|
||||
description = ''
|
||||
Selects the platform theme to use for Qt5 applications.</para>
|
||||
<para>The options are
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term><literal>gtk</literal></term>
|
||||
<listitem><para>Use GTK theme with
|
||||
<link xlink:href="https://github.com/qt/qtstyleplugins">qtstyleplugins</link>
|
||||
</para></listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><literal>gnome</literal></term>
|
||||
<listitem><para>Use GNOME theme with
|
||||
<link xlink:href="https://github.com/FedoraQt/QGnomePlatform">qgnomeplatform</link>
|
||||
</para></listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
'';
|
||||
};
|
||||
|
||||
style = mkOption {
|
||||
type = types.enum [
|
||||
"adwaita"
|
||||
"cleanlooks"
|
||||
"gtk2"
|
||||
"motif"
|
||||
"plastique"
|
||||
];
|
||||
example = "adwaita";
|
||||
relatedPackages = [
|
||||
"adwaita-qt"
|
||||
["libsForQt5" "qtstyleplugins"]
|
||||
];
|
||||
description = ''
|
||||
Selects the style to use for Qt5 applications.</para>
|
||||
<para>The options are
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term><literal>adwaita</literal></term>
|
||||
<listitem><para>Use Adwaita Qt style with
|
||||
<link xlink:href="https://github.com/FedoraQt/adwaita-qt">adwaita</link>
|
||||
</para></listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><literal>cleanlooks</literal></term>
|
||||
<term><literal>gtk2</literal></term>
|
||||
<term><literal>motif</literal></term>
|
||||
<term><literal>plastique</literal></term>
|
||||
<listitem><para>Use styles from
|
||||
<link xlink:href="https://github.com/qt/qtstyleplugins">qtstyleplugins</link>
|
||||
</para></listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
environment.variables.QT_QPA_PLATFORMTHEME = cfg.platformTheme;
|
||||
|
||||
environment.variables.QT_STYLE_OVERRIDE = cfg.style;
|
||||
|
||||
environment.systemPackages = packages;
|
||||
|
||||
};
|
||||
}
|
|
@ -42,22 +42,16 @@ in
|
|||
|
||||
config = {
|
||||
|
||||
environment.etc."sysctl.d/nixos.conf".text =
|
||||
environment.etc."sysctl.d/60-nixos.conf".text =
|
||||
concatStrings (mapAttrsToList (n: v:
|
||||
optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n"
|
||||
) config.boot.kernel.sysctl);
|
||||
|
||||
systemd.services.systemd-sysctl =
|
||||
{ wantedBy = [ "multi-user.target" ];
|
||||
restartTriggers = [ config.environment.etc."sysctl.d/nixos.conf".source ];
|
||||
restartTriggers = [ config.environment.etc."sysctl.d/60-nixos.conf".source ];
|
||||
};
|
||||
|
||||
# Enable hardlink and symlink restrictions. See
|
||||
# https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=800179c9b8a1e796e441674776d11cd4c05d61d7
|
||||
# for details.
|
||||
boot.kernel.sysctl."fs.protected_hardlinks" = true;
|
||||
boot.kernel.sysctl."fs.protected_symlinks" = true;
|
||||
|
||||
# Hide kernel pointers (e.g. in /proc/modules) for unprivileged
|
||||
# users as these make it easier to exploit kernel vulnerabilities.
|
||||
boot.kernel.sysctl."kernel.kptr_restrict" = 1;
|
||||
|
|
52
nixos/modules/config/vte.nix
Normal file
52
nixos/modules/config/vte.nix
Normal file
|
@ -0,0 +1,52 @@
|
|||
# VTE
|
||||
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
|
||||
vteInitSnippet = ''
|
||||
# Show current working directory in VTE terminals window title.
|
||||
# Supports both bash and zsh, requires interactive shell.
|
||||
. ${pkgs.vte}/etc/profile.d/vte.sh
|
||||
'';
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
|
||||
options = {
|
||||
|
||||
programs.bash.vteIntegration = mkOption {
|
||||
default = false;
|
||||
type = types.bool;
|
||||
description = ''
|
||||
Whether to enable Bash integration for VTE terminals.
|
||||
This allows it to preserve the current directory of the shell
|
||||
across terminals.
|
||||
'';
|
||||
};
|
||||
|
||||
programs.zsh.vteIntegration = mkOption {
|
||||
default = false;
|
||||
type = types.bool;
|
||||
description = ''
|
||||
Whether to enable Zsh integration for VTE terminals.
|
||||
This allows it to preserve the current directory of the shell
|
||||
across terminals.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = mkMerge [
|
||||
(mkIf config.programs.bash.vteIntegration {
|
||||
programs.bash.interactiveShellInit = vteInitSnippet;
|
||||
})
|
||||
|
||||
(mkIf config.programs.zsh.vteIntegration {
|
||||
programs.zsh.interactiveShellInit = vteInitSnippet;
|
||||
})
|
||||
];
|
||||
}
|
|
@ -73,8 +73,8 @@ in
|
|||
|
||||
firmwareSize = mkOption {
|
||||
type = types.int;
|
||||
# As of 2019-05-31 the Raspberry pi firmware + u-bot takes ~13MiB
|
||||
default = 20;
|
||||
# As of 2019-08-18 the Raspberry pi firmware + u-boot takes ~18MiB
|
||||
default = 30;
|
||||
description = ''
|
||||
Size of the /boot/firmware partition, in megabytes.
|
||||
'';
|
||||
|
|
|
@ -27,6 +27,7 @@
|
|||
./config/nsswitch.nix
|
||||
./config/power-management.nix
|
||||
./config/pulseaudio.nix
|
||||
./config/qt5.nix
|
||||
./config/resolvconf.nix
|
||||
./config/shells-environment.nix
|
||||
./config/swap.nix
|
||||
|
@ -37,6 +38,7 @@
|
|||
./config/unix-odbc-drivers.nix
|
||||
./config/users-groups.nix
|
||||
./config/vpnc.nix
|
||||
./config/vte.nix
|
||||
./config/zram.nix
|
||||
./hardware/acpilight.nix
|
||||
./hardware/all-firmware.nix
|
||||
|
@ -115,6 +117,7 @@
|
|||
./programs/fuse.nix
|
||||
./programs/gnome-disks.nix
|
||||
./programs/gnome-documents.nix
|
||||
./programs/gnome-terminal.nix
|
||||
./programs/gpaste.nix
|
||||
./programs/gnupg.nix
|
||||
./programs/gphoto2.nix
|
||||
|
@ -285,6 +288,7 @@
|
|||
./services/desktops/flatpak.nix
|
||||
./services/desktops/geoclue2.nix
|
||||
./services/desktops/gsignond.nix
|
||||
./services/desktops/gvfs.nix
|
||||
./services/desktops/pipewire.nix
|
||||
./services/desktops/gnome3/at-spi2-core.nix
|
||||
./services/desktops/gnome3/chrome-gnome-shell.nix
|
||||
|
@ -295,9 +299,7 @@
|
|||
./services/desktops/gnome3/gnome-remote-desktop.nix
|
||||
./services/desktops/gnome3/gnome-online-miners.nix
|
||||
./services/desktops/gnome3/gnome-settings-daemon.nix
|
||||
./services/desktops/gnome3/gnome-terminal-server.nix
|
||||
./services/desktops/gnome3/gnome-user-share.nix
|
||||
./services/desktops/gnome3/gvfs.nix
|
||||
./services/desktops/gnome3/rygel.nix
|
||||
./services/desktops/gnome3/seahorse.nix
|
||||
./services/desktops/gnome3/sushi.nix
|
||||
|
@ -436,13 +438,13 @@
|
|||
./services/misc/logkeys.nix
|
||||
./services/misc/leaps.nix
|
||||
./services/misc/lidarr.nix
|
||||
./services/misc/mantisbt.nix
|
||||
./services/misc/mathics.nix
|
||||
./services/misc/matrix-synapse.nix
|
||||
./services/misc/mbpfan.nix
|
||||
./services/misc/mediatomb.nix
|
||||
./services/misc/mesos-master.nix
|
||||
./services/misc/mesos-slave.nix
|
||||
./services/misc/metabase.nix
|
||||
./services/misc/mwlib.nix
|
||||
./services/misc/nix-daemon.nix
|
||||
./services/misc/nix-gc.nix
|
||||
|
@ -520,7 +522,6 @@
|
|||
./services/monitoring/scollector.nix
|
||||
./services/monitoring/smartd.nix
|
||||
./services/monitoring/sysstat.nix
|
||||
./services/monitoring/systemhealth.nix
|
||||
./services/monitoring/teamviewer.nix
|
||||
./services/monitoring/telegraf.nix
|
||||
./services/monitoring/thanos.nix
|
||||
|
@ -608,6 +609,7 @@
|
|||
./services/networking/iodine.nix
|
||||
./services/networking/iperf3.nix
|
||||
./services/networking/ircd-hybrid/default.nix
|
||||
./services/networking/jormungandr.nix
|
||||
./services/networking/iwd.nix
|
||||
./services/networking/keepalived/default.nix
|
||||
./services/networking/keybase.nix
|
||||
|
@ -862,7 +864,6 @@
|
|||
./system/activation/activation-script.nix
|
||||
./system/activation/top-level.nix
|
||||
./system/boot/binfmt.nix
|
||||
./system/boot/coredump.nix
|
||||
./system/boot/emergency-mode.nix
|
||||
./system/boot/grow-partition.nix
|
||||
./system/boot/initrd-network.nix
|
||||
|
|
|
@ -14,8 +14,6 @@ with lib;
|
|||
|
||||
nix.allowedUsers = mkDefault [ "@users" ];
|
||||
|
||||
environment.memoryAllocator.provider = mkDefault "graphene-hardened";
|
||||
|
||||
security.hideProcessInformation = mkDefault true;
|
||||
|
||||
security.lockKernelModules = mkDefault true;
|
||||
|
@ -95,23 +93,17 @@ with lib;
|
|||
# Disable ftrace debugging
|
||||
boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false;
|
||||
|
||||
# Enable reverse path filtering (that is, do not attempt to route packets
|
||||
# that "obviously" do not belong to the iface's network; dropped packets are
|
||||
# logged as martians).
|
||||
# Enable strict reverse path filtering (that is, do not attempt to route
|
||||
# packets that "obviously" do not belong to the iface's network; dropped
|
||||
# packets are logged as martians).
|
||||
boot.kernel.sysctl."net.ipv4.conf.all.log_martians" = mkDefault true;
|
||||
boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = mkDefault true;
|
||||
boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = mkDefault "1";
|
||||
boot.kernel.sysctl."net.ipv4.conf.default.log_martians" = mkDefault true;
|
||||
boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = mkDefault true;
|
||||
boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = mkDefault "1";
|
||||
|
||||
# Ignore broadcast ICMP (mitigate SMURF)
|
||||
boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault true;
|
||||
|
||||
# Ignore route information from sender
|
||||
boot.kernel.sysctl."net.ipv4.conf.all.accept_source_route" = mkDefault false;
|
||||
boot.kernel.sysctl."net.ipv4.conf.default.accept_source_route" = mkDefault false;
|
||||
boot.kernel.sysctl."net.ipv6.conf.all.accept_source_route" = mkDefault false;
|
||||
boot.kernel.sysctl."net.ipv6.conf.default.accept_source_route" = mkDefault false;
|
||||
|
||||
# Ignore incoming ICMP redirects (note: default is needed to ensure that the
|
||||
# setting is applied to interfaces added after the sysctls are set)
|
||||
boot.kernel.sysctl."net.ipv4.conf.all.accept_redirects" = mkDefault false;
|
||||
|
|
|
@ -34,11 +34,11 @@ in
|
|||
|
||||
services.dbus.packages = [ pkgs.gnome3.dconf ];
|
||||
|
||||
environment.variables.GIO_EXTRA_MODULES = optional cfg.enable
|
||||
"${pkgs.gnome3.dconf.lib}/lib/gio/modules";
|
||||
# https://github.com/NixOS/nixpkgs/pull/31891
|
||||
#environment.variables.XDG_DATA_DIRS = optional cfg.enable
|
||||
# "$(echo ${pkgs.gsettings-desktop-schemas}/share/gsettings-schemas/gsettings-desktop-schemas-*)";
|
||||
# For dconf executable
|
||||
environment.systemPackages = [ pkgs.gnome3.dconf ];
|
||||
|
||||
# Needed for unwrapped applications
|
||||
environment.variables.GIO_EXTRA_MODULES = mkIf cfg.enable [ "${pkgs.gnome3.dconf.lib}/lib/gio/modules" ];
|
||||
};
|
||||
|
||||
}
|
||||
|
|
36
nixos/modules/programs/gnome-terminal.nix
Normal file
36
nixos/modules/programs/gnome-terminal.nix
Normal file
|
@ -0,0 +1,36 @@
|
|||
# GNOME Terminal.
|
||||
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
|
||||
cfg = config.programs.gnome-terminal;
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
|
||||
# Added 2019-08-19
|
||||
imports = [
|
||||
(mkRenamedOptionModule
|
||||
[ "services" "gnome3" "gnome-terminal-server" "enable" ]
|
||||
[ "programs" "gnome-terminal" "enable" ])
|
||||
];
|
||||
|
||||
options = {
|
||||
|
||||
programs.gnome-terminal.enable = mkEnableOption "GNOME Terminal";
|
||||
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = [ pkgs.gnome3.gnome-terminal ];
|
||||
services.dbus.packages = [ pkgs.gnome3.gnome-terminal ];
|
||||
systemd.packages = [ pkgs.gnome3.gnome-terminal ];
|
||||
|
||||
programs.bash.vteIntegration = true;
|
||||
programs.zsh.vteIntegration = true;
|
||||
};
|
||||
}
|
|
@ -69,9 +69,7 @@ in
|
|||
|
||||
promptInit = mkOption {
|
||||
default = ''
|
||||
if [ "$TERM" != dumb ]; then
|
||||
autoload -U promptinit && promptinit && prompt walters
|
||||
fi
|
||||
autoload -U promptinit && promptinit && prompt walters && setopt prompt_sp
|
||||
'';
|
||||
description = ''
|
||||
Shell script code used to initialise the zsh prompt.
|
||||
|
@ -213,6 +211,15 @@ in
|
|||
|
||||
${cfg.promptInit}
|
||||
|
||||
# Need to disable features to support TRAMP
|
||||
if [ "$TERM" = dumb ]; then
|
||||
unsetopt zle prompt_cr prompt_subst
|
||||
unfunction precmd preexec
|
||||
unset RPS1 RPROMPT
|
||||
PS1='$ '
|
||||
PROMPT='$ '
|
||||
fi
|
||||
|
||||
# Read system-wide modifications.
|
||||
if test -f /etc/zshrc.local; then
|
||||
. /etc/zshrc.local
|
||||
|
|
|
@ -226,6 +226,7 @@ with lib;
|
|||
(mkRemovedOptionModule [ "services" "mysql" "rootPassword" ] "Use socket authentication or set the password outside of the nix store.")
|
||||
(mkRemovedOptionModule [ "services" "zabbixServer" "dbPassword" ] "Use services.zabbixServer.database.passwordFile instead.")
|
||||
(mkRemovedOptionModule [ "systemd" "generator-packages" ] "Use systemd.packages instead.")
|
||||
(mkRemovedOptionModule [ "systemd" "coredump" "enable" ] "Enabled by default. Set boot.kernel.sysctl.\"kernel.core_pattern\" = \"core\"; to disable.")
|
||||
|
||||
# ZSH
|
||||
(mkRenamedOptionModule [ "programs" "zsh" "enableSyntaxHighlighting" ] [ "programs" "zsh" "syntaxHighlighting" "enable" ])
|
||||
|
@ -276,7 +277,7 @@ with lib;
|
|||
throw "services.redshift.longitude is set to null, you can remove this"
|
||||
else builtins.fromJSON value))
|
||||
|
||||
] ++ (flip map [ "blackboxExporter" "collectdExporter" "fritzboxExporter"
|
||||
] ++ (forEach [ "blackboxExporter" "collectdExporter" "fritzboxExporter"
|
||||
"jsonExporter" "minioExporter" "nginxExporter" "nodeExporter"
|
||||
"snmpExporter" "unifiExporter" "varnishExporter" ]
|
||||
(opt: mkRemovedOptionModule [ "services" "prometheus" "${opt}" ] ''
|
||||
|
|
|
@ -19,6 +19,20 @@ in {
|
|||
TCP: 9100 - 9200
|
||||
'';
|
||||
};
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "roon-server";
|
||||
description = ''
|
||||
User to run the Roon Server as.
