diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 0c06c59f37800db6d9a8364fe607adf2eeb23d28..3392fa5dab9572ec99b1015d6332251b6fd0febb 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -14,7 +14,9 @@
/lib @edolstra @nbp @infinisil
/lib/systems @nbp @ericson2314 @matthewbauer
/lib/generators.nix @edolstra @nbp @Profpatsch
+/lib/cli.nix @edolstra @nbp @Profpatsch
/lib/debug.nix @edolstra @nbp @Profpatsch
+/lib/asserts.nix @edolstra @nbp @Profpatsch
# Nixpkgs Internals
/default.nix @nbp
@@ -162,7 +164,7 @@
/pkgs/top-level/emacs-packages.nix @adisbladis
# VimPlugins
-/pkgs/misc/vim-plugins @jonringer
+/pkgs/misc/vim-plugins @jonringer @softinio
# VsCode Extensions
/pkgs/misc/vscode-extensions @jonringer
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 706952b208db1080bd5734cebf28f292d17b8d3e..a50a8a507de346115e886cae859ee95e7f0932dc 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -48,6 +48,15 @@ In addition to writing properly formatted commit messages, it's important to inc
For package version upgrades and such a one-line commit message is usually sufficient.
+## Backporting changes
+
+To [backport a change into a release branch](https://nixos.org/nixpkgs/manual/#submitting-changes-stable-release-branches):
+
+1. Take note of the commit in which the change was introduced into `master`.
+2. Check out the target _release branch_, e.g. `release-19.09`. Do not use a _channel branch_ like `nixos-19.09` or `nixpkgs-19.09`.
+3. Use `git cherry-pick -x `.
+4. Open your backport PR. Make sure to select the release branch (e.g. `release-19.09`) as the target branch of the PR, and link to the PR in which the original change was made to `master`.
+
## Reviewing contributions
See the nixpkgs manual for more details on how to [Review contributions](https://nixos.org/nixpkgs/manual/#chap-reviewing-contributions).
diff --git a/doc/builders/images/appimagetools.xml b/doc/builders/images/appimagetools.xml
index 37e4251cda2ea87a605b9875ab3c35af0e6e1f18..0767a509a43dbd3e6bab64abba3eebad6547813b 100644
--- a/doc/builders/images/appimagetools.xml
+++ b/doc/builders/images/appimagetools.xml
@@ -80,7 +80,7 @@ appimageTools.wrapType2 { # or wrapType1
src specifies the AppImage file to extract.
-
+ extraPkgs allows you to pass a function to include additional packages inside the FHS environment your AppImage is going to run in. There are a few ways to learn which dependencies an application needs:
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 41a5dae8b9b034d2596503206974e3abb7f5f02b..e183bd8160dad47940e3b0915f46c123cbdcc56c 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -496,8 +496,8 @@ and in this case the `python35` interpreter is automatically used.
### Interpreters
-Versions 2.7, 3.5, 3.6 and 3.7 of the CPython interpreter are available as
-respectively `python27`, `python35`, `python36` and `python37`. The aliases
+Versions 2.7, 3.5, 3.6, 3.7 and 3.8 of the CPython interpreter are available as
+respectively `python27`, `python35`, `python36`, `python37` and `python38`. The aliases
`python2` and `python3` correspond to respectively `python27` and
`python37`. The default interpreter, `python`, maps to `python2`. The PyPy
interpreters compatible with Python 2.7 and 3 are available as `pypy27` and
@@ -833,6 +833,7 @@ used in `buildPythonPackage`.
- `pythonRemoveBinBytecode` to remove bytecode from the `/bin` folder.
- `setuptoolsBuildHook` to build a wheel using `setuptools`.
- `setuptoolsCheckHook` to run tests with `python setup.py test`.
+- `venvShellHook` to source a Python 3 `venv` at the `venvDir` location. A `venv` is created if it does not yet exist.
- `wheelUnpackHook` to move a wheel to the correct folder so it can be installed with the `pipInstallHook`.
### Development mode
@@ -1028,36 +1029,41 @@ If you want to create a Python environment for development, then the recommended
method is to use `nix-shell`, either with or without the `python.buildEnv`
function.
-### How to consume python modules using pip in a virtualenv like I am used to on other Operating Systems ?
+### How to consume python modules using pip in a virtual environment like I am used to on other Operating Systems?
-This is an example of a `default.nix` for a `nix-shell`, which allows to consume a `virtualenv` environment,
+While this approach is not very idiomatic from Nix perspective, it can still be useful when dealing with pre-existing
+projects or in situations where it's not feasible or desired to write derivations for all required dependencies.
+
+This is an example of a `default.nix` for a `nix-shell`, which allows to consume a virtual environment created by `venv`,
and install python modules through `pip` the traditional way.
Create this `default.nix` file, together with a `requirements.txt` and simply execute `nix-shell`.
```nix
-with import {};
+with import { };
let
- pythonPackages = python27Packages;
-in
-
-stdenv.mkDerivation {
+ pythonPackages = python3Packages;
+in pkgs.mkShell rec {
name = "impurePythonEnv";
-
- src = null;
-
+ venvDir = "./.venv";
buildInputs = [
- # these packages are required for virtualenv and pip to work:
- #
- pythonPackages.virtualenv
- pythonPackages.pip
- # the following packages are related to the dependencies of your python
- # project.
- # In this particular example the python modules listed in the
- # requirements.txt require the following packages to be installed locally
- # in order to compile any binary extensions they may require.
- #
+ # A python interpreter including the 'venv' module is required to bootstrap
+ # the environment.
+ pythonPackages.python
+
+ # This execute some shell code to initialize a venv in $venvDir before
+ # dropping into the shell
+ pythonPackages.venvShellHook
+
+ # Those are dependencies that we would like to use from nixpkgs, which will
+ # add them to PYTHONPATH and thus make them accessible from within the venv.
+ pythonPackages.numpy
+ pythonPackages.requests
+
+ # In this particular example, in order to compile any binary extensions they may
+ # require, the python modules listed in the hypothetical requirements.txt need
+ # the following packages to be installed locally:
taglib
openssl
git
@@ -1067,11 +1073,54 @@ stdenv.mkDerivation {
zlib
];
+ # Now we can execute any commands within the virtual environment.
+ # This is optional and can be left out to run pip manually.
+ postShellHook = ''
+ pip install -r requirements.txt
+ '';
+
+}
+```
+
+In case the supplied venvShellHook is insufficient, or when python 2 support is needed,
+you can define your own shell hook and adapt to your needs like in the following example:
+
+```nix
+with import { };
+
+let
+ venvDir = "./.venv";
+ pythonPackages = python3Packages;
+in pkgs.mkShell rec {
+ name = "impurePythonEnv";
+ buildInputs = [
+ pythonPackages.python
+ # Needed when using python 2.7
+ # pythonPackages.virtualenv
+ # ...
+ ];
+
+ # This is very close to how venvShellHook is implemented, but
+ # adapted to use 'virtualenv'
shellHook = ''
- # set SOURCE_DATE_EPOCH so that we can use python wheels
SOURCE_DATE_EPOCH=$(date +%s)
- virtualenv --python=${pythonPackages.python.interpreter} --no-setuptools venv
- export PATH=$PWD/venv/bin:$PATH
+
+ if [ -d "${venvDir}" ]; then
+ echo "Skipping venv creation, '${venvDir}' already exists"
+ else
+ echo "Creating new venv environment in path: '${venvDir}'"
+ # Note that the module venv was only introduced in python 3, so for 2.7
+ # this needs to be replaced with a call to virtualenv
+ ${pythonPackages.python.interpreter} -m venv "${venvDir}"
+ fi
+
+ # Under some circumstances it might be necessary to add your virtual
+ # environment to PYTHONPATH, which you can do here too;
+ # PYTHONPATH=$PWD/${venvDir}/${pythonPackages.python.sitePackages}/:$PYTHONPATH
+
+ source "${venvDir}/bin/activate"
+
+ # As in the previous example, this is optional.
pip install -r requirements.txt
'';
}
diff --git a/doc/languages-frameworks/rust.section.md b/doc/languages-frameworks/rust.section.md
index 0edf03ad26a98bd512b636983b21cb8705ea0dd8..3332dff1eb078dc380d71ca7771c77c226d25d0b 100644
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@@ -16,12 +16,6 @@ cargo
into the `environment.systemPackages` or bring them into
scope with `nix-shell -p rustc cargo`.
-> If you are using NixOS and you want to use rust without a nix expression you
-> probably want to add the following in your `configuration.nix` to build
-> crates with C dependencies.
->
-> environment.systemPackages = [binutils gcc gnumake openssl pkgconfig]
-
For daily builds (beta and nightly) use either rustup from
nixpkgs or use the [Rust nightlies
overlay](#using-the-rust-nightlies-overlay).
diff --git a/doc/overrides.css b/doc/overrides.css
index 4c7d4a31be2d09210f8dfeb67eb3ba85b98a42d3..73901a3f543bf9269eaf2654997ff5856cce65f8 100644
--- a/doc/overrides.css
+++ b/doc/overrides.css
@@ -1,9 +1,22 @@
.docbook .xref img[src^=images\/callouts\/],
.screen img,
-.programlisting img {
+.programlisting img,
+.literallayout img,
+.synopsis img {
width: 1em;
}
.calloutlist img {
width: 1.5em;
}
+
+.prompt,
+.screen img,
+.programlisting img,
+.literallayout img,
+.synopsis img {
+ -moz-user-select: none;
+ -webkit-user-select: none;
+ -ms-user-select: none;
+ user-select: none;
+}
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 086c3d746fc187873ecede9c7e433526936d849a..32994432d53d62dafa32e13e9e22e81727ff31cb 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -60,7 +60,7 @@ rec {
[ { name = head attrPath; value = setAttrByPath (tail attrPath) value; } ];
- /* Like `getAttrPath' without a default value. If it doesn't find the
+ /* Like `attrByPath' without a default value. If it doesn't find the
path it will throw.
Example:
diff --git a/lib/cli.nix b/lib/cli.nix
new file mode 100644
index 0000000000000000000000000000000000000000..c96d4dbb0432dd3cab8ac388b9de1c955d46d42a
--- /dev/null
+++ b/lib/cli.nix
@@ -0,0 +1,83 @@
+{ lib }:
+
+rec {
+ /* Automatically convert an attribute set to command-line options.
+
+ This helps protect against malformed command lines and also to reduce
+ boilerplate related to command-line construction for simple use cases.
+
+ `toGNUCommandLine` returns a list of nix strings.
+ `toGNUCommandLineShell` returns an escaped shell string.
+
+ Example:
+ cli.toGNUCommandLine {} {
+ data = builtins.toJSON { id = 0; };
+ X = "PUT";
+ retry = 3;
+ retry-delay = null;
+ url = [ "https://example.com/foo" "https://example.com/bar" ];
+ silent = false;
+ verbose = true;
+ }
+ => [
+ "-X" "PUT"
+ "--data" "{\"id\":0}"
+ "--retry" "3"
+ "--url" "https://example.com/foo"
+ "--url" "https://example.com/bar"
+ "--verbose"
+ ]
+
+ cli.toGNUCommandLineShell {} {
+ data = builtins.toJSON { id = 0; };
+ X = "PUT";
+ retry = 3;
+ retry-delay = null;
+ url = [ "https://example.com/foo" "https://example.com/bar" ];
+ silent = false;
+ verbose = true;
+ }
+ => "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'";
+ */
+ toGNUCommandLineShell =
+ options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
+
+ toGNUCommandLine = {
+ # how to string-format the option name;
+ # by default one character is a short option (`-`),
+ # more than one characters a long option (`--`).
+ mkOptionName ?
+ k: if builtins.stringLength k == 1
+ then "-${k}"
+ else "--${k}",
+
+ # how to format a boolean value to a command list;
+ # by default it’s a flag option
+ # (only the option name if true, left out completely if false).
+ mkBool ? k: v: lib.optional v (mkOptionName k),
+
+ # how to format a list value to a command list;
+ # by default the option name is repeated for each value
+ # and `mkOption` is applied to the values themselves.
+ mkList ? k: v: lib.concatMap (mkOption k) v,
+
+ # how to format any remaining value to a command list;
+ # on the toplevel, booleans and lists are handled by `mkBool` and `mkList`,
+ # though they can still appear as values of a list.
+ # By default, everything is printed verbatim and complex types
+ # are forbidden (lists, attrsets, functions). `null` values are omitted.
+ mkOption ?
+ k: v: if v == null
+ then []
+ else [ (mkOptionName k) (lib.generators.mkValueStringDefault {} v) ]
+ }:
+ options:
+ let
+ render = k: v:
+ if builtins.isBool v then mkBool k v
+ else if builtins.isList v then mkList k v
+ else mkOption k v;
+
+ in
+ builtins.concatLists (lib.mapAttrsToList render options);
+}
diff --git a/lib/default.nix b/lib/default.nix
index 9f7a088d792dedfbc1d8a43768740c3baa87c199..d2fe018aa6af42055f4572501d464493d03ee4e6 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -37,10 +37,13 @@ let
licenses = callLibs ./licenses.nix;
systems = callLibs ./systems;
+ # serialization
+ cli = callLibs ./cli.nix;
+ generators = callLibs ./generators.nix;
+
# misc
asserts = callLibs ./asserts.nix;
debug = callLibs ./debug.nix;
- generators = callLibs ./generators.nix;
misc = callLibs ./deprecated.nix;
# domain-specific
@@ -100,7 +103,7 @@ let
inherit (sources) pathType pathIsDirectory cleanSourceFilter
cleanSource sourceByRegex sourceFilesBySuffices
commitIdFromGitRepo cleanSourceWith pathHasContext
- canCleanSource;
+ canCleanSource pathIsRegularFile pathIsGitRepo;
inherit (modules) evalModules unifyModuleSyntax
applyIfFunction mergeModules
mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
diff --git a/lib/generators.nix b/lib/generators.nix
index a71654bec6c3673bd9f64202b4918818ec518833..a64e94bd5cbdfecfca54a70f717e96c0c92cbbe8 100644
--- a/lib/generators.nix
+++ b/lib/generators.nix
@@ -46,7 +46,10 @@ rec {
else if isList v then err "lists" v
# same as for lists, might want to replace
else if isAttrs v then err "attrsets" v
+ # functions can’t be printed of course
else if isFunction v then err "functions" v
+ # let’s not talk about floats. There is no sensible `toString` for them.
+ else if isFloat v then err "floats" v
else err "this value is" (toString v);
diff --git a/lib/licenses.nix b/lib/licenses.nix
index 986b7fa1fdd9df83e37dab9a2999469f64b2a56d..e2f94e565ce27d7688ed5a1fad13ae7506497821 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -536,11 +536,6 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
fullName = "University of Illinois/NCSA Open Source License";
};
- notion_lgpl = {
- url = "https://raw.githubusercontent.com/raboof/notion/master/LICENSE";
- fullName = "Notion modified LGPL";
- };
-
nposl3 = spdx {
spdxId = "NPOSL-3.0";
fullName = "Non-Profit Open Software License 3.0";
diff --git a/lib/modules.nix b/lib/modules.nix
index e2315290ff0dcb34f299cfd821c861f44444fb3a..2b1faf4f0c28ee1a14e85e7fd957418d6c9aea71 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -764,12 +764,15 @@ rec {
fromOpt = getAttrFromPath from options;
toOf = attrByPath to
(abort "Renaming error: option `${showOption to}' does not exist.");
+ toType = let opt = attrByPath to {} options; in opt.type or null;
in
{
options = setAttrByPath from (mkOption {
inherit visible;
description = "Alias of .";
apply = x: use (toOf config);
+ } // optionalAttrs (toType != null) {
+ type = toType;
});
config = mkMerge [
{
diff --git a/lib/sources.nix b/lib/sources.nix
index 51bcf5559e3216ab97aa88eb261eebbed4c54b04..05519c3e392e263f5f27e51488363c59cdba5edf 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -9,6 +9,9 @@ rec {
# Returns true if the path exists and is a directory, false otherwise
pathIsDirectory = p: if builtins.pathExists p then (pathType p) == "directory" else false;
+ # Returns true if the path exists and is a regular file, false otherwise
+ pathIsRegularFile = p: if builtins.pathExists p then (pathType p) == "regular" else false;
+
# Bring in a path as a source, filtering out all Subversion and CVS
# directories, as well as backup files (*~).
cleanSourceFilter = name: type: let baseName = baseNameOf (toString name); in ! (
@@ -102,6 +105,7 @@ rec {
in type == "directory" || lib.any (ext: lib.hasSuffix ext base) exts;
in cleanSourceWith { inherit filter; src = path; };
+ pathIsGitRepo = path: (builtins.tryEval (commitIdFromGitRepo path)).success;
# Get the commit id of a git repo
# Example: commitIdFromGitRepo
@@ -110,24 +114,45 @@ rec {
with builtins;
let fileName = toString path + "/" + file;
packedRefsName = toString path + "/packed-refs";
- in if lib.pathExists fileName
+ absolutePath = base: path:
+ if lib.hasPrefix "/" path
+ then path
+ else toString (/. + "${base}/${path}");
+ in if pathIsRegularFile path
+ # Resolve git worktrees. See gitrepository-layout(5)
+ then
+ let m = match "^gitdir: (.*)$" (lib.fileContents path);
+ in if m == null
+ then throw ("File contains no gitdir reference: " + path)
+ else
+ let gitDir = absolutePath (dirOf path) (lib.head m);
+ commonDir' = if pathIsRegularFile "${gitDir}/commondir"
+ then lib.fileContents "${gitDir}/commondir"
+ else gitDir;
+ commonDir = absolutePath gitDir commonDir';
+ refFile = lib.removePrefix "${commonDir}/" "${gitDir}/${file}";
+ in readCommitFromFile refFile commonDir
+
+ else if pathIsRegularFile fileName
+ # Sometimes git stores the commitId directly in the file but
+ # sometimes it stores something like: «ref: refs/heads/branch-name»
then
let fileContent = lib.fileContents fileName;
- # Sometimes git stores the commitId directly in the file but
- # sometimes it stores something like: «ref: refs/heads/branch-name»
matchRef = match "^ref: (.*)$" fileContent;
- in if matchRef == null
+ in if matchRef == null
then fileContent
else readCommitFromFile (lib.head matchRef) path
+
+ else if pathIsRegularFile packedRefsName
# Sometimes, the file isn't there at all and has been packed away in the
# packed-refs file, so we have to grep through it:
- else if lib.pathExists packedRefsName
then
let fileContent = readFile packedRefsName;
matchRef = match (".*\n([^\n ]*) " + file + "\n.*") fileContent;
- in if matchRef == null
+ in if matchRef == null
then throw ("Could not find " + file + " in " + packedRefsName)
else lib.head matchRef
+
else throw ("Not a .git directory: " + path);
in readCommitFromFile "HEAD";
diff --git a/lib/strings.nix b/lib/strings.nix
index 6dbb3d3a3e8b69c40fb5c65cfab5a654e125ee38..4f9509ffe7c078cab00aaf7e2eb233e49579bf68 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -244,7 +244,7 @@ rec {
Also note that Nix treats strings as a list of bytes and thus doesn't
handle unicode.
- Type: stringtoCharacters :: string -> [string]
+ Type: stringToCharacters :: string -> [string]
Example:
stringToCharacters ""
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 026117cc34fd2317fcfabc04af57d805f569f531..36afdae386685a938d408ed86557f51b6b0334c2 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -84,7 +84,7 @@ rec {
else final.parsed.cpu.name;
qemuArch =
- if final.isArm then "arm"
+ if final.isAarch32 then "arm"
else if final.isx86_64 then "x86_64"
else if final.isx86 then "i386"
else {
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index cb8bc3de6c4894aa8a531ac5a280857ca8053159..19b3790ecbe0e599fa14b962d1c6adc990b817c6 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -170,8 +170,8 @@ rec {
iphone64 = {
config = "aarch64-apple-ios";
# config = "aarch64-apple-darwin14";
- sdkVer = "10.2";
- xcodeVer = "8.2";
+ sdkVer = "12.4";
+ xcodeVer = "10.3";
xcodePlatform = "iPhoneOS";
useiOSPrebuilt = true;
platform = {};
@@ -180,8 +180,8 @@ rec {
iphone32 = {
config = "armv7a-apple-ios";
# config = "arm-apple-darwin10";
- sdkVer = "10.2";
- xcodeVer = "8.2";
+ sdkVer = "12.4";
+ xcodeVer = "10.3";
xcodePlatform = "iPhoneOS";
useiOSPrebuilt = true;
platform = {};
@@ -190,8 +190,8 @@ rec {
iphone64-simulator = {
config = "x86_64-apple-ios";
# config = "x86_64-apple-darwin14";
- sdkVer = "10.2";
- xcodeVer = "8.2";
+ sdkVer = "12.4";
+ xcodeVer = "10.3";
xcodePlatform = "iPhoneSimulator";
useiOSPrebuilt = true;
platform = {};
@@ -200,8 +200,8 @@ rec {
iphone32-simulator = {
config = "i686-apple-ios";
# config = "i386-apple-darwin11";
- sdkVer = "10.2";
- xcodeVer = "8.2";
+ sdkVer = "12.4";
+ xcodeVer = "10.3";
xcodePlatform = "iPhoneSimulator";
useiOSPrebuilt = true;
platform = {};
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index d1980c6dff817fd3f0fdc7062900ba216908c1e4..01dcf0787dfaf1cea49b7b45e9b1c863c0e063e6 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -55,9 +55,6 @@ rec {
isEfi = map (family: { cpu.family = family; })
[ "x86" "arm" "aarch64" ];
-
- # Deprecated after 18.03
- isArm = isAarch32;
};
matchAnyAttrs = patterns:
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index b064faa1e1ba637645593bbef548590d38249d66..59ed1e507e2491ab1aa85904612c716c07733d9e 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -441,4 +441,41 @@ runTests {
expected = "«foo»";
};
+
+# CLI
+
+ testToGNUCommandLine = {
+ expr = cli.toGNUCommandLine {} {
+ data = builtins.toJSON { id = 0; };
+ X = "PUT";
+ retry = 3;
+ retry-delay = null;
+ url = [ "https://example.com/foo" "https://example.com/bar" ];
+ silent = false;
+ verbose = true;
+ };
+
+ expected = [
+ "-X" "PUT"
+ "--data" "{\"id\":0}"
+ "--retry" "3"
+ "--url" "https://example.com/foo"
+ "--url" "https://example.com/bar"
+ "--verbose"
+ ];
+ };
+
+ testToGNUCommandLineShell = {
+ expr = cli.toGNUCommandLineShell {} {
+ data = builtins.toJSON { id = 0; };
+ X = "PUT";
+ retry = 3;
+ retry-delay = null;
+ url = [ "https://example.com/foo" "https://example.com/bar" ];
+ silent = false;
+ verbose = true;
+ };
+
+ expected = "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'";
+ };
}
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 3a25e31fb052b5db1641b397655739f8a905f28a..a281cd70fb0e2cd95e66b445553518f91734f8a4 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -191,7 +191,7 @@ rec {
let
revisionFile = "${toString ./..}/.git-revision";
gitRepo = "${toString ./..}/.git";
- in if lib.pathIsDirectory gitRepo
+ in if lib.pathIsGitRepo gitRepo
then lib.commitIdFromGitRepo gitRepo
else if lib.pathExists revisionFile then lib.fileContents revisionFile
else default;
diff --git a/lib/types.nix b/lib/types.nix
index ab325fd200914eab2e8690e88be5f93f6fdc3bd3..6fd6de7e1fd901995a33c4c97e200e665f757fcd 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -367,18 +367,6 @@ rec {
{ path = [ "services" "geoclue2" "appConfig" ];
name = "desktopID";
}
- { path = [ "home-manager" "users" anyString "programs" "ssh" "matchBlocks" ];
- name = "host"; # https://github.com/rycee/home-manager/blob/e8dbc3561373b68d12decb3c0d7c1ba245f138f7/modules/programs/ssh.nix#L265
- }
- { path = [ "home-manager" "users" anyString "home" "file" ];
- name = "target"; # https://github.com/rycee/home-manager/blob/0e9b7aab3c6c27bf020402e0e2ef20b65c040552/modules/files.nix#L33
- }
- { path = [ "home-manager" "users" anyString "xdg" "configFile" ];
- name = "target"; # https://github.com/rycee/home-manager/blob/54de0e1d79a1370e57a8f23bef89f99f9b92ab67/modules/misc/xdg.nix#L41
- }
- { path = [ "home-manager" "users" anyString "xdg" "dataFile" ];
- name = "target"; # https://github.com/rycee/home-manager/blob/54de0e1d79a1370e57a8f23bef89f99f9b92ab67/modules/misc/xdg.nix#L58
- }
];
matched = let
equals = a: b: b == anyString || a == b;
@@ -418,7 +406,7 @@ rec {
In file ${def.file}
a list is being assigned to the option config.${option}.
This will soon be an error as type loaOf is deprecated.
- See https://git.io/fj2zm for more information.
+ See https://github.com/NixOS/nixpkgs/pull/63103 for more information.
Do
${option} =
{ ${set}${more}}
@@ -602,7 +590,7 @@ rec {
tail' = tail ts;
in foldl' either head' tail';
- # Either value of type `finalType` or `coercedType`, the latter is
+ # Either value of type `coercedType` or `finalType`, the former is
# converted to `finalType` using `coerceFunc`.
coercedTo = coercedType: coerceFunc: finalType:
assert lib.assertMsg (coercedType.getSubModules == null)
@@ -611,12 +599,12 @@ rec {
mkOptionType rec {
name = "coercedTo";
description = "${finalType.description} or ${coercedType.description} convertible to it";
- check = x: finalType.check x || (coercedType.check x && finalType.check (coerceFunc x));
+ check = x: (coercedType.check x && finalType.check (coerceFunc x)) || finalType.check x;
merge = loc: defs:
let
coerceVal = val:
- if finalType.check val then val
- else coerceFunc val;
+ if coercedType.check val then coerceFunc val
+ else val;
in finalType.merge loc (map (def: def // { value = coerceVal def.value; }) defs);
emptyValue = finalType.emptyValue;
getSubOptions = finalType.getSubOptions;
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a01e626c64794855310fe4a4d7786e5ebff06711..de6adbf69d51998cc060118e3f971ff2394812b3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -40,12 +40,6 @@
See `./scripts/check-maintainer-github-handles.sh` for an example on how to work with this data.
*/
{
- "00-matt" = {
- name = "Matt Smith";
- email = "matt@offtopica.uk";
- github = "00-matt";
- githubId = 48835712;
- };
"0x4A6F" = {
email = "0x4A6F@shackspace.de";
name = "Joachim Ernst";
@@ -517,6 +511,12 @@
githubId = 5327697;
name = "Anatolii Prylutskyi";
};
+ antoinerg = {
+ email = "roygobeil.antoine@gmail.com";
+ github = "antoinerg";
+ githubId = 301546;
+ name = "Antoine Roy-Gobeil";
+ };
anton-dessiatov = {
email = "anton.dessiatov@gmail.com";
github = "anton-dessiatov";
@@ -594,6 +594,12 @@
githubId = 1296771;
name = "Anders Riutta";
};
+ arnoldfarkas = {
+ email = "arnold.farkas@gmail.com";
+ github = "arnoldfarkas";
+ githubId = 59696216;
+ name = "Arnold Farkas";
+ };
arobyn = {
email = "shados@shados.net";
github = "shados";
@@ -676,6 +682,12 @@
githubId = 192147;
name = "aszlig";
};
+ atemu = {
+ name = "Atemu";
+ email = "atemu.main+nixpkgs@gmail.com";
+ github = "Atemu";
+ githubId = 18599032;
+ };
athas = {
email = "athas@sigkill.dk";
github = "athas";
@@ -951,6 +963,12 @@
githubId = 5718007;
name = "Bastian Köcher";
};
+ blanky0230 = {
+ email = "blanky0230@gmail.com";
+ github = "blanky0230";
+ githubId = 5700358;
+ name = "Thomas Blank";
+ };
blitz = {
email = "js@alien8.de";
github = "blitz";
@@ -1893,6 +1911,12 @@
email = "burkett.andrew@gmail.com";
name = "Andrew Burkett";
};
+ drewrisinger = {
+ email = "drisinger+nixpkgs@gmail.com";
+ github = "drewrisinger";
+ gitHubId = 10198051;
+ name = "Drew Risinger";
+ };
dsferruzza = {
email = "david.sferruzza@gmail.com";
github = "dsferruzza";
@@ -1919,6 +1943,12 @@
fingerprint = "5DD7 C6F6 0630 F08E DAE7 4711 1525 585D 1B43 C62A";
}];
};
+ dwarfmaster = {
+ email = "nixpkgs@dwarfmaster.net";
+ github = "dwarfmaster";
+ githubId = 2025623;
+ name = "Luc Chabassier";
+ };
dxf = {
email = "dingxiangfei2009@gmail.com";
github = "dingxiangfei2009";
@@ -2393,6 +2423,12 @@
githubId = 415760;
name = "Jonas Höglund";
};
+ fishi0x01 = {
+ email = "fishi0x01@gmail.com";
+ github = "fishi0x01";
+ githubId = 10799507;
+ name = "Karl Fischer";
+ };
Flakebi = {
email = "flakebi@t-online.de";
github = "Flakebi";
@@ -2439,6 +2475,12 @@
githubId = 844574;
name = "Daniel Austin";
};
+ flyfloh = {
+ email = "nix@halbmastwurf.de";
+ github = "flyfloh";
+ githubId = 74379;
+ name = "Florian Pester";
+ };
fmthoma = {
email = "f.m.thoma@googlemail.com";
github = "fmthoma";
@@ -2520,6 +2562,12 @@
githubId = 1943632;
name = "fro_ozen";
};
+ Frostman = {
+ email = "me@slukjanov.name";
+ github = "Frostman";
+ githubId = 134872;
+ name = "Sergei Lukianov";
+ };
frontsideair = {
email = "photonia@gmail.com";
github = "frontsideair";
@@ -2992,6 +3040,12 @@
githubId = 4401220;
name = "Michael Eden";
};
+ ilya-fedin = {
+ email = "fedin-ilja2010@ya.ru";
+ github = "ilya-fedin";
+ githubId = 17829319;
+ name = "Ilya Fedin";
+ };
ilya-kolpakov = {
email = "ilya.kolpakov@gmail.com";
github = "ilya-kolpakov";
@@ -3474,6 +3528,12 @@
github = "jorsn";
githubId = 4646725;
};
+ jpas = {
+ name = "Jarrod Pas";
+ email = "jarrod@jarrodpas.com";
+ github = "jpas";
+ githubId = 5689724;
+ };
jpdoyle = {
email = "joethedoyle@gmail.com";
github = "jpdoyle";
@@ -3504,6 +3564,16 @@
githubId = 4611077;
name = "Raymond Gauthier";
};
+ jtcoolen = {
+ email = "jtcoolen@pm.me";
+ name = "Julien Coolen";
+ github = "jtcoolen";
+ githubId = 54635632;
+ keys = [{
+ longkeyid = "rsa4096/0x19642151C218F6F5";
+ fingerprint = "4C68 56EE DFDA 20FB 77E8 9169 1964 2151 C218 F6F5";
+ }];
+ };
jtobin = {
email = "jared@jtobin.io";
github = "jtobin";
@@ -3790,6 +3860,12 @@
githubId = 787421;
name = "Kevin Quick";
};
+ kraem = {
+ email = "me@kraem.xyz";
+ github = "kraem";
+ githubId = 26622971;
+ name = "Ronnie Ebrin";
+ };
kragniz = {
email = "louis@kragniz.eu";
github = "kragniz";
@@ -3808,6 +3884,12 @@
githubId = 17659803;
name = "Matthias Axel Kröll";
};
+ kristian-brucaj = {
+ email = "kbrucaj@gmail.com";
+ github = "kristian-brucaj";
+ githubID = "8893110";
+ name = "Kristian Brucaj";
+ };
kristoff3r = {
email = "k.soeholm@gmail.com";
github = "kristoff3r";
@@ -3838,6 +3920,12 @@
githubId = 449813;
name = "Roman Kuznetsov";
};
+ kwohlfahrt = {
+ email = "kai.wohlfahrt@gmail.com";
+ github = "kwohlfahrt";
+ githubId = 2422454;
+ name = "Kai Wohlfahrt";
+ };
kylesferrazza = {
name = "Kyle Sferrazza";
email = "kyle.sferrazza@gmail.com";
@@ -3903,6 +3991,12 @@
githubId = 32152;
name = "Luka Blaskovic";
};
+ ldelelis = {
+ email = "ldelelis@est.frba.utn.edu.ar";
+ github = "ldelelis";
+ githubId = 20250323;
+ name = "Lucio Delelis";
+ };
ldesgoui = {
email = "ldesgoui@gmail.com";
github = "ldesgoui";
@@ -4147,12 +4241,6 @@
github = "ltavard";
name = "Laure Tavard";
};
- lucas8 = {
- email = "luc.linux@mailoo.org";
- github = "lucas8";
- githubId = 2025623;
- name = "Luc Chabassier";
- };
lucus16 = {
email = "lars.jellema@gmail.com";
github = "Lucus16";
@@ -5088,6 +5176,12 @@
githubId = 7588406;
name = "Andrew R. M.";
};
+ nloomans = {
+ email = "noah@nixos.noahloomans.com";
+ github = "nloomans";
+ githubId = 7829481;
+ name = "Noah Loomans";
+ };
nmattia = {
email = "nicolas@nmattia.com";
github = "nmattia";
@@ -5403,6 +5497,12 @@
githubId = 3250809;
name = "Milan Pässler";
};
+ petercommand = {
+ email = "petercommand@gmail.com";
+ github = "petercommand";
+ githubId = 1260660;
+ name = "petercommand";
+ };
peterhoeg = {
email = "peter@hoeg.com";
github = "peterhoeg";
@@ -6147,6 +6247,16 @@
githubId = 6022042;
name = "Sam Parkinson";
};
+ samlich = {
+ email = "nixos@samli.ch";
+ github = "samlich";
+ githubId = 1349989;
+ name = "samlich";
+ keys = [{
+ longkeyid = "rsa4096/B1568953B1939F1C";
+ fingerprint = "AE8C 0836 FDF6 3FFC 9580 C588 B156 8953 B193 9F1C";
+ }];
+ };
samrose = {
email = "samuel.rose@gmail.com";
github = "samrose";
@@ -6254,6 +6364,12 @@
github = "scubed2";
name = "Sterling Stein";
};
+ sdier = {
+ email = "scott@dier.name";
+ github = "sdier";
+ githubId = 11613056;
+ name = "Scott Dier";
+ };
sdll = {
email = "sasha.delly@gmail.com";
github = "sdll";
@@ -6841,6 +6957,12 @@
githubId = 870673;
name = "Takuo Yonezawa";
};
+ talkara = {
+ email = "taito.horiuchi@relexsolutions.com";
+ github = "talkara";
+ githubId = 51232929;
+ name = "Taito Horiuchi";
+ };
talyz = {
email = "kim.lindberger@gmail.com";
github = "talyz";
@@ -7032,6 +7154,11 @@
github = "timbertson";
name = "Tim Cuthbertson";
};
+ timma = {
+ email = "kunduru.it.iitb@gmail.com";
+ github = "ktrsoft";
+ name = "Timma";
+ };
timokau = {
email = "timokau@zoho.com";
github = "timokau";
@@ -7823,6 +7950,12 @@
githubId = 1069303;
name = "Kim Simmons";
};
+ zowoq = {
+ email = "59103226+zowoq@users.noreply.github.com";
+ github = "zowoq";
+ githubId = 59103226;
+ name = "zowoq";
+ };
zraexy = {
email = "zraexy@gmail.com";
github = "zraexy";
@@ -7895,4 +8028,16 @@
githubId = 8686360;
name = "Illia Shestakov";
};
+ foxit64 = {
+ email = "o4nsxy05@gmail.com";
+ github = "foxit64";
+ githubId = 56247270;
+ name = "Foxit";
+ };
+ masaeedu = {
+ email = "masaeedu@gmail.com";
+ github = "masaeedu";
+ githubId = 3674056;
+ name = "Asad Saeeduddin";
+ };
}
diff --git a/maintainers/scripts/fetch-kde-qt.sh b/maintainers/scripts/fetch-kde-qt.sh
index a267a5fa8715dfdbd3f7768304b766b1b8e1260a..c6c980dd0cb67a0101ff362d24e7ba20e3196e56 100755
--- a/maintainers/scripts/fetch-kde-qt.sh
+++ b/maintainers/scripts/fetch-kde-qt.sh
@@ -28,7 +28,8 @@ find . -type f | while read src; do
done
cat >"$SRCS" <nixos-rebuild switch.
+
+
+ Some packages require additional global configuration such as D-Bus or systemd service registration so adding them to might not be sufficient. You are advised to check the list of options whether a NixOS module for the package does not exist.
+
+
+
You can get a list of the available packages as follows:
diff --git a/nixos/doc/manual/configuration/luks-file-systems.xml b/nixos/doc/manual/configuration/luks-file-systems.xml
index 8a2b107e0ee8aa5c61d6624e53152f07731ca1a5..d3007843d68bd19042bdd5f510aba32749837034 100644
--- a/nixos/doc/manual/configuration/luks-file-systems.xml
+++ b/nixos/doc/manual/configuration/luks-file-systems.xml
@@ -37,4 +37,38 @@ Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***
on an encrypted partition, it is necessary to add the following grub option:
= true;
+
+ FIDO2
+
+
+ NixOS also supports unlocking your LUKS-Encrypted file system using a FIDO2 compatible token. In the following example, we will create a new FIDO2 credential
+ and add it as a new key to our existing device /dev/sda2:
+
+
+# export FIDO2_LABEL="/dev/sda2 @ $HOSTNAME"
+# fido2luks credential "$FIDO2_LABEL"
+f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7
+
+# fido2luks -i add-key /dev/sda2 f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7
+Password:
+Password (again):
+Old password:
+Old password (again):
+Added to key to device /dev/sda2, slot: 2
+
+
+ To ensure that this file system is decrypted using the FIDO2 compatible key, add the following to configuration.nix:
+
+boot.initrd.luks.fido2Support = true;
+boot.initrd.luks.devices."/dev/sda2".fido2.credential = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7";
+
+
+ You can also use the FIDO2 passwordless setup, but for security reasons, you might want to enable it only when your device is PIN protected, such as Trezor.
+
+
+boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess = true;
+
+
+
+
diff --git a/nixos/doc/manual/configuration/network-manager.xml b/nixos/doc/manual/configuration/network-manager.xml
index d103ee24978390131729ad7270c2f1c879aa72cd..3953e0ffe851a0b8f310e61256ac28a8fbb3edea 100644
--- a/nixos/doc/manual/configuration/network-manager.xml
+++ b/nixos/doc/manual/configuration/network-manager.xml
@@ -28,17 +28,21 @@
nmtui (curses-based terminal user interface). See their
manual pages for details on their usage. Some desktop environments (GNOME,
KDE) have their own configuration tools for NetworkManager. On XFCE, there is
- no configuration tool for NetworkManager by default: by adding
- networkmanagerapplet to the list of system packages, the
- graphical applet will be installed and will launch automatically when XFCE is
- starting (and will show in the status tray).
+ no configuration tool for NetworkManager by default: by enabling , the
+ graphical applet will be installed and will launch automatically when the graphical session is started.
networking.networkmanager and networking.wireless
- (WPA Supplicant) cannot be enabled at the same time: you can still connect
- to the wireless networks using NetworkManager.
+ (WPA Supplicant) can be used together if desired. To do this you need to instruct
+ NetworkManager to ignore those interfaces like:
+
+ = [
+ "*" "except:type:wwan" "except:type:gsm"
+];
+
+ Refer to the option description for the exact syntax and references to external documentation.
diff --git a/nixos/doc/manual/configuration/x-windows.xml b/nixos/doc/manual/configuration/x-windows.xml
index 55ad9fe6e6530b76cb847834edf83154a45c60e8..06dd7c8bfb949b3e08999aea05f4c2d7360c2a90 100644
--- a/nixos/doc/manual/configuration/x-windows.xml
+++ b/nixos/doc/manual/configuration/x-windows.xml
@@ -85,11 +85,14 @@
= "none+i3";
- And, finally, to enable auto-login for a user johndoe:
+ Every display manager in NixOS supports auto-login, here is an example
+ using lightdm for a user alice:
- = true;
- = "johndoe";
+ = true;
+ = true;
+ = "alice";
+ The options are named identically for all other display managers.
diff --git a/nixos/doc/manual/configuration/xfce.xml b/nixos/doc/manual/configuration/xfce.xml
index 7d2862f8b31fffb97bb5722a5b3493f7b2fd1898..a81a327c09b68408bf916dfe0a4874bfd1a5628d 100644
--- a/nixos/doc/manual/configuration/xfce.xml
+++ b/nixos/doc/manual/configuration/xfce.xml
@@ -28,25 +28,14 @@
Some Xfce programs are not installed automatically. To install them manually
(system wide), put them into your
- .
+ from pkgs.xfce.
-
- Thunar Volume Support
+
+ Thunar Plugins
- To enable Thunar volume support, put
-
- = true;
-
- into your configuration.nix.
-
-
-
- Polkit Authentication Agent
-
- There is no authentication agent automatically installed alongside Xfce. To
- allow mounting of local (non-removable) filesystems, you will need to
- install one. Installing polkit_gnome, a rebuild, logout
- and login did the trick.
+ If you'd like to add extra plugins to Thunar, add them to
+ .
+ You shouldn't just add them to .
diff --git a/nixos/doc/manual/development/releases.xml b/nixos/doc/manual/development/releases.xml
index 9371af9984d1d3948e831a5f6f70b175a1536d02..a22a0a3707b4d66a5f57025bd5dfa968860e93e7 100755
--- a/nixos/doc/manual/development/releases.xml
+++ b/nixos/doc/manual/development/releases.xml
@@ -187,7 +187,7 @@
- Update "Chapter 4. Upgrading NixOS" section of the manual to match
+ Update "Chapter 4. Upgrading NixOS" section of the manual to match
new stable release version.
@@ -236,6 +236,10 @@
introduced to their role, making it easier to pass on knowledge and
experience.
+
+ Release managers for the current NixOS release are tracked by GitHub team
+ @NixOS/nixos-release-managers.
+
A release manager's role and responsibilities are:
diff --git a/nixos/doc/manual/installation/upgrading.xml b/nixos/doc/manual/installation/upgrading.xml
index 8d3f35b7c26f4e34cd75abb769e2c51d8f1ef0dd..92864cf2557a3f617d394c52f11ff9f546705859 100644
--- a/nixos/doc/manual/installation/upgrading.xml
+++ b/nixos/doc/manual/installation/upgrading.xml
@@ -120,12 +120,17 @@ nixos https://nixos.org/channels/nixos-unstable
to configuration.nix:
= true;
+ = true;
This enables a periodically executed systemd service named
- nixos-upgrade.service. It runs nixos-rebuild
- switch --upgrade to upgrade NixOS to the latest version in the
- current channel. (To see when the service runs, see systemctl
- list-timers.) You can also specify a channel explicitly, e.g.
+ nixos-upgrade.service. If the allowReboot
+ option is false, it runs nixos-rebuild switch
+ --upgrade to upgrade NixOS to the latest version in the current
+ channel. (To see when the service runs, see systemctl list-timers.)
+ If allowReboot is true, then the
+ system will automatically reboot if the new generation contains a different
+ kernel, initrd or kernel modules.
+ You can also specify a channel explicitly, e.g.
= https://nixos.org/channels/nixos-19.09;
diff --git a/nixos/doc/manual/man-nixos-install.xml b/nixos/doc/manual/man-nixos-install.xml
index 0752c397182f580c8a7d6eb34c2fb8de07012db0..9255ce763efee152f24a093a27f2a2b98047fe0e 100644
--- a/nixos/doc/manual/man-nixos-install.xml
+++ b/nixos/doc/manual/man-nixos-install.xml
@@ -210,7 +210,7 @@
The closure must be an appropriately configured NixOS system, with boot
loader and partition configuration that fits the target host. Such a
closure is typically obtained with a command such as nix-build
- -I nixos-config=./configuration.nix '<nixos>' -A system
+ -I nixos-config=./configuration.nix '<nixpkgs/nixos>' -A system
--no-out-link
diff --git a/nixos/doc/manual/man-nixos-option.xml b/nixos/doc/manual/man-nixos-option.xml
index b82f31256099ca809bb90f315a7772e0449b071f..b921386d0df01515a5da27385608bc072940901b 100644
--- a/nixos/doc/manual/man-nixos-option.xml
+++ b/nixos/doc/manual/man-nixos-option.xml
@@ -14,12 +14,16 @@
nixos-option
+
- path
+
+
+
+
-
+ path
@@ -46,23 +50,22 @@
-
- path
-
+
+
- This option is passed to the underlying
- nix-instantiate invocation.
+ Print all the values at or below the specified path recursively.
-
+ path
- Print the values of all options.
+ This option is passed to the underlying
+ nix-instantiate invocation.
diff --git a/nixos/doc/manual/man-pages.xml b/nixos/doc/manual/man-pages.xml
index f5a1dd2d69f49b1aae4b03ef531f849e86d4d221..49acfe7330b6da6aabbd2d1974c8f8b434883947 100644
--- a/nixos/doc/manual/man-pages.xml
+++ b/nixos/doc/manual/man-pages.xml
@@ -6,7 +6,7 @@
EelcoDolstraAuthor
- 2007-2019Eelco Dolstra
+ 2007-2020Eelco Dolstra
diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index 37ac4ec02881001bafc8681ea36a892f7ddd0aca..106612d05953282653f3faa64d98d2eabd53a1a3 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -23,6 +23,13 @@
Support is planned until the end of October 2020, handing over to 20.09.
+
+
+ Linux kernel is updated to branch 5.4 by default (from 4.19).
+ Users of Intel GPUs may prefer to explicitly set branch to 4.19 to avoid some regressions.
+ boot.kernelPackages = pkgs.linuxPackages_4_19;
+
+
Postgresql for NixOS service now defaults to v11.
@@ -52,7 +59,7 @@
nixos-option has been rewritten in C++, speeding it up, improving correctness,
- and adding a option which prints all options and their values.
+ and adding a option which prints all options and their values recursively.
@@ -96,6 +103,13 @@ services.xserver.displayManager.defaultSession = "xfce+icewm";
via .
+
+
+ To use Geary you should enable instead of
+ just adding it to .
+ It was created so Geary could function properly outside of GNOME.
+
+
@@ -126,7 +140,7 @@ services.xserver.displayManager.defaultSession = "xfce+icewm";
The dynamicHosts option has been removed from the
- networkd
+ NetworkManager
module. Allowing (multiple) regular users to override host entries
affecting the whole system opens up a huge attack vector.
There seem to be very rare cases where this might be useful.
@@ -168,6 +182,12 @@ services.xserver.displayManager.defaultSession = "xfce+icewm";
SDDM, GDM, or using the startx module which uses Xinitrc.
+
+
+ The Way Cooler wayland compositor has been removed, as the project has been officially canceled.
+ There are no more way-cooler attribute and programs.way-cooler options.
+
+
The BEAM package set has been deleted. You will only find there the different interpreters.
@@ -226,6 +246,23 @@ services.xserver.displayManager.defaultSession = "xfce+icewm";
upstream issue for more information.
+
+
+ The roundcube module has been hardened.
+
+
+
+ The password of the database is not written world readable in the store any more. If database.host is set to localhost, then a unix user of the same name as the database will be created and PostreSQL peer authentication will be used, removing the need for a password. Otherwise, a password is still needed and can be provided with the new option database.passwordFile, which should be set to the path of a file containing the password and readable by the user nginx only. The database.password option is insecure and deprecated. Usage of this option will print a warning.
+
+
+
+
+ A random des_key is set by default in the configuration of roundcube, instead of using the hardcoded and insecure default. To ensure a clean migration, all users will be logged out when you upgrade to this release.
+
+
+
+
+
The packages openobex and obexftp
@@ -401,6 +438,183 @@ users.users.me =
the type to either path (submodule ...).
+
+
+ The Buildkite Agent
+ module and corresponding packages have been updated to 3.x.
+ While doing so, the following options have been changed:
+
+
+
+
+ services.buildkite-agent.meta-data has been renamed to
+ services.buildkite-agent.tags,
+ to match upstreams naming for 3.x.
+ Its type has also changed - it now accepts an attrset of strings.
+
+
+
+
+ Theservices.buildkite-agent.openssh.publicKeyPath option
+ has been removed, as it's not necessary to deploy public keys to clone private
+ repositories.
+
+
+
+
+ services.buildkite-agent.openssh.privateKeyPath
+ has been renamed to
+ buildkite-agent.privateSshKeyPath,
+ as the whole openssh now only contained that single option.
+
+
+
+
+ services.buildkite-agent.shell
+ has been introduced, allowing to specify a custom shell to be used.
+
+
+
+
+
+
+ The citrix_workspace_19_3_0 package has been removed as
+ it will be EOLed within the lifespan of 20.03. For further information,
+ please refer to the support and maintenance information from upstream.
+
+
+
+
+ The gcc5 and gfortran5 packages have been removed.
+
+
+
+
+ The module has been removed.
+ It was only intended for use in internal NixOS tests, and gave the false impression
+ of it being a special display manager when it's actually LightDM.
+ Please use the options instead,
+ or any other display manager in NixOS as they all support auto-login. If you used this module specifically
+ because it permitted root auto-login you can override the lightdm-autologin pam module like:
+
+security.pam.services.lightdm-autologin.text = lib.mkForce ''
+ auth requisite pam_nologin.so
+ auth required pam_succeed_if.so quiet
+ auth required pam_permit.so
+
+ account include lightdm
+
+ password include lightdm
+
+ session include lightdm
+'';
+
+ The difference is the:
+
+auth required pam_succeed_if.so quiet
+
+ line, where default it's:
+
+auth required pam_succeed_if.so uid >= 1000 quiet
+
+ not permitting users with uid's below 1000 (like root).
+ All other display managers in NixOS are configured like this.
+
+
+
+
+ There have been lots of improvements to the Mailman module. As
+ a result,
+
+
+
+
+ The
+ option has been renamed to .
+
+
+
+
+ The
+ option has been removed. This is because having an option
+ for the Hyperkitty API key meant that the API key would be
+ stored in the world-readable Nix store, which was a
+ security vulnerability. A new Hyperkitty API key will be
+ generated the first time the new Hyperkitty service is run,
+ and it will then be persisted outside of the Nix store. To
+ continue using Hyperkitty, you must set to
+ true.
+
+
+
+
+ Additionally, some Postfix configuration must now be set
+ manually instead of automatically by the Mailman module:
+
+ = [ "hash:/var/lib/mailman/data/postfix_domains" ];
+.transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
+.local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
+
+ This is because some users may want to include other values
+ in these lists as well, and this was not possible if they
+ were set automatically by the Mailman module. It would not
+ have been possible to just concatenate values from multiple
+ modules each setting the values they needed, because the
+ order of elements in the list is significant.
+
+
+
+
+
+ The LLVM versions 3.5, 3.9 and 4 (including the corresponding CLang versions) have been dropped.
+
+
+
+ The option has
+ been replaced by .
+ The new option allows better control of the IPv6 temporary addresses,
+ including completely disabling them for interfaces where they are not
+ needed.
+
+
+
+
+ Rspamd was updated to version 2.2. Read
+
+ the upstream migration notes carefully. Please be especially
+ aware that some modules were removed and the default Bayes backend is
+ now Redis.
+
+
+
+
+ The *psu versions of oraclejdk8 have been removed
+ as they aren't provided by upstream anymore.
+
+
+
+
+ The module has been removed
+ as it used the deprecated version of dnscrypt-proxy. We've added
+ to use the supported version.
+
+
+
+
+ qesteidutil has been deprecated in favor of qdigidoc.
+
+
+
+
+ sqldeveloper_18 has been removed as it's not maintained anymore,
+ sqldeveloper has been updated to version 19.4.
+ Please note that this means that this means that the oraclejdk is now
+ required. For further information please read the
+ release notes.
+
+
@@ -452,9 +666,14 @@ users.users.me =
As well as this, the options security.acme.acceptTerms and either
security.acme.email or security.acme.certs.<name>.email
must be set in order to use the ACME module.
- Certificates will be regenerated from new on the next renewal date. The credentials for simp-le are
+ Certificates will be regenerated anew on the next renewal date. The credentials for simp-le are
preserved and thus it is possible to roll back to previous versions without breaking certificate
generation.
+
+
+
+ It is now possible to unlock LUKS-Encrypted file systems using a FIDO2 token
+ via .
diff --git a/nixos/lib/qemu-flags.nix b/nixos/lib/qemu-flags.nix
index 774f66b4804e0de6fe58c7f88a407744905b2137..859d9e975fec7a2418d57403efe669fcfe59eca0 100644
--- a/nixos/lib/qemu-flags.nix
+++ b/nixos/lib/qemu-flags.nix
@@ -17,9 +17,9 @@ in
else throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";
qemuBinary = qemuPkg: {
- x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu kvm64";
+ x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu host";
armv7l-linux = "${qemuPkg}/bin/qemu-system-arm -enable-kvm -machine virt -cpu host";
aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -enable-kvm -machine virt,gic-version=host -cpu host";
- x86_64-darwin = "${qemuPkg}/bin/qemu-kvm -cpu kvm64";
+ x86_64-darwin = "${qemuPkg}/bin/qemu-kvm -cpu host";
}.${pkgs.stdenv.hostPlatform.system} or "${qemuPkg}/bin/qemu-kvm";
}
diff --git a/nixos/lib/test-driver/test-driver.py b/nixos/lib/test-driver/test-driver.py
index 7e575189209ae944717651c1d77a863c1443f742..2b8dffec7d597a36c4795027ff303e8f98967f8c 100644
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@@ -1,13 +1,17 @@
#! /somewhere/python3
from contextlib import contextmanager, _GeneratorContextManager
+from queue import Queue, Empty
+from typing import Tuple, Any, Callable, Dict, Iterator, Optional, List
from xml.sax.saxutils import XMLGenerator
import _thread
import atexit
+import base64
import os
+import pathlib
import ptpython.repl
import pty
-from queue import Queue, Empty
import re
+import shlex
import shutil
import socket
import subprocess
@@ -15,9 +19,6 @@ import sys
import tempfile
import time
import unicodedata
-from typing import Tuple, Any, Callable, Dict, Iterator, Optional, List
-import shlex
-import pathlib
CHAR_TO_KEY = {
"A": "shift-a",
@@ -84,7 +85,7 @@ CHAR_TO_KEY = {
# Forward references
nr_tests: int
-nr_succeeded: int
+failed_tests: list
log: "Logger"
machines: "List[Machine]"
@@ -221,7 +222,7 @@ class Machine:
return path
self.state_dir = create_dir("vm-state-{}".format(self.name))
- self.shared_dir = create_dir("{}/xchg".format(self.state_dir))
+ self.shared_dir = create_dir("shared-xchg")
self.booted = False
self.connected = False
@@ -395,7 +396,7 @@ class Machine:
status_code_pattern = re.compile(r"(.*)\|\!EOF\s+(\d+)")
while True:
- chunk = self.shell.recv(4096).decode()
+ chunk = self.shell.recv(4096).decode(errors="ignore")
match = status_code_pattern.match(chunk)
if match:
output += match[1]
@@ -566,6 +567,41 @@ class Machine:
if ret.returncode != 0:
raise Exception("Cannot convert screenshot")
+ def copy_from_host_via_shell(self, source: str, target: str) -> None:
+ """Copy a file from the host into the guest by piping it over the
+ shell into the destination file. Works without host-guest shared folder.
+ Prefer copy_from_host for whenever possible.
+ """
+ with open(source, "rb") as fh:
+ content_b64 = base64.b64encode(fh.read()).decode()
+ self.succeed(
+ f"mkdir -p $(dirname {target})",
+ f"echo -n {content_b64} | base64 -d > {target}",
+ )
+
+ def copy_from_host(self, source: str, target: str) -> None:
+ """Copy a file from the host into the guest via the `shared_dir` shared
+ among all the VMs (using a temporary directory).
+ """
+ host_src = pathlib.Path(source)
+ vm_target = pathlib.Path(target)
+ with tempfile.TemporaryDirectory(dir=self.shared_dir) as shared_td:
+ shared_temp = pathlib.Path(shared_td)
+ host_intermediate = shared_temp / host_src.name
+ vm_shared_temp = pathlib.Path("/tmp/shared") / shared_temp.name
+ vm_intermediate = vm_shared_temp / host_src.name
+
+ self.succeed(make_command(["mkdir", "-p", vm_shared_temp]))
+ if host_src.is_dir():
+ shutil.copytree(host_src, host_intermediate)
+ else:
+ shutil.copy(host_src, host_intermediate)
+ self.succeed("sync")
+ self.succeed(make_command(["mkdir", "-p", vm_target.parent]))
+ self.succeed(make_command(["cp", "-r", vm_intermediate, vm_target]))
+ # Make sure the cleanup is synced into VM
+ self.succeed("sync")
+
def copy_from_vm(self, source: str, target_dir: str = "") -> None:
"""Copy a file from the VM (specified by an in-VM source path) to a path
relative to `$out`. The file is copied via the `shared_dir` shared among
@@ -576,7 +612,7 @@ class Machine:
vm_src = pathlib.Path(source)
with tempfile.TemporaryDirectory(dir=self.shared_dir) as shared_td:
shared_temp = pathlib.Path(shared_td)
- vm_shared_temp = pathlib.Path("/tmp/xchg") / shared_temp.name
+ vm_shared_temp = pathlib.Path("/tmp/shared") / shared_temp.name
vm_intermediate = vm_shared_temp / vm_src.name
intermediate = shared_temp / vm_src.name
# Copy the file to the shared directory inside VM
@@ -704,7 +740,8 @@ class Machine:
def process_serial_output() -> None:
for _line in self.process.stdout:
- line = _line.decode("unicode_escape").replace("\r", "").rstrip()
+ # Ignore undecodable bytes that may occur in boot menus
+ line = _line.decode(errors="ignore").replace("\r", "").rstrip()
eprint("{} # {}".format(self.name, line))
self.logger.enqueue({"msg": line, "machine": self.name})
@@ -841,23 +878,31 @@ def run_tests() -> None:
machine.execute("sync")
if nr_tests != 0:
+ nr_succeeded = nr_tests - len(failed_tests)
eprint("{} out of {} tests succeeded".format(nr_succeeded, nr_tests))
- if nr_tests > nr_succeeded:
+ if len(failed_tests) > 0:
+ eprint(
+ "The following tests have failed:\n - {}".format(
+ "\n - ".join(failed_tests)
+ )
+ )
sys.exit(1)
@contextmanager
def subtest(name: str) -> Iterator[None]:
global nr_tests
- global nr_succeeded
+ global failed_tests
with log.nested(name):
nr_tests += 1
try:
yield
- nr_succeeded += 1
return True
except Exception as e:
+ failed_tests.append(
+ 'Test "{}" failed with error: "{}"'.format(name, str(e))
+ )
log.log("error: {}".format(str(e)))
return False
@@ -879,7 +924,7 @@ if __name__ == "__main__":
exec("\n".join(machine_eval))
nr_tests = 0
- nr_succeeded = 0
+ failed_tests = []
@atexit.register
def clean_up() -> None:
diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
index 3d09be3b6cd50e6db8a48faf1265936726143199..a7f6d79265147e9d27bd3882e0056493bfa85542 100644
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@@ -155,7 +155,7 @@ in rec {
--add-flags "''${vms[*]}" \
${lib.optionalString enableOCR
"--prefix PATH : '${ocrProg}/bin:${imagemagick_tiff}/bin'"} \
- --run "export testScript=\"\$(cat $out/test-script)\"" \
+ --run "export testScript=\"\$(${coreutils}/bin/cat $out/test-script)\"" \
--set VLANS '${toString vlans}'
ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
wrapProgram $out/bin/nixos-run-vms \
diff --git a/nixos/lib/testing/jquery-ui.nix b/nixos/lib/testing/jquery-ui.nix
index e65107a3c2fbc643de3400fb9c8059e2f1c51ffd..abd59da2d285e6dfdb77507a2758ccec3e69a354 100644
--- a/nixos/lib/testing/jquery-ui.nix
+++ b/nixos/lib/testing/jquery-ui.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
name = "jquery-ui-1.11.4";
src = fetchurl {
- url = "http://jqueryui.com/resources/download/${name}.zip";
+ url = "https://jqueryui.com/resources/download/${name}.zip";
sha256 = "0ciyaj1acg08g8hpzqx6whayq206fvf4whksz2pjgxlv207lqgjh";
};
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
'';
meta = {
- homepage = http://jqueryui.com/;
+ homepage = https://jqueryui.com/;
description = "A library of JavaScript widgets and effects";
platforms = stdenv.lib.platforms.all;
};
diff --git a/nixos/modules/config/ldap.nix b/nixos/modules/config/ldap.nix
index 9c8e9d1493714e6dfd478a0096b37fa378650f73..b554f197dc4ba8f8e41dc80c871a6be0eb6450e7 100644
--- a/nixos/modules/config/ldap.nix
+++ b/nixos/modules/config/ldap.nix
@@ -28,8 +28,6 @@ let
};
nslcdConfig = writeText "nslcd.conf" ''
- uid nslcd
- gid nslcd
uri ${cfg.server}
base ${cfg.base}
timelimit ${toString cfg.timeLimit}
@@ -282,6 +280,7 @@ in
Group = "nslcd";
RuntimeDirectory = [ "nslcd" ];
PIDFile = "/run/nslcd/nslcd.pid";
+ AmbientCapabilities = "CAP_SYS_RESOURCE";
};
};
diff --git a/nixos/modules/config/pulseaudio.nix b/nixos/modules/config/pulseaudio.nix
index 048bbb30c73d0cb435b3b180ed2d90784368047b..408d0a9c33f27732b5d653ca236cc242f61fd492 100644
--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@@ -248,6 +248,9 @@ in {
security.rtkit.enable = true;
systemd.packages = [ overriddenPackage ];
+
+ # PulseAudio is packaged with udev rules to handle various audio device quirks
+ services.udev.packages = [ overriddenPackage ];
})
(mkIf (cfg.extraModules != []) {
diff --git a/nixos/modules/config/resolvconf.nix b/nixos/modules/config/resolvconf.nix
index 7d2f252a88863fed6f84514b3cbb3906e9d90135..cc202bca6c4e41f4d19f0a7cd2b296fa2d61c27a 100644
--- a/nixos/modules/config/resolvconf.nix
+++ b/nixos/modules/config/resolvconf.nix
@@ -38,6 +38,7 @@ in
(mkRenamedOptionModule [ "networking" "dnsExtensionMechanism" ] [ "networking" "resolvconf" "dnsExtensionMechanism" ])
(mkRenamedOptionModule [ "networking" "extraResolvconfConf" ] [ "networking" "resolvconf" "extraConfig" ])
(mkRenamedOptionModule [ "networking" "resolvconfOptions" ] [ "networking" "resolvconf" "extraOptions" ])
+ (mkRemovedOptionModule [ "networking" "resolvconf" "useHostResolvConf" ] "This option was never used for anything anyways")
];
options = {
@@ -53,15 +54,6 @@ in
'';
};
- useHostResolvConf = mkOption {
- type = types.bool;
- default = false;
- description = ''
- In containers, whether to use the
- resolv.conf supplied by the host.
- '';
- };
-
dnsSingleRequest = lib.mkOption {
type = types.bool;
default = false;
diff --git a/nixos/modules/hardware/opengl.nix b/nixos/modules/hardware/opengl.nix
index 89dc5008df5838b7abddc7f8027e548026b1c78e..28cddea8b79cf4fd6e4e4d960bafcc245a410405 100644
--- a/nixos/modules/hardware/opengl.nix
+++ b/nixos/modules/hardware/opengl.nix
@@ -43,11 +43,11 @@ in
description = ''
Whether to enable OpenGL drivers. This is needed to enable
OpenGL support in X11 systems, as well as for Wayland compositors
- like sway, way-cooler and Weston. It is enabled by default
+ like sway and Weston. It is enabled by default
by the corresponding modules, so you do not usually have to
set it yourself, only if there is no module for your wayland
- compositor of choice. See services.xserver.enable,
- programs.sway.enable, and programs.way-cooler.enable.
+ compositor of choice. See services.xserver.enable and
+ programs.sway.enable.
'';
type = types.bool;
default = false;
diff --git a/nixos/modules/hardware/openrazer.nix b/nixos/modules/hardware/openrazer.nix
index 883db7f2f4f192c283239a6c365baaa1afc5148b..b5c3d67441422c01aca637077bf5690963f10b28 100644
--- a/nixos/modules/hardware/openrazer.nix
+++ b/nixos/modules/hardware/openrazer.nix
@@ -49,7 +49,7 @@ in
{
options = {
hardware.openrazer = {
- enable = mkEnableOption "OpenRazer drivers and userspace daemon.";
+ enable = mkEnableOption "OpenRazer drivers and userspace daemon";
verboseLogging = mkOption {
type = types.bool;
diff --git a/nixos/modules/hardware/tuxedo-keyboard.nix b/nixos/modules/hardware/tuxedo-keyboard.nix
new file mode 100644
index 0000000000000000000000000000000000000000..898eed2449355cb94e6316f2734468af8af2d39b
--- /dev/null
+++ b/nixos/modules/hardware/tuxedo-keyboard.nix
@@ -0,0 +1,35 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.hardware.tuxedo-keyboard;
+ tuxedo-keyboard = config.boot.kernelPackages.tuxedo-keyboard;
+in
+ {
+ options.hardware.tuxedo-keyboard = {
+ enable = mkEnableOption ''
+ Enables the tuxedo-keyboard driver.
+
+ To configure the driver, pass the options to the configuration.
+ There are several parameters you can change. It's best to check at the source code description which options are supported.
+ You can find all the supported parameters at:
+
+ In order to use the custom lighting with the maximumg brightness and a color of 0xff0a0a one would put pass like this:
+
+
+ boot.kernelParams = [
+ "tuxedo_keyboard.mode=0"
+ "tuxedo_keyboard.brightness=255"
+ "tuxedo_keyboard.color_left=0xff0a0a"
+ ];
+
+ '';
+ };
+
+ config = mkIf cfg.enable
+ {
+ boot.kernelModules = ["tuxedo_keyboard"];
+ boot.extraModulePackages = [ tuxedo-keyboard ];
+ };
+ }
diff --git a/nixos/modules/hardware/usb-wwan.nix b/nixos/modules/hardware/usb-wwan.nix
index 2d20421586a7929238064d43f8887aad1ef3913f..679a6c6497cb63dc93e35145d2f95742406ad3bb 100644
--- a/nixos/modules/hardware/usb-wwan.nix
+++ b/nixos/modules/hardware/usb-wwan.nix
@@ -21,6 +21,19 @@ with lib;
###### implementation
config = mkIf config.hardware.usbWwan.enable {
+ # Attaches device specific handlers.
services.udev.packages = with pkgs; [ usb-modeswitch-data ];
+
+ # Triggered by udev, usb-modeswitch creates systemd services via a
+ # template unit in the usb-modeswitch package.
+ systemd.packages = with pkgs; [ usb-modeswitch ];
+
+ # The systemd service requires the usb-modeswitch-data. The
+ # usb-modeswitch package intends to discover this via the
+ # filesystem at /usr/share/usb_modeswitch, and merge it with user
+ # configuration in /etc/usb_modeswitch.d. Configuring the correct
+ # path in the package is difficult, as it would cause a cyclic
+ # dependency.
+ environment.etc."usb_modeswitch.d".source = "${pkgs.usb-modeswitch-data}/share/usb_modeswitch";
};
}
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde-new-kernel.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5-new-kernel.nix
similarity index 55%
rename from nixos/modules/installer/cd-dvd/installation-cd-graphical-kde-new-kernel.nix
rename to nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5-new-kernel.nix
index 3336d512cfd86e58c2be5685af09f551cff1bd8a..d98325a99ac2a30714eae1ac3df38238590cb505 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde-new-kernel.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5-new-kernel.nix
@@ -1,7 +1,7 @@
{ pkgs, ... }:
{
- imports = [ ./installation-cd-graphical-kde.nix ];
+ imports = [ ./installation-cd-graphical-plasma5.nix ];
boot.kernelPackages = pkgs.linuxPackages_latest;
}
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix
similarity index 100%
rename from nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix
rename to nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 11319e5f4f823e0438689fb560fa40fd5c531219..4558b4dc955216e96d23dafc7e9d861a1904dc6a 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -569,14 +569,18 @@ in
};
fileSystems."/nix/store" =
- { fsType = "unionfs-fuse";
- device = "unionfs";
- options = [ "allow_other" "cow" "nonempty" "chroot=/mnt-root" "max_files=32768" "hide_meta_files" "dirs=/nix/.rw-store=rw:/nix/.ro-store=ro" ];
+ { fsType = "overlay";
+ device = "overlay";
+ options = [
+ "lowerdir=/nix/.ro-store"
+ "upperdir=/nix/.rw-store/store"
+ "workdir=/nix/.rw-store/work"
+ ];
};
- boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" ];
+ boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" "overlay" ];
- boot.initrd.kernelModules = [ "loop" ];
+ boot.initrd.kernelModules = [ "loop" "overlay" ];
# Closures to be copied to the Nix store on the CD, namely the init
# script and the top-level system configuration directory.
diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix
index 5146858cccf5a399cc422da0a1f41a2f6c930d42..95eba86bcb6544a10fe72fc744134994f700208f 100644
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@@ -50,14 +50,18 @@ with lib;
};
fileSystems."/nix/store" =
- { fsType = "unionfs-fuse";
- device = "unionfs";
- options = [ "allow_other" "cow" "nonempty" "chroot=/mnt-root" "max_files=32768" "hide_meta_files" "dirs=/nix/.rw-store=rw:/nix/.ro-store=ro" ];
+ { fsType = "overlay";
+ device = "overlay";
+ options = [
+ "lowerdir=/nix/.ro-store"
+ "upperdir=/nix/.rw-store/store"
+ "workdir=/nix/.rw-store/work"
+ ];
};
- boot.initrd.availableKernelModules = [ "squashfs" ];
+ boot.initrd.availableKernelModules = [ "squashfs" "overlay" ];
- boot.initrd.kernelModules = [ "loop" ];
+ boot.initrd.kernelModules = [ "loop" "overlay" ];
# Closures to be copied to the Nix store, namely the init
# script and the top-level system configuration directory.
diff --git a/nixos/modules/installer/tools/nixos-option/nixos-option.cc b/nixos/modules/installer/tools/nixos-option/nixos-option.cc
index 9b92dc829cd16a5be4ffa5c30e670b4c2cc100ba..1a7b07a74f8ac2bea57925ec0b453d107616b901 100644
--- a/nixos/modules/installer/tools/nixos-option/nixos-option.cc
+++ b/nixos/modules/installer/tools/nixos-option/nixos-option.cc
@@ -131,12 +131,12 @@ bool isOption(Context & ctx, const Value & v)
if (v.type != tAttrs) {
return false;
}
- const auto & atualType = v.attrs->find(ctx.underscoreType);
- if (atualType == v.attrs->end()) {
+ const auto & actualType = v.attrs->find(ctx.underscoreType);
+ if (actualType == v.attrs->end()) {
return false;
}
try {
- Value evaluatedType = evaluateValue(ctx, *atualType->value);
+ Value evaluatedType = evaluateValue(ctx, *actualType->value);
if (evaluatedType.type != tString) {
return false;
}
@@ -197,9 +197,107 @@ void recurse(const std::function & f, Context & ctx, Value root)
+bool optionTypeIs(Context & ctx, Value & v, const std::string & soughtType)
{
+ try {
+ const auto & typeLookup = v.attrs->find(ctx.state.sType);
+ if (typeLookup == v.attrs->end()) {
+ return false;
+ }
+ Value type = evaluateValue(ctx, *typeLookup->value);
+ if (type.type != tAttrs) {
+ return false;
+ }
+ const auto & nameLookup = type.attrs->find(ctx.state.sName);
+ if (nameLookup == type.attrs->end()) {
+ return false;
+ }
+ Value name = evaluateValue(ctx, *nameLookup->value);
+ if (name.type != tString) {
+ return false;
+ }
+ return name.string.s == soughtType;
+ } catch (Error &) {
+ return false;
+ }
+}
+
+bool isAggregateOptionType(Context & ctx, Value & v)
+{
+ return optionTypeIs(ctx, v, "attrsOf") || optionTypeIs(ctx, v, "listOf") || optionTypeIs(ctx, v, "loaOf");
+}
+
+MakeError(OptionPathError, EvalError);
+
+Value getSubOptions(Context & ctx, Value & option)
+{
+ Value getSubOptions = evaluateValue(ctx, *findAlongAttrPath(ctx.state, "type.getSubOptions", ctx.autoArgs, option));
+ if (getSubOptions.type != tLambda) {
+ throw OptionPathError("Option's type.getSubOptions isn't a function");
+ }
+ Value emptyString{};
+ nix::mkString(emptyString, "");
+ Value v;
+ ctx.state.callFunction(getSubOptions, emptyString, v, nix::Pos{});
+ return v;
+}
+
+// Carefully walk an option path, looking for sub-options when a path walks past
+// an option value.
+struct FindAlongOptionPathRet
+{
+ Value option;
+ std::string path;
+};
+FindAlongOptionPathRet findAlongOptionPath(Context & ctx, const std::string & path)
+{
+ Strings tokens = parseAttrPath(path);
+ Value v = ctx.optionsRoot;
+ std::string processedPath;
+ for (auto i = tokens.begin(); i != tokens.end(); i++) {
+ const auto & attr = *i;
+ try {
+ bool lastAttribute = std::next(i) == tokens.end();
+ v = evaluateValue(ctx, v);
+ if (attr.empty()) {
+ throw OptionPathError("empty attribute name");
+ }
+ if (isOption(ctx, v) && optionTypeIs(ctx, v, "submodule")) {
+ v = getSubOptions(ctx, v);
+ }
+ if (isOption(ctx, v) && isAggregateOptionType(ctx, v)) {
+ auto subOptions = getSubOptions(ctx, v);
+ if (lastAttribute && subOptions.attrs->empty()) {
+ break;
+ }
+ v = subOptions;
+ // Note that we've consumed attr, but didn't actually use it. This is the path component that's looked
+ // up in the list or attribute set that doesn't name an option -- the "root" in "users.users.root.name".
+ } else if (v.type != tAttrs) {
+ throw OptionPathError("Value is %s while a set was expected", showType(v));
+ } else {
+ const auto & next = v.attrs->find(ctx.state.symbols.create(attr));
+ if (next == v.attrs->end()) {
+ throw OptionPathError("Attribute not found", attr, path);
+ }
+ v = *next->value;
+ }
+ processedPath = appendPath(processedPath, attr);
+ } catch (OptionPathError & e) {
+ throw OptionPathError("At '%s' in path '%s': %s", attr, path, e.msg());
+ }
+ }
+ return {v, processedPath};
+}
+
+// Calls f on all the option names at or below the option described by `path`.
+// Note that "the option described by `path`" is not trivial -- if path describes a value inside an aggregate
+// option (such as users.users.root), the *option* described by that path is one path component shorter
+// (eg: users.users), which results in f being called on sibling-paths (eg: users.users.nixbld1). If f
+// doesn't want these, it must do its own filtering.
+void mapOptions(const std::function & f, Context & ctx, const std::string & path)
+{
+ auto root = findAlongOptionPath(ctx, path);
recurse(
[f, &ctx](const std::string & path, std::variant v) {
bool isOpt = std::holds_alternative(v) || isOption(ctx, std::get(v));
@@ -208,7 +306,7 @@ void mapOptions(const std::function & f, Context
}
return !isOpt;
},
- ctx, root, "");
+ ctx, root.option, root.path);
}
// Calls f on all the config values inside one option.
@@ -294,9 +392,11 @@ void printAttrs(Context & ctx, Out & out, Value & v, const std::string & path)
Out attrsOut(out, "{", "}", v.attrs->size());
for (const auto & a : v.attrs->lexicographicOrder()) {
std::string name = a->name;
- attrsOut << name << " = ";
- printValue(ctx, attrsOut, *a->value, appendPath(path, name));
- attrsOut << ";" << Out::sep;
+ if (!forbiddenRecursionName(name)) {
+ attrsOut << name << " = ";
+ printValue(ctx, attrsOut, *a->value, appendPath(path, name));
+ attrsOut << ";" << Out::sep;
+ }
}
}
@@ -380,17 +480,26 @@ void printConfigValue(Context & ctx, Out & out, const std::string & path, std::v
out << ";\n";
}
-void printAll(Context & ctx, Out & out)
+// Replace with std::starts_with when C++20 is available
+bool starts_with(const std::string & s, const std::string & prefix)
+{
+ return s.size() >= prefix.size() &&
+ std::equal(s.begin(), std::next(s.begin(), prefix.size()), prefix.begin(), prefix.end());
+}
+
+void printRecursive(Context & ctx, Out & out, const std::string & path)
{
mapOptions(
- [&ctx, &out](const std::string & optionPath) {
+ [&ctx, &out, &path](const std::string & optionPath) {
mapConfigValuesInOption(
- [&ctx, &out](const std::string & configPath, std::variant v) {
- printConfigValue(ctx, out, configPath, v);
+ [&ctx, &out, &path](const std::string & configPath, std::variant v) {
+ if (starts_with(configPath, path)) {
+ printConfigValue(ctx, out, configPath, v);
+ }
},
optionPath, ctx);
},
- ctx, ctx.optionsRoot);
+ ctx, path);
}
void printAttr(Context & ctx, Out & out, const std::string & path, Value & root)
@@ -450,95 +559,17 @@ void printListing(Out & out, Value & v)
}
}
-bool optionTypeIs(Context & ctx, Value & v, const std::string & soughtType)
-{
- try {
- const auto & typeLookup = v.attrs->find(ctx.state.sType);
- if (typeLookup == v.attrs->end()) {
- return false;
- }
- Value type = evaluateValue(ctx, *typeLookup->value);
- if (type.type != tAttrs) {
- return false;
- }
- const auto & nameLookup = type.attrs->find(ctx.state.sName);
- if (nameLookup == type.attrs->end()) {
- return false;
- }
- Value name = evaluateValue(ctx, *nameLookup->value);
- if (name.type != tString) {
- return false;
- }
- return name.string.s == soughtType;
- } catch (Error &) {
- return false;
- }
-}
-
-bool isAggregateOptionType(Context & ctx, Value & v)
-{
- return optionTypeIs(ctx, v, "attrsOf") || optionTypeIs(ctx, v, "listOf") || optionTypeIs(ctx, v, "loaOf");
-}
-
-MakeError(OptionPathError, EvalError);
-
-Value getSubOptions(Context & ctx, Value & option)
-{
- Value getSubOptions = evaluateValue(ctx, *findAlongAttrPath(ctx.state, "type.getSubOptions", ctx.autoArgs, option));
- if (getSubOptions.type != tLambda) {
- throw OptionPathError("Option's type.getSubOptions isn't a function");
- }
- Value emptyString{};
- nix::mkString(emptyString, "");
- Value v;
- ctx.state.callFunction(getSubOptions, emptyString, v, nix::Pos{});
- return v;
-}
-
-// Carefully walk an option path, looking for sub-options when a path walks past
-// an option value.
-Value findAlongOptionPath(Context & ctx, const std::string & path)
-{
- Strings tokens = parseAttrPath(path);
- Value v = ctx.optionsRoot;
- for (auto i = tokens.begin(); i != tokens.end(); i++) {
- const auto & attr = *i;
- try {
- bool lastAttribute = std::next(i) == tokens.end();
- v = evaluateValue(ctx, v);
- if (attr.empty()) {
- throw OptionPathError("empty attribute name");
- }
- if (isOption(ctx, v) && optionTypeIs(ctx, v, "submodule")) {
- v = getSubOptions(ctx, v);
- }
- if (isOption(ctx, v) && isAggregateOptionType(ctx, v) && !lastAttribute) {
- v = getSubOptions(ctx, v);
- // Note that we've consumed attr, but didn't actually use it. This is the path component that's looked
- // up in the list or attribute set that doesn't name an option -- the "root" in "users.users.root.name".
- } else if (v.type != tAttrs) {
- throw OptionPathError("Value is %s while a set was expected", showType(v));
- } else {
- const auto & next = v.attrs->find(ctx.state.symbols.create(attr));
- if (next == v.attrs->end()) {
- throw OptionPathError("Attribute not found", attr, path);
- }
- v = *next->value;
- }
- } catch (OptionPathError & e) {
- throw OptionPathError("At '%s' in path '%s': %s", attr, path, e.msg());
- }
- }
- return v;
-}
-
void printOne(Context & ctx, Out & out, const std::string & path)
{
try {
- Value option = findAlongOptionPath(ctx, path);
+ auto result = findAlongOptionPath(ctx, path);
+ Value & option = result.option;
option = evaluateValue(ctx, option);
+ if (path != result.path) {
+ out << "Note: showing " << result.path << " instead of " << path << "\n";
+ }
if (isOption(ctx, option)) {
- printOption(ctx, out, path, option);
+ printOption(ctx, out, result.path, option);
} else {
printListing(out, option);
}
@@ -552,7 +583,7 @@ void printOne(Context & ctx, Out & out, const std::string & path)
int main(int argc, char ** argv)
{
- bool all = false;
+ bool recursive = false;
std::string path = ".";
std::string optionsExpr = "(import {}).options";
std::string configExpr = "(import {}).config";
@@ -568,8 +599,8 @@ int main(int argc, char ** argv)
nix::showManPage("nixos-option");
} else if (*arg == "--version") {
nix::printVersion("nixos-option");
- } else if (*arg == "--all") {
- all = true;
+ } else if (*arg == "-r" || *arg == "--recursive") {
+ recursive = true;
} else if (*arg == "--path") {
path = nix::getArg(*arg, arg, end);
} else if (*arg == "--options_expr") {
@@ -598,18 +629,12 @@ int main(int argc, char ** argv)
Context ctx{*state, *myArgs.getAutoArgs(*state), optionsRoot, configRoot};
Out out(std::cout);
- if (all) {
- if (!args.empty()) {
- throw UsageError("--all cannot be used with arguments");
- }
- printAll(ctx, out);
- } else {
- if (args.empty()) {
- printOne(ctx, out, "");
- }
- for (const auto & arg : args) {
- printOne(ctx, out, arg);
- }
+ auto print = recursive ? printRecursive : printOne;
+ if (args.empty()) {
+ print(ctx, out, "");
+ }
+ for (const auto & arg : args) {
+ print(ctx, out, arg);
}
ctx.state.printStats();
diff --git a/nixos/modules/installer/tools/nixos-rebuild.sh b/nixos/modules/installer/tools/nixos-rebuild.sh
index c53dc1000c4ac00ce328505e23352414bcc1bbe0..7db323d38e680352b2baa719f2bc2a4ad3f75574 100644
--- a/nixos/modules/installer/tools/nixos-rebuild.sh
+++ b/nixos/modules/installer/tools/nixos-rebuild.sh
@@ -22,7 +22,7 @@ repair=
profile=/nix/var/nix/profiles/system
buildHost=
targetHost=
-maybeSudo=
+maybeSudo=()
while [ "$#" -gt 0 ]; do
i="$1"; shift 1
@@ -91,9 +91,7 @@ while [ "$#" -gt 0 ]; do
shift 1
;;
--use-remote-sudo)
- # note the trailing space
- maybeSudo="sudo "
- shift 1
+ maybeSudo=(sudo --)
;;
*)
echo "$0: unknown option \`$i'"
@@ -102,6 +100,10 @@ while [ "$#" -gt 0 ]; do
esac
done
+if [ -n "$SUDO_USER" ]; then
+ maybeSudo=(sudo --)
+fi
+
if [ -z "$buildHost" -a -n "$targetHost" ]; then
buildHost="$targetHost"
fi
@@ -116,17 +118,17 @@ buildHostCmd() {
if [ -z "$buildHost" ]; then
"$@"
elif [ -n "$remoteNix" ]; then
- ssh $SSHOPTS "$buildHost" env PATH="$remoteNix:$PATH" "$maybeSudo$@"
+ ssh $SSHOPTS "$buildHost" env PATH="$remoteNix:$PATH" "${maybeSudo[@]}" "$@"
else
- ssh $SSHOPTS "$buildHost" "$maybeSudo$@"
+ ssh $SSHOPTS "$buildHost" "${maybeSudo[@]}" "$@"
fi
}
targetHostCmd() {
if [ -z "$targetHost" ]; then
- "$@"
+ "${maybeSudo[@]}" "$@"
else
- ssh $SSHOPTS "$targetHost" "$maybeSudo$@"
+ ssh $SSHOPTS "$targetHost" "${maybeSudo[@]}" "$@"
fi
}
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index bedd87a368eb10ab944cef5aa30025c14a6d77f6..979cdc5d4ad471db18bd579cdc4f5bacdb95ff5c 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -299,7 +299,7 @@ in
couchpotato = 267;
gogs = 268;
pdns-recursor = 269;
- kresd = 270;
+ #kresd = 270; # switched to "knot-resolver" with dynamic ID
rpc = 271;
geoip = 272;
fcron = 273;
@@ -600,7 +600,7 @@ in
headphones = 266;
couchpotato = 267;
gogs = 268;
- kresd = 270;
+ #kresd = 270; # switched to "knot-resolver" with dynamic ID
#rpc = 271; # unused
#geoip = 272; # unused
fcron = 273;
diff --git a/nixos/modules/misc/locate.nix b/nixos/modules/misc/locate.nix
index 552535c253e615111ac87d2b1e5a9e69a77aa4e0..dc668796c78869e02450c466b060369f3427ed78 100644
--- a/nixos/modules/misc/locate.nix
+++ b/nixos/modules/misc/locate.nix
@@ -131,13 +131,6 @@ in {
++ optional (isFindutils && cfg.pruneNames != []) "findutils locate does not support pruning by directory component"
++ optional (isFindutils && cfg.pruneBindMounts) "findutils locate does not support skipping bind mounts";
- # directory creation needs to be separated from main service
- # because ReadWritePaths fails when the directory doesn't already exist
- systemd.tmpfiles.rules =
- let dir = dirOf cfg.output; in
- mkIf (dir != "/var/cache")
- [ "d ${dir} 0755 root root -" ];
-
systemd.services.update-locatedb =
{ description = "Update Locate Database";
path = mkIf (!isMLocate) [ pkgs.su ];
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index b85614771ee4014011daf02882c6e6176ceaaa15..8a85035ceb7ce75e58c12c45ad365f84b670562a 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -6,6 +6,7 @@ let
cfg = config.system.nixos;
gitRepo = "${toString pkgs.path}/.git";
+ gitRepoValid = lib.pathIsGitRepo gitRepo;
gitCommitId = lib.substring 0 7 (commitIdFromGitRepo gitRepo);
in
@@ -91,8 +92,8 @@ in
# These defaults are set here rather than up there so that
# changing them would not rebuild the manual
version = mkDefault (cfg.release + cfg.versionSuffix);
- revision = mkIf (pathIsDirectory gitRepo) (mkDefault gitCommitId);
- versionSuffix = mkIf (pathIsDirectory gitRepo) (mkDefault (".git." + gitCommitId));
+ revision = mkIf gitRepoValid (mkDefault gitCommitId);
+ versionSuffix = mkIf gitRepoValid (mkDefault (".git." + gitCommitId));
};
# Generate /etc/os-release. See
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index a6c1d7c5d66cf0fc6be45d1a2c226bfed7e7f4c8..878b77969af17c3f88ce512abcc977a4781c27ec 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -62,6 +62,7 @@
./hardware/printers.nix
./hardware/raid/hpsa.nix
./hardware/steam-hardware.nix
+ ./hardware/tuxedo-keyboard.nix
./hardware/usb-wwan.nix
./hardware/onlykey.nix
./hardware/video/amdgpu.nix
@@ -97,6 +98,7 @@
./programs/autojump.nix
./programs/bandwhich.nix
./programs/bash/bash.nix
+ ./programs/bash-my-aws.nix
./programs/bcc.nix
./programs/browserpass.nix
./programs/captive-browser.nix
@@ -116,6 +118,7 @@
./programs/fish.nix
./programs/freetds.nix
./programs/fuse.nix
+ ./programs/geary.nix
./programs/gnome-disks.nix
./programs/gnome-documents.nix
./programs/gnome-terminal.nix
@@ -127,6 +130,7 @@
./programs/java.nix
./programs/kbdlight.nix
./programs/less.nix
+ ./programs/liboping.nix
./programs/light.nix
./programs/mosh.nix
./programs/mininet.nix
@@ -152,13 +156,13 @@
./programs/system-config-printer.nix
./programs/thefuck.nix
./programs/tmux.nix
+ ./programs/traceroute.nix
./programs/tsm-client.nix
./programs/udevil.nix
./programs/usbtop.nix
./programs/venus.nix
./programs/vim.nix
./programs/wavemon.nix
- ./programs/way-cooler.nix
./programs/waybar.nix
./programs/wireshark.nix
./programs/x2goserver.nix
@@ -278,6 +282,7 @@
./services/databases/riak.nix
./services/databases/riak-cs.nix
./services/databases/stanchion.nix
+ ./services/databases/victoriametrics.nix
./services/databases/virtuoso.nix
./services/desktops/accountsservice.nix
./services/desktops/bamf.nix
@@ -424,6 +429,7 @@
./services/misc/exhibitor.nix
./services/misc/felix.nix
./services/misc/folding-at-home.nix
+ ./services/misc/freeswitch.nix
./services/misc/fstrim.nix
./services/misc/gammu-smsd.nix
./services/misc/geoip-updater.nix
@@ -524,6 +530,7 @@
./services/monitoring/prometheus/alertmanager.nix
./services/monitoring/prometheus/exporters.nix
./services/monitoring/prometheus/pushgateway.nix
+ ./services/monitoring/prometheus/xmpp-alerts.nix
./services/monitoring/riemann.nix
./services/monitoring/riemann-dash.nix
./services/monitoring/riemann-tools.nix
@@ -577,6 +584,7 @@
./services/networking/connman.nix
./services/networking/consul.nix
./services/networking/coredns.nix
+ ./services/networking/corerad.nix
./services/networking/coturn.nix
./services/networking/dante.nix
./services/networking/ddclient.nix
@@ -584,7 +592,7 @@
./services/networking/dhcpd.nix
./services/networking/dnscache.nix
./services/networking/dnschain.nix
- ./services/networking/dnscrypt-proxy.nix
+ ./services/networking/dnscrypt-proxy2.nix
./services/networking/dnscrypt-wrapper.nix
./services/networking/dnsdist.nix
./services/networking/dnsmasq.nix
@@ -735,6 +743,7 @@
./services/networking/wicd.nix
./services/networking/wireguard.nix
./services/networking/wpa_supplicant.nix
+ ./services/networking/xandikos.nix
./services/networking/xinetd.nix
./services/networking/xl2tpd.nix
./services/networking/xrdp.nix
@@ -802,6 +811,7 @@
./services/web-apps/codimd.nix
./services/web-apps/cryptpad.nix
./services/web-apps/documize.nix
+ ./services/web-apps/dokuwiki.nix
./services/web-apps/frab.nix
./services/web-apps/gotify-server.nix
./services/web-apps/icingaweb2/icingaweb2.nix
@@ -859,7 +869,6 @@
./services/x11/unclutter.nix
./services/x11/unclutter-xfixes.nix
./services/x11/desktop-managers/default.nix
- ./services/x11/display-managers/auto.nix
./services/x11/display-managers/default.nix
./services/x11/display-managers/gdm.nix
./services/x11/display-managers/lightdm.nix
@@ -869,7 +878,6 @@
./services/x11/display-managers/xpra.nix
./services/x11/fractalart.nix
./services/x11/hardware/libinput.nix
- ./services/x11/hardware/multitouch.nix
./services/x11/hardware/synaptics.nix
./services/x11/hardware/wacom.nix
./services/x11/hardware/digimend.nix
diff --git a/nixos/modules/programs/bash-my-aws.nix b/nixos/modules/programs/bash-my-aws.nix
new file mode 100644
index 0000000000000000000000000000000000000000..15e429a7549763edcb11b32697ab9ab0e9f0ff77
--- /dev/null
+++ b/nixos/modules/programs/bash-my-aws.nix
@@ -0,0 +1,25 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+ prg = config.programs;
+ cfg = prg.bash-my-aws;
+
+ initScript = ''
+ eval $(${pkgs.bash-my-aws}/bin/bma-init)
+ '';
+in
+ {
+ options = {
+ programs.bash-my-aws = {
+ enable = mkEnableOption "bash-my-aws";
+ };
+ };
+
+ config = mkIf cfg.enable {
+ environment.systemPackages = with pkgs; [ bash-my-aws ];
+
+ programs.bash.interactiveShellInit = initScript;
+ };
+ }
diff --git a/nixos/modules/programs/bash/bash.nix b/nixos/modules/programs/bash/bash.nix
index 366c07c0a3528e113d0b5f7d5ca7d2132a37e366..be964ce7f3f9a787e0c0c252d2c62ae543fa5b6d 100644
--- a/nixos/modules/programs/bash/bash.nix
+++ b/nixos/modules/programs/bash/bash.nix
@@ -32,6 +32,10 @@ let
fi
'';
+ lsColors = optionalString cfg.enableLsColors ''
+ eval "$(${pkgs.coreutils}/bin/dircolors -b)"
+ '';
+
bashAliases = concatStringsSep "\n" (
mapAttrsFlatten (k: v: "alias ${k}=${escapeShellArg v}")
(filterAttrs (k: v: v != null) cfg.shellAliases)
@@ -127,6 +131,14 @@ in
type = types.bool;
};
+ enableLsColors = mkOption {
+ default = true;
+ description = ''
+ Enable extra colors in directory listings.
+ '';
+ type = types.bool;
+ };
+
};
};
@@ -156,6 +168,7 @@ in
${cfg.promptInit}
${bashCompletion}
+ ${lsColors}
${bashAliases}
${cfge.interactiveShellInit}
diff --git a/nixos/modules/programs/geary.nix b/nixos/modules/programs/geary.nix
new file mode 100644
index 0000000000000000000000000000000000000000..01803bc411e5430f3dc4660ae1b923cb2120cbf2
--- /dev/null
+++ b/nixos/modules/programs/geary.nix
@@ -0,0 +1,20 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+ cfg = config.programs.geary;
+
+in {
+ options = {
+ programs.geary.enable = mkEnableOption "Geary, a Mail client for GNOME 3";
+ };
+
+ config = mkIf cfg.enable {
+ environment.systemPackages = [ pkgs.gnome3.geary ];
+ programs.dconf.enable = true;
+ services.gnome3.gnome-keyring.enable = true;
+ services.gnome3.gnome-online-accounts.enable = true;
+ };
+}
+
diff --git a/nixos/modules/programs/gnupg.nix b/nixos/modules/programs/gnupg.nix
index 2d262d9065796c374d57c7beb5ea799c4f9bb27b..7a3cb588ee719dba8f3bef32f230df17965a772d 100644
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@@ -96,7 +96,7 @@ in
# This overrides the systemd user unit shipped with the gnupg package
systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {
serviceConfig.ExecStart = [ "" ''
- ${pkgs.gnupg}/bin/gpg-agent --supervised \
+ ${cfg.package}/bin/gpg-agent --supervised \
--pinentry-program ${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry
'' ];
};
diff --git a/nixos/modules/programs/liboping.nix b/nixos/modules/programs/liboping.nix
new file mode 100644
index 0000000000000000000000000000000000000000..4e4c235ccde4a99720773641a8764f3d5665df86
--- /dev/null
+++ b/nixos/modules/programs/liboping.nix
@@ -0,0 +1,22 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.programs.liboping;
+in {
+ options.programs.liboping = {
+ enable = mkEnableOption "liboping";
+ };
+ config = mkIf cfg.enable {
+ environment.systemPackages = with pkgs; [ liboping ];
+ security.wrappers = mkMerge (map (
+ exec: {
+ "${exec}" = {
+ source = "${pkgs.liboping}/bin/${exec}";
+ capabilities = "cap_net_raw+p";
+ };
+ }
+ ) [ "oping" "noping" ]);
+ };
+}
diff --git a/nixos/modules/programs/sway.nix b/nixos/modules/programs/sway.nix
index 33e252be45f8f36e36719fd235e2003ef6c57eb6..7e646f8737d67ee727c953d3a11758aa210e6bde 100644
--- a/nixos/modules/programs/sway.nix
+++ b/nixos/modules/programs/sway.nix
@@ -87,7 +87,8 @@ in {
type = with types; listOf package;
default = with pkgs; [
swaylock swayidle
- xwayland rxvt_unicode dmenu
+ xwayland alacritty dmenu
+ rxvt_unicode # For backward compatibility (old default terminal)
];
defaultText = literalExample ''
with pkgs; [ swaylock swayidle xwayland rxvt_unicode dmenu ];
diff --git a/nixos/modules/programs/tmux.nix b/nixos/modules/programs/tmux.nix
index ed077e3daa76209031a441b76ef8bb587dd35b10..c39908751d29f62e808b08a34de895bdb2b6a470 100644
--- a/nixos/modules/programs/tmux.nix
+++ b/nixos/modules/programs/tmux.nix
@@ -52,7 +52,7 @@ let
set -s escape-time ${toString cfg.escapeTime}
set -g history-limit ${toString cfg.historyLimit}
- ${cfg.extraTmuxConf}
+ ${cfg.extraConfig}
'';
in {
@@ -102,7 +102,7 @@ in {
description = "Time in milliseconds for which tmux waits after an escape is input.";
};
- extraTmuxConf = mkOption {
+ extraConfig = mkOption {
default = "";
description = ''
Additional contents of /etc/tmux.conf
@@ -181,4 +181,8 @@ in {
};
};
};
+
+ imports = [
+ (lib.mkRenamedOptionModule [ "programs" "tmux" "extraTmuxConf" ] [ "programs" "tmux" "extraConfig" ])
+ ];
}
diff --git a/nixos/modules/programs/traceroute.nix b/nixos/modules/programs/traceroute.nix
new file mode 100644
index 0000000000000000000000000000000000000000..4eb0be3f0e0beccb1de4da16f2c07f8477f3ee75
--- /dev/null
+++ b/nixos/modules/programs/traceroute.nix
@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.programs.traceroute;
+in {
+ options = {
+ programs.traceroute = {
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to configure a setcap wrapper for traceroute.
+ '';
+ };
+ };
+ };
+
+ config = mkIf cfg.enable {
+ security.wrappers.traceroute = {
+ source = "${pkgs.traceroute}/bin/traceroute";
+ capabilities = "cap_net_raw+p";
+ };
+ };
+}
diff --git a/nixos/modules/programs/way-cooler.nix b/nixos/modules/programs/way-cooler.nix
deleted file mode 100644
index f27bd42bd764c89496de010bd025aeb397b77df8..0000000000000000000000000000000000000000
--- a/nixos/modules/programs/way-cooler.nix
+++ /dev/null
@@ -1,78 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-let
- cfg = config.programs.way-cooler;
- way-cooler = pkgs.way-cooler;
-
- wcWrapped = pkgs.writeShellScriptBin "way-cooler" ''
- ${cfg.extraSessionCommands}
- exec ${pkgs.dbus}/bin/dbus-run-session ${way-cooler}/bin/way-cooler
- '';
- wcJoined = pkgs.symlinkJoin {
- name = "way-cooler-wrapped";
- paths = [ wcWrapped way-cooler ];
- };
- configFile = readFile "${way-cooler}/etc/way-cooler/init.lua";
- spawnBar = ''
- util.program.spawn_at_startup("lemonbar");
- '';
-in
-{
- options.programs.way-cooler = {
- enable = mkEnableOption "way-cooler";
-
- extraSessionCommands = mkOption {
- default = "";
- type = types.lines;
- example = ''
- export XKB_DEFAULT_LAYOUT=us,de
- export XKB_DEFAULT_VARIANT=,nodeadkeys
- export XKB_DEFAULT_OPTIONS=grp:caps_toggle,
- '';
- description = ''
- Shell commands executed just before way-cooler is started.
- '';
- };
-
- extraPackages = mkOption {
- type = with types; listOf package;
- default = with pkgs; [
- westonLite xwayland dmenu
- ];
- example = literalExample ''
- with pkgs; [
- westonLite xwayland dmenu
- ]
- '';
- description = ''
- Extra packages to be installed system wide.
- '';
- };
-
- enableBar = mkOption {
- type = types.bool;
- default = true;
- description = ''
- Whether to enable an unofficial bar.
- '';
- };
- };
-
- config = mkIf cfg.enable {
- environment.systemPackages = [ wcJoined ] ++ cfg.extraPackages;
-
- security.pam.services.wc-lock = {};
- environment.etc."way-cooler/init.lua".text = ''
- ${configFile}
- ${optionalString cfg.enableBar spawnBar}
- '';
-
- hardware.opengl.enable = mkDefault true;
- fonts.enableDefaultFonts = mkDefault true;
- programs.dconf.enable = mkDefault true;
- };
-
- meta.maintainers = with maintainers; [ gnidorah ];
-}
diff --git a/nixos/modules/programs/zsh/zsh.nix b/nixos/modules/programs/zsh/zsh.nix
index c66c29ed45fb926716f56f8bb66184d2372bda40..4fbdba47b1df57891421b9c566251e4672baace1 100644
--- a/nixos/modules/programs/zsh/zsh.nix
+++ b/nixos/modules/programs/zsh/zsh.nix
@@ -15,6 +15,24 @@ let
(filterAttrs (k: v: v != null) cfg.shellAliases)
);
+ zshStartupNotes = ''
+ # Note that generated /etc/zprofile and /etc/zshrc files do a lot of
+ # non-standard setup to make zsh usable with no configuration by default.
+ #
+ # Which means that unless you explicitly meticulously override everything
+ # generated, interactions between your ~/.zshrc and these files are likely
+ # to be rather surprising.
+ #
+ # Note however, that you can disable loading of the generated /etc/zprofile
+ # and /etc/zshrc (you can't disable loading of /etc/zshenv, but it is
+ # designed to not set anything surprising) by setting `no_global_rcs` option
+ # in ~/.zshenv:
+ #
+ # echo setopt no_global_rcs >> ~/.zshenv
+ #
+ # See "STARTUP/SHUTDOWN FILES" section of zsh(1) for more info.
+ '';
+
in
{
@@ -69,6 +87,10 @@ in
promptInit = mkOption {
default = ''
+ # Note that to manually override this in ~/.zshrc you should run `prompt off`
+ # before setting your PS1 and etc. Otherwise this will likely to interact with
+ # your ~/.zshrc configuration in unexpected ways as the default prompt sets
+ # a lot of different prompt variables.
autoload -U promptinit && promptinit && prompt walters && setopt prompt_sp
'';
description = ''
@@ -100,7 +122,8 @@ in
];
example = [ "EXTENDED_HISTORY" "RM_STAR_WAIT" ];
description = ''
- Configure zsh options.
+ Configure zsh options. See
+ zshoptions1.
'';
};
@@ -147,6 +170,14 @@ in
. ${config.system.build.setEnvironment}
fi
+ HELPDIR="${pkgs.zsh}/share/zsh/$ZSH_VERSION/help"
+
+ # Tell zsh how to find installed completions.
+ for p in ''${(z)NIX_PROFILES}; do
+ fpath+=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions $p/share/zsh/vendor-completions)
+ done
+
+ # Setup custom shell init stuff.
${cfge.shellInit}
${cfg.shellInit}
@@ -161,11 +192,14 @@ in
''
# /etc/zprofile: DO NOT EDIT -- this file has been generated automatically.
# This file is read for login shells.
+ #
+ ${zshStartupNotes}
# Only execute this file once per shell.
if [ -n "$__ETC_ZPROFILE_SOURCED" ]; then return; fi
__ETC_ZPROFILE_SOURCED=1
+ # Setup custom login shell init stuff.
${cfge.loginShellInit}
${cfg.loginShellInit}
@@ -180,38 +214,44 @@ in
''
# /etc/zshrc: DO NOT EDIT -- this file has been generated automatically.
# This file is read for interactive shells.
+ #
+ ${zshStartupNotes}
# Only execute this file once per shell.
if [ -n "$__ETC_ZSHRC_SOURCED" -o -n "$NOSYSZSHRC" ]; then return; fi
__ETC_ZSHRC_SOURCED=1
- . /etc/zinputrc
+ ${optionalString (cfg.setOptions != []) ''
+ # Set zsh options.
+ setopt ${concatStringsSep " " cfg.setOptions}
+ ''}
- # Don't export these, otherwise other shells (bash) will try to use same histfile
+ # Setup command line history.
+ # Don't export these, otherwise other shells (bash) will try to use same HISTFILE.
SAVEHIST=${toString cfg.histSize}
HISTSIZE=${toString cfg.histSize}
HISTFILE=${cfg.histFile}
- HELPDIR="${pkgs.zsh}/share/zsh/$ZSH_VERSION/help"
-
- # Tell zsh how to find installed completions
- for p in ''${(z)NIX_PROFILES}; do
- fpath+=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions $p/share/zsh/vendor-completions)
- done
+ # Configure sane keyboard defaults.
+ . /etc/zinputrc
- ${optionalString cfg.enableGlobalCompInit "autoload -U compinit && compinit"}
+ ${optionalString cfg.enableGlobalCompInit ''
+ # Enable autocompletion.
+ autoload -U compinit && compinit
+ ''}
+ # Setup custom interactive shell init stuff.
${cfge.interactiveShellInit}
${cfg.interactiveShellInit}
- ${optionalString (cfg.setOptions != []) "setopt ${concatStringsSep " " cfg.setOptions}"}
-
+ # Setup aliases.
${zshAliases}
+ # Setup prompt.
${cfg.promptInit}
- # Need to disable features to support TRAMP
+ # Disable some features to support TRAMP.
if [ "$TERM" = dumb ]; then
unsetopt zle prompt_cr prompt_subst
unset RPS1 RPROMPT
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 7109ab5a1099d6f0c8284c8dbafb2b3fbca1b390..3b1b1b8bb55c8a302a6c800cada26ced4a7faeca 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -27,6 +27,21 @@ with lib;
(mkRemovedOptionModule [ "services.osquery" ] "The osquery module has been removed")
(mkRemovedOptionModule [ "services.fourStore" ] "The fourStore module has been removed")
(mkRemovedOptionModule [ "services.fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
+ (mkRemovedOptionModule [ "programs" "way-cooler" ] ("way-cooler is abandoned by its author: " +
+ "https://way-cooler.org/blog/2020/01/09/way-cooler-post-mortem.html"))
+ (mkRemovedOptionModule [ "services" "xserver" "multitouch" ] ''
+ services.xserver.multitouch (which uses xf86_input_mtrack) has been removed
+ as the underlying package isn't being maintained. Working alternatives are
+ libinput and synaptics.
+ '')
+ (mkRemovedOptionModule [ "services" "xserver" "displayManager" "auto" ] ''
+ The services.xserver.displayManager.auto module has been removed
+ because it was only intended for use in internal NixOS tests, and gave the
+ false impression of it being a special display manager when it's actually
+ LightDM. Please use the services.xserver.displayManager.lightdm.autoLogin options
+ instead, or any other display manager in NixOS as they all support auto-login.
+ '')
+ (mkRemovedOptionModule [ "services" "dnscrypt-proxy" ] "Use services.dnscrypt-proxy2 instead")
# Do NOT add any option renames here, see top of the file
];
diff --git a/nixos/modules/security/duosec.nix b/nixos/modules/security/duosec.nix
index 78a82b7154e7586595caf655097c4f821ec078ac..c686a6861d0fc65220fa9f9fa01c153137ff41ce 100644
--- a/nixos/modules/security/duosec.nix
+++ b/nixos/modules/security/duosec.nix
@@ -12,7 +12,7 @@ let
ikey=${cfg.ikey}
skey=${cfg.skey}
host=${cfg.host}
- ${optionalString (cfg.group != "") ("group="+cfg.group)}
+ ${optionalString (cfg.groups != "") ("groups="+cfg.groups)}
failmode=${cfg.failmode}
pushinfo=${boolToStr cfg.pushinfo}
autopush=${boolToStr cfg.autopush}
@@ -42,6 +42,10 @@ let
};
in
{
+ imports = [
+ (mkRenamedOptionModule [ "security" "duosec" "group" ] [ "security" "duosec" "groups" ])
+ ];
+
options = {
security.duosec = {
ssh.enable = mkOption {
@@ -71,10 +75,16 @@ in
description = "Duo API hostname.";
};
- group = mkOption {
+ groups = mkOption {
type = types.str;
default = "";
- description = "Use Duo authentication for users only in this group.";
+ example = "users,!wheel,!*admin guests";
+ description = ''
+ If specified, Duo authentication is required only for users
+ whose primary group or supplementary group list matches one
+ of the space-separated pattern lists. Refer to
+ for details.
+ '';
};
failmode = mkOption {
diff --git a/nixos/modules/services/amqp/rabbitmq.nix b/nixos/modules/services/amqp/rabbitmq.nix
index 697732426ccfbefc2a02198fff8d6be96de843df..f80d6b3f1ba56003d5b7166c0c4b259a56fab120 100644
--- a/nixos/modules/services/amqp/rabbitmq.nix
+++ b/nixos/modules/services/amqp/rabbitmq.nix
@@ -98,8 +98,8 @@ in {
will be merged into these options by RabbitMQ at runtime to
form the final configuration.
- See http://www.rabbitmq.com/configure.html#config-items
- For the distinct formats, see http://www.rabbitmq.com/configure.html#config-file-formats
+ See https://www.rabbitmq.com/configure.html#config-items
+ For the distinct formats, see https://www.rabbitmq.com/configure.html#config-file-formats
'';
};
@@ -116,8 +116,8 @@ in {
The contents of this option will be merged into the configItems
by RabbitMQ at runtime to form the final configuration.
- See the second table on http://www.rabbitmq.com/configure.html#config-items
- For the distinct formats, see http://www.rabbitmq.com/configure.html#config-file-formats
+ See the second table on https://www.rabbitmq.com/configure.html#config-items
+ For the distinct formats, see https://www.rabbitmq.com/configure.html#config-file-formats
'';
};
@@ -165,7 +165,10 @@ in {
after = [ "network.target" "epmd.socket" ];
wants = [ "network.target" "epmd.socket" ];
- path = [ cfg.package pkgs.procps ];
+ path = [
+ cfg.package
+ pkgs.coreutils # mkdir/chown/chmod for preStart
+ ];
environment = {
RABBITMQ_MNESIA_BASE = "${cfg.dataDir}/mnesia";
diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix
index 7e8e91e4b9c386def17bab01e36c89399311f25d..2388f1d6ca1378061b748355789300b4fdd96bfd 100644
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@@ -103,6 +103,34 @@ in
Create the repository if it doesn't exist.
'';
};
+
+ pruneOpts = mkOption {
+ type = types.listOf types.str;
+ default = [];
+ description = ''
+ A list of options (--keep-* et al.) for 'restic forget
+ --prune', to automatically prune old snapshots. The
+ 'forget' command is run *after* the 'backup' command, so
+ keep that in mind when constructing the --keep-* options.
+ '';
+ example = [
+ "--keep-daily 7"
+ "--keep-weekly 5"
+ "--keep-monthly 12"
+ "--keep-yearly 75"
+ ];
+ };
+
+ dynamicFilesFrom = mkOption {
+ type = with types; nullOr str;
+ default = null;
+ description = ''
+ A script that produces a list of files to back up. The
+ results of this command are given to the '--files-from'
+ option.
+ '';
+ example = "find /home/matt/git -type d -name .git";
+ };
};
}));
default = {};
@@ -134,25 +162,41 @@ in
let
extraOptions = concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
resticCmd = "${pkgs.restic}/bin/restic${extraOptions}";
+ filesFromTmpFile = "/run/restic-backups-${name}/includes";
+ backupPaths = if (backup.dynamicFilesFrom == null)
+ then concatStringsSep " " backup.paths
+ else "--files-from ${filesFromTmpFile}";
+ pruneCmd = optionals (builtins.length backup.pruneOpts > 0) [
+ ( resticCmd + " forget --prune " + (concatStringsSep " " backup.pruneOpts) )
+ ( resticCmd + " check" )
+ ];
in nameValuePair "restic-backups-${name}" ({
environment = {
RESTIC_PASSWORD_FILE = backup.passwordFile;
RESTIC_REPOSITORY = backup.repository;
};
- path = with pkgs; [
- openssh
- ];
+ path = [ pkgs.openssh ];
restartIfChanged = false;
serviceConfig = {
Type = "oneshot";
- ExecStart = "${resticCmd} backup ${concatStringsSep " " backup.extraBackupArgs} ${concatStringsSep " " backup.paths}";
+ ExecStart = [ "${resticCmd} backup ${concatStringsSep " " backup.extraBackupArgs} ${backupPaths}" ] ++ pruneCmd;
User = backup.user;
+ RuntimeDirectory = "restic-backups-${name}";
} // optionalAttrs (backup.s3CredentialsFile != null) {
EnvironmentFile = backup.s3CredentialsFile;
};
- } // optionalAttrs backup.initialize {
+ } // optionalAttrs (backup.initialize || backup.dynamicFilesFrom != null) {
preStart = ''
- ${resticCmd} snapshots || ${resticCmd} init
+ ${optionalString (backup.initialize) ''
+ ${resticCmd} snapshots || ${resticCmd} init
+ ''}
+ ${optionalString (backup.dynamicFilesFrom != null) ''
+ ${pkgs.writeScript "dynamicFilesFromScript" backup.dynamicFilesFrom} > ${filesFromTmpFile}
+ ''}
+ '';
+ } // optionalAttrs (backup.dynamicFilesFrom != null) {
+ postStart = ''
+ rm ${filesFromTmpFile}
'';
})
) config.services.restic.backups;
diff --git a/nixos/modules/services/cluster/kubernetes/pki.nix b/nixos/modules/services/cluster/kubernetes/pki.nix
index 733479e24c97717df05ae799f7734093f8f7401a..4275563f1a36b3d7eaff41d153f0892d9773a465 100644
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@@ -20,6 +20,7 @@ let
size = 2048;
};
CN = top.masterAddress;
+ hosts = cfg.cfsslAPIExtraSANs;
});
cfsslAPITokenBaseName = "apitoken.secret";
@@ -66,6 +67,15 @@ in
type = bool;
};
+ cfsslAPIExtraSANs = mkOption {
+ description = ''
+ Extra x509 Subject Alternative Names to be added to the cfssl API webserver TLS cert.
+ '';
+ default = [];
+ example = [ "subdomain.example.com" ];
+ type = listOf str;
+ };
+
genCfsslAPIToken = mkOption {
description = ''
Whether to automatically generate cfssl API-token secret,
diff --git a/nixos/modules/services/continuous-integration/buildkite-agent.nix b/nixos/modules/services/continuous-integration/buildkite-agent.nix
index 32f361454bc18434845a5c70398cc7a5402b6bf9..58bce654941414cfa727c068f19a8ef2006d8911 100644
--- a/nixos/modules/services/continuous-integration/buildkite-agent.nix
+++ b/nixos/modules/services/continuous-integration/buildkite-agent.nix
@@ -50,8 +50,8 @@ in
};
runtimePackages = mkOption {
- default = [ pkgs.bash pkgs.nix ];
- defaultText = "[ pkgs.bash pkgs.nix ]";
+ default = [ pkgs.bash pkgs.gnutar pkgs.gzip pkgs.git pkgs.nix ];
+ defaultText = "[ pkgs.bash pkgs.gnutar pkgs.gzip pkgs.git pkgs.nix ]";
description = "Add programs to the buildkite-agent environment";
type = types.listOf types.package;
};
@@ -74,13 +74,12 @@ in
'';
};
- meta-data = mkOption {
- type = types.str;
- default = "";
- example = "queue=default,docker=true,ruby2=true";
+ tags = mkOption {
+ type = types.attrsOf types.str;
+ default = {};
+ example = { queue = "default"; docker = "true"; ruby2 ="true"; };
description = ''
- Meta data for the agent. This is a comma-separated list of
- key=value pairs.
+ Tags for the agent.
'';
};
@@ -93,26 +92,20 @@ in
'';
};
- openssh =
- { privateKeyPath = mkOption {
- type = types.path;
- description = ''
- Private agent key.
+ privateSshKeyPath = mkOption {
+ type = types.nullOr types.path;
+ default = null;
+ ## maximum care is taken so that secrets (ssh keys and the CI token)
+ ## don't end up in the Nix store.
+ apply = final: if final == null then null else toString final;
- A run-time path to the key file, which is supposed to be provisioned
- outside of Nix store.
- '';
- };
- publicKeyPath = mkOption {
- type = types.path;
- description = ''
- Public agent key.
-
- A run-time path to the key file, which is supposed to be provisioned
- outside of Nix store.
- '';
- };
- };
+ description = ''
+ OpenSSH private key
+
+ A run-time path to the key file, which is supposed to be provisioned
+ outside of Nix store.
+ '';
+ };
hooks = mkHookOptions [
{ name = "checkout";
@@ -181,18 +174,26 @@ in
instead.
'';
};
+
+ shell = mkOption {
+ type = types.str;
+ default = "${pkgs.bash}/bin/bash -e -c";
+ description = ''
+ Command that buildkite-agent 3 will execute when it spawns a shell.
+ '';
+ };
};
};
config = mkIf config.services.buildkite-agent.enable {
- users.users.buildkite-agent =
- { name = "buildkite-agent";
- home = cfg.dataDir;
- createHome = true;
- description = "Buildkite agent user";
- extraGroups = [ "keys" ];
- isSystemUser = true;
- };
+ users.users.buildkite-agent = {
+ name = "buildkite-agent";
+ home = cfg.dataDir;
+ createHome = true;
+ description = "Buildkite agent user";
+ extraGroups = [ "keys" ];
+ isSystemUser = true;
+ };
environment.systemPackages = [ cfg.package ];
@@ -210,17 +211,18 @@ in
## don't end up in the Nix store.
preStart = let
sshDir = "${cfg.dataDir}/.ssh";
+ tagStr = lib.concatStringsSep "," (lib.mapAttrsToList (name: value: "${name}=${value}") cfg.tags);
in
- ''
+ optionalString (cfg.privateSshKeyPath != null) ''
mkdir -m 0700 -p "${sshDir}"
- cp -f "${toString cfg.openssh.privateKeyPath}" "${sshDir}/id_rsa"
- cp -f "${toString cfg.openssh.publicKeyPath}" "${sshDir}/id_rsa.pub"
- chmod 600 "${sshDir}"/id_rsa*
-
+ cp -f "${toString cfg.privateSshKeyPath}" "${sshDir}/id_rsa"
+ chmod 600 "${sshDir}"/id_rsa
+ '' + ''
cat > "${cfg.dataDir}/buildkite-agent.cfg" <
+ or victoriametrics -help for more
+ information.
+ '';
+ };
+ };
+ config = lib.mkIf cfg.enable {
+ systemd.services.victoriametrics = {
+ description = "VictoriaMetrics time series database";
+ after = [ "network.target" ];
+ serviceConfig = {
+ Restart = "on-failure";
+ RestartSec = 1;
+ StartLimitBurst = 5;
+ StateDirectory = "victoriametrics";
+ DynamicUser = true;
+ ExecStart = ''
+ ${cfg.package}/bin/victoria-metrics \
+ -storageDataPath=/var/lib/victoriametrics \
+ -httpListenAddr ${cfg.listenAddress}
+ -retentionPeriod ${toString cfg.retentionPeriod}
+ ${lib.escapeShellArgs cfg.extraOptions}
+ '';
+ };
+ wantedBy = [ "multi-user.target" ];
+
+ postStart =
+ let
+ bindAddr = (lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
+ in
+ lib.mkBefore ''
+ until ${lib.getBin pkgs.curl}/bin/curl -s -o /dev/null http://${bindAddr}/ping; do
+ sleep 1;
+ done
+ '';
+ };
+ };
+}
diff --git a/nixos/modules/services/desktops/gnome3/at-spi2-core.nix b/nixos/modules/services/desktops/gnome3/at-spi2-core.nix
index cca98c43dc7a2da31f6e157362a054603d9c77cb..8fa108c4f9df432789229b40ea33e847e5c3993e 100644
--- a/nixos/modules/services/desktops/gnome3/at-spi2-core.nix
+++ b/nixos/modules/services/desktops/gnome3/at-spi2-core.nix
@@ -18,6 +18,9 @@ with lib;
description = ''
Whether to enable at-spi2-core, a service for the Assistive Technologies
available on the GNOME platform.
+
+ Enable this if you get the error or warning
+ The name org.a11y.Bus was not provided by any .service files.
'';
};
diff --git a/nixos/modules/services/development/jupyter/default.nix b/nixos/modules/services/development/jupyter/default.nix
index f20860af6e12874b6462bc0e2c7a5e71cbcb8e58..e598b0186450bea61247a2ffe6085a868459a726 100644
--- a/nixos/modules/services/development/jupyter/default.nix
+++ b/nixos/modules/services/development/jupyter/default.nix
@@ -118,15 +118,15 @@ in {
in {
displayName = "Python 3 for machine learning";
argv = [
- "$ {env.interpreter}"
+ "''${env.interpreter}"
"-m"
"ipykernel_launcher"
"-f"
"{connection_file}"
];
language = "python";
- logo32 = "$ {env.sitePackages}/ipykernel/resources/logo-32x32.png";
- logo64 = "$ {env.sitePackages}/ipykernel/resources/logo-64x64.png";
+ logo32 = "''${env.sitePackages}/ipykernel/resources/logo-32x32.png";
+ logo64 = "''${env.sitePackages}/ipykernel/resources/logo-64x64.png";
};
}
'';
diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix
index 51877970a8bcb25eaa58aca2270d48728e39403f..e586af25c2b1d180bb098be5fc58ebf8070746d6 100644
--- a/nixos/modules/services/hardware/fwupd.nix
+++ b/nixos/modules/services/hardware/fwupd.nix
@@ -53,7 +53,7 @@ in {
blacklistPlugins = mkOption {
type = types.listOf types.str;
- default = [ "test" ];
+ default = [];
example = [ "udev" ];
description = ''
Allow blacklisting specific plugins
@@ -91,6 +91,9 @@ in {
###### implementation
config = mkIf cfg.enable {
+ # Disable test related plug-ins implicitly so that users do not have to care about them.
+ services.fwupd.blacklistPlugins = cfg.package.defaultBlacklistedPlugins;
+
environment.systemPackages = [ cfg.package ];
environment.etc = {
diff --git a/nixos/modules/services/hardware/irqbalance.nix b/nixos/modules/services/hardware/irqbalance.nix
index b139154432cf95f0801bf3c6d0461c075b84fb2b..c79e0eb83ecea1754bdb7be54d9fe23e18284b21 100644
--- a/nixos/modules/services/hardware/irqbalance.nix
+++ b/nixos/modules/services/hardware/irqbalance.nix
@@ -13,18 +13,12 @@ in
config = mkIf cfg.enable {
- systemd.services = {
- irqbalance = {
- description = "irqbalance daemon";
- path = [ pkgs.irqbalance ];
- serviceConfig =
- { ExecStart = "${pkgs.irqbalance}/bin/irqbalance --foreground"; };
- wantedBy = [ "multi-user.target" ];
- };
- };
-
environment.systemPackages = [ pkgs.irqbalance ];
+ systemd.services.irqbalance.wantedBy = ["multi-user.target"];
+
+ systemd.packages = [ pkgs.irqbalance ];
+
};
}
diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix
index e917209f3d1f500274028c37cec4dea918594abf..43dc185cdd77729878dd9732e9d10e695a30f58d 100644
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@@ -6,37 +6,18 @@ let
cfg = config.services.mailman;
- mailmanPyEnv = pkgs.python3.withPackages (ps: with ps; [mailman mailman-hyperkitty]);
-
- mailmanExe = with pkgs; stdenv.mkDerivation {
- name = "mailman-" + python3Packages.mailman.version;
- buildInputs = [makeWrapper];
- unpackPhase = ":";
- installPhase = ''
- mkdir -p $out/bin
- makeWrapper ${mailmanPyEnv}/bin/mailman $out/bin/mailman \
- --set MAILMAN_CONFIG_FILE /etc/mailman.cfg
- '';
- };
-
- mailmanWeb = pkgs.python3Packages.mailman-web.override {
- serverEMail = cfg.siteOwner;
- archiverKey = cfg.hyperkittyApiKey;
- allowedHosts = cfg.webHosts;
- };
-
- mailmanWebPyEnv = pkgs.python3.withPackages (x: with x; [mailman-web]);
-
- mailmanWebExe = with pkgs; stdenv.mkDerivation {
- inherit (mailmanWeb) name;
- buildInputs = [makeWrapper];
- unpackPhase = ":";
- installPhase = ''
- mkdir -p $out/bin
- makeWrapper ${mailmanWebPyEnv}/bin/django-admin $out/bin/mailman-web \
- --set DJANGO_SETTINGS_MODULE settings
- '';
- };
+ # This deliberately doesn't use recursiveUpdate so users can
+ # override the defaults.
+ settings = {
+ DEFAULT_FROM_EMAIL = cfg.siteOwner;
+ SERVER_EMAIL = cfg.siteOwner;
+ ALLOWED_HOSTS = [ "localhost" "127.0.0.1" ] ++ cfg.webHosts;
+ COMPRESS_OFFLINE = true;
+ STATIC_ROOT = "/var/lib/mailman-web/static";
+ MEDIA_ROOT = "/var/lib/mailman-web/media";
+ } // cfg.webSettings;
+
+ settingsJSON = pkgs.writeText "settings.json" (builtins.toJSON settings);
mailmanCfg = ''
[mailman]
@@ -53,30 +34,42 @@ let
etc_dir: /etc
ext_dir: $etc_dir/mailman.d
pid_file: /run/mailman/master.pid
- '' + optionalString (cfg.hyperkittyApiKey != null) ''
+ '' + optionalString cfg.hyperkitty.enable ''
+
[archiver.hyperkitty]
class: mailman_hyperkitty.Archiver
enable: yes
- configuration: ${pkgs.writeText "mailman-hyperkitty.cfg" mailmanHyperkittyCfg}
+ configuration: /var/lib/mailman/mailman-hyperkitty.cfg
'';
- mailmanHyperkittyCfg = ''
+ mailmanHyperkittyCfg = pkgs.writeText "mailman-hyperkitty.cfg" ''
[general]
# This is your HyperKitty installation, preferably on the localhost. This
# address will be used by Mailman to forward incoming emails to HyperKitty
# for archiving. It does not need to be publicly available, in fact it's
# better if it is not.
- base_url: ${cfg.hyperkittyBaseUrl}
+ base_url: ${cfg.hyperkitty.baseUrl}
# Shared API key, must be the identical to the value in HyperKitty's
# settings.
- api_key: ${cfg.hyperkittyApiKey}
+ api_key: @API_KEY@
'';
in {
###### interface
+ imports = [
+ (mkRenamedOptionModule [ "services" "mailman" "hyperkittyBaseUrl" ]
+ [ "services" "mailman" "hyperkitty" "baseUrl" ])
+
+ (mkRemovedOptionModule [ "services" "mailman" "hyperkittyApiKey" ] ''
+ The Hyperkitty API key is now generated on first run, and not
+ stored in the world-readable Nix store. To continue using
+ Hyperkitty, you must set services.mailman.hyperkitty.enable = true.
+ '')
+ ];
+
options = {
services.mailman = {
@@ -87,9 +80,17 @@ in {
description = "Enable Mailman on this host. Requires an active Postfix installation.";
};
+ package = mkOption {
+ type = types.package;
+ default = pkgs.mailman;
+ defaultText = "pkgs.mailman";
+ example = "pkgs.mailman.override { archivers = []; }";
+ description = "Mailman package to use";
+ };
+
siteOwner = mkOption {
type = types.str;
- default = "postmaster@example.org";
+ example = "postmaster@example.org";
description = ''
Certain messages that must be delivered to a human, but which can't
be delivered to a list owner (e.g. a bounce from a list owner), will
@@ -99,12 +100,13 @@ in {
webRoot = mkOption {
type = types.path;
- default = "${mailmanWeb}/${pkgs.python3.sitePackages}";
- defaultText = "pkgs.python3Packages.mailman-web";
+ default = "${pkgs.mailman-web}/${pkgs.python3.sitePackages}";
+ defaultText = "\${pkgs.mailman-web}/\${pkgs.python3.sitePackages}";
description = ''
The web root for the Hyperkity + Postorius apps provided by Mailman.
This variable can be set, of course, but it mainly exists so that site
- admins can refer to it in their own hand-written httpd configuration files.
+ admins can refer to it in their own hand-written web server
+ configuration files.
'';
};
@@ -120,26 +122,35 @@ in {
'';
};
- hyperkittyBaseUrl = mkOption {
+ webUser = mkOption {
type = types.str;
- default = "http://localhost/hyperkitty/";
+ default = config.services.httpd.user;
description = ''
- Where can Mailman connect to Hyperkitty's internal API, preferably on
- localhost?
+ User to run mailman-web as
'';
};
- hyperkittyApiKey = mkOption {
- type = types.nullOr types.str;
- default = null;
+ webSettings = mkOption {
+ type = types.attrs;
+ default = {};
description = ''
- The shared secret used to authenticate Mailman's internal
- communication with Hyperkitty. Must be set to enable support for the
- Hyperkitty archiver. Note that this secret is going to be visible to
- all local users in the Nix store.
+ Overrides for the default mailman-web Django settings.
'';
};
+ hyperkitty = {
+ enable = mkEnableOption "the Hyperkitty archiver for Mailman";
+
+ baseUrl = mkOption {
+ type = types.str;
+ default = "http://localhost/hyperkitty/";
+ description = ''
+ Where can Mailman connect to Hyperkitty's internal API, preferably on
+ localhost?
+ '';
+ };
+ };
+
};
};
@@ -147,25 +158,58 @@ in {
config = mkIf cfg.enable {
- assertions = [
- { assertion = cfg.enable -> config.services.postfix.enable;
+ assertions = let
+ inherit (config.services) postfix;
+
+ requirePostfixHash = optionPath: dataFile:
+ with lib;
+ let
+ expected = "hash:/var/lib/mailman/data/${dataFile}";
+ value = attrByPath optionPath [] postfix;
+ in
+ { assertion = postfix.enable -> isList value && elem expected value;
+ message = ''
+ services.postfix.${concatStringsSep "." optionPath} must contain
+ "${expected}".
+ See .
+ '';
+ };
+ in [
+ { assertion = postfix.enable;
message = "Mailman requires Postfix";
}
+ (requirePostfixHash [ "relayDomains" ] "postfix_domains")
+ (requirePostfixHash [ "config" "transport_maps" ] "postfix_lmtp")
+ (requirePostfixHash [ "config" "local_recipient_maps" ] "postfix_lmtp")
];
users.users.mailman = { description = "GNU Mailman"; isSystemUser = true; };
- environment = {
- systemPackages = [ mailmanExe mailmanWebExe pkgs.sassc ];
- etc."mailman.cfg".text = mailmanCfg;
- };
+ environment.etc."mailman.cfg".text = mailmanCfg;
+
+ environment.etc."mailman3/settings.py".text = ''
+ import os
+
+ # Required by mailman_web.settings, but will be overridden when
+ # settings_local.json is loaded.
+ os.environ["SECRET_KEY"] = ""
+
+ from mailman_web.settings import *
+
+ import json
+
+ with open('${settingsJSON}') as f:
+ globals().update(json.load(f))
+
+ with open('/var/lib/mailman-web/settings_local.json') as f:
+ globals().update(json.load(f))
+ '';
+
+ environment.systemPackages = [ cfg.package ] ++ (with pkgs; [ mailman-web ]);
services.postfix = {
- relayDomains = [ "hash:/var/lib/mailman/data/postfix_domains" ];
recipientDelimiter = "+"; # bake recipient addresses in mail envelopes via VERP
config = {
- transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
- local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
owner_request_special = "no"; # Mailman handles -owner addresses on its own
};
};
@@ -173,34 +217,71 @@ in {
systemd.services.mailman = {
description = "GNU Mailman Master Process";
after = [ "network.target" ];
+ restartTriggers = [ config.environment.etc."mailman.cfg".source ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
- ExecStart = "${mailmanExe}/bin/mailman start";
- ExecStop = "${mailmanExe}/bin/mailman stop";
+ ExecStart = "${cfg.package}/bin/mailman start";
+ ExecStop = "${cfg.package}/bin/mailman stop";
User = "mailman";
Type = "forking";
- StateDirectory = "mailman";
- StateDirectoryMode = "0700";
RuntimeDirectory = "mailman";
PIDFile = "/run/mailman/master.pid";
};
};
+ systemd.services.mailman-settings = {
+ description = "Generate settings files (including secrets) for Mailman";
+ before = [ "mailman.service" "mailman-web.service" "hyperkitty.service" "httpd.service" "uwsgi.service" ];
+ requiredBy = [ "mailman.service" "mailman-web.service" "hyperkitty.service" "httpd.service" "uwsgi.service" ];
+ path = with pkgs; [ jq ];
+ script = ''
+ mailmanDir=/var/lib/mailman
+ mailmanWebDir=/var/lib/mailman-web
+
+ mailmanCfg=$mailmanDir/mailman-hyperkitty.cfg
+ mailmanWebCfg=$mailmanWebDir/settings_local.json
+
+ install -m 0700 -o mailman -g nogroup -d $mailmanDir
+ install -m 0700 -o ${cfg.webUser} -g nogroup -d $mailmanWebDir
+
+ if [ ! -e $mailmanWebCfg ]; then
+ hyperkittyApiKey=$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 64)
+ secretKey=$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 64)
+
+ mailmanWebCfgTmp=$(mktemp)
+ jq -n '.MAILMAN_ARCHIVER_KEY=$archiver_key | .SECRET_KEY=$secret_key' \
+ --arg archiver_key "$hyperkittyApiKey" \
+ --arg secret_key "$secretKey" \
+ >"$mailmanWebCfgTmp"
+ chown ${cfg.webUser} "$mailmanWebCfgTmp"
+ mv -n "$mailmanWebCfgTmp" $mailmanWebCfg
+ fi
+
+ hyperkittyApiKey="$(jq -r .MAILMAN_ARCHIVER_KEY $mailmanWebCfg)"
+ mailmanCfgTmp=$(mktemp)
+ sed "s/@API_KEY@/$hyperkittyApiKey/g" ${mailmanHyperkittyCfg} >"$mailmanCfgTmp"
+ chown mailman "$mailmanCfgTmp"
+ mv "$mailmanCfgTmp" $mailmanCfg
+ '';
+ serviceConfig = {
+ Type = "oneshot";
+ };
+ };
+
systemd.services.mailman-web = {
description = "Init Postorius DB";
- before = [ "httpd.service" ];
- requiredBy = [ "httpd.service" ];
+ before = [ "httpd.service" "uwsgi.service" ];
+ requiredBy = [ "httpd.service" "uwsgi.service" ];
+ restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
script = ''
- ${mailmanWebExe}/bin/mailman-web migrate
+ ${pkgs.mailman-web}/bin/mailman-web migrate
rm -rf static
- ${mailmanWebExe}/bin/mailman-web collectstatic
- ${mailmanWebExe}/bin/mailman-web compress
+ ${pkgs.mailman-web}/bin/mailman-web collectstatic
+ ${pkgs.mailman-web}/bin/mailman-web compress
'';
serviceConfig = {
- User = config.services.httpd.user;
+ User = cfg.webUser;
Type = "oneshot";
- StateDirectory = "mailman-web";
- StateDirectoryMode = "0700";
WorkingDirectory = "/var/lib/mailman-web";
};
};
@@ -208,86 +289,94 @@ in {
systemd.services.mailman-daily = {
description = "Trigger daily Mailman events";
startAt = "daily";
+ restartTriggers = [ config.environment.etc."mailman.cfg".source ];
serviceConfig = {
- ExecStart = "${mailmanExe}/bin/mailman digests --send";
+ ExecStart = "${cfg.package}/bin/mailman digests --send";
User = "mailman";
};
};
systemd.services.hyperkitty = {
- enable = cfg.hyperkittyApiKey != null;
+ inherit (cfg.hyperkitty) enable;
description = "GNU Hyperkitty QCluster Process";
after = [ "network.target" ];
+ restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
wantedBy = [ "mailman.service" "multi-user.target" ];
serviceConfig = {
- ExecStart = "${mailmanWebExe}/bin/mailman-web qcluster";
- User = config.services.httpd.user;
+ ExecStart = "${pkgs.mailman-web}/bin/mailman-web qcluster";
+ User = cfg.webUser;
WorkingDirectory = "/var/lib/mailman-web";
};
};
systemd.services.hyperkitty-minutely = {
- enable = cfg.hyperkittyApiKey != null;
+ inherit (cfg.hyperkitty) enable;
description = "Trigger minutely Hyperkitty events";
startAt = "minutely";
+ restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
serviceConfig = {
- ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs minutely";
- User = config.services.httpd.user;
+ ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs minutely";
+ User = cfg.webUser;
WorkingDirectory = "/var/lib/mailman-web";
};
};
systemd.services.hyperkitty-quarter-hourly = {
- enable = cfg.hyperkittyApiKey != null;
+ inherit (cfg.hyperkitty) enable;
description = "Trigger quarter-hourly Hyperkitty events";
startAt = "*:00/15";
+ restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
serviceConfig = {
- ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs quarter_hourly";
- User = config.services.httpd.user;
+ ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs quarter_hourly";
+ User = cfg.webUser;
WorkingDirectory = "/var/lib/mailman-web";
};
};
systemd.services.hyperkitty-hourly = {
- enable = cfg.hyperkittyApiKey != null;
+ inherit (cfg.hyperkitty) enable;
description = "Trigger hourly Hyperkitty events";
startAt = "hourly";
+ restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
serviceConfig = {
- ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs hourly";
- User = config.services.httpd.user;
+ ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs hourly";
+ User = cfg.webUser;
WorkingDirectory = "/var/lib/mailman-web";
};
};
systemd.services.hyperkitty-daily = {
- enable = cfg.hyperkittyApiKey != null;
+ inherit (cfg.hyperkitty) enable;
description = "Trigger daily Hyperkitty events";
startAt = "daily";
+ restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
serviceConfig = {
- ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs daily";
- User = config.services.httpd.user;
+ ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs daily";
+ User = cfg.webUser;
WorkingDirectory = "/var/lib/mailman-web";
};
};
systemd.services.hyperkitty-weekly = {
- enable = cfg.hyperkittyApiKey != null;
+ inherit (cfg.hyperkitty) enable;
description = "Trigger weekly Hyperkitty events";
startAt = "weekly";
+ restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
serviceConfig = {
- ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs weekly";
- User = config.services.httpd.user;
+ ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs weekly";
+ User = cfg.webUser;
WorkingDirectory = "/var/lib/mailman-web";
};
};
systemd.services.hyperkitty-yearly = {
- enable = cfg.hyperkittyApiKey != null;
+ inherit (cfg.hyperkitty) enable;
description = "Trigger yearly Hyperkitty events";
startAt = "yearly";
+ restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
serviceConfig = {
- ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs yearly";
- User = config.services.httpd.user;
+ ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs yearly";
+ User = cfg.webUser;
WorkingDirectory = "/var/lib/mailman-web";
};
};
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 36dda619ad06335a76c16a256efd35537d2d8db1..0bb0eaedad5007efae85cbc1f7bd81742f4c8c09 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -5,6 +5,8 @@ with lib;
let
cfg = config.services.roundcube;
fpm = config.services.phpfpm.pools.roundcube;
+ localDB = cfg.database.host == "localhost";
+ user = cfg.database.username;
in
{
options.services.roundcube = {
@@ -44,7 +46,10 @@ in
username = mkOption {
type = types.str;
default = "roundcube";
- description = "Username for the postgresql connection";
+ description = ''
+ Username for the postgresql connection.
+ If database.host is set to localhost, a unix user and group of the same name will be created as well.
+ '';
};
host = mkOption {
type = types.str;
@@ -58,7 +63,12 @@ in
};
password = mkOption {
type = types.str;
- description = "Password for the postgresql connection";
+ description = "Password for the postgresql connection. Do not use: the password will be stored world readable in the store; use passwordFile instead.";
+ default = "";
+ };
+ passwordFile = mkOption {
+ type = types.str;
+ description = "Password file for the postgresql connection. Must be readable by user nginx. Ignored if database.host is set to localhost, as peer authentication will be used.";
};
dbname = mkOption {
type = types.str;
@@ -83,14 +93,22 @@ in
};
config = mkIf cfg.enable {
+ # backward compatibility: if password is set but not passwordFile, make one.
+ services.roundcube.database.passwordFile = mkIf (!localDB && cfg.database.password != "") (mkDefault ("${pkgs.writeText "roundcube-password" cfg.database.password}"));
+ warnings = lib.optional (!localDB && cfg.database.password != "") "services.roundcube.database.password is deprecated and insecure; use services.roundcube.database.passwordFile instead";
+
environment.etc."roundcube/config.inc.php".text = ''
/var/lib/roundcube/des_key;
+ # we need to log out everyone in case change the des_key
+ # from the default when upgrading from nixos 19.09
+ ${psql} <<< 'TRUNCATE TABLE session;'
fi
${pkgs.php}/bin/php ${cfg.package}/bin/update.sh
'';
- serviceConfig.Type = "oneshot";
+ serviceConfig = {
+ Type = "oneshot";
+ StateDirectory = "roundcube";
+ User = if localDB then user else "nginx";
+ # so that the des_key is not world readable
+ StateDirectoryMode = "0700";
+ };
}
];
};
diff --git a/nixos/modules/services/mail/spamassassin.nix b/nixos/modules/services/mail/spamassassin.nix
index 75442c7cdb5e1f4917a4d0f0763c7e2c887253df..2d5fb40fad357ea30a20b49d9fd958f0e75b6f14 100644
--- a/nixos/modules/services/mail/spamassassin.nix
+++ b/nixos/modules/services/mail/spamassassin.nix
@@ -6,15 +6,6 @@ let
cfg = config.services.spamassassin;
spamassassin-local-cf = pkgs.writeText "local.cf" cfg.config;
- spamdEnv = pkgs.buildEnv {
- name = "spamd-env";
- paths = [];
- postBuild = ''
- ln -sf ${spamassassin-init-pre} $out/init.pre
- ln -sf ${spamassassin-local-cf} $out/local.cf
- '';
- };
-
in
{
@@ -120,13 +111,11 @@ in
};
config = mkIf cfg.enable {
+ environment.etc."mail/spamassassin/init.pre".source = cfg.initPreConf;
+ environment.etc."mail/spamassassin/local.cf".source = spamassassin-local-cf;
# Allow users to run 'spamc'.
-
- environment = {
- etc.spamassassin.source = spamdEnv;
- systemPackages = [ pkgs.spamassassin ];
- };
+ environment.systemPackages = [ pkgs.spamassassin ];
users.users.spamd = {
description = "Spam Assassin Daemon";
@@ -141,7 +130,7 @@ in
systemd.services.sa-update = {
script = ''
set +e
- ${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/ --siteconfigpath=${spamdEnv}/" spamd
+ ${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/" spamd
v=$?
set -e
@@ -172,7 +161,7 @@ in
after = [ "network.target" ];
serviceConfig = {
- ExecStart = "${pkgs.spamassassin}/bin/spamd ${optionalString cfg.debug "-D"} --username=spamd --groupname=spamd --siteconfigpath=${spamdEnv} --virtual-config-dir=/var/lib/spamassassin/user-%u --allow-tell --pidfile=/run/spamd.pid";
+ ExecStart = "${pkgs.spamassassin}/bin/spamd ${optionalString cfg.debug "-D"} --username=spamd --groupname=spamd --virtual-config-dir=/var/lib/spamassassin/user-%u --allow-tell --pidfile=/run/spamd.pid";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
};
@@ -183,7 +172,7 @@ in
mkdir -p /var/lib/spamassassin
chown spamd:spamd /var/lib/spamassassin -R
set +e
- ${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/ --siteconfigpath=${spamdEnv}/" spamd
+ ${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/" spamd
v=$?
set -e
if [ $v -gt 1 ]; then
diff --git a/nixos/modules/services/misc/freeswitch.nix b/nixos/modules/services/misc/freeswitch.nix
new file mode 100644
index 0000000000000000000000000000000000000000..0de5ba428110ae5e586f645b462826cc2c60b256
--- /dev/null
+++ b/nixos/modules/services/misc/freeswitch.nix
@@ -0,0 +1,103 @@
+{ config, lib, pkgs, ...}:
+with lib;
+let
+ cfg = config.services.freeswitch;
+ pkg = cfg.package;
+ configDirectory = pkgs.runCommand "freeswitch-config-d" { } ''
+ mkdir -p $out
+ cp -rT ${cfg.configTemplate} $out
+ chmod -R +w $out
+ ${concatStringsSep "\n" (mapAttrsToList (fileName: filePath: ''
+ mkdir -p $out/$(dirname ${fileName})
+ cp ${filePath} $out/${fileName}
+ '') cfg.configDir)}
+ '';
+ configPath = if cfg.enableReload
+ then "/etc/freeswitch"
+ else configDirectory;
+in {
+ options = {
+ services.freeswitch = {
+ enable = mkEnableOption "FreeSWITCH";
+ enableReload = mkOption {
+ default = false;
+ type = types.bool;
+ description = ''
+ Issue the reloadxml command to FreeSWITCH when configuration directory changes (instead of restart).
+ See FreeSWITCH documentation for more info.
+ The configuration directory is exposed at /etc/freeswitch.
+ See also systemd.services.*.restartIfChanged.
+ '';
+ };
+ configTemplate = mkOption {
+ type = types.path;
+ default = "${config.services.freeswitch.package}/share/freeswitch/conf/vanilla";
+ defaultText = literalExample "\${config.services.freeswitch.package}/share/freeswitch/conf/vanilla";
+ example = literalExample "\${config.services.freeswitch.package}/share/freeswitch/conf/minimal";
+ description = ''
+ Configuration template to use.
+ See available templates in FreeSWITCH repository.
+ You can also set your own configuration directory.
+ '';
+ };
+ configDir = mkOption {
+ type = with types; attrsOf path;
+ default = { };
+ example = literalExample ''
+ {
+ "freeswitch.xml" = ./freeswitch.xml;
+ "dialplan/default.xml" = pkgs.writeText "dialplan-default.xml" '''
+ [xml lines]
+ ''';
+ }
+ '';
+ description = ''
+ Override file in FreeSWITCH config template directory.
+ Each top-level attribute denotes a file path in the configuration directory, its value is the file path.
+ See FreeSWITCH documentation for more info.
+ Also check available templates in FreeSWITCH repository.
+ '';
+ };
+ package = mkOption {
+ type = types.package;
+ default = pkgs.freeswitch;
+ defaultText = literalExample "pkgs.freeswitch";
+ example = literalExample "pkgs.freeswitch";
+ description = ''
+ FreeSWITCH package.
+ '';
+ };
+ };
+ };
+ config = mkIf cfg.enable {
+ environment.etc.freeswitch = mkIf cfg.enableReload {
+ source = configDirectory;
+ };
+ systemd.services.freeswitch-config-reload = mkIf cfg.enableReload {
+ before = [ "freeswitch.service" ];
+ wantedBy = [ "multi-user.target" ];
+ restartTriggers = [ configDirectory ];
+ serviceConfig = {
+ ExecStart = "${pkgs.systemd}/bin/systemctl try-reload-or-restart freeswitch.service";
+ RemainAfterExit = true;
+ Type = "oneshot";
+ };
+ };
+ systemd.services.freeswitch = {
+ description = "Free and open-source application server for real-time communication";
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+ serviceConfig = {
+ DynamicUser = true;
+ StateDirectory = "freeswitch";
+ ExecStart = "${pkg}/bin/freeswitch -nf \\
+ -mod ${pkg}/lib/freeswitch/mod \\
+ -conf ${configPath} \\
+ -base /var/lib/freeswitch";
+ ExecReload = "${pkg}/bin/fs_cli -x reloadxml";
+ Restart = "always";
+ RestartSec = "5s";
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 258476dd9feb3933cdfcc1e384b9eadd99378e14..38910a5a005d4b21a977ce528354ea4b97829da3 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -364,7 +364,7 @@ in
''}
sed -e "s,#secretkey#,$KEY,g" \
-e "s,#dbpass#,$DBPASS,g" \
- -e "s,#jwtsecet#,$JWTSECET,g" \
+ -e "s,#jwtsecret#,$JWTSECRET,g" \
-e "s,#mailerpass#,$MAILERPASSWORD,g" \
-i ${runConfig}
chmod 640 ${runConfig} ${secretKey} ${jwtSecret}
diff --git a/nixos/modules/services/misc/home-assistant.nix b/nixos/modules/services/misc/home-assistant.nix
index cc113ca2d0c1a63546ff54ec86f647739d36c6e3..d63f38e93b8e135f3289b21094e86dfb277d64d1 100644
--- a/nixos/modules/services/misc/home-assistant.nix
+++ b/nixos/modules/services/misc/home-assistant.nix
@@ -251,6 +251,7 @@ in {
home = cfg.configDir;
createHome = true;
group = "hass";
+ extraGroups = [ "dialout" ];
uid = config.ids.uids.hass;
};
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 3985dc0b303c20e4c2bf84c86b99728964db981d..bfaf760fb8363a7ed8c7365bb69b9194c9b4bced 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -123,9 +123,9 @@ in
config = mkIf cfg.enable {
systemd.tmpfiles.rules = [
- "d '${cfg.dataDir}' - ${cfg.user} ${cfg.user} - -"
+ "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
] ++ (optional cfg.consumptionDirIsPublic
- "d '${cfg.consumptionDir}' 777 ${cfg.user} ${cfg.user} - -"
+ "d '${cfg.consumptionDir}' 777 - - - -"
# If the consumption dir is not created here, it's automatically created by
# 'manage' with the default permissions.
);
@@ -169,17 +169,15 @@ in
};
users = optionalAttrs (cfg.user == defaultUser) {
- users = [{
- name = defaultUser;
+ users.${defaultUser} = {
group = defaultUser;
uid = config.ids.uids.paperless;
home = cfg.dataDir;
- }];
+ };
- groups = [{
- name = defaultUser;
+ groups.${defaultUser} = {
gid = config.ids.gids.paperless;
- }];
+ };
};
};
}
diff --git a/nixos/modules/services/monitoring/nagios.nix b/nixos/modules/services/monitoring/nagios.nix
index 3ca79dddaf57aa9617f8262cbadc390d3daf151e..9ac6869068f2baa09050bc01649e038de24f03c6 100644
--- a/nixos/modules/services/monitoring/nagios.nix
+++ b/nixos/modules/services/monitoring/nagios.nix
@@ -154,7 +154,7 @@ in
};
virtualHost = mkOption {
- type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+ type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
example = literalExample ''
{ hostName = "example.org";
adminAddr = "webmaster@example.org";
diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager.nix b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
index 9af6b1d94f374e66e32fd7cb88f1b3f0ba4a2320..4534d150885ebd3e49efa14d019f69713a99d496 100644
--- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@@ -18,7 +18,7 @@ let
in checkedConfig yml;
cmdlineArgs = cfg.extraFlags ++ [
- "--config.file ${alertmanagerYml}"
+ "--config.file /tmp/alert-manager-substituted.yaml"
"--web.listen-address ${cfg.listenAddress}:${toString cfg.port}"
"--log.level ${cfg.logLevel}"
] ++ (optional (cfg.webExternalUrl != null)
@@ -127,6 +127,18 @@ in {
Extra commandline options when launching the Alertmanager.
'';
};
+
+ environmentFile = mkOption {
+ type = types.nullOr types.path;
+ default = null;
+ example = "/root/alertmanager.env";
+ description = ''
+ File to load as environment file. Environment variables
+ from this file will be interpolated into the config file
+ using envsubst with this syntax:
+ $ENVIRONMENT ''${VARIABLE}
+ '';
+ };
};
};
@@ -144,9 +156,14 @@ in {
systemd.services.alertmanager = {
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
+ preStart = ''
+ ${lib.getBin pkgs.envsubst}/bin/envsubst -o "/tmp/alert-manager-substituted.yaml" \
+ -i "${alertmanagerYml}"
+ '';
serviceConfig = {
Restart = "always";
- DynamicUser = true;
+ DynamicUser = true; # implies PrivateTmp
+ EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
WorkingDirectory = "/tmp";
ExecStart = "${cfg.package}/bin/alertmanager" +
optionalString (length cmdlineArgs != 0) (" \\\n " +
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix b/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
index f40819e826b0d6f4c4e725360360fc19f6857789..d50564717eaf73244017b4137ef5d30b928eccad 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
@@ -74,7 +74,7 @@ in
then "--systemd.slice ${cfg.systemd.slice}"
else "--systemd.unit ${cfg.systemd.unit}")
++ optional (cfg.systemd.enable && (cfg.systemd.journalPath != null))
- "--systemd.jounal_path ${cfg.systemd.journalPath}"
+ "--systemd.journal_path ${cfg.systemd.journalPath}"
++ optional (!cfg.systemd.enable) "--postfix.logfile_path ${cfg.logfilePath}")}
'';
};
diff --git a/nixos/modules/services/monitoring/prometheus/xmpp-alerts.nix b/nixos/modules/services/monitoring/prometheus/xmpp-alerts.nix
new file mode 100644
index 0000000000000000000000000000000000000000..44b15cb2034c2520446e0570c2c2ccd0f01054a1
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/xmpp-alerts.nix
@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.prometheus.xmpp-alerts;
+
+ configFile = pkgs.writeText "prometheus-xmpp-alerts.yml" (builtins.toJSON cfg.configuration);
+
+in
+
+{
+ options.services.prometheus.xmpp-alerts = {
+
+ enable = mkEnableOption "XMPP Web hook service for Alertmanager";
+
+ configuration = mkOption {
+ type = types.attrs;
+ description = "Configuration as attribute set which will be converted to YAML";
+ };
+
+ };
+
+ config = mkIf cfg.enable {
+ systemd.services.prometheus-xmpp-alerts = {
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network-online.target" ];
+ wants = [ "network-online.target" ];
+ serviceConfig = {
+ ExecStart = "${pkgs.prometheus-xmpp-alerts}/bin/prometheus-xmpp-alerts --config ${configFile}";
+ Restart = "on-failure";
+ DynamicUser = true;
+ PrivateTmp = true;
+ PrivateDevices = true;
+ ProtectHome = true;
+ ProtectSystem = "strict";
+ ProtectKernelTunables = true;
+ ProtectKernelModules = true;
+ ProtectControlGroups = true;
+ NoNewPrivileges = true;
+ SystemCallArchitectures = "native";
+ RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+ SystemCallFilter = [ "@system-service" ];
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/network-filesystems/kbfs.nix b/nixos/modules/services/network-filesystems/kbfs.nix
index 263b70d04a56d5ad620e4e513ec808d31aa851fc..a43ac656f6676298250ad8463ff8f340d1b9109c 100644
--- a/nixos/modules/services/network-filesystems/kbfs.nix
+++ b/nixos/modules/services/network-filesystems/kbfs.nix
@@ -1,6 +1,7 @@
{ config, lib, pkgs, ... }:
with lib;
let
+ inherit (config.security) wrapperDir;
cfg = config.services.kbfs;
in {
@@ -17,6 +18,16 @@ in {
description = "Whether to mount the Keybase filesystem.";
};
+ enableRedirector = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to enable the Keybase root redirector service, allowing
+ any user to access KBFS files via /keybase,
+ which will show different contents depending on the requester.
+ '';
+ };
+
mountPoint = mkOption {
type = types.str;
default = "%h/keybase";
@@ -41,26 +52,67 @@ in {
###### implementation
- config = mkIf cfg.enable {
-
- systemd.user.services.kbfs = {
- description = "Keybase File System";
- requires = [ "keybase.service" ];
- after = [ "keybase.service" ];
- path = [ "/run/wrappers" ];
- unitConfig.ConditionUser = "!@system";
- serviceConfig = {
- ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${cfg.mountPoint}";
- ExecStart = "${pkgs.kbfs}/bin/kbfsfuse ${toString cfg.extraFlags} ${cfg.mountPoint}";
- ExecStopPost = "/run/wrappers/bin/fusermount -u ${cfg.mountPoint}";
- Restart = "on-failure";
- PrivateTmp = true;
+ config = mkIf cfg.enable (mkMerge [
+ {
+ # Upstream: https://github.com/keybase/client/blob/master/packaging/linux/systemd/kbfs.service
+ systemd.user.services.kbfs = {
+ description = "Keybase File System";
+
+ # Note that the "Requires" directive will cause a unit to be restarted whenever its dependency is restarted.
+ # Do not issue a hard dependency on keybase, because kbfs can reconnect to a restarted service.
+ # Do not issue a hard dependency on keybase-redirector, because it's ok if it fails (e.g., if it is disabled).
+ wants = [ "keybase.service" ] ++ optional cfg.enableRedirector "keybase-redirector.service";
+ path = [ "/run/wrappers" ];
+ unitConfig.ConditionUser = "!@system";
+
+ serviceConfig = {
+ Type = "notify";
+ # Keybase notifies from a forked process
+ EnvironmentFile = [
+ "-%E/keybase/keybase.autogen.env"
+ "-%E/keybase/keybase.env"
+ ];
+ ExecStartPre = [
+ "${pkgs.coreutils}/bin/mkdir -p \"${cfg.mountPoint}\""
+ "-${wrapperDir}/fusermount -uz \"${cfg.mountPoint}\""
+ ];
+ ExecStart = "${pkgs.kbfs}/bin/kbfsfuse ${toString cfg.extraFlags} \"${cfg.mountPoint}\"";
+ ExecStop = "${wrapperDir}/fusermount -uz \"${cfg.mountPoint}\"";
+ Restart = "on-failure";
+ PrivateTmp = true;
+ };
+ wantedBy = [ "default.target" ];
};
- wantedBy = [ "default.target" ];
- };
- services.keybase.enable = true;
+ services.keybase.enable = true;
- environment.systemPackages = [ pkgs.kbfs ];
- };
+ environment.systemPackages = [ pkgs.kbfs ];
+ }
+
+ (mkIf cfg.enableRedirector {
+ security.wrappers."keybase-redirector".source = "${pkgs.kbfs}/bin/redirector";
+
+ systemd.tmpfiles.rules = [ "d /keybase 0755 root root 0" ];
+
+ # Upstream: https://github.com/keybase/client/blob/master/packaging/linux/systemd/keybase-redirector.service
+ systemd.user.services.keybase-redirector = {
+ description = "Keybase Root Redirector for KBFS";
+ wants = [ "keybase.service" ];
+ unitConfig.ConditionUser = "!@system";
+
+ serviceConfig = {
+ EnvironmentFile = [
+ "-%E/keybase/keybase.autogen.env"
+ "-%E/keybase/keybase.env"
+ ];
+ # Note: The /keybase mount point is not currently configurable upstream.
+ ExecStart = "${wrapperDir}/keybase-redirector /keybase";
+ Restart = "on-failure";
+ PrivateTmp = true;
+ };
+
+ wantedBy = [ "default.target" ];
+ };
+ })
+ ]);
}
diff --git a/nixos/modules/services/networking/bitlbee.nix b/nixos/modules/services/networking/bitlbee.nix
index 54fe70f7ccc0200fcf29de9031d12bc9a6adab8a..01a16698384aba58b1572ec800350d5bc38acbd6 100644
--- a/nixos/modules/services/networking/bitlbee.nix
+++ b/nixos/modules/services/networking/bitlbee.nix
@@ -168,8 +168,7 @@ in
createHome = true;
};
- users.groups = singleton {
- name = "bitlbee";
+ users.groups.bitlbee = {
gid = config.ids.gids.bitlbee;
};
diff --git a/nixos/modules/services/networking/corerad.nix b/nixos/modules/services/networking/corerad.nix
new file mode 100644
index 0000000000000000000000000000000000000000..1a2c4aec665142e7426dd1421c57ced8d2687161
--- /dev/null
+++ b/nixos/modules/services/networking/corerad.nix
@@ -0,0 +1,46 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.corerad;
+in {
+ meta = {
+ maintainers = with maintainers; [ mdlayher ];
+ };
+
+ options.services.corerad = {
+ enable = mkEnableOption "CoreRAD IPv6 NDP RA daemon";
+
+ configFile = mkOption {
+ type = types.path;
+ example = literalExample "\"\${pkgs.corerad}/etc/corerad/corerad.toml\"";
+ description = "Path to CoreRAD TOML configuration file.";
+ };
+
+ package = mkOption {
+ default = pkgs.corerad;
+ defaultText = literalExample "pkgs.corerad";
+ type = types.package;
+ description = "CoreRAD package to use.";
+ };
+ };
+
+ config = mkIf cfg.enable {
+ systemd.services.corerad = {
+ description = "CoreRAD IPv6 NDP RA daemon";
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+ serviceConfig = {
+ LimitNPROC = 512;
+ LimitNOFILE = 1048576;
+ CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
+ AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";
+ NoNewPrivileges = true;
+ DynamicUser = true;
+ ExecStart = "${getBin cfg.package}/bin/corerad -c=${cfg.configFile}";
+ Restart = "on-failure";
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index 6fbc014db718b1c4c478eaa980c76207ad381175..f476b147a5761cec7b623423dc02ee0fd9b1f112 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -59,6 +59,16 @@ let
# Use the list of allowed interfaces if specified
${optionalString (allowInterfaces != null) "allowinterfaces ${toString allowInterfaces}"}
+ # Immediately fork to background if specified, otherwise wait for IP address to be assigned
+ ${{
+ background = "background";
+ any = "waitip";
+ ipv4 = "waitip 4";
+ ipv6 = "waitip 6";
+ both = "waitip 4\nwaitip 6";
+ if-carrier-up = "";
+ }.${cfg.wait}}
+
${cfg.extraConfig}
'';
@@ -146,6 +156,21 @@ in
'';
};
+ networking.dhcpcd.wait = mkOption {
+ type = types.enum [ "background" "any" "ipv4" "ipv6" "both" "if-carrier-up" ];
+ default = "any";
+ description = ''
+ This option specifies when the dhcpcd service will fork to background.
+ If set to "background", dhcpcd will fork to background immediately.
+ If set to "ipv4" or "ipv6", dhcpcd will wait for the corresponding IP
+ address to be assigned. If set to "any", dhcpcd will wait for any type
+ (IPv4 or IPv6) to be assigned. If set to "both", dhcpcd will wait for
+ both an IPv4 and an IPv6 address before forking.
+ The option "if-carrier-up" is equivalent to "any" if either ethernet
+ is plugged nor WiFi is powered, and to "background" otherwise.
+ '';
+ };
+
};
@@ -165,6 +190,8 @@ in
before = [ "network-online.target" ];
after = [ "systemd-udev-settle.service" ];
+ restartTriggers = [ exitHook ];
+
# Stopping dhcpcd during a reconfiguration is undesirable
# because it brings down the network interfaces configured by
# dhcpcd. So do a "systemctl restart" instead.
@@ -177,7 +204,7 @@ in
serviceConfig =
{ Type = "forking";
PIDFile = "/run/dhcpcd.pid";
- ExecStart = "@${dhcpcd}/sbin/dhcpcd dhcpcd -w --quiet ${optionalString cfg.persistent "--persistent"} --config ${dhcpcdConf}";
+ ExecStart = "@${dhcpcd}/sbin/dhcpcd dhcpcd --quiet ${optionalString cfg.persistent "--persistent"} --config ${dhcpcdConf}";
ExecReload = "${dhcpcd}/sbin/dhcpcd --rebind";
Restart = "always";
};
diff --git a/nixos/modules/services/networking/dnscrypt-proxy.nix b/nixos/modules/services/networking/dnscrypt-proxy.nix
deleted file mode 100644
index 8edcf925dbfa13ae2b383f31c258b781218547db..0000000000000000000000000000000000000000
--- a/nixos/modules/services/networking/dnscrypt-proxy.nix
+++ /dev/null
@@ -1,328 +0,0 @@
-{ config, lib, pkgs, ... }:
-with lib;
-
-let
- cfg = config.services.dnscrypt-proxy;
-
- stateDirectory = "/var/lib/dnscrypt-proxy";
-
- # The minisign public key used to sign the upstream resolver list.
- # This is somewhat more flexible than preloading the key as an
- # embedded string.
- upstreamResolverListPubKey = pkgs.fetchurl {
- url = https://raw.githubusercontent.com/dyne/dnscrypt-proxy/master/minisign.pub;
- sha256 = "18lnp8qr6ghfc2sd46nn1rhcpr324fqlvgsp4zaigw396cd7vnnh";
- };
-
- # Internal flag indicating whether the upstream resolver list is used.
- useUpstreamResolverList = cfg.customResolver == null;
-
- # The final local address.
- localAddress = "${cfg.localAddress}:${toString cfg.localPort}";
-
- # The final resolvers list path.
- resolverList = "${stateDirectory}/dnscrypt-resolvers.csv";
-
- # Build daemon command line
-
- resolverArgs =
- if (cfg.customResolver == null)
- then
- [ "-L ${resolverList}"
- "-R ${cfg.resolverName}"
- ]
- else with cfg.customResolver;
- [ "-N ${name}"
- "-k ${key}"
- "-r ${address}:${toString port}"
- ];
-
- daemonArgs =
- [ "-a ${localAddress}" ]
- ++ resolverArgs
- ++ cfg.extraArgs;
-in
-
-{
- meta = {
- maintainers = with maintainers; [ joachifm ];
- doc = ./dnscrypt-proxy.xml;
- };
-
- options = {
- # Before adding another option, consider whether it could
- # equally well be passed via extraArgs.
-
- services.dnscrypt-proxy = {
- enable = mkOption {
- default = false;
- type = types.bool;
- description = "Whether to enable the DNSCrypt client proxy";
- };
-
- localAddress = mkOption {
- default = "127.0.0.1";
- type = types.str;
- description = ''
- Listen for DNS queries to relay on this address. The only reason to
- change this from its default value is to proxy queries on behalf
- of other machines (typically on the local network).
- '';
- };
-
- localPort = mkOption {
- default = 53;
- type = types.int;
- description = ''
- Listen for DNS queries to relay on this port. The default value
- assumes that the DNSCrypt proxy should relay DNS queries directly.
- When running as a forwarder for another DNS client, set this option
- to a different value; otherwise leave the default.
- '';
- };
-
- resolverName = mkOption {
- default = "random";
- example = "dnscrypt.eu-nl";
- type = types.nullOr types.str;
- description = ''
- The name of the DNSCrypt resolver to use, taken from
- ${resolverList}. The default is to
- pick a random non-logging resolver that supports DNSSEC.
- '';
- };
-
- customResolver = mkOption {
- default = null;
- description = ''
- Use an unlisted resolver (e.g., a private DNSCrypt provider). For
- advanced users only. If specified, this option takes precedence.
- '';
- type = types.nullOr (types.submodule ({ ... }: { options = {
- address = mkOption {
- type = types.str;
- description = "IP address";
- example = "208.67.220.220";
- };
-
- port = mkOption {
- type = types.int;
- description = "Port";
- default = 443;
- };
-
- name = mkOption {
- type = types.str;
- description = "Fully qualified domain name";
- example = "2.dnscrypt-cert.example.com";
- };
-
- key = mkOption {
- type = types.str;
- description = "Public key";
- example = "B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79";
- };
- }; }));
- };
-
- extraArgs = mkOption {
- default = [];
- type = types.listOf types.str;
- description = ''
- Additional command-line arguments passed verbatim to the daemon.
- See dnscrypt-proxy
- 8 for details.
- '';
- example = [ "-X libdcplugin_example_cache.so,--min-ttl=60" ];
- };
- };
- };
-
- config = mkIf cfg.enable (mkMerge [{
- assertions = [
- { assertion = (cfg.customResolver != null) || (cfg.resolverName != null);
- message = "please configure upstream DNSCrypt resolver";
- }
- ];
-
- # make man 8 dnscrypt-proxy work
- environment.systemPackages = [ pkgs.dnscrypt-proxy ];
-
- users.users.dnscrypt-proxy = {
- description = "dnscrypt-proxy daemon user";
- isSystemUser = true;
- group = "dnscrypt-proxy";
- };
- users.groups.dnscrypt-proxy = {};
-
- systemd.sockets.dnscrypt-proxy = {
- description = "dnscrypt-proxy listening socket";
- documentation = [ "man:dnscrypt-proxy(8)" ];
-
- wantedBy = [ "sockets.target" ];
-
- socketConfig = {
- ListenStream = localAddress;
- ListenDatagram = localAddress;
- };
- };
-
- systemd.services.dnscrypt-proxy = {
- description = "dnscrypt-proxy daemon";
- documentation = [ "man:dnscrypt-proxy(8)" ];
-
- before = [ "nss-lookup.target" ];
- after = [ "network.target" ];
- requires = [ "dnscrypt-proxy.socket "];
-
- serviceConfig = {
- NonBlocking = "true";
- ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy ${toString daemonArgs}";
- ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-
- User = "dnscrypt-proxy";
-
- PrivateTmp = true;
- PrivateDevices = true;
- ProtectHome = true;
- };
- };
- }
-
- (mkIf config.security.apparmor.enable {
- systemd.services.dnscrypt-proxy.after = [ "apparmor.service" ];
-
- security.apparmor.profiles = singleton (pkgs.writeText "apparmor-dnscrypt-proxy" ''
- ${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy {
- /dev/null rw,
- /dev/random r,
- /dev/urandom r,
-
- /etc/passwd r,
- /etc/group r,
- ${config.environment.etc."nsswitch.conf".source} r,
-
- ${getLib pkgs.glibc}/lib/*.so mr,
- ${pkgs.tzdata}/share/zoneinfo/** r,
-
- network inet stream,
- network inet6 stream,
- network inet dgram,
- network inet6 dgram,
-
- ${getLib pkgs.dnscrypt-proxy}/lib/dnscrypt-proxy/libdcplugin*.so mr,
-
- ${getLib pkgs.gcc.cc}/lib/libssp.so.* mr,
- ${getLib pkgs.libsodium}/lib/libsodium.so.* mr,
- ${getLib pkgs.systemd}/lib/libsystemd.so.* mr,
- ${getLib pkgs.utillinuxMinimal.out}/lib/libmount.so.* mr,
- ${getLib pkgs.utillinuxMinimal.out}/lib/libblkid.so.* mr,
- ${getLib pkgs.utillinuxMinimal.out}/lib/libuuid.so.* mr,
- ${getLib pkgs.xz}/lib/liblzma.so.* mr,
- ${getLib pkgs.libgcrypt}/lib/libgcrypt.so.* mr,
- ${getLib pkgs.libgpgerror}/lib/libgpg-error.so.* mr,
- ${getLib pkgs.libcap}/lib/libcap.so.* mr,
- ${getLib pkgs.lz4}/lib/liblz4.so.* mr,
- ${getLib pkgs.attr}/lib/libattr.so.* mr, # */
-
- ${resolverList} r,
-
- /run/systemd/notify rw,
- }
- '');
- })
-
- (mkIf useUpstreamResolverList {
- systemd.services.init-dnscrypt-proxy-statedir = {
- description = "Initialize dnscrypt-proxy state directory";
-
- wantedBy = [ "dnscrypt-proxy.service" ];
- before = [ "dnscrypt-proxy.service" ];
-
- script = ''
- mkdir -pv ${stateDirectory}
- chown -c dnscrypt-proxy:dnscrypt-proxy ${stateDirectory}
- cp -uv \
- ${pkgs.dnscrypt-proxy}/share/dnscrypt-proxy/dnscrypt-resolvers.csv \
- ${stateDirectory}
- '';
-
- serviceConfig = {
- Type = "oneshot";
- RemainAfterExit = true;
- };
- };
-
- systemd.services.update-dnscrypt-resolvers = {
- description = "Update list of DNSCrypt resolvers";
-
- requires = [ "init-dnscrypt-proxy-statedir.service" ];
- after = [ "init-dnscrypt-proxy-statedir.service" ];
-
- path = with pkgs; [ curl diffutils dnscrypt-proxy minisign ];
- script = ''
- cd ${stateDirectory}
- domain=raw.githubusercontent.com
- get="curl -fSs --resolve $domain:443:$(hostip -r 8.8.8.8 $domain | head -1)"
- $get -o dnscrypt-resolvers.csv.tmp \
- https://$domain/dyne/dnscrypt-proxy/master/dnscrypt-resolvers.csv
- $get -o dnscrypt-resolvers.csv.minisig.tmp \
- https://$domain/dyne/dnscrypt-proxy/master/dnscrypt-resolvers.csv.minisig
- mv dnscrypt-resolvers.csv.minisig{.tmp,}
- if ! minisign -q -V -p ${upstreamResolverListPubKey} \
- -m dnscrypt-resolvers.csv.tmp -x dnscrypt-resolvers.csv.minisig ; then
- echo "failed to verify resolver list!" >&2
- exit 1
- fi
- [[ -f dnscrypt-resolvers.csv ]] && mv dnscrypt-resolvers.csv{,.old}
- mv dnscrypt-resolvers.csv{.tmp,}
- if cmp dnscrypt-resolvers.csv{,.old} ; then
- echo "no change"
- else
- echo "resolver list updated"
- fi
- '';
-
- serviceConfig = {
- PrivateTmp = true;
- PrivateDevices = true;
- ProtectHome = true;
- ProtectSystem = "strict";
- ReadWritePaths = "${dirOf stateDirectory} ${stateDirectory}";
- SystemCallFilter = "~@mount";
- };
- };
-
- systemd.timers.update-dnscrypt-resolvers = {
- wantedBy = [ "timers.target" ];
- timerConfig = {
- OnBootSec = "5min";
- OnUnitActiveSec = "6h";
- };
- };
- })
- ]);
-
- imports = [
- (mkRenamedOptionModule [ "services" "dnscrypt-proxy" "port" ] [ "services" "dnscrypt-proxy" "localPort" ])
-
- (mkChangedOptionModule
- [ "services" "dnscrypt-proxy" "tcpOnly" ]
- [ "services" "dnscrypt-proxy" "extraArgs" ]
- (config:
- let val = getAttrFromPath [ "services" "dnscrypt-proxy" "tcpOnly" ] config; in
- optional val "-T"))
-
- (mkChangedOptionModule
- [ "services" "dnscrypt-proxy" "ephemeralKeys" ]
- [ "services" "dnscrypt-proxy" "extraArgs" ]
- (config:
- let val = getAttrFromPath [ "services" "dnscrypt-proxy" "ephemeralKeys" ] config; in
- optional val "-E"))
-
- (mkRemovedOptionModule [ "services" "dnscrypt-proxy" "resolverList" ] ''
- The current resolver listing from upstream is always used
- unless a custom resolver is specified.
- '')
- ];
-}
diff --git a/nixos/modules/services/networking/dnscrypt-proxy.xml b/nixos/modules/services/networking/dnscrypt-proxy.xml
deleted file mode 100644
index afc7880392a1a50ec4f7bf7ef9d26fa64f49f416..0000000000000000000000000000000000000000
--- a/nixos/modules/services/networking/dnscrypt-proxy.xml
+++ /dev/null
@@ -1,66 +0,0 @@
-
- DNSCrypt client proxy
-
- The DNSCrypt client proxy relays DNS queries to a DNSCrypt enabled upstream
- resolver. The traffic between the client and the upstream resolver is
- encrypted and authenticated, mitigating the risk of MITM attacks, DNS
- poisoning attacks, and third-party snooping (assuming the upstream is
- trustworthy).
-
-
- Basic configuration
-
-
- To enable the client proxy, set
-
- = true;
-
-
-
-
- Enabling the client proxy does not alter the system nameserver; to relay
- local queries, prepend 127.0.0.1 to
- .
-
-
-
- As a forwarder for another DNS client
-
-
- To run the DNSCrypt proxy client as a forwarder for another DNS client,
- change the default proxy listening port to a non-standard value and point
- the other client to it:
-
- = 43;
-
-
-
-
- dnsmasq
-
-
-{
- = true;
- = [ "127.0.0.1#43" ];
-}
-
-
-
-
-
- unbound
-
-
-{
- = true;
- = [ "127.0.0.1@43" ];
-}
-
-
-
-
-
diff --git a/nixos/modules/services/networking/dnscrypt-proxy2.nix b/nixos/modules/services/networking/dnscrypt-proxy2.nix
new file mode 100644
index 0000000000000000000000000000000000000000..e48eb729103be3ec39141ebc1100ce84147dae17
--- /dev/null
+++ b/nixos/modules/services/networking/dnscrypt-proxy2.nix
@@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }: with lib;
+
+let
+ cfg = config.services.dnscrypt-proxy2;
+in
+
+{
+ options.services.dnscrypt-proxy2 = {
+ enable = mkEnableOption "dnscrypt-proxy2";
+
+ settings = mkOption {
+ description = ''
+ Attrset that is converted and passed as TOML config file.
+ For available params, see:
+ '';
+ example = literalExample ''
+ {
+ sources.public-resolvers = {
+ urls = [ "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md" ];
+ cache_file = "public-resolvers.md";
+ minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+ refresh_delay = 72;
+ };
+ }
+ '';
+ type = types.attrs;
+ default = {};
+ };
+
+ configFile = mkOption {
+ description = ''
+ Path to TOML config file. See:
+ If this option is set, it will override any configuration done in options.services.dnscrypt-proxy2.settings.
+ '';
+ example = "/etc/dnscrypt-proxy/dnscrypt-proxy.toml";
+ type = types.path;
+ default = pkgs.runCommand "dnscrypt-proxy.toml" {
+ json = builtins.toJSON cfg.settings;
+ passAsFile = [ "json" ];
+ } ''
+ ${pkgs.remarshal}/bin/json2toml < $jsonPath > $out
+ '';
+ defaultText = literalExample "TOML file generated from services.dnscrypt-proxy2.settings";
+ };
+ };
+
+ config = mkIf cfg.enable {
+
+ networking.nameservers = lib.mkDefault [ "127.0.0.1" ];
+
+ systemd.services.dnscrypt-proxy2 = {
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+ serviceConfig = {
+ AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+ DynamicUser = true;
+ ExecStart = "${pkgs.dnscrypt-proxy2}/bin/dnscrypt-proxy -config ${cfg.configFile}";
+ };
+ };
+ };
+}
diff --git a/nixos/modules/services/networking/keybase.nix b/nixos/modules/services/networking/keybase.nix
index 85f52be8a6ac972a2e39451317b2bedcda966da2..495102cb7eeee1fa595e87d102490c5f157bd281 100644
--- a/nixos/modules/services/networking/keybase.nix
+++ b/nixos/modules/services/networking/keybase.nix
@@ -24,13 +24,18 @@ in {
config = mkIf cfg.enable {
+ # Upstream: https://github.com/keybase/client/blob/master/packaging/linux/systemd/keybase.service
systemd.user.services.keybase = {
description = "Keybase service";
unitConfig.ConditionUser = "!@system";
+ environment.KEYBASE_SERVICE_TYPE = "systemd";
serviceConfig = {
- ExecStart = ''
- ${pkgs.keybase}/bin/keybase service --auto-forked
- '';
+ Type = "notify";
+ EnvironmentFile = [
+ "-%E/keybase/keybase.autogen.env"
+ "-%E/keybase/keybase.env"
+ ];
+ ExecStart = "${pkgs.keybase}/bin/keybase service";
Restart = "on-failure";
PrivateTmp = true;
};
diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix
index 1cc1dd3f2f62bf14b6ad40dba881336fcbd4a118..47364ecb84640415da9b451287f7aead65696370 100644
--- a/nixos/modules/services/networking/knot.nix
+++ b/nixos/modules/services/networking/knot.nix
@@ -56,6 +56,7 @@ in {
package = mkOption {
type = types.package;
default = pkgs.knot-dns;
+ defaultText = "pkgs.knot-dns";
description = ''
Which Knot DNS package to use
'';
@@ -92,4 +93,3 @@ in {
environment.systemPackages = [ knot-cli-wrappers ];
};
}
-
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index 5eb50a13ca9abe6707d62487ba77b33da9a9f381..a2f91a4200bf817bf48aa4dbd909d5873b66b8d6 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -3,14 +3,39 @@
with lib;
let
-
cfg = config.services.kresd;
- package = pkgs.knot-resolver;
- configFile = pkgs.writeText "kresd.conf" cfg.extraConfig;
-in
+ # Convert systemd-style address specification to kresd config line(s).
+ # On Nix level we don't attempt to precisely validate the address specifications.
+ mkListen = kind: addr: let
+ al_v4 = builtins.match "([0-9.]\+):([0-9]\+)" addr;
+ al_v6 = builtins.match "\\[(.\+)]:([0-9]\+)" addr;
+ al_portOnly = builtins.match "()([0-9]\+)" addr;
+ al = findFirst (a: a != null)
+ (throw "services.kresd.*: incorrect address specification '${addr}'")
+ [ al_v4 al_v6 al_portOnly ];
+ port = last al;
+ addrSpec = if al_portOnly == null then "'${head al}'" else "{'::', '127.0.0.1'}";
+ in # freebind is set for compatibility with earlier kresd services;
+ # it could be configurable, for example.
+ ''
+ net.listen(${addrSpec}, ${port}, { kind = '${kind}', freebind = true })
+ '';
-{
+ configFile = pkgs.writeText "kresd.conf" (
+ optionalString (cfg.listenDoH != []) ''
+ modules.load('http')
+ ''
+ + concatMapStrings (mkListen "dns") cfg.listenPlain
+ + concatMapStrings (mkListen "tls") cfg.listenTLS
+ + concatMapStrings (mkListen "doh") cfg.listenDoH
+ + cfg.extraConfig
+ );
+
+ package = pkgs.knot-resolver.override {
+ extraFeatures = cfg.listenDoH != [];
+ };
+in {
meta.maintainers = [ maintainers.vcunat /* upstream developer */ ];
imports = [
@@ -22,6 +47,7 @@ in
value
)
)
+ (mkRemovedOptionModule [ "services" "kresd" "cacheDir" ] "Please use (bind-)mounting instead.")
];
###### interface
@@ -32,8 +58,8 @@ in
description = ''
Whether to enable knot-resolver domain name server.
DNSSEC validation is turned on by default.
- You can run sudo nc -U /run/kresd/control
- and give commands interactively to kresd.
+ You can run sudo nc -U /run/knot-resolver/control/1
+ and give commands interactively to kresd@1.service.
'';
};
extraConfig = mkOption {
@@ -43,16 +69,10 @@ in
Extra lines to be added verbatim to the generated configuration file.
'';
};
- cacheDir = mkOption {
- type = types.path;
- default = "/var/cache/kresd";
- description = ''
- Directory for caches. They are intended to survive reboots.
- '';
- };
listenPlain = mkOption {
type = with types; listOf str;
default = [ "[::1]:53" "127.0.0.1:53" ];
+ example = [ "53" ];
description = ''
What addresses and ports the server should listen on.
For detailed syntax see ListenStream in man systemd.socket.
@@ -67,75 +87,59 @@ in
For detailed syntax see ListenStream in man systemd.socket.
'';
};
+ listenDoH = mkOption {
+ type = with types; listOf str;
+ default = [];
+ example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ];
+ description = ''
+ Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 8484).
+ For detailed syntax see ListenStream in man systemd.socket.
+ '';
+ };
+ instances = mkOption {
+ type = types.ints.unsigned;
+ default = 1;
+ description = ''
+ The number of instances to start. They will be called kresd@{1,2,...}.service.
+ Knot Resolver uses no threads, so this is the way to scale.
+ You can dynamically start/stop them at will, so this is just system default.
+ '';
+ };
# TODO: perhaps options for more common stuff like cache size or forwarding
};
###### implementation
config = mkIf cfg.enable {
- environment.etc."kresd.conf".source = configFile; # not required
+ environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
- users.users.kresd =
- { uid = config.ids.uids.kresd;
- group = "kresd";
+ users.users.knot-resolver =
+ { isSystemUser = true;
+ group = "knot-resolver";
description = "Knot-resolver daemon user";
};
- users.groups.kresd.gid = config.ids.gids.kresd;
+ users.groups.knot-resolver.gid = null;
- systemd.sockets.kresd = rec {
- wantedBy = [ "sockets.target" ];
- before = wantedBy;
- listenStreams = cfg.listenPlain;
- socketConfig = {
- ListenDatagram = listenStreams;
- FreeBind = true;
- FileDescriptorName = "dns";
- };
- };
+ systemd.packages = [ package ]; # the units are patched inside the package a bit
- systemd.sockets.kresd-tls = mkIf (cfg.listenTLS != []) rec {
- wantedBy = [ "sockets.target" ];
- before = wantedBy;
- partOf = [ "kresd.socket" ];
- listenStreams = cfg.listenTLS;
- socketConfig = {
- FileDescriptorName = "tls";
- FreeBind = true;
- Service = "kresd.service";
- };
+ systemd.targets.kresd = { # configure units started by default
+ wantedBy = [ "multi-user.target" ];
+ wants = [ "kres-cache-gc.service" ]
+ ++ map (i: "kresd@${toString i}.service") (range 1 cfg.instances);
};
-
- systemd.sockets.kresd-control = rec {
- wantedBy = [ "sockets.target" ];
- before = wantedBy;
- partOf = [ "kresd.socket" ];
- listenStreams = [ "/run/kresd/control" ];
- socketConfig = {
- FileDescriptorName = "control";
- Service = "kresd.service";
- SocketMode = "0660"; # only root user/group may connect and control kresd
- };
+ systemd.services."kresd@".serviceConfig = {
+ ExecStart = "${package}/bin/kresd --noninteractive "
+ + "-c ${package}/lib/knot-resolver/distro-preconfig.lua -c ${configFile}";
+ # Ensure correct ownership in case UID or GID changes.
+ CacheDirectory = "knot-resolver";
+ CacheDirectoryMode = "0750";
};
- systemd.tmpfiles.rules = [ "d '${cfg.cacheDir}' 0770 kresd kresd - -" ];
+ environment.etc."tmpfiles.d/knot-resolver.conf".source =
+ "${package}/lib/tmpfiles.d/knot-resolver.conf";
- systemd.services.kresd = {
- description = "Knot-resolver daemon";
-
- serviceConfig = {
- User = "kresd";
- Type = "notify";
- WorkingDirectory = cfg.cacheDir;
- Restart = "on-failure";
- Sockets = [ "kresd.socket" "kresd-control.socket" ]
- ++ optional (cfg.listenTLS != []) "kresd-tls.socket";
- };
-
- # Trust anchor goes from dns-root-data by default.
- script = ''
- exec '${package}/bin/kresd' --config '${configFile}' --forks=1
- '';
-
- requires = [ "kresd.socket" ];
- };
+ # Try cleaning up the previously default location of cache file.
+ # Note that /var/cache/* should always be safe to remove.
+ # TODO: remove later, probably between 20.09 and 21.03
+ systemd.tmpfiles.rules = [ "R /var/cache/kresd" ];
};
}
diff --git a/nixos/modules/services/networking/matterbridge.nix b/nixos/modules/services/networking/matterbridge.nix
index bad35133459a0ef835785198418d4c230e78c9b6..b8b4f37c84a89eb7a2e20de34fcdfa12383ec1f4 100644
--- a/nixos/modules/services/networking/matterbridge.nix
+++ b/nixos/modules/services/networking/matterbridge.nix
@@ -111,7 +111,7 @@ in
serviceConfig = {
User = cfg.user;
Group = cfg.group;
- ExecStart = "${pkgs.matterbridge.bin}/bin/matterbridge -conf ${matterbridgeConfToml}";
+ ExecStart = "${pkgs.matterbridge}/bin/matterbridge -conf ${matterbridgeConfToml}";
Restart = "always";
RestartSec = "10";
};
diff --git a/nixos/modules/services/networking/ndppd.nix b/nixos/modules/services/networking/ndppd.nix
index 92088623517f8b8e96cd509cdba5e836d6a3e388..e015f76f622b472de64c74080ebccc451f2ef05e 100644
--- a/nixos/modules/services/networking/ndppd.nix
+++ b/nixos/modules/services/networking/ndppd.nix
@@ -161,7 +161,25 @@ in {
documentation = [ "man:ndppd(1)" "man:ndppd.conf(5)" ];
after = [ "network-pre.target" ];
wantedBy = [ "multi-user.target" ];
- serviceConfig.ExecStart = "${pkgs.ndppd}/bin/ndppd -c ${ndppdConf}";
+ serviceConfig = {
+ ExecStart = "${pkgs.ndppd}/bin/ndppd -c ${ndppdConf}";
+
+ # Sandboxing
+ CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN";
+ ProtectSystem = "strict";
+ ProtectHome = true;
+ PrivateTmp = true;
+ PrivateDevices = true;
+ ProtectKernelTunables = true;
+ ProtectKernelModules = true;
+ ProtectControlGroups = true;
+ RestrictAddressFamilies = "AF_INET6 AF_PACKET AF_NETLINK";
+ RestrictNamespaces = true;
+ LockPersonality = true;
+ MemoryDenyWriteExecute = true;
+ RestrictRealtime = true;
+ RestrictSUIDSGID = true;
+ };
};
};
}
diff --git a/nixos/modules/services/networking/nsd.nix b/nixos/modules/services/networking/nsd.nix
index 344396638a6cf4439f24077d69d186bb0cbd1a5d..429580e5c6c48b532460bc45a299119551c98bb1 100644
--- a/nixos/modules/services/networking/nsd.nix
+++ b/nixos/modules/services/networking/nsd.nix
@@ -244,7 +244,7 @@ let
};
data = mkOption {
- type = types.str;
+ type = types.lines;
default = "";
example = "";
description = ''
@@ -484,7 +484,7 @@ in
};
extraConfig = mkOption {
- type = types.str;
+ type = types.lines;
default = "";
description = ''
Extra nsd config.
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 47b10e408c027750327765103be0c1f17e79071a..5b3eb6f04b4282fee9a5e279b40b63272216eb49 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -484,6 +484,24 @@ in {
-gui-address=${cfg.guiAddress} \
-home=${cfg.configDir}
'';
+ MemoryDenyWriteExecute = true;
+ NoNewPrivileges = true;
+ PrivateDevices = true;
+ PrivateMounts = true;
+ PrivateTmp = true;
+ PrivateUsers = true;
+ ProtectControlGroups = true;
+ ProtectHostname = true;
+ ProtectKernelModules = true;
+ ProtectKernelTunables = true;
+ RestrictNamespaces = true;
+ RestrictRealtime = true;
+ RestrictSUIDSGID = true;
+ CapabilityBoundingSet = [
+ "~CAP_SYS_PTRACE" "~CAP_SYS_ADMIN"
+ "~CAP_SETGID" "~CAP_SETUID" "~CAP_SETPCAP"
+ "~CAP_SYS_TIME" "~CAP_KILL"
+ ];
};
};
syncthing-init = mkIf (
diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix
index c922ba15960fd2828af688387b15c65e91bec5e7..4bdfa8143dce09f74a00afb3a40cecf1223860bc 100644
--- a/nixos/modules/services/networking/unifi.nix
+++ b/nixos/modules/services/networking/unifi.nix
@@ -147,8 +147,10 @@ in
}) mountPoints;
systemd.tmpfiles.rules = [
- "e '${stateDir}' 0700 unifi - - -"
+ "d '${stateDir}' 0700 unifi - - -"
"d '${stateDir}/data' 0700 unifi - - -"
+ "d '${stateDir}/webapps' 0700 unifi - - -"
+ "L+ '${stateDir}/webapps/ROOT' - - - - ${cfg.unifiPackage}/webapps/ROOT"
];
systemd.services.unifi = {
@@ -161,17 +163,6 @@ in
# This a HACK to fix missing dependencies of dynamic libs extracted from jars
environment.LD_LIBRARY_PATH = with pkgs.stdenv; "${cc.cc.lib}/lib";
- preStart = ''
- # Create the volatile webapps
- rm -rf "${stateDir}/webapps"
- mkdir -p "${stateDir}/webapps"
- ln -s "${cfg.unifiPackage}/webapps/ROOT" "${stateDir}/webapps/ROOT"
- '';
-
- postStop = ''
- rm -rf "${stateDir}/webapps"
- '';
-
serviceConfig = {
Type = "simple";
ExecStart = "${(removeSuffix "\n" cmd)} start";
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index 980961225c9e0944064b5a0569446f117327bfe2..7785861a730f6b9569d3cc7459901d6c62121244 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -151,7 +151,7 @@ let
publicKey = mkOption {
example = "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=";
type = types.str;
- description = "The base64 public key the peer.";
+ description = "The base64 public key of the peer.";
};
presharedKey = mkOption {
diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index 8f05c3949fba71b1efd41acaca92655a560eaebf..de0f11595a949b0575b259827a01847e7c703c9b 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -233,6 +233,7 @@ in {
path = [ pkgs.wpa_supplicant ];
script = ''
+ iface_args="-s -u -D${cfg.driver} -c ${configFile}"
${if ifaces == [] then ''
for i in $(cd /sys/class/net && echo *); do
DEVTYPE=
@@ -240,14 +241,14 @@ in {
if [ -e "$UEVENT_PATH" ]; then
source "$UEVENT_PATH"
if [ "$DEVTYPE" = "wlan" -o -e /sys/class/net/$i/wireless ]; then
- ifaces="$ifaces''${ifaces:+ -N} -i$i"
+ args+="''${args:+ -N} -i$i $iface_args"
fi
fi
done
'' else ''
- ifaces="${concatStringsSep " -N " (map (i: "-i${i}") ifaces)}"
+ args="${concatMapStringsSep " -N " (i: "-i${i} $iface_args") ifaces}"
''}
- exec wpa_supplicant -s -u -D${cfg.driver} -c ${configFile} $ifaces
+ exec wpa_supplicant $args
'';
};
diff --git a/nixos/modules/services/networking/xandikos.nix b/nixos/modules/services/networking/xandikos.nix
new file mode 100644
index 0000000000000000000000000000000000000000..87c029156b9e7e0cd8e351a2e1302db7ab478a51
--- /dev/null
+++ b/nixos/modules/services/networking/xandikos.nix
@@ -0,0 +1,148 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.services.xandikos;
+in
+{
+
+ options = {
+ services.xandikos = {
+ enable = mkEnableOption "Xandikos CalDAV and CardDAV server";
+
+ package = mkOption {
+ type = types.package;
+ default = pkgs.xandikos;
+ defaultText = "pkgs.xandikos";
+ description = "The Xandikos package to use.";
+ };
+
+ address = mkOption {
+ type = types.str;
+ default = "localhost";
+ description = ''
+ The IP address on which Xandikos will listen.
+ By default listens on localhost.
+ '';
+ };
+
+ port = mkOption {
+ type = types.port;
+ default = 8080;
+ description = "The port of the Xandikos web application";
+ };
+
+ routePrefix = mkOption {
+ type = types.str;
+ default = "/";
+ description = ''
+ Path to Xandikos.
+ Useful when Xandikos is behind a reverse proxy.
+ '';
+ };
+
+ extraOptions = mkOption {
+ default = [];
+ type = types.listOf types.str;
+ example = literalExample ''
+ [ "--autocreate"
+ "--defaults"
+ "--current-user-principal user"
+ "--dump-dav-xml"
+ ]
+ '';
+ description = ''
+ Extra command line arguments to pass to xandikos.
+ '';
+ };
+
+ nginx = mkOption {
+ default = {};
+ description = ''
+ Configuration for nginx reverse proxy.
+ '';
+
+ type = types.submodule {
+ options = {
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Configure the nginx reverse proxy settings.
+ '';
+ };
+
+ hostName = mkOption {
+ type = types.str;
+ description = ''
+ The hostname use to setup the virtualhost configuration
+ '';
+ };
+ };
+ };
+ };
+
+ };
+
+ };
+
+ config = mkIf cfg.enable (
+ mkMerge [
+ {
+ meta.maintainers = [ lib.maintainers."0x4A6F" ];
+
+ systemd.services.xandikos = {
+ description = "A Simple Calendar and Contact Server";
+ after = [ "network.target" ];
+ wantedBy = [ "multi-user.target" ];
+
+ serviceConfig = {
+ User = "xandikos";
+ Group = "xandikos";
+ DynamicUser = "yes";
+ RuntimeDirectory = "xandikos";
+ StateDirectory = "xandikos";
+ StateDirectoryMode = "0700";
+ PrivateDevices = true;
+ # Sandboxing
+ CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN";
+ ProtectSystem = "strict";
+ ProtectHome = true;
+ PrivateTmp = true;
+ ProtectKernelTunables = true;
+ ProtectKernelModules = true;
+ ProtectControlGroups = true;
+ RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX AF_PACKET AF_NETLINK";
+ RestrictNamespaces = true;
+ LockPersonality = true;
+ MemoryDenyWriteExecute = true;
+ RestrictRealtime = true;
+ RestrictSUIDSGID = true;
+ ExecStart = ''
+ ${cfg.package}/bin/xandikos \
+ --directory /var/lib/xandikos \
+ --listen_address ${cfg.address} \
+ --port ${toString cfg.port} \
+ --route-prefix ${cfg.routePrefix} \
+ ${lib.concatStringsSep " " cfg.extraOptions}
+ '';
+ };
+ };
+ }
+
+ (
+ mkIf cfg.nginx.enable {
+ services.nginx = {
+ enable = true;
+ virtualHosts."${cfg.nginx.hostName}" = {
+ locations."/" = {
+ proxyPass = "http://${cfg.address}:${toString cfg.port}/";
+ };
+ };
+ };
+ }
+ )
+ ]
+ );
+}
diff --git a/nixos/modules/services/networking/zerotierone.nix b/nixos/modules/services/networking/zerotierone.nix
index 764af3846fe5dd5ac8e92e46c406929a7be3c73a..069e15a909b78fc0384d9872df29bfafc513e374 100644
--- a/nixos/modules/services/networking/zerotierone.nix
+++ b/nixos/modules/services/networking/zerotierone.nix
@@ -38,10 +38,13 @@ in
config = mkIf cfg.enable {
systemd.services.zerotierone = {
description = "ZeroTierOne";
- path = [ cfg.package ];
- bindsTo = [ "network-online.target" ];
- after = [ "network-online.target" ];
+
wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+ wants = [ "network-online.target" ];
+
+ path = [ cfg.package ];
+
preStart = ''
mkdir -p /var/lib/zerotier-one/networks.d
chmod 700 /var/lib/zerotier-one
@@ -53,6 +56,7 @@ in
ExecStart = "${cfg.package}/bin/zerotier-one -p${toString cfg.port}";
Restart = "always";
KillMode = "process";
+ TimeoutStopSec = 5;
};
};
diff --git a/nixos/modules/services/search/solr.nix b/nixos/modules/services/search/solr.nix
index b2176225493e496055452888f8f0f4d067fbd625..a8615a20a1cf2b0b806d16832b6da363dfedf700 100644
--- a/nixos/modules/services/search/solr.nix
+++ b/nixos/modules/services/search/solr.nix
@@ -13,19 +13,11 @@ in
services.solr = {
enable = mkEnableOption "Solr";
- # default to the 8.x series not forcing major version upgrade of those on the 7.x series
package = mkOption {
type = types.package;
- default = if versionAtLeast config.system.stateVersion "19.09"
- then pkgs.solr_8
- else pkgs.solr_7
- ;
+ default = pkgs.solr;
defaultText = "pkgs.solr";
- description = ''
- Which Solr package to use. This defaults to version 7.x if
- system.stateVersion < 19.09 and version 8.x
- otherwise.
- '';
+ description = "Which Solr package to use.";
};
port = mkOption {
diff --git a/nixos/modules/services/security/bitwarden_rs/default.nix b/nixos/modules/services/security/bitwarden_rs/default.nix
index d1817db0755501081ae3038bc4cf9045111f385b..a63be0ee766e9493c6dcf810b97970f0765ac8ea 100644
--- a/nixos/modules/services/security/bitwarden_rs/default.nix
+++ b/nixos/modules/services/security/bitwarden_rs/default.nix
@@ -18,15 +18,33 @@ let
else key + toUpper x) "" parts;
in if builtins.match "[A-Z0-9_]+" name != null then name else partsToEnvVar parts;
- configFile = pkgs.writeText "bitwarden_rs.env" (concatMapStrings (s: s + "\n") (
- (concatLists (mapAttrsToList (name: value:
- if value != null then [ "${nameToEnvVar name}=${if isBool value then boolToString value else toString value}" ] else []
- ) cfg.config))));
+ # Due to the different naming schemes allowed for config keys,
+ # we can only check for values consistently after converting them to their corresponding environment variable name.
+ configEnv =
+ let
+ configEnv = listToAttrs (concatLists (mapAttrsToList (name: value:
+ if value != null then [ (nameValuePair (nameToEnvVar name) (if isBool value then boolToString value else toString value)) ] else []
+ ) cfg.config));
+ in { DATA_FOLDER = "/var/lib/bitwarden_rs"; } // optionalAttrs (!(configEnv ? WEB_VAULT_ENABLED) || configEnv.WEB_VAULT_ENABLED == "true") {
+ WEB_VAULT_FOLDER = "${pkgs.bitwarden_rs-vault}/share/bitwarden_rs/vault";
+ } // configEnv;
+
+ configFile = pkgs.writeText "bitwarden_rs.env" (concatStrings (mapAttrsToList (name: value: "${name}=${value}\n") configEnv));
+
+ bitwarden_rs = pkgs.bitwarden_rs.override { inherit (cfg) dbBackend; };
in {
options.services.bitwarden_rs = with types; {
enable = mkEnableOption "bitwarden_rs";
+ dbBackend = mkOption {
+ type = enum [ "sqlite" "mysql" "postgresql" ];
+ default = "sqlite";
+ description = ''
+ Which database backend bitwarden_rs will be using.
+ '';
+ };
+
backupDir = mkOption {
type = nullOr str;
default = null;
@@ -56,23 +74,20 @@ in {
even though foo2 would have been converted to FOO_2.
This allows working around any potential future conflicting naming conventions.
- Based on the attributes passed to this config option a environment file will be generated
+ Based on the attributes passed to this config option an environment file will be generated
that is passed to bitwarden_rs's systemd service.
The available configuration options can be found in
- the environment template file.
+ the environment template file.
'';
- apply = config: optionalAttrs config.webVaultEnabled {
- webVaultFolder = "${pkgs.bitwarden_rs-vault}/share/bitwarden_rs/vault";
- } // config;
};
};
config = mkIf cfg.enable {
- services.bitwarden_rs.config = {
- dataFolder = "/var/lib/bitwarden_rs";
- webVaultEnabled = mkDefault true;
- };
+ assertions = [ {
+ assertion = cfg.backupDir != null -> cfg.dbBackend == "sqlite";
+ message = "Backups for database backends other than sqlite will need customization";
+ } ];
users.users.bitwarden_rs = {
inherit group;
@@ -87,7 +102,7 @@ in {
User = user;
Group = group;
EnvironmentFile = configFile;
- ExecStart = "${pkgs.bitwarden_rs}/bin/bitwarden_rs";
+ ExecStart = "${bitwarden_rs}/bin/bitwarden_rs";
LimitNOFILE = "1048576";
LimitNPROC = "64";
PrivateTmp = "true";
@@ -109,6 +124,7 @@ in {
path = with pkgs; [ sqlite ];
serviceConfig = {
SyslogIdentifier = "backup-bitwarden_rs";
+ Type = "oneshot";
User = mkDefault user;
Group = mkDefault group;
ExecStart = "${pkgs.bash}/bin/bash ${./backup.sh}";
diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix
index 716ae7a2d2f4cd1055401396f12d4caa5e46e4d6..cb748c93d24edc28e5b3755c8e787bb9c0024b66 100644
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -6,15 +6,32 @@ let
cfg = config.services.fail2ban;
- fail2banConf = pkgs.writeText "fail2ban.conf" cfg.daemonConfig;
+ fail2banConf = pkgs.writeText "fail2ban.local" cfg.daemonConfig;
- jailConf = pkgs.writeText "jail.conf"
- (concatStringsSep "\n" (attrValues (flip mapAttrs cfg.jails (name: def:
+ jailConf = pkgs.writeText "jail.local" ''
+ [INCLUDES]
+
+ before = paths-nixos.conf
+
+ ${concatStringsSep "\n" (attrValues (flip mapAttrs cfg.jails (name: def:
optionalString (def != "")
''
[${name}]
${def}
- ''))));
+ '')))}
+ '';
+
+ pathsConf = pkgs.writeText "paths-nixos.conf" ''
+ # NixOS
+
+ [INCLUDES]
+
+ before = paths-common.conf
+
+ after = paths-overrides.local
+
+ [DEFAULT]
+ '';
in
@@ -31,21 +48,135 @@ in
description = "Whether to enable the fail2ban service.";
};
+ package = mkOption {
+ default = pkgs.fail2ban;
+ type = types.package;
+ example = "pkgs.fail2ban_0_11";
+ description = "The fail2ban package to use for running the fail2ban service.";
+ };
+
+ packageFirewall = mkOption {
+ default = pkgs.iptables;
+ type = types.package;
+ example = "pkgs.nftables";
+ description = "The firewall package used by fail2ban service.";
+ };
+
+ banaction = mkOption {
+ default = "iptables-multiport";
+ type = types.str;
+ example = "nftables-multiport";
+ description = ''
+ Default banning action (e.g. iptables, iptables-new, iptables-multiport,
+ shorewall, etc) It is used to define action_* variables. Can be overridden
+ globally or per section within jail.local file
+ '';
+ };
+
+ banaction-allports = mkOption {
+ default = "iptables-allport";
+ type = types.str;
+ example = "nftables-allport";
+ description = ''
+ Default banning action (e.g. iptables, iptables-new, iptables-multiport,
+ shorewall, etc) It is used to define action_* variables. Can be overridden
+ globally or per section within jail.local file
+ '';
+ };
+
+ bantime-increment.enable = mkOption {
+ default = false;
+ type = types.bool;
+ description = ''
+ Allows to use database for searching of previously banned ip's to increase
+ a default ban time using special formula, default it is banTime * 1, 2, 4, 8, 16, 32...
+ '';
+ };
+
+ bantime-increment.rndtime = mkOption {
+ default = "4m";
+ type = types.str;
+ example = "8m";
+ description = ''
+ "bantime-increment.rndtime" is the max number of seconds using for mixing with random time
+ to prevent "clever" botnets calculate exact time IP can be unbanned again
+ '';
+ };
+
+ bantime-increment.maxtime = mkOption {
+ default = "10h";
+ type = types.str;
+ example = "48h";
+ description = ''
+ "bantime-increment.maxtime" is the max number of seconds using the ban time can reach (don't grows further)
+ '';
+ };
+
+ bantime-increment.factor = mkOption {
+ default = "1";
+ type = types.str;
+ example = "4";
+ description = ''
+ "bantime-increment.factor" is a coefficient to calculate exponent growing of the formula or common multiplier,
+ default value of factor is 1 and with default value of formula, the ban time grows by 1, 2, 4, 8, 16 ...
+ '';
+ };
+
+ bantime-increment.formula = mkOption {
+ default = "ban.Time * (1<<(ban.Count if ban.Count<20 else 20)) * banFactor";
+ type = types.str;
+ example = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
+ description = ''
+ "bantime-increment.formula" used by default to calculate next value of ban time, default value bellow,
+ the same ban time growing will be reached by multipliers 1, 2, 4, 8, 16, 32...
+ '';
+ };
+
+ bantime-increment.multipliers = mkOption {
+ default = "1 2 4 8 16 32 64";
+ type = types.str;
+ example = "2 4 16 128";
+ description = ''
+ "bantime-increment.multipliers" used to calculate next value of ban time instead of formula, coresponding
+ previously ban count and given "bantime.factor" (for multipliers default is 1);
+ following example grows ban time by 1, 2, 4, 8, 16 ... and if last ban count greater as multipliers count,
+ always used last multiplier (64 in example), for factor '1' and original ban time 600 - 10.6 hours
+ '';
+ };
+
+ bantime-increment.overalljails = mkOption {
+ default = false;
+ type = types.bool;
+ example = true;
+ description = ''
+ "bantime-increment.overalljails" (if true) specifies the search of IP in the database will be executed
+ cross over all jails, if false (dafault), only current jail of the ban IP will be searched
+ '';
+ };
+
+ ignoreIP = mkOption {
+ default = [ ];
+ type = types.listOf types.str;
+ example = [ "192.168.0.0/16" "2001:DB8::42" ];
+ description = ''
+ "ignoreIP" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban will not ban a host which
+ matches an address in this list. Several addresses can be defined using space (and/or comma) separator.
+ '';
+ };
+
daemonConfig = mkOption {
- default =
- ''
- [Definition]
- loglevel = INFO
- logtarget = SYSLOG
- socket = /run/fail2ban/fail2ban.sock
- pidfile = /run/fail2ban/fail2ban.pid
- '';
+ default = ''
+ [Definition]
+ logtarget = SYSLOG
+ socket = /run/fail2ban/fail2ban.sock
+ pidfile = /run/fail2ban/fail2ban.pid
+ dbfile = /var/lib/fail2ban/fail2ban.sqlite3
+ '';
type = types.lines;
- description =
- ''
- The contents of Fail2ban's main configuration file. It's
- generally not necessary to change it.
- '';
+ description = ''
+ The contents of Fail2ban's main configuration file. It's
+ generally not necessary to change it.
+ '';
};
jails = mkOption {
@@ -65,88 +196,107 @@ in
}
'';
type = types.attrsOf types.lines;
- description =
- ''
- The configuration of each Fail2ban “jail”. A jail
- consists of an action (such as blocking a port using
- iptables) that is triggered when a
- filter applied to a log file triggers more than a certain
- number of times in a certain time period. Actions are
- defined in /etc/fail2ban/action.d,
- while filters are defined in
- /etc/fail2ban/filter.d.
- '';
+ description = ''
+ The configuration of each Fail2ban “jail”. A jail
+ consists of an action (such as blocking a port using
+ iptables) that is triggered when a
+ filter applied to a log file triggers more than a certain
+ number of times in a certain time period. Actions are
+ defined in /etc/fail2ban/action.d,
+ while filters are defined in
+ /etc/fail2ban/filter.d.
+ '';
};
};
};
-
###### implementation
config = mkIf cfg.enable {
- environment.systemPackages = [ pkgs.fail2ban ];
+ environment.systemPackages = [ cfg.package ];
- environment.etc."fail2ban/fail2ban.conf".source = fail2banConf;
- environment.etc."fail2ban/jail.conf".source = jailConf;
- environment.etc."fail2ban/action.d".source = "${pkgs.fail2ban}/etc/fail2ban/action.d/*.conf";
- environment.etc."fail2ban/filter.d".source = "${pkgs.fail2ban}/etc/fail2ban/filter.d/*.conf";
-
- systemd.services.fail2ban =
- { description = "Fail2ban Intrusion Prevention System";
+ environment.etc = {
+ "fail2ban/fail2ban.local".source = fail2banConf;
+ "fail2ban/jail.local".source = jailConf;
+ "fail2ban/fail2ban.conf".source = "${cfg.package}/etc/fail2ban/fail2ban.conf";
+ "fail2ban/jail.conf".source = "${cfg.package}/etc/fail2ban/jail.conf";
+ "fail2ban/paths-common.conf".source = "${cfg.package}/etc/fail2ban/paths-common.conf";
+ "fail2ban/paths-nixos.conf".source = pathsConf;
+ "fail2ban/action.d".source = "${cfg.package}/etc/fail2ban/action.d/*.conf";
+ "fail2ban/filter.d".source = "${cfg.package}/etc/fail2ban/filter.d/*.conf";
+ };
- wantedBy = [ "multi-user.target" ];
- after = [ "network.target" ];
- partOf = optional config.networking.firewall.enable "firewall.service";
+ systemd.services.fail2ban = {
+ description = "Fail2ban Intrusion Prevention System";
- restartTriggers = [ fail2banConf jailConf ];
- path = [ pkgs.fail2ban pkgs.iptables pkgs.iproute ];
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+ partOf = optional config.networking.firewall.enable "firewall.service";
- preStart =
- ''
- mkdir -p /var/lib/fail2ban
- '';
+ restartTriggers = [ fail2banConf jailConf pathsConf ];
+ reloadIfChanged = true;
- unitConfig.Documentation = "man:fail2ban(1)";
+ path = [ cfg.package cfg.packageFirewall pkgs.iproute ];
- serviceConfig =
- { Type = "forking";
- ExecStart = "${pkgs.fail2ban}/bin/fail2ban-client -x start";
- ExecStop = "${pkgs.fail2ban}/bin/fail2ban-client stop";
- ExecReload = "${pkgs.fail2ban}/bin/fail2ban-client reload";
- PIDFile = "/run/fail2ban/fail2ban.pid";
- Restart = "always";
+ unitConfig.Documentation = "man:fail2ban(1)";
- ReadOnlyDirectories = "/";
- ReadWriteDirectories = "/run/fail2ban /var/tmp /var/lib";
- PrivateTmp = "true";
- RuntimeDirectory = "fail2ban";
- CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW";
- };
+ serviceConfig = {
+ ExecStart = "${cfg.package}/bin/fail2ban-server -xf start";
+ ExecStop = "${cfg.package}/bin/fail2ban-server stop";
+ ExecReload = "${cfg.package}/bin/fail2ban-server reload";
+ Type = "simple";
+ Restart = "on-failure";
+ PIDFile = "/run/fail2ban/fail2ban.pid";
+ # Capabilities
+ CapabilityBoundingSet = [ "CAP_AUDIT_READ" "CAP_DAC_READ_SEARCH" "CAP_NET_ADMIN" "CAP_NET_RAW" ];
+ # Security
+ NoNewPrivileges = true;
+ # Directory
+ RuntimeDirectory = "fail2ban";
+ RuntimeDirectoryMode = "0750";
+ StateDirectory = "fail2ban";
+ StateDirectoryMode = "0750";
+ LogsDirectory = "fail2ban";
+ LogsDirectoryMode = "0750";
+ # Sandboxing
+ ProtectSystem = "strict";
+ ProtectHome = true;
+ PrivateTmp = true;
+ PrivateDevices = true;
+ ProtectHostname = true;
+ ProtectKernelTunables = true;
+ ProtectKernelModules = true;
+ ProtectControlGroups = true;
};
+ };
# Add some reasonable default jails. The special "DEFAULT" jail
# sets default values for all other jails.
- services.fail2ban.jails.DEFAULT =
- ''
- ignoreip = 127.0.0.1/8
- bantime = 600
- findtime = 600
- maxretry = 3
- backend = systemd
- enabled = true
- '';
-
+ services.fail2ban.jails.DEFAULT = ''
+ ${optionalString cfg.bantime-increment.enable ''
+ # Bantime incremental
+ bantime.increment = ${if cfg.bantime-increment.enable then "true" else "false"}
+ bantime.maxtime = ${cfg.bantime-increment.maxtime}
+ bantime.factor = ${cfg.bantime-increment.factor}
+ bantime.formula = ${cfg.bantime-increment.formula}
+ bantime.multipliers = ${cfg.bantime-increment.multipliers}
+ bantime.overalljails = ${if cfg.bantime-increment.overalljails then "true" else "false"}
+ ''}
+ # Miscellaneous options
+ ignoreip = 127.0.0.1/8 ${optionalString config.networking.enableIPv6 "::1"} ${concatStringsSep " " cfg.ignoreIP}
+ maxretry = 3
+ backend = systemd
+ # Actions
+ banaction = ${cfg.banaction}
+ banaction_allports = ${cfg.banaction-allports}
+ '';
# Block SSH if there are too many failing connection attempts.
- services.fail2ban.jails.ssh-iptables =
- ''
- filter = sshd
- action = iptables-multiport[name=SSH, port="${concatMapStringsSep "," (p: toString p) config.services.openssh.ports}", protocol=tcp]
- maxretry = 5
- '';
-
+ services.fail2ban.jails.sshd = mkDefault ''
+ enabled = true
+ port = ${concatMapStringsSep "," (p: toString p) config.services.openssh.ports}
+ '';
};
-
}
diff --git a/nixos/modules/services/security/sshguard.nix b/nixos/modules/services/security/sshguard.nix
index 4a174564dd2cabcd35e66ab6928cd282783d849a..e7a9cefdef30ad112be73a75ad8eb1a70a6cc725 100644
--- a/nixos/modules/services/security/sshguard.nix
+++ b/nixos/modules/services/security/sshguard.nix
@@ -92,8 +92,11 @@ in {
"-o cat"
"-n1"
] ++ (map (name: "-t ${escapeShellArg name}") cfg.services));
+ backend = if config.networking.nftables.enable
+ then "sshg-fw-nft-sets"
+ else "sshg-fw-ipset";
in ''
- BACKEND="${pkgs.sshguard}/libexec/sshg-fw-ipset"
+ BACKEND="${pkgs.sshguard}/libexec/${backend}"
LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl ${args}"
'';
@@ -104,7 +107,9 @@ in {
after = [ "network.target" ];
partOf = optional config.networking.firewall.enable "firewall.service";
- path = with pkgs; [ iptables ipset iproute systemd ];
+ path = with pkgs; if config.networking.nftables.enable
+ then [ nftables iproute systemd ]
+ else [ iptables ipset iproute systemd ];
# The sshguard ipsets must exist before we invoke
# iptables. sshguard creates the ipsets after startup if
@@ -112,14 +117,14 @@ in {
# the iptables rules because postStart races with the creation
# of the ipsets. So instead, we create both the ipsets and
# firewall rules before sshguard starts.
- preStart = ''
+ preStart = optionalString config.networking.firewall.enable ''
${pkgs.ipset}/bin/ipset -quiet create -exist sshguard4 hash:net family inet
${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:net family inet6
${pkgs.iptables}/bin/iptables -I INPUT -m set --match-set sshguard4 src -j DROP
${pkgs.iptables}/bin/ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP
'';
- postStop = ''
+ postStop = optionalString config.networking.firewall.enable ''
${pkgs.iptables}/bin/iptables -D INPUT -m set --match-set sshguard4 src -j DROP
${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP
${pkgs.ipset}/bin/ipset -quiet destroy sshguard4
diff --git a/nixos/modules/services/security/vault.nix b/nixos/modules/services/security/vault.nix
index b0ab8fadcbec9a8c442dc5185d5c3fcd599ada82..6a8a3a93327eb7b086c62c4e1a971fa4010faa12 100644
--- a/nixos/modules/services/security/vault.nix
+++ b/nixos/modules/services/security/vault.nix
@@ -135,6 +135,7 @@ in
User = "vault";
Group = "vault";
ExecStart = "${cfg.package}/bin/vault server -config ${configFile}";
+ ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
PrivateDevices = true;
PrivateTmp = true;
ProtectSystem = "full";
diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix
index aa1acdf7d20b98513d6e6ed6e7d1a24ac822bb35..5ba72e8d7730d66eb9597909d5654acf68c3129c 100644
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@@ -129,19 +129,23 @@ in
# It's useful to have transmission in path, e.g. for remote control
environment.systemPackages = [ pkgs.transmission ];
- users.users = optionalAttrs (cfg.user == "transmission") (singleton
- { name = "transmission";
+ users.users = optionalAttrs (cfg.user == "transmission") ({
+ transmission = {
+ name = "transmission";
group = cfg.group;
uid = config.ids.uids.transmission;
description = "Transmission BitTorrent user";
home = homeDir;
createHome = true;
- });
+ };
+ });
- users.groups = optionalAttrs (cfg.group == "transmission") (singleton
- { name = "transmission";
+ users.groups = optionalAttrs (cfg.group == "transmission") ({
+ transmission = {
+ name = "transmission";
gid = config.ids.gids.transmission;
- });
+ };
+ });
# AppArmor profile
security.apparmor.profiles = mkIf apparmor [
diff --git a/nixos/modules/services/web-apps/dokuwiki.nix b/nixos/modules/services/web-apps/dokuwiki.nix
new file mode 100644
index 0000000000000000000000000000000000000000..07af7aa0dfec7c3625505b2bf769b18b69348239
--- /dev/null
+++ b/nixos/modules/services/web-apps/dokuwiki.nix
@@ -0,0 +1,272 @@
+{ config, lib, pkgs, ... }:
+
+let
+
+ inherit (lib) mkEnableOption mkForce mkIf mkMerge mkOption optionalAttrs recursiveUpdate types;
+
+ cfg = config.services.dokuwiki;
+
+ user = config.services.nginx.user;
+ group = config.services.nginx.group;
+
+ dokuwikiAclAuthConfig = pkgs.writeText "acl.auth.php" ''
+ # acl.auth.php
+ #
+ #
+ # Access Control Lists
+ #
+ ${toString cfg.acl}
+ '';
+
+ dokuwikiLocalConfig = pkgs.writeText "local.php" ''
+
+ Mutually exclusive with services.dokuwiki.aclFile
+ Set this to a value other than null to take precedence over aclFile option.
+ '';
+ };
+
+ aclFile = mkOption {
+ type = types.nullOr types.path;
+ default = null;
+ description = ''
+ Location of the dokuwiki acl rules. Mutually exclusive with services.dokuwiki.acl
+ Mutually exclusive with services.dokuwiki.acl which is preferred.
+ Consult documentation for further instructions.
+ Example:
+ '';
+ };
+
+ aclUse = mkOption {
+ type = types.bool;
+ default = true;
+ description = ''
+ Necessary for users to log in into the system.
+ Also limits anonymous users. When disabled,
+ everyone is able to create and edit content.
+ '';
+ };
+
+ pluginsConfig = mkOption {
+ type = types.lines;
+ default = ''
+ $plugins['authad'] = 0;
+ $plugins['authldap'] = 0;
+ $plugins['authmysql'] = 0;
+ $plugins['authpgsql'] = 0;
+ '';
+ description = ''
+ List of the dokuwiki (un)loaded plugins.
+ '';
+ };
+
+ superUser = mkOption {
+ type = types.nullOr types.str;
+ default = "@admin";
+ description = ''
+ You can set either a username, a list of usernames (“admin1,admin2”),
+ or the name of a group by prepending an @ char to the groupname
+ Consult documentation for further instructions.
+ '';
+ };
+
+ usersFile = mkOption {
+ type = types.nullOr types.path;
+ default = null;
+ description = ''
+ Location of the dokuwiki users file. List of users. Format:
+ login:passwordhash:Real Name:email:groups,comma,separated
+ Create passwordHash easily by using:$ mkpasswd -5 password `pwgen 8 1`
+ Example:
+ '';
+ };
+
+ extraConfig = mkOption {
+ type = types.nullOr types.lines;
+ default = null;
+ example = ''
+ $conf['title'] = 'My Wiki';
+ $conf['userewrite'] = 1;
+ '';
+ description = ''
+ DokuWiki configuration. Refer to
+
+ for details on supported values.
+ '';
+ };
+
+ poolConfig = mkOption {
+ type = with types; attrsOf (oneOf [ str int bool ]);
+ default = {
+ "pm" = "dynamic";
+ "pm.max_children" = 32;
+ "pm.start_servers" = 2;
+ "pm.min_spare_servers" = 2;
+ "pm.max_spare_servers" = 4;
+ "pm.max_requests" = 500;
+ };
+ description = ''
+ Options for the dokuwiki PHP pool. See the documentation on php-fpm.conf
+ for details on configuration directives.
+ '';
+ };
+
+ nginx = mkOption {
+ type = types.submodule (
+ recursiveUpdate
+ (import ../web-servers/nginx/vhost-options.nix { inherit config lib; })
+ {
+ # Enable encryption by default,
+ options.forceSSL.default = true;
+ options.enableACME.default = true;
+ }
+ );
+ default = {forceSSL = true; enableACME = true;};
+ example = {
+ serverAliases = [
+ "wiki.\${config.networking.domain}"
+ ];
+ enableACME = false;
+ };
+ description = ''
+ With this option, you can customize the nginx virtualHost which already has sensible defaults for DokuWiki.
+ '';
+ };
+ };
+
+ # implementation
+
+ config = mkIf cfg.enable {
+
+ warnings = mkIf (cfg.superUser == null) ["Not setting services.dokuwiki.superUser will impair your ability to administer DokuWiki"];
+
+ assertions = [
+ {
+ assertion = cfg.aclUse -> (cfg.acl != null || cfg.aclFile != null);
+ message = "Either services.dokuwiki.acl or services.dokuwiki.aclFile is mandatory when aclUse is true";
+ }
+ {
+ assertion = cfg.usersFile != null -> cfg.aclUse != false;
+ message = "services.dokuwiki.aclUse must be true when usersFile is not null";
+ }
+ ];
+
+ services.phpfpm.pools.dokuwiki = {
+ inherit user;
+ inherit group;
+ phpEnv = {
+ DOKUWIKI_LOCAL_CONFIG = "${dokuwikiLocalConfig}";
+ DOKUWIKI_PLUGINS_LOCAL_CONFIG = "${dokuwikiPluginsLocalConfig}";
+ } //optionalAttrs (cfg.usersFile != null) {
+ DOKUWIKI_USERS_AUTH_CONFIG = "${cfg.usersFile}";
+ } //optionalAttrs (cfg.aclUse) {
+ DOKUWIKI_ACL_AUTH_CONFIG = if (cfg.acl != null) then "${dokuwikiAclAuthConfig}" else "${toString cfg.aclFile}";
+ };
+
+ settings = {
+ "listen.mode" = "0660";
+ "listen.owner" = user;
+ "listen.group" = group;
+ } // cfg.poolConfig;
+ };
+
+ services.nginx = {
+ enable = true;
+
+ virtualHosts = {
+ ${cfg.hostName} = mkMerge [ cfg.nginx {
+ root = mkForce "${pkgs.dokuwiki}/share/dokuwiki/";
+ extraConfig = "fastcgi_param HTTPS on;";
+
+ locations."~ /(conf/|bin/|inc/|install.php)" = {
+ extraConfig = "deny all;";
+ };
+
+ locations."~ ^/data/" = {
+ root = "${cfg.stateDir}";
+ extraConfig = "internal;";
+ };
+
+ locations."~ ^/lib.*\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+ extraConfig = "expires 365d;";
+ };
+
+ locations."/" = {
+ priority = 1;
+ index = "doku.php";
+ extraConfig = ''try_files $uri $uri/ @dokuwiki;'';
+ };
+
+ locations."@dokuwiki" = {
+ extraConfig = ''
+ # rewrites "doku.php/" out of the URLs if you set the userwrite setting to .htaccess in dokuwiki config page
+ rewrite ^/_media/(.*) /lib/exe/fetch.php?media=$1 last;
+ rewrite ^/_detail/(.*) /lib/exe/detail.php?media=$1 last;
+ rewrite ^/_export/([^/]+)/(.*) /doku.php?do=export_$1&id=$2 last;
+ rewrite ^/(.*) /doku.php?id=$1&$args last;
+ '';
+ };
+
+ locations."~ \.php$" = {
+ extraConfig = ''
+ try_files $uri $uri/ /doku.php;
+ include ${pkgs.nginx}/conf/fastcgi_params;
+ fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+ fastcgi_param REDIRECT_STATUS 200;
+ fastcgi_pass unix:${config.services.phpfpm.pools.dokuwiki.socket};
+ fastcgi_param HTTPS on;
+ '';
+ };
+ }];
+ };
+
+ };
+
+ systemd.tmpfiles.rules = [
+ "d ${cfg.stateDir}/attic 0750 ${user} ${group} - -"
+ "d ${cfg.stateDir}/cache 0750 ${user} ${group} - -"
+ "d ${cfg.stateDir}/index 0750 ${user} ${group} - -"
+ "d ${cfg.stateDir}/locks 0750 ${user} ${group} - -"
+ "d ${cfg.stateDir}/media 0750 ${user} ${group} - -"
+ "d ${cfg.stateDir}/media_attic 0750 ${user} ${group} - -"
+ "d ${cfg.stateDir}/media_meta 0750 ${user} ${group} - -"
+ "d ${cfg.stateDir}/meta 0750 ${user} ${group} - -"
+ "d ${cfg.stateDir}/pages 0750 ${user} ${group} - -"
+ "d ${cfg.stateDir}/tmp 0750 ${user} ${group} - -"
+ ];
+
+ };
+}
diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index e00a47191c6f97225011f36f2af047c25275b5ac..56265e80957ed1b7a8056e4250d1b9352b6f2b7f 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -100,7 +100,7 @@ in
};
virtualHost = mkOption {
- type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+ type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
example = literalExample ''
{
hostName = "survey.example.org";
diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index 8a109b39bb5797b72a0a09194218f7002b5d3ce4..e9ed53857d8119d8da20b2ef2fa130177b25c80c 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -290,7 +290,7 @@ in
};
virtualHost = mkOption {
- type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+ type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
example = literalExample ''
{
hostName = "mediawiki.example.org";
diff --git a/nixos/modules/services/web-apps/moodle.nix b/nixos/modules/services/web-apps/moodle.nix
index 595d070d940ab78951bdfcb6ea99907bcc89be58..1196780cf6ef96a14b52801aec745cde74c42094 100644
--- a/nixos/modules/services/web-apps/moodle.nix
+++ b/nixos/modules/services/web-apps/moodle.nix
@@ -140,7 +140,7 @@ in
};
virtualHost = mkOption {
- type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+ type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
example = literalExample ''
{
hostName = "moodle.example.org";
diff --git a/nixos/modules/services/web-apps/wordpress.nix b/nixos/modules/services/web-apps/wordpress.nix
index ad4f39fbf52c40505dac13252d03610810e6388c..c48a44097372ea2d676532960f6c98a0cb650c98 100644
--- a/nixos/modules/services/web-apps/wordpress.nix
+++ b/nixos/modules/services/web-apps/wordpress.nix
@@ -209,7 +209,7 @@ let
};
virtualHost = mkOption {
- type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+ type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
example = literalExample ''
{
adminAddr = "webmaster@example.org";
diff --git a/nixos/modules/services/web-apps/zabbix.nix b/nixos/modules/services/web-apps/zabbix.nix
index ee8447810c6de10558ff7bdd8c22a7118e57acee..00719512834783f52f9055168d1122022f305b68 100644
--- a/nixos/modules/services/web-apps/zabbix.nix
+++ b/nixos/modules/services/web-apps/zabbix.nix
@@ -113,7 +113,7 @@ in
};
virtualHost = mkOption {
- type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+ type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
example = literalExample ''
{
hostName = "zabbix.example.org";
diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix
index 4460f89ec5c196054117c0f8b6c465cea962dbbd..832c8b30ee9da28d7b650f86eb2a0f68ca4bde3c 100644
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@@ -4,21 +4,21 @@ with lib;
let
- mainCfg = config.services.httpd;
+ cfg = config.services.httpd;
runtimeDir = "/run/httpd";
- httpd = mainCfg.package.out;
+ pkg = cfg.package.out;
- httpdConf = mainCfg.configFile;
+ httpdConf = cfg.configFile;
- php = mainCfg.phpPackage.override { apacheHttpd = httpd.dev; /* otherwise it only gets .out */ };
+ php = cfg.phpPackage.override { apacheHttpd = pkg.dev; /* otherwise it only gets .out */ };
phpMajorVersion = lib.versions.major (lib.getVersion php);
- mod_perl = pkgs.apacheHttpdPackages.mod_perl.override { apacheHttpd = httpd; };
+ mod_perl = pkgs.apacheHttpdPackages.mod_perl.override { apacheHttpd = pkg; };
- vhosts = attrValues mainCfg.virtualHosts;
+ vhosts = attrValues cfg.virtualHosts;
mkListenInfo = hostOpts:
if hostOpts.listen != [] then hostOpts.listen
@@ -29,8 +29,8 @@ let
listenInfo = unique (concatMap mkListenInfo vhosts);
+ enableHttp2 = any (vhost: vhost.http2) vhosts;
enableSSL = any (listen: listen.ssl) listenInfo;
-
enableUserDir = any (vhost: vhost.enableUserDir) vhosts;
# NOTE: generally speaking order of modules is very important
@@ -41,23 +41,19 @@ let
"mime" "autoindex" "negotiation" "dir"
"alias" "rewrite"
"unixd" "slotmem_shm" "socache_shmcb"
- "mpm_${mainCfg.multiProcessingModule}"
+ "mpm_${cfg.multiProcessingModule}"
]
- ++ (if mainCfg.multiProcessingModule == "prefork" then [ "cgi" ] else [ "cgid" ])
+ ++ (if cfg.multiProcessingModule == "prefork" then [ "cgi" ] else [ "cgid" ])
+ ++ optional enableHttp2 "http2"
++ optional enableSSL "ssl"
++ optional enableUserDir "userdir"
- ++ optional mainCfg.enableMellon { name = "auth_mellon"; path = "${pkgs.apacheHttpdPackages.mod_auth_mellon}/modules/mod_auth_mellon.so"; }
- ++ optional mainCfg.enablePHP { name = "php${phpMajorVersion}"; path = "${php}/modules/libphp${phpMajorVersion}.so"; }
- ++ optional mainCfg.enablePerl { name = "perl"; path = "${mod_perl}/modules/mod_perl.so"; }
- ++ mainCfg.extraModules;
-
-
- allDenied = "Require all denied";
- allGranted = "Require all granted";
-
+ ++ optional cfg.enableMellon { name = "auth_mellon"; path = "${pkgs.apacheHttpdPackages.mod_auth_mellon}/modules/mod_auth_mellon.so"; }
+ ++ optional cfg.enablePHP { name = "php${phpMajorVersion}"; path = "${php}/modules/libphp${phpMajorVersion}.so"; }
+ ++ optional cfg.enablePerl { name = "perl"; path = "${mod_perl}/modules/mod_perl.so"; }
+ ++ cfg.extraModules;
- loggingConf = (if mainCfg.logFormat != "none" then ''
- ErrorLog ${mainCfg.logDir}/error.log
+ loggingConf = (if cfg.logFormat != "none" then ''
+ ErrorLog ${cfg.logDir}/error.log
LogLevel notice
@@ -66,7 +62,7 @@ let
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
- CustomLog ${mainCfg.logDir}/access.log ${mainCfg.logFormat}
+ CustomLog ${cfg.logDir}/access.log ${cfg.logFormat}
'' else ''
ErrorLog /dev/null
'');
@@ -88,34 +84,36 @@ let
sslConf = ''
- SSLSessionCache shmcb:${runtimeDir}/ssl_scache(512000)
+
+ SSLSessionCache shmcb:${runtimeDir}/ssl_scache(512000)
- Mutex posixsem
+ Mutex posixsem
- SSLRandomSeed startup builtin
- SSLRandomSeed connect builtin
+ SSLRandomSeed startup builtin
+ SSLRandomSeed connect builtin
- SSLProtocol ${mainCfg.sslProtocols}
- SSLCipherSuite ${mainCfg.sslCiphers}
- SSLHonorCipherOrder on
+ SSLProtocol ${cfg.sslProtocols}
+ SSLCipherSuite ${cfg.sslCiphers}
+ SSLHonorCipherOrder on
+
'';
mimeConf = ''
- TypesConfig ${httpd}/conf/mime.types
+ TypesConfig ${pkg}/conf/mime.types
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
AddType application/x-httpd-php .php .phtml
- MIMEMagicFile ${httpd}/conf/magic
+ MIMEMagicFile ${pkg}/conf/magic
'';
mkVHostConf = hostOpts:
let
- adminAddr = if hostOpts.adminAddr != null then hostOpts.adminAddr else mainCfg.adminAddr;
+ adminAddr = if hostOpts.adminAddr != null then hostOpts.adminAddr else cfg.adminAddr;
listen = filter (listen: !listen.ssl) (mkListenInfo hostOpts);
listenSSL = filter (listen: listen.ssl) (mkListenInfo hostOpts);
@@ -167,6 +165,7 @@ let
SSLCertificateFile ${sslServerCert}
SSLCertificateKeyFile ${sslServerKey}
${optionalString (sslServerChain != null) "SSLCertificateChainFile ${sslServerChain}"}
+ ${optionalString hostOpts.http2 "Protocols h2 h2c http/1.1"}
${acmeChallenge}
${mkVHostCommonConf hostOpts}
@@ -179,11 +178,33 @@ let
then hostOpts.documentRoot
else pkgs.runCommand "empty" { preferLocalBuild = true; } "mkdir -p $out"
;
+
+ mkLocations = locations: concatStringsSep "\n" (map (config: ''
+
+ ${optionalString (config.proxyPass != null) ''
+
+ ProxyPass ${config.proxyPass}
+ ProxyPassReverse ${config.proxyPass}
+
+ ''}
+ ${optionalString (config.index != null) ''
+
+ DirectoryIndex ${config.index}
+
+ ''}
+ ${optionalString (config.alias != null) ''
+
+ Alias "${config.alias}"
+
+ ''}
+ ${config.extraConfig}
+
+ '') (sortProperties (mapAttrsToList (k: v: v // { location = k; }) locations)));
in
''
- ${optionalString mainCfg.logPerVirtualHost ''
- ErrorLog ${mainCfg.logDir}/error-${hostOpts.hostName}.log
- CustomLog ${mainCfg.logDir}/access-${hostOpts.hostName}.log ${hostOpts.logFormat}
+ ${optionalString cfg.logPerVirtualHost ''
+ ErrorLog ${cfg.logDir}/error-${hostOpts.hostName}.log
+ CustomLog ${cfg.logDir}/access-${hostOpts.hostName}.log ${hostOpts.logFormat}
''}
${optionalString (hostOpts.robotsEntries != "") ''
@@ -195,7 +216,7 @@ let
Options Indexes FollowSymLinks
AllowOverride None
- ${allGranted}
+ Require all granted
${optionalString hostOpts.enableUserDir ''
@@ -217,24 +238,19 @@ let
RedirectPermanent / ${hostOpts.globalRedirect}
''}
- ${
- let makeFileConf = elem: ''
- Alias ${elem.urlPath} ${elem.file}
- '';
- in concatMapStrings makeFileConf hostOpts.servedFiles
- }
${
let makeDirConf = elem: ''
Alias ${elem.urlPath} ${elem.dir}/
Options +Indexes
- ${allGranted}
+ Require all granted
AllowOverride All
'';
in concatMapStrings makeDirConf hostOpts.servedDirs
}
+ ${mkLocations hostOpts.locations}
${hostOpts.extraConfig}
''
;
@@ -242,20 +258,20 @@ let
confFile = pkgs.writeText "httpd.conf" ''
- ServerRoot ${httpd}
+ ServerRoot ${pkg}
ServerName ${config.networking.hostName}
DefaultRuntimeDir ${runtimeDir}/runtime
PidFile ${runtimeDir}/httpd.pid
- ${optionalString (mainCfg.multiProcessingModule != "prefork") ''
+ ${optionalString (cfg.multiProcessingModule != "prefork") ''
# mod_cgid requires this.
ScriptSock ${runtimeDir}/cgisock
''}
- MaxClients ${toString mainCfg.maxClients}
- MaxRequestsPerChild ${toString mainCfg.maxRequestsPerChild}
+ MaxClients ${toString cfg.maxClients}
+ MaxRequestsPerChild ${toString cfg.maxRequestsPerChild}
${let
@@ -264,12 +280,12 @@ let
in concatStringsSep "\n" uniqueListen
}
- User ${mainCfg.user}
- Group ${mainCfg.group}
+ User ${cfg.user}
+ Group ${cfg.group}
${let
mkModule = module:
- if isString module then { name = module; path = "${httpd}/modules/mod_${module}.so"; }
+ if isString module then { name = module; path = "${pkg}/modules/mod_${module}.so"; }
else if isAttrs module then { inherit (module) name path; }
else throw "Expecting either a string or attribute set including a name and path.";
in
@@ -279,37 +295,37 @@ let
AddHandler type-map var
- ${allDenied}
+ Require all denied
${mimeConf}
${loggingConf}
${browserHacks}
- Include ${httpd}/conf/extra/httpd-default.conf
- Include ${httpd}/conf/extra/httpd-autoindex.conf
- Include ${httpd}/conf/extra/httpd-multilang-errordoc.conf
- Include ${httpd}/conf/extra/httpd-languages.conf
+ Include ${pkg}/conf/extra/httpd-default.conf
+ Include ${pkg}/conf/extra/httpd-autoindex.conf
+ Include ${pkg}/conf/extra/httpd-multilang-errordoc.conf
+ Include ${pkg}/conf/extra/httpd-languages.conf
TraceEnable off
- ${if enableSSL then sslConf else ""}
+ ${sslConf}
# Fascist default - deny access to everything.
Options FollowSymLinks
AllowOverride None
- ${allDenied}
+ Require all denied
# But do allow access to files in the store so that we don't have
# to generate clauses for every generated file that we
# want to serve.
- ${allGranted}
+ Require all granted
- ${mainCfg.extraConfig}
+ ${cfg.extraConfig}
${concatMapStringsSep "\n" mkVHostConf vhosts}
'';
@@ -317,7 +333,7 @@ let
# Generate the PHP configuration file. Should probably be factored
# out into a separate module.
phpIni = pkgs.runCommand "php.ini"
- { options = mainCfg.phpOptions;
+ { options = cfg.phpOptions;
preferLocalBuild = true;
}
''
@@ -350,17 +366,13 @@ in
(mkRemovedOptionModule [ "services" "httpd" "sslServerKey" ] "Please define a virtual host using `services.httpd.virtualHosts`.")
];
- ###### interface
+ # interface
options = {
services.httpd = {
- enable = mkOption {
- type = types.bool;
- default = false;
- description = "Whether to enable the Apache HTTP Server.";
- };
+ enable = mkEnableOption "the Apache HTTP Server";
package = mkOption {
type = types.package;
@@ -387,7 +399,7 @@ in
default = "";
description = ''
Configuration lines appended to the generated Apache
- configuration file. Note that this mechanism may not work
+ configuration file. Note that this mechanism will not work
when is overridden.
'';
};
@@ -402,7 +414,7 @@ in
]
'';
description = ''
- Additional Apache modules to be used. These can be
+ Additional Apache modules to be used. These can be
specified as a string in the case of modules distributed
with Apache, or as an attribute set specifying the
name and path of the
@@ -441,8 +453,7 @@ in
type = types.str;
default = "wwwrun";
description = ''
- User account under which httpd runs. The account is created
- automatically if it doesn't exist.
+ User account under which httpd runs.
'';
};
@@ -450,8 +461,7 @@ in
type = types.str;
default = "wwwrun";
description = ''
- Group under which httpd runs. The account is created
- automatically if it doesn't exist.
+ Group under which httpd runs.
'';
};
@@ -459,15 +469,15 @@ in
type = types.path;
default = "/var/log/httpd";
description = ''
- Directory for Apache's log files. It is created automatically.
+ Directory for Apache's log files. It is created automatically.
'';
};
virtualHosts = mkOption {
- type = with types; attrsOf (submodule (import ./per-server-options.nix));
+ type = with types; attrsOf (submodule (import ./vhost-options.nix));
default = {
localhost = {
- documentRoot = "${httpd}/htdocs";
+ documentRoot = "${pkg}/htdocs";
};
};
example = literalExample ''
@@ -523,17 +533,18 @@ in
''
date.timezone = "CET"
'';
- description =
- "Options appended to the PHP configuration file php.ini.";
+ description = ''
+ Options appended to the PHP configuration file php.ini.
+ '';
};
multiProcessingModule = mkOption {
- type = types.str;
+ type = types.enum [ "event" "prefork" "worker" ];
default = "prefork";
example = "worker";
description =
''
- Multi-processing module to be used by Apache. Available
+ Multi-processing module to be used by Apache. Available
modules are prefork (the default;
handles each request in a separate child process),
worker (hybrid approach that starts a
@@ -555,8 +566,9 @@ in
type = types.int;
default = 0;
example = 500;
- description =
- "Maximum number of httpd requests answered per httpd child (prefork), 0 means unlimited";
+ description = ''
+ Maximum number of httpd requests answered per httpd child (prefork), 0 means unlimited.
+ '';
};
sslCiphers = mkOption {
@@ -575,10 +587,9 @@ in
};
+ # implementation
- ###### implementation
-
- config = mkIf config.services.httpd.enable {
+ config = mkIf cfg.enable {
assertions = [
{
@@ -606,28 +617,36 @@ in
}
];
- users.users = optionalAttrs (mainCfg.user == "wwwrun") {
+ warnings =
+ mapAttrsToList (name: hostOpts: ''
+ Using config.services.httpd.virtualHosts."${name}".servedFiles is deprecated and will become unsupported in a future release. Your configuration will continue to work as is but please migrate your configuration to config.services.httpd.virtualHosts."${name}".locations before the 20.09 release of NixOS.
+ '') (filterAttrs (name: hostOpts: hostOpts.servedFiles != []) cfg.virtualHosts);
+
+ users.users = optionalAttrs (cfg.user == "wwwrun") {
wwwrun = {
- group = mainCfg.group;
+ group = cfg.group;
description = "Apache httpd user";
uid = config.ids.uids.wwwrun;
};
};
- users.groups = optionalAttrs (mainCfg.group == "wwwrun") {
+ users.groups = optionalAttrs (cfg.group == "wwwrun") {
wwwrun.gid = config.ids.gids.wwwrun;
};
security.acme.certs = mapAttrs (name: hostOpts: {
- user = mainCfg.user;
- group = mkDefault mainCfg.group;
- email = if hostOpts.adminAddr != null then hostOpts.adminAddr else mainCfg.adminAddr;
+ user = cfg.user;
+ group = mkDefault cfg.group;
+ email = if hostOpts.adminAddr != null then hostOpts.adminAddr else cfg.adminAddr;
webroot = hostOpts.acmeRoot;
extraDomains = genAttrs hostOpts.serverAliases (alias: null);
postRun = "systemctl reload httpd.service";
- }) (filterAttrs (name: hostOpts: hostOpts.enableACME) mainCfg.virtualHosts);
+ }) (filterAttrs (name: hostOpts: hostOpts.enableACME) cfg.virtualHosts);
+
+ environment.systemPackages = [ pkg ];
- environment.systemPackages = [httpd];
+ # required for "apachectl configtest"
+ environment.etc."httpd/httpd.conf".source = httpdConf;
services.httpd.phpOptions =
''
@@ -664,6 +683,15 @@ in
"access_compat"
];
+ systemd.tmpfiles.rules =
+ let
+ svc = config.systemd.services.httpd.serviceConfig;
+ in
+ [
+ "d '${cfg.logDir}' 0700 ${svc.User} ${svc.Group}"
+ "Z '${cfg.logDir}' - ${svc.User} ${svc.Group}"
+ ];
+
systemd.services.httpd =
let
vhostsACME = filter (hostOpts: hostOpts.enableACME) vhosts;
@@ -675,35 +703,36 @@ in
after = [ "network.target" "fs.target" ] ++ map (hostOpts: "acme-selfsigned-${hostOpts.hostName}.service") vhostsACME;
path =
- [ httpd pkgs.coreutils pkgs.gnugrep ]
- ++ optional mainCfg.enablePHP pkgs.system-sendmail; # Needed for PHP's mail() function.
+ [ pkg pkgs.coreutils pkgs.gnugrep ]
+ ++ optional cfg.enablePHP pkgs.system-sendmail; # Needed for PHP's mail() function.
environment =
- optionalAttrs mainCfg.enablePHP { PHPRC = phpIni; }
- // optionalAttrs mainCfg.enableMellon { LD_LIBRARY_PATH = "${pkgs.xmlsec}/lib"; };
+ optionalAttrs cfg.enablePHP { PHPRC = phpIni; }
+ // optionalAttrs cfg.enableMellon { LD_LIBRARY_PATH = "${pkgs.xmlsec}/lib"; };
preStart =
''
- mkdir -m 0700 -p ${mainCfg.logDir}
-
# Get rid of old semaphores. These tend to accumulate across
# server restarts, eventually preventing it from restarting
# successfully.
- for i in $(${pkgs.utillinux}/bin/ipcs -s | grep ' ${mainCfg.user} ' | cut -f2 -d ' '); do
+ for i in $(${pkgs.utillinux}/bin/ipcs -s | grep ' ${cfg.user} ' | cut -f2 -d ' '); do
${pkgs.utillinux}/bin/ipcrm -s $i
done
'';
- serviceConfig.ExecStart = "@${httpd}/bin/httpd httpd -f ${httpdConf}";
- serviceConfig.ExecStop = "${httpd}/bin/httpd -f ${httpdConf} -k graceful-stop";
- serviceConfig.ExecReload = "${httpd}/bin/httpd -f ${httpdConf} -k graceful";
- serviceConfig.Group = mainCfg.group;
- serviceConfig.Type = "forking";
- serviceConfig.PIDFile = "${runtimeDir}/httpd.pid";
- serviceConfig.Restart = "always";
- serviceConfig.RestartSec = "5s";
- serviceConfig.RuntimeDirectory = "httpd httpd/runtime";
- serviceConfig.RuntimeDirectoryMode = "0750";
+ serviceConfig = {
+ ExecStart = "@${pkg}/bin/httpd httpd -f ${httpdConf}";
+ ExecStop = "${pkg}/bin/httpd -f ${httpdConf} -k graceful-stop";
+ ExecReload = "${pkg}/bin/httpd -f ${httpdConf} -k graceful";
+ User = "root";
+ Group = cfg.group;
+ Type = "forking";
+ PIDFile = "${runtimeDir}/httpd.pid";
+ Restart = "always";
+ RestartSec = "5s";
+ RuntimeDirectory = "httpd httpd/runtime";
+ RuntimeDirectoryMode = "0750";
+ };
};
};
diff --git a/nixos/modules/services/web-servers/apache-httpd/location-options.nix b/nixos/modules/services/web-servers/apache-httpd/location-options.nix
new file mode 100644
index 0000000000000000000000000000000000000000..8ea88f94f973fd73cb28b5e1dc32a68ed28d9e93
--- /dev/null
+++ b/nixos/modules/services/web-servers/apache-httpd/location-options.nix
@@ -0,0 +1,54 @@
+{ config, lib, name, ... }:
+let
+ inherit (lib) mkOption types;
+in
+{
+ options = {
+
+ proxyPass = mkOption {
+ type = with types; nullOr str;
+ default = null;
+ example = "http://www.example.org/";
+ description = ''
+ Sets up a simple reverse proxy as described by .
+ '';
+ };
+
+ index = mkOption {
+ type = with types; nullOr str;
+ default = null;
+ example = "index.php index.html";
+ description = ''
+ Adds DirectoryIndex directive. See .
+ '';
+ };
+
+ alias = mkOption {
+ type = with types; nullOr path;
+ default = null;
+ example = "/your/alias/directory";
+ description = ''
+ Alias directory for requests. See .
+ '';
+ };
+
+ extraConfig = mkOption {
+ type = types.lines;
+ default = "";
+ description = ''
+ These lines go to the end of the location verbatim.
+ '';
+ };
+
+ priority = mkOption {
+ type = types.int;
+ default = 1000;
+ description = ''
+ Order of this location block in relation to the others in the vhost.
+ The semantics are the same as with `lib.mkOrder`. Smaller values have
+ a greater priority.
+ '';
+ };
+
+ };
+}
diff --git a/nixos/modules/services/web-servers/apache-httpd/per-server-options.nix b/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
similarity index 82%
rename from nixos/modules/services/web-servers/apache-httpd/per-server-options.nix
rename to nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
index f2e92cda05f60dd3e463e6402dcf998e6c1538b5..263980add8b26da6f4379f8bf895b125a2b5e360 100644
--- a/nixos/modules/services/web-servers/apache-httpd/per-server-options.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
@@ -1,6 +1,6 @@
{ config, lib, name, ... }:
let
- inherit (lib) mkOption types;
+ inherit (lib) literalExample mkOption nameValuePair types;
in
{
options = {
@@ -135,6 +135,15 @@ in
description = "Path to server SSL chain file.";
};
+ http2 = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to enable HTTP 2. HTTP/2 is supported in all multi-processing modules that come with httpd. However, if you use the prefork mpm, there will
+ be severe restrictions. Refer to for details.
+ '';
+ };
+
adminAddr = mkOption {
type = types.nullOr types.str;
default = null;
@@ -175,6 +184,12 @@ in
];
description = ''
This option provides a simple way to serve individual, static files.
+
+
+ This option has been deprecated and will be removed in a future
+ version of NixOS. You can achieve the same result by making use of
+ the locations.<name>.alias option.
+
'';
};
@@ -231,5 +246,30 @@ in
'';
};
+ locations = mkOption {
+ type = with types; attrsOf (submodule (import ./location-options.nix));
+ default = {};
+ example = literalExample ''
+ {
+ "/" = {
+ proxyPass = "http://localhost:3000";
+ };
+ "/foo/bar.png" = {
+ alias = "/home/eelco/some-file.png";
+ };
+ };
+ '';
+ description = ''
+ Declarative location config. See for details.
+ '';
+ };
+
+ };
+
+ config = {
+
+ locations = builtins.listToAttrs (map (elem: nameValuePair elem.urlPath { alias = elem.file; }) config.servedFiles);
+
};
}
diff --git a/nixos/modules/services/web-servers/nginx/gitweb.nix b/nixos/modules/services/web-servers/nginx/gitweb.nix
index 272fd1480185ead4e337ebb2196c4ba621ce3928..f7fb07bb79755234b8dc6c1d86f56568d8c3d482 100644
--- a/nixos/modules/services/web-servers/nginx/gitweb.nix
+++ b/nixos/modules/services/web-servers/nginx/gitweb.nix
@@ -3,8 +3,9 @@
with lib;
let
- cfg = config.services.gitweb;
- package = pkgs.gitweb.override (optionalAttrs cfg.gitwebTheme {
+ cfg = config.services.nginx.gitweb;
+ gitwebConfig = config.services.gitweb;
+ package = pkgs.gitweb.override (optionalAttrs gitwebConfig.gitwebTheme {
gitwebTheme = true;
});
@@ -17,13 +18,45 @@ in
default = false;
type = types.bool;
description = ''
- If true, enable gitweb in nginx. Access it at http://yourserver/gitweb
+ If true, enable gitweb in nginx.
+ '';
+ };
+
+ location = mkOption {
+ default = "/gitweb";
+ type = types.str;
+ description = ''
+ Location to serve gitweb on.
+ '';
+ };
+
+ user = mkOption {
+ default = "nginx";
+ type = types.str;
+ description = ''
+ Existing user that the CGI process will belong to. (Default almost surely will do.)
+ '';
+ };
+
+ group = mkOption {
+ default = "nginx";
+ type = types.str;
+ description = ''
+ Group that the CGI process will belong to. (Set to config.services.gitolite.group if you are using gitolite.)
+ '';
+ };
+
+ virtualHost = mkOption {
+ default = "_";
+ type = types.str;
+ description = ''
+ VirtualHost to serve gitweb on. Default is catch-all.
'';
};
};
- config = mkIf config.services.nginx.gitweb.enable {
+ config = mkIf cfg.enable {
systemd.services.gitweb = {
description = "GitWeb service";
@@ -32,22 +65,22 @@ in
FCGI_SOCKET_PATH = "/run/gitweb/gitweb.sock";
};
serviceConfig = {
- User = "nginx";
- Group = "nginx";
+ User = cfg.user;
+ Group = cfg.group;
RuntimeDirectory = [ "gitweb" ];
};
wantedBy = [ "multi-user.target" ];
};
services.nginx = {
- virtualHosts.default = {
- locations."/gitweb/static/" = {
+ virtualHosts.${cfg.virtualHost} = {
+ locations."${cfg.location}/static/" = {
alias = "${package}/static/";
};
- locations."/gitweb/" = {
+ locations."${cfg.location}/" = {
extraConfig = ''
include ${pkgs.nginx}/conf/fastcgi_params;
- fastcgi_param GITWEB_CONFIG ${cfg.gitwebConfigFile};
+ fastcgi_param GITWEB_CONFIG ${gitwebConfig.gitwebConfigFile};
fastcgi_pass unix:/run/gitweb/gitweb.sock;
'';
};
diff --git a/nixos/modules/services/web-servers/unit/default.nix b/nixos/modules/services/web-servers/unit/default.nix
index 2303dfa95404cba05a8dc995f40cba951270fff1..f8a18954fc99b97952d002eb2e01e5695b7c038a 100644
--- a/nixos/modules/services/web-servers/unit/default.nix
+++ b/nixos/modules/services/web-servers/unit/default.nix
@@ -111,7 +111,7 @@ in {
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SETGID" "CAP_SETUID" ];
# Security
NoNewPrivileges = true;
- # Sanboxing
+ # Sandboxing
ProtectSystem = "full";
ProtectHome = true;
RuntimeDirectory = "unit";
@@ -130,8 +130,10 @@ in {
};
users.users = optionalAttrs (cfg.user == "unit") {
- unit.group = cfg.group;
- isSystemUser = true;
+ unit = {
+ group = cfg.group;
+ isSystemUser = true;
+ };
};
users.groups = optionalAttrs (cfg.group == "unit") {
diff --git a/nixos/modules/services/x11/desktop-managers/default.nix b/nixos/modules/services/x11/desktop-managers/default.nix
index 970fa620c6b6db32a0ac15d2fa6d307b7db5d137..ea6aac9f6c92faa36e47f618e1044c056e2bc91f 100644
--- a/nixos/modules/services/x11/desktop-managers/default.nix
+++ b/nixos/modules/services/x11/desktop-managers/default.nix
@@ -68,21 +68,15 @@ in
scripts before forwarding the value to the
displayManager.
'';
- apply = list: {
- list = map (d: d // {
- manage = "desktop";
- start = d.start
- + optionalString (needBGCond d) ''
- if [ -e $HOME/.background-image ]; then
- ${pkgs.feh}/bin/feh --bg-${cfg.wallpaper.mode} ${optionalString cfg.wallpaper.combineScreens "--no-xinerama"} $HOME/.background-image
- else
- # Use a solid black background as fallback
- ${pkgs.xorg.xsetroot}/bin/xsetroot -solid black
- fi
- '';
- }) list;
- needBGPackages = [] != filter needBGCond list;
- };
+ apply = map (d: d // {
+ manage = "desktop";
+ start = d.start
+ + optionalString (needBGCond d) ''
+ if [ -e $HOME/.background-image ]; then
+ ${pkgs.feh}/bin/feh --bg-${cfg.wallpaper.mode} ${optionalString cfg.wallpaper.combineScreens "--no-xinerama"} $HOME/.background-image
+ fi
+ '';
+ });
};
default = mkOption {
@@ -100,5 +94,5 @@ in
};
- config.services.xserver.displayManager.session = cfg.session.list;
+ config.services.xserver.displayManager.session = cfg.session;
}
diff --git a/nixos/modules/services/x11/desktop-managers/gnome3.nix b/nixos/modules/services/x11/desktop-managers/gnome3.nix
index 6d9bd284bc725e8b849752df1d1177a777e942ba..5756cf14ed948ac394b39515914900a94773a774 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@@ -144,7 +144,7 @@ in
services.gnome3.core-shell.enable = true;
services.gnome3.core-utilities.enable = mkDefault true;
- services.xserver.displayManager.sessionPackages = [ pkgs.gnome3.gnome-session ];
+ services.xserver.displayManager.sessionPackages = [ pkgs.gnome3.gnome-session.sessions ];
environment.extraInit = ''
${concatMapStrings (p: ''
@@ -249,11 +249,17 @@ in
services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
services.telepathy.enable = mkDefault true;
- systemd.packages = with pkgs.gnome3; [ vino gnome-session ];
+ systemd.packages = with pkgs.gnome3; [
+ gnome-session
+ gnome-shell
+ vino
+ ];
services.avahi.enable = mkDefault true;
- xdg.portal.extraPortals = [ pkgs.gnome3.gnome-shell ];
+ xdg.portal.extraPortals = [
+ pkgs.gnome3.gnome-shell
+ ];
services.geoclue2.enable = mkDefault true;
services.geoclue2.enableDemoAgent = false; # GNOME has its own geoclue agent
@@ -328,7 +334,6 @@ in
cheese
eog
epiphany
- geary
gedit
gnome-calculator
gnome-calendar
@@ -355,6 +360,7 @@ in
# Enable default programs
programs.evince.enable = mkDefault true;
programs.file-roller.enable = mkDefault true;
+ programs.geary.enable = mkDefault true;
programs.gnome-disks.enable = mkDefault true;
programs.gnome-terminal.enable = mkDefault true;
programs.seahorse.enable = mkDefault true;
diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix
index 2538858ac0f7621f84115ab36448b4687ba80689..bd0a2f3481fa7e6de8164f05307e49c12589501f 100644
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@@ -60,7 +60,7 @@ in
-e '/^toolBarFont=/ s/,Regular$//'
fi
- exec "${getBin plasma5.plasma-workspace}/bin/startkde"
+ exec "${getBin plasma5.plasma-workspace}/bin/startplasma-x11"
'';
};
@@ -137,6 +137,7 @@ in
libkscreen
libksysguard
milou
+ plasma-browser-integration
plasma-integration
polkit-kde-agent
systemsettings
diff --git a/nixos/modules/services/x11/display-managers/default.nix b/nixos/modules/services/x11/display-managers/default.nix
index 1efd07393765bf60940409ad8c13b884866949fd..821886e5fdaba2df47a0e0ab74b3e5dda5973d13 100644
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@@ -141,9 +141,11 @@ let
'';
dmDefault = cfg.desktopManager.default;
+ # fallback default for cases when only default wm is set
+ dmFallbackDefault = if dmDefault != null then dmDefault else "none";
wmDefault = cfg.windowManager.default;
- defaultSessionFromLegacyOptions = concatStringsSep "+" (filter (s: s != null) ([ dmDefault ] ++ optional (wmDefault != "none") wmDefault));
+ defaultSessionFromLegacyOptions = dmFallbackDefault + optionalString (wmDefault != null && wmDefault != "none") "+${wmDefault}";
in
@@ -358,7 +360,7 @@ in
{ c = wmDefault; t = "- services.xserver.windowManager.default"; }
]))}
Please use
- services.xserver.displayManager.defaultSession = "${concatStringsSep "+" (filter (s: s != null) [ dmDefault wmDefault ])}";
+ services.xserver.displayManager.defaultSession = "${defaultSessionFromLegacyOptions}";
instead.
''
];
diff --git a/nixos/modules/services/x11/display-managers/gdm.nix b/nixos/modules/services/x11/display-managers/gdm.nix
index 2f8c8cc90137f18383b76266d9b572097103cd23..325023f4121a9b5995f8897411325cef8c14e452 100644
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@@ -174,6 +174,10 @@ in
"f /run/gdm/.config/gnome-initial-setup-done 0711 gdm gdm - yes"
];
+ # Otherwise GDM will not be able to start correctly and display Wayland sessions
+ systemd.packages = with pkgs.gnome3; [ gnome-session gnome-shell ];
+ environment.systemPackages = [ pkgs.gnome3.adwaita-icon-theme ];
+
systemd.services.display-manager.wants = [
# Because sd_login_monitor_new requires /run/systemd/machines
"systemd-machined.service"
diff --git a/nixos/modules/services/x11/hardware/multitouch.nix b/nixos/modules/services/x11/hardware/multitouch.nix
deleted file mode 100644
index c03bb3b494fb55fdb4df4b2de74acb7024ecb299..0000000000000000000000000000000000000000
--- a/nixos/modules/services/x11/hardware/multitouch.nix
+++ /dev/null
@@ -1,94 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let cfg = config.services.xserver.multitouch;
- disabledTapConfig = ''
- Option "MaxTapTime" "0"
- Option "MaxTapMove" "0"
- Option "TapButton1" "0"
- Option "TapButton2" "0"
- Option "TapButton3" "0"
- '';
-in {
-
- options = {
-
- services.xserver.multitouch = {
-
- enable = mkOption {
- default = false;
- description = "Whether to enable multitouch touchpad support.";
- };
-
- invertScroll = mkOption {
- default = false;
- type = types.bool;
- description = "Whether to invert scrolling direction à la OSX Lion";
- };
-
- ignorePalm = mkOption {
- default = false;
- type = types.bool;
- description = "Whether to ignore touches detected as being the palm (i.e when typing)";
- };
-
- tapButtons = mkOption {
- type = types.bool;
- default = true;
- description = "Whether to enable tap buttons.";
- };
-
- buttonsMap = mkOption {
- type = types.listOf types.int;
- default = [3 2 0];
- example = [1 3 2];
- description = "Remap touchpad buttons.";
- apply = map toString;
- };
-
- additionalOptions = mkOption {
- type = types.str;
- default = "";
- example = ''
- Option "ScaleDistance" "50"
- Option "RotateDistance" "60"
- '';
- description = ''
- Additional options for mtrack touchpad driver.
- '';
- };
-
- };
-
- };
-
- config = mkIf cfg.enable {
-
- services.xserver.modules = [ pkgs.xf86_input_mtrack ];
-
- services.xserver.config =
- ''
- # Automatically enable the multitouch driver
- Section "InputClass"
- MatchIsTouchpad "on"
- Identifier "Touchpads"
- Driver "mtrack"
- Option "IgnorePalm" "${boolToString cfg.ignorePalm}"
- Option "ClickFinger1" "${builtins.elemAt cfg.buttonsMap 0}"
- Option "ClickFinger2" "${builtins.elemAt cfg.buttonsMap 1}"
- Option "ClickFinger3" "${builtins.elemAt cfg.buttonsMap 2}"
- ${optionalString (!cfg.tapButtons) disabledTapConfig}
- ${optionalString cfg.invertScroll ''
- Option "ScrollUpButton" "5"
- Option "ScrollDownButton" "4"
- Option "ScrollLeftButton" "7"
- Option "ScrollRightButton" "6"
- ''}
- ${cfg.additionalOptions}
- EndSection
- '';
-
- };
-
-}
diff --git a/nixos/modules/services/x11/unclutter.nix b/nixos/modules/services/x11/unclutter.nix
index 2478aaabb7998fe42c09ba44ab6de2b60092653a..c0868604a688bd8a045cc58a0a599f73200fac6e 100644
--- a/nixos/modules/services/x11/unclutter.nix
+++ b/nixos/modules/services/x11/unclutter.nix
@@ -32,7 +32,7 @@ in {
default = 1;
};
- threeshold = mkOption {
+ threshold = mkOption {
description = "Minimum number of pixels considered cursor movement";
type = types.int;
default = 1;
@@ -72,6 +72,11 @@ in {
};
};
+ imports = [
+ (mkRenamedOptionModule [ "services" "unclutter" "threeshold" ]
+ [ "services" "unclutter" "threshold" ])
+ ];
+
meta.maintainers = with lib.maintainers; [ rnhmjoj ];
}
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 7029919170aaf5ff7e80176004c7a0632459d98b..7f0de96d2084ab8138fb053ad4d9fd9feb1d41a7 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -556,8 +556,7 @@ in
services.xserver.displayManager.lightdm.enable =
let dmconf = cfg.displayManager;
- default = !( dmconf.auto.enable
- || dmconf.gdm.enable
+ default = !(dmconf.gdm.enable
|| dmconf.sddm.enable
|| dmconf.xpra.enable );
in mkIf (default) true;
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index 9a4db84f7b731ad3cbc314a876ccabb3b9b1a33e..26c1197bf975f6977f6783e3582d75cb32abd76a 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -630,7 +630,7 @@ in
boot.loader.grub.extraPrepareConfig =
concatStrings (mapAttrsToList (n: v: ''
- ${pkgs.coreutils}/bin/cp -pf "${v}" "/boot/${n}"
+ ${pkgs.coreutils}/bin/cp -pf "${v}" "@bootPath@/${n}"
'') config.boot.loader.grub.extraFiles);
assertions = [
diff --git a/nixos/modules/system/boot/loader/grub/install-grub.pl b/nixos/modules/system/boot/loader/grub/install-grub.pl
index a09c5dc4761803958f947332aa91b4276786ba1d..ca0fb0248e0e9fc956f315a55eed92b2771c8978 100644
--- a/nixos/modules/system/boot/loader/grub/install-grub.pl
+++ b/nixos/modules/system/boot/loader/grub/install-grub.pl
@@ -475,6 +475,9 @@ if ($grubVersion == 2) {
}
}
+# extraPrepareConfig could refer to @bootPath@, which we have to substitute
+$extraPrepareConfig =~ s/\@bootPath\@/$bootPath/g;
+
# Run extraPrepareConfig in sh
if ($extraPrepareConfig ne "") {
system((get("shell"), "-c", $extraPrepareConfig));
diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 0bb8396a44fc813a58553af1d3a6ed4da5a2a8ff..31f1e22cda32c1083212d547eeb0d21b45f0582b 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -4,6 +4,7 @@ with lib;
let
luks = config.boot.initrd.luks;
+ kernelPackages = config.boot.kernelPackages;
commonFunctions = ''
die() {
@@ -139,7 +140,7 @@ let
umount /crypt-ramfs 2>/dev/null
'';
- openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, gpgCard, fallbackToPassword, ... }: assert name' == name;
+ openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, gpgCard, fido2, fallbackToPassword, ... }: assert name' == name;
let
csopen = "cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} ${optionalString (header != null) "--header=${header}"}";
cschange = "cryptsetup luksChangeKey ${device} ${optionalString (header != null) "--header=${header}"}";
@@ -387,7 +388,31 @@ let
}
''}
- ${if (luks.yubikeySupport && (yubikey != null)) || (luks.gpgSupport && (gpgCard != null)) then ''
+ ${optionalString (luks.fido2Support && (fido2.credential != null)) ''
+
+ open_with_hardware() {
+ local passsphrase
+
+ ${if fido2.passwordLess then ''
+ export passphrase=""
+ '' else ''
+ read -rsp "FIDO2 salt for ${device}: " passphrase
+ echo
+ ''}
+ ${optionalString (lib.versionOlder kernelPackages.kernel.version "5.4") ''
+ echo "On systems with Linux Kernel < 5.4, it might take a while to initialize the CRNG, you might want to use linuxPackages_latest."
+ echo "Please move your mouse to create needed randomness."
+ ''}
+ echo "Waiting for your FIDO2 device..."
+ fido2luks -i open ${device} ${name} ${fido2.credential} --await-dev ${toString fido2.gracePeriod} --salt string:$passphrase
+ if [ $? -ne 0 ]; then
+ echo "No FIDO2 key found, falling back to normal open procedure"
+ open_normally
+ fi
+ }
+ ''}
+
+ ${if (luks.yubikeySupport && (yubikey != null)) || (luks.gpgSupport && (gpgCard != null)) || (luks.fido2Support && (fido2.credential != null)) then ''
open_with_hardware
'' else ''
open_normally
@@ -608,6 +633,31 @@ in
});
};
+ fido2 = {
+ credential = mkOption {
+ default = null;
+ example = "f1d00200d8dc783f7fb1e10ace8da27f8312d72692abfca2f7e4960a73f48e82e1f7571f6ebfcee9fb434f9886ccc8fcc52a6614d8d2";
+ type = types.str;
+ description = "The FIDO2 credential ID.";
+ };
+
+ gracePeriod = mkOption {
+ default = 10;
+ type = types.int;
+ description = "Time in seconds to wait for the FIDO2 key.";
+ };
+
+ passwordLess = mkOption {
+ default = false;
+ type = types.bool;
+ description = ''
+ Defines whatever to use an empty string as a default salt.
+
+ Enable only when your device is PIN protected, such as Trezor.
+ '';
+ };
+ };
+
yubikey = mkOption {
default = null;
description = ''
@@ -706,6 +756,15 @@ in
and a Yubikey to work with this feature.
'';
};
+
+ boot.initrd.luks.fido2Support = mkOption {
+ default = false;
+ type = types.bool;
+ description = ''
+ Enables support for authenticating with FIDO2 devices.
+ '';
+ };
+
};
config = mkIf (luks.devices != {} || luks.forceLuksSupportInInitrd) {
@@ -714,6 +773,14 @@ in
[ { assertion = !(luks.gpgSupport && luks.yubikeySupport);
message = "Yubikey and GPG Card may not be used at the same time.";
}
+
+ { assertion = !(luks.gpgSupport && luks.fido2Support);
+ message = "FIDO2 and GPG Card may not be used at the same time.";
+ }
+
+ { assertion = !(luks.fido2Support && luks.yubikeySupport);
+ message = "FIDO2 and Yubikey may not be used at the same time.";
+ }
];
# actually, sbp2 driver is the one enabling the DMA attack, but this needs to be tested
@@ -753,6 +820,11 @@ in
chmod +x $out/bin/openssl-wrap
''}
+ ${optionalString luks.fido2Support ''
+ copy_bin_and_libs ${pkgs.fido2luks}/bin/fido2luks
+ ''}
+
+
${optionalString luks.gpgSupport ''
copy_bin_and_libs ${pkgs.gnupg}/bin/gpg
copy_bin_and_libs ${pkgs.gnupg}/bin/gpg-agent
@@ -783,6 +855,9 @@ in
$out/bin/gpg-agent --version
$out/bin/scdaemon --version
''}
+ ${optionalString luks.fido2Support ''
+ $out/bin/fido2luks --version
+ ''}
'';
boot.initrd.preFailCommands = postCommands;
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index 3e289a63139f77650df2abec6fe2a8e8cf93b3a4..a77dbc609f4624ca5d945dd260f8219f2862e732 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -49,12 +49,17 @@ let
(assertValueOneOf "Kind" [
"bond" "bridge" "dummy" "gre" "gretap" "ip6gre" "ip6tnl" "ip6gretap" "ipip"
"ipvlan" "macvlan" "macvtap" "sit" "tap" "tun" "veth" "vlan" "vti" "vti6"
- "vxlan" "geneve" "vrf" "vcan" "vxcan" "wireguard" "netdevsim"
+ "vxlan" "geneve" "vrf" "vcan" "vxcan" "wireguard" "netdevsim" "xfrm"
])
(assertByteFormat "MTUBytes")
(assertMacAddress "MACAddress")
];
+ checkVRF = checkUnitConfig "VRF" [
+ (assertOnlyFields [ "Table" ])
+ (assertMinimum "Table" 0)
+ ];
+
# NOTE The PrivateKey directive is missing on purpose here, please
# do not add it to this list. The nix store is world-readable let's
# refrain ourselves from providing a footgun.
@@ -172,6 +177,14 @@ let
(assertValueOneOf "AllSlavesActive" boolValues)
];
+ checkXfrm = checkUnitConfig "Xfrm" [
+ (assertOnlyFields [
+ "InterfaceId" "Independent"
+ ])
+ (assertRange "InterfaceId" 1 4294967295)
+ (assertValueOneOf "Independent" boolValues)
+ ];
+
checkNetwork = checkUnitConfig "Network" [
(assertOnlyFields [
"Description" "DHCP" "DHCPServer" "LinkLocalAddressing" "IPv4LLRoute"
@@ -182,7 +195,7 @@ let
"IPv6HopLimit" "IPv4ProxyARP" "IPv6ProxyNDP" "IPv6ProxyNDPAddress"
"IPv6PrefixDelegation" "IPv6MTUBytes" "Bridge" "Bond" "VRF" "VLAN"
"IPVLAN" "MACVLAN" "VXLAN" "Tunnel" "ActiveSlave" "PrimarySlave"
- "ConfigureWithoutCarrier"
+ "ConfigureWithoutCarrier" "Xfrm"
])
# Note: For DHCP the values both, none, v4, v6 are deprecated
(assertValueOneOf "DHCP" ["yes" "no" "ipv4" "ipv6" "both" "none" "v4" "v6"])
@@ -341,6 +354,21 @@ let
'';
};
+ vrfConfig = mkOption {
+ default = {};
+ example = { Table = 2342; };
+ type = types.addCheck (types.attrsOf unitOption) checkVRF;
+ description = ''
+ Each attribute in this set specifies an option in the
+ [VRF] section of the unit. See
+ systemd.netdev
+ 5 for details.
+ A detailed explanation about how VRFs work can be found in the
+ kernel
+ docs.
+ '';
+ };
+
wireguardConfig = mkOption {
default = {};
example = {
@@ -477,6 +505,18 @@ let
'';
};
+ xfrmConfig = mkOption {
+ default = {};
+ example = { InterfaceId = 1; };
+ type = types.addCheck (types.attrsOf unitOption) checkXfrm;
+ description = ''
+ Each attribute in this set specifies an option in the
+ [Xfrm] section of the unit. See
+ systemd.netdev
+ 5 for details.
+ '';
+ };
+
};
addressOptions = {
@@ -712,6 +752,16 @@ let
'';
};
+ xfrm = mkOption {
+ default = [ ];
+ type = types.listOf types.str;
+ description = ''
+ A list of xfrm interfaces to be added to the network section of the
+ unit. See systemd.network
+ 5 for details.
+ '';
+ };
+
addresses = mkOption {
default = [ ];
type = with types; listOf (submodule addressOptions);
@@ -809,6 +859,16 @@ let
[Bond]
${attrsToSection def.bondConfig}
+ ''}
+ ${optionalString (def.xfrmConfig != { }) ''
+ [Xfrm]
+ ${attrsToSection def.xfrmConfig}
+
+ ''}
+ ${optionalString (def.vrfConfig != { }) ''
+ [VRF]
+ ${attrsToSection def.vrfConfig}
+
''}
${optionalString (def.wireguardConfig != { }) ''
[WireGuard]
@@ -847,6 +907,7 @@ let
${concatStringsSep "\n" (map (s: "MACVLAN=${s}") def.macvlan)}
${concatStringsSep "\n" (map (s: "VXLAN=${s}") def.vxlan)}
${concatStringsSep "\n" (map (s: "Tunnel=${s}") def.tunnel)}
+ ${concatStringsSep "\n" (map (s: "Xfrm=${s}") def.xfrm)}
${optionalString (def.dhcpConfig != { }) ''
[DHCP]
@@ -911,9 +972,10 @@ in
systemd.network.units = mkOption {
description = "Definition of networkd units.";
default = {};
+ internal = true;
type = with types; attrsOf (submodule (
{ name, config, ... }:
- { options = concreteUnitOptions;
+ { options = mapAttrs (_: x: x // { internal = true; }) concreteUnitOptions;
config = {
unit = mkDefault (makeUnit name config);
};
diff --git a/nixos/modules/system/boot/stage-1-init.sh b/nixos/modules/system/boot/stage-1-init.sh
index f520bf54ad1bd743c38bdb7b6ce3e89874b0634d..8736613c3d256f7f4389f740f5937d3b00c1de09 100644
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@@ -334,8 +334,10 @@ mountFS() {
# Filter out x- options, which busybox doesn't do yet.
local optionsFiltered="$(IFS=,; for i in $options; do if [ "${i:0:2}" != "x-" ]; then echo -n $i,; fi; done)"
+ # Prefix (lower|upper|work)dir with /mnt-root (overlayfs)
+ local optionsPrefixed="$( echo "$optionsFiltered" | sed -E 's#\<(lowerdir|upperdir|workdir)=#\1=/mnt-root#g' )"
- echo "$device /mnt-root$mountPoint $fsType $optionsFiltered" >> /etc/fstab
+ echo "$device /mnt-root$mountPoint $fsType $optionsPrefixed" >> /etc/fstab
checkFS "$device" "$fsType"
@@ -354,10 +356,11 @@ mountFS() {
;;
esac
- # Create backing directories for unionfs-fuse.
- if [ "$fsType" = unionfs-fuse ]; then
- for i in $(IFS=:; echo ${options##*,dirs=}); do
- mkdir -m 0700 -p /mnt-root"${i%=*}"
+ # Create backing directories for overlayfs
+ if [ "$fsType" = overlay ]; then
+ for i in upper work; do
+ dir="$( echo "$optionsPrefixed" | grep -o "${i}dir=[^,]*" )"
+ mkdir -m 0700 -p "${dir##*=}"
done
fi
diff --git a/nixos/modules/system/boot/systemd-lib.nix b/nixos/modules/system/boot/systemd-lib.nix
index 28ad4f121bbee3515d0b216e27ca356ee21a7447..fd1a5b9f62c501912f223ad694b8fa9527e4980d 100644
--- a/nixos/modules/system/boot/systemd-lib.nix
+++ b/nixos/modules/system/boot/systemd-lib.nix
@@ -147,7 +147,13 @@ in rec {
done
# Symlink all units provided listed in systemd.packages.
- for i in ${toString cfg.packages}; do
+ packages="${toString cfg.packages}"
+
+ # Filter duplicate directories
+ declare -A unique_packages
+ for k in $packages ; do unique_packages[$k]=1 ; done
+
+ for i in ''${!unique_packages[@]}; do
for fn in $i/etc/systemd/${type}/* $i/lib/systemd/${type}/*; do
if ! [[ "$fn" =~ .wants$ ]]; then
if [[ -d "$fn" ]]; then
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index c438bb216e705ab73978c574639d8dad079a3eb6..cdc9d23793923490095a23a78e461e46fc47e589 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -697,6 +697,16 @@ in
'';
};
+ systemd.sleep.extraConfig = mkOption {
+ default = "";
+ type = types.lines;
+ example = "HibernateDelaySec=1h";
+ description = ''
+ Extra config options for systemd sleep state logic.
+ See sleep.conf.d(5) man page for available options.
+ '';
+ };
+
systemd.user.extraConfig = mkOption {
default = "";
type = types.lines;
@@ -776,6 +786,18 @@ in
'';
};
+ systemd.suppressedSystemUnits = mkOption {
+ default = [ ];
+ type = types.listOf types.str;
+ example = [ "systemd-backlight@.service" ];
+ description = ''
+ A list of units to suppress when generating system systemd configuration directory. This has
+ priority over upstream units, , and
+ . The main purpose of this is to
+ suppress a upstream systemd unit with any modifications made to it by other NixOS modules.
+ '';
+ };
+
};
@@ -808,8 +830,11 @@ in
done
${concatStrings (mapAttrsToList (exec: target: "ln -s ${target} $out/${exec};\n") links)}
'';
+
+ enabledUpstreamSystemUnits = filter (n: ! elem n cfg.suppressedSystemUnits) upstreamSystemUnits;
+ enabledUnits = filterAttrs (n: v: ! elem n cfg.suppressedSystemUnits) cfg.units;
in ({
- "systemd/system".source = generateUnits "system" cfg.units upstreamSystemUnits upstreamSystemWants;
+ "systemd/system".source = generateUnits "system" enabledUnits enabledUpstreamSystemUnits upstreamSystemWants;
"systemd/user".source = generateUnits "user" cfg.user.units upstreamUserUnits [];
@@ -863,17 +888,22 @@ in
"systemd/sleep.conf".text = ''
[Sleep]
+ ${config.systemd.sleep.extraConfig}
'';
# install provided sysctl snippets
"sysctl.d/50-coredump.conf".source = "${systemd}/example/sysctl.d/50-coredump.conf";
"sysctl.d/50-default.conf".source = "${systemd}/example/sysctl.d/50-default.conf";
+ "tmpfiles.d/home.conf".source = "${systemd}/example/tmpfiles.d/home.conf";
"tmpfiles.d/journal-nocow.conf".source = "${systemd}/example/tmpfiles.d/journal-nocow.conf";
+ "tmpfiles.d/portables.conf".source = "${systemd}/example/tmpfiles.d/portables.conf";
"tmpfiles.d/static-nodes-permissions.conf".source = "${systemd}/example/tmpfiles.d/static-nodes-permissions.conf";
"tmpfiles.d/systemd.conf".source = "${systemd}/example/tmpfiles.d/systemd.conf";
+ "tmpfiles.d/systemd-nologin.conf".source = "${systemd}/example/tmpfiles.d/systemd-nologin.conf";
"tmpfiles.d/systemd-nspawn.conf".source = "${systemd}/example/tmpfiles.d/systemd-nspawn.conf";
"tmpfiles.d/systemd-tmp.conf".source = "${systemd}/example/tmpfiles.d/systemd-tmp.conf";
+ "tmpfiles.d/tmp.conf".source = "${systemd}/example/tmpfiles.d/tmp.conf";
"tmpfiles.d/var.conf".source = "${systemd}/example/tmpfiles.d/var.conf";
"tmpfiles.d/x11.conf".source = "${systemd}/example/tmpfiles.d/x11.conf";
diff --git a/nixos/modules/tasks/filesystems.nix b/nixos/modules/tasks/filesystems.nix
index 688c77cb22d15845edc1de654ef625a0d9f939d4..965a1c9eb1a6479278f2ce04369b376817dbfeb7 100644
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@@ -304,6 +304,10 @@ in
in listToAttrs (map formatDevice (filter (fs: fs.autoFormat) fileSystems));
+ systemd.tmpfiles.rules = [
+ "Z /run/keys 0750 root ${toString config.ids.gids.keys}"
+ ];
+
# Sync mount options with systemd's src/core/mount-setup.c: mount_table.
boot.specialFileSystems = {
"/proc" = { fsType = "proc"; options = [ "nosuid" "noexec" "nodev" ]; };
@@ -312,8 +316,8 @@ in
"/dev/shm" = { fsType = "tmpfs"; options = [ "nosuid" "nodev" "strictatime" "mode=1777" "size=${config.boot.devShmSize}" ]; };
"/dev/pts" = { fsType = "devpts"; options = [ "nosuid" "noexec" "mode=620" "ptmxmode=0666" "gid=${toString config.ids.gids.tty}" ]; };
- # To hold secrets that shouldn't be written to disk (generally used for NixOps, harmless elsewhere)
- "/run/keys" = { fsType = "ramfs"; options = [ "nosuid" "nodev" "mode=750" "gid=${toString config.ids.gids.keys}" ]; };
+ # To hold secrets that shouldn't be written to disk
+ "/run/keys" = { fsType = "ramfs"; options = [ "nosuid" "nodev" "mode=750" ]; };
} // optionalAttrs (!config.boot.isContainer) {
# systemd-nspawn populates /sys by itself, and remounting it causes all
# kinds of weird issues (most noticeably, waiting for host disk device
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 31e2ed1cd1eaed569b76a73c97e94af92ce4b028..cef9c38c2e30476279a479307a23016e69634913 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -143,13 +143,34 @@ let
description = "Name of the interface.";
};
- preferTempAddress = mkOption {
- type = types.bool;
- default = cfg.enableIPv6;
- defaultText = literalExample "config.networking.enableIPv6";
+ tempAddress = mkOption {
+ type = types.enum [ "default" "enabled" "disabled" ];
+ default = if cfg.enableIPv6 then "default" else "disabled";
+ defaultText = literalExample ''if cfg.enableIPv6 then "default" else "disabled"'';
description = ''
- When using SLAAC prefer a temporary (IPv6) address over the EUI-64
- address for originating connections. This is used to reduce tracking.
+ When IPv6 is enabled with SLAAC, this option controls the use of
+ temporary address (aka privacy extensions). This is used to reduce tracking.
+ The three possible values are:
+
+
+
+
+ "default" to generate temporary addresses and use
+ them by default;
+
+
+
+
+ "enabled" to generate temporary addresses but keep
+ using the standard EUI-64 ones by default;
+
+
+
+
+ "disabled" to completely disable temporary addresses.
+
+
+
'';
};
@@ -287,6 +308,11 @@ let
let
defined = x: x != "_mkMergedOptionModule";
in [
+ (mkChangedOptionModule [ "preferTempAddress" ] [ "tempAddress" ]
+ (config:
+ let bool = getAttrFromPath [ "preferTempAddress" ] config;
+ in if bool then "default" else "enabled"
+ ))
(mkRenamedOptionModule [ "ip4" ] [ "ipv4" "addresses"])
(mkRenamedOptionModule [ "ip6" ] [ "ipv6" "addresses"])
(mkRemovedOptionModule [ "subnetMask" ] ''
@@ -945,7 +971,7 @@ in
The networking.interfaces."${i.name}" must not have any defined ips when it is a slave.
'';
})) ++ (forEach interfaces (i: {
- assertion = i.preferTempAddress -> cfg.enableIPv6;
+ assertion = i.tempAddress != "disabled" -> cfg.enableIPv6;
message = ''
Temporary addresses are only needed when IPv6 is enabled.
'';
@@ -973,8 +999,11 @@ in
"net.ipv6.conf.all.forwarding" = mkDefault (any (i: i.proxyARP) interfaces);
} // listToAttrs (flip concatMap (filter (i: i.proxyARP) interfaces)
(i: forEach [ "4" "6" ] (v: nameValuePair "net.ipv${v}.conf.${replaceChars ["."] ["/"] i.name}.proxy_arp" true)))
- // listToAttrs (forEach (filter (i: i.preferTempAddress) interfaces)
- (i: nameValuePair "net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr" 2));
+ // listToAttrs (forEach interfaces
+ (i: let
+ opt = i.tempAddress;
+ val = { disabled = 0; enabled = 1; default = 2; }.${opt};
+ in nameValuePair "net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr" val));
# Capabilities won't work unless we have at-least a 4.3 Linux
# kernel because we need the ambient capability
@@ -1103,10 +1132,18 @@ in
(pkgs.writeTextFile rec {
name = "ipv6-privacy-extensions.rules";
destination = "/etc/udev/rules.d/99-${name}";
- text = concatMapStrings (i: ''
- # enable IPv6 privacy addresses but prefer EUI-64 addresses for ${i.name}
- ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr=1"
- '') (filter (i: !i.preferTempAddress) interfaces);
+ text = concatMapStrings (i:
+ let
+ opt = i.tempAddress;
+ val = if opt == "disabled" then 0 else 1;
+ msg = if opt == "disabled"
+ then "completely disable IPv6 privacy addresses"
+ else "enable IPv6 privacy addresses but prefer EUI-64 addresses";
+ in
+ ''
+ # override to ${msg} for ${i.name}
+ ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr=${toString val}"
+ '') (filter (i: i.tempAddress != "default") interfaces);
})
] ++ lib.optional (cfg.wlanInterfaces != {})
(pkgs.writeTextFile {
diff --git a/nixos/modules/virtualisation/amazon-init.nix b/nixos/modules/virtualisation/amazon-init.nix
index 8032b2c6d7ca4cee85a47018d13078cb84ab8b3b..8c12e0e49bf5b6b5bd6a5c825df5965978cda228 100644
--- a/nixos/modules/virtualisation/amazon-init.nix
+++ b/nixos/modules/virtualisation/amazon-init.nix
@@ -7,8 +7,8 @@ let
echo "attempting to fetch configuration from EC2 user data..."
export HOME=/root
- export PATH=${pkgs.lib.makeBinPath [ config.nix.package pkgs.systemd pkgs.gnugrep pkgs.gnused config.system.build.nixos-rebuild]}:$PATH
- export NIX_PATH=/nix/var/nix/profiles/per-user/root/channels/nixos:nixos-config=/etc/nixos/configuration.nix:/nix/var/nix/profiles/per-user/root/channels
+ export PATH=${pkgs.lib.makeBinPath [ config.nix.package pkgs.systemd pkgs.gnugrep pkgs.git pkgs.gnutar pkgs.gzip pkgs.gnused config.system.build.nixos-rebuild]}:$PATH
+ export NIX_PATH=nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos:nixos-config=/etc/nixos/configuration.nix:/nix/var/nix/profiles/per-user/root/channels
userData=/etc/ec2-metadata/user-data
@@ -18,9 +18,9 @@ let
# that as the channel.
if sed '/^\(#\|SSH_HOST_.*\)/d' < "$userData" | grep -q '\S'; then
channels="$(grep '^###' "$userData" | sed 's|###\s*||')"
- printf "%s" "$channels" | while read channel; do
+ while IFS= read -r channel; do
echo "writing channel: $channel"
- done
+ done < <(printf "%s\n" "$channels")
if [[ -n "$channels" ]]; then
printf "%s" "$channels" > /root/.nix-channels
@@ -48,7 +48,7 @@ in {
wantedBy = [ "multi-user.target" ];
after = [ "multi-user.target" ];
requires = [ "network-online.target" ];
-
+
restartIfChanged = false;
unitConfig.X-StopOnRemoval = false;
@@ -58,4 +58,3 @@ in {
};
};
}
-
diff --git a/nixos/modules/virtualisation/docker-containers.nix b/nixos/modules/virtualisation/docker-containers.nix
index 760cb9122a2f515e7ed57f2195f2b7fa57869edf..216ba2c733fcdb6cd70157fc3a48a548cd343ddb 100644
--- a/nixos/modules/virtualisation/docker-containers.nix
+++ b/nixos/modules/virtualisation/docker-containers.nix
@@ -10,11 +10,24 @@ let
options = {
image = mkOption {
- type = types.str;
+ type = with types; str;
description = "Docker image to run.";
example = "library/hello-world";
};
+ imageFile = mkOption {
+ type = with types; nullOr package;
+ default = null;
+ description = ''
+ Path to an image file to load instead of pulling from a registry.
+ If defined, do not pull from registry.
+
+ You still need to set the image attribute, as it
+ will be used as the image name for docker to start a container.
+ '';
+ example = literalExample "pkgs.dockerTools.buildDockerImage {...};";
+ };
+
cmd = mkOption {
type = with types; listOf str;
default = [];
@@ -26,7 +39,7 @@ let
entrypoint = mkOption {
type = with types; nullOr str;
- description = "Overwrite the default entrypoint of the image.";
+ description = "Override the default entrypoint of the image.";
default = null;
example = "/bin/my-app";
};
@@ -132,7 +145,7 @@ let
Note that this is a list of "src:dst" strings to
allow for src to refer to
- /nix/store paths, which would difficult with an
+ /nix/store paths, which would be difficult with an
attribute set. There are also a variety of mount options available
as a third field; please refer to the
@@ -153,6 +166,24 @@ let
example = "/var/lib/hello_world";
};
+ dependsOn = mkOption {
+ type = with types; listOf str;
+ default = [];
+ description = ''
+ Define which other containers this one depends on. They will be added to both After and Requires for the unit.
+
+ Use the same name as the attribute under services.docker-containers.
+ '';
+ example = literalExample ''
+ services.docker-containers = {
+ node1 = {};
+ node2 = {
+ dependsOn = [ "node1" ];
+ }
+ }
+ '';
+ };
+
extraDockerOptions = mkOption {
type = with types; listOf str;
default = [];
@@ -164,15 +195,18 @@ let
};
};
- mkService = name: container: {
+ mkService = name: container: let
+ mkAfter = map (x: "docker-${x}.service") container.dependsOn;
+ in rec {
wantedBy = [ "multi-user.target" ];
- after = [ "docker.service" "docker.socket" ];
- requires = [ "docker.service" "docker.socket" ];
+ after = [ "docker.service" "docker.socket" ] ++ mkAfter;
+ requires = after;
+
serviceConfig = {
ExecStart = concatStringsSep " \\\n " ([
"${pkgs.docker}/bin/docker run"
"--rm"
- "--name=%n"
+ "--name=${name}"
"--log-driver=${container.log-driver}"
] ++ optional (container.entrypoint != null)
"--entrypoint=${escapeShellArg container.entrypoint}"
@@ -185,9 +219,13 @@ let
++ [container.image]
++ map escapeShellArg container.cmd
);
- ExecStartPre = "-${pkgs.docker}/bin/docker rm -f %n";
- ExecStop = ''${pkgs.bash}/bin/sh -c "[ $SERVICE_RESULT = success ] || ${pkgs.docker}/bin/docker stop %n"'';
- ExecStopPost = "-${pkgs.docker}/bin/docker rm -f %n";
+
+ ExecStartPre =
+ ["-${pkgs.docker}/bin/docker rm -f ${name}"] ++
+ (optional (container.imageFile != null) "${pkgs.docker}/bin/docker load -i ${container.imageFile}");
+
+ ExecStop = ''${pkgs.bash}/bin/sh -c "[ $SERVICE_RESULT = success ] || ${pkgs.docker}/bin/docker stop ${name}"'';
+ ExecStopPost = "-${pkgs.docker}/bin/docker rm -f ${name}";
### There is no generalized way of supporting `reload` for docker
### containers. Some containers may respond well to SIGHUP sent to their
diff --git a/nixos/modules/virtualisation/lxd.nix b/nixos/modules/virtualisation/lxd.nix
index b4934a86cf56ce2e9aae7d2d42cdf42e59dc2988..de48d3a780e270b25eafcf9d9bd1432ef84e6254 100644
--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@@ -7,6 +7,7 @@ with lib;
let
cfg = config.virtualisation.lxd;
+ zfsCfg = config.boot.zfs;
in
@@ -26,11 +27,40 @@ in
lxc command line tool, among others.
'';
};
+
+ package = mkOption {
+ type = types.package;
+ default = pkgs.lxd;
+ defaultText = "pkgs.lxd";
+ description = ''
+ The LXD package to use.
+ '';
+ };
+
+ lxcPackage = mkOption {
+ type = types.package;
+ default = pkgs.lxc;
+ defaultText = "pkgs.lxc";
+ description = ''
+ The LXC package to use with LXD (required for AppArmor profiles).
+ '';
+ };
+
+ zfsPackage = mkOption {
+ type = types.package;
+ default = with pkgs; if zfsCfg.enableUnstable then zfsUnstable else zfs;
+ defaultText = "pkgs.zfs";
+ description = ''
+ The ZFS package to use with LXD.
+ '';
+ };
+
zfsSupport = mkOption {
type = types.bool;
default = false;
description = ''
- enables lxd to use zfs as a storage for containers.
+ Enables lxd to use zfs as a storage for containers.
+
This option is enabled by default if a zfs pool is configured
with nixos.
'';
@@ -54,15 +84,15 @@ in
config = mkIf cfg.enable {
- environment.systemPackages = [ pkgs.lxd ];
+ environment.systemPackages = [ cfg.package ];
security.apparmor = {
enable = true;
profiles = [
- "${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start"
- "${pkgs.lxc}/etc/apparmor.d/lxc-containers"
+ "${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start"
+ "${cfg.lxcPackage}/etc/apparmor.d/lxc-containers"
];
- packages = [ pkgs.lxc ];
+ packages = [ cfg.lxcPackage ];
};
systemd.services.lxd = {
@@ -71,14 +101,14 @@ in
wantedBy = [ "multi-user.target" ];
after = [ "systemd-udev-settle.service" ];
- path = lib.optional cfg.zfsSupport pkgs.zfs;
+ path = lib.optional cfg.zfsSupport cfg.zfsPackage;
preStart = ''
mkdir -m 0755 -p /var/lib/lxc/rootfs
'';
serviceConfig = {
- ExecStart = "@${pkgs.lxd.bin}/bin/lxd lxd --group lxd";
+ ExecStart = "@${cfg.package.bin}/bin/lxd lxd --group lxd";
Type = "simple";
KillMode = "process"; # when stopping, leave the containers alone
LimitMEMLOCK = "infinity";
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index ca9c6f9a7f911e1cdb9591d5a7719ac875c247ca..b46731863cab7a1c1a227b669d21d88c8e3d5804 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -54,7 +54,7 @@ in rec {
(all nixos.dummy)
(all nixos.manual)
- nixos.iso_graphical.x86_64-linux or []
+ nixos.iso_plasma5.x86_64-linux or []
nixos.iso_minimal.aarch64-linux or []
nixos.iso_minimal.i686-linux or []
nixos.iso_minimal.x86_64-linux or []
diff --git a/nixos/release.nix b/nixos/release.nix
index f40b5fa9bd7f70aacc7848341547059eedcafb8c..512ba7143977ac272ab8166cf15d72cbcedd8063 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -149,9 +149,9 @@ in rec {
inherit system;
});
- iso_graphical = forMatchingSystems [ "x86_64-linux" ] (system: makeIso {
- module = ./modules/installer/cd-dvd/installation-cd-graphical-kde.nix;
- type = "graphical";
+ iso_plasma5 = forMatchingSystems [ "x86_64-linux" ] (system: makeIso {
+ module = ./modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix;
+ type = "plasma5";
inherit system;
});
@@ -209,7 +209,8 @@ in rec {
hydraJob ((import lib/eval-config.nix {
inherit system;
modules =
- [ versionModule
+ [ configuration
+ versionModule
./maintainers/scripts/ec2/amazon-image.nix
];
}).config.system.build.amazonImage)
diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index 617dafee0dce7c5c55597eb9f0c2153d128e4d1a..732f41a4905d344e93e18011ddb3c89f154461b6 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -29,7 +29,6 @@ in import ./make-test-python.nix {
systemd.services.pebble-challtestsrv = {
enable = true;
description = "Pebble ACME challenge test server";
- requires = [ ];
wantedBy = [ "network.target" ];
serviceConfig = {
ExecStart = "${pkgs.pebble}/bin/pebble-challtestsrv -dns01 ':53' -defaultIPv6 '' -defaultIPv4 '${nodes.webserver.config.networking.primaryIPAddress}'";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index fe9c4df1416fec6fc99cb23d6a6bb6e01891b2d2..bdac56169fdf469080840e6be8fcfcf769701294 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -32,7 +32,7 @@ in
bees = handleTest ./bees.nix {};
bind = handleTest ./bind.nix {};
bittorrent = handleTest ./bittorrent.nix {};
- #blivet = handleTest ./blivet.nix {}; # broken since 2017-07024
+ buildkite-agent = handleTest ./buildkite-agent.nix {};
boot = handleTestOn ["x86_64-linux"] ./boot.nix {}; # syslinux is unsupported on aarch64
boot-stage1 = handleTest ./boot-stage1.nix {};
borgbackup = handleTest ./borgbackup.nix {};
@@ -61,10 +61,11 @@ in
containers-portforward = handleTest ./containers-portforward.nix {};
containers-restart_networking = handleTest ./containers-restart_networking.nix {};
containers-tmpfs = handleTest ./containers-tmpfs.nix {};
+ corerad = handleTest ./corerad.nix {};
couchdb = handleTest ./couchdb.nix {};
deluge = handleTest ./deluge.nix {};
dhparams = handleTest ./dhparams.nix {};
- dnscrypt-proxy = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy.nix {};
+ dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
docker = handleTestOn ["x86_64-linux"] ./docker.nix {};
docker-containers = handleTestOn ["x86_64-linux"] ./docker-containers.nix {};
docker-edge = handleTestOn ["x86_64-linux"] ./docker-edge.nix {};
@@ -73,6 +74,7 @@ in
docker-tools = handleTestOn ["x86_64-linux"] ./docker-tools.nix {};
docker-tools-overlay = handleTestOn ["x86_64-linux"] ./docker-tools-overlay.nix {};
documize = handleTest ./documize.nix {};
+ dokuwiki = handleTest ./dokuwiki.nix {};
dovecot = handleTest ./dovecot.nix {};
# ec2-config doesn't work in a sandbox as the simulated ec2 instance needs network access
#ec2-config = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-config or {};
@@ -91,6 +93,7 @@ in
flannel = handleTestOn ["x86_64-linux"] ./flannel.nix {};
fluentd = handleTest ./fluentd.nix {};
fontconfig-default-fonts = handleTest ./fontconfig-default-fonts.nix {};
+ freeswitch = handleTest ./freeswitch.nix {};
fsck = handleTest ./fsck.nix {};
gotify-server = handleTest ./gotify-server.nix {};
gitea = handleTest ./gitea.nix {};
@@ -210,8 +213,7 @@ in
openldap = handleTest ./openldap.nix {};
opensmtpd = handleTest ./opensmtpd.nix {};
openssh = handleTest ./openssh.nix {};
- # openstack-image-userdata doesn't work in a sandbox as the simulated openstack instance needs network access
- #openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
+ openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
openstack-image-metadata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).metadata or {};
orangefs = handleTest ./orangefs.nix {};
os-prober = handleTestOn ["x86_64-linux"] ./os-prober.nix {};
@@ -246,6 +248,7 @@ in
radicale = handleTest ./radicale.nix {};
redis = handleTest ./redis.nix {};
redmine = handleTest ./redmine.nix {};
+ restic = handleTest ./restic.nix {};
roundcube = handleTest ./roundcube.nix {};
rspamd = handleTest ./rspamd.nix {};
rss2email = handleTest ./rss2email.nix {};
@@ -272,6 +275,7 @@ in
systemd-analyze = handleTest ./systemd-analyze.nix {};
systemd-confinement = handleTest ./systemd-confinement.nix {};
systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
+ systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
systemd-nspawn = handleTest ./systemd-nspawn.nix {};
pdns-recursor = handleTest ./pdns-recursor.nix {};
@@ -290,11 +294,13 @@ in
upnp = handleTest ./upnp.nix {};
uwsgi = handleTest ./uwsgi.nix {};
vault = handleTest ./vault.nix {};
+ victoriametrics = handleTest ./victoriametrics.nix {};
virtualbox = handleTestOn ["x86_64-linux"] ./virtualbox.nix {};
wireguard = handleTest ./wireguard {};
wireguard-generated = handleTest ./wireguard/generated.nix {};
wireguard-namespaces = handleTest ./wireguard/namespaces.nix {};
wordpress = handleTest ./wordpress.nix {};
+ xandikos = handleTest ./xandikos.nix {};
xautolock = handleTest ./xautolock.nix {};
xfce = handleTest ./xfce.nix {};
xmonad = handleTest ./xmonad.nix {};
@@ -302,6 +308,7 @@ in
xss-lock = handleTest ./xss-lock.nix {};
yabar = handleTest ./yabar.nix {};
yggdrasil = handleTest ./yggdrasil.nix {};
+ zfs = handleTest ./zfs.nix {};
zsh-history = handleTest ./zsh-history.nix {};
zookeeper = handleTest ./zookeeper.nix {};
}
diff --git a/nixos/tests/bittorrent.nix b/nixos/tests/bittorrent.nix
index e5be652c711248378342be5806155acc79658408..0a97d5556a2692395175c45eb8e982fc757ce75a 100644
--- a/nixos/tests/bittorrent.nix
+++ b/nixos/tests/bittorrent.nix
@@ -18,6 +18,17 @@ let
externalRouterAddress = "80.100.100.1";
externalClient2Address = "80.100.100.2";
externalTrackerAddress = "80.100.100.3";
+
+ transmissionConfig = { ... }: {
+ environment.systemPackages = [ pkgs.transmission ];
+ services.transmission = {
+ enable = true;
+ settings = {
+ dht-enabled = false;
+ message-level = 3;
+ };
+ };
+ };
in
{
@@ -26,88 +37,79 @@ in
maintainers = [ domenkozar eelco rob bobvanderlinden ];
};
- nodes =
- { tracker =
- { pkgs, ... }:
- { environment.systemPackages = [ pkgs.transmission ];
-
- virtualisation.vlans = [ 1 ];
- networking.interfaces.eth1.ipv4.addresses = [
- { address = externalTrackerAddress; prefixLength = 24; }
- ];
-
- # We need Apache on the tracker to serve the torrents.
- services.httpd.enable = true;
- services.httpd.adminAddr = "foo@example.org";
- services.httpd.documentRoot = "/tmp";
-
- networking.firewall.enable = false;
-
- services.opentracker.enable = true;
-
- services.transmission.enable = true;
- services.transmission.settings.dht-enabled = false;
- services.transmission.settings.port-forwaring-enabled = false;
- };
-
- router =
- { pkgs, nodes, ... }:
- { virtualisation.vlans = [ 1 2 ];
- networking.nat.enable = true;
- networking.nat.internalInterfaces = [ "eth2" ];
- networking.nat.externalInterface = "eth1";
- networking.firewall.enable = true;
- networking.firewall.trustedInterfaces = [ "eth2" ];
- networking.interfaces.eth0.ipv4.addresses = [];
- networking.interfaces.eth1.ipv4.addresses = [
- { address = externalRouterAddress; prefixLength = 24; }
- ];
- networking.interfaces.eth2.ipv4.addresses = [
- { address = internalRouterAddress; prefixLength = 24; }
- ];
- services.miniupnpd = {
- enable = true;
- externalInterface = "eth1";
- internalIPs = [ "eth2" ];
- appendConfig = ''
- ext_ip=${externalRouterAddress}
- '';
+ nodes = {
+ tracker = { pkgs, ... }: {
+ imports = [ transmissionConfig ];
+
+ virtualisation.vlans = [ 1 ];
+ networking.firewall.enable = false;
+ networking.interfaces.eth1.ipv4.addresses = [
+ { address = externalTrackerAddress; prefixLength = 24; }
+ ];
+
+ # We need Apache on the tracker to serve the torrents.
+ services.httpd = {
+ enable = true;
+ virtualHosts = {
+ "torrentserver.org" = {
+ adminAddr = "foo@example.org";
+ documentRoot = "/tmp";
};
};
+ };
+ services.opentracker.enable = true;
+ };
- client1 =
- { pkgs, nodes, ... }:
- { environment.systemPackages = [ pkgs.transmission pkgs.miniupnpc ];
- virtualisation.vlans = [ 2 ];
- networking.interfaces.eth0.ipv4.addresses = [];
- networking.interfaces.eth1.ipv4.addresses = [
- { address = internalClient1Address; prefixLength = 24; }
- ];
- networking.defaultGateway = internalRouterAddress;
- networking.firewall.enable = false;
- services.transmission.enable = true;
- services.transmission.settings.dht-enabled = false;
- services.transmission.settings.message-level = 3;
- };
+ router = { pkgs, nodes, ... }: {
+ virtualisation.vlans = [ 1 2 ];
+ networking.nat.enable = true;
+ networking.nat.internalInterfaces = [ "eth2" ];
+ networking.nat.externalInterface = "eth1";
+ networking.firewall.enable = true;
+ networking.firewall.trustedInterfaces = [ "eth2" ];
+ networking.interfaces.eth0.ipv4.addresses = [];
+ networking.interfaces.eth1.ipv4.addresses = [
+ { address = externalRouterAddress; prefixLength = 24; }
+ ];
+ networking.interfaces.eth2.ipv4.addresses = [
+ { address = internalRouterAddress; prefixLength = 24; }
+ ];
+ services.miniupnpd = {
+ enable = true;
+ externalInterface = "eth1";
+ internalIPs = [ "eth2" ];
+ appendConfig = ''
+ ext_ip=${externalRouterAddress}
+ '';
+ };
+ };
- client2 =
- { pkgs, ... }:
- { environment.systemPackages = [ pkgs.transmission ];
- virtualisation.vlans = [ 1 ];
- networking.interfaces.eth0.ipv4.addresses = [];
- networking.interfaces.eth1.ipv4.addresses = [
- { address = externalClient2Address; prefixLength = 24; }
- ];
- networking.firewall.enable = false;
- services.transmission.enable = true;
- services.transmission.settings.dht-enabled = false;
- services.transmission.settings.port-forwaring-enabled = false;
- };
+ client1 = { pkgs, nodes, ... }: {
+ imports = [ transmissionConfig ];
+ environment.systemPackages = [ pkgs.miniupnpc ];
+
+ virtualisation.vlans = [ 2 ];
+ networking.interfaces.eth0.ipv4.addresses = [];
+ networking.interfaces.eth1.ipv4.addresses = [
+ { address = internalClient1Address; prefixLength = 24; }
+ ];
+ networking.defaultGateway = internalRouterAddress;
+ networking.firewall.enable = false;
};
- testScript =
- { nodes, ... }:
- ''
+ client2 = { pkgs, ... }: {
+ imports = [ transmissionConfig ];
+
+ virtualisation.vlans = [ 1 ];
+ networking.interfaces.eth0.ipv4.addresses = [];
+ networking.interfaces.eth1.ipv4.addresses = [
+ { address = externalClient2Address; prefixLength = 24; }
+ ];
+ networking.firewall.enable = false;
+ };
+ };
+
+ testScript = { nodes, ... }: ''
start_all()
# Wait for network and miniupnpd.
@@ -159,5 +161,4 @@ in
"cmp /tmp/test.tar.bz2 ${file}"
)
'';
-
})
diff --git a/nixos/tests/blivet.nix b/nixos/tests/blivet.nix
deleted file mode 100644
index 2adc2ee1eeea3fba543ee4c4925b9cdc4e67508d..0000000000000000000000000000000000000000
--- a/nixos/tests/blivet.nix
+++ /dev/null
@@ -1,87 +0,0 @@
-import ./make-test.nix ({ pkgs, ... }: with pkgs.python2Packages; rec {
- name = "blivet";
- meta = with pkgs.stdenv.lib.maintainers; {
- maintainers = [ aszlig ];
- };
-
- machine = {
- environment.systemPackages = [ pkgs.python blivet mock ];
- boot.supportedFilesystems = [ "btrfs" "jfs" "reiserfs" "xfs" ];
- virtualisation.memorySize = 768;
- };
-
- debugBlivet = false;
- debugProgramCalls = false;
-
- pythonTestRunner = pkgs.writeText "run-blivet-tests.py" ''
- import sys
- import logging
-
- from unittest import TestLoader
- from unittest.runner import TextTestRunner
-
- ${pkgs.lib.optionalString debugProgramCalls ''
- blivet_program_log = logging.getLogger("program")
- blivet_program_log.setLevel(logging.DEBUG)
- blivet_program_log.addHandler(logging.StreamHandler(sys.stderr))
- ''}
-
- ${pkgs.lib.optionalString debugBlivet ''
- blivet_log = logging.getLogger("blivet")
- blivet_log.setLevel(logging.DEBUG)
- blivet_log.addHandler(logging.StreamHandler(sys.stderr))
- ''}
-
- runner = TextTestRunner(verbosity=2, failfast=False, buffer=False)
- result = runner.run(TestLoader().discover('tests/', pattern='*_test.py'))
- sys.exit(not result.wasSuccessful())
- '';
-
- blivetTest = pkgs.writeScript "blivet-test.sh" ''
- #!${pkgs.stdenv.shell} -e
-
- # Use the hosts temporary directory, because we have a tmpfs within the VM
- # and we don't want to increase the memory size of the VM for no reason.
- mkdir -p /tmp/xchg/bigtmp
- TMPDIR=/tmp/xchg/bigtmp
- export TMPDIR
-
- cp -Rd "${blivet.src}/tests" .
-
- # Skip SELinux tests
- rm -f tests/formats_test/selinux_test.py
-
- # Race conditions in growing/shrinking during resync
- rm -f tests/devicelibs_test/mdraid_*
-
- # Deactivate small BTRFS device test, because it fails with newer btrfsprogs
- sed -i -e '/^class *BTRFSAsRootTestCase3(/,/^[^ ]/ {
- /^class *BTRFSAsRootTestCase3(/d
- /^$/d
- /^ /d
- }' tests/devicelibs_test/btrfs_test.py
-
- # How on earth can these tests ever work even upstream? O_o
- sed -i -e '/def testDiskChunk[12]/,/^ *[^ ]/{n; s/^ */&return # /}' \
- tests/partitioning_test.py
-
- # fix hardcoded temporary directory
- sed -i \
- -e '1i import tempfile' \
- -e 's|_STORE_FILE_PATH = .*|_STORE_FILE_PATH = tempfile.gettempdir()|' \
- -e 's|DEFAULT_STORE_SIZE = .*|DEFAULT_STORE_SIZE = 409600|' \
- tests/loopbackedtestcase.py
-
- PYTHONPATH=".:$(< "${pkgs.stdenv.mkDerivation {
- name = "blivet-pythonpath";
- buildInputs = [ blivet mock ];
- buildCommand = "echo \"$PYTHONPATH\" > \"$out\"";
- }}")" python "${pythonTestRunner}"
- '';
-
- testