c4patino/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-06 17:13:24 -05:00
Code Issues Projects Releases Packages Wiki Activity

treewide: run nixfmt 1.0.0

Browse source
This commit is contained in:
Wolfgang Walther 2025-07-22 15:19:36 +02:00
commit 5a0711127c
No known key found for this signature in database
GPG key ID: B39893FA5F65CAE1
5118 changed files with 100492 additions and 103190 deletions
Download patch file Download diff file Expand all files Collapse all files

3
doc/hooks/tauri.section.md
View file

@ -45,7 +45,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
# Make sure we can find our libraries
pkg-config
] ++ lib.optionals stdenv.hostPlatform.isLinux [ wrapGAppsHook4 ];
]
++ lib.optionals stdenv.hostPlatform.isLinux [ wrapGAppsHook4 ];
buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
glib-networking # Most Tauri apps need networking

8
doc/languages-frameworks/coq.section.md
View file

@ -177,10 +177,8 @@ For instance, here is how you could add some code to be performed in the derivat
```nix
coqPackages.multinomials.overrideAttrs (oldAttrs: {
postInstall =
oldAttrs.postInstall or ""
+ ''
echo "you can do anything you want here"
'';
postInstall = oldAttrs.postInstall or "" + ''
echo "you can do anything you want here"
'';
})
```

30
doc/languages-frameworks/python.section.md
View file

@ -1376,20 +1376,19 @@ This is especially helpful to select tests or specify flags conditionally:
```nix
{
disabledTests =
[
# touches network
"download"
"update"
]
++ lib.optionals (pythonAtLeast "3.8") [
# broken due to python3.8 async changes
"async"
]
++ lib.optionals stdenv.buildPlatform.isDarwin [
# can fail when building with other packages
"socket"
];
disabledTests = [
# touches network
"download"
"update"
]
++ lib.optionals (pythonAtLeast "3.8") [
# broken due to python3.8 async changes
"async"
]
++ lib.optionals stdenv.buildPlatform.isDarwin [
# can fail when building with other packages
"socket"
];
}
```
@ -2035,7 +2034,8 @@ and letting the package requiring the extra add the list to its dependencies
{
dependencies = [
# ...
] ++ dask.optional-dependencies.complete;
]
++ dask.optional-dependencies.complete;
}
```

3
doc/stdenv/cross-compilation.chapter.md
View file

@ -171,7 +171,8 @@ e.g.
{
nativeBuildInputs = [
meson
] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];
]
++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];
}
```

19
lib/customisation.nix
View file

@ -446,16 +446,15 @@ rec {
let
outputs = drv.outputs or [ "out" ];
commonAttrs =
{
inherit (drv) name system meta;
inherit outputs;
}
// optionalAttrs (drv._hydraAggregate or false) {
_hydraAggregate = true;
constituents = map hydraJob (flatten drv.constituents);
}
// (listToAttrs outputsList);
commonAttrs = {
inherit (drv) name system meta;
inherit outputs;
}
// optionalAttrs (drv._hydraAggregate or false) {
_hydraAggregate = true;
constituents = map hydraJob (flatten drv.constituents);
}
// (listToAttrs outputsList);
makeOutput =
outputName:

7
lib/deprecated/misc.nix
View file

@ -355,8 +355,11 @@ let
mergeAttrByFunc =
x: y:
let
mergeAttrBy2 =
{ mergeAttrBy = mergeAttrs; } // (maybeAttr "mergeAttrBy" { } x) // (maybeAttr "mergeAttrBy" { } y);
mergeAttrBy2 = {
mergeAttrBy = mergeAttrs;
}
// (maybeAttr "mergeAttrBy" { } x)
// (maybeAttr "mergeAttrBy" { } y);
in
foldr mergeAttrs { } [
x

60
lib/modules.nix
View file

@ -886,19 +886,18 @@ let
path = showOption loc;
depth = length loc;
paragraphs =
[
"In module ${file}: expected an option declaration at option path `${path}` but got an attribute set with type ${actualTag}"
]
++ optional (actualTag == "option-type") ''
When declaring an option, you must wrap the type in a `mkOption` call. It should look somewhat like:
${comment}
${name} = lib.mkOption {
description = ...;
type = <the type you wrote for ${name}>;
...
};
'';
paragraphs = [
"In module ${file}: expected an option declaration at option path `${path}` but got an attribute set with type ${actualTag}"
]
++ optional (actualTag == "option-type") ''
When declaring an option, you must wrap the type in a `mkOption` call. It should look somewhat like:
${comment}
${name} = lib.mkOption {
description = ...;
type = <the type you wrote for ${name}>;
...
};
'';
# Ideally we'd know the exact syntax they used, but short of that,
# we can only reliably repeat the last. However, we repeat the
@ -1627,25 +1626,24 @@ let
) from
);
config =
{
warnings = filter (x: x != "") (
map (
f:
let
val = getAttrFromPath f config;
opt = getAttrFromPath f options;
in
optionalString (val != "_mkMergedOptionModule")
"The option `${showOption f}' defined in ${showFiles opt.files} has been changed to `${showOption to}' that has a different type. Please read `${showOption to}' documentation and update your configuration accordingly."
) from
);
}
// setAttrByPath to (
mkMerge (
optional (any (f: (getAttrFromPath f config) != "_mkMergedOptionModule") from) (mergeFn config)
)
config = {
warnings = filter (x: x != "") (
map (
f:
let
val = getAttrFromPath f config;
opt = getAttrFromPath f options;
in
optionalString (val != "_mkMergedOptionModule")
"The option `${showOption f}' defined in ${showFiles opt.files} has been changed to `${showOption to}' that has a different type. Please read `${showOption to}' documentation and update your configuration accordingly."
) from
);
}
// setAttrByPath to (
mkMerge (
optional (any (f: (getAttrFromPath f config) != "_mkMergedOptionModule") from) (mergeFn config)
)
);
};
/**

47
lib/options.nix
View file

@ -572,30 +572,29 @@ rec {
opt:
let
name = showOption opt.loc;
docOption =
{
loc = opt.loc;
inherit name;
description = opt.description or null;
declarations = filter (x: x != unknownModule) opt.declarations;
internal = opt.internal or false;
visible = if (opt ? visible && opt.visible == "shallow") then true else opt.visible or true;
readOnly = opt.readOnly or false;
type = opt.type.description or "unspecified";
}
// optionalAttrs (opt ? example) {
example = builtins.addErrorContext "while evaluating the example of option `${name}`" (
renderOptionValue opt.example
);
}
// optionalAttrs (opt ? defaultText || opt ? default) {
default = builtins.addErrorContext "while evaluating the ${
if opt ? defaultText then "defaultText" else "default value"
} of option `${name}`" (renderOptionValue (opt.defaultText or opt.default));
}
// optionalAttrs (opt ? relatedPackages && opt.relatedPackages != null) {
inherit (opt) relatedPackages;
};
docOption = {
loc = opt.loc;
inherit name;
description = opt.description or null;
declarations = filter (x: x != unknownModule) opt.declarations;
internal = opt.internal or false;
visible = if (opt ? visible && opt.visible == "shallow") then true else opt.visible or true;
readOnly = opt.readOnly or false;
type = opt.type.description or "unspecified";
}
// optionalAttrs (opt ? example) {
example = builtins.addErrorContext "while evaluating the example of option `${name}`" (
renderOptionValue opt.example
);
}
// optionalAttrs (opt ? defaultText || opt ? default) {
default = builtins.addErrorContext "while evaluating the ${
if opt ? defaultText then "defaultText" else "default value"
} of option `${name}`" (renderOptionValue (opt.defaultText or opt.default));
}
// optionalAttrs (opt ? relatedPackages && opt.relatedPackages != null) {
inherit (opt) relatedPackages;
};
subOptions =
let

15
lib/path/tests/default.nix
View file

@ -14,14 +14,13 @@
pkgs.runCommand "lib-path-tests"
{
nativeBuildInputs =
[
nixVersions.stable
]
++ (with pkgs; [
jq
bc
]);
nativeBuildInputs = [
nixVersions.stable
]
++ (with pkgs; [
jq
bc
]);
}
''
# Needed to make Nix evaluation work

9
lib/systems/architectures.nix
View file

@ -477,7 +477,8 @@ rec {
"armv9.1-a" = [
"armv9-a"
"armv8.6-a"
] ++ inferiors."armv8.6-a";
]
++ inferiors."armv8.6-a";
"armv9.2-a" = lib.unique (
[
"armv9.1-a"
@ -503,12 +504,14 @@ rec {
"armv8.2-a"
"cortex-a53"
"cortex-a72"
] ++ inferiors."armv8.2-a";
]
++ inferiors."armv8.2-a";
cortex-a76 = [
"armv8.2-a"
"cortex-a53"
"cortex-a72"
] ++ inferiors."armv8.2-a";
]
++ inferiors."armv8.2-a";
# Ampere
ampere1 = withInferiors [

919
lib/systems/default.nix
View file

@ -83,486 +83,485 @@ let
# TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
rust = args.rust or args.rustc or { };
final =
{
# Prefer to parse `config` as it is strictly more informative.
parsed = parse.mkSystemFromString (args.config or allArgs.system);
# This can be losslessly-extracted from `parsed` iff parsing succeeds.
system = parse.doubleFromSystem final.parsed;
# TODO: This currently can't be losslessly-extracted from `parsed`, for example
# because of -mingw32.
config = parse.tripleFromSystem final.parsed;
# Determine whether we can execute binaries built for the provided platform.
canExecute =
platform:
final.isAndroid == platform.isAndroid
&& parse.isCompatible final.parsed.cpu platform.parsed.cpu
&& final.parsed.kernel == platform.parsed.kernel
&& (
# Only perform this check when cpus have the same type;
# assume compatible cpu have all the instructions included
final.parsed.cpu == platform.parsed.cpu
->
# if both have gcc.arch defined, check whether final can execute the given platform
(
(final ? gcc.arch && platform ? gcc.arch)
-> architectures.canExecute final.gcc.arch platform.gcc.arch
)
# if platform has gcc.arch defined but final doesn't, don't assume it can be executed
|| (platform ? gcc.arch -> !(final ? gcc.arch))
);
final = {
# Prefer to parse `config` as it is strictly more informative.
parsed = parse.mkSystemFromString (args.config or allArgs.system);
# This can be losslessly-extracted from `parsed` iff parsing succeeds.
system = parse.doubleFromSystem final.parsed;
# TODO: This currently can't be losslessly-extracted from `parsed`, for example
# because of -mingw32.
config = parse.tripleFromSystem final.parsed;
# Determine whether we can execute binaries built for the provided platform.
canExecute =
platform:
final.isAndroid == platform.isAndroid
&& parse.isCompatible final.parsed.cpu platform.parsed.cpu
&& final.parsed.kernel == platform.parsed.kernel
&& (
# Only perform this check when cpus have the same type;
# assume compatible cpu have all the instructions included
final.parsed.cpu == platform.parsed.cpu
->
# if both have gcc.arch defined, check whether final can execute the given platform
(
(final ? gcc.arch && platform ? gcc.arch)
-> architectures.canExecute final.gcc.arch platform.gcc.arch
)
# if platform has gcc.arch defined but final doesn't, don't assume it can be executed
|| (platform ? gcc.arch -> !(final ? gcc.arch))
);
isCompatible =
_:
throw "2022-05-23: isCompatible has been removed in favor of canExecute, refer to the 22.11 changelog for details";
# Derived meta-data
useLLVM = final.isFreeBSD || final.isOpenBSD;
isCompatible =
_:
throw "2022-05-23: isCompatible has been removed in favor of canExecute, refer to the 22.11 changelog for details";
# Derived meta-data
useLLVM = final.isFreeBSD || final.isOpenBSD;
libc =
if final.isDarwin then
"libSystem"
else if final.isMinGW then
"msvcrt"
else if final.isWasi then
"wasilibc"
else if final.isWasm && !final.isWasi then
null
else if final.isRedox then
"relibc"
else if final.isMusl then
"musl"
else if final.isUClibc then
"uclibc"
else if final.isAndroid then
"bionic"
else if
final.isLinux # default
then
"glibc"
else if final.isFreeBSD then
"fblibc"
else if final.isOpenBSD then
"oblibc"
else if final.isNetBSD then
"nblibc"
else if final.isAvr then
"avrlibc"
else if final.isGhcjs then
null
else if final.isNone then
"newlib"
# TODO(@Ericson2314) think more about other operating systems
else
"native/impure";
# Choose what linker we wish to use by default. Someday we might also
# choose the C compiler, runtime library, C++ standard library, etc. in
# this way, nice and orthogonally, and deprecate `useLLVM`. But due to
# the monolithic GCC build we cannot actually make those choices
# independently, so we are just doing `linker` and keeping `useLLVM` for
# now.
linker =
if final.useLLVM or false then
"lld"
libc =
if final.isDarwin then
"libSystem"
else if final.isMinGW then
"msvcrt"
else if final.isWasi then
"wasilibc"
else if final.isWasm && !final.isWasi then
null
else if final.isRedox then
"relibc"
else if final.isMusl then
"musl"
else if final.isUClibc then
"uclibc"
else if final.isAndroid then
"bionic"
else if
final.isLinux # default
then
"glibc"
else if final.isFreeBSD then
"fblibc"
else if final.isOpenBSD then
"oblibc"
else if final.isNetBSD then
"nblibc"
else if final.isAvr then
"avrlibc"
else if final.isGhcjs then
null
else if final.isNone then
"newlib"
# TODO(@Ericson2314) think more about other operating systems
else
"native/impure";
# Choose what linker we wish to use by default. Someday we might also
# choose the C compiler, runtime library, C++ standard library, etc. in
# this way, nice and orthogonally, and deprecate `useLLVM`. But due to
# the monolithic GCC build we cannot actually make those choices
# independently, so we are just doing `linker` and keeping `useLLVM` for
# now.
linker =
if final.useLLVM or false then
"lld"
else if final.isDarwin then
"cctools"
# "bfd" and "gold" both come from GNU binutils. The existence of Gold
# is why we use the more obscure "bfd" and not "binutils" for this
# choice.
else
"bfd";
# The standard lib directory name that non-nixpkgs binaries distributed
# for this platform normally assume.
libDir =
if final.isLinux then
if final.isx86_64 || final.isMips64 || final.isPower64 then "lib64" else "lib"
else
null;
extensions =
optionalAttrs final.hasSharedLibraries {
sharedLibrary =
if final.isDarwin then
".dylib"
else if final.isWindows then
".dll"
else
".so";
}
// {
staticLibrary = if final.isWindows then ".lib" else ".a";
library = if final.isStatic then final.extensions.staticLibrary else final.extensions.sharedLibrary;
executable = if final.isWindows then ".exe" else "";
};
# Misc boolean options
useAndroidPrebuilt = false;
useiOSPrebuilt = false;
# Output from uname
uname = {
# uname -s
system =
{
linux = "Linux";
windows = "Windows";
darwin = "Darwin";
netbsd = "NetBSD";
freebsd = "FreeBSD";
openbsd = "OpenBSD";
wasi = "Wasi";
redox = "Redox";
genode = "Genode";
}
.${final.parsed.kernel.name} or null;
# uname -m
processor =
if final.isPower64 then
"ppc64${optionalString final.isLittleEndian "le"}"
else if final.isPower then
"ppc${optionalString final.isLittleEndian "le"}"
else if final.isMips64 then
"mips64" # endianness is *not* included on mips64
else if final.isDarwin then
"cctools"
# "bfd" and "gold" both come from GNU binutils. The existence of Gold
# is why we use the more obscure "bfd" and not "binutils" for this
# choice.
final.darwinArch
else
"bfd";
# The standard lib directory name that non-nixpkgs binaries distributed
# for this platform normally assume.
libDir =
if final.isLinux then
if final.isx86_64 || final.isMips64 || final.isPower64 then "lib64" else "lib"
final.parsed.cpu.name;
# uname -r
release = null;
};
# It is important that hasSharedLibraries==false when the platform has no
# dynamic library loader. Various tools (including the gcc build system)
# have knowledge of which platforms are incapable of dynamic linking, and
# will still build on/for those platforms with --enable-shared, but simply
# omit any `.so` build products such as libgcc_s.so. When that happens,
# it causes hard-to-troubleshoot build failures.
hasSharedLibraries =
with final;
(
isAndroid
|| isGnu
|| isMusl # Linux (allows multiple libcs)
|| isDarwin
|| isSunOS
|| isOpenBSD
|| isFreeBSD
|| isNetBSD # BSDs
|| isCygwin
|| isMinGW
|| isWindows # Windows
|| isWasm # WASM
)
&& !isStatic;
# The difference between `isStatic` and `hasSharedLibraries` is mainly the
# addition of the `staticMarker` (see make-derivation.nix). Some
# platforms, like embedded machines without a libc (e.g. arm-none-eabi)
# don't support dynamic linking, but don't get the `staticMarker`.
# `pkgsStatic` sets `isStatic=true`, so `pkgsStatic.hostPlatform` always
# has the `staticMarker`.
isStatic = final.isWasi || final.isRedox;
# Just a guess, based on `system`
inherit
(
{
linux-kernel = args.linux-kernel or { };
gcc = args.gcc or { };
}
// platforms.select final
)
linux-kernel
gcc
;
# TODO: remove after 23.05 is EOL, with an error pointing to the rust.* attrs.
rustc = args.rustc or { };
linuxArch =
if final.isAarch32 then
"arm"
else if final.isAarch64 then
"arm64"
else if final.isx86_32 then
"i386"
else if final.isx86_64 then
"x86_64"
# linux kernel does not distinguish microblaze/microblazeel
else if final.isMicroBlaze then
"microblaze"
else if final.isMips32 then
"mips"
else if final.isMips64 then
"mips" # linux kernel does not distinguish mips32/mips64
else if final.isPower then
"powerpc"
else if final.isRiscV then
"riscv"
else if final.isS390 then
"s390"
else if final.isLoongArch64 then
"loongarch"
else
final.parsed.cpu.name;
# https://source.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L81-106
ubootArch =
if final.isx86_32 then
"x86" # not i386
else if final.isMips64 then
"mips64" # uboot *does* distinguish between mips32/mips64
else
final.linuxArch; # other cases appear to agree with linuxArch
qemuArch =
if final.isAarch32 then
"arm"
else if final.isAarch64 then
"aarch64"
else if final.isS390 && !final.isS390x then
null
else if final.isx86_64 then
"x86_64"
else if final.isx86 then
"i386"
else if final.isMips64n32 then
"mipsn32${optionalString final.isLittleEndian "el"}"
else if final.isMips64 then
"mips64${optionalString final.isLittleEndian "el"}"
else
final.uname.processor;
# Name used by UEFI for architectures.
efiArch =
if final.isx86_32 then
"ia32"
else if final.isx86_64 then
"x64"
else if final.isAarch32 then
"arm"
else if final.isAarch64 then
"aa64"
else
final.parsed.cpu.name;
darwinArch = parse.darwinArch final.parsed.cpu;
darwinPlatform =
if final.isMacOS then
"macos"
else if final.isiOS then
"ios"
else
null;
# The canonical name for this attribute is darwinSdkVersion, but some
# platforms define the old name "sdkVer".
darwinSdkVersion = final.sdkVer or "11.3";
darwinMinVersion = final.darwinSdkVersion;
darwinMinVersionVariable =
if final.isMacOS then
"MACOSX_DEPLOYMENT_TARGET"
else if final.isiOS then
"IPHONEOS_DEPLOYMENT_TARGET"
else
null;
# Handle Android SDK and NDK versions.
androidSdkVersion = args.androidSdkVersion or null;
androidNdkVersion = args.androidNdkVersion or null;
}
// (
let
selectEmulator =
pkgs:
let
wine = (pkgs.winePackagesFor "wine${toString final.parsed.cpu.bits}").minimal;
in
# Note: we guarantee that the return value is either `null` or a path
# to an emulator program. That is, if an emulator requires additional
# arguments, a wrapper should be used.
if pkgs.stdenv.hostPlatform.canExecute final then
lib.getExe (pkgs.writeShellScriptBin "exec" ''exec "$@"'')
else if final.isWindows then
"${wine}/bin/wine${optionalString (final.parsed.cpu.bits == 64) "64"}"
else if final.isLinux && pkgs.stdenv.hostPlatform.isLinux && final.qemuArch != null then
"${pkgs.qemu-user}/bin/qemu-${final.qemuArch}"
else if final.isWasi then
"${pkgs.wasmtime}/bin/wasmtime"
else if final.isMmix then
"${pkgs.mmixware}/bin/mmix"
else
null;
extensions =
optionalAttrs final.hasSharedLibraries {
sharedLibrary =
if final.isDarwin then
".dylib"
else if final.isWindows then
".dll"
else
".so";
}
// {
staticLibrary = if final.isWindows then ".lib" else ".a";
library = if final.isStatic then final.extensions.staticLibrary else final.extensions.sharedLibrary;
executable = if final.isWindows then ".exe" else "";
};
# Misc boolean options
useAndroidPrebuilt = false;
useiOSPrebuilt = false;
in
{
emulatorAvailable = pkgs: (selectEmulator pkgs) != null;
# Output from uname
uname = {
# uname -s
system =
{
linux = "Linux";
windows = "Windows";
darwin = "Darwin";
netbsd = "NetBSD";
freebsd = "FreeBSD";
openbsd = "OpenBSD";
wasi = "Wasi";
redox = "Redox";
genode = "Genode";
}
.${final.parsed.kernel.name} or null;
# whether final.emulator pkgs.pkgsStatic works
staticEmulatorAvailable =
pkgs: final.emulatorAvailable pkgs && (final.isLinux || final.isWasi || final.isMmix);
# uname -m
processor =
if final.isPower64 then
"ppc64${optionalString final.isLittleEndian "le"}"
else if final.isPower then
"ppc${optionalString final.isLittleEndian "le"}"
emulator =
pkgs:
if (final.emulatorAvailable pkgs) then
selectEmulator pkgs
else
throw "Don't know how to run ${final.config} executables.";
}
)
// mapAttrs (n: v: v final.parsed) inspect.predicates
// mapAttrs (n: v: v final.gcc.arch or "default") architectures.predicates
// args
// {
rust = rust // {
# Once args.rustc.platform.target-family is deprecated and
# removed, there will no longer be any need to modify any
# values from args.rust.platform, so we can drop all the
# "args ? rust" etc. checks, and merge args.rust.platform in
# /after/.
platform = rust.platform or { } // {
# https://doc.rust-lang.org/reference/conditional-compilation.html#target_arch
arch =
if rust ? platform then
rust.platform.arch
else if final.isAarch32 then
"arm"
else if final.isMips64 then
"mips64" # endianness is *not* included on mips64
else if final.isDarwin then
final.darwinArch
"mips64" # never add "el" suffix
else if final.isPower64 then
"powerpc64" # never add "le" suffix
else
final.parsed.cpu.name;
# uname -r
release = null;
# https://doc.rust-lang.org/reference/conditional-compilation.html#target_os
os =
if rust ? platform then
rust.platform.os or "none"
else if final.isDarwin then
"macos"
else if final.isWasm && !final.isWasi then
"unknown" # Needed for {wasm32,wasm64}-unknown-unknown.
else
final.parsed.kernel.name;
# https://doc.rust-lang.org/reference/conditional-compilation.html#target_family
target-family =
if args ? rust.platform.target-family then
args.rust.platform.target-family
else if args ? rustc.platform.target-family then
(
# Since https://github.com/rust-lang/rust/pull/84072
# `target-family` is a list instead of single value.
let
f = args.rustc.platform.target-family;
in
if isList f then f else [ f ]
)
else
optional final.isUnix "unix" ++ optional final.isWindows "windows" ++ optional final.isWasm "wasm";
# https://doc.rust-lang.org/reference/conditional-compilation.html#target_vendor
vendor =
let
inherit (final.parsed) vendor;
in
rust.platform.vendor or {
"w64" = "pc";
}
.${vendor.name} or vendor.name;
};
# It is important that hasSharedLibraries==false when the platform has no
# dynamic library loader. Various tools (including the gcc build system)
# have knowledge of which platforms are incapable of dynamic linking, and
# will still build on/for those platforms with --enable-shared, but simply
# omit any `.so` build products such as libgcc_s.so. When that happens,
# it causes hard-to-troubleshoot build failures.
hasSharedLibraries =
with final;
(
isAndroid
|| isGnu
|| isMusl # Linux (allows multiple libcs)
|| isDarwin
|| isSunOS
|| isOpenBSD
|| isFreeBSD
|| isNetBSD # BSDs
|| isCygwin
|| isMinGW
|| isWindows # Windows
|| isWasm # WASM
)
&& !isStatic;
# The difference between `isStatic` and `hasSharedLibraries` is mainly the
# addition of the `staticMarker` (see make-derivation.nix). Some
# platforms, like embedded machines without a libc (e.g. arm-none-eabi)
# don't support dynamic linking, but don't get the `staticMarker`.
# `pkgsStatic` sets `isStatic=true`, so `pkgsStatic.hostPlatform` always
# has the `staticMarker`.
isStatic = final.isWasi || final.isRedox;
# Just a guess, based on `system`
inherit
(
{
linux-kernel = args.linux-kernel or { };
gcc = args.gcc or { };
}
// platforms.select final
)
linux-kernel
gcc
;
# TODO: remove after 23.05 is EOL, with an error pointing to the rust.* attrs.
rustc = args.rustc or { };
linuxArch =
if final.isAarch32 then
"arm"
else if final.isAarch64 then
"arm64"
else if final.isx86_32 then
"i386"
else if final.isx86_64 then
"x86_64"
# linux kernel does not distinguish microblaze/microblazeel
else if final.isMicroBlaze then
"microblaze"
else if final.isMips32 then
"mips"
else if final.isMips64 then
"mips" # linux kernel does not distinguish mips32/mips64
else if final.isPower then
"powerpc"
else if final.isRiscV then
"riscv"
else if final.isS390 then
"s390"
else if final.isLoongArch64 then
"loongarch"
else
final.parsed.cpu.name;
# https://source.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L81-106
ubootArch =
if final.isx86_32 then
"x86" # not i386
else if final.isMips64 then
"mips64" # uboot *does* distinguish between mips32/mips64
else
final.linuxArch; # other cases appear to agree with linuxArch
qemuArch =
if final.isAarch32 then
"arm"
else if final.isAarch64 then
"aarch64"
else if final.isS390 && !final.isS390x then
null
else if final.isx86_64 then
"x86_64"
else if final.isx86 then
"i386"
else if final.isMips64n32 then
"mipsn32${optionalString final.isLittleEndian "el"}"
else if final.isMips64 then
"mips64${optionalString final.isLittleEndian "el"}"
else
final.uname.processor;
# Name used by UEFI for architectures.
efiArch =
if final.isx86_32 then
"ia32"
else if final.isx86_64 then
"x64"
else if final.isAarch32 then
"arm"
else if final.isAarch64 then
"aa64"
else
final.parsed.cpu.name;
darwinArch = parse.darwinArch final.parsed.cpu;
darwinPlatform =
if final.isMacOS then
"macos"
else if final.isiOS then
"ios"
else
null;
# The canonical name for this attribute is darwinSdkVersion, but some
# platforms define the old name "sdkVer".
darwinSdkVersion = final.sdkVer or "11.3";
darwinMinVersion = final.darwinSdkVersion;
darwinMinVersionVariable =
if final.isMacOS then
"MACOSX_DEPLOYMENT_TARGET"
else if final.isiOS then
"IPHONEOS_DEPLOYMENT_TARGET"
else
null;
# Handle Android SDK and NDK versions.
androidSdkVersion = args.androidSdkVersion or null;
androidNdkVersion = args.androidNdkVersion or null;
}
// (
let
selectEmulator =
pkgs:
let
wine = (pkgs.winePackagesFor "wine${toString final.parsed.cpu.bits}").minimal;
in
# Note: we guarantee that the return value is either `null` or a path
# to an emulator program. That is, if an emulator requires additional
# arguments, a wrapper should be used.
if pkgs.stdenv.hostPlatform.canExecute final then
lib.getExe (pkgs.writeShellScriptBin "exec" ''exec "$@"'')
else if final.isWindows then
"${wine}/bin/wine${optionalString (final.parsed.cpu.bits == 64) "64"}"
else if final.isLinux && pkgs.stdenv.hostPlatform.isLinux && final.qemuArch != null then
"${pkgs.qemu-user}/bin/qemu-${final.qemuArch}"
else if final.isWasi then
"${pkgs.wasmtime}/bin/wasmtime"
else if final.isMmix then
"${pkgs.mmixware}/bin/mmix"
else
null;
in
{
emulatorAvailable = pkgs: (selectEmulator pkgs) != null;
# whether final.emulator pkgs.pkgsStatic works
staticEmulatorAvailable =
pkgs: final.emulatorAvailable pkgs && (final.isLinux || final.isWasi || final.isMmix);
emulator =
pkgs:
if (final.emulatorAvailable pkgs) then
selectEmulator pkgs
else
throw "Don't know how to run ${final.config} executables.";
}
)
// mapAttrs (n: v: v final.parsed) inspect.predicates
// mapAttrs (n: v: v final.gcc.arch or "default") architectures.predicates
// args
// {
rust = rust // {
# Once args.rustc.platform.target-family is deprecated and
# removed, there will no longer be any need to modify any
# values from args.rust.platform, so we can drop all the
# "args ? rust" etc. checks, and merge args.rust.platform in
# /after/.
platform = rust.platform or { } // {
# https://doc.rust-lang.org/reference/conditional-compilation.html#target_arch
arch =
if rust ? platform then
rust.platform.arch
else if final.isAarch32 then
"arm"
else if final.isMips64 then
"mips64" # never add "el" suffix
else if final.isPower64 then
"powerpc64" # never add "le" suffix
else
final.parsed.cpu.name;
# https://doc.rust-lang.org/reference/conditional-compilation.html#target_os
os =
if rust ? platform then
rust.platform.os or "none"
else if final.isDarwin then
"macos"
else if final.isWasm && !final.isWasi then
"unknown" # Needed for {wasm32,wasm64}-unknown-unknown.
else
final.parsed.kernel.name;
# https://doc.rust-lang.org/reference/conditional-compilation.html#target_family
target-family =
if args ? rust.platform.target-family then
args.rust.platform.target-family
else if args ? rustc.platform.target-family then
(
# Since https://github.com/rust-lang/rust/pull/84072
# `target-family` is a list instead of single value.
let
f = args.rustc.platform.target-family;
in
if isList f then f else [ f ]
)
else
optional final.isUnix "unix" ++ optional final.isWindows "windows" ++ optional final.isWasm "wasm";
# https://doc.rust-lang.org/reference/conditional-compilation.html#target_vendor
vendor =
let
inherit (final.parsed) vendor;
in
rust.platform.vendor or {
"w64" = "pc";
# The name of the rust target, even if it is custom. Adjustments are
# because rust has slightly different naming conventions than we do.
rustcTarget =
let
inherit (final.parsed) cpu kernel abi;
cpu_ =
rust.platform.arch or {
"armv7a" = "armv7";
"armv7l" = "armv7";
"armv6l" = "arm";
"armv5tel" = "armv5te";
"riscv32" = "riscv32gc";
"riscv64" = "riscv64gc";
}
.${vendor.name} or vendor.name;
};
.${cpu.name} or cpu.name;
vendor_ = final.rust.platform.vendor;
in
# TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
args.rust.rustcTarget or args.rustc.config or (
# Rust uses `wasm32-wasip?` rather than `wasm32-unknown-wasi`.
# We cannot know which subversion does the user want, and
# currently use WASI 0.1 as default for compatibility. Custom
# users can set `rust.rustcTarget` to override it.
if final.isWasi then
"${cpu_}-wasip1"
else
"${cpu_}-${vendor_}-${kernel.name}${optionalString (abi.name != "unknown") "-${abi.name}"}"
);
# The name of the rust target, even if it is custom. Adjustments are
# because rust has slightly different naming conventions than we do.
rustcTarget =
let
inherit (final.parsed) cpu kernel abi;
cpu_ =
rust.platform.arch or {
"armv7a" = "armv7";
"armv7l" = "armv7";
"armv6l" = "arm";
"armv5tel" = "armv5te";
"riscv32" = "riscv32gc";
"riscv64" = "riscv64gc";
}
.${cpu.name} or cpu.name;
vendor_ = final.rust.platform.vendor;
in
# TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
args.rust.rustcTarget or args.rustc.config or (
# Rust uses `wasm32-wasip?` rather than `wasm32-unknown-wasi`.
# We cannot know which subversion does the user want, and
# currently use WASI 0.1 as default for compatibility. Custom
# users can set `rust.rustcTarget` to override it.
if final.isWasi then
"${cpu_}-wasip1"
else
"${cpu_}-${vendor_}-${kernel.name}${optionalString (abi.name != "unknown") "-${abi.name}"}"
);
# The name of the rust target if it is standard, or the json file
# containing the custom target spec.
rustcTargetSpec =
rust.rustcTargetSpec or (
if rust ? platform then
builtins.toFile (final.rust.rustcTarget + ".json") (toJSON rust.platform)
else
final.rust.rustcTarget
);
# The name of the rust target if it is standard, or the json file
# containing the custom target spec.
rustcTargetSpec =
rust.rustcTargetSpec or (
if rust ? platform then
builtins.toFile (final.rust.rustcTarget + ".json") (toJSON rust.platform)
else
final.rust.rustcTarget
);
# The name of the rust target if it is standard, or the
# basename of the file containing the custom target spec,
# without the .json extension.
#
# This is the name used by Cargo for target subdirectories.
cargoShortTarget = removeSuffix ".json" (baseNameOf "${final.rust.rustcTargetSpec}");
# The name of the rust target if it is standard, or the
# basename of the file containing the custom target spec,
# without the .json extension.
#
# This is the name used by Cargo for target subdirectories.
cargoShortTarget = removeSuffix ".json" (baseNameOf "${final.rust.rustcTargetSpec}");
# When used as part of an environment variable name, triples are
# uppercased and have all hyphens replaced by underscores:
#
# https://github.com/rust-lang/cargo/pull/9169
# https://github.com/rust-lang/cargo/issues/8285#issuecomment-634202431
cargoEnvVarTarget = replaceString "-" "_" (toUpper final.rust.cargoShortTarget);
# When used as part of an environment variable name, triples are
# uppercased and have all hyphens replaced by underscores:
#
# https://github.com/rust-lang/cargo/pull/9169
# https://github.com/rust-lang/cargo/issues/8285#issuecomment-634202431
cargoEnvVarTarget = replaceString "-" "_" (toUpper final.rust.cargoShortTarget);
# True if the target is no_std
# https://github.com/rust-lang/rust/blob/2e44c17c12cec45b6a682b1e53a04ac5b5fcc9d2/src/bootstrap/config.rs#L415-L421
isNoStdTarget = any (t: hasInfix t final.rust.rustcTarget) [
"-none"
"nvptx"
"switch"
"-uefi"
];
};
}
// {
go = {
# See https://pkg.go.dev/internal/platform for a list of known platforms
GOARCH =
{
"aarch64" = "arm64";
"arm" = "arm";
"armv5tel" = "arm";
"armv6l" = "arm";
"armv7l" = "arm";
"i686" = "386";
"loongarch64" = "loong64";
"mips" = "mips";
"mips64el" = "mips64le";
"mipsel" = "mipsle";
"powerpc64" = "ppc64";
"powerpc64le" = "ppc64le";
"riscv64" = "riscv64";
"s390x" = "s390x";
"x86_64" = "amd64";
"wasm32" = "wasm";
}
.${final.parsed.cpu.name} or null;
GOOS = if final.isWasi then "wasip1" else final.parsed.kernel.name;
# See https://go.dev/wiki/GoArm
GOARM = toString (lib.intersectLists [ (final.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
};
# True if the target is no_std
# https://github.com/rust-lang/rust/blob/2e44c17c12cec45b6a682b1e53a04ac5b5fcc9d2/src/bootstrap/config.rs#L415-L421
isNoStdTarget = any (t: hasInfix t final.rust.rustcTarget) [
"-none"
"nvptx"
"switch"
"-uefi"
];
};
}
// {
go = {
# See https://pkg.go.dev/internal/platform for a list of known platforms
GOARCH =
{
"aarch64" = "arm64";
"arm" = "arm";
"armv5tel" = "arm";
"armv6l" = "arm";
"armv7l" = "arm";
"i686" = "386";
"loongarch64" = "loong64";
"mips" = "mips";
"mips64el" = "mips64le";
"mipsel" = "mipsle";
"powerpc64" = "ppc64";
"powerpc64le" = "ppc64le";
"riscv64" = "riscv64";
"s390x" = "s390x";
"x86_64" = "amd64";
"wasm32" = "wasm";
}
.${final.parsed.cpu.name} or null;
GOOS = if final.isWasi then "wasip1" else final.parsed.kernel.name;
# See https://go.dev/wiki/GoArm
GOARM = toString (lib.intersectLists [ (final.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
};
};
in
assert final.useAndroidPrebuilt -> final.isAndroid;
assert foldl (pass: { assertion, message }: if assertion final then pass else throw message) true (

45
lib/systems/examples.nix
View file

@ -38,23 +38,28 @@ rec {
sheevaplug = {
config = "armv5tel-unknown-linux-gnueabi";
} // platforms.sheevaplug;
}
// platforms.sheevaplug;
raspberryPi = {
config = "armv6l-unknown-linux-gnueabihf";
} // platforms.raspberrypi;
}
// platforms.raspberrypi;
bluefield2 = {
config = "aarch64-unknown-linux-gnu";
} // platforms.bluefield2;
}
// platforms.bluefield2;
remarkable1 = {
config = "armv7l-unknown-linux-gnueabihf";
} // platforms.zero-gravitas;
}
// platforms.zero-gravitas;
remarkable2 = {
config = "armv7l-unknown-linux-gnueabihf";
} // platforms.zero-sugar;
}
// platforms.zero-sugar;
armv7l-hf-multiplatform = {
config = "armv7l-unknown-linux-gnueabihf";
@ -70,7 +75,8 @@ rec {
androidSdkVersion = "33";
androidNdkVersion = "26";
useAndroidPrebuilt = true;
} // platforms.armv7a-android;
}
// platforms.armv7a-android;
aarch64-android-prebuilt = {
config = "aarch64-unknown-linux-android";
@ -91,39 +97,48 @@ rec {
pogoplug4 = {
config = "armv5tel-unknown-linux-gnueabi";
} // platforms.pogoplug4;
}
// platforms.pogoplug4;
ben-nanonote = {
config = "mipsel-unknown-linux-uclibc";
} // platforms.ben_nanonote;
}
// platforms.ben_nanonote;
fuloongminipc = {
config = "mipsel-unknown-linux-gnu";
} // platforms.fuloong2f_n32;
}
// platforms.fuloong2f_n32;
# can execute on 32bit chip
mips-linux-gnu = {
config = "mips-unknown-linux-gnu";
} // platforms.gcc_mips32r2_o32;
}
// platforms.gcc_mips32r2_o32;
mipsel-linux-gnu = {
config = "mipsel-unknown-linux-gnu";
} // platforms.gcc_mips32r2_o32;
}
// platforms.gcc_mips32r2_o32;
# require 64bit chip (for more registers, 64-bit floating point, 64-bit "long long") but use 32bit pointers
mips64-linux-gnuabin32 = {
config = "mips64-unknown-linux-gnuabin32";
} // platforms.gcc_mips64r2_n32;
}
// platforms.gcc_mips64r2_n32;
mips64el-linux-gnuabin32 = {
config = "mips64el-unknown-linux-gnuabin32";
} // platforms.gcc_mips64r2_n32;
}
// platforms.gcc_mips64r2_n32;
# 64bit pointers
mips64-linux-gnuabi64 = {
config = "mips64-unknown-linux-gnuabi64";
} // platforms.gcc_mips64r2_64;
}
// platforms.gcc_mips64r2_64;
mips64el-linux-gnuabi64 = {
config = "mips64el-unknown-linux-gnuabi64";
} // platforms.gcc_mips64r2_64;
}
// platforms.gcc_mips64r2_64;
muslpi = raspberryPi // {
config = "armv6l-unknown-linux-musleabihf";

20
lib/systems/inspect.nix
View file

@ -260,16 +260,16 @@ rec {
bits = 64;
};
};
isILP32 =
[
{
cpu = {
family = "wasm";
bits = 32;
};
}
]
++ map
isILP32 = [
{
cpu = {
family = "wasm";
bits = 32;
};
}
]
++
map
(a: {
abi = {
abi = a;

15
lib/tests/modules/define-option-dependently-nested.nix
View file

@ -5,13 +5,12 @@
{
# Always defined, but the value depends on the presence of an option.
config.set =
{
value = if options ? set.enable then 360 else 7;
}
# Only define if possible.
// lib.optionalAttrs (options ? set.enable) {
enable = true;
};
config.set = {
value = if options ? set.enable then 360 else 7;
}
# Only define if possible.
// lib.optionalAttrs (options ? set.enable) {
enable = true;
};
}

15
lib/tests/modules/define-option-dependently.nix
View file

@ -5,13 +5,12 @@
{
# Always defined, but the value depends on the presence of an option.
config =
{
value = if options ? enable then 360 else 7;
}
# Only define if possible.
// lib.optionalAttrs (options ? enable) {
enable = true;
};
config = {
value = if options ? enable then 360 else 7;
}
# Only define if possible.
// lib.optionalAttrs (options ? enable) {
enable = true;
};
}

3
lib/tests/test-with-nix.nix
View file

@ -27,7 +27,8 @@ pkgs.runCommand "nixpkgs-lib-tests-nix-${nix.version}"
nativeBuildInputs = [
nix
pkgs.gitMinimal
] ++ lib.optional pkgs.stdenv.hostPlatform.isLinux pkgs.inotify-tools;
]
++ lib.optional pkgs.stdenv.hostPlatform.isLinux pkgs.inotify-tools;
strictDeps = true;
}
''

3
lib/types.nix
View file

@ -1210,7 +1210,8 @@ let
# It shouldn't cause an issue since this is cosmetic for the manual.
_module.args.name = lib.mkOptionDefault "‹name›";
}
] ++ modules;
]
++ modules;
};
freeformType = base._module.freeformType;

3
nixos/lib/eval-config-minimal.nix
View file

@ -40,7 +40,8 @@ let
class = "nixos";
specialArgs = {
modulesPath = builtins.toString ../modules;
} // specialArgs;
}
// specialArgs;
};
in

3
nixos/lib/make-btrfs-fs.nix
View file

@ -31,7 +31,8 @@ pkgs.stdenv.mkDerivation {
btrfs-progs
libfaketime
fakeroot
] ++ lib.optional compressImage zstd;
]
++ lib.optional compressImage zstd;
buildCommand = ''
${if compressImage then "img=temp.img" else "img=$out"}

3
nixos/lib/make-ext4-fs.nix
View file

@ -33,7 +33,8 @@ pkgs.stdenv.mkDerivation {
libfaketime
perl
fakeroot
] ++ lib.optional compressImage zstd;
]
++ lib.optional compressImage zstd;
buildCommand = ''
${if compressImage then "img=temp.img" else "img=$out"}

3
nixos/lib/make-iso9660-image.nix
View file

@ -82,7 +82,8 @@ stdenv.mkDerivation {
syslinux
zstd
libossp_uuid
] ++ lib.optionals needSquashfs makeSquashfsDrv.nativeBuildInputs;
]
++ lib.optionals needSquashfs makeSquashfsDrv.nativeBuildInputs;
inherit
isoName

59
nixos/lib/make-squashfs.nix
View file

@ -29,40 +29,39 @@ stdenv.mkDerivation {
nativeBuildInputs = [ squashfsTools ];
buildCommand =
''
closureInfo=${closureInfo { rootPaths = storeContents; }}
buildCommand = ''
closureInfo=${closureInfo { rootPaths = storeContents; }}
# Also include a manifest of the closures in a format suitable
# for nix-store --load-db.
cp $closureInfo/registration nix-path-registration
# Also include a manifest of the closures in a format suitable
# for nix-store --load-db.
cp $closureInfo/registration nix-path-registration
imgPath="$out"
''
+ lib.optionalString hydraBuildProduct ''
imgPath="$out"
''
+ lib.optionalString hydraBuildProduct ''
mkdir $out
imgPath="$out/${fileName}.squashfs"
''
+ lib.optionalString stdenv.buildPlatform.is32bit ''
mkdir $out
imgPath="$out/${fileName}.squashfs"
''
+ lib.optionalString stdenv.buildPlatform.is32bit ''
# 64 cores on i686 does not work
# fails with FATAL ERROR: mangle2:: xz compress failed with error code 5
if ((NIX_BUILD_CORES > 48)); then
NIX_BUILD_CORES=48
fi
''
+ ''
# 64 cores on i686 does not work
# fails with FATAL ERROR: mangle2:: xz compress failed with error code 5
if ((NIX_BUILD_CORES > 48)); then
NIX_BUILD_CORES=48
fi
''
+ ''
# Generate the squashfs image.
# We have to set SOURCE_DATE_EPOCH to 0 here for reproducibility (https://github.com/NixOS/nixpkgs/issues/390696)
SOURCE_DATE_EPOCH=0 mksquashfs nix-path-registration $(cat $closureInfo/store-paths) $imgPath ${pseudoFilesArgs} \
-no-hardlinks ${lib.optionalString noStrip "-no-strip"} -keep-as-directory -all-root -b 1048576 ${compFlag} \
-processors $NIX_BUILD_CORES -root-mode 0755
''
+ lib.optionalString hydraBuildProduct ''
# Generate the squashfs image.
# We have to set SOURCE_DATE_EPOCH to 0 here for reproducibility (https://github.com/NixOS/nixpkgs/issues/390696)
SOURCE_DATE_EPOCH=0 mksquashfs nix-path-registration $(cat $closureInfo/store-paths) $imgPath ${pseudoFilesArgs} \
-no-hardlinks ${lib.optionalString noStrip "-no-strip"} -keep-as-directory -all-root -b 1048576 ${compFlag} \
-processors $NIX_BUILD_CORES -root-mode 0755
''
+ lib.optionalString hydraBuildProduct ''
mkdir -p $out/nix-support
echo "file squashfs-image $out/${fileName}.squashfs" >> $out/nix-support/hydra-build-products
'';
mkdir -p $out/nix-support
echo "file squashfs-image $out/${fileName}.squashfs" >> $out/nix-support/hydra-build-products
'';
}

21
nixos/lib/systemd-lib.nix
View file

@ -701,17 +701,16 @@ rec {
{
config = {
name = "${utils.escapeSystemdPath config.where}.mount";
mountConfig =
{
What = config.what;
Where = config.where;
}
// optionalAttrs (config.type != "") {
Type = config.type;
}
// optionalAttrs (config.options != "") {
Options = config.options;
};
mountConfig = {
What = config.what;
Where = config.where;
}
// optionalAttrs (config.type != "") {
Type = config.type;
}
// optionalAttrs (config.options != "") {
Options = config.options;
};
};
};

23
nixos/lib/test-driver/default.nix
View file

@ -37,18 +37,17 @@ python3Packages.buildPythonApplication {
]
++ extraPythonPackages python3Packages;
propagatedBuildInputs =
[
coreutils
netpbm
qemu_pkg
socat
vde2
]
++ lib.optionals enableOCR [
imagemagick_light
tesseract4
];
propagatedBuildInputs = [
coreutils
netpbm
qemu_pkg
socat
vde2
]
++ lib.optionals enableOCR [
imagemagick_light
tesseract4
];
passthru.tests = {
inherit (nixosTests.nixos-test-driver) driver-timeout;

3
nixos/lib/testing/driver.nix
View file

@ -49,7 +49,8 @@ let
# inherit testName; TODO (roberth): need this?
nativeBuildInputs = [
hostPkgs.makeWrapper
] ++ lib.optionals (!config.skipTypeCheck) [ hostPkgs.mypy ];
]
++ lib.optionals (!config.skipTypeCheck) [ hostPkgs.mypy ];
buildInputs = [ testDriver ];
testScript = config.testScriptString;
preferLocalBuild = true;

7
nixos/lib/testing/run.nix
View file

@ -93,8 +93,11 @@ in
{
name = "vm-test-run-${config.name}";
requiredSystemFeatures =
[ "nixos-test" ] ++ lib.optional isLinux "kvm" ++ lib.optional isDarwin "apple-virt";
requiredSystemFeatures = [
"nixos-test"
]
++ lib.optional isLinux "kvm"
++ lib.optional isDarwin "apple-virt";
nativeBuildInputs = lib.optionals config.enableDebugHook [
hostPkgs.openssh

3
nixos/maintainers/scripts/openstack/openstack-image-zfs.nix
View file

@ -40,7 +40,8 @@ in
];
})
] ++ (lib.optional copyChannel ../../../modules/installer/cd-dvd/channel.nix);
]
++ (lib.optional copyChannel ../../../modules/installer/cd-dvd/channel.nix);
options.openstackImage = {
ramMB = mkOption {

3
nixos/maintainers/scripts/openstack/openstack-image.nix
View file

@ -14,7 +14,8 @@ in
imports = [
../../../modules/virtualisation/openstack-config.nix
../../../modules/image/file-options.nix
] ++ (lib.optional copyChannel ../../../modules/installer/cd-dvd/channel.nix);
]
++ (lib.optional copyChannel ../../../modules/installer/cd-dvd/channel.nix);
documentation.enable = copyChannel;

25
nixos/modules/config/console.nix
View file

@ -191,19 +191,18 @@ in
boot.initrd.systemd.additionalUpstreamUnits = [
"systemd-vconsole-setup.service"
];
boot.initrd.systemd.storePaths =
[
"${config.boot.initrd.systemd.package}/lib/systemd/systemd-vconsole-setup"
"${config.boot.initrd.systemd.package.kbd}/bin/setfont"
"${config.boot.initrd.systemd.package.kbd}/bin/loadkeys"
"${config.boot.initrd.systemd.package.kbd.gzip}/bin/gzip" # Fonts and keyboard layouts are compressed
]
++ lib.optionals (cfg.font != null && lib.hasPrefix builtins.storeDir cfg.font) [
"${cfg.font}"
]
++ lib.optionals (lib.hasPrefix builtins.storeDir cfg.keyMap) [
"${cfg.keyMap}"
];
boot.initrd.systemd.storePaths = [
"${config.boot.initrd.systemd.package}/lib/systemd/systemd-vconsole-setup"
"${config.boot.initrd.systemd.package.kbd}/bin/setfont"
"${config.boot.initrd.systemd.package.kbd}/bin/loadkeys"
"${config.boot.initrd.systemd.package.kbd.gzip}/bin/gzip" # Fonts and keyboard layouts are compressed
]
++ lib.optionals (cfg.font != null && lib.hasPrefix builtins.storeDir cfg.font) [
"${cfg.font}"
]
++ lib.optionals (lib.hasPrefix builtins.storeDir cfg.keyMap) [
"${cfg.keyMap}"
];
systemd.additionalUpstreamSystemUnits = [
"systemd-vconsole-setup.service"

75
nixos/modules/config/fonts/fontconfig.nix
View file

@ -258,44 +258,43 @@ let
fontconfigNote = "Consider manually configuring fonts.fontconfig according to personal preference.";
in
{
imports =
[
(lib.mkRenamedOptionModule
[ "fonts" "fontconfig" "ultimate" "allowBitmaps" ]
[ "fonts" "fontconfig" "allowBitmaps" ]
)
(lib.mkRenamedOptionModule
[ "fonts" "fontconfig" "ultimate" "allowType1" ]
[ "fonts" "fontconfig" "allowType1" ]
)
(lib.mkRenamedOptionModule
[ "fonts" "fontconfig" "ultimate" "useEmbeddedBitmaps" ]
[ "fonts" "fontconfig" "useEmbeddedBitmaps" ]
)
(lib.mkRenamedOptionModule
[ "fonts" "fontconfig" "ultimate" "forceAutohint" ]
[ "fonts" "fontconfig" "forceAutohint" ]
)
(lib.mkRenamedOptionModule
[ "fonts" "fontconfig" "ultimate" "renderMonoTTFAsBitmap" ]
[ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ]
)
(lib.mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
(lib.mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
(lib.mkRemovedOptionModule [ "fonts" "fontconfig" "dpi" ] "Use display server-specific options")
(lib.mkRemovedOptionModule [ "hardware" "video" "hidpi" "enable" ] fontconfigNote)
(lib.mkRemovedOptionModule [ "fonts" "optimizeForVeryHighDPI" ] fontconfigNote)
]
++ lib.forEach [ "enable" "substitutions" "preset" ] (
opt:
lib.mkRemovedOptionModule [ "fonts" "fontconfig" "ultimate" "${opt}" ] ''
The fonts.fontconfig.ultimate module and configuration is obsolete.
The repository has since been archived and activity has ceased.
https://github.com/bohoomil/fontconfig-ultimate/issues/171.
No action should be needed for font configuration, as the fonts.fontconfig
module is already used by default.
''
);
imports = [
(lib.mkRenamedOptionModule
[ "fonts" "fontconfig" "ultimate" "allowBitmaps" ]
[ "fonts" "fontconfig" "allowBitmaps" ]
)
(lib.mkRenamedOptionModule
[ "fonts" "fontconfig" "ultimate" "allowType1" ]
[ "fonts" "fontconfig" "allowType1" ]
)
(lib.mkRenamedOptionModule
[ "fonts" "fontconfig" "ultimate" "useEmbeddedBitmaps" ]
[ "fonts" "fontconfig" "useEmbeddedBitmaps" ]
)
(lib.mkRenamedOptionModule
[ "fonts" "fontconfig" "ultimate" "forceAutohint" ]
[ "fonts" "fontconfig" "forceAutohint" ]
)
(lib.mkRenamedOptionModule
[ "fonts" "fontconfig" "ultimate" "renderMonoTTFAsBitmap" ]
[ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ]
)
(lib.mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
(lib.mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
(lib.mkRemovedOptionModule [ "fonts" "fontconfig" "dpi" ] "Use display server-specific options")
(lib.mkRemovedOptionModule [ "hardware" "video" "hidpi" "enable" ] fontconfigNote)
(lib.mkRemovedOptionModule [ "fonts" "optimizeForVeryHighDPI" ] fontconfigNote)
]
++ lib.forEach [ "enable" "substitutions" "preset" ] (
opt:
lib.mkRemovedOptionModule [ "fonts" "fontconfig" "ultimate" "${opt}" ] ''
The fonts.fontconfig.ultimate module and configuration is obsolete.
The repository has since been archived and activity has ceased.
https://github.com/bohoomil/fontconfig-ultimate/issues/171.
No action should be needed for font configuration, as the fonts.fontconfig
module is already used by default.
''
);
options = {

30
nixos/modules/config/i18n.nix
View file

@ -7,20 +7,19 @@
let
sanitizeUTF8Capitalization =
lang: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] lang);
aggregatedLocales =
[
"${config.i18n.defaultLocale}/${config.i18n.defaultCharset}"
]
++ lib.pipe config.i18n.extraLocaleSettings [
# See description of extraLocaleSettings for why is this ignored here.
(lib.filterAttrs (n: v: n != "LANGUAGE"))
(lib.mapAttrs (n: v: (sanitizeUTF8Capitalization v)))
(lib.mapAttrsToList (LCRole: lang: lang + "/" + (config.i18n.localeCharsets.${LCRole} or "UTF-8")))
]
++ (builtins.map sanitizeUTF8Capitalization (
lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales
))
++ (lib.optional (builtins.isString config.i18n.extraLocales) config.i18n.extraLocales);
aggregatedLocales = [
"${config.i18n.defaultLocale}/${config.i18n.defaultCharset}"
]
++ lib.pipe config.i18n.extraLocaleSettings [
# See description of extraLocaleSettings for why is this ignored here.
(lib.filterAttrs (n: v: n != "LANGUAGE"))
(lib.mapAttrs (n: v: (sanitizeUTF8Capitalization v)))
(lib.mapAttrsToList (LCRole: lang: lang + "/" + (config.i18n.localeCharsets.${LCRole} or "UTF-8")))
]
++ (builtins.map sanitizeUTF8Capitalization (
lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales
))
++ (lib.optional (builtins.isString config.i18n.extraLocales) config.i18n.extraLocales);
in
{
###### interface
@ -171,7 +170,8 @@ in
environment.sessionVariables = {
LANG = config.i18n.defaultLocale;
LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
} // config.i18n.extraLocaleSettings;
}
// config.i18n.extraLocaleSettings;
systemd.globalEnvironment = lib.mkIf (config.i18n.supportedLocales != [ ]) {
LOCALE_ARCHIVE = "${config.i18n.glibcLocales}/lib/locale/locale-archive";

15
nixos/modules/config/locale.nix
View file

@ -90,14 +90,13 @@ in
NIXOS_STATIC_TIMEZONE = "1";
};
environment.etc =
{
zoneinfo.source = tzdir;
}
// lib.optionalAttrs (config.time.timeZone != null) {
localtime.source = "/etc/zoneinfo/${config.time.timeZone}";
localtime.mode = "direct-symlink";
};
environment.etc = {
zoneinfo.source = tzdir;
}
// lib.optionalAttrs (config.time.timeZone != null) {
localtime.source = "/etc/zoneinfo/${config.time.timeZone}";
localtime.mode = "direct-symlink";
};
};
}

67
nixos/modules/config/mysql.nix
View file

@ -380,40 +380,39 @@ in
group = "root";
mode = "0600";
# password will be added from password file in systemd oneshot
text =
''
users.host=${cfg.host}
users.db_user=${cfg.user}
users.database=${cfg.database}
users.table=${cfg.pam.table}
users.user_column=${cfg.pam.userColumn}
users.password_column=${cfg.pam.passwordColumn}
users.password_crypt=${cfg.pam.passwordCrypt}
users.disconnect_every_operation=${if cfg.pam.disconnectEveryOperation then "1" else "0"}
verbose=${if cfg.pam.verbose then "1" else "0"}
''
+ lib.optionalString (cfg.pam.cryptDefault != null) ''
users.use_${cfg.pam.cryptDefault}=1
''
+ lib.optionalString (cfg.pam.where != null) ''
users.where_clause=${cfg.pam.where}
''
+ lib.optionalString (cfg.pam.statusColumn != null) ''
users.status_column=${cfg.pam.statusColumn}
''
+ lib.optionalString (cfg.pam.updateTable != null) ''
users.update_table=${cfg.pam.updateTable}
''
+ lib.optionalString cfg.pam.logging.enable ''
log.enabled=true
log.table=${cfg.pam.logging.table}
log.message_column=${cfg.pam.logging.msgColumn}
log.pid_column=${cfg.pam.logging.pidColumn}
log.user_column=${cfg.pam.logging.userColumn}
log.host_column=${cfg.pam.logging.hostColumn}
log.rhost_column=${cfg.pam.logging.rHostColumn}
log.time_column=${cfg.pam.logging.timeColumn}
'';
text = ''
users.host=${cfg.host}
users.db_user=${cfg.user}
users.database=${cfg.database}
users.table=${cfg.pam.table}
users.user_column=${cfg.pam.userColumn}
users.password_column=${cfg.pam.passwordColumn}
users.password_crypt=${cfg.pam.passwordCrypt}
users.disconnect_every_operation=${if cfg.pam.disconnectEveryOperation then "1" else "0"}
verbose=${if cfg.pam.verbose then "1" else "0"}
''
+ lib.optionalString (cfg.pam.cryptDefault != null) ''
users.use_${cfg.pam.cryptDefault}=1
''
+ lib.optionalString (cfg.pam.where != null) ''
users.where_clause=${cfg.pam.where}
''
+ lib.optionalString (cfg.pam.statusColumn != null) ''
users.status_column=${cfg.pam.statusColumn}
''
+ lib.optionalString (cfg.pam.updateTable != null) ''
users.update_table=${cfg.pam.updateTable}
''
+ lib.optionalString cfg.pam.logging.enable ''
log.enabled=true
log.table=${cfg.pam.logging.table}
log.message_column=${cfg.pam.logging.msgColumn}
log.pid_column=${cfg.pam.logging.pidColumn}
log.user_column=${cfg.pam.logging.userColumn}
log.host_column=${cfg.pam.logging.hostColumn}
log.rhost_column=${cfg.pam.logging.rHostColumn}
log.time_column=${cfg.pam.logging.timeColumn}
'';
};
environment.etc."libnss-mysql.cfg" = {

37
nixos/modules/config/networking.nix
View file

@ -206,30 +206,29 @@ in
extraHosts
];
environment.etc =
{
# /etc/services: TCP/UDP port assignments.
services.source = pkgs.iana-etc + "/etc/services";
environment.etc = {
# /etc/services: TCP/UDP port assignments.
services.source = pkgs.iana-etc + "/etc/services";
# /etc/protocols: IP protocol numbers.
protocols.source = pkgs.iana-etc + "/etc/protocols";
# /etc/protocols: IP protocol numbers.
protocols.source = pkgs.iana-etc + "/etc/protocols";
# /etc/hosts: Hostname-to-IP mappings.
hosts.source = pkgs.concatText "hosts" cfg.hostFiles;
# /etc/hosts: Hostname-to-IP mappings.
hosts.source = pkgs.concatText "hosts" cfg.hostFiles;
# /etc/netgroup: Network-wide groups.
netgroup.text = lib.mkDefault "";
# /etc/netgroup: Network-wide groups.
netgroup.text = lib.mkDefault "";
# /etc/host.conf: resolver configuration file
"host.conf".text = ''
multi on
'';
# /etc/host.conf: resolver configuration file
"host.conf".text = ''
multi on
'';
}
// lib.optionalAttrs (pkgs.stdenv.hostPlatform.libc == "glibc") {
# /etc/rpc: RPC program numbers.
rpc.source = pkgs.stdenv.cc.libc.out + "/etc/rpc";
};
}
// lib.optionalAttrs (pkgs.stdenv.hostPlatform.libc == "glibc") {
# /etc/rpc: RPC program numbers.
rpc.source = pkgs.stdenv.cc.libc.out + "/etc/rpc";
};
networking.proxy.envVars =
lib.optionalAttrs (cfg.proxy.default != null) {

15
nixos/modules/config/nix-remote-build.nix
View file

@ -235,14 +235,13 @@ in
[
{
assertion = !(any badMachine cfg.buildMachines);
message =
''
At least one system type (via <varname>system</varname> or
<varname>systems</varname>) must be set for every build machine.
Invalid machine specifications:
''
+ " "
+ (concatStringsSep "\n " (map (m: m.hostName) (filter (badMachine) cfg.buildMachines)));
message = ''
At least one system type (via <varname>system</varname> or
<varname>systems</varname>) must be set for every build machine.
Invalid machine specifications:
''
+ " "
+ (concatStringsSep "\n " (map (m: m.hostName) (filter (badMachine) cfg.buildMachines)));
}
];

106
nixos/modules/config/nix.nix
View file

@ -50,20 +50,19 @@ let
isNixAtLeast = versionAtLeast (getVersion nixPackage);
defaultSystemFeatures =
[
"nixos-test"
"benchmark"
"big-parallel"
"kvm"
]
++ optionals (pkgs.stdenv.hostPlatform ? gcc.arch) (
# a builder can run code for `gcc.arch` and inferior architectures
[ "gccarch-${pkgs.stdenv.hostPlatform.gcc.arch}" ]
++ map (x: "gccarch-${x}") (
systems.architectures.inferiors.${pkgs.stdenv.hostPlatform.gcc.arch} or [ ]
)
);
defaultSystemFeatures = [
"nixos-test"
"benchmark"
"big-parallel"
"kvm"
]
++ optionals (pkgs.stdenv.hostPlatform ? gcc.arch) (
# a builder can run code for `gcc.arch` and inferior architectures
[ "gccarch-${pkgs.stdenv.hostPlatform.gcc.arch}" ]
++ map (x: "gccarch-${x}") (
systems.architectures.inferiors.${pkgs.stdenv.hostPlatform.gcc.arch} or [ ]
)
);
legacyConfMappings = {
useSandbox = "sandbox";
@ -170,46 +169,45 @@ let
in
{
imports =
[
(mkRenamedOptionModuleWith {
sinceRelease = 2003;
from = [
"nix"
"useChroot"
];
to = [
"nix"
"useSandbox"
];
})
(mkRenamedOptionModuleWith {
sinceRelease = 2003;
from = [
"nix"
"chrootDirs"
];
to = [
"nix"
"sandboxPaths"
];
})
]
++ mapAttrsToList (
oldConf: newConf:
mkRenamedOptionModuleWith {
sinceRelease = 2205;
from = [
"nix"
oldConf
];
to = [
"nix"
"settings"
newConf
];
}
) legacyConfMappings;
imports = [
(mkRenamedOptionModuleWith {
sinceRelease = 2003;
from = [
"nix"
"useChroot"
];
to = [
"nix"
"useSandbox"
];
})
(mkRenamedOptionModuleWith {
sinceRelease = 2003;
from = [
"nix"
"chrootDirs"
];
to = [
"nix"
"sandboxPaths"
];
})
]
++ mapAttrsToList (
oldConf: newConf:
mkRenamedOptionModuleWith {
sinceRelease = 2205;
from = [
"nix"
oldConf
];
to = [
"nix"
"settings"
newConf
];
}
) legacyConfMappings;
options = {
nix = {

41
nixos/modules/config/resolvconf.nix
View file

@ -15,27 +15,26 @@ let
++ lib.optional cfg.dnsExtensionMechanism "edns0"
++ lib.optional cfg.useLocalResolver "trust-ad";
configText =
''
# This is the default, but we must set it here to prevent
# a collision with an apparently unrelated environment
# variable with the same name exported by dhcpcd.
interface_order='lo lo[0-9]*'
''
+ lib.optionalString config.services.nscd.enable ''
# Invalidate the nscd cache whenever resolv.conf is
# regenerated.
libc_restart='/run/current-system/systemd/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
''
+ lib.optionalString (lib.length resolvconfOptions > 0) ''
# Options as described in resolv.conf(5)
resolv_conf_options='${lib.concatStringsSep " " resolvconfOptions}'
''
+ lib.optionalString cfg.useLocalResolver ''
# This hosts runs a full-blown DNS resolver.
name_servers='127.0.0.1${lib.optionalString config.networking.enableIPv6 " ::1"}'
''
+ cfg.extraConfig;
configText = ''
# This is the default, but we must set it here to prevent
# a collision with an apparently unrelated environment
# variable with the same name exported by dhcpcd.
interface_order='lo lo[0-9]*'
''
+ lib.optionalString config.services.nscd.enable ''
# Invalidate the nscd cache whenever resolv.conf is
# regenerated.
libc_restart='/run/current-system/systemd/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
''
+ lib.optionalString (lib.length resolvconfOptions > 0) ''
# Options as described in resolv.conf(5)
resolv_conf_options='${lib.concatStringsSep " " resolvconfOptions}'
''
+ lib.optionalString cfg.useLocalResolver ''
# This hosts runs a full-blown DNS resolver.
name_servers='127.0.0.1${lib.optionalString config.networking.enableIPv6 " ::1"}'
''
+ cfg.extraConfig;
in

3
nixos/modules/config/swap.nix
View file

@ -286,7 +286,8 @@ in
path = [
pkgs.util-linux
pkgs.e2fsprogs
] ++ lib.optional sw.randomEncryption.enable pkgs.cryptsetup;
]
++ lib.optional sw.randomEncryption.enable pkgs.cryptsetup;
environment.DEVICE = sw.device;

320
nixos/modules/config/users-groups.nix
View file

@ -1036,176 +1036,174 @@ in
};
};
assertions =
[
{
assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique);
message = "UIDs and GIDs must be unique!";
}
{
assertion = !cfg.enforceIdUniqueness || (sdInitrdUidsAreUnique && sdInitrdGidsAreUnique);
message = "systemd initrd UIDs and GIDs must be unique!";
}
{
assertion = usersWithoutExistingGroup == { };
message =
let
errUsers = lib.attrNames usersWithoutExistingGroup;
missingGroups = lib.unique (lib.mapAttrsToList (n: u: u.group) usersWithoutExistingGroup);
mkConfigHint = group: "users.groups.${group} = {};";
in
''
The following users have a primary group that is undefined: ${lib.concatStringsSep " " errUsers}
Hint: Add this to your NixOS configuration:
${lib.concatStringsSep "\n " (map mkConfigHint missingGroups)}
'';
}
{
assertion = !cfg.mutableUsers -> length usersWithNullShells == 0;
message = ''
users.mutableUsers = false has been set,
but found users that have their shell set to null.
If you wish to disable login, set their shell to pkgs.shadow (the default).
Misconfigured users: ${lib.concatStringsSep " " usersWithNullShells}
assertions = [
{
assertion = !cfg.enforceIdUniqueness || (uidsAreUnique && gidsAreUnique);
message = "UIDs and GIDs must be unique!";
}
{
assertion = !cfg.enforceIdUniqueness || (sdInitrdUidsAreUnique && sdInitrdGidsAreUnique);
message = "systemd initrd UIDs and GIDs must be unique!";
}
{
assertion = usersWithoutExistingGroup == { };
message =
let
errUsers = lib.attrNames usersWithoutExistingGroup;
missingGroups = lib.unique (lib.mapAttrsToList (n: u: u.group) usersWithoutExistingGroup);
mkConfigHint = group: "users.groups.${group} = {};";
in
''
The following users have a primary group that is undefined: ${lib.concatStringsSep " " errUsers}
Hint: Add this to your NixOS configuration:
${lib.concatStringsSep "\n " (map mkConfigHint missingGroups)}
'';
}
{
# If mutableUsers is false, to prevent users creating a
# configuration that locks them out of the system, ensure that
# there is at least one "privileged" account that has a
# password or an SSH authorized key. Privileged accounts are
# root and users in the wheel group.
# The check does not apply when users.allowNoPasswordLogin
# The check does not apply when users.mutableUsers
assertion =
!cfg.mutableUsers
-> !cfg.allowNoPasswordLogin
-> any id (
mapAttrsToList (
name: cfg:
(name == "root" || cfg.group == "wheel" || elem "wheel" cfg.extraGroups)
&& (
allowsLogin cfg.hashedPassword
|| cfg.password != null
|| cfg.hashedPasswordFile != null
|| cfg.openssh.authorizedKeys.keys != [ ]
|| cfg.openssh.authorizedKeys.keyFiles != [ ]
)
) cfg.users
++ [
config.security.googleOsLogin.enable
]
);
message = ''
Neither the root account nor any wheel user has a password or SSH authorized key.
You must set one to prevent being locked out of your system.
If you really want to be locked out of your system, set users.allowNoPasswordLogin = true;
However you are most probably better off by setting users.mutableUsers = true; and
manually running passwd root to set the root password.
'';
}
]
++ flatten (
flip mapAttrsToList cfg.users (
name: user:
[
(
let
# Things fail in various ways with especially non-ascii usernames.
# This regex mirrors the one from shadow's is_valid_name:
# https://github.com/shadow-maint/shadow/blob/bee77ffc291dfed2a133496db465eaa55e2b0fec/lib/chkname.c#L68
# though without the trailing $, because Samba 3 got its last release
# over 10 years ago and is not in Nixpkgs anymore,
# while later versions don't appear to require anything like that.
nameRegex = "[a-zA-Z0-9_.][a-zA-Z0-9_.-]*";
in
{
assertion = builtins.match nameRegex user.name != null;
message = "The username \"${user.name}\" is not valid, it does not match the regex \"${nameRegex}\".";
}
)
{
assertion = (user.hashedPassword != null) -> (match ".*:.*" user.hashedPassword == null);
message = ''
The password hash of user "${user.name}" contains a ":" character.
This is invalid and would break the login system because the fields
of /etc/shadow (file where hashes are stored) are colon-separated.
Please check the value of option `users.users."${user.name}".hashedPassword`.'';
}
{
assertion = user.isNormalUser && user.uid != null -> user.uid >= 1000;
message = ''
A user cannot have a users.users.${user.name}.uid set below 1000 and set users.users.${user.name}.isNormalUser.
Either users.users.${user.name}.isSystemUser must be set to true instead of users.users.${user.name}.isNormalUser
or users.users.${user.name}.uid must be changed to 1000 or above.
'';
}
{
assertion =
let
# we do an extra check on isNormalUser here, to not trigger this assertion when isNormalUser is set and uid to < 1000
isEffectivelySystemUser =
user.isSystemUser || (user.uid != null && user.uid < 1000 && !user.isNormalUser);
in
xor isEffectivelySystemUser user.isNormalUser;
message = ''
Exactly one of users.users.${user.name}.isSystemUser and users.users.${user.name}.isNormalUser must be set.
'';
}
{
assertion = user.group != "";
message = ''
users.users.${user.name}.group is unset. This used to default to
nogroup, but this is unsafe. For example you can create a group
for this user with:
users.users.${user.name}.group = "${user.name}";
users.groups.${user.name} = {};
'';
}
]
++ (map
(shell: {
assertion =
!user.ignoreShellProgramCheck
-> (user.shell == pkgs.${shell})
-> (config.programs.${shell}.enable == true);
message = ''
users.users.${user.name}.shell is set to ${shell}, but
programs.${shell}.enable is not true. This will cause the ${shell}
shell to lack the basic nix directories in its PATH and might make
logging in as that user impossible. You can fix it with:
programs.${shell}.enable = true;
If you know what you're doing and you are fine with the behavior,
set users.users.${user.name}.ignoreShellProgramCheck = true;
instead.
'';
})
[
"fish"
"xonsh"
"zsh"
}
{
assertion = !cfg.mutableUsers -> length usersWithNullShells == 0;
message = ''
users.mutableUsers = false has been set,
but found users that have their shell set to null.
If you wish to disable login, set their shell to pkgs.shadow (the default).
Misconfigured users: ${lib.concatStringsSep " " usersWithNullShells}
'';
}
{
# If mutableUsers is false, to prevent users creating a
# configuration that locks them out of the system, ensure that
# there is at least one "privileged" account that has a
# password or an SSH authorized key. Privileged accounts are
# root and users in the wheel group.
# The check does not apply when users.allowNoPasswordLogin
# The check does not apply when users.mutableUsers
assertion =
!cfg.mutableUsers
-> !cfg.allowNoPasswordLogin
-> any id (
mapAttrsToList (
name: cfg:
(name == "root" || cfg.group == "wheel" || elem "wheel" cfg.extraGroups)
&& (
allowsLogin cfg.hashedPassword
|| cfg.password != null
|| cfg.hashedPasswordFile != null
|| cfg.openssh.authorizedKeys.keys != [ ]
|| cfg.openssh.authorizedKeys.keyFiles != [ ]
)
) cfg.users
++ [
config.security.googleOsLogin.enable
]
);
message = ''
Neither the root account nor any wheel user has a password or SSH authorized key.
You must set one to prevent being locked out of your system.
If you really want to be locked out of your system, set users.allowNoPasswordLogin = true;
However you are most probably better off by setting users.mutableUsers = true; and
manually running passwd root to set the root password.
'';
}
]
++ flatten (
flip mapAttrsToList cfg.users (
name: user:
[
(
let
# Things fail in various ways with especially non-ascii usernames.
# This regex mirrors the one from shadow's is_valid_name:
# https://github.com/shadow-maint/shadow/blob/bee77ffc291dfed2a133496db465eaa55e2b0fec/lib/chkname.c#L68
# though without the trailing $, because Samba 3 got its last release
# over 10 years ago and is not in Nixpkgs anymore,
# while later versions don't appear to require anything like that.
nameRegex = "[a-zA-Z0-9_.][a-zA-Z0-9_.-]*";
in
{
assertion = builtins.match nameRegex user.name != null;
message = "The username \"${user.name}\" is not valid, it does not match the regex \"${nameRegex}\".";
}
)
{
assertion = (user.hashedPassword != null) -> (match ".*:.*" user.hashedPassword == null);
message = ''
The password hash of user "${user.name}" contains a ":" character.
This is invalid and would break the login system because the fields
of /etc/shadow (file where hashes are stored) are colon-separated.
Please check the value of option `users.users."${user.name}".hashedPassword`.'';
}
{
assertion = user.isNormalUser && user.uid != null -> user.uid >= 1000;
message = ''
A user cannot have a users.users.${user.name}.uid set below 1000 and set users.users.${user.name}.isNormalUser.
Either users.users.${user.name}.isSystemUser must be set to true instead of users.users.${user.name}.isNormalUser
or users.users.${user.name}.uid must be changed to 1000 or above.
'';
}
{
assertion =
let
# we do an extra check on isNormalUser here, to not trigger this assertion when isNormalUser is set and uid to < 1000
isEffectivelySystemUser =
user.isSystemUser || (user.uid != null && user.uid < 1000 && !user.isNormalUser);
in
xor isEffectivelySystemUser user.isNormalUser;
message = ''
Exactly one of users.users.${user.name}.isSystemUser and users.users.${user.name}.isNormalUser must be set.
'';
}
{
assertion = user.group != "";
message = ''
users.users.${user.name}.group is unset. This used to default to
nogroup, but this is unsafe. For example you can create a group
for this user with:
users.users.${user.name}.group = "${user.name}";
users.groups.${user.name} = {};
'';
}
]
++ (map
(shell: {
assertion =
!user.ignoreShellProgramCheck
-> (user.shell == pkgs.${shell})
-> (config.programs.${shell}.enable == true);
message = ''
users.users.${user.name}.shell is set to ${shell}, but
programs.${shell}.enable is not true. This will cause the ${shell}
shell to lack the basic nix directories in its PATH and might make
logging in as that user impossible. You can fix it with:
programs.${shell}.enable = true;
If you know what you're doing and you are fine with the behavior,
set users.users.${user.name}.ignoreShellProgramCheck = true;
instead.
'';
})
[
"fish"
"xonsh"
"zsh"
]
)
);
)
);
warnings =
flip concatMap (attrValues cfg.users) (
user:
let
passwordOptions =
[
"hashedPassword"
"hashedPasswordFile"
"password"
]
++ optionals cfg.mutableUsers [
# For immutable users, initialHashedPassword is set to hashedPassword,
# so using these options would always trigger the assertion.
"initialHashedPassword"
"initialPassword"
];
passwordOptions = [
"hashedPassword"
"hashedPasswordFile"
"password"
]
++ optionals cfg.mutableUsers [
# For immutable users, initialHashedPassword is set to hashedPassword,
# so using these options would always trigger the assertion.
"initialHashedPassword"
"initialPassword"
];
unambiguousPasswordConfiguration =
1 >= length (filter (x: x != null) (map (flip getAttr user) passwordOptions));
in

31
nixos/modules/config/xdg/icons.nix
View file

@ -34,22 +34,21 @@
"/share/pixmaps"
];
environment.systemPackages =
[
# Empty icon theme that contains index.theme file describing directories
# where toolkits should look for icons installed by apps.
pkgs.hicolor-icon-theme
]
++ lib.optionals (config.xdg.icons.fallbackCursorThemes != [ ]) [
(pkgs.writeTextFile {
name = "fallback-cursor-theme";
text = ''
[Icon Theme]
Inherits=${lib.concatStringsSep "," config.xdg.icons.fallbackCursorThemes}
'';
destination = "/share/icons/default/index.theme";
})
];
environment.systemPackages = [
# Empty icon theme that contains index.theme file describing directories
# where toolkits should look for icons installed by apps.
pkgs.hicolor-icon-theme
]
++ lib.optionals (config.xdg.icons.fallbackCursorThemes != [ ]) [
(pkgs.writeTextFile {
name = "fallback-cursor-theme";
text = ''
[Icon Theme]
Inherits=${lib.concatStringsSep "," config.xdg.icons.fallbackCursorThemes}
'';
destination = "/share/icons/default/index.theme";
})
];
# libXcursor looks for cursors in XCURSOR_PATH
# it mostly follows the spec for icons

245
nixos/modules/hardware/all-hardware.nix
View file

@ -22,151 +22,150 @@ in
# The initrd has to contain any module that might be necessary for
# supporting the most important parts of HW like drives.
boot.initrd.availableKernelModules =
[
# SATA/PATA support.
"ahci"
boot.initrd.availableKernelModules = [
# SATA/PATA support.
"ahci"
"ata_piix"
"ata_piix"
"sata_inic162x"
"sata_nv"
"sata_promise"
"sata_qstor"
"sata_sil"
"sata_sil24"
"sata_sis"
"sata_svw"
"sata_sx4"
"sata_uli"
"sata_via"
"sata_vsc"
"sata_inic162x"
"sata_nv"
"sata_promise"
"sata_qstor"
"sata_sil"
"sata_sil24"
"sata_sis"
"sata_svw"
"sata_sx4"
"sata_uli"
"sata_via"
"sata_vsc"
"pata_ali"
"pata_amd"
"pata_artop"
"pata_atiixp"
"pata_efar"
"pata_hpt366"
"pata_hpt37x"
"pata_hpt3x2n"
"pata_hpt3x3"
"pata_it8213"
"pata_it821x"
"pata_jmicron"
"pata_marvell"
"pata_mpiix"
"pata_netcell"
"pata_ns87410"
"pata_oldpiix"
"pata_pcmcia"
"pata_pdc2027x"
"pata_qdi"
"pata_rz1000"
"pata_serverworks"
"pata_sil680"
"pata_sis"
"pata_sl82c105"
"pata_triflex"
"pata_via"
"pata_winbond"
"pata_ali"
"pata_amd"
"pata_artop"
"pata_atiixp"
"pata_efar"
"pata_hpt366"
"pata_hpt37x"
"pata_hpt3x2n"
"pata_hpt3x3"
"pata_it8213"
"pata_it821x"
"pata_jmicron"
"pata_marvell"
"pata_mpiix"
"pata_netcell"
"pata_ns87410"
"pata_oldpiix"
"pata_pcmcia"
"pata_pdc2027x"
"pata_qdi"
"pata_rz1000"
"pata_serverworks"
"pata_sil680"
"pata_sis"
"pata_sl82c105"
"pata_triflex"
"pata_via"
"pata_winbond"
# SCSI support (incomplete).
"3w-9xxx"
"3w-xxxx"
"aic79xx"
"aic7xxx"
"arcmsr"
"hpsa"
# SCSI support (incomplete).
"3w-9xxx"
"3w-xxxx"
"aic79xx"
"aic7xxx"
"arcmsr"
"hpsa"
# USB support, especially for booting from USB CD-ROM
# drives.
"uas"
# USB support, especially for booting from USB CD-ROM
# drives.
"uas"
# SD cards.
"sdhci_pci"
# SD cards.
"sdhci_pci"
# NVMe drives
"nvme"
# NVMe drives
"nvme"
# Firewire support. Not tested.
"ohci1394"
"sbp2"
# Firewire support. Not tested.
"ohci1394"
"sbp2"
# Virtio (QEMU, KVM etc.) support.
"virtio_net"
"virtio_pci"
"virtio_mmio"
"virtio_blk"
"virtio_scsi"
"virtio_balloon"
"virtio_console"
# Virtio (QEMU, KVM etc.) support.
"virtio_net"
"virtio_pci"
"virtio_mmio"
"virtio_blk"
"virtio_scsi"
"virtio_balloon"
"virtio_console"
# VMware support.
"mptspi"
"vmxnet3"
"vsock"
]
++ lib.optional platform.isx86 "vmw_balloon"
++ lib.optionals (pkgs.stdenv.hostPlatform.isi686 || pkgs.stdenv.hostPlatform.isx86_64) [
"vmw_vmci"
"vmwgfx"
"vmw_vsock_vmci_transport"
# VMware support.
"mptspi"
"vmxnet3"
"vsock"
]
++ lib.optional platform.isx86 "vmw_balloon"
++ lib.optionals (pkgs.stdenv.hostPlatform.isi686 || pkgs.stdenv.hostPlatform.isx86_64) [
"vmw_vmci"
"vmwgfx"
"vmw_vsock_vmci_transport"
# Hyper-V support.
"hv_storvsc"
]
++ lib.optionals pkgs.stdenv.hostPlatform.isAarch [
# Allwinner support
# Required for early KMS
"sun4i-drm"
"sun8i-mixer" # Audio, but required for kms
# Hyper-V support.
"hv_storvsc"
]
++ lib.optionals pkgs.stdenv.hostPlatform.isAarch [
# Allwinner support
# Required for early KMS
"sun4i-drm"
"sun8i-mixer" # Audio, but required for kms
# PWM for the backlight
"pwm-sun4i"
# PWM for the backlight
"pwm-sun4i"
# Broadcom
"vc4"
]
++ lib.optionals pkgs.stdenv.hostPlatform.isAarch64 [
# Most of the following falls into two categories:
# - early KMS / early display
# - early storage (e.g. USB) support
# Broadcom
"vc4"
]
++ lib.optionals pkgs.stdenv.hostPlatform.isAarch64 [
# Most of the following falls into two categories:
# - early KMS / early display
# - early storage (e.g. USB) support
# Broadcom
# Broadcom
"pcie-brcmstb"
"pcie-brcmstb"
# Rockchip
"dw-hdmi"
"dw-mipi-dsi"
"rockchipdrm"
"rockchip-rga"
"phy-rockchip-pcie"
"pcie-rockchip-host"
# Rockchip
"dw-hdmi"
"dw-mipi-dsi"
"rockchipdrm"
"rockchip-rga"
"phy-rockchip-pcie"
"pcie-rockchip-host"
# Misc. uncategorized hardware
# Misc. uncategorized hardware
# Used for some platform's integrated displays
"panel-simple"
"pwm-bl"
# Used for some platform's integrated displays
"panel-simple"
"pwm-bl"
# Power supply drivers, some platforms need them for USB
"axp20x-ac-power"
"axp20x-battery"
"pinctrl-axp209"
"mp8859"
# Power supply drivers, some platforms need them for USB
"axp20x-ac-power"
"axp20x-battery"
"pinctrl-axp209"
"mp8859"
# USB drivers
"xhci-pci-renesas"
# USB drivers
"xhci-pci-renesas"
# Reset controllers
"reset-raspberrypi" # Triggers USB chip firmware load.
# Reset controllers
"reset-raspberrypi" # Triggers USB chip firmware load.
# Misc "weak" dependencies
"analogix-dp"
"analogix-anx6345" # For DP or eDP (e.g. integrated display)
];
# Misc "weak" dependencies
"analogix-dp"
"analogix-anx6345" # For DP or eDP (e.g. integrated display)
];
# Include lots of firmware.
hardware.enableRedistributableFirmware = true;

3
nixos/modules/hardware/device-tree.nix
View file

@ -93,7 +93,8 @@ let
let
includePaths = [
"${lib.getDev cfg.kernelPackage}/lib/modules/${cfg.kernelPackage.modDirVersion}/source/scripts/dtc/include-prefixes"
] ++ cfg.dtboBuildExtraIncludePaths;
]
++ cfg.dtboBuildExtraIncludePaths;
extraPreprocessorFlags = cfg.dtboBuildExtraPreprocessorFlags;
in
if o.dtboFile == null then

47
nixos/modules/hardware/infiniband.nix
View file

@ -7,31 +7,30 @@
let
cfg = config.hardware.infiniband;
opensm-services =
{
"opensm@" = {
enable = true;
description = "Starts OpenSM Infiniband fabric Subnet Managers";
before = [ "network.target" ];
unitConfig = {
ConditionPathExists = "/sys/class/infiniband_mad/abi_version";
};
serviceConfig = {
Type = "simple";
ExecStart = "${pkgs.opensm}/bin/opensm --guid %I --log_file /var/log/opensm.%I.log";
};
opensm-services = {
"opensm@" = {
enable = true;
description = "Starts OpenSM Infiniband fabric Subnet Managers";
before = [ "network.target" ];
unitConfig = {
ConditionPathExists = "/sys/class/infiniband_mad/abi_version";
};
}
// (builtins.listToAttrs (
map (guid: {
name = "opensm@${guid}";
value = {
enable = true;
wantedBy = [ "machines.target" ];
overrideStrategy = "asDropin";
};
}) cfg.guids
));
serviceConfig = {
Type = "simple";
ExecStart = "${pkgs.opensm}/bin/opensm --guid %I --log_file /var/log/opensm.%I.log";
};
};
}
// (builtins.listToAttrs (
map (guid: {
name = "opensm@${guid}";
value = {
enable = true;
wantedBy = [ "machines.target" ];
overrideStrategy = "asDropin";
};
}) cfg.guids
));
in

13
nixos/modules/hardware/ksm.nix
View file

@ -24,13 +24,12 @@ in
systemd.services.enable-ksm = {
description = "Enable Kernel Same-Page Merging";
wantedBy = [ "multi-user.target" ];
script =
''
echo 1 > /sys/kernel/mm/ksm/run
''
+ lib.optionalString (cfg.sleep != null) ''
echo ${toString cfg.sleep} > /sys/kernel/mm/ksm/sleep_millisecs
'';
script = ''
echo 1 > /sys/kernel/mm/ksm/run
''
+ lib.optionalString (cfg.sleep != null) ''
echo ${toString cfg.sleep} > /sys/kernel/mm/ksm/sleep_millisecs
'';
};
};
}

15
nixos/modules/hardware/logitech.nix
View file

@ -80,14 +80,13 @@ in
++ lib.optional cfg.wireless.enable pkgs.logitech-udev-rules
++ lib.optional cfg.lcd.enable pkgs.g15daemon;
extraRules =
''
# nixos: hardware.logitech.lcd
''
+ lib.concatMapStringsSep "\n" (
dev:
''ACTION=="add", SUBSYSTEMS=="usb", ATTRS{idVendor}=="${vendor}", ATTRS{idProduct}=="${dev}", TAG+="systemd", ENV{SYSTEMD_WANTS}+="${daemon}.service"''
) cfg.lcd.devices;
extraRules = ''
# nixos: hardware.logitech.lcd
''
+ lib.concatMapStringsSep "\n" (
dev:
''ACTION=="add", SUBSYSTEMS=="usb", ATTRS{idVendor}=="${vendor}", ATTRS{idProduct}=="${dev}", TAG+="systemd", ENV{SYSTEMD_WANTS}+="${daemon}.service"''
) cfg.lcd.devices;
};
systemd.services."${daemon}" = lib.mkIf cfg.lcd.enable {

13
nixos/modules/hardware/nfc-nci.nix
View file

@ -154,13 +154,12 @@ in
};
config = lib.mkIf cfg.enable {
environment.systemPackages =
[
pkgs.libnfc-nci
]
++ lib.optionals cfg.enableIFD [
pkgs.ifdnfc-nci
];
environment.systemPackages = [
pkgs.libnfc-nci
]
++ lib.optionals cfg.enableIFD [
pkgs.ifdnfc-nci
];
environment.etc = {
"libnfc-nci.conf".text = generateSettings "nci";

3
nixos/modules/hardware/system-76.nix
View file

@ -24,7 +24,8 @@ let
modules = [
"system76"
"system76-io"
] ++ (optional (versionOlder kpkgs.kernel.version "5.5") "system76-acpi");
]
++ (optional (versionOlder kpkgs.kernel.version "5.5") "system76-acpi");
modulePackages = map (m: kpkgs.${m}) modules;
moduleConfig = mkIf cfg.kernel-modules.enable {
boot.extraModulePackages = modulePackages;

3
nixos/modules/hardware/video/bumblebee.nix
View file

@ -93,8 +93,7 @@ in
];
boot.kernelModules = lib.optional useBbswitch "bbswitch";
boot.extraModulePackages =
lib.optional useBbswitch kernel.bbswitch
++ lib.optional useNvidia kernel.nvidia_x11.bin;
lib.optional useBbswitch kernel.bbswitch ++ lib.optional useNvidia kernel.nvidia_x11.bin;
environment.systemPackages = [
bumblebee

75
nixos/modules/hardware/video/nvidia.nix
View file

@ -488,40 +488,37 @@ in
name = igpuDriver;
display = offloadCfg.enable;
modules = lib.optional (igpuDriver == "amdgpu") pkgs.xorg.xf86videoamdgpu;
deviceSection =
''
BusID "${igpuBusId}"
''
+ lib.optionalString (syncCfg.enable && igpuDriver != "amdgpu") ''
Option "AccelMethod" "none"
'';
deviceSection = ''
BusID "${igpuBusId}"
''
+ lib.optionalString (syncCfg.enable && igpuDriver != "amdgpu") ''
Option "AccelMethod" "none"
'';
}
++ lib.singleton {
name = "nvidia";
modules = [ nvidia_x11.bin ];
display = !offloadCfg.enable;
deviceSection =
''
Option "SidebandSocketPath" "/run/nvidia-xdriver/"
''
+ lib.optionalString primeEnabled ''
BusID "${pCfg.nvidiaBusId}"
''
+ lib.optionalString pCfg.allowExternalGpu ''
Option "AllowExternalGpus"
'';
screenSection =
''
Option "RandRRotation" "on"
''
+ lib.optionalString syncCfg.enable ''
Option "AllowEmptyInitialConfiguration"
''
+ lib.optionalString cfg.forceFullCompositionPipeline ''
Option "metamodes" "nvidia-auto-select +0+0 {ForceFullCompositionPipeline=On}"
Option "AllowIndirectGLXProtocol" "off"
Option "TripleBuffer" "on"
'';
deviceSection = ''
Option "SidebandSocketPath" "/run/nvidia-xdriver/"
''
+ lib.optionalString primeEnabled ''
BusID "${pCfg.nvidiaBusId}"
''
+ lib.optionalString pCfg.allowExternalGpu ''
Option "AllowExternalGpus"
'';
screenSection = ''
Option "RandRRotation" "on"
''
+ lib.optionalString syncCfg.enable ''
Option "AllowEmptyInitialConfiguration"
''
+ lib.optionalString cfg.forceFullCompositionPipeline ''
Option "metamodes" "nvidia-auto-select +0+0 {ForceFullCompositionPipeline=On}"
Option "AllowIndirectGLXProtocol" "off"
Option "TripleBuffer" "on"
'';
};
services.xserver.serverLayoutSection =
@ -644,16 +641,16 @@ in
hardware.firmware = lib.optional cfg.gsp.enable nvidia_x11.firmware;
systemd.tmpfiles.rules =
[
# Remove the following log message:
# (WW) NVIDIA: Failed to bind sideband socket to
# (WW) NVIDIA: '/var/run/nvidia-xdriver-b4f69129' Permission denied
#
# https://bbs.archlinux.org/viewtopic.php?pid=1909115#p1909115
"d /run/nvidia-xdriver 0770 root users"
]
++ lib.optional (nvidia_x11.persistenced != null && config.virtualisation.docker.enableNvidia)
systemd.tmpfiles.rules = [
# Remove the following log message:
# (WW) NVIDIA: Failed to bind sideband socket to
# (WW) NVIDIA: '/var/run/nvidia-xdriver-b4f69129' Permission denied
#
# https://bbs.archlinux.org/viewtopic.php?pid=1909115#p1909115
"d /run/nvidia-xdriver 0770 root users"
]
++
lib.optional (nvidia_x11.persistenced != null && config.virtualisation.docker.enableNvidia)
"L+ /run/nvidia-docker/extras/bin/nvidia-persistenced - - - - ${nvidia_x11.persistenced}/origBin/nvidia-persistenced";
boot = {

3
nixos/modules/hardware/video/webcam/facetimehd.nix
View file

@ -38,7 +38,8 @@ in
hardware.firmware = [
pkgs.facetimehd-firmware
] ++ lib.optional cfg.withCalibration pkgs.facetimehd-calibration;
]
++ lib.optional cfg.withCalibration pkgs.facetimehd-calibration;
# unload module during suspend/hibernate as it crashes the whole system
powerManagement.powerDownCommands = ''

11
nixos/modules/i18n/input-method/default.nix
View file

@ -104,12 +104,11 @@ in
warnings =
lib.optional (cfg.enabled != null)
"i18n.inputMethod.enabled will be removed in a future release. Please use .type, and .enable = true instead";
environment.systemPackages =
[
cfg.package
]
++ lib.optional cfg.enableGtk2 gtk2_cache
++ lib.optional cfg.enableGtk3 gtk3_cache;
environment.systemPackages = [
cfg.package
]
++ lib.optional cfg.enableGtk2 gtk2_cache
++ lib.optional cfg.enableGtk3 gtk3_cache;
};
meta = {

17
nixos/modules/i18n/input-method/fcitx5.nix
View file

@ -147,15 +147,14 @@ in
) cfg.settings.addons)
];
environment.variables =
{
XMODIFIERS = "@im=fcitx";
QT_PLUGIN_PATH = [ "${fcitx5Package}/${pkgs.qt6.qtbase.qtPluginPrefix}" ];
}
// lib.optionalAttrs (!cfg.waylandFrontend) {
GTK_IM_MODULE = "fcitx";
QT_IM_MODULE = "fcitx";
};
environment.variables = {
XMODIFIERS = "@im=fcitx";
QT_PLUGIN_PATH = [ "${fcitx5Package}/${pkgs.qt6.qtbase.qtPluginPrefix}" ];
}
// lib.optionalAttrs (!cfg.waylandFrontend) {
GTK_IM_MODULE = "fcitx";
QT_IM_MODULE = "fcitx";
};
environment.sessionVariables = lib.mkIf cfg.ignoreUserConfig {
SKIP_FCITX_USER_PATH = "1";

15
nixos/modules/i18n/input-method/kime.nix
View file

@ -69,14 +69,13 @@ in
XMODIFIERS = "@im=kime";
};
environment.etc."xdg/kime/config.yaml".text =
''
daemon:
modules: [${lib.concatStringsSep "," imcfg.kime.daemonModules}]
indicator:
icon_color: ${imcfg.kime.iconColor}
''
+ imcfg.kime.extraConfig;
environment.etc."xdg/kime/config.yaml".text = ''
daemon:
modules: [${lib.concatStringsSep "," imcfg.kime.daemonModules}]
indicator:
icon_color: ${imcfg.kime.iconColor}
''
+ imcfg.kime.extraConfig;
};
# uses attributes of the linked package

91
nixos/modules/image/repart-image.nix
View file

@ -148,16 +148,15 @@ stdenvNoCC.mkDerivation (
# to the closure that was used to build it
unsafeDiscardReferences.out = true;
nativeBuildInputs =
[
systemd
util-linux
fakeroot
]
++ lib.optionals (compression.enable) [
compressionPkg
]
++ fileSystemTools;
nativeBuildInputs = [
systemd
util-linux
fakeroot
]
++ lib.optionals (compression.enable) [
compressionPkg
]
++ fileSystemTools;
env = mkfsEnv;
@ -168,24 +167,23 @@ stdenvNoCC.mkDerivation (
# relative path to the repart definitions that are read by systemd-repart
finalRepartDefinitions = "repart.d";
systemdRepartFlags =
[
"--architecture=${systemdArch}"
"--dry-run=no"
"--size=auto"
"--definitions=${finalAttrs.finalRepartDefinitions}"
"--split=${lib.boolToString split}"
"--json=pretty"
]
++ lib.optionals (seed != null) [
"--seed=${seed}"
]
++ lib.optionals createEmpty [
"--empty=create"
]
++ lib.optionals (sectorSize != null) [
"--sector-size=${toString sectorSize}"
];
systemdRepartFlags = [
"--architecture=${systemdArch}"
"--dry-run=no"
"--size=auto"
"--definitions=${finalAttrs.finalRepartDefinitions}"
"--split=${lib.boolToString split}"
"--json=pretty"
]
++ lib.optionals (seed != null) [
"--seed=${seed}"
]
++ lib.optionals createEmpty [
"--empty=create"
]
++ lib.optionals (sectorSize != null) [
"--sector-size=${toString sectorSize}"
];
dontUnpack = true;
dontConfigure = true;
@ -213,27 +211,26 @@ stdenvNoCC.mkDerivation (
runHook postBuild
'';
installPhase =
''
runHook preInstall
installPhase = ''
runHook preInstall
mkdir -p $out
''
# Compression is implemented in the same derivation as opposed to in a
# separate derivation to allow users to save disk space. Disk images are
# already very space intensive so we want to allow users to mitigate this.
+ lib.optionalString compression.enable ''
for f in ${imageFileBasename}*; do
echo "Compressing $f with ${compression.algorithm}..."
# Keep the original file when compressing and only delete it afterwards
${compressionCommand} $f && rm $f
done
''
+ ''
mv -v repart-output.json ${imageFileBasename}* $out
mkdir -p $out
''
# Compression is implemented in the same derivation as opposed to in a
# separate derivation to allow users to save disk space. Disk images are
# already very space intensive so we want to allow users to mitigate this.
+ lib.optionalString compression.enable ''
for f in ${imageFileBasename}*; do
echo "Compressing $f with ${compression.algorithm}..."
# Keep the original file when compressing and only delete it afterwards
${compressionCommand} $f && rm $f
done
''
+ ''
mv -v repart-output.json ${imageFileBasename}* $out
runHook postInstall
'';
runHook postInstall
'';
passthru = {
inherit amendRepartDefinitions;

13
nixos/modules/installer/cd-dvd/iso-image.nix
View file

@ -797,7 +797,8 @@ in
device = "/iso/nix-store.squashfs";
options = [
"loop"
] ++ lib.optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2") "threads=multi";
]
++ lib.optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2") "threads=multi";
neededForBoot = true;
};
@ -869,7 +870,8 @@ in
environment.systemPackages = [
grubPkgs.grub2
] ++ lib.optional (config.isoImage.makeBiosBootable) pkgs.syslinux;
]
++ lib.optional (config.isoImage.makeBiosBootable) pkgs.syslinux;
system.extraDependencies = [ grubPkgs.grub2_efi ];
# In stage 1 of the boot, mount the CD as the root FS by label so
@ -901,9 +903,10 @@ in
# Closures to be copied to the Nix store on the CD, namely the init
# script and the top-level system configuration directory.
isoImage.storeContents =
[ config.system.build.toplevel ]
++ lib.optional config.isoImage.includeSystemBuildDependencies config.system.build.toplevel.drvPath;
isoImage.storeContents = [
config.system.build.toplevel
]
++ lib.optional config.isoImage.includeSystemBuildDependencies config.system.build.toplevel.drvPath;
# Individual files to be included on the CD, outside of the Nix
# store on the CD.

3
nixos/modules/installer/netboot/netboot.nix
View file

@ -54,7 +54,8 @@ with lib;
device = "../nix-store.squashfs";
options = [
"loop"
] ++ lib.optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2") "threads=multi";
]
++ lib.optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2") "threads=multi";
neededForBoot = true;
};

41
nixos/modules/installer/sd-card/sd-image-powerpc64le.nix
View file

@ -30,26 +30,25 @@
sdImage = {
populateFirmwareCommands = "";
populateRootCommands =
''
mkdir -p ./files/boot
${config.boot.loader.generic-extlinux-compatible.populateCmd} \
-c ${config.system.build.toplevel} \
-d ./files/boot
''
# https://github.com/open-power/petitboot/blob/master/discover/syslinux-parser.c
# petitboot will look in these paths (plus all-caps versions of them):
# /boot/syslinux/syslinux.cfg
# /syslinux/syslinux.cfg
# /syslinux.cfg
+ ''
mv ./files/boot/extlinux ./files/boot/syslinux
mv ./files/boot/syslinux/extlinux.conf ./files/boot/syslinux/syslinux.cfg
''
# petitboot does not support relative paths for LINUX or INITRD; it prepends
# a `/` when parsing these fields
+ ''
sed -i 's_^\(\W\W*\(INITRD\|initrd\|LINUX\|linux\)\W\)\.\./_\1/boot/_' ./files/boot/syslinux/syslinux.cfg
'';
populateRootCommands = ''
mkdir -p ./files/boot
${config.boot.loader.generic-extlinux-compatible.populateCmd} \
-c ${config.system.build.toplevel} \
-d ./files/boot
''
# https://github.com/open-power/petitboot/blob/master/discover/syslinux-parser.c
# petitboot will look in these paths (plus all-caps versions of them):
# /boot/syslinux/syslinux.cfg
# /syslinux/syslinux.cfg
# /syslinux.cfg
+ ''
mv ./files/boot/extlinux ./files/boot/syslinux
mv ./files/boot/syslinux/extlinux.conf ./files/boot/syslinux/syslinux.cfg
''
# petitboot does not support relative paths for LINUX or INITRD; it prepends
# a `/` when parsing these fields
+ ''
sed -i 's_^\(\W\W*\(INITRD\|initrd\|LINUX\|linux\)\W\)\.\./_\1/boot/_' ./files/boot/syslinux/syslinux.cfg
'';
};
}

3
nixos/modules/installer/sd-card/sd-image.nix
View file

@ -227,7 +227,8 @@ in
libfaketime
mtools
util-linux
] ++ lib.optional config.sdImage.compressImage zstd;
]
++ lib.optional config.sdImage.compressImage zstd;
inherit (config.sdImage) compressImage;

3
nixos/modules/misc/documentation.nix
View file

@ -77,7 +77,8 @@ let
{
_module.check = false;
}
] ++ docModules.eager;
]
++ docModules.eager;
class = "nixos";
specialArgs = specialArgs // {
pkgs = scrubDerivations "pkgs" pkgs;

23
nixos/modules/profiles/installation-device.nix
View file

@ -61,21 +61,20 @@ with lib;
services.getty.autologinUser = "nixos";
# Some more help text.
services.getty.helpLine =
''
The "nixos" and "root" accounts have empty passwords.
services.getty.helpLine = ''
The "nixos" and "root" accounts have empty passwords.
To log in over ssh you must set a password for either "nixos" or "root"
with `passwd` (prefix with `sudo` for "root"), or add your public key to
/home/nixos/.ssh/authorized_keys or /root/.ssh/authorized_keys.
To log in over ssh you must set a password for either "nixos" or "root"
with `passwd` (prefix with `sudo` for "root"), or add your public key to
/home/nixos/.ssh/authorized_keys or /root/.ssh/authorized_keys.
To set up a wireless connection, run `nmtui`.
''
+ optionalString config.services.xserver.enable ''
To set up a wireless connection, run `nmtui`.
''
+ optionalString config.services.xserver.enable ''
Type `sudo systemctl start display-manager' to
start the graphical user interface.
'';
Type `sudo systemctl start display-manager' to
start the graphical user interface.
'';
# We run sshd by default. Login is only possible after adding a
# password via "passwd" or by adding a ssh key to ~/.ssh/authorized_keys.

13
nixos/modules/programs/cdemu.nix
View file

@ -71,13 +71,12 @@ in
Restart = "no";
};
environment.systemPackages =
[
pkgs.cdemu-daemon
pkgs.cdemu-client
]
++ lib.optional cfg.gui pkgs.gcdemu
++ lib.optional cfg.image-analyzer pkgs.image-analyzer;
environment.systemPackages = [
pkgs.cdemu-daemon
pkgs.cdemu-client
]
++ lib.optional cfg.gui pkgs.gcdemu
++ lib.optional cfg.image-analyzer pkgs.image-analyzer;
};
}

3
nixos/modules/programs/dconf.nix
View file

@ -50,7 +50,8 @@ let
(pkgs.writeTextDir "locks/nixos-generated-dconf-locks" (
lib.concatStringsSep "\n" (if val.lockAll then mkAllLocks val.settings else val.locks)
))
] ++ (map checkDconfKeyfiles val.keyfiles);
]
++ (map checkDconfKeyfiles val.keyfiles);
}
);

3
nixos/modules/programs/feedbackd.nix
View file

@ -25,7 +25,8 @@ in
config = lib.mkIf cfg.enable {
environment.systemPackages = [
cfg.package
] ++ (if cfg.theme-package != null then [ cfg.theme-package ] else [ ]);
]
++ (if cfg.theme-package != null then [ cfg.theme-package ] else [ ]);
services.dbus.packages = [ cfg.package ];
services.udev.packages = [ cfg.package ];

3
nixos/modules/programs/firefox.nix
View file

@ -293,7 +293,8 @@ in
Additional packages containing native messaging hosts that should be made available to Firefox extensions.
'';
};
}) // (builtins.mapAttrs (k: v: lib.mkEnableOption "${v.name} support") nmhOptions);
})
// (builtins.mapAttrs (k: v: lib.mkEnableOption "${v.name} support") nmhOptions);
};
config =

15
nixos/modules/programs/htop.nix
View file

@ -63,14 +63,13 @@ in
cfg.package
];
environment.etc."htoprc".text =
''
# Global htop configuration
# To change set: programs.htop.settings.KEY = VALUE;
''
+ builtins.concatStringsSep "\n" (
lib.mapAttrsToList (key: value: "${key}=${fmt value}") cfg.settings
);
environment.etc."htoprc".text = ''
# Global htop configuration
# To change set: programs.htop.settings.KEY = VALUE;
''
+ builtins.concatStringsSep "\n" (
lib.mapAttrsToList (key: value: "${key}=${fmt value}") cfg.settings
);
};
}

19
nixos/modules/programs/less.nix
View file

@ -123,16 +123,15 @@ in
environment.systemPackages = [ cfg.package ];
environment.variables =
{
LESSKEYIN_SYSTEM = builtins.toString lessKey;
}
// lib.optionalAttrs (cfg.lessopen != null) {
LESSOPEN = cfg.lessopen;
}
// lib.optionalAttrs (cfg.lessclose != null) {
LESSCLOSE = cfg.lessclose;
};
environment.variables = {
LESSKEYIN_SYSTEM = builtins.toString lessKey;
}
// lib.optionalAttrs (cfg.lessopen != null) {
LESSOPEN = cfg.lessopen;
}
// lib.optionalAttrs (cfg.lessclose != null) {
LESSCLOSE = cfg.lessclose;
};
warnings =
lib.optional

3
nixos/modules/programs/nix-required-mounts.nix
View file

@ -56,7 +56,8 @@ let
config.hardware.graphics.package
# nvidia_x11, etc:
] ++ config.hardware.graphics.extraPackages; # nvidia_x11
]
++ config.hardware.graphics.extraPackages; # nvidia_x11
defaults = {
nvidia-gpu.onFeatures = package.allowedPatterns.nvidia-gpu.onFeatures;

3
nixos/modules/programs/opengamepadui.nix
View file

@ -264,7 +264,8 @@ in
environment.systemPackages = [
cfg.package
] ++ lib.optional cfg.gamescopeSession.enable opengamepadui-gamescope;
]
++ lib.optional cfg.gamescopeSession.enable opengamepadui-gamescope;
};
meta.maintainers = with lib.maintainers; [ shadowapex ];

35
nixos/modules/programs/schroot.nix
View file

@ -96,26 +96,25 @@ in
environment = {
systemPackages = [ cfg.package ];
etc =
{
# schroot requires this directory to exist
"schroot/chroot.d/.keep".text = "";
etc = {
# schroot requires this directory to exist
"schroot/chroot.d/.keep".text = "";
"schroot/schroot.conf".source = iniFmt.generate "schroot.conf" cfg.settings;
"schroot/schroot.conf".source = iniFmt.generate "schroot.conf" cfg.settings;
}
// (lib.attrsets.concatMapAttrs (
name:
{
copyfiles,
fstab,
nssdatabases,
}:
{
"schroot/${name}/copyfiles".text = (lib.strings.concatStringsSep "\n" copyfiles) + "\n";
"schroot/${name}/fstab".source = fstab;
"schroot/${name}/nssdatabases".text = (lib.strings.concatStringsSep "\n" nssdatabases) + "\n";
}
// (lib.attrsets.concatMapAttrs (
name:
{
copyfiles,
fstab,
nssdatabases,
}:
{
"schroot/${name}/copyfiles".text = (lib.strings.concatStringsSep "\n" copyfiles) + "\n";
"schroot/${name}/fstab".source = fstab;
"schroot/${name}/nssdatabases".text = (lib.strings.concatStringsSep "\n" nssdatabases) + "\n";
}
) cfg.profiles);
) cfg.profiles);
};
security.wrappers.schroot = {

32
nixos/modules/programs/ssh.nix
View file

@ -32,7 +32,8 @@ let
knownHostsFiles = [
"/etc/ssh/ssh_known_hosts"
] ++ builtins.map pkgs.copyPathToStore cfg.knownHostsFiles;
]
++ builtins.map pkgs.copyPathToStore cfg.knownHostsFiles;
in
{
@ -319,21 +320,20 @@ in
|| config.services.openssh.settings.X11Forwarding
);
assertions =
[
{
assertion = cfg.forwardX11 == true -> cfg.setXAuthLocation;
message = "cannot enable X11 forwarding without setting XAuth location";
}
]
++ lib.flip lib.mapAttrsToList cfg.knownHosts (
name: data: {
assertion =
(data.publicKey == null && data.publicKeyFile != null)
|| (data.publicKey != null && data.publicKeyFile == null);
message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
}
);
assertions = [
{
assertion = cfg.forwardX11 == true -> cfg.setXAuthLocation;
message = "cannot enable X11 forwarding without setting XAuth location";
}
]
++ lib.flip lib.mapAttrsToList cfg.knownHosts (
name: data: {
assertion =
(data.publicKey == null && data.publicKeyFile != null)
|| (data.publicKey != null && data.publicKeyFile == null);
message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
}
);
# SSH configuration. Slight duplication of the sshd_config
# generation in the sshd service.

17
nixos/modules/programs/steam.nix
View file

@ -241,15 +241,14 @@ in
hardware.steam-hardware.enable = true;
environment.systemPackages =
[
cfg.package
cfg.package.run
]
++ lib.optional cfg.gamescopeSession.enable steam-gamescope
++ lib.optional cfg.protontricks.enable (
cfg.protontricks.package.override { inherit extraCompatPaths; }
);
environment.systemPackages = [
cfg.package
cfg.package.run
]
++ lib.optional cfg.gamescopeSession.enable steam-gamescope
++ lib.optional cfg.protontricks.enable (
cfg.protontricks.package.override { inherit extraCompatPaths; }
);
networking.firewall = lib.mkMerge [
(lib.mkIf (cfg.remotePlay.openFirewall || cfg.localNetworkGameTransfers.openFirewall) {

67
nixos/modules/programs/tsm-client.nix
View file

@ -229,44 +229,43 @@ let
cfg = config.programs.tsmClient;
servernames = map (s: s.servername) (attrValues cfg.servers);
assertions =
[
{
assertion = allUnique (map toLower servernames);
message = ''
TSM server names
(option `programs.tsmClient.servers`)
contain duplicate name
(note that server names are case insensitive).
'';
}
{
assertion = (cfg.defaultServername != null) -> (elem cfg.defaultServername servernames);
message = ''
TSM default server name
`programs.tsmClient.defaultServername="${cfg.defaultServername}"`
not found in server names in
`programs.tsmClient.servers`.
'';
}
]
++ (mapAttrsToList (name: serverCfg: {
assertion = all (key: null != match "[^[:space:]]+" key) (attrNames serverCfg);
assertions = [
{
assertion = allUnique (map toLower servernames);
message = ''
TSM server setting names in
`programs.tsmClient.servers.${name}.*`
contain spaces, but that's not allowed.
TSM server names
(option `programs.tsmClient.servers`)
contain duplicate name
(note that server names are case insensitive).
'';
}) cfg.servers)
++ (mapAttrsToList (name: serverCfg: {
assertion = allUnique (map toLower (attrNames serverCfg));
}
{
assertion = (cfg.defaultServername != null) -> (elem cfg.defaultServername servernames);
message = ''
TSM server setting names in
`programs.tsmClient.servers.${name}.*`
contain duplicate names
(note that setting names are case insensitive).
TSM default server name
`programs.tsmClient.defaultServername="${cfg.defaultServername}"`
not found in server names in
`programs.tsmClient.servers`.
'';
}) cfg.servers);
}
]
++ (mapAttrsToList (name: serverCfg: {
assertion = all (key: null != match "[^[:space:]]+" key) (attrNames serverCfg);
message = ''
TSM server setting names in
`programs.tsmClient.servers.${name}.*`
contain spaces, but that's not allowed.
'';
}) cfg.servers)
++ (mapAttrsToList (name: serverCfg: {
assertion = allUnique (map toLower (attrNames serverCfg));
message = ''
TSM server setting names in
`programs.tsmClient.servers.${name}.*`
contain duplicate names
(note that setting names are case insensitive).
'';
}) cfg.servers);
makeDsmSysLines =
key: value:

27
nixos/modules/programs/wayland/sway.nix
View file

@ -155,20 +155,19 @@ in
# Needed for the default wallpaper:
pathsToLink = lib.optional (cfg.package != null) "/share/backgrounds/sway";
etc =
{
"sway/config.d/nixos.conf".source = pkgs.writeText "nixos.conf" ''
# Import the most important environment variables into the D-Bus and systemd
# user environments (e.g. required for screen sharing and Pinentry prompts):
exec dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP
# enable systemd-integration
exec "systemctl --user import-environment {,WAYLAND_}DISPLAY SWAYSOCK; systemctl --user start sway-session.target"
exec swaymsg -t subscribe '["shutdown"]' && systemctl --user stop sway-session.target
'';
}
// lib.optionalAttrs (cfg.package != null) {
"sway/config".source = lib.mkOptionDefault "${cfg.package}/etc/sway/config";
};
etc = {
"sway/config.d/nixos.conf".source = pkgs.writeText "nixos.conf" ''
# Import the most important environment variables into the D-Bus and systemd
# user environments (e.g. required for screen sharing and Pinentry prompts):
exec dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP
# enable systemd-integration
exec "systemctl --user import-environment {,WAYLAND_}DISPLAY SWAYSOCK; systemctl --user start sway-session.target"
exec swaymsg -t subscribe '["shutdown"]' && systemctl --user stop sway-session.target
'';
}
// lib.optionalAttrs (cfg.package != null) {
"sway/config".source = lib.mkOptionDefault "${cfg.package}/etc/sway/config";
};
};
systemd.user.targets.sway-session = {

3
nixos/modules/programs/zsh/zsh.nix
View file

@ -308,7 +308,8 @@ in
environment.systemPackages = [
pkgs.zsh
] ++ lib.optional cfg.enableCompletion pkgs.nix-zsh-completions;
]
++ lib.optional cfg.enableCompletion pkgs.nix-zsh-completions;
environment.pathsToLink = lib.optional cfg.enableCompletion "/share/zsh";

58
nixos/modules/security/acme/default.nix
View file

@ -284,34 +284,33 @@ let
data.webroot
];
commonOpts =
[
"--accept-tos" # Checking the option is covered by the assertions
"--path"
"."
"--email"
data.email
]
++ protocolOpts
++ lib.optionals (acmeServer != null) [
"--server"
acmeServer
]
++ lib.optionals (data.csr != null) [
"--csr"
data.csr
]
++ lib.optionals (data.csr == null) [
"--key-type"
data.keyType
"-d"
data.domain
]
++ lib.concatMap (name: [
"-d"
name
]) extraDomains
++ data.extraLegoFlags;
commonOpts = [
"--accept-tos" # Checking the option is covered by the assertions
"--path"
"."
"--email"
data.email
]
++ protocolOpts
++ lib.optionals (acmeServer != null) [
"--server"
acmeServer
]
++ lib.optionals (data.csr != null) [
"--csr"
data.csr
]
++ lib.optionals (data.csr == null) [
"--key-type"
data.keyType
"-d"
data.domain
]
++ lib.concatMap (name: [
"-d"
name
]) extraDomains
++ data.extraLegoFlags;
# Although --must-staple is common to both modes, it is not declared as a
# mode-agnostic argument in lego and thus must come after the mode.
@ -420,7 +419,8 @@ let
"network-online.target"
"acme-setup.service"
"nss-lookup.target"
] ++ selfsignedDeps;
]
++ selfsignedDeps;
wants = [ "network-online.target" ] ++ selfsignedDeps;
requires = [ "acme-setup.service" ];

13
nixos/modules/security/apparmor.nix
View file

@ -149,13 +149,12 @@ in
}) enabledPolicies
++ lib.mapAttrsToList (name: path: { inherit name path; }) cfg.includes
);
environment.etc."apparmor/parser.conf".text =
''
${if cfg.enableCache then "write-cache" else "skip-cache"}
cache-loc /var/cache/apparmor
Include /etc/apparmor.d
''
+ lib.concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
environment.etc."apparmor/parser.conf".text = ''
${if cfg.enableCache then "write-cache" else "skip-cache"}
cache-loc /var/cache/apparmor
Include /etc/apparmor.d
''
+ lib.concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
# For aa-logprof
environment.etc."apparmor/apparmor.conf".text = '''';
# For aa-logprof

725
nixos/modules/security/apparmor/includes.nix
View file

@ -39,60 +39,58 @@ in
alias /sbin -> /run/current-system/sw/sbin,
alias /usr -> /run/current-system/sw,
'';
"abstractions/audio" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/audio"
''
+ lib.concatMapStringsSep "\n" etcRule [
"asound.conf"
"esound/esd.conf"
"libao.conf"
{
path = "pulse";
trail = "/";
}
{
path = "pulse";
trail = "/**";
}
{
path = "sound";
trail = "/";
}
{
path = "sound";
trail = "/**";
}
{
path = "alsa/conf.d";
trail = "/";
}
{
path = "alsa/conf.d";
trail = "/*";
}
"openal/alsoft.conf"
"wildmidi/wildmidi.conf"
];
"abstractions/authentication" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/authentication"
# Defined in security.pam
include <abstractions/pam>
''
+ lib.concatMapStringsSep "\n" etcRule [
"nologin"
"securetty"
{
path = "security";
trail = "/*";
}
"shadow"
"gshadow"
"pwdb.conf"
"default/passwd"
"login.defs"
];
"abstractions/audio" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/audio"
''
+ lib.concatMapStringsSep "\n" etcRule [
"asound.conf"
"esound/esd.conf"
"libao.conf"
{
path = "pulse";
trail = "/";
}
{
path = "pulse";
trail = "/**";
}
{
path = "sound";
trail = "/";
}
{
path = "sound";
trail = "/**";
}
{
path = "alsa/conf.d";
trail = "/";
}
{
path = "alsa/conf.d";
trail = "/*";
}
"openal/alsoft.conf"
"wildmidi/wildmidi.conf"
];
"abstractions/authentication" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/authentication"
# Defined in security.pam
include <abstractions/pam>
''
+ lib.concatMapStringsSep "\n" etcRule [
"nologin"
"securetty"
{
path = "security";
trail = "/*";
}
"shadow"
"gshadow"
"pwdb.conf"
"default/passwd"
"login.defs"
];
"abstractions/base" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base"
r ${pkgs.stdenv.cc.libc}/share/locale/**,
@ -102,38 +100,37 @@ in
r ${pkgs.tzdata}/share/zoneinfo/**,
r ${pkgs.stdenv.cc.libc}/share/i18n/**,
'';
"abstractions/bash" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/bash"
"abstractions/bash" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/bash"
# bash inspects filesystems at startup
# and /etc/mtab is linked to /proc/mounts
r @{PROC}/mounts,
# bash inspects filesystems at startup
# and /etc/mtab is linked to /proc/mounts
r @{PROC}/mounts,
# system-wide bash configuration
''
+ lib.concatMapStringsSep "\n" etcRule [
"profile.dos"
"profile"
"profile.d"
{
path = "profile.d";
trail = "/*";
}
"bashrc"
"bash.bashrc"
"bash.bashrc.local"
"bash_completion"
"bash_completion.d"
{
path = "bash_completion.d";
trail = "/*";
}
# bash relies on system-wide readline configuration
"inputrc"
# run out of /etc/bash.bashrc
"DIR_COLORS"
];
# system-wide bash configuration
''
+ lib.concatMapStringsSep "\n" etcRule [
"profile.dos"
"profile"
"profile.d"
{
path = "profile.d";
trail = "/*";
}
"bashrc"
"bash.bashrc"
"bash.bashrc.local"
"bash_completion"
"bash_completion.d"
{
path = "bash_completion.d";
trail = "/*";
}
# bash relies on system-wide readline configuration
"inputrc"
# run out of /etc/bash.bashrc
"DIR_COLORS"
];
"abstractions/consoles" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/consoles"
'';
@ -166,129 +163,125 @@ in
trail = "/**";
}}
'';
"abstractions/gnome" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/gnome"
include <abstractions/fonts>
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "gnome";
trail = "/gtkrc*";
}
{
path = "gtk";
trail = "/*";
}
{
path = "gtk-2.0";
trail = "/*";
}
{
path = "gtk-3.0";
trail = "/*";
}
"orbitrc"
{
path = "pango";
trail = "/*";
}
{
path = "/etc/gnome-vfs-2.0";
trail = "/modules/";
}
{
path = "/etc/gnome-vfs-2.0";
trail = "/modules/*";
}
"papersize"
{
path = "cups";
trail = "/lpoptions";
}
{
path = "gnome";
trail = "/defaults.list";
}
{
path = "xdg";
trail = "/{,*-}mimeapps.list";
}
"xdg/mimeapps.list"
];
"abstractions/kde" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kde"
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "qt3";
trail = "/kstylerc";
}
{
path = "qt3";
trail = "/qt_plugins_3.3rc";
}
{
path = "qt3";
trail = "/qtrc";
}
"kderc"
{
path = "kde3";
trail = "/*";
}
"kde4rc"
{
path = "xdg";
trail = "/kdeglobals";
}
{
path = "xdg";
trail = "/Trolltech.conf";
}
];
"abstractions/kerberosclient" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kerberosclient"
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "krb5.keytab";
mode = "rk";
}
"krb5.conf"
"krb5.conf.d"
{
path = "krb5.conf.d";
trail = "/*";
}
"abstractions/gnome" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/gnome"
include <abstractions/fonts>
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "gnome";
trail = "/gtkrc*";
}
{
path = "gtk";
trail = "/*";
}
{
path = "gtk-2.0";
trail = "/*";
}
{
path = "gtk-3.0";
trail = "/*";
}
"orbitrc"
{
path = "pango";
trail = "/*";
}
{
path = "/etc/gnome-vfs-2.0";
trail = "/modules/";
}
{
path = "/etc/gnome-vfs-2.0";
trail = "/modules/*";
}
"papersize"
{
path = "cups";
trail = "/lpoptions";
}
{
path = "gnome";
trail = "/defaults.list";
}
{
path = "xdg";
trail = "/{,*-}mimeapps.list";
}
"xdg/mimeapps.list"
];
"abstractions/kde" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kde"
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "qt3";
trail = "/kstylerc";
}
{
path = "qt3";
trail = "/qt_plugins_3.3rc";
}
{
path = "qt3";
trail = "/qtrc";
}
"kderc"
{
path = "kde3";
trail = "/*";
}
"kde4rc"
{
path = "xdg";
trail = "/kdeglobals";
}
{
path = "xdg";
trail = "/Trolltech.conf";
}
];
"abstractions/kerberosclient" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/kerberosclient"
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "krb5.keytab";
mode = "rk";
}
"krb5.conf"
"krb5.conf.d"
{
path = "krb5.conf.d";
trail = "/*";
}
# config files found via strings on libs
"krb.conf"
"krb.realms"
"srvtab"
];
"abstractions/ldapclient" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ldapclient"
''
+ lib.concatMapStringsSep "\n" etcRule [
"ldap.conf"
"ldap.secret"
{
path = "openldap";
trail = "/*";
}
{
path = "openldap";
trail = "/cacerts/*";
}
{
path = "sasl2";
trail = "/*";
}
];
# config files found via strings on libs
"krb.conf"
"krb.realms"
"srvtab"
];
"abstractions/ldapclient" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ldapclient"
''
+ lib.concatMapStringsSep "\n" etcRule [
"ldap.conf"
"ldap.secret"
{
path = "openldap";
trail = "/*";
}
{
path = "openldap";
trail = "/cacerts/*";
}
{
path = "sasl2";
trail = "/*";
}
];
"abstractions/likewise" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/likewise"
'';
@ -296,49 +289,48 @@ in
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/mdns"
${etcRule "nss_mdns.conf"}
'';
"abstractions/nameservice" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nameservice"
"abstractions/nameservice" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nameservice"
# Many programs wish to perform nameservice-like operations, such as
# looking up users by name or id, groups by name or id, hosts by name
# or IP, etc. These operations may be performed through files, dns,
# NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
mr ${getLib pkgs.nss}/lib/libnss_*.so*,
mr ${getLib pkgs.nss}/lib64/libnss_*.so*,
''
+ lib.concatMapStringsSep "\n" etcRule [
"group"
"host.conf"
"hosts"
"nsswitch.conf"
"gai.conf"
"passwd"
"protocols"
# Many programs wish to perform nameservice-like operations, such as
# looking up users by name or id, groups by name or id, hosts by name
# or IP, etc. These operations may be performed through files, dns,
# NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
mr ${getLib pkgs.nss}/lib/libnss_*.so*,
mr ${getLib pkgs.nss}/lib64/libnss_*.so*,
''
+ lib.concatMapStringsSep "\n" etcRule [
"group"
"host.conf"
"hosts"
"nsswitch.conf"
"gai.conf"
"passwd"
"protocols"
# libtirpc (used for NIS/YP login) needs this
"netconfig"
# libtirpc (used for NIS/YP login) needs this
"netconfig"
"resolv.conf"
"resolv.conf"
{
path = "samba";
trail = "/lmhosts";
}
"services"
{
path = "samba";
trail = "/lmhosts";
}
"services"
"default/nss"
"default/nss"
# libnl-3-200 via libnss-gw-name
{
path = "libnl";
trail = "/classid";
}
{
path = "libnl-3";
trail = "/classid";
}
];
# libnl-3-200 via libnss-gw-name
{
path = "libnl";
trail = "/classid";
}
{
path = "libnl-3";
trail = "/classid";
}
];
"abstractions/nis" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nis"
'';
@ -367,28 +359,27 @@ in
trail = "/openssl.cnf";
}}
'';
"abstractions/p11-kit" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/p11-kit"
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "pkcs11";
trail = "/";
}
{
path = "pkcs11";
trail = "/pkcs11.conf";
}
{
path = "pkcs11";
trail = "/modules/";
}
{
path = "pkcs11";
trail = "/modules/*";
}
];
"abstractions/p11-kit" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/p11-kit"
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "pkcs11";
trail = "/";
}
{
path = "pkcs11";
trail = "/pkcs11.conf";
}
{
path = "pkcs11";
trail = "/modules/";
}
{
path = "pkcs11";
trail = "/modules/*";
}
];
"abstractions/perl" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/perl"
${etcRule {
@ -396,67 +387,64 @@ in
trail = "/**";
}}
'';
"abstractions/php" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/php"
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "php";
trail = "/**/";
}
{
path = "php5";
trail = "/**/";
}
{
path = "php7";
trail = "/**/";
}
{
path = "php";
trail = "/**.ini";
}
{
path = "php5";
trail = "/**.ini";
}
{
path = "php7";
trail = "/**.ini";
}
];
"abstractions/postfix-common" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/postfix-common"
''
+ lib.concatMapStringsSep "\n" etcRule [
"mailname"
{
path = "postfix";
trail = "/*.cf";
}
"postfix/main.cf"
"postfix/master.cf"
];
"abstractions/php" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/php"
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "php";
trail = "/**/";
}
{
path = "php5";
trail = "/**/";
}
{
path = "php7";
trail = "/**/";
}
{
path = "php";
trail = "/**.ini";
}
{
path = "php5";
trail = "/**.ini";
}
{
path = "php7";
trail = "/**.ini";
}
];
"abstractions/postfix-common" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/postfix-common"
''
+ lib.concatMapStringsSep "\n" etcRule [
"mailname"
{
path = "postfix";
trail = "/*.cf";
}
"postfix/main.cf"
"postfix/master.cf"
];
"abstractions/python" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/python"
'';
"abstractions/qt5" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/qt5"
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "xdg";
trail = "/QtProject/qtlogging.ini";
}
{
path = "xdg/QtProject";
trail = "/qtlogging.ini";
}
"xdg/QtProject/qtlogging.ini"
];
"abstractions/qt5" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/qt5"
''
+ lib.concatMapStringsSep "\n" etcRule [
{
path = "xdg";
trail = "/QtProject/qtlogging.ini";
}
{
path = "xdg/QtProject";
trail = "/qtlogging.ini";
}
"xdg/QtProject/qtlogging.ini"
];
"abstractions/samba" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/samba"
${etcRule {
@ -464,56 +452,55 @@ in
trail = "/*";
}}
'';
"abstractions/ssl_certs" =
''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ssl_certs"
"abstractions/ssl_certs" = ''
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ssl_certs"
# For the NixOS module: security.acme
r /var/lib/acme/*/cert.pem,
r /var/lib/acme/*/chain.pem,
r /var/lib/acme/*/fullchain.pem,
# For the NixOS module: security.acme
r /var/lib/acme/*/cert.pem,
r /var/lib/acme/*/chain.pem,
r /var/lib/acme/*/fullchain.pem,
r /etc/pki/tls/certs/,
r /etc/pki/tls/certs/,
''
+ lib.concatMapStringsSep "\n" etcRule [
"ssl/certs/ca-certificates.crt"
"ssl/certs/ca-bundle.crt"
"pki/tls/certs/ca-bundle.crt"
''
+ lib.concatMapStringsSep "\n" etcRule [
"ssl/certs/ca-certificates.crt"
"ssl/certs/ca-bundle.crt"
"pki/tls/certs/ca-bundle.crt"
{
path = "ssl/trust";
trail = "/";
}
{
path = "ssl/trust";
trail = "/*";
}
{
path = "ssl/trust/anchors";
trail = "/";
}
{
path = "ssl/trust/anchors";
trail = "/**";
}
{
path = "pki/trust";
trail = "/";
}
{
path = "pki/trust";
trail = "/*";
}
{
path = "pki/trust/anchors";
trail = "/";
}
{
path = "pki/trust/anchors";
trail = "/**";
}
];
{
path = "ssl/trust";
trail = "/";
}
{
path = "ssl/trust";
trail = "/*";
}
{
path = "ssl/trust/anchors";
trail = "/";
}
{
path = "ssl/trust/anchors";
trail = "/**";
}
{
path = "pki/trust";
trail = "/";
}
{
path = "pki/trust";
trail = "/*";
}
{
path = "pki/trust/anchors";
trail = "/";
}
{
path = "pki/trust/anchors";
trail = "/**";
}
];
"abstractions/ssl_keys" = ''
# security.acme NixOS module
r /var/lib/acme/*/full.pem,

109
nixos/modules/security/dhparams.nix
View file

@ -144,67 +144,66 @@ in
};
config = lib.mkIf (cfg.enable && cfg.stateful) {
systemd.services =
{
dhparams-init = {
description = "Clean Up Old Diffie-Hellman Parameters";
systemd.services = {
dhparams-init = {
description = "Clean Up Old Diffie-Hellman Parameters";
# Clean up even when no DH params is set
wantedBy = [ "multi-user.target" ];
# Clean up even when no DH params is set
wantedBy = [ "multi-user.target" ];
serviceConfig.RemainAfterExit = true;
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
serviceConfig.Type = "oneshot";
script = ''
if [ ! -d ${cfg.path} ]; then
mkdir -p ${cfg.path}
script = ''
if [ ! -d ${cfg.path} ]; then
mkdir -p ${cfg.path}
fi
# Remove old dhparams
for file in ${cfg.path}/*; do
if [ ! -f "$file" ]; then
continue
fi
${lib.concatStrings (
lib.mapAttrsToList (
name:
{ bits, path, ... }:
''
if [ "$file" = ${lib.escapeShellArg path} ] && \
${pkgs.openssl}/bin/openssl dhparam -in "$file" -text \
| head -n 1 | grep "(${toString bits} bit)" > /dev/null; then
continue
fi
''
) cfg.params
)}
rm "$file"
done
# Remove old dhparams
for file in ${cfg.path}/*; do
if [ ! -f "$file" ]; then
continue
fi
${lib.concatStrings (
lib.mapAttrsToList (
name:
{ bits, path, ... }:
''
if [ "$file" = ${lib.escapeShellArg path} ] && \
${pkgs.openssl}/bin/openssl dhparam -in "$file" -text \
| head -n 1 | grep "(${toString bits} bit)" > /dev/null; then
continue
fi
''
) cfg.params
)}
rm "$file"
done
# TODO: Ideally this would be removing the *former* cfg.path, though
# this does not seem really important as changes to it are quite
# unlikely
rmdir --ignore-fail-on-non-empty ${cfg.path}
'';
};
# TODO: Ideally this would be removing the *former* cfg.path, though
# this does not seem really important as changes to it are quite
# unlikely
rmdir --ignore-fail-on-non-empty ${cfg.path}
'';
};
}
// lib.mapAttrs' (
name:
{ bits, path, ... }:
lib.nameValuePair "dhparams-gen-${name}" {
description = "Generate Diffie-Hellman Parameters for ${name}";
after = [ "dhparams-init.service" ];
before = [ "${name}.service" ];
wantedBy = [ "multi-user.target" ];
unitConfig.ConditionPathExists = "!${path}";
serviceConfig.Type = "oneshot";
script = ''
mkdir -p ${lib.escapeShellArg cfg.path}
${pkgs.openssl}/bin/openssl dhparam -out ${lib.escapeShellArg path} \
${toString bits}
'';
}
// lib.mapAttrs' (
name:
{ bits, path, ... }:
lib.nameValuePair "dhparams-gen-${name}" {
description = "Generate Diffie-Hellman Parameters for ${name}";
after = [ "dhparams-init.service" ];
before = [ "${name}.service" ];
wantedBy = [ "multi-user.target" ];
unitConfig.ConditionPathExists = "!${path}";
serviceConfig.Type = "oneshot";
script = ''
mkdir -p ${lib.escapeShellArg cfg.path}
${pkgs.openssl}/bin/openssl dhparam -out ${lib.escapeShellArg path} \
${toString bits}
'';
}
) cfg.params;
) cfg.params;
};
meta.maintainers = with lib.maintainers; [ ekleog ];

10
nixos/modules/security/duosec.nix
View file

@ -21,12 +21,10 @@ let
fallback_local_ip=${boolToStr cfg.fallbackLocalIP}
'';
configFileLogin =
configFilePam
+ ''
motd=${boolToStr cfg.motd}
accept_env_factor=${boolToStr cfg.acceptEnvFactor}
'';
configFileLogin = configFilePam + ''
motd=${boolToStr cfg.motd}
accept_env_factor=${boolToStr cfg.acceptEnvFactor}
'';
in
{
imports = [

63
nixos/modules/security/krb5/krb5-conf-format.nix
View file

@ -124,39 +124,38 @@ rec {
in
submodule {
freeformType = attrsOf sectionType;
options =
{
include = mkOption {
default = [ ];
description = ''
Files to include in the Kerberos configuration.
'';
type = coercedTo path singleton (listOf path);
};
includedir = mkOption {
default = [ ];
description = ''
Directories containing files to include in the Kerberos configuration.
'';
type = coercedTo path singleton (listOf path);
};
module = mkOption {
default = [ ];
description = ''
Modules to obtain Kerberos configuration from.
'';
type = coercedTo path singleton (listOf path);
};
options = {
include = mkOption {
default = [ ];
description = ''
Files to include in the Kerberos configuration.
'';
type = coercedTo path singleton (listOf path);
};
includedir = mkOption {
default = [ ];
description = ''
Directories containing files to include in the Kerberos configuration.
'';
type = coercedTo path singleton (listOf path);
};
module = mkOption {
default = [ ];
description = ''
Modules to obtain Kerberos configuration from.
'';
type = coercedTo path singleton (listOf path);
};
}
// (lib.optionalAttrs enableKdcACLEntries {
realms = mkOption {
type = attrsOf realm;
description = ''
The realm(s) to serve keys for.
'';
};
});
}
// (lib.optionalAttrs enableKdcACLEntries {
realms = mkOption {
type = attrsOf realm;
description = ''
The realm(s) to serve keys for.
'';
};
});
};
generate =

94
nixos/modules/security/pam.nix
View file

@ -2270,16 +2270,17 @@ in
a malicious process can then edit such an authorized_keys file and bypass the ssh-agent-based authentication.
See https://github.com/NixOS/nixpkgs/issues/31611
''
++ lib.optional
(
with config.security.pam.rssh;
enable && settings.auth_key_file or null != null && settings.authorized_keys_command or null != null
)
''
security.pam.rssh.settings.auth_key_file will be ignored as
security.pam.rssh.settings.authorized_keys_command has been specified.
Explictly set the former to null to silence this warning.
'';
++
lib.optional
(
with config.security.pam.rssh;
enable && settings.auth_key_file or null != null && settings.authorized_keys_command or null != null
)
''
security.pam.rssh.settings.auth_key_file will be ignored as
security.pam.rssh.settings.authorized_keys_command has been specified.
Explictly set the former to null to silence this warning.
'';
environment.systemPackages =
# Include the PAM modules in the system path mostly for the manpages.
@ -2310,47 +2311,46 @@ in
environment.etc = lib.mapAttrs' makePAMService enabledServices;
security.pam.services =
{
other.text = ''
auth required pam_warn.so
auth required pam_deny.so
account required pam_warn.so
account required pam_deny.so
password required pam_warn.so
password required pam_deny.so
session required pam_warn.so
session required pam_deny.so
'';
security.pam.services = {
other.text = ''
auth required pam_warn.so
auth required pam_deny.so
account required pam_warn.so
account required pam_deny.so
password required pam_warn.so
password required pam_deny.so
session required pam_warn.so
session required pam_deny.so
'';
# Most of these should be moved to specific modules.
i3lock.enable = lib.mkDefault config.programs.i3lock.enable;
i3lock-color.enable = lib.mkDefault config.programs.i3lock.enable;
vlock.enable = lib.mkDefault config.console.enable;
xlock.enable = lib.mkDefault config.services.xserver.enable;
xscreensaver.enable = lib.mkDefault config.services.xscreensaver.enable;
# Most of these should be moved to specific modules.
i3lock.enable = lib.mkDefault config.programs.i3lock.enable;
i3lock-color.enable = lib.mkDefault config.programs.i3lock.enable;
vlock.enable = lib.mkDefault config.console.enable;
xlock.enable = lib.mkDefault config.services.xserver.enable;
xscreensaver.enable = lib.mkDefault config.services.xscreensaver.enable;
runuser = {
rootOK = true;
unixAuth = false;
setEnvironment = false;
};
/*
FIXME: should runuser -l start a systemd session? Currently
it complains "Cannot create session: Already running in a
session".
*/
runuser-l = {
rootOK = true;
unixAuth = false;
};
}
// lib.optionalAttrs (config.security.pam.enableFscrypt) {
# Allow fscrypt to verify login passphrase
fscrypt = { };
runuser = {
rootOK = true;
unixAuth = false;
setEnvironment = false;
};
/*
FIXME: should runuser -l start a systemd session? Currently
it complains "Cannot create session: Already running in a
session".
*/
runuser-l = {
rootOK = true;
unixAuth = false;
};
}
// lib.optionalAttrs (config.security.pam.enableFscrypt) {
# Allow fscrypt to verify login passphrase
fscrypt = { };
};
security.apparmor.includes."abstractions/pam" =
lib.concatMapStrings (name: "r ${config.environment.etc."pam.d/${name}".source},\n") (
lib.attrNames enabledServices

3
nixos/modules/security/pam_mount.nix
View file

@ -158,7 +158,8 @@ in
user = user.name;
path = user.cryptHomeLuks;
mountpoint = user.home;
} // user.pamMount;
}
// user.pamMount;
in
"<volume ${lib.concatStringsSep " " (lib.mapAttrsToList mkAttr attrs)} />\n";
in

33
nixos/modules/security/wrappers/wrapper.nix
View file

@ -11,23 +11,22 @@ stdenv.mkDerivation {
name = "security-wrapper-${baseNameOf sourceProg}";
buildInputs = [ linuxHeaders ];
dontUnpack = true;
CFLAGS =
[
''-DSOURCE_PROG="${sourceProg}"''
]
++ (
if debug then
[
"-Werror"
"-Og"
"-g"
]
else
[
"-Wall"
"-O2"
]
);
CFLAGS = [
''-DSOURCE_PROG="${sourceProg}"''
]
++ (
if debug then
[
"-Werror"
"-Og"
"-g"
]
else
[
"-Wall"
"-O2"
]
);
dontStrip = debug;
installPhase = ''
mkdir -p $out/bin

83
nixos/modules/services/admin/oxidized.nix
View file

@ -97,51 +97,50 @@ in
isSystemUser = true;
};
systemd.tmpfiles.settings."10-oxidized" =
{
"${cfg.dataDir}" = {
d = {
mode = "0750";
user = cfg.user;
group = cfg.group;
};
};
"${cfg.dataDir}/.config" = {
d = {
mode = "0750";
user = cfg.user;
group = cfg.group;
};
};
"${cfg.dataDir}/.config/oxidized" = {
d = {
mode = "0750";
user = cfg.user;
group = cfg.group;
};
};
"${cfg.dataDir}/.config/oxidized/config" = {
"L+" = {
argument = "${cfg.configFile}";
user = cfg.user;
group = cfg.group;
};
};
}
// lib.optionalAttrs (cfg.routerDB != null) {
"${cfg.dataDir}/.config/oxidized/router.db" = {
"L+" = {
argument = "${cfg.routerDB}";
user = cfg.user;
group = cfg.group;
};
systemd.tmpfiles.settings."10-oxidized" = {
"${cfg.dataDir}" = {
d = {
mode = "0750";
user = cfg.user;
group = cfg.group;
};
};
"${cfg.dataDir}/.config" = {
d = {
mode = "0750";
user = cfg.user;
group = cfg.group;
};
};
"${cfg.dataDir}/.config/oxidized" = {
d = {
mode = "0750";
user = cfg.user;
group = cfg.group;
};
};
"${cfg.dataDir}/.config/oxidized/config" = {
"L+" = {
argument = "${cfg.configFile}";
user = cfg.user;
group = cfg.group;
};
};
}
// lib.optionalAttrs (cfg.routerDB != null) {
"${cfg.dataDir}/.config/oxidized/router.db" = {
"L+" = {
argument = "${cfg.routerDB}";
user = cfg.user;
group = cfg.group;
};
};
};
systemd.services.oxidized = {
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];

38
nixos/modules/services/admin/pgadmin.nix
View file

@ -157,24 +157,23 @@ in
config = lib.mkIf (cfg.enable) {
networking.firewall.allowedTCPPorts = lib.mkIf (cfg.openFirewall) [ cfg.port ];
services.pgadmin.settings =
{
DEFAULT_SERVER_PORT = cfg.port;
PASSWORD_LENGTH_MIN = cfg.minimumPasswordLength;
SERVER_MODE = true;
UPGRADE_CHECK_ENABLED = false;
}
// (lib.optionalAttrs cfg.openFirewall {
DEFAULT_SERVER = lib.mkDefault "::";
})
// (lib.optionalAttrs cfg.emailServer.enable {
MAIL_SERVER = cfg.emailServer.address;
MAIL_PORT = cfg.emailServer.port;
MAIL_USE_SSL = cfg.emailServer.useSSL;
MAIL_USE_TLS = cfg.emailServer.useTLS;
MAIL_USERNAME = cfg.emailServer.username;
SECURITY_EMAIL_SENDER = cfg.emailServer.sender;
});
services.pgadmin.settings = {
DEFAULT_SERVER_PORT = cfg.port;
PASSWORD_LENGTH_MIN = cfg.minimumPasswordLength;
SERVER_MODE = true;
UPGRADE_CHECK_ENABLED = false;
}
// (lib.optionalAttrs cfg.openFirewall {
DEFAULT_SERVER = lib.mkDefault "::";
})
// (lib.optionalAttrs cfg.emailServer.enable {
MAIL_SERVER = cfg.emailServer.address;
MAIL_PORT = cfg.emailServer.port;
MAIL_USE_SSL = cfg.emailServer.useSSL;
MAIL_USE_TLS = cfg.emailServer.useTLS;
MAIL_USERNAME = cfg.emailServer.username;
SECURITY_EMAIL_SENDER = cfg.emailServer.sender;
});
systemd.services.pgadmin = {
wantedBy = [ "multi-user.target" ];
@ -227,7 +226,8 @@ in
ExecStart = "${cfg.package}/bin/pgadmin4";
LoadCredential = [
"initial_password:${cfg.initialPasswordFile}"
] ++ lib.optional cfg.emailServer.enable "email_password:${cfg.emailServer.passwordFile}";
]
++ lib.optional cfg.emailServer.enable "email_password:${cfg.emailServer.passwordFile}";
};
};

18
nixos/modules/services/amqp/rabbitmq.nix
View file

@ -175,14 +175,13 @@ in
users.groups.rabbitmq.gid = config.ids.gids.rabbitmq;
services.rabbitmq.configItems =
{
"listeners.tcp.1" = lib.mkDefault "${cfg.listenAddress}:${toString cfg.port}";
}
// lib.optionalAttrs cfg.managementPlugin.enable {
"management.tcp.port" = toString cfg.managementPlugin.port;
"management.tcp.ip" = cfg.listenAddress;
};
services.rabbitmq.configItems = {
"listeners.tcp.1" = lib.mkDefault "${cfg.listenAddress}:${toString cfg.port}";
}
// lib.optionalAttrs cfg.managementPlugin.enable {
"management.tcp.port" = toString cfg.managementPlugin.port;
"management.tcp.ip" = cfg.listenAddress;
};
services.rabbitmq.plugins = lib.optional cfg.managementPlugin.enable "rabbitmq_management";
@ -213,7 +212,8 @@ in
RABBITMQ_ENABLED_PLUGINS_FILE = pkgs.writeText "enabled_plugins" ''
[ ${lib.concatStringsSep "," cfg.plugins} ].
'';
} // lib.optionalAttrs (cfg.config != "") { RABBITMQ_ADVANCED_CONFIG_FILE = advanced_config_file; };
}
// lib.optionalAttrs (cfg.config != "") { RABBITMQ_ADVANCED_CONFIG_FILE = advanced_config_file; };
serviceConfig = {
ExecStart = "${cfg.package}/sbin/rabbitmq-server";

19
nixos/modules/services/audio/gonic.nix
View file

@ -63,16 +63,15 @@ in
cfg.settings.playlists-path
cfg.settings.podcast-path
];
BindReadOnlyPaths =
[
# gonic can access scrobbling services
"-/etc/resolv.conf"
"${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
builtins.storeDir
]
++ cfg.settings.music-path
++ lib.optional (cfg.settings.tls-cert != null) cfg.settings.tls-cert
++ lib.optional (cfg.settings.tls-key != null) cfg.settings.tls-key;
BindReadOnlyPaths = [
# gonic can access scrobbling services
"-/etc/resolv.conf"
"${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
builtins.storeDir
]
++ cfg.settings.music-path
++ lib.optional (cfg.settings.tls-cert != null) cfg.settings.tls-cert
++ lib.optional (cfg.settings.tls-key != null) cfg.settings.tls-key;
CapabilityBoundingSet = "";
RestrictAddressFamilies = [
"AF_UNIX"

23
nixos/modules/services/audio/hqplayerd.nix
View file

@ -122,19 +122,18 @@ in
config.environment.etc."hqplayer/hqplayerd.xml".source
];
preStart =
''
cp -r "${pkg}/var/lib/hqplayer/web" "${stateDir}"
chmod -R u+wX "${stateDir}/web"
preStart = ''
cp -r "${pkg}/var/lib/hqplayer/web" "${stateDir}"
chmod -R u+wX "${stateDir}/web"
if [ ! -f "${configDir}/hqplayerd.xml" ]; then
echo "creating initial config file"
install -m 0644 "${pkg}/etc/hqplayer/hqplayerd.xml" "${configDir}/hqplayerd.xml"
fi
''
+ lib.optionalString (cfg.auth.username != null && cfg.auth.password != null) ''
${pkg}/bin/hqplayerd -s ${cfg.auth.username} ${cfg.auth.password}
'';
if [ ! -f "${configDir}/hqplayerd.xml" ]; then
echo "creating initial config file"
install -m 0644 "${pkg}/etc/hqplayer/hqplayerd.xml" "${configDir}/hqplayerd.xml"
fi
''
+ lib.optionalString (cfg.auth.username != null && cfg.auth.password != null) ''
${pkg}/bin/hqplayerd -s ${cfg.auth.username} ${cfg.auth.password}
'';
};
};

25
nixos/modules/services/audio/jack.nix
View file

@ -254,19 +254,18 @@ in
systemd.services.jack = {
description = "JACK Audio Connection Kit";
serviceConfig =
{
User = "jackaudio";
SupplementaryGroups = lib.optional (
config.services.pulseaudio.enable && !config.services.pulseaudio.systemWide
) "users";
ExecStart = "${cfg.jackd.package}/bin/jackd ${lib.escapeShellArgs cfg.jackd.extraOptions}";
LimitRTPRIO = 99;
LimitMEMLOCK = "infinity";
}
// lib.optionalAttrs umaskNeeded {
UMask = "007";
};
serviceConfig = {
User = "jackaudio";
SupplementaryGroups = lib.optional (
config.services.pulseaudio.enable && !config.services.pulseaudio.systemWide
) "users";
ExecStart = "${cfg.jackd.package}/bin/jackd ${lib.escapeShellArgs cfg.jackd.extraOptions}";
LimitRTPRIO = 99;
LimitMEMLOCK = "infinity";
}
// lib.optionalAttrs umaskNeeded {
UMask = "007";
};
path = [ cfg.jackd.package ];
environment = {
JACK_PROMISCUOUS_SERVER = "jackaudio";

25
nixos/modules/services/audio/mpd.nix
View file

@ -258,19 +258,18 @@ in
systemd.services.mpd = {
wantedBy = lib.optional (!cfg.startWhenNeeded) "multi-user.target";
preStart =
''
set -euo pipefail
install -m 600 ${mpdConf} /run/mpd/mpd.conf
''
+ lib.optionalString (cfg.credentials != [ ]) (
lib.concatStringsSep "\n" (
lib.imap0 (
i: c:
''${pkgs.replace-secret}/bin/replace-secret '{{password-${toString i}}}' '${c.passwordFile}' /run/mpd/mpd.conf''
) cfg.credentials
)
);
preStart = ''
set -euo pipefail
install -m 600 ${mpdConf} /run/mpd/mpd.conf
''
+ lib.optionalString (cfg.credentials != [ ]) (
lib.concatStringsSep "\n" (
lib.imap0 (
i: c:
''${pkgs.replace-secret}/bin/replace-secret '{{password-${toString i}}}' '${c.passwordFile}' /run/mpd/mpd.conf''
) cfg.credentials
)
);
serviceConfig = {
User = "${cfg.user}";

23
nixos/modules/services/audio/navidrome.nix
View file

@ -127,18 +127,17 @@ in
BindPaths =
optional (cfg.settings ? DataFolder) cfg.settings.DataFolder
++ optional (cfg.settings ? CacheFolder) cfg.settings.CacheFolder;
BindReadOnlyPaths =
[
# navidrome uses online services to download additional album metadata / covers
"${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
builtins.storeDir
"/etc"
]
++ optional (cfg.settings ? MusicFolder) cfg.settings.MusicFolder
++ lib.optionals config.services.resolved.enable [
"/run/systemd/resolve/stub-resolv.conf"
"/run/systemd/resolve/resolv.conf"
];
BindReadOnlyPaths = [
# navidrome uses online services to download additional album metadata / covers
"${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
builtins.storeDir
"/etc"
]
++ optional (cfg.settings ? MusicFolder) cfg.settings.MusicFolder
++ lib.optionals config.services.resolved.enable [
"/run/systemd/resolve/stub-resolv.conf"
"/run/systemd/resolve/resolv.conf"
];
CapabilityBoundingSet = "";
RestrictAddressFamilies = [
"AF_UNIX"

19
nixos/modules/services/audio/pulseaudio.nix
View file

@ -286,17 +286,16 @@ in
"pulse/default.pa".source = myConfigFile;
};
systemd.user = {
services.pulseaudio =
{
restartIfChanged = true;
serviceConfig = {
RestartSec = "500ms";
PassEnvironment = "DISPLAY";
};
}
// lib.optionalAttrs config.services.jack.jackd.enable {
environment.JACK_PROMISCUOUS_SERVER = "jackaudio";
services.pulseaudio = {
restartIfChanged = true;
serviceConfig = {
RestartSec = "500ms";
PassEnvironment = "DISPLAY";
};
}
// lib.optionalAttrs config.services.jack.jackd.enable {
environment.JACK_PROMISCUOUS_SERVER = "jackaudio";
};
sockets.pulseaudio = {
wantedBy = [ "sockets.target" ];
};

35
nixos/modules/services/backup/borgbackup.nix
View file

@ -165,22 +165,20 @@ let
CPUSchedulingPolicy = "idle";
IOSchedulingClass = "idle";
ProtectSystem = "strict";
ReadWritePaths =
[
"${userHome}/.config/borg"
"${userHome}/.cache/borg"
]
++ cfg.readWritePaths
# Borg needs write access to repo if it is not remote
++ lib.optional (isLocalPath cfg.repo) cfg.repo;
ReadWritePaths = [
"${userHome}/.config/borg"
"${userHome}/.cache/borg"
]
++ cfg.readWritePaths
# Borg needs write access to repo if it is not remote
++ lib.optional (isLocalPath cfg.repo) cfg.repo;
PrivateTmp = cfg.privateTmp;
};
environment =
{
BORG_REPO = cfg.repo;
}
// (mkPassEnv cfg)
// cfg.environment;
environment = {
BORG_REPO = cfg.repo;
}
// (mkPassEnv cfg)
// cfg.environment;
};
mkBackupTimers =
@ -223,7 +221,11 @@ let
mkWrapperDrv {
original = lib.getExe config.services.borgbackup.package;
name = "borg-job-${name}";
set = { BORG_REPO = cfg.repo; } // (mkPassEnv cfg) // cfg.environment;
set = {
BORG_REPO = cfg.repo;
}
// (mkPassEnv cfg)
// cfg.environment;
};
# Paths listed in ReadWritePaths must exist before service is started
@ -895,7 +897,8 @@ in
environment.systemPackages = [
config.services.borgbackup.package
] ++ (lib.mapAttrsToList mkBorgWrapper jobs);
]
++ (lib.mapAttrsToList mkBorgWrapper jobs);
}
);
}

13
nixos/modules/services/backup/btrbk.nix
View file

@ -354,12 +354,13 @@ in
value = {
description = "Takes BTRFS snapshots and maintains retention policies.";
unitConfig.Documentation = "man:btrbk(1)";
path =
[ "/run/wrappers" ]
++ cfg.extraPackages
++ optional (instance.settings.stream_compress != "no") (
getAttr instance.settings.stream_compress streamCompressMap
);
path = [
"/run/wrappers"
]
++ cfg.extraPackages
++ optional (instance.settings.stream_compress != "no") (
getAttr instance.settings.stream_compress streamCompressMap
);
serviceConfig = {
User = "btrbk";
Group = "btrbk";

138
nixos/modules/services/backup/duplicity.nix
View file

@ -162,82 +162,80 @@ in
config = lib.mkIf cfg.enable {
systemd = {
services.duplicity =
{
description = "backup files with duplicity";
services.duplicity = {
description = "backup files with duplicity";
environment.HOME = stateDirectory;
environment.HOME = stateDirectory;
script =
let
target = lib.escapeShellArg cfg.targetUrl;
extra = lib.escapeShellArgs (
script =
let
target = lib.escapeShellArg cfg.targetUrl;
extra = lib.escapeShellArgs (
[
"--archive-dir"
stateDirectory
]
++ cfg.extraFlags
);
dup = "${pkgs.duplicity}/bin/duplicity";
in
''
set -x
${dup} cleanup ${target} --force ${extra}
${lib.optionalString (
cfg.cleanup.maxAge != null
) "${dup} remove-older-than ${lib.escapeShellArg cfg.cleanup.maxAge} ${target} --force ${extra}"}
${lib.optionalString (
cfg.cleanup.maxFull != null
) "${dup} remove-all-but-n-full ${toString cfg.cleanup.maxFull} ${target} --force ${extra}"}
${lib.optionalString (
cfg.cleanup.maxIncr != null
) "${dup} remove-all-inc-of-but-n-full ${toString cfg.cleanup.maxIncr} ${target} --force ${extra}"}
exec ${dup} ${if cfg.fullIfOlderThan == "always" then "full" else "incr"} ${
lib.escapeShellArgs (
[
"--archive-dir"
stateDirectory
cfg.root
cfg.targetUrl
]
++ cfg.extraFlags
);
dup = "${pkgs.duplicity}/bin/duplicity";
in
''
set -x
${dup} cleanup ${target} --force ${extra}
${lib.optionalString (
cfg.cleanup.maxAge != null
) "${dup} remove-older-than ${lib.escapeShellArg cfg.cleanup.maxAge} ${target} --force ${extra}"}
${lib.optionalString (
cfg.cleanup.maxFull != null
) "${dup} remove-all-but-n-full ${toString cfg.cleanup.maxFull} ${target} --force ${extra}"}
${lib.optionalString (
cfg.cleanup.maxIncr != null
) "${dup} remove-all-inc-of-but-n-full ${toString cfg.cleanup.maxIncr} ${target} --force ${extra}"}
exec ${dup} ${if cfg.fullIfOlderThan == "always" then "full" else "incr"} ${
lib.escapeShellArgs (
[
cfg.root
cfg.targetUrl
]
++ lib.optionals (cfg.includeFileList != null) [
"--include-filelist"
cfg.includeFileList
]
++ lib.optionals (cfg.excludeFileList != null) [
"--exclude-filelist"
cfg.excludeFileList
]
++ lib.concatMap (p: [
"--include"
p
]) cfg.include
++ lib.concatMap (p: [
"--exclude"
p
]) cfg.exclude
++ (lib.optionals (cfg.fullIfOlderThan != "never" && cfg.fullIfOlderThan != "always") [
"--full-if-older-than"
cfg.fullIfOlderThan
])
)
} ${extra}
'';
serviceConfig =
{
PrivateTmp = true;
ProtectSystem = "strict";
ProtectHome = "read-only";
StateDirectory = baseNameOf stateDirectory;
}
// lib.optionalAttrs (localTarget != null) {
ReadWritePaths = localTarget;
}
// lib.optionalAttrs (cfg.secretFile != null) {
EnvironmentFile = cfg.secretFile;
};
++ lib.optionals (cfg.includeFileList != null) [
"--include-filelist"
cfg.includeFileList
]
++ lib.optionals (cfg.excludeFileList != null) [
"--exclude-filelist"
cfg.excludeFileList
]
++ lib.concatMap (p: [
"--include"
p
]) cfg.include
++ lib.concatMap (p: [
"--exclude"
p
]) cfg.exclude
++ (lib.optionals (cfg.fullIfOlderThan != "never" && cfg.fullIfOlderThan != "always") [
"--full-if-older-than"
cfg.fullIfOlderThan
])
)
} ${extra}
'';
serviceConfig = {
PrivateTmp = true;
ProtectSystem = "strict";
ProtectHome = "read-only";
StateDirectory = baseNameOf stateDirectory;
}
// lib.optionalAttrs (cfg.frequency != null) {
startAt = cfg.frequency;
// lib.optionalAttrs (localTarget != null) {
ReadWritePaths = localTarget;
}
// lib.optionalAttrs (cfg.secretFile != null) {
EnvironmentFile = cfg.secretFile;
};
}
// lib.optionalAttrs (cfg.frequency != null) {
startAt = cfg.frequency;
};
tmpfiles.rules = lib.optional (localTarget != null) "d ${localTarget} 0700 root root -";
};

13
nixos/modules/services/backup/pgbackrest.nix
View file

@ -52,13 +52,12 @@ let
))
];
fullConfig =
{
global = normalize (cfg.settings // flattenWithIndex cfg.repos "repo");
}
// lib.mapAttrs (
_: cfg': normalize (cfg'.settings // flattenWithIndex cfg'.instances "pg")
) cfg.stanzas;
fullConfig = {
global = normalize (cfg.settings // flattenWithIndex cfg.repos "repo");
}
// lib.mapAttrs (
_: cfg': normalize (cfg'.settings // flattenWithIndex cfg'.instances "pg")
) cfg.stanzas;
namedJobs = lib.listToAttrs (
lib.flatten (

86
nixos/modules/services/backup/restic.nix
View file

@ -367,54 +367,52 @@ in
in
lib.nameValuePair "restic-backups-${name}" (
{
environment =
{
# not %C, because that wouldn't work in the wrapper script
RESTIC_CACHE_DIR = "/var/cache/restic-backups-${name}";
RESTIC_PASSWORD_FILE = backup.passwordFile;
RESTIC_REPOSITORY = backup.repository;
RESTIC_REPOSITORY_FILE = backup.repositoryFile;
}
// lib.optionalAttrs (backup.rcloneOptions != null) (
lib.mapAttrs' (
name: value: lib.nameValuePair (rcloneAttrToOpt name) (toRcloneVal value)
) backup.rcloneOptions
)
// lib.optionalAttrs (backup.rcloneConfigFile != null) {
RCLONE_CONFIG = backup.rcloneConfigFile;
}
// lib.optionalAttrs (backup.rcloneConfig != null) (
lib.mapAttrs' (
name: value: lib.nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
) backup.rcloneConfig
)
// lib.optionalAttrs (backup.progressFps != null) {
RESTIC_PROGRESS_FPS = toString backup.progressFps;
};
environment = {
# not %C, because that wouldn't work in the wrapper script
RESTIC_CACHE_DIR = "/var/cache/restic-backups-${name}";
RESTIC_PASSWORD_FILE = backup.passwordFile;
RESTIC_REPOSITORY = backup.repository;
RESTIC_REPOSITORY_FILE = backup.repositoryFile;
}
// lib.optionalAttrs (backup.rcloneOptions != null) (
lib.mapAttrs' (
name: value: lib.nameValuePair (rcloneAttrToOpt name) (toRcloneVal value)
) backup.rcloneOptions
)
// lib.optionalAttrs (backup.rcloneConfigFile != null) {
RCLONE_CONFIG = backup.rcloneConfigFile;
}
// lib.optionalAttrs (backup.rcloneConfig != null) (
lib.mapAttrs' (
name: value: lib.nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
) backup.rcloneConfig
)
// lib.optionalAttrs (backup.progressFps != null) {
RESTIC_PROGRESS_FPS = toString backup.progressFps;
};
path = [ config.programs.ssh.package ];
restartIfChanged = false;
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
serviceConfig =
{
Type = "oneshot";
ExecStart =
(lib.optionals doBackup [
"${resticCmd} backup ${
lib.concatStringsSep " " (backup.extraBackupArgs ++ excludeFlags)
} --files-from=${filesFromTmpFile}"
])
++ pruneCmd
++ checkCmd;
User = backup.user;
RuntimeDirectory = "restic-backups-${name}";
CacheDirectory = "restic-backups-${name}";
CacheDirectoryMode = "0700";
PrivateTmp = true;
}
// lib.optionalAttrs (backup.environmentFile != null) {
EnvironmentFile = backup.environmentFile;
};
serviceConfig = {
Type = "oneshot";
ExecStart =
(lib.optionals doBackup [
"${resticCmd} backup ${
lib.concatStringsSep " " (backup.extraBackupArgs ++ excludeFlags)
} --files-from=${filesFromTmpFile}"
])
++ pruneCmd
++ checkCmd;
User = backup.user;
RuntimeDirectory = "restic-backups-${name}";
CacheDirectory = "restic-backups-${name}";
CacheDirectoryMode = "0700";
PrivateTmp = true;
}
// lib.optionalAttrs (backup.environmentFile != null) {
EnvironmentFile = backup.environmentFile;
};
}
// lib.optionalAttrs (backup.initialize || doBackup || backup.backupPrepareCommand != null) {
preStart = ''

83
nixos/modules/services/backup/snapraid.nix
View file

@ -191,50 +191,49 @@ in
snapraid-sync = {
description = "Synchronize the state of the SnapRAID array";
startAt = sync.interval;
serviceConfig =
{
Type = "oneshot";
ExecStart = "${pkgs.snapraid}/bin/snapraid sync";
Nice = 19;
IOSchedulingPriority = 7;
CPUSchedulingPolicy = "batch";
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.snapraid}/bin/snapraid sync";
Nice = 19;
IOSchedulingPriority = 7;
CPUSchedulingPolicy = "batch";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = "none";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = "@system-service";
SystemCallErrorNumber = "EPERM";
CapabilityBoundingSet = "CAP_DAC_OVERRIDE" + lib.optionalString cfg.touchBeforeSync " CAP_FOWNER";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = "none";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = "@system-service";
SystemCallErrorNumber = "EPERM";
CapabilityBoundingSet = "CAP_DAC_OVERRIDE" + lib.optionalString cfg.touchBeforeSync " CAP_FOWNER";
ProtectSystem = "strict";
ProtectHome = "read-only";
ReadWritePaths =
# sync requires access to directories containing content files
# to remove them if they are stale
let
contentDirs = map dirOf contentFiles;
# Multiple "split" parity files can be specified in a single
# "parityFile", separated by a comma.
# https://www.snapraid.it/manual#7.1
splitParityFiles = map (s: lib.splitString "," s) parityFiles;
in
lib.unique (lib.attrValues dataDisks ++ splitParityFiles ++ contentDirs);
}
// lib.optionalAttrs touchBeforeSync {
ExecStartPre = "${pkgs.snapraid}/bin/snapraid touch";
};
ProtectSystem = "strict";
ProtectHome = "read-only";
ReadWritePaths =
# sync requires access to directories containing content files
# to remove them if they are stale
let
contentDirs = map dirOf contentFiles;
# Multiple "split" parity files can be specified in a single
# "parityFile", separated by a comma.
# https://www.snapraid.it/manual#7.1
splitParityFiles = map (s: lib.splitString "," s) parityFiles;
in
lib.unique (lib.attrValues dataDisks ++ splitParityFiles ++ contentDirs);
}
// lib.optionalAttrs touchBeforeSync {
ExecStartPre = "${pkgs.snapraid}/bin/snapraid touch";
};
};
};
};

6
nixos/modules/services/cluster/druid/default.nix
View file

@ -253,7 +253,8 @@ in
tmpDirs = [
(attrByPath [ "druid.lookup.snapshotWorkingDir" ] "" cfg."${name}".config)
] ++ (map (x: x.path) cfg."${name}".segmentLocations);
]
++ (map (x: x.path) cfg."${name}".segmentLocations);
allowedTCPPorts = [ (attrByPath [ "druid.plaintextPort" ] 8083 cfg."${name}".config) ];
@ -266,7 +267,8 @@ in
tmpDirs = [
"/var/log/druid/indexer"
] ++ [ (attrByPath [ "druid.indexer.task.baseTaskDir" ] "" cfg."${name}".config) ];
]
++ [ (attrByPath [ "druid.indexer.task.baseTaskDir" ] "" cfg."${name}".config) ];
allowedTCPPorts = [ (attrByPath [ "druid.plaintextPort" ] 8091 cfg."${name}".config) ];

101
nixos/modules/services/cluster/hadoop/hbase.nix
View file

@ -146,65 +146,64 @@ in
'';
};
hbase =
{
hbase = {
package = lib.mkPackageOption pkgs "hbase" { };
package = lib.mkPackageOption pkgs "hbase" { };
rootdir = lib.mkOption {
description = ''
This option will set "hbase.rootdir" in hbase-site.xml and determine
the directory shared by region servers and into which HBase persists.
The URL should be 'fully-qualified' to include the filesystem scheme.
If a core-site.xml is provided, the FS scheme defaults to the value
of "fs.defaultFS".
rootdir = lib.mkOption {
description = ''
This option will set "hbase.rootdir" in hbase-site.xml and determine
the directory shared by region servers and into which HBase persists.
The URL should be 'fully-qualified' to include the filesystem scheme.
If a core-site.xml is provided, the FS scheme defaults to the value
of "fs.defaultFS".
Filesystems other than HDFS (like S3, QFS, Swift) are also supported.
'';
type = lib.types.str;
example = "hdfs://nameservice1/hbase";
default = "/hbase";
Filesystems other than HDFS (like S3, QFS, Swift) are also supported.
'';
type = lib.types.str;
example = "hdfs://nameservice1/hbase";
default = "/hbase";
};
zookeeperQuorum = lib.mkOption {
description = ''
This option will set "hbase.zookeeper.quorum" in hbase-site.xml.
Comma separated list of servers in the ZooKeeper ensemble.
'';
type = with lib.types; nullOr commas;
example = "zk1.internal,zk2.internal,zk3.internal";
default = null;
};
}
// (
let
ports = port: infoPort: {
port = lib.mkOption {
type = lib.types.int;
default = port;
description = "RPC port";
};
infoPort = lib.mkOption {
type = lib.types.int;
default = infoPort;
description = "web UI port";
};
};
zookeeperQuorum = lib.mkOption {
in
lib.mapAttrs hbaseRoleOption {
master.initHDFS = lib.mkEnableOption "initialization of the hbase directory on HDFS";
regionServer.overrideHosts = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
This option will set "hbase.zookeeper.quorum" in hbase-site.xml.
Comma separated list of servers in the ZooKeeper ensemble.
Remove /etc/hosts entries for "127.0.0.2" and "::1" defined in nixos/modules/config/networking.nix
Regionservers must be able to resolve their hostnames to their IP addresses, through PTR records
or /etc/hosts entries.
'';
type = with lib.types; nullOr commas;
example = "zk1.internal,zk2.internal,zk3.internal";
default = null;
};
thrift = ports 9090 9095;
rest = ports 8080 8085;
}
// (
let
ports = port: infoPort: {
port = lib.mkOption {
type = lib.types.int;
default = port;
description = "RPC port";
};
infoPort = lib.mkOption {
type = lib.types.int;
default = infoPort;
description = "web UI port";
};
};
in
lib.mapAttrs hbaseRoleOption {
master.initHDFS = lib.mkEnableOption "initialization of the hbase directory on HDFS";
regionServer.overrideHosts = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Remove /etc/hosts entries for "127.0.0.2" and "::1" defined in nixos/modules/config/networking.nix
Regionservers must be able to resolve their hostnames to their IP addresses, through PTR records
or /etc/hosts entries.
'';
};
thrift = ports 9090 9095;
rest = ports 8080 8085;
}
);
);
};
config = lib.mkMerge (

Some files were not shown because too many files have changed in this diff Show more