|
||||
'';
|
||||
};
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
default = "roon-server";
|
||||
description = ''
|
||||
Group to run the Roon Server as.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
@ -33,8 +47,8 @@ in {
|
|||
serviceConfig = {
|
||||
ExecStart = "${pkgs.roon-server}/opt/start.sh";
|
||||
LimitNOFILE = 8192;
|
||||
DynamicUser = true;
|
||||
SupplementaryGroups = "audio";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
StateDirectory = name;
|
||||
};
|
||||
};
|
||||
|
@ -45,5 +59,15 @@ in {
|
|||
];
|
||||
allowedUDPPorts = [ 9003 ];
|
||||
};
|
||||
|
||||
|
||||
users.groups."${cfg.group}" = {};
|
||||
users.users."${cfg.user}" =
|
||||
if cfg.user == "roon-server" then {
|
||||
isSystemUser = true;
|
||||
description = "Roon Server user";
|
||||
groups = [ cfg.group "audio" ];
|
||||
}
|
||||
else {};
|
||||
};
|
||||
}
|
||||
|
|
|
@ -30,9 +30,9 @@ with lib;
|
|||
|
||||
config = mkIf config.services.gnome3.gnome-online-accounts.enable {
|
||||
|
||||
environment.systemPackages = [ pkgs.gnome3.gnome-online-accounts ];
|
||||
environment.systemPackages = [ pkgs.gnome-online-accounts ];
|
||||
|
||||
services.dbus.packages = [ pkgs.gnome3.gnome-online-accounts ];
|
||||
services.dbus.packages = [ pkgs.gnome-online-accounts ];
|
||||
|
||||
};
|
||||
|
||||
|
|
|
@ -1,41 +0,0 @@
|
|||
# GNOME Documents daemon.
|
||||
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
{
|
||||
|
||||
###### interface
|
||||
|
||||
options = {
|
||||
|
||||
services.gnome3.gnome-terminal-server = {
|
||||
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to enable GNOME Terminal server service,
|
||||
needed for gnome-terminal.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
|
||||
###### implementation
|
||||
|
||||
config = mkIf config.services.gnome3.gnome-terminal-server.enable {
|
||||
|
||||
environment.systemPackages = [ pkgs.gnome3.gnome-terminal ];
|
||||
|
||||
services.dbus.packages = [ pkgs.gnome3.gnome-terminal ];
|
||||
|
||||
systemd.packages = [ pkgs.gnome3.gnome-terminal ];
|
||||
|
||||
};
|
||||
|
||||
}
|
|
@ -1,43 +0,0 @@
|
|||
# gvfs backends
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
{
|
||||
|
||||
###### interface
|
||||
|
||||
options = {
|
||||
|
||||
services.gnome3.gvfs = {
|
||||
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to enable gvfs backends, userspace virtual filesystem used
|
||||
by GNOME components via D-Bus.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
|
||||
###### implementation
|
||||
|
||||
config = mkIf config.services.gnome3.gvfs.enable {
|
||||
|
||||
environment.systemPackages = [ pkgs.gnome3.gvfs ];
|
||||
|
||||
services.dbus.packages = [ pkgs.gnome3.gvfs ];
|
||||
|
||||
systemd.packages = [ pkgs.gnome3.gvfs ];
|
||||
|
||||
services.udev.packages = [ pkgs.libmtp.bin ];
|
||||
|
||||
};
|
||||
|
||||
}
|
|
@ -30,11 +30,11 @@ with lib;
|
|||
|
||||
config = mkIf config.services.gnome3.tracker-miners.enable {
|
||||
|
||||
environment.systemPackages = [ pkgs.gnome3.tracker-miners ];
|
||||
environment.systemPackages = [ pkgs.tracker-miners ];
|
||||
|
||||
services.dbus.packages = [ pkgs.gnome3.tracker-miners ];
|
||||
services.dbus.packages = [ pkgs.tracker-miners ];
|
||||
|
||||
systemd.packages = [ pkgs.gnome3.tracker-miners ];
|
||||
systemd.packages = [ pkgs.tracker-miners ];
|
||||
|
||||
};
|
||||
|
||||
|
|
|
@ -30,11 +30,11 @@ with lib;
|
|||
|
||||
config = mkIf config.services.gnome3.tracker.enable {
|
||||
|
||||
environment.systemPackages = [ pkgs.gnome3.tracker ];
|
||||
environment.systemPackages = [ pkgs.tracker ];
|
||||
|
||||
services.dbus.packages = [ pkgs.gnome3.tracker ];
|
||||
services.dbus.packages = [ pkgs.tracker ];
|
||||
|
||||
systemd.packages = [ pkgs.gnome3.tracker ];
|
||||
systemd.packages = [ pkgs.tracker ];
|
||||
|
||||
};
|
||||
|
||||
|
|
59
nixos/modules/services/desktops/gvfs.nix
Normal file
59
nixos/modules/services/desktops/gvfs.nix
Normal file
|
@ -0,0 +1,59 @@
|
|||
# GVfs
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
|
||||
cfg = config.services.gvfs;
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
|
||||
# Added 2019-08-19
|
||||
imports = [
|
||||
(mkRenamedOptionModule
|
||||
[ "services" "gnome3" "gvfs" "enable" ]
|
||||
[ "services" "gvfs" "enable" ])
|
||||
];
|
||||
|
||||
###### interface
|
||||
|
||||
options = {
|
||||
|
||||
services.gvfs = {
|
||||
|
||||
enable = mkEnableOption "GVfs, a userspace virtual filesystem";
|
||||
|
||||
# gvfs can be built with multiple configurations
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.gnome3.gvfs;
|
||||
description = "Which GVfs package to use.";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
|
||||
###### implementation
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
|
||||
services.dbus.packages = [ cfg.package ];
|
||||
|
||||
systemd.packages = [ cfg.package ];
|
||||
|
||||
services.udev.packages = [ pkgs.libmtp.bin ];
|
||||
|
||||
# Needed for unwrapped applications
|
||||
environment.variables.GIO_EXTRA_MODULES = [ "${cfg.package}/lib/gio/modules" ];
|
||||
|
||||
};
|
||||
|
||||
}
|
|
@ -5,6 +5,12 @@ let
|
|||
cfg = config.services.trezord;
|
||||
in {
|
||||
|
||||
### docs
|
||||
|
||||
meta = {
|
||||
doc = ./trezord.xml;
|
||||
};
|
||||
|
||||
### interface
|
||||
|
||||
options = {
|
||||
|
@ -16,6 +22,22 @@ in {
|
|||
Enable Trezor bridge daemon, for use with Trezor hardware bitcoin wallets.
|
||||
'';
|
||||
};
|
||||
|
||||
emulator.enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Enable Trezor emulator support.
|
||||
'';
|
||||
};
|
||||
|
||||
emulator.port = mkOption {
|
||||
type = types.port;
|
||||
default = 21324;
|
||||
description = ''
|
||||
Listening port for the Trezor emulator.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
@ -44,7 +66,7 @@ in {
|
|||
path = [];
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = "${pkgs.trezord}/bin/trezord-go";
|
||||
ExecStart = "${pkgs.trezord}/bin/trezord-go ${optionalString cfg.emulator.enable "-e ${builtins.toString cfg.emulator.port}"}";
|
||||
User = "trezord";
|
||||
};
|
||||
};
|
||||
|
|
26
nixos/modules/services/hardware/trezord.xml
Normal file
26
nixos/modules/services/hardware/trezord.xml
Normal file
|
@ -0,0 +1,26 @@
|
|||
<chapter xmlns="http://docbook.org/ns/docbook"
|
||||
xmlns:xlink="http://www.w3.org/1999/xlink"
|
||||
xmlns:xi="http://www.w3.org/2001/XInclude"
|
||||
version="5.0"
|
||||
xml:id="trezor">
|
||||
<title>Trezor</title>
|
||||
<para>
|
||||
Trezor is an open-source cryptocurrency hardware wallet and security token
|
||||
allowing secure storage of private keys.
|
||||
</para>
|
||||
<para>
|
||||
It offers advanced features such U2F two-factor authorization, SSH login
|
||||
through
|
||||
<link xlink:href="https://wiki.trezor.io/Apps:SSH_agent">Trezor SSH agent</link>,
|
||||
<link xlink:href="https://wiki.trezor.io/GPG">GPG</link> and a
|
||||
<link xlink:href="https://wiki.trezor.io/Trezor_Password_Manager">password manager</link>.
|
||||
For more information, guides and documentation, see <link xlink:href="https://wiki.trezor.io"/>.
|
||||
</para>
|
||||
<para>
|
||||
To enable Trezor support, add the following to your <filename>configuration.nix</filename>:
|
||||
<programlisting>
|
||||
<xref linkend="opt-services.trezord.enable"/> = true;
|
||||
</programlisting>
|
||||
This will add all necessary udev rules and start Trezor Bridge.
|
||||
</para>
|
||||
</chapter>
|
|
@ -4,6 +4,7 @@ with lib;
|
|||
|
||||
let
|
||||
cfg = config.services.awstats;
|
||||
httpd = config.services.httpd;
|
||||
package = pkgs.awstats;
|
||||
in
|
||||
|
||||
|
@ -67,29 +68,32 @@ in
|
|||
environment.etc."awstats/awstats.conf".source = pkgs.runCommand "awstats.conf"
|
||||
{ preferLocalBuild = true; }
|
||||
( let
|
||||
cfg-httpd = config.services.httpd;
|
||||
logFormat =
|
||||
if cfg-httpd.logFormat == "combined" then "1" else
|
||||
if cfg-httpd.logFormat == "common" then "4" else
|
||||
throw "awstats service doesn't support Apache log format `${cfg-httpd.logFormat}`";
|
||||
if httpd.logFormat == "combined" then "1" else
|
||||
if httpd.logFormat == "common" then "4" else
|
||||
throw "awstats service doesn't support Apache log format `${httpd.logFormat}`";
|
||||
in
|
||||
''
|
||||
sed \
|
||||
-e 's|^\(DirData\)=.*$|\1="${cfg.vardir}"|' \
|
||||
-e 's|^\(DirIcons\)=.*$|\1="icons"|' \
|
||||
-e 's|^\(CreateDirDataIfNotExists\)=.*$|\1=1|' \
|
||||
-e 's|^\(SiteDomain\)=.*$|\1="${cfg-httpd.hostName}"|' \
|
||||
-e 's|^\(LogFile\)=.*$|\1="${cfg-httpd.logDir}/access_log"|' \
|
||||
-e 's|^\(SiteDomain\)=.*$|\1="${httpd.hostName}"|' \
|
||||
-e 's|^\(LogFile\)=.*$|\1="${httpd.logDir}/access_log"|' \
|
||||
-e 's|^\(LogFormat\)=.*$|\1=${logFormat}|' \
|
||||
< '${package.out}/wwwroot/cgi-bin/awstats.model.conf' > "$out"
|
||||
echo '${cfg.extraConfig}' >> "$out"
|
||||
'');
|
||||
|
||||
systemd.tmpfiles.rules = optionals cfg.service.enable [
|
||||
"d '${cfg.vardir}' - ${httpd.user} ${httpd.group} - -"
|
||||
"Z '${cfg.vardir}' - ${httpd.user} ${httpd.group} - -"
|
||||
];
|
||||
|
||||
# The httpd sub-service showing awstats.
|
||||
services.httpd.enable = mkIf cfg.service.enable true;
|
||||
services.httpd.extraSubservices = mkIf cfg.service.enable [ { function = { serverInfo, ... }: {
|
||||
extraConfig =
|
||||
''
|
||||
services.httpd = optionalAttrs cfg.service.enable {
|
||||
enable = true;
|
||||
extraConfig = ''
|
||||
Alias ${cfg.service.urlPrefix}/classes "${package.out}/wwwroot/classes/"
|
||||
Alias ${cfg.service.urlPrefix}/css "${package.out}/wwwroot/css/"
|
||||
Alias ${cfg.service.urlPrefix}/icons "${package.out}/wwwroot/icon/"
|
||||
|
@ -97,20 +101,10 @@ in
|
|||
|
||||
<Directory "${package.out}/wwwroot">
|
||||
Options None
|
||||
AllowOverride None
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
Require all granted
|
||||
</Directory>
|
||||
'';
|
||||
startupScript =
|
||||
let
|
||||
inherit (serverInfo.serverConfig) user group;
|
||||
in pkgs.writeScript "awstats_startup.sh"
|
||||
''
|
||||
mkdir -p '${cfg.vardir}'
|
||||
chown '${user}:${group}' '${cfg.vardir}'
|
||||
'';
|
||||
};}];
|
||||
};
|
||||
|
||||
systemd.services.awstats-update = mkIf (cfg.updateAt != null) {
|
||||
description = "awstats log collector";
|
||||
|
|
|
@ -659,7 +659,7 @@ in {
|
|||
fi
|
||||
|
||||
# We remove potentially broken links to old gitlab-shell versions
|
||||
rm -f ${cfg.statePath}/repositories/**/*.git/hooks
|
||||
rm -Rf ${cfg.statePath}/repositories/**/*.git/hooks
|
||||
|
||||
${pkgs.sudo}/bin/sudo -u ${cfg.user} -H ${pkgs.git}/bin/git config --global core.autocrlf "input"
|
||||
'';
|
||||
|
|
|
@ -1,68 +0,0 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
cfg = config.services.mantisbt;
|
||||
|
||||
freshInstall = cfg.extraConfig == "";
|
||||
|
||||
# combined code+config directory
|
||||
mantisbt = let
|
||||
config_inc = pkgs.writeText "config_inc.php" ("<?php\n" + cfg.extraConfig);
|
||||
src = pkgs.fetchurl {
|
||||
url = "mirror://sourceforge/mantisbt/${name}.tar.gz";
|
||||
sha256 = "1pl6xn793p3mxc6ibpr2bhg85vkdlcf57yk7pfc399g47l8x4508";
|
||||
};
|
||||
name = "mantisbt-1.2.19";
|
||||
in
|
||||
# We have to copy every time; otherwise config won't be found.
|
||||
pkgs.runCommand name
|
||||
{ preferLocalBuild = true; allowSubstitutes = false; }
|
||||
(''
|
||||
mkdir -p "$out"
|
||||
cd "$out"
|
||||
tar -xf '${src}' --strip-components=1
|
||||
ln -s '${config_inc}' config_inc.php
|
||||
''
|
||||
+ lib.optionalString (!freshInstall) "rm -r admin/"
|
||||
);
|
||||
in
|
||||
{
|
||||
options.services.mantisbt = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Enable the mantisbt web service.
|
||||
This switches on httpd with PHP and database.
|
||||
'';
|
||||
};
|
||||
urlPrefix = mkOption {
|
||||
type = types.string;
|
||||
default = "/mantisbt";
|
||||
description = "The URL prefix under which the mantisbt service appears.";
|
||||
};
|
||||
extraConfig = mkOption {
|
||||
type = types.lines;
|
||||
default = "";
|
||||
description = ''
|
||||
The contents of config_inc.php, without leading <?php.
|
||||
If left empty, the admin directory will be accessible.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.mysql.enable = true;
|
||||
services.httpd.enable = true;
|
||||
services.httpd.enablePHP = true;
|
||||
# The httpd sub-service showing mantisbt.
|
||||
services.httpd.extraSubservices = [ { function = { ... }: {
|
||||
extraConfig =
|
||||
''
|
||||
Alias ${cfg.urlPrefix} "${mantisbt}"
|
||||
'';
|
||||
};}];
|
||||
};
|
||||
}
|
|
@ -684,7 +684,7 @@ in {
|
|||
fi
|
||||
'';
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
Type = "notify";
|
||||
User = "matrix-synapse";
|
||||
Group = "matrix-synapse";
|
||||
WorkingDirectory = cfg.dataDir;
|
||||
|
|
103
nixos/modules/services/misc/metabase.nix
Normal file
103
nixos/modules/services/misc/metabase.nix
Normal file
|
@ -0,0 +1,103 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.metabase;
|
||||
|
||||
inherit (lib) mkEnableOption mkIf mkOption;
|
||||
inherit (lib) optional optionalAttrs types;
|
||||
|
||||
dataDir = "/var/lib/metabase";
|
||||
|
||||
in {
|
||||
|
||||
options = {
|
||||
|
||||
services.metabase = {
|
||||
enable = mkEnableOption "Metabase service";
|
||||
|
||||
listen = {
|
||||
ip = mkOption {
|
||||
type = types.str;
|
||||
default = "0.0.0.0";
|
||||
description = ''
|
||||
IP address that Metabase should listen on.
|
||||
'';
|
||||
};
|
||||
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
default = 3000;
|
||||
description = ''
|
||||
Listen port for Metabase.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
ssl = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to enable SSL (https) support.
|
||||
'';
|
||||
};
|
||||
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
default = 8443;
|
||||
description = ''
|
||||
Listen port over SSL (https) for Metabase.
|
||||
'';
|
||||
};
|
||||
|
||||
keystore = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = "${dataDir}/metabase.jks";
|
||||
example = "/etc/secrets/keystore.jks";
|
||||
description = ''
|
||||
<link xlink:href="https://www.digitalocean.com/community/tutorials/java-keytool-essentials-working-with-java-keystores">Java KeyStore</link> file containing the certificates.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
openFirewall = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Open ports in the firewall for Metabase.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
systemd.services.metabase = {
|
||||
description = "Metabase server";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
environment = {
|
||||
MB_PLUGINS_DIR = "${dataDir}/plugins";
|
||||
MB_DB_FILE = "${dataDir}/metabase.db";
|
||||
MB_JETTY_HOST = cfg.listen.ip;
|
||||
MB_JETTY_PORT = toString cfg.listen.port;
|
||||
} // optionalAttrs (cfg.ssl.enable) {
|
||||
MB_JETTY_SSL = true;
|
||||
MB_JETTY_SSL_PORT = toString cfg.ssl.port;
|
||||
MB_JETTY_SSL_KEYSTORE = cfg.ssl.keystore;
|
||||
};
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
StateDirectory = baseNameOf dataDir;
|
||||
ExecStart = "${pkgs.metabase}/bin/metabase";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall = mkIf cfg.openFirewall {
|
||||
allowedTCPPorts = [ cfg.listen.port ] ++ optional cfg.ssl.enable cfg.ssl.port;
|
||||
};
|
||||
|
||||
};
|
||||
}
|
|
@ -84,6 +84,16 @@ in {
|
|||
type = types.bool;
|
||||
description = "Cadvisor storage driver, enable secure communication.";
|
||||
};
|
||||
|
||||
extraOptions = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
description = ''
|
||||
Additional cadvisor options.
|
||||
|
||||
See <link xlink:href='https://github.com/google/cadvisor/blob/master/docs/runtime_options.md'/> for available options.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
@ -112,6 +122,7 @@ in {
|
|||
-logtostderr=true \
|
||||
-listen_ip="${cfg.listenAddress}" \
|
||||
-port="${toString cfg.port}" \
|
||||
${escapeShellArgs cfg.extraOptions} \
|
||||
${optionalString (cfg.storageDriver != null) ''
|
||||
-storage_driver "${cfg.storageDriver}" \
|
||||
-storage_driver_user "${cfg.storageDriverHost}" \
|
||||
|
|
|
@ -11,7 +11,7 @@ let
|
|||
|
||||
healthLauncher = writeScriptBin "riemann-health" ''
|
||||
#!/bin/sh
|
||||
exec ${pkgs.riemann-tools}/bin/riemann-health --host ${riemannHost}
|
||||
exec ${pkgs.riemann-tools}/bin/riemann-health ${builtins.concatStringsSep " " cfg.extraArgs} --host ${riemannHost}
|
||||
'';
|
||||
|
||||
|
||||
|
@ -34,8 +34,16 @@ in {
|
|||
Address of the host riemann node. Defaults to localhost.
|
||||
'';
|
||||
};
|
||||
extraArgs = mkOption {
|
||||
type = types.listOf types.string;
|
||||
default = [];
|
||||
description = ''
|
||||
A list of commandline-switches forwarded to a riemann-tool.
|
||||
See for example `riemann-health --help` for available options.
|
||||
'';
|
||||
example = ["-p 5555" "--timeout=30" "--attribute=myattribute=42"];
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = mkIf cfg.enableHealth {
|
||||
|
|
|
@ -1,133 +0,0 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.systemhealth;
|
||||
|
||||
systemhealth = with pkgs; stdenv.mkDerivation {
|
||||
name = "systemhealth-1.0";
|
||||
src = fetchurl {
|
||||
url = "https://www.brianlane.com/downloads/systemhealth/systemhealth-1.0.tar.bz2";
|
||||
sha256 = "1q69lz7hmpbdpbz36zb06nzfkj651413n9icx0njmyr3xzq1j9qy";
|
||||
};
|
||||
buildInputs = [ python ];
|
||||
installPhase = ''
|
||||
mkdir -p $out/bin
|
||||
# Make it work for kernels 3.x, not so different than 2.6
|
||||
sed -i 's/2\.6/4.0/' system_health.py
|
||||
cp system_health.py $out/bin
|
||||
'';
|
||||
};
|
||||
|
||||
rrdDir = "/var/lib/health/rrd";
|
||||
htmlDir = "/var/lib/health/html";
|
||||
|
||||
configFile = rrdDir + "/.syshealthrc";
|
||||
# The program will try to read $HOME/.syshealthrc, so we set the proper home.
|
||||
command = "HOME=${rrdDir} ${systemhealth}/bin/system_health.py";
|
||||
|
||||
cronJob = ''
|
||||
*/5 * * * * wwwrun ${command} --log
|
||||
5 * * * * wwwrun ${command} --graph
|
||||
'';
|
||||
|
||||
nameEqualName = s: "${s} = ${s}";
|
||||
interfacesSection = concatStringsSep "\n" (map nameEqualName cfg.interfaces);
|
||||
|
||||
driveLine = d: "${d.path} = ${d.name}";
|
||||
drivesSection = concatStringsSep "\n" (map driveLine cfg.drives);
|
||||
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.systemhealth = {
|
||||
enable = mkOption {
|
||||
default = false;
|
||||
description = ''
|
||||
Enable the system health monitor and its generation of graphs.
|
||||
'';
|
||||
};
|
||||
|
||||
urlPrefix = mkOption {
|
||||
default = "/health";
|
||||
description = ''
|
||||
The URL prefix under which the System Health web pages appear in httpd.
|
||||
'';
|
||||
};
|
||||
|
||||
interfaces = mkOption {
|
||||
default = [ "lo" ];
|
||||
example = [ "lo" "eth0" "eth1" ];
|
||||
description = ''
|
||||
Interfaces to monitor (minimum one).
|
||||
'';
|
||||
};
|
||||
|
||||
drives = mkOption {
|
||||
default = [ ];
|
||||
example = [ { name = "root"; path = "/"; } ];
|
||||
description = ''
|
||||
Drives to monitor.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.cron.systemCronJobs = [ cronJob ];
|
||||
|
||||
system.activationScripts.systemhealth = stringAfter [ "var" ]
|
||||
''
|
||||
mkdir -p ${rrdDir} ${htmlDir}
|
||||
chown wwwrun:wwwrun ${rrdDir} ${htmlDir}
|
||||
|
||||
cat >${configFile} << EOF
|
||||
[paths]
|
||||
rrdtool = ${pkgs.rrdtool}/bin/rrdtool
|
||||
loadavg_rrd = loadavg
|
||||
ps = /run/current-system/sw/bin/ps
|
||||
df = /run/current-system/sw/bin/df
|
||||
meminfo_rrd = meminfo
|
||||
uptime_rrd = uptime
|
||||
rrd_path = ${rrdDir}
|
||||
png_path = ${htmlDir}
|
||||
|
||||
[processes]
|
||||
|
||||
[interfaces]
|
||||
${interfacesSection}
|
||||
|
||||
[drives]
|
||||
${drivesSection}
|
||||
|
||||
[graphs]
|
||||
width = 400
|
||||
time = ['-3hours', '-32hours', '-8days', '-5weeks', '-13months']
|
||||
height = 100
|
||||
|
||||
[external]
|
||||
|
||||
EOF
|
||||
|
||||
chown wwwrun:wwwrun ${configFile}
|
||||
|
||||
${pkgs.su}/bin/su -s "/bin/sh" -c "${command} --check" wwwrun
|
||||
${pkgs.su}/bin/su -s "/bin/sh" -c "${command} --html" wwwrun
|
||||
'';
|
||||
|
||||
services.httpd.extraSubservices = [
|
||||
{ function = f: {
|
||||
extraConfig = ''
|
||||
Alias ${cfg.urlPrefix} ${htmlDir}
|
||||
|
||||
<Directory ${htmlDir}>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Directory>
|
||||
'';
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
|
@ -225,7 +225,7 @@ in
|
|||
''
|
||||
maxstartdelay = ${toString cfg.maxStartDelay}
|
||||
|
||||
${flip concatStringsSep (flip map (attrValues cfg.ups) (ups: ups.summary)) "
|
||||
${flip concatStringsSep (forEach (attrValues cfg.ups) (ups: ups.summary)) "
|
||||
|
||||
"}
|
||||
'';
|
||||
|
|
|
@ -55,6 +55,7 @@ in
|
|||
sockets.u9fs = {
|
||||
description = "U9fs Listening Socket";
|
||||
wantedBy = [ "sockets.target" ];
|
||||
after = [ "network.target" ];
|
||||
inherit (cfg) listenStreams;
|
||||
socketConfig.Accept = "yes";
|
||||
};
|
||||
|
|
|
@ -44,9 +44,7 @@ let
|
|||
parseModules = x:
|
||||
x // { connectTo = mapAttrs (name: value: { inherit (value) password publicKey; }) x.connectTo; };
|
||||
|
||||
# would be nice to merge 'cfg' with a //,
|
||||
# but the json nesting is wacky.
|
||||
cjdrouteConf = builtins.toJSON ( {
|
||||
cjdrouteConf = builtins.toJSON ( recursiveUpdate {
|
||||
admin = {
|
||||
bind = cfg.admin.bind;
|
||||
password = "@CJDNS_ADMIN_PASSWORD@";
|
||||
|
@ -71,7 +69,7 @@ let
|
|||
|
||||
security = [ { exemptAngel = 1; setuser = "nobody"; } ];
|
||||
|
||||
});
|
||||
} cfg.extraConfig);
|
||||
|
||||
in
|
||||
|
||||
|
@ -91,6 +89,16 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
extraConfig = mkOption {
|
||||
type = types.attrs;
|
||||
default = {};
|
||||
example = { router.interface.tunDevice = "tun10"; };
|
||||
description = ''
|
||||
Extra configuration, given as attrs, that will be merged recursively
|
||||
with the rest of the JSON generated by this module, at the root node.
|
||||
'';
|
||||
};
|
||||
|
||||
confFile = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
|
@ -246,7 +254,10 @@ in
|
|||
if cfg.confFile != null then "${pkg}/bin/cjdroute < ${cfg.confFile}" else
|
||||
''
|
||||
source /etc/cjdns.keys
|
||||
echo '${cjdrouteConf}' | sed \
|
||||
(cat <<'EOF'
|
||||
${cjdrouteConf}
|
||||
EOF
|
||||
) | sed \
|
||||
-e "s/@CJDNS_ADMIN_PASSWORD@/$CJDNS_ADMIN_PASSWORD/g" \
|
||||
-e "s/@CJDNS_PRIVATE_KEY@/$CJDNS_PRIVATE_KEY/g" \
|
||||
| ${pkg}/bin/cjdroute
|
||||
|
|
|
@ -15,7 +15,7 @@ let
|
|||
++ cfg.extraConfigFiles;
|
||||
|
||||
devices = attrValues (filterAttrs (_: i: i != null) cfg.interface);
|
||||
systemdDevices = flip map devices
|
||||
systemdDevices = forEach devices
|
||||
(i: "sys-subsystem-net-devices-${utils.escapeSystemdPath i}.device");
|
||||
in
|
||||
{
|
||||
|
|
|
@ -7,7 +7,7 @@ let
|
|||
inherit (lib) concatStringsSep optionalString;
|
||||
|
||||
cfg = config.services.hylafax;
|
||||
mapModems = lib.flip map (lib.attrValues cfg.modems);
|
||||
mapModems = lib.forEach (lib.attrValues cfg.modems);
|
||||
|
||||
mkConfigFile = name: conf:
|
||||
# creates hylafax config file,
|
||||
|
|
97
nixos/modules/services/networking/jormungandr.nix
Normal file
97
nixos/modules/services/networking/jormungandr.nix
Normal file
|
@ -0,0 +1,97 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.jormungandr;
|
||||
|
||||
inherit (lib) mkEnableOption mkIf mkOption;
|
||||
inherit (lib) optionalString types;
|
||||
|
||||
dataDir = "/var/lib/jormungandr";
|
||||
|
||||
# Default settings so far, as the service matures we will
|
||||
# move these out as separate settings
|
||||
configSettings = {
|
||||
storage = dataDir;
|
||||
p2p = {
|
||||
public_address = "/ip4/127.0.0.1/tcp/8606";
|
||||
messages = "high";
|
||||
blocks = "high";
|
||||
};
|
||||
rest = {
|
||||
listen = "127.0.0.1:8607";
|
||||
};
|
||||
};
|
||||
|
||||
configFile = if cfg.configFile == null then
|
||||
pkgs.writeText "jormungandr.yaml" (builtins.toJSON configSettings)
|
||||
else cfg.configFile;
|
||||
|
||||
in {
|
||||
|
||||
options = {
|
||||
|
||||
services.jormungandr = {
|
||||
enable = mkEnableOption "jormungandr service";
|
||||
|
||||
configFile = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
example = "/var/lib/jormungandr/node.yaml";
|
||||
description = ''
|
||||
The path of the jormungandr blockchain configuration file in YAML format.
|
||||
If no file is specified, a file is generated using the other options.
|
||||
'';
|
||||
};
|
||||
|
||||
secretFile = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
example = "/etc/secret/jormungandr.yaml";
|
||||
description = ''
|
||||
The path of the jormungandr blockchain secret node configuration file in
|
||||
YAML format. Do not store this in nix store!
|
||||
'';
|
||||
};
|
||||
|
||||
genesisBlockHash = mkOption {
|
||||
type = types.nullOr types.string;
|
||||
default = null;
|
||||
example = "d70495af81ae8600aca3e642b2427327cb6001ec4d7a0037e96a00dabed163f9";
|
||||
description = ''
|
||||
Set the genesis block hash (the hash of the block0) so we can retrieve
|
||||
the genesis block (and the blockchain configuration) from the existing
|
||||
storage or from the network.
|
||||
'';
|
||||
};
|
||||
|
||||
genesisBlockFile = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
example = "/var/lib/jormungandr/block-0.bin";
|
||||
description = ''
|
||||
The path of the genesis block file if we are hosting it locally.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
systemd.services.jormungandr = {
|
||||
description = "jormungandr server";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
StateDirectory = baseNameOf dataDir;
|
||||
ExecStart = ''
|
||||
${pkgs.jormungandr}/bin/jormungandr --config ${configFile} \
|
||||
${optionalString (cfg.secretFile != null) " --secret ${cfg.secretFile}"} \
|
||||
${optionalString (cfg.genesisBlockHash != null) " --genesis-block-hash ${cfg.genesisBlockHash}"} \
|
||||
${optionalString (cfg.genesisBlockFile != null) " --genesis-block ${cfg.genesisBlockFile}"}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
|
@ -35,10 +35,10 @@ in
|
|||
};
|
||||
|
||||
localAddress = mkOption {
|
||||
type = types.str;
|
||||
default = "0.0.0.0";
|
||||
type = types.coercedTo types.str singleton (types.listOf types.str);
|
||||
default = [ "[::0]" "0.0.0.0" ];
|
||||
description = ''
|
||||
Local address to which the server binds.
|
||||
Local addresses to which the server binds.
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
|
@ -502,7 +502,7 @@ in
|
|||
|
||||
assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;
|
||||
message = "cannot enable X11 forwarding without setting xauth location";}]
|
||||
++ flip map cfg.listenAddresses ({ addr, ... }: {
|
||||
++ forEach cfg.listenAddresses ({ addr, ... }: {
|
||||
assertion = addr != null;
|
||||
message = "addr must be specified in each listenAddresses entry";
|
||||
});
|
||||
|
|
|
@ -168,7 +168,7 @@ in
|
|||
default = defaultUpstream;
|
||||
type = types.lines;
|
||||
description = ''
|
||||
Add additional upstreams. See <citerefentry><refentrytitle>stubby
|
||||
Replace default upstreams. See <citerefentry><refentrytitle>stubby
|
||||
</refentrytitle><manvolnum>1</manvolnum></citerefentry> for an
|
||||
example of the entry formatting. In Strict mode, at least one of the
|
||||
following settings must be supplied for each nameserver:
|
||||
|
|
|
@ -131,6 +131,7 @@ in {
|
|||
description = "Extra elasticsearch plugins";
|
||||
default = [];
|
||||
type = types.listOf types.package;
|
||||
example = lib.literalExample "[ pkgs.elasticsearchPlugins.discovery-ec2 ]";
|
||||
};
|
||||
|
||||
};
|
||||
|
|
|
@ -106,14 +106,24 @@ in {
|
|||
|
||||
path = with pkgs; [ iptables ipset iproute systemd ];
|
||||
|
||||
postStart = ''
|
||||
# The sshguard ipsets must exist before we invoke
|
||||
# iptables. sshguard creates the ipsets after startup if
|
||||
# necessary, but if we let sshguard do it, we can't reliably add
|
||||
# the iptables rules because postStart races with the creation
|
||||
# of the ipsets. So instead, we create both the ipsets and
|
||||
# firewall rules before sshguard starts.
|
||||
preStart = ''
|
||||
${pkgs.ipset}/bin/ipset -quiet create -exist sshguard4 hash:net family inet
|
||||
${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:net family inet6
|
||||
${pkgs.iptables}/bin/iptables -I INPUT -m set --match-set sshguard4 src -j DROP
|
||||
${pkgs.iptables}/bin/ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP
|
||||
'';
|
||||
|
||||
preStop = ''
|
||||
postStop = ''
|
||||
${pkgs.iptables}/bin/iptables -D INPUT -m set --match-set sshguard4 src -j DROP
|
||||
${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP
|
||||
${pkgs.ipset}/bin/ipset -quiet destroy sshguard4
|
||||
${pkgs.ipset}/bin/ipset -quiet destroy sshguard6
|
||||
'';
|
||||
|
||||
unitConfig.Documentation = "man:sshguard(8)";
|
||||
|
|
|
@ -39,6 +39,16 @@ in {
|
|||
services.usbguard = {
|
||||
enable = mkEnableOption "USBGuard daemon";
|
||||
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.usbguard;
|
||||
defaultText = "pkgs.usbguard";
|
||||
description = ''
|
||||
The usbguard package to use. If you do not need the Qt GUI, use
|
||||
<literal>pkgs.usbguard-nox</literal> to save disk space.
|
||||
'';
|
||||
};
|
||||
|
||||
ruleFile = mkOption {
|
||||
type = types.path;
|
||||
default = "/var/lib/usbguard/rules.conf";
|
||||
|
@ -179,7 +189,7 @@ in {
|
|||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
environment.systemPackages = [ pkgs.usbguard ];
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
|
||||
systemd.services.usbguard = {
|
||||
description = "USBGuard daemon";
|
||||
|
@ -195,7 +205,7 @@ in {
|
|||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = ''${pkgs.usbguard}/bin/usbguard-daemon -P -k -c ${daemonConfFile}'';
|
||||
ExecStart = ''${cfg.package}/bin/usbguard-daemon -P -k -c ${daemonConfFile}'';
|
||||
Restart = "on-failure";
|
||||
};
|
||||
};
|
||||
|
|
|
@ -5,10 +5,12 @@
|
|||
|
||||
defaultConfig = {
|
||||
global = {
|
||||
module_path = "${pkgs.icingaweb2}/modules${optionalString (builtins.length config.modulePath > 0) ":${concatStringsSep ":" config.modulePath}"}";
|
||||
module_path = "${pkgs.icingaweb2}/modules";
|
||||
};
|
||||
};
|
||||
in {
|
||||
meta.maintainers = with maintainers; [ das_j ];
|
||||
|
||||
options.services.icingaweb2 = with types; {
|
||||
enable = mkEnableOption "the icingaweb2 web interface";
|
||||
|
||||
|
|
|
@ -70,7 +70,7 @@ in {
|
|||
{ CADDYPATH = cfg.dataDir; };
|
||||
serviceConfig = {
|
||||
ExecStart = ''
|
||||
${cfg.package.bin}/bin/caddy -root=/var/tmp -conf=${configFile} \
|
||||
${cfg.package}/bin/caddy -root=/var/tmp -conf=${configFile} \
|
||||
-ca=${cfg.ca} -email=${cfg.email} ${optionalString cfg.agree "-agree"}
|
||||
'';
|
||||
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
|
||||
|
|
|
@ -162,6 +162,10 @@ let
|
|||
${cfg.appendConfig}
|
||||
'';
|
||||
|
||||
configPath = if cfg.enableReload
|
||||
then "/etc/nginx/nginx.conf"
|
||||
else configFile;
|
||||
|
||||
vhosts = concatStringsSep "\n" (mapAttrsToList (vhostName: vhost:
|
||||
let
|
||||
onlySSL = vhost.onlySSL || vhost.enableSSL;
|
||||
|
@ -431,6 +435,16 @@ in
|
|||
";
|
||||
};
|
||||
|
||||
enableReload = mkOption {
|
||||
default = false;
|
||||
type = types.bool;
|
||||
description = ''
|
||||
Reload nginx when configuration file changes (instead of restart).
|
||||
The configuration file is exposed at <filename>/etc/nginx/nginx.conf</filename>.
|
||||
See also <literal>systemd.services.*.restartIfChanged</literal>.
|
||||
'';
|
||||
};
|
||||
|
||||
stateDir = mkOption {
|
||||
default = "/var/spool/nginx";
|
||||
description = "
|
||||
|
@ -638,10 +652,10 @@ in
|
|||
preStart =
|
||||
''
|
||||
${cfg.preStart}
|
||||
${cfg.package}/bin/nginx -c ${configFile} -p ${cfg.stateDir} -t
|
||||
${cfg.package}/bin/nginx -c ${configPath} -p ${cfg.stateDir} -t
|
||||
'';
|
||||
serviceConfig = {
|
||||
ExecStart = "${cfg.package}/bin/nginx -c ${configFile} -p ${cfg.stateDir}";
|
||||
ExecStart = "${cfg.package}/bin/nginx -c ${configPath} -p ${cfg.stateDir}";
|
||||
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
|
||||
Restart = "always";
|
||||
RestartSec = "10s";
|
||||
|
@ -649,6 +663,21 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
environment.etc."nginx/nginx.conf" = mkIf cfg.enableReload {
|
||||
source = configFile;
|
||||
};
|
||||
|
||||
systemd.services.nginx-config-reload = mkIf cfg.enableReload {
|
||||
wantedBy = [ "nginx.service" ];
|
||||
restartTriggers = [ configFile ];
|
||||
script = ''
|
||||
if ${pkgs.systemd}/bin/systemctl -q is-active nginx.service ; then
|
||||
${pkgs.systemd}/bin/systemctl reload nginx.service
|
||||
fi
|
||||
'';
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
};
|
||||
|
||||
security.acme.certs = filterAttrs (n: v: v != {}) (
|
||||
let
|
||||
vhostsConfigs = mapAttrsToList (vhostName: vhostConfig: vhostConfig) virtualHosts;
|
||||
|
|
|
@ -136,9 +136,8 @@ in {
|
|||
services.gnome3.gnome-online-accounts.enable = mkDefault true;
|
||||
services.gnome3.gnome-remote-desktop.enable = mkDefault true;
|
||||
services.gnome3.gnome-settings-daemon.enable = true;
|
||||
services.gnome3.gnome-terminal-server.enable = mkDefault true;
|
||||
services.gnome3.gnome-user-share.enable = mkDefault true;
|
||||
services.gnome3.gvfs.enable = true;
|
||||
services.gvfs.enable = true;
|
||||
services.gnome3.rygel.enable = mkDefault true;
|
||||
services.gnome3.seahorse.enable = mkDefault true;
|
||||
services.gnome3.sushi.enable = mkDefault true;
|
||||
|
@ -161,10 +160,12 @@ in {
|
|||
xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
|
||||
|
||||
# Enable default programs
|
||||
programs.dconf.enable = true;
|
||||
programs.evince.enable = mkDefault true;
|
||||
programs.file-roller.enable = mkDefault true;
|
||||
programs.gnome-disks.enable = mkDefault true;
|
||||
programs.gnome-documents.enable = mkDefault true;
|
||||
programs.gnome-terminal.enable = mkDefault true;
|
||||
|
||||
# If gnome3 is installed, build vim for gtk3 too.
|
||||
nixpkgs.config.vim.gui = "gtk3";
|
||||
|
@ -230,8 +231,6 @@ in {
|
|||
|
||||
services.xserver.updateDbusEnvironment = true;
|
||||
|
||||
environment.variables.GIO_EXTRA_MODULES = [ "${lib.getLib pkgs.gnome3.dconf}/lib/gio/modules"
|
||||
"${pkgs.gnome3.gvfs}/lib/gio/modules" ];
|
||||
environment.systemPackages = pkgs.gnome3.corePackages ++ cfg.sessionPath
|
||||
++ (pkgs.gnome3.removePackagesByName pkgs.gnome3.optionalPackages config.environment.gnome3.excludePackages) ++ [
|
||||
pkgs.xdg-user-dirs # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
|
||||
|
|
|
@ -58,7 +58,8 @@ in
|
|||
# Link some extra directories in /run/current-system/software/share
|
||||
environment.pathsToLink = [ "/share" ];
|
||||
|
||||
environment.variables.GIO_EXTRA_MODULES = [ "${pkgs.gvfs}/lib/gio/modules" ];
|
||||
services.gvfs.enable = true;
|
||||
services.gvfs.package = pkgs.gvfs;
|
||||
|
||||
services.upower.enable = config.powerManagement.enable;
|
||||
};
|
||||
|
|
|
@ -94,17 +94,19 @@ in
|
|||
];
|
||||
|
||||
programs.dconf.enable = true;
|
||||
# Shell integration for VTE terminals
|
||||
programs.bash.vteIntegration = mkDefault true;
|
||||
programs.zsh.vteIntegration = mkDefault true;
|
||||
|
||||
services.gnome3.at-spi2-core.enable = true;
|
||||
services.gnome3.gnome-keyring.enable = true;
|
||||
services.gnome3.gnome-settings-daemon.enable = true;
|
||||
services.gnome3.gnome-settings-daemon.package = pkgs.mate.mate-settings-daemon;
|
||||
services.gnome3.gvfs.enable = true;
|
||||
services.gvfs.enable = true;
|
||||
services.upower.enable = config.powerManagement.enable;
|
||||
|
||||
security.pam.services."mate-screensaver".unixAuth = true;
|
||||
|
||||
environment.variables.GIO_EXTRA_MODULES = [ "${pkgs.gnome3.gvfs}/lib/gio/modules" ];
|
||||
|
||||
environment.pathsToLink = [ "/share" ];
|
||||
};
|
||||
|
||||
|
|
|
@ -99,10 +99,6 @@ in
|
|||
fi
|
||||
'') cfg.sessionPath}
|
||||
|
||||
# Makes qt applications look less alien
|
||||
export QT_QPA_PLATFORMTHEME=gtk3
|
||||
export QT_STYLE_OVERRIDE=adwaita
|
||||
|
||||
# Settings from elementary-default-settings
|
||||
export GTK_CSD=1
|
||||
export GTK_MODULES=$GTK_MODULES:pantheon-filechooser-module
|
||||
|
@ -129,7 +125,7 @@ in
|
|||
services.gnome3.gnome-keyring.enable = true;
|
||||
services.gnome3.gnome-settings-daemon.enable = true;
|
||||
services.gnome3.gnome-settings-daemon.package = pkgs.pantheon.elementary-settings-daemon;
|
||||
services.gnome3.gvfs.enable = true;
|
||||
services.gvfs.enable = true;
|
||||
services.gnome3.rygel.enable = mkDefault true;
|
||||
services.gsignond.enable = mkDefault true;
|
||||
services.gsignond.plugins = with pkgs.gsignondPlugins; [ lastfm mail oauth ];
|
||||
|
@ -146,9 +142,19 @@ in
|
|||
isSystem = true;
|
||||
};
|
||||
|
||||
programs.dconf.enable = true;
|
||||
programs.evince.enable = mkDefault true;
|
||||
programs.file-roller.enable = mkDefault true;
|
||||
|
||||
# Shell integration for VTE terminals
|
||||
programs.bash.vteIntegration = mkDefault true;
|
||||
programs.zsh.vteIntegration = mkDefault true;
|
||||
|
||||
# Harmonize Qt5 applications under Pantheon
|
||||
qt5.enable = true;
|
||||
qt5.platformTheme = "gnome";
|
||||
qt5.style = "adwaita";
|
||||
|
||||
networking.networkmanager.enable = mkDefault true;
|
||||
networking.networkmanager.basePackages =
|
||||
{ inherit (pkgs) networkmanager modemmanager wpa_supplicant crda;
|
||||
|
@ -161,11 +167,6 @@ in
|
|||
|
||||
environment.variables.GNOME_SESSION_DEBUG = optionalString cfg.debug "1";
|
||||
|
||||
environment.variables.GIO_EXTRA_MODULES = [
|
||||
"${lib.getLib pkgs.gnome3.dconf}/lib/gio/modules"
|
||||
"${pkgs.gnome3.gvfs}/lib/gio/modules"
|
||||
];
|
||||
|
||||
environment.pathsToLink = [
|
||||
# FIXME: modules should link subdirs of `/share` rather than relying on this
|
||||
"/share"
|
||||
|
@ -187,7 +188,6 @@ in
|
|||
glib-networking
|
||||
gnome-menus
|
||||
gnome3.adwaita-icon-theme
|
||||
gnome3.dconf
|
||||
gtk3.out
|
||||
hicolor-icon-theme
|
||||
lightlocker
|
||||
|
|
|
@ -66,7 +66,6 @@ in
|
|||
exo
|
||||
garcon
|
||||
gtk-xfce-engine
|
||||
gvfs
|
||||
libxfce4ui
|
||||
tumbler
|
||||
xfconf
|
||||
|
@ -100,10 +99,6 @@ in
|
|||
"/share/gtksourceview-2.0"
|
||||
];
|
||||
|
||||
environment.variables = {
|
||||
GIO_EXTRA_MODULES = [ "${pkgs.xfce.gvfs}/lib/gio/modules" ];
|
||||
};
|
||||
|
||||
services.xserver.gdk-pixbuf.modulePackages = [ pkgs.librsvg ];
|
||||
|
||||
services.xserver.desktopManager.session = [{
|
||||
|
@ -128,5 +123,7 @@ in
|
|||
# Enable helpful DBus services.
|
||||
services.udisks2.enable = true;
|
||||
services.upower.enable = config.powerManagement.enable;
|
||||
services.gvfs.enable = true;
|
||||
services.gvfs.package = pkgs.xfce.gvfs;
|
||||
};
|
||||
}
|
||||
|
|
|
@ -129,7 +129,7 @@ in
|
|||
assertion = cfg.killer != null -> cfg.killtime >= 10;
|
||||
message = "killtime has to be at least 10 minutes according to `man xautolock`";
|
||||
}
|
||||
] ++ (lib.flip map [ "locker" "notifier" "nowlocker" "killer" ]
|
||||
] ++ (lib.forEach [ "locker" "notifier" "nowlocker" "killer" ]
|
||||
(option:
|
||||
{
|
||||
assertion = cfg."${option}" != null -> builtins.substring 0 1 cfg."${option}" == "/";
|
||||
|
|
|
@ -78,7 +78,7 @@ let
|
|||
in imap1 mkHead cfg.xrandrHeads;
|
||||
|
||||
xrandrDeviceSection = let
|
||||
monitors = flip map xrandrHeads (h: ''
|
||||
monitors = forEach xrandrHeads (h: ''
|
||||
Option "monitor-${h.config.output}" "${h.name}"
|
||||
'');
|
||||
# First option is indented through the space in the config but any
|
||||
|
|
|
@ -1,66 +0,0 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
{
|
||||
|
||||
options = {
|
||||
|
||||
systemd.coredump = {
|
||||
|
||||
enable = mkOption {
|
||||
default = false;
|
||||
type = types.bool;
|
||||
description = ''
|
||||
Enables storing core dumps in systemd.
|
||||
Note that this alone is not enough to enable core dumps. The maximum
|
||||
file size for core dumps must be specified in limits.conf as well. See
|
||||
<option>security.pam.loginLimits</option> and the limits.conf(5)
|
||||
man page (these specify the core dump limits for user login sessions)
|
||||
and <option>systemd.extraConfig</option> (where e.g.
|
||||
<literal>DefaultLimitCORE=1000000</literal> can be specified to set
|
||||
the core dump limit for systemd system-level services).
|
||||
'';
|
||||
};
|
||||
|
||||
extraConfig = mkOption {
|
||||
default = "";
|
||||
type = types.lines;
|
||||
example = "Storage=journal";
|
||||
description = ''
|
||||
Extra config options for systemd-coredump. See coredump.conf(5) man page
|
||||
for available options.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = mkMerge [
|
||||
(mkIf config.systemd.coredump.enable {
|
||||
|
||||
systemd.additionalUpstreamSystemUnits = [ "systemd-coredump.socket" "systemd-coredump@.service" ];
|
||||
|
||||
environment.etc."systemd/coredump.conf".text =
|
||||
''
|
||||
[Coredump]
|
||||
${config.systemd.coredump.extraConfig}
|
||||
'';
|
||||
|
||||
# Have the kernel pass core dumps to systemd's coredump helper binary.
|
||||
# From systemd's 50-coredump.conf file. See:
|
||||
# <https://github.com/systemd/systemd/blob/v218/sysctl.d/50-coredump.conf.in>
|
||||
boot.kernel.sysctl."kernel.core_pattern" = "|${pkgs.systemd}/lib/systemd/systemd-coredump %P %u %g %s %t %c %e";
|
||||
})
|
||||
|
||||
(mkIf (!config.systemd.coredump.enable) {
|
||||
boot.kernel.sysctl."kernel.core_pattern" = mkDefault "core";
|
||||
|
||||
systemd.extraConfig =
|
||||
''
|
||||
DefaultLimitCORE=0:infinity
|
||||
'';
|
||||
})
|
||||
];
|
||||
|
||||
}
|
|
@ -36,6 +36,7 @@ in
|
|||
|
||||
boot.kernelPackages = mkOption {
|
||||
default = pkgs.linuxPackages;
|
||||
type = types.unspecified // { merge = mergeEqualOption; };
|
||||
apply = kernelPackages: kernelPackages.extend (self: super: {
|
||||
kernel = super.kernel.override {
|
||||
inherit randstructSeed;
|
||||
|
|
|
@ -684,7 +684,7 @@ in
|
|||
assertion = if args.efiSysMountPoint == null then true else hasPrefix "/" args.efiSysMountPoint;
|
||||
message = "EFI paths must be absolute, not ${args.efiSysMountPoint}";
|
||||
}
|
||||
] ++ flip map args.devices (device: {
|
||||
] ++ forEach args.devices (device: {
|
||||
assertion = device == "nodev" || hasPrefix "/" device;
|
||||
message = "GRUB devices must be absolute paths, not ${device} in ${args.path}";
|
||||
}));
|
||||
|
|
|
@ -55,6 +55,27 @@ let
|
|||
(assertMacAddress "MACAddress")
|
||||
];
|
||||
|
||||
# NOTE The PrivateKey directive is missing on purpose here, please
|
||||
# do not add it to this list. The nix store is world-readable let's
|
||||
# refrain ourselves from providing a footgun.
|
||||
checkWireGuard = checkUnitConfig "WireGuard" [
|
||||
(assertOnlyFields [
|
||||
"PrivateKeyFile" "ListenPort" "FwMark"
|
||||
])
|
||||
(assertRange "FwMark" 1 4294967295)
|
||||
];
|
||||
|
||||
# NOTE The PresharedKey directive is missing on purpose here, please
|
||||
# do not add it to this list. The nix store is world-readable,let's
|
||||
# refrain ourselves from providing a footgun.
|
||||
checkWireGuardPeer = checkUnitConfig "WireGuardPeer" [
|
||||
(assertOnlyFields [
|
||||
"PublicKey" "PresharedKeyFile" "AllowedIPs"
|
||||
"Endpoint" "PersistentKeepalive"
|
||||
])
|
||||
(assertRange "PersistentKeepalive" 1 65535)
|
||||
];
|
||||
|
||||
checkVlan = checkUnitConfig "VLAN" [
|
||||
(assertOnlyFields ["Id" "GVRP" "MVRP" "LooseBinding" "ReorderHeader"])
|
||||
(assertRange "Id" 0 4094)
|
||||
|
@ -320,6 +341,46 @@ let
|
|||
'';
|
||||
};
|
||||
|
||||
wireguardConfig = mkOption {
|
||||
default = {};
|
||||
example = {
|
||||
PrivateKeyFile = "/etc/wireguard/secret.key";
|
||||
ListenPort = 51820;
|
||||
FwMark = 42;
|
||||
};
|
||||
type = types.addCheck (types.attrsOf unitOption) checkWireGuard;
|
||||
description = ''
|
||||
Each attribute in this set specifies an option in the
|
||||
<literal>[WireGuard]</literal> section of the unit. See
|
||||
<citerefentry><refentrytitle>systemd.netdev</refentrytitle>
|
||||
<manvolnum>5</manvolnum></citerefentry> for details.
|
||||
Use <literal>PrivateKeyFile</literal> instead of
|
||||
<literal>PrivateKey</literal>: the nix store is
|
||||
world-readable.
|
||||
'';
|
||||
};
|
||||
|
||||
wireguardPeers = mkOption {
|
||||
default = [];
|
||||
example = [ { wireguardPeerConfig={
|
||||
Endpoint = "192.168.1.1:51820";
|
||||
PublicKey = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
|
||||
PresharedKeyFile = "/etc/wireguard/psk.key";
|
||||
AllowedIPs = [ "10.0.0.1/32" ];
|
||||
PersistentKeepalive = 15;
|
||||
};}];
|
||||
type = with types; listOf (submodule wireguardPeerOptions);
|
||||
description = ''
|
||||
Each item in this array specifies an option in the
|
||||
<literal>[WireGuardPeer]</literal> section of the unit. See
|
||||
<citerefentry><refentrytitle>systemd.netdev</refentrytitle>
|
||||
<manvolnum>5</manvolnum></citerefentry> for details.
|
||||
Use <literal>PresharedKeyFile</literal> instead of
|
||||
<literal>PresharedKey</literal>: the nix store is
|
||||
world-readable.
|
||||
'';
|
||||
};
|
||||
|
||||
vlanConfig = mkOption {
|
||||
default = {};
|
||||
example = { Id = "4"; };
|
||||
|
@ -450,6 +511,23 @@ let
|
|||
};
|
||||
};
|
||||
|
||||
wireguardPeerOptions = {
|
||||
options = {
|
||||
wireguardPeerConfig = mkOption {
|
||||
default = {};
|
||||
example = { };
|
||||
type = types.addCheck (types.attrsOf unitOption) checkWireGuardPeer;
|
||||
description = ''
|
||||
Each attribute in this set specifies an option in the
|
||||
<literal>[WireGuardPeer]</literal> section of the unit. See
|
||||
<citerefentry><refentrytitle>systemd.network</refentrytitle>
|
||||
<manvolnum>5</manvolnum></citerefentry> for details.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
networkOptions = commonNetworkOptions // {
|
||||
|
||||
networkConfig = mkOption {
|
||||
|
@ -732,6 +810,16 @@ let
|
|||
${attrsToSection def.bondConfig}
|
||||
|
||||
''}
|
||||
${optionalString (def.wireguardConfig != { }) ''
|
||||
[WireGuard]
|
||||
${attrsToSection def.wireguardConfig}
|
||||
|
||||
''}
|
||||
${flip concatMapStrings def.wireguardPeers (x: ''
|
||||
[WireGuardPeer]
|
||||
${attrsToSection x.wireguardPeerConfig}
|
||||
|
||||
'')}
|
||||
${def.extraConfig}
|
||||
'';
|
||||
};
|
||||
|
|
|
@ -44,13 +44,13 @@ EOF
|
|||
*) to ignore the error and continue
|
||||
EOF
|
||||
|
||||
read reply
|
||||
read -n 1 reply
|
||||
|
||||
if [ -n "$allowShell" -a "$reply" = f ]; then
|
||||
exec setsid @shell@ -c "exec @shell@ < /dev/$console >/dev/$console 2>/dev/$console"
|
||||
elif [ -n "$allowShell" -a "$reply" = i ]; then
|
||||
echo "Starting interactive shell..."
|
||||
setsid @shell@ -c "@shell@ < /dev/$console >/dev/$console 2>/dev/$console" || fail
|
||||
setsid @shell@ -c "exec @shell@ < /dev/$console >/dev/$console 2>/dev/$console" || fail
|
||||
elif [ "$reply" = r ]; then
|
||||
echo "Rebooting..."
|
||||
reboot -f
|
||||
|
|
|
@ -76,6 +76,10 @@ let
|
|||
"systemd-journald-dev-log.socket"
|
||||
"syslog.socket"
|
||||
|
||||
# Coredumps.
|
||||
"systemd-coredump.socket"
|
||||
"systemd-coredump@.service"
|
||||
|
||||
# SysV init compatibility.
|
||||
"systemd-initctl.socket"
|
||||
"systemd-initctl.service"
|
||||
|
@ -540,6 +544,16 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
systemd.coredump.extraConfig = mkOption {
|
||||
default = "";
|
||||
type = types.lines;
|
||||
example = "Storage=journal";
|
||||
description = ''
|
||||
Extra config options for systemd-coredump. See coredump.conf(5) man page
|
||||
for available options.
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.extraConfig = mkOption {
|
||||
default = "";
|
||||
type = types.lines;
|
||||
|
@ -795,6 +809,7 @@ in
|
|||
DefaultMemoryAccounting=yes
|
||||
DefaultTasksAccounting=yes
|
||||
''}
|
||||
DefaultLimitCORE=infinity
|
||||
${config.systemd.extraConfig}
|
||||
'';
|
||||
|
||||
|
@ -818,6 +833,12 @@ in
|
|||
${config.services.journald.extraConfig}
|
||||
'';
|
||||
|
||||
"systemd/coredump.conf".text =
|
||||
''
|
||||
[Coredump]
|
||||
${config.systemd.coredump.extraConfig}
|
||||
'';
|
||||
|
||||
"systemd/logind.conf".text = ''
|
||||
[Login]
|
||||
KillUserProcesses=${if config.services.logind.killUserProcesses then "yes" else "no"}
|
||||
|
@ -831,6 +852,10 @@ in
|
|||
[Sleep]
|
||||
'';
|
||||
|
||||
# install provided sysctl snippets
|
||||
"sysctl.d/50-coredump.conf".source = "${systemd}/example/sysctl.d/50-coredump.conf";
|
||||
"sysctl.d/50-default.conf".source = "${systemd}/example/sysctl.d/50-default.conf";
|
||||
|
||||
"tmpfiles.d/systemd.conf".source = "${systemd}/example/tmpfiles.d/systemd.conf";
|
||||
"tmpfiles.d/x11.conf".source = "${systemd}/example/tmpfiles.d/x11.conf";
|
||||
|
||||
|
|
|
@ -74,7 +74,7 @@ in
|
|||
enable = true;
|
||||
networks."99-main" = genericNetwork mkDefault;
|
||||
}
|
||||
(mkMerge (flip map interfaces (i: {
|
||||
(mkMerge (forEach interfaces (i: {
|
||||
netdevs = mkIf i.virtual ({
|
||||
"40-${i.name}" = {
|
||||
netdevConfig = {
|
||||
|
@ -90,7 +90,7 @@ in
|
|||
name = mkDefault i.name;
|
||||
DHCP = mkForce (dhcpStr
|
||||
(if i.useDHCP != null then i.useDHCP else cfg.useDHCP && interfaceIps i == [ ]));
|
||||
address = flip map (interfaceIps i)
|
||||
address = forEach (interfaceIps i)
|
||||
(ip: "${ip.address}/${toString ip.prefixLength}");
|
||||
networkConfig.IPv6PrivacyExtensions = "kernel";
|
||||
} ];
|
||||
|
@ -102,7 +102,7 @@ in
|
|||
Kind = "bridge";
|
||||
};
|
||||
};
|
||||
networks = listToAttrs (flip map bridge.interfaces (bi:
|
||||
networks = listToAttrs (forEach bridge.interfaces (bi:
|
||||
nameValuePair "40-${bi}" (mkMerge [ (genericNetwork (mkOverride 999)) {
|
||||
DHCP = mkOverride 0 (dhcpStr false);
|
||||
networkConfig.Bridge = name;
|
||||
|
@ -173,7 +173,7 @@ in
|
|||
|
||||
};
|
||||
|
||||
networks = listToAttrs (flip map bond.interfaces (bi:
|
||||
networks = listToAttrs (forEach bond.interfaces (bi:
|
||||
nameValuePair "40-${bi}" (mkMerge [ (genericNetwork (mkOverride 999)) {
|
||||
DHCP = mkOverride 0 (dhcpStr false);
|
||||
networkConfig.Bond = name;
|
||||
|
|
|
@ -926,7 +926,7 @@ in
|
|||
warnings = concatMap (i: i.warnings) interfaces;
|
||||
|
||||
assertions =
|
||||
(flip map interfaces (i: {
|
||||
(forEach interfaces (i: {
|
||||
# With the linux kernel, interface name length is limited by IFNAMSIZ
|
||||
# to 16 bytes, including the trailing null byte.
|
||||
# See include/linux/if.h in the kernel sources
|
||||
|
@ -934,12 +934,12 @@ in
|
|||
message = ''
|
||||
The name of networking.interfaces."${i.name}" is too long, it needs to be less than 16 characters.
|
||||
'';
|
||||
})) ++ (flip map slaveIfs (i: {
|
||||
})) ++ (forEach slaveIfs (i: {
|
||||
assertion = i.ipv4.addresses == [ ] && i.ipv6.addresses == [ ];
|
||||
message = ''
|
||||
The networking.interfaces."${i.name}" must not have any defined ips when it is a slave.
|
||||
'';
|
||||
})) ++ (flip map interfaces (i: {
|
||||
})) ++ (forEach interfaces (i: {
|
||||
assertion = i.preferTempAddress -> cfg.enableIPv6;
|
||||
message = ''
|
||||
Temporary addresses are only needed when IPv6 is enabled.
|
||||
|
@ -967,8 +967,8 @@ in
|
|||
"net.ipv6.conf.default.disable_ipv6" = mkDefault (!cfg.enableIPv6);
|
||||
"net.ipv6.conf.all.forwarding" = mkDefault (any (i: i.proxyARP) interfaces);
|
||||
} // listToAttrs (flip concatMap (filter (i: i.proxyARP) interfaces)
|
||||
(i: flip map [ "4" "6" ] (v: nameValuePair "net.ipv${v}.conf.${i.name}.proxy_arp" true)))
|
||||
// listToAttrs (flip map (filter (i: i.preferTempAddress) interfaces)
|
||||
(i: forEach [ "4" "6" ] (v: nameValuePair "net.ipv${v}.conf.${i.name}.proxy_arp" true)))
|
||||
// listToAttrs (forEach (filter (i: i.preferTempAddress) interfaces)
|
||||
(i: nameValuePair "net.ipv6.conf.${i.name}.use_tempaddr" 2));
|
||||
|
||||
# Capabilities won't work unless we have at-least a 4.3 Linux
|
||||
|
@ -1050,7 +1050,7 @@ in
|
|||
${cfg.localCommands}
|
||||
'';
|
||||
};
|
||||
} // (listToAttrs (flip map interfaces (i:
|
||||
} // (listToAttrs (forEach interfaces (i:
|
||||
let
|
||||
deviceDependency = if (config.boot.isContainer || i.name == "lo")
|
||||
then []
|
||||
|
|
|
@ -138,7 +138,7 @@ let
|
|||
--bind-ro=/nix/var/nix/daemon-socket \
|
||||
--bind="/nix/var/nix/profiles/per-container/$INSTANCE:/nix/var/nix/profiles" \
|
||||
--bind="/nix/var/nix/gcroots/per-container/$INSTANCE:/nix/var/nix/gcroots" \
|
||||
--link-journal=try-guest \
|
||||
${optionalString (!cfg.ephemeral) "--link-journal=try-guest"} \
|
||||
--setenv PRIVATE_NETWORK="$PRIVATE_NETWORK" \
|
||||
--setenv HOST_BRIDGE="$HOST_BRIDGE" \
|
||||
--setenv HOST_ADDRESS="$HOST_ADDRESS" \
|
||||
|
@ -147,6 +147,7 @@ let
|
|||
--setenv LOCAL_ADDRESS6="$LOCAL_ADDRESS6" \
|
||||
--setenv HOST_PORT="$HOST_PORT" \
|
||||
--setenv PATH="$PATH" \
|
||||
${optionalString cfg.ephemeral "--ephemeral"} \
|
||||
${if cfg.additionalCapabilities != null && cfg.additionalCapabilities != [] then
|
||||
''--capability="${concatStringsSep " " cfg.additionalCapabilities}"'' else ""
|
||||
} \
|
||||
|
@ -247,6 +248,8 @@ let
|
|||
|
||||
Type = "notify";
|
||||
|
||||
RuntimeDirectory = lib.optional cfg.ephemeral "containers/%i";
|
||||
|
||||
# Note that on reboot, systemd-nspawn returns 133, so this
|
||||
# unit will be restarted. On poweroff, it returns 0, so the
|
||||
# unit won't be restarted.
|
||||
|
@ -419,6 +422,7 @@ let
|
|||
{
|
||||
extraVeths = {};
|
||||
additionalCapabilities = [];
|
||||
ephemeral = false;
|
||||
allowedDevices = [];
|
||||
hostAddress = null;
|
||||
hostAddress6 = null;
|
||||
|
@ -511,6 +515,26 @@ in
|
|||
information.
|
||||
'';
|
||||
};
|
||||
|
||||
ephemeral = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Runs container in ephemeral mode with the empty root filesystem at boot.
|
||||
This way container will be bootstrapped from scratch on each boot
|
||||
and will be cleaned up on shutdown leaving no traces behind.
|
||||
Useful for completely stateless, reproducible containers.
|
||||
|
||||
Note that this option might require to do some adjustments to the container configuration,
|
||||
e.g. you might want to set
|
||||
<varname>systemd.network.networks.$interface.dhcpConfig.ClientIdentifier</varname> to "mac"
|
||||
if you use <varname>macvlans</varname> option.
|
||||
This way dhcp client identifier will be stable between the container restarts.
|
||||
|
||||
Note that the container journal will not be linked to the host if this option is enabled.
|
||||
'';
|
||||
};
|
||||
|
||||
enableTun = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
|
@ -659,12 +683,14 @@ in
|
|||
unit = {
|
||||
description = "Container '%i'";
|
||||
|
||||
unitConfig.RequiresMountsFor = [ "/var/lib/containers/%i" ];
|
||||
unitConfig.RequiresMountsFor = "/var/lib/containers/%i";
|
||||
|
||||
path = [ pkgs.iproute ];
|
||||
|
||||
environment.INSTANCE = "%i";
|
||||
environment.root = "/var/lib/containers/%i";
|
||||
environment = {
|
||||
root = "/var/lib/containers/%i";
|
||||
INSTANCE = "%i";
|
||||
};
|
||||
|
||||
preStart = preStartScript dummyConfig;
|
||||
|
||||
|
@ -703,11 +729,13 @@ in
|
|||
}
|
||||
else {});
|
||||
in
|
||||
unit // {
|
||||
recursiveUpdate unit {
|
||||
preStart = preStartScript containerConfig;
|
||||
script = startScript containerConfig;
|
||||
postStart = postStartScript containerConfig;
|
||||
serviceConfig = serviceDirectives containerConfig;
|
||||
unitConfig.RequiresMountsFor = lib.optional (!containerConfig.ephemeral) "/var/lib/containers/%i";
|
||||
environment.root = if containerConfig.ephemeral then "/run/containers/%i" else "/var/lib/containers/%i";
|
||||
} // (
|
||||
if containerConfig.autoStart then
|
||||
{
|
||||
|
|
|
@ -159,12 +159,6 @@ in
|
|||
# functionality/features (e.g. TCP Window scaling).
|
||||
"net.ipv4.tcp_syncookies" = mkDefault "1";
|
||||
|
||||
# ignores source-routed packets
|
||||
"net.ipv4.conf.all.accept_source_route" = mkDefault "0";
|
||||
|
||||
# ignores source-routed packets
|
||||
"net.ipv4.conf.default.accept_source_route" = mkDefault "0";
|
||||
|
||||
# ignores ICMP redirects
|
||||
"net.ipv4.conf.all.accept_redirects" = mkDefault "0";
|
||||
|
||||
|
@ -186,10 +180,10 @@ in
|
|||
# don't allow traffic between networks or act as a router
|
||||
"net.ipv4.conf.default.send_redirects" = mkDefault "0";
|
||||
|
||||
# reverse path filtering - IP spoofing protection
|
||||
# strict reverse path filtering - IP spoofing protection
|
||||
"net.ipv4.conf.all.rp_filter" = mkDefault "1";
|
||||
|
||||
# reverse path filtering - IP spoofing protection
|
||||
# strict path filtering - IP spoofing protection
|
||||
"net.ipv4.conf.default.rp_filter" = mkDefault "1";
|
||||
|
||||
# ignores ICMP broadcasts to avoid participating in Smurf attacks
|
||||
|
|
|
@ -47,6 +47,7 @@ in
|
|||
codimd = handleTest ./codimd.nix {};
|
||||
colord = handleTest ./colord.nix {};
|
||||
containers-bridge = handleTest ./containers-bridge.nix {};
|
||||
containers-ephemeral = handleTest ./containers-ephemeral.nix {};
|
||||
containers-extra_veth = handleTest ./containers-extra_veth.nix {};
|
||||
containers-hosts = handleTest ./containers-hosts.nix {};
|
||||
containers-imperative = handleTest ./containers-imperative.nix {};
|
||||
|
@ -73,7 +74,7 @@ in
|
|||
#ec2-config = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-config or {};
|
||||
ec2-nixops = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-nixops or {};
|
||||
ecryptfs = handleTest ./ecryptfs.nix {};
|
||||
ejabberd = handleTest ./ejabberd.nix {};
|
||||
ejabberd = handleTest ./xmpp/ejabberd.nix {};
|
||||
elk = handleTestOn ["x86_64-linux"] ./elk.nix {};
|
||||
env = handleTest ./env.nix {};
|
||||
etcd = handleTestOn ["x86_64-linux"] ./etcd.nix {};
|
||||
|
@ -93,8 +94,10 @@ in
|
|||
gitlab = handleTest ./gitlab.nix {};
|
||||
gitolite = handleTest ./gitolite.nix {};
|
||||
gjs = handleTest ./gjs.nix {};
|
||||
glusterfs = handleTest ./glusterfs.nix {};
|
||||
gnome3-xorg = handleTest ./gnome3-xorg.nix {};
|
||||
gnome3 = handleTest ./gnome3.nix {};
|
||||
gnome-photos = handleTest ./gnome-photos.nix {};
|
||||
gocd-agent = handleTest ./gocd-agent.nix {};
|
||||
gocd-server = handleTest ./gocd-server.nix {};
|
||||
google-oslogin = handleTest ./google-oslogin {};
|
||||
|
@ -114,6 +117,7 @@ in
|
|||
hound = handleTest ./hound.nix {};
|
||||
hydra = handleTest ./hydra {};
|
||||
i3wm = handleTest ./i3wm.nix {};
|
||||
icingaweb2 = handleTest ./icingaweb2.nix {};
|
||||
iftop = handleTest ./iftop.nix {};
|
||||
incron = handleTest ./incron.nix {};
|
||||
influxdb = handleTest ./influxdb.nix {};
|
||||
|
@ -124,6 +128,7 @@ in
|
|||
jackett = handleTest ./jackett.nix {};
|
||||
jellyfin = handleTest ./jellyfin.nix {};
|
||||
jenkins = handleTest ./jenkins.nix {};
|
||||
jormungandr = handleTest ./jormungandr.nix {};
|
||||
kafka = handleTest ./kafka.nix {};
|
||||
kerberos = handleTest ./kerberos/default.nix {};
|
||||
kernel-latest = handleTest ./kernel-latest.nix {};
|
||||
|
@ -138,6 +143,7 @@ in
|
|||
latestKernel.login = handleTest ./login.nix { latestKernel = true; };
|
||||
ldap = handleTest ./ldap.nix {};
|
||||
leaps = handleTest ./leaps.nix {};
|
||||
libxmlb = handleTest ./libxmlb.nix {};
|
||||
lidarr = handleTest ./lidarr.nix {};
|
||||
lightdm = handleTest ./lightdm.nix {};
|
||||
limesurvey = handleTest ./limesurvey.nix {};
|
||||
|
@ -150,6 +156,7 @@ in
|
|||
mediawiki = handleTest ./mediawiki.nix {};
|
||||
memcached = handleTest ./memcached.nix {};
|
||||
mesos = handleTest ./mesos.nix {};
|
||||
metabase = handleTest ./metabase.nix {};
|
||||
miniflux = handleTest ./miniflux.nix {};
|
||||
minio = handleTest ./minio.nix {};
|
||||
misc = handleTest ./misc.nix {};
|
||||
|
@ -217,7 +224,8 @@ in
|
|||
prometheus = handleTest ./prometheus.nix {};
|
||||
prometheus2 = handleTest ./prometheus-2.nix {};
|
||||
prometheus-exporters = handleTest ./prometheus-exporters.nix {};
|
||||
prosody = handleTest ./prosody.nix {};
|
||||
prosody = handleTest ./xmpp/prosody.nix {};
|
||||
prosodyMysql = handleTest ./xmpp/prosody-mysql.nix {};
|
||||
proxy = handleTest ./proxy.nix {};
|
||||
quagga = handleTest ./quagga.nix {};
|
||||
quake3 = handleTest ./quake3.nix {};
|
||||
|
@ -249,6 +257,7 @@ in
|
|||
systemd = handleTest ./systemd.nix {};
|
||||
systemd-confinement = handleTest ./systemd-confinement.nix {};
|
||||
systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
|
||||
systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
|
||||
pdns-recursor = handleTest ./pdns-recursor.nix {};
|
||||
taskserver = handleTest ./taskserver.nix {};
|
||||
telegraf = handleTest ./telegraf.nix {};
|
||||
|
@ -256,6 +265,7 @@ in
|
|||
tinydns = handleTest ./tinydns.nix {};
|
||||
tor = handleTest ./tor.nix {};
|
||||
transmission = handleTest ./transmission.nix {};
|
||||
trezord = handleTest ./trezord.nix {};
|
||||
udisks2 = handleTest ./udisks2.nix {};
|
||||
upnp = handleTest ./upnp.nix {};
|
||||
uwsgi = handleTest ./uwsgi.nix {};
|
||||
|
|
56
nixos/tests/containers-ephemeral.nix
Normal file
56
nixos/tests/containers-ephemeral.nix
Normal file
|
@ -0,0 +1,56 @@
|
|||
# Test for NixOS' container support.
|
||||
|
||||
import ./make-test.nix ({ pkgs, ...} : {
|
||||
name = "containers-ephemeral";
|
||||
|
||||
machine = { pkgs, ... }: {
|
||||
virtualisation.memorySize = 768;
|
||||
virtualisation.writableStore = true;
|
||||
|
||||
containers.webserver = {
|
||||
ephemeral = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = "10.231.136.1";
|
||||
localAddress = "10.231.136.2";
|
||||
config = {
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts.localhost = {
|
||||
root = (pkgs.runCommand "localhost" {} ''
|
||||
mkdir "$out"
|
||||
echo hello world > "$out/index.html"
|
||||
'');
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
$machine->succeed("nixos-container list") =~ /webserver/ or die;
|
||||
|
||||
# Start the webserver container.
|
||||
$machine->succeed("nixos-container start webserver");
|
||||
|
||||
# Check that container got its own root folder
|
||||
$machine->succeed("ls /run/containers/webserver");
|
||||
|
||||
# Check that container persistent directory is not created
|
||||
$machine->fail("ls /var/lib/containers/webserver");
|
||||
|
||||
# Since "start" returns after the container has reached
|
||||
# multi-user.target, we should now be able to access it.
|
||||
my $ip = $machine->succeed("nixos-container show-ip webserver");
|
||||
chomp $ip;
|
||||
$machine->succeed("ping -n -c1 $ip");
|
||||
$machine->succeed("curl --fail http://$ip/ > /dev/null");
|
||||
|
||||
# Stop the container.
|
||||
$machine->succeed("nixos-container stop webserver");
|
||||
$machine->fail("curl --fail --connect-timeout 2 http://$ip/ > /dev/null");
|
||||
|
||||
# Check that container's root folder was removed
|
||||
$machine->fail("ls /run/containers/webserver");
|
||||
'';
|
||||
})
|
65
nixos/tests/glusterfs.nix
Normal file
65
nixos/tests/glusterfs.nix
Normal file
|
@ -0,0 +1,65 @@
|
|||
import ./make-test.nix ({ ... } :
|
||||
|
||||
let
|
||||
client = { pkgs, ... } : {
|
||||
environment.systemPackages = [ pkgs.glusterfs ];
|
||||
fileSystems = pkgs.lib.mkVMOverride
|
||||
[ { mountPoint = "/gluster";
|
||||
fsType = "glusterfs";
|
||||
device = "server1:/gv0";
|
||||
} ];
|
||||
};
|
||||
|
||||
server = { pkgs, ... } : {
|
||||
networking.firewall.enable = false;
|
||||
services.glusterfs.enable = true;
|
||||
|
||||
# create a mount point for the volume
|
||||
boot.initrd.postDeviceCommands = ''
|
||||
${pkgs.e2fsprogs}/bin/mkfs.ext4 -L data /dev/vdb
|
||||
'';
|
||||
|
||||
virtualisation.emptyDiskImages = [ 1024 ];
|
||||
|
||||
fileSystems = pkgs.lib.mkVMOverride
|
||||
[ { mountPoint = "/data";
|
||||
device = "/dev/disk/by-label/data";
|
||||
fsType = "ext4";
|
||||
}
|
||||
];
|
||||
};
|
||||
in {
|
||||
name = "glusterfs";
|
||||
|
||||
nodes = {
|
||||
server1 = server;
|
||||
server2 = server;
|
||||
client1 = client;
|
||||
client2 = client;
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
$server1->waitForUnit("glusterd.service");
|
||||
$server2->waitForUnit("glusterd.service");
|
||||
|
||||
# establish initial contact
|
||||
$server1->succeed("sleep 2");
|
||||
$server1->succeed("gluster peer probe server2");
|
||||
$server1->succeed("gluster peer probe server1");
|
||||
|
||||
$server1->succeed("gluster peer status | grep Connected");
|
||||
|
||||
# create volumes
|
||||
$server1->succeed("mkdir -p /data/vg0");
|
||||
$server2->succeed("mkdir -p /data/vg0");
|
||||
$server1->succeed("gluster volume create gv0 server1:/data/vg0 server2:/data/vg0");
|
||||
$server1->succeed("gluster volume start gv0");
|
||||
|
||||
# test clients
|
||||
$client1->waitForUnit("gluster.mount");
|
||||
$client2->waitForUnit("gluster.mount");
|
||||
|
||||
$client1->succeed("echo test > /gluster/file1");
|
||||
$client2->succeed("grep test /gluster/file1");
|
||||
'';
|
||||
})
|
42
nixos/tests/gnome-photos.nix
Normal file
42
nixos/tests/gnome-photos.nix
Normal file
|
@ -0,0 +1,42 @@
|
|||
# run installed tests
|
||||
import ./make-test.nix ({ pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
|
||||
# gsettings tool with access to gsettings-desktop-schemas
|
||||
desktop-gsettings = with pkgs; stdenv.mkDerivation {
|
||||
name = "desktop-gsettings";
|
||||
dontUnpack = true;
|
||||
nativeBuildInputs = [ glib wrapGAppsHook ];
|
||||
buildInputs = [ gsettings-desktop-schemas ];
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
mkdir -p $out/bin
|
||||
ln -s ${glib.bin}/bin/gsettings $out/bin/desktop-gsettings
|
||||
runHook postInstall
|
||||
'';
|
||||
};
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
name = "gnome-photos";
|
||||
meta = {
|
||||
maintainers = pkgs.gnome-photos.meta.maintainers;
|
||||
};
|
||||
|
||||
machine = { pkgs, ... }: {
|
||||
imports = [ ./common/x11.nix ];
|
||||
programs.dconf.enable = true;
|
||||
services.gnome3.at-spi2-core.enable = true; # needed for dogtail
|
||||
environment.systemPackages = with pkgs; [ gnome-desktop-testing desktop-gsettings ];
|
||||
services.dbus.packages = with pkgs; [ gnome-photos ];
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
$machine->waitForX;
|
||||
# dogtail needs accessibility enabled
|
||||
$machine->succeed("desktop-gsettings set org.gnome.desktop.interface toolkit-accessibility true 2>&1");
|
||||
$machine->succeed("gnome-desktop-testing-runner -d '${pkgs.gnome-photos.installedTests}/share' 2>&1");
|
||||
'';
|
||||
})
|
71
nixos/tests/icingaweb2.nix
Normal file
71
nixos/tests/icingaweb2.nix
Normal file
|
@ -0,0 +1,71 @@
|
|||
import ./make-test.nix ({ pkgs, ... }: {
|
||||
name = "icingaweb2";
|
||||
meta = with pkgs.stdenv.lib.maintainers; {
|
||||
maintainers = [ das_j ];
|
||||
};
|
||||
|
||||
nodes = {
|
||||
icingaweb2 = { config, pkgs, ... }: {
|
||||
services.icingaweb2 = {
|
||||
enable = true;
|
||||
|
||||
modulePackages = with pkgs.icingaweb2Modules; {
|
||||
particles = theme-particles;
|
||||
spring = theme-spring;
|
||||
};
|
||||
|
||||
modules = {
|
||||
doc.enable = true;
|
||||
migrate.enable = true;
|
||||
setup.enable = true;
|
||||
test.enable = true;
|
||||
translation.enable = true;
|
||||
};
|
||||
|
||||
generalConfig = {
|
||||
global = {
|
||||
module_path = "${pkgs.icingaweb2}/modules";
|
||||
};
|
||||
};
|
||||
|
||||
authentications = {
|
||||
icingaweb = {
|
||||
backend = "external";
|
||||
};
|
||||
};
|
||||
|
||||
groupBackends = {
|
||||
icingaweb = {
|
||||
backend = "db";
|
||||
resource = "icingaweb_db";
|
||||
};
|
||||
};
|
||||
|
||||
resources = {
|
||||
# Not used, so no DB server needed
|
||||
icingaweb_db = {
|
||||
type = "db";
|
||||
db = "mysql";
|
||||
host = "localhost";
|
||||
username = "icingaweb2";
|
||||
password = "icingaweb2";
|
||||
dbname = "icingaweb2";
|
||||
};
|
||||
};
|
||||
|
||||
roles = {
|
||||
Administrators = {
|
||||
users = "*";
|
||||
permissions = "*";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
startAll();
|
||||
$icingaweb2->waitForUnit("multi-user.target");
|
||||
$icingaweb2->succeed("curl -sSf http://icingaweb2/authentication/login");
|
||||
'';
|
||||
})
|
49
nixos/tests/jormungandr.nix
Normal file
49
nixos/tests/jormungandr.nix
Normal file
|
@ -0,0 +1,49 @@
|
|||
import ./make-test.nix ({ pkgs, ... }: {
|
||||
name = "jormungandr";
|
||||
meta = with pkgs.stdenv.lib.maintainers; {
|
||||
maintainers = [ mmahut ];
|
||||
};
|
||||
|
||||
nodes = {
|
||||
bft = { ... }: {
|
||||
environment.systemPackages = [ pkgs.jormungandr ];
|
||||
|
||||
services.jormungandr.enable = true;
|
||||
services.jormungandr.genesisBlockFile = "/var/lib/jormungandr/block-0.bin";
|
||||
services.jormungandr.secretFile = "/etc/secrets/jormungandr.yaml";
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
startAll;
|
||||
|
||||
# Let's wait for the StateDirectory
|
||||
$bft->waitForFile("/var/lib/jormungandr/");
|
||||
|
||||
# First, we generate the genesis file for our new blockchain
|
||||
$bft->succeed("jcli genesis init > /root/genesis.yaml");
|
||||
|
||||
# We need to generate our secret key
|
||||
$bft->succeed("jcli key generate --type=Ed25519 > /root/key.prv");
|
||||
|
||||
# We include the secret key into our services.jormungandr.secretFile
|
||||
$bft->succeed("mkdir -p /etc/secrets");
|
||||
$bft->succeed("echo -e \"bft:\\n signing_key:\" \$(cat /root/key.prv) > /etc/secrets/jormungandr.yaml");
|
||||
|
||||
# After that, we generate our public key from it
|
||||
$bft->succeed("cat /root/key.prv | jcli key to-public > /root/key.pub");
|
||||
|
||||
# We add our public key as a consensus leader in the genesis configration file
|
||||
$bft->succeed("sed -ie \"s/ed25519_pk1vvwp2s0n5jl5f4xcjurp2e92sj2awehkrydrlas4vgqr7xzt33jsadha32/\$(cat /root/key.pub)/\" /root/genesis.yaml");
|
||||
|
||||
# Now we can generate the genesis block from it
|
||||
$bft->succeed("jcli genesis encode --input /root/genesis.yaml --output /var/lib/jormungandr/block-0.bin");
|
||||
|
||||
# We should have everything to start the service now
|
||||
$bft->succeed("systemctl restart jormungandr");
|
||||
$bft->waitForUnit("jormungandr.service");
|
||||
|
||||
# Now we can test if we are able to reach the REST API
|
||||
$bft->waitUntilSucceeds("curl -L http://localhost:8607/api/v0/node/stats | grep uptime");
|
||||
'';
|
||||
})
|
17
nixos/tests/libxmlb.nix
Normal file
17
nixos/tests/libxmlb.nix
Normal file
|
@ -0,0 +1,17 @@
|
|||
# run installed tests
|
||||
import ./make-test.nix ({ pkgs, ... }:
|
||||
|
||||
{
|
||||
name = "libxmlb";
|
||||
meta = {
|
||||
maintainers = pkgs.libxmlb.meta.maintainers;
|
||||
};
|
||||
|
||||
machine = { pkgs, ... }: {
|
||||
environment.systemPackages = with pkgs; [ gnome-desktop-testing ];
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
$machine->succeed("gnome-desktop-testing-runner -d '${pkgs.libxmlb.installedTests}/share'");
|
||||
'';
|
||||
})
|
20
nixos/tests/metabase.nix
Normal file
20
nixos/tests/metabase.nix
Normal file
|
@ -0,0 +1,20 @@
|
|||
import ./make-test.nix ({ pkgs, ... }: {
|
||||
name = "metabase";
|
||||
meta = with pkgs.stdenv.lib.maintainers; {
|
||||
maintainers = [ mmahut ];
|
||||
};
|
||||
|
||||
nodes = {
|
||||
machine = { ... }: {
|
||||
services.metabase.enable = true;
|
||||
virtualisation.memorySize = 1024;
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
startAll;
|
||||
$machine->waitForUnit("metabase.service");
|
||||
$machine->waitForOpenPort(3000);
|
||||
$machine->waitUntilSucceeds("curl -L http://localhost:3000/setup | grep Metabase");
|
||||
'';
|
||||
})
|
|
@ -21,7 +21,7 @@ let
|
|||
useNetworkd = networkd;
|
||||
firewall.checkReversePath = true;
|
||||
firewall.allowedUDPPorts = [ 547 ];
|
||||
interfaces = mkOverride 0 (listToAttrs (flip map vlanIfs (n:
|
||||
interfaces = mkOverride 0 (listToAttrs (forEach vlanIfs (n:
|
||||
nameValuePair "eth${toString n}" {
|
||||
ipv4.addresses = [ { address = "192.168.${toString n}.1"; prefixLength = 24; } ];
|
||||
ipv6.addresses = [ { address = "fd00:1234:5678:${toString n}::1"; prefixLength = 64; } ];
|
||||
|
|
|
@ -3,15 +3,15 @@
|
|||
# generated virtual hosts config.
|
||||
# 2. whether the ETag header is properly generated whenever we're serving
|
||||
# files in Nix store paths
|
||||
|
||||
# 3. nginx doesn't restart on configuration changes (only reloads)
|
||||
import ./make-test.nix ({ pkgs, ... }: {
|
||||
name = "nginx";
|
||||
meta = with pkgs.stdenv.lib.maintainers; {
|
||||
maintainers = [ mbbx6spp ];
|
||||
};
|
||||
|
||||
nodes = let
|
||||
commonConfig = { pkgs, ... }: {
|
||||
nodes = {
|
||||
webserver = { pkgs, lib, ... }: {
|
||||
services.nginx.enable = true;
|
||||
services.nginx.commonHttpConfig = ''
|
||||
log_format ceeformat '@cee: {"status":"$status",'
|
||||
|
@ -32,30 +32,42 @@ import ./make-test.nix ({ pkgs, ... }: {
|
|||
location /favicon.ico { allow all; access_log off; log_not_found off; }
|
||||
'';
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts.localhost = {
|
||||
root = pkgs.runCommand "testdir" {} ''
|
||||
mkdir "$out"
|
||||
echo hello world > "$out/index.html"
|
||||
'';
|
||||
};
|
||||
};
|
||||
in {
|
||||
webserver = commonConfig;
|
||||
|
||||
newwebserver = { pkgs, lib, ... }: {
|
||||
imports = [ commonConfig ];
|
||||
services.nginx.enableReload = true;
|
||||
|
||||
nesting.clone = [
|
||||
{
|
||||
services.nginx.virtualHosts.localhost = {
|
||||
root = lib.mkForce (pkgs.runCommand "testdir2" {} ''
|
||||
mkdir "$out"
|
||||
echo hello world > "$out/index.html"
|
||||
echo content changed > "$out/index.html"
|
||||
'');
|
||||
};
|
||||
}
|
||||
|
||||
{
|
||||
services.nginx.virtualHosts."1.my.test".listen = [ { addr = "127.0.0.1"; port = 8080; }];
|
||||
}
|
||||
|
||||
{
|
||||
services.nginx.package = pkgs.nginxUnstable;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
testScript = { nodes, ... }: let
|
||||
newServerSystem = nodes.newwebserver.config.system.build.toplevel;
|
||||
switch = "${newServerSystem}/bin/switch-to-configuration test";
|
||||
etagSystem = "${nodes.webserver.config.system.build.toplevel}/fine-tune/child-1";
|
||||
justReloadSystem = "${nodes.webserver.config.system.build.toplevel}/fine-tune/child-2";
|
||||
reloadRestartSystem = "${nodes.webserver.config.system.build.toplevel}/fine-tune/child-3";
|
||||
in ''
|
||||
my $url = 'http://localhost/index.html';
|
||||
|
||||
|
@ -77,9 +89,23 @@ import ./make-test.nix ({ pkgs, ... }: {
|
|||
|
||||
subtest "check ETag if serving Nix store paths", sub {
|
||||
my $oldEtag = checkEtag;
|
||||
$webserver->succeed('${switch}');
|
||||
$webserver->succeed("${etagSystem}/bin/switch-to-configuration test >&2");
|
||||
$webserver->sleep(1); # race condition
|
||||
my $newEtag = checkEtag;
|
||||
die "Old ETag $oldEtag is the same as $newEtag" if $oldEtag eq $newEtag;
|
||||
};
|
||||
|
||||
subtest "config is reloaded on nixos-rebuild switch", sub {
|
||||
$webserver->succeed("${justReloadSystem}/bin/switch-to-configuration test >&2");
|
||||
$webserver->waitForOpenPort("8080");
|
||||
$webserver->fail("journalctl -u nginx | grep -q -i stopped");
|
||||
$webserver->succeed("journalctl -u nginx | grep -q -i reloaded");
|
||||
};
|
||||
|
||||
subtest "restart when nginx package changes", sub {
|
||||
$webserver->succeed("${reloadRestartSystem}/bin/switch-to-configuration test >&2");
|
||||
$webserver->waitForUnit("nginx");
|
||||
$webserver->succeed("journalctl -u nginx | grep -q -i stopped");
|
||||
};
|
||||
'';
|
||||
})
|
||||
|
|
|
@ -8,11 +8,8 @@ import ./make-test.nix ({ ...}: {
|
|||
services.httpd = {
|
||||
enable = true;
|
||||
adminAddr = "please@dont.contact";
|
||||
extraSubservices = lib.singleton {
|
||||
function = f: {
|
||||
enablePHP = true;
|
||||
phpOptions = "pcre.jit = true";
|
||||
|
||||
extraConfig =
|
||||
let
|
||||
testRoot = pkgs.writeText "index.php"
|
||||
|
@ -32,8 +29,6 @@ import ./make-test.nix ({ ...}: {
|
|||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
testScript = { ... }:
|
||||
''
|
||||
$machine->waitForUnit('httpd.service');
|
||||
|
|
|
@ -1,38 +0,0 @@
|
|||
import ./make-test.nix {
|
||||
name = "prosody";
|
||||
|
||||
machine = { pkgs, ... }: {
|
||||
services.prosody = {
|
||||
enable = true;
|
||||
# TODO: use a self-signed certificate
|
||||
c2sRequireEncryption = false;
|
||||
extraConfig = ''
|
||||
storage = "sql"
|
||||
'';
|
||||
virtualHosts.test = {
|
||||
domain = "example.com";
|
||||
enabled = true;
|
||||
};
|
||||
};
|
||||
environment.systemPackages = [
|
||||
(pkgs.callPackage ./xmpp-sendmessage.nix {})
|
||||
];
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
$machine->waitForUnit('prosody.service');
|
||||
$machine->succeed('prosodyctl status') =~ /Prosody is running/;
|
||||
|
||||
# set password to 'nothunter2' (it's asked twice)
|
||||
$machine->succeed('yes nothunter2 | prosodyctl adduser cthon98@example.com');
|
||||
# set password to 'y'
|
||||
$machine->succeed('yes | prosodyctl adduser azurediamond@example.com');
|
||||
# correct password to 'hunter2'
|
||||
$machine->succeed('yes hunter2 | prosodyctl passwd azurediamond@example.com');
|
||||
|
||||
$machine->succeed("send-message");
|
||||
|
||||
$machine->succeed('prosodyctl deluser cthon98@example.com');
|
||||
$machine->succeed('prosodyctl deluser azurediamond@example.com');
|
||||
'';
|
||||
}
|
|
@ -1,121 +0,0 @@
|
|||
import ./make-test.nix ({ pkgs, ...} :
|
||||
|
||||
let
|
||||
|
||||
# Build some packages with coverage instrumentation.
|
||||
overrides = pkgs:
|
||||
with pkgs.stdenvAdapters;
|
||||
let
|
||||
do = pkg: pkg.override (args: {
|
||||
stdenv = addCoverageInstrumentation args.stdenv;
|
||||
});
|
||||
in
|
||||
rec {
|
||||
apr = do pkgs.apr;
|
||||
aprutil = do pkgs.aprutil;
|
||||
apacheHttpd = do pkgs.apacheHttpd;
|
||||
mod_python = do pkgs.mod_python;
|
||||
subversion = do pkgs.subversion;
|
||||
|
||||
# To build the kernel with coverage instrumentation, we need a
|
||||
# special patch to make coverage data available under /proc.
|
||||
linux = pkgs.linux.override (orig: {
|
||||
stdenv = overrideInStdenv pkgs.stdenv [ pkgs.keepBuildTree ];
|
||||
extraConfig =
|
||||
''
|
||||
GCOV_KERNEL y
|
||||
GCOV_PROFILE_ALL y
|
||||
'';
|
||||
});
|
||||
};
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
name = "subversion";
|
||||
meta = with pkgs.stdenv.lib.maintainers; {
|
||||
maintainers = [ eelco ];
|
||||
};
|
||||
|
||||
nodes =
|
||||
{ webserver =
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
services.httpd.enable = true;
|
||||
services.httpd.adminAddr = "e.dolstra@tudelft.nl";
|
||||
services.httpd.extraSubservices =
|
||||
[ { function = import <services/subversion>;
|
||||
urlPrefix = "";
|
||||
dataDir = "/data/subversion";
|
||||
userCreationDomain = "192.168.0.0/16";
|
||||
}
|
||||
];
|
||||
nixpkgs.config.packageOverrides = overrides;
|
||||
};
|
||||
|
||||
client =
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
environment.systemPackages = [ pkgs.subversion ];
|
||||
nixpkgs.config.packageOverrides = overrides;
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
testScript =
|
||||
''
|
||||
startAll;
|
||||
|
||||
$webserver->waitForOpenPort(80);
|
||||
|
||||
print STDERR $client->succeed("svn --version");
|
||||
|
||||
print STDERR $client->succeed("curl --fail http://webserver/");
|
||||
|
||||
# Create a new user through the web interface.
|
||||
$client->succeed("curl --fail -F username=alice -F fullname='Alice Lastname' -F address=alice\@example.org -F password=foobar -F password_again=foobar http://webserver/repoman/adduser");
|
||||
|
||||
# Let Alice create a new repository.
|
||||
$client->succeed("curl --fail -u alice:foobar --form repo=xyzzy --form description=Xyzzy http://webserver/repoman/create");
|
||||
|
||||
$client->succeed("curl --fail http://webserver/") =~ /alice/ or die;
|
||||
|
||||
# Let Alice do a checkout.
|
||||
my $svnFlags = "--non-interactive --username alice --password foobar";
|
||||
$client->succeed("svn co $svnFlags http://webserver/repos/xyzzy wc");
|
||||
$client->succeed("echo hello > wc/world");
|
||||
$client->succeed("svn add wc/world");
|
||||
$client->succeed("svn ci $svnFlags -m 'Added world.' wc/world");
|
||||
|
||||
# Create a new user on the server through the create-user.pl script.
|
||||
$webserver->execute("svn-server-create-user.pl bob bob\@example.org Bob");
|
||||
$webserver->succeed("svn-server-resetpw.pl bob fnord");
|
||||
$client->succeed("curl --fail http://webserver/") =~ /bob/ or die;
|
||||
|
||||
# Bob should not have access to the repo.
|
||||
my $svnFlagsBob = "--non-interactive --username bob --password fnord";
|
||||
$client->fail("svn co $svnFlagsBob http://webserver/repos/xyzzy wc2");
|
||||
|
||||
# Bob should not be able change the ACLs of the repo.
|
||||
# !!! Repoman should really return a 403 here.
|
||||
$client->succeed("curl --fail -u bob:fnord -F description=Xyzzy -F readers=alice,bob -F writers=alice -F watchers= -F tardirs= http://webserver/repoman/update/xyzzy")
|
||||
=~ /not authorised/ or die;
|
||||
|
||||
# Give Bob access.
|
||||
$client->succeed("curl --fail -u alice:foobar -F description=Xyzzy -F readers=alice,bob -F writers=alice -F watchers= -F tardirs= http://webserver/repoman/update/xyzzy");
|
||||
|
||||
# So now his checkout should succeed.
|
||||
$client->succeed("svn co $svnFlagsBob http://webserver/repos/xyzzy wc2");
|
||||
|
||||
# Test ViewVC and WebSVN
|
||||
$client->succeed("curl --fail -u alice:foobar http://webserver/viewvc/xyzzy");
|
||||
$client->succeed("curl --fail -u alice:foobar http://webserver/websvn/xyzzy");
|
||||
$client->succeed("curl --fail -u alice:foobar http://webserver/repos-xml/xyzzy");
|
||||
|
||||
# Stop Apache to gather all the coverage data.
|
||||
$webserver->stopJob("httpd");
|
||||
'';
|
||||
|
||||
})
|
80
nixos/tests/systemd-networkd-wireguard.nix
Normal file
80
nixos/tests/systemd-networkd-wireguard.nix
Normal file
|
@ -0,0 +1,80 @@
|
|||
let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...}: {
|
||||
imports = [ common/user-account.nix ];
|
||||
systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
|
||||
networking.useNetworkd = true;
|
||||
networking.firewall.enable = false;
|
||||
virtualisation.vlans = [ 1 ];
|
||||
environment.systemPackages = with pkgs; [ wireguard-tools ];
|
||||
boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
netdevs = {
|
||||
"90-wg0" = {
|
||||
netdevConfig = { Kind = "wireguard"; Name = "wg0"; };
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = privkpath ;
|
||||
ListenPort = 51820;
|
||||
FwMark = 42;
|
||||
};
|
||||
wireguardPeers = [ {wireguardPeerConfig={
|
||||
Endpoint = "192.168.1.${peerId}:51820";
|
||||
PublicKey = pubk;
|
||||
PresharedKeyFile = pkgs.writeText "psk.key" "yTL3sCOL33Wzi6yCnf9uZQl/Z8laSE+zwpqOHC4HhFU=";
|
||||
AllowedIPs = [ "10.0.0.${peerId}/32" ];
|
||||
PersistentKeepalive = 15;
|
||||
};}];
|
||||
};
|
||||
};
|
||||
networks = {
|
||||
"99-nope" = {
|
||||
matchConfig.Name = "eth*";
|
||||
linkConfig.Unmanaged = true;
|
||||
};
|
||||
"90-wg0" = {
|
||||
matchConfig = { Name = "wg0"; };
|
||||
address = [ "10.0.0.${nodeId}/32" ];
|
||||
routes = [
|
||||
{ routeConfig = { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; }; }
|
||||
];
|
||||
};
|
||||
"90-eth1" = {
|
||||
matchConfig = { Name = "eth1"; };
|
||||
address = [ "192.168.1.${nodeId}/24" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
in import ./make-test.nix ({pkgs, ... }: {
|
||||
name = "networkd-wireguard";
|
||||
meta = with pkgs.stdenv.lib.maintainers; {
|
||||
maintainers = [ ninjatrappeur ];
|
||||
};
|
||||
nodes = {
|
||||
node1 = { pkgs, ... }@attrs:
|
||||
let localConf = {
|
||||
privkpath = pkgs.writeText "priv.key" "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
|
||||
pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
|
||||
nodeId = "1";
|
||||
peerId = "2";
|
||||
};
|
||||
in generateNodeConf (attrs // localConf);
|
||||
|
||||
node2 = { pkgs, ... }@attrs:
|
||||
let localConf = {
|
||||
privkpath = pkgs.writeText "priv.key" "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
|
||||
pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
|
||||
nodeId = "2";
|
||||
peerId = "1";
|
||||
};
|
||||
in generateNodeConf (attrs // localConf);
|
||||
};
|
||||
testScript = ''
|
||||
startAll;
|
||||
$node1->waitForUnit('systemd-networkd-wait-online.service');
|
||||
$node2->waitForUnit('systemd-networkd-wait-online.service');
|
||||
$node1->succeed('ping -c 5 10.0.0.2');
|
||||
$node2->succeed('ping -c 5 10.0.0.1');
|
||||
# Is the fwmark set?
|
||||
$node2->succeed('wg | grep -q 42');
|
||||
'';
|
||||
})
|
|
@ -78,19 +78,16 @@ import ./make-test.nix ({ pkgs, ... }: {
|
|||
$machine->fail('dumpe2fs /dev/vdb | grep -q "^Last mount time: *n/a"');
|
||||
};
|
||||
|
||||
# Regression test for https://github.com/NixOS/nixpkgs/issues/35268
|
||||
subtest "file system with x-initrd.mount is not unmounted", sub {
|
||||
$machine->shutdown;
|
||||
$machine->waitForUnit('multi-user.target');
|
||||
# If the file system was unmounted during the shutdown the file system
|
||||
# has a last mount time, because the file system wasn't checked.
|
||||
$machine->fail('dumpe2fs /dev/vdb | grep -q "^Last mount time: *n/a"');
|
||||
};
|
||||
|
||||
subtest "systemd-shutdown works", sub {
|
||||
$machine->shutdown;
|
||||
$machine->waitForUnit('multi-user.target');
|
||||
$machine->succeed('test -e /tmp/shared/shutdown-test');
|
||||
};
|
||||
|
||||
# Test settings from /etc/sysctl.d/50-default.conf are applied
|
||||
subtest "systemd sysctl settings are applied", sub {
|
||||
$machine->waitForUnit('multi-user.target');
|
||||
$machine->succeed('sysctl net.core.default_qdisc | grep -q "fq_codel"');
|
||||
};
|
||||
'';
|
||||
})
|
||||
|
|
20
nixos/tests/trezord.nix
Normal file
20
nixos/tests/trezord.nix
Normal file
|
@ -0,0 +1,20 @@
|
|||
import ./make-test.nix ({ pkgs, ... }: {
|
||||
name = "trezord";
|
||||
meta = with pkgs.stdenv.lib.maintainers; {
|
||||
maintainers = [ mmahut ];
|
||||
};
|
||||
|
||||
nodes = {
|
||||
machine = { ... }: {
|
||||
services.trezord.enable = true;
|
||||
services.trezord.emulator.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
startAll;
|
||||
$machine->waitForUnit("trezord.service");
|
||||
$machine->waitForOpenPort(21325);
|
||||
$machine->waitUntilSucceeds("curl -L http://localhost:21325/status/ | grep Version");
|
||||
'';
|
||||
})
|
|
@ -1,4 +1,4 @@
|
|||
import ./make-test.nix ({ pkgs, ... }: {
|
||||
import ../make-test.nix ({ pkgs, ... }: {
|
||||
name = "ejabberd";
|
||||
meta = with pkgs.stdenv.lib.maintainers; {
|
||||
maintainers = [ ajs124 ];
|
||||
|
@ -45,8 +45,7 @@ import ./make-test.nix ({ pkgs, ... }: {
|
|||
ip: "127.0.0.1"
|
||||
module: ejabberd_service
|
||||
access: local
|
||||
shaper_rule: fast
|
||||
ip: "127.0.0.1"
|
||||
shaper: fast
|
||||
|
||||
## Disabling digest-md5 SASL authentication. digest-md5 requires plain-text
|
||||
## password storage (see auth_password_format option).
|
||||
|
@ -181,7 +180,6 @@ import ./make-test.nix ({ pkgs, ... }: {
|
|||
mod_client_state: {}
|
||||
mod_configure: {} # requires mod_adhoc
|
||||
## mod_delegation: {} # for xep0356
|
||||
mod_echo: {}
|
||||
#mod_irc:
|
||||
# host: "irc.@HOST@"
|
||||
# default_encoding: "utf-8"
|
77
nixos/tests/xmpp/prosody-mysql.nix
Normal file
77
nixos/tests/xmpp/prosody-mysql.nix
Normal file
|
@ -0,0 +1,77 @@
|
|||
import ../make-test.nix {
|
||||
name = "prosody-mysql";
|
||||
|
||||
nodes = {
|
||||
client = { nodes, pkgs, ... }: {
|
||||
environment.systemPackages = [
|
||||
(pkgs.callPackage ./xmpp-sendmessage.nix { connectTo = nodes.server.config.networking.primaryIPAddress; })
|
||||
];
|
||||
};
|
||||
server = { config, pkgs, ... }: {
|
||||
nixpkgs.overlays = [
|
||||
(self: super: {
|
||||
prosody = super.prosody.override {
|
||||
withDBI = true;
|
||||
withExtraLibs = [ pkgs.luaPackages.luadbi-mysql ];
|
||||
};
|
||||
})
|
||||
];
|
||||
networking.extraHosts = ''
|
||||
${config.networking.primaryIPAddress} example.com
|
||||
'';
|
||||
networking.firewall.enable = false;
|
||||
services.prosody = {
|
||||
enable = true;
|
||||
# TODO: use a self-signed certificate
|
||||
c2sRequireEncryption = false;
|
||||
extraConfig = ''
|
||||
storage = "sql"
|
||||
sql = {
|
||||
driver = "MySQL";
|
||||
database = "prosody";
|
||||
host = "mysql";
|
||||
port = 3306;
|
||||
username = "prosody";
|
||||
password = "password123";
|
||||
};
|
||||
'';
|
||||
virtualHosts.test = {
|
||||
domain = "example.com";
|
||||
enabled = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
mysql = { config, pkgs, ... }: {
|
||||
networking.firewall.enable = false;
|
||||
services.mysql = {
|
||||
enable = true;
|
||||
initialScript = pkgs.writeText "mysql_init.sql" ''
|
||||
CREATE DATABASE prosody;
|
||||
CREATE USER 'prosody'@'server' IDENTIFIED BY 'password123';
|
||||
GRANT ALL PRIVILEGES ON prosody.* TO 'prosody'@'server';
|
||||
FLUSH PRIVILEGES;
|
||||
'';
|
||||
package = pkgs.mariadb;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
testScript = { nodes, ... }: ''
|
||||
$mysql->waitForUnit('mysql.service');
|
||||
$server->waitForUnit('prosody.service');
|
||||
$server->succeed('prosodyctl status') =~ /Prosody is running/;
|
||||
|
||||
# set password to 'nothunter2' (it's asked twice)
|
||||
$server->succeed('yes nothunter2 | prosodyctl adduser cthon98@example.com');
|
||||
# set password to 'y'
|
||||
$server->succeed('yes | prosodyctl adduser azurediamond@example.com');
|
||||
# correct password to 'hunter2'
|
||||
$server->succeed('yes hunter2 | prosodyctl passwd azurediamond@example.com');
|
||||
|
||||
$client->succeed("send-message");
|
||||
|
||||
$server->succeed('prosodyctl deluser cthon98@example.com');
|
||||
$server->succeed('prosodyctl deluser azurediamond@example.com');
|
||||
'';
|
||||
}
|
||||
|
46
nixos/tests/xmpp/prosody.nix
Normal file
46
nixos/tests/xmpp/prosody.nix
Normal file
|
@ -0,0 +1,46 @@
|
|||
import ../make-test.nix {
|
||||
name = "prosody";
|
||||
|
||||
nodes = {
|
||||
client = { nodes, pkgs, ... }: {
|
||||
environment.systemPackages = [
|
||||
(pkgs.callPackage ./xmpp-sendmessage.nix { connectTo = nodes.server.config.networking.primaryIPAddress; })
|
||||
];
|
||||
};
|
||||
server = { config, pkgs, ... }: {
|
||||
networking.extraHosts = ''
|
||||
${config.networking.primaryIPAddress} example.com
|
||||
'';
|
||||
networking.firewall.enable = false;
|
||||
services.prosody = {
|
||||
enable = true;
|
||||
# TODO: use a self-signed certificate
|
||||
c2sRequireEncryption = false;
|
||||
extraConfig = ''
|
||||
storage = "sql"
|
||||
'';
|
||||
virtualHosts.test = {
|
||||
domain = "example.com";
|
||||
enabled = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
testScript = { nodes, ... }: ''
|
||||
$server->waitForUnit('prosody.service');
|
||||
$server->succeed('prosodyctl status') =~ /Prosody is running/;
|
||||
|
||||
# set password to 'nothunter2' (it's asked twice)
|
||||
$server->succeed('yes nothunter2 | prosodyctl adduser cthon98@example.com');
|
||||
# set password to 'y'
|
||||
$server->succeed('yes | prosodyctl adduser azurediamond@example.com');
|
||||
# correct password to 'hunter2'
|
||||
$server->succeed('yes hunter2 | prosodyctl passwd azurediamond@example.com');
|
||||
|
||||
$client->succeed("send-message");
|
||||
|
||||
$server->succeed('prosodyctl deluser cthon98@example.com');
|
||||
$server->succeed('prosodyctl deluser azurediamond@example.com');
|
||||
'';
|
||||
}
|
|
@ -1,38 +0,0 @@
|
|||
--- a/src/txmempool.h
|
||||
+++ b/src/txmempool.h
|
||||
@@ -204,7 +204,7 @@
|
||||
class CompareTxMemPoolEntryByDescendantScore
|
||||
{
|
||||
public:
|
||||
- bool operator()(const CTxMemPoolEntry& a, const CTxMemPoolEntry& b)
|
||||
+ bool operator()(const CTxMemPoolEntry& a, const CTxMemPoolEntry& b) const
|
||||
{
|
||||
bool fUseADescendants = UseDescendantScore(a);
|
||||
bool fUseBDescendants = UseDescendantScore(b);
|
||||
@@ -226,7 +226,7 @@
|
||||
}
|
||||
|
||||
// Calculate which score to use for an entry (avoiding division).
|
||||
- bool UseDescendantScore(const CTxMemPoolEntry &a)
|
||||
+ bool UseDescendantScore(const CTxMemPoolEntry &a) const
|
||||
{
|
||||
double f1 = (double)a.GetModifiedFee() * a.GetSizeWithDescendants();
|
||||
double f2 = (double)a.GetModFeesWithDescendants() * a.GetTxSize();
|
||||
@@ -241,7 +241,7 @@
|
||||
class CompareTxMemPoolEntryByScore
|
||||
{
|
||||
public:
|
||||
- bool operator()(const CTxMemPoolEntry& a, const CTxMemPoolEntry& b)
|
||||
+ bool operator()(const CTxMemPoolEntry& a, const CTxMemPoolEntry& b) const
|
||||
{
|
||||
double f1 = (double)a.GetModifiedFee() * b.GetTxSize();
|
||||
double f2 = (double)b.GetModifiedFee() * a.GetTxSize();
|
||||
@@ -255,7 +255,7 @@
|
||||
class CompareTxMemPoolEntryByEntryTime
|
||||
{
|
||||
public:
|
||||
- bool operator()(const CTxMemPoolEntry& a, const CTxMemPoolEntry& b)
|
||||
+ bool operator()(const CTxMemPoolEntry& a, const CTxMemPoolEntry& b) const
|
||||
{
|
||||
return a.GetTime() < b.GetTime();
|
||||
}
|
|
@ -1,34 +1,32 @@
|
|||
{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
|
||||
, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, libevent
|
||||
, withGui
|
||||
, zlib, miniupnpc, utillinux, protobuf, qrencode, libevent, python3
|
||||
, withGui, wrapQtAppsHook ? null, qtbase ? null, qttools ? null
|
||||
, Foundation, ApplicationServices, AppKit }:
|
||||
|
||||
with stdenv.lib;
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
|
||||
name = "bitcoin" + (toString (optional (!withGui) "d")) + "-unlimited-" + version;
|
||||
version = "1.0.3.0";
|
||||
version = "1.6.0.1";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "bitcoinunlimited";
|
||||
repo = "bitcoinunlimited";
|
||||
rev = "v${version}";
|
||||
sha256 = "0l02a7h502msrp4c02wgm7f3159ap8l61k4890vas99gq7ywxkcx";
|
||||
rev = "bucash${version}";
|
||||
sha256 = "0f0mnal4jf8xdj7w5m4rdlcqkrkbpxi88c006m5k45lmjmj141zr";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [ pkgconfig autoreconfHook ];
|
||||
nativeBuildInputs = [ pkgconfig autoreconfHook python3 ]
|
||||
++ optionals withGui [ wrapQtAppsHook qttools ];
|
||||
buildInputs = [ openssl db48 boost zlib
|
||||
miniupnpc utillinux protobuf libevent ]
|
||||
++ optionals withGui [ qt4 qrencode ]
|
||||
++ optionals withGui [ qtbase qttools qrencode ]
|
||||
++ optionals stdenv.isDarwin [ Foundation ApplicationServices AppKit ];
|
||||
|
||||
patches = [
|
||||
./bitcoin-unlimited-const-comparators.patch
|
||||
];
|
||||
|
||||
configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
|
||||
++ optionals withGui [ "--with-gui=qt4" ];
|
||||
++ optionals withGui [ "--with-gui=qt5"
|
||||
"--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin"
|
||||
];
|
||||
enableParallelBuilding = true;
|
||||
|
||||
meta = {
|
||||
|
|
|
@ -1,51 +0,0 @@
|
|||
{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db48, boost
|
||||
, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, curl, libevent
|
||||
, withGui
|
||||
, Foundation, ApplicationServices, AppKit }:
|
||||
|
||||
with stdenv.lib;
|
||||
stdenv.mkDerivation rec{
|
||||
|
||||
name = "bitcoin" + (toString (optional (!withGui) "d")) + "-xt-" + version;
|
||||
version = "0.11H";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "bitcoinxt";
|
||||
repo = "bitcoinxt";
|
||||
rev = "v${version}";
|
||||
sha256 = "1v43bynmidn2zdpky939km721x3ks91bzyh4200gji61qzsmyg62";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [ pkgconfig autoreconfHook ];
|
||||
buildInputs = [ openssl db48 boost zlib libevent
|
||||
miniupnpc utillinux protobuf curl ]
|
||||
++ optionals withGui [ qt4 qrencode ]
|
||||
++ optionals stdenv.isDarwin [ Foundation ApplicationServices AppKit ];
|
||||
|
||||
configureFlags = [
|
||||
"--with-boost-libdir=${boost.out}/lib"
|
||||
"--with-libcurl-headers=${curl.dev}/include"
|
||||
] ++ optionals withGui [ "--with-gui=qt4" ];
|
||||
|
||||
enableParallelBuilding = true;
|
||||
|
||||
meta = {
|
||||
description = "Peer-to-peer electronic cash system (XT client)";
|
||||
longDescription= ''
|
||||
Bitcoin is a free open source peer-to-peer electronic cash system that is
|
||||
completely decentralized, without the need for a central server or trusted
|
||||
parties. Users hold the crypto keys to their own money and transact directly
|
||||
with each other, with the help of a P2P network to check for double-spending.
|
||||
|
||||
Bitcoin XT is an implementation of a Bitcoin full node, based upon the
|
||||
source code of Bitcoin Core. It is built by taking the latest stable
|
||||
Core release, applying a series of patches, and then doing deterministic
|
||||
builds so anyone can check the downloads correspond to the source code.
|
||||
'';
|
||||
homepage = https://bitcoinxt.software/;
|
||||
maintainers = with maintainers; [ jefdaj ];
|
||||
license = licenses.mit;
|
||||
broken = stdenv.isDarwin;
|
||||
platforms = platforms.unix;
|
||||
};
|
||||
}
|
|
@ -1,4 +1,4 @@
|
|||
{ callPackage, boost155, boost165, openssl_1_1, darwin, libsForQt5, libsForQt59, miniupnpc_2, python3, buildGo110Package }:
|
||||
{ callPackage, boost155, boost165, darwin, libsForQt5, libsForQt59, miniupnpc_2, python3, buildGo110Package }:
|
||||
|
||||
rec {
|
||||
|
||||
|
@ -11,7 +11,7 @@ rec {
|
|||
bitcoin-abc = libsForQt5.callPackage ./bitcoin-abc.nix { boost = boost165; withGui = true; };
|
||||
bitcoind-abc = callPackage ./bitcoin-abc.nix { boost = boost165; withGui = false; };
|
||||
|
||||
bitcoin-unlimited = callPackage ./bitcoin-unlimited.nix {
|
||||
bitcoin-unlimited = libsForQt5.callPackage ./bitcoin-unlimited.nix {
|
||||
inherit (darwin.apple_sdk.frameworks) Foundation ApplicationServices AppKit;
|
||||
withGui = true;
|
||||
};
|
||||
|
@ -23,15 +23,6 @@ rec {
|
|||
bitcoin-classic = libsForQt5.callPackage ./bitcoin-classic.nix { boost = boost165; withGui = true; };
|
||||
bitcoind-classic = callPackage ./bitcoin-classic.nix { boost = boost165; withGui = false; };
|
||||
|
||||
bitcoin-xt = callPackage ./bitcoin-xt.nix {
|
||||
inherit (darwin.apple_sdk.frameworks) Foundation ApplicationServices AppKit;
|
||||
boost = boost165; withGui = true;
|
||||
};
|
||||
bitcoind-xt = callPackage ./bitcoin-xt.nix {
|
||||
inherit (darwin.apple_sdk.frameworks) Foundation ApplicationServices AppKit;
|
||||
boost = boost165; withGui = false;
|
||||
};
|
||||
|
||||
btc1 = callPackage ./btc1.nix {
|
||||
inherit (darwin.apple_sdk.frameworks) AppKit;
|
||||
boost = boost165;
|
||||
|
@ -69,9 +60,6 @@ rec {
|
|||
|
||||
masari = callPackage ./masari.nix { boost = boost165; };
|
||||
|
||||
memorycoin = callPackage ./memorycoin.nix { boost = boost165; withGui = true; };
|
||||
memorycoind = callPackage ./memorycoin.nix { boost = boost165; withGui = false; };
|
||||
|
||||
mist = callPackage ./mist.nix { };
|
||||
|
||||
namecoin = callPackage ./namecoin.nix { withGui = true; };
|
||||
|
@ -90,7 +78,6 @@ rec {
|
|||
|
||||
zcash = callPackage ./zcash {
|
||||
withGui = false;
|
||||
openssl = openssl_1_1;
|
||||
};
|
||||
|
||||
parity = callPackage ./parity { };
|
||||
|
|
|
@ -1,8 +1,8 @@
|
|||
{ stdenv , fetchFromGitHub
|
||||
, pkgconfig, autoreconfHook
|
||||
, db5, openssl, boost, zlib, miniupnpc
|
||||
, db5, openssl, boost, zlib, miniupnpc, libevent
|
||||
, protobuf, utillinux, qt4, qrencode
|
||||
, withGui, libevent }:
|
||||
, withGui }:
|
||||
|
||||
with stdenv.lib;
|
||||
stdenv.mkDerivation rec {
|
||||
|
|
|
@ -34,5 +34,8 @@ stdenv.mkDerivation rec {
|
|||
license = licenses.mit;
|
||||
maintainers = [ maintainers.viric ];
|
||||
platforms = platforms.linux;
|
||||
|
||||
# upstream doesn't support newer openssl versions, use 1.0.1 for testing
|
||||
broken = true;
|
||||
};
|
||||
}
|
||||
|
|
|
@ -1,27 +1,28 @@
|
|||
{ stdenv
|
||||
, lib
|
||||
, fetchgit
|
||||
, rustPlatform
|
||||
, openssl
|
||||
, pkgconfig
|
||||
, protobuf
|
||||
, rustup
|
||||
, darwin
|
||||
}:
|
||||
|
||||
rustPlatform.buildRustPackage rec {
|
||||
pname = "jormungandr";
|
||||
version = "0.3.1";
|
||||
version = "0.3.3";
|
||||
|
||||
src = fetchgit {
|
||||
url = "https://github.com/input-output-hk/${pname}";
|
||||
rev = "v${version}";
|
||||
sha256 = "0ys8sw73c7binxnl79dqi7sxva62bgifbhgyzvvjvmjjdxgq4kfp";
|
||||
sha256 = "1fw3cl2rxnw9mww1b1z96x2iapwbpdgyp4ra19dhvfzmlvaiml5j";
|
||||
fetchSubmodules = true;
|
||||
};
|
||||
|
||||
cargoSha256 = "0fphjzz78ym15qbka01idnq6vkyf4asrnhrhvxngwc3bifmnj937";
|
||||
cargoSha256 = "1ilp9ffaz3njv38mnqics4b5d7wh52mj4rwi71h5c0wzx4ww3zal";
|
||||
|
||||
nativeBuildInputs = [ pkgconfig protobuf rustup ];
|
||||
buildInputs = [ openssl ];
|
||||
nativeBuildInputs = [ pkgconfig protobuf ];
|
||||
buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
|
||||
|
||||
PROTOC = "${protobuf}/bin/protoc";
|
||||
|
||||
|
|
|
@ -1,56 +0,0 @@
|
|||
{ stdenv, fetchurl, pkgconfig, openssl, db48, boost
|
||||
, zlib, qt4, qmake4Hook, utillinux, protobuf, qrencode
|
||||
, withGui }:
|
||||
|
||||
with stdenv.lib;
|
||||
stdenv.mkDerivation rec{
|
||||
|
||||
name = "memorycoin" + (toString (optional (!withGui) "d")) + "-" + version;
|
||||
version = "0.8.5";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://github.com/memorycoin/memorycoin/archive/v${version}.tar.gz";
|
||||
sha256 = "1iyh6dqrg0mirwci5br5n5qw3ghp2cs23wd8ygr56bh9ml4dr1m8";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [ pkgconfig ];
|
||||
buildInputs = [ openssl db48 boost zlib utillinux protobuf ]
|
||||
++ optionals withGui [ qt4 qmake4Hook qrencode ];
|
||||
|
||||
qmakeFlags = ["USE_UPNP=-"];
|
||||
makeFlags = ["USE_UPNP=-"];
|
||||
|
||||
configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
|
||||
++ optionals withGui [ "--with-gui=qt4" ];
|
||||
|
||||
preBuild = "unset AR;"
|
||||
+ (toString (optional (!withGui) "cd src; cp makefile.unix Makefile"));
|
||||
|
||||
installPhase =
|
||||
if withGui
|
||||
then "install -D bitcoin-qt $out/bin/memorycoin-qt"
|
||||
else "install -D bitcoind $out/bin/memorycoind";
|
||||
|
||||
# `make build/version.o`:
|
||||
# make: *** No rule to make target 'build/build.h', needed by 'build/version.o'. Stop.
|
||||
enableParallelBuilding = false;
|
||||
|
||||
meta = {
|
||||
description = "Peer-to-peer, CPU-based electronic cash system";
|
||||
longDescription= ''
|
||||
Memorycoin is a cryptocurrency that aims to empower the
|
||||
economically and financially marginalized. It allows individuals
|
||||
to participate in the internet economy even when they live in
|
||||
countries where credit card companies and PayPal(R) refuse to
|
||||
operate. Individuals can store and transfer wealth with just a
|
||||
memorized pass phrase.
|
||||
|
||||
Memorycoin is based on the Bitcoin code, but with some key
|
||||
differences.
|
||||
'';
|
||||
homepage = http://www.bitcoin.org/;
|
||||
maintainers = with maintainers; [ AndersonTorres ];
|
||||
license = licenses.mit;
|
||||
platforms = [ "x86_64-linux" ];
|
||||
};
|
||||
}
|
|
@ -1,6 +1,6 @@
|
|||
let
|
||||
version = "2.6.0";
|
||||
sha256 = "1v0wc6l09nr42ljlq5lq1dgignm53hq3pmrgp2sld9zfxy3vdy0x";
|
||||
cargoSha256 = "1bkcvziz0diy76nbcgykajpnp6akva0m7ka7q6w3s9k7awxjxkx3";
|
||||
version = "2.6.1";
|
||||
sha256 = "0yvscs2ivy08zla3jhirxhwwaqsn9j5ml4sqbgx6h5rh19c941vh";
|
||||
cargoSha256 = "1s3c44cggajrmc504klf4cyb1s4l5ny48yihs9c3fc0n8d064017";
|
||||
in
|
||||
import ./parity.nix { inherit version sha256 cargoSha256; }
|
||||
|
|
|
@ -1,6 +1,6 @@
|
|||
let
|
||||
version = "2.5.5";
|
||||
sha256 = "193fnrf1pr67wblyxd5gbrg1rgflphnfaxgm3kb4iawjh18br6c6";
|
||||
cargoSha256 = "1w9p43v76igb62mbjk2rl7fynk13l4hpz25jd4f4hk5b2y2wf3r7";
|
||||
version = "2.5.6";
|
||||
sha256 = "1qkrqkkgjvm27babd6bidhf1n6vdp8rac1zy5kf61nfzplxzr2dy";
|
||||
cargoSha256 = "0aa0nkv3jr7cdzswbxghxxv0y65a59jgs1682ch8vrasi0x17m1x";
|
||||
in
|
||||
import ./parity.nix { inherit version sha256 cargoSha256; }
|
||||
|
|
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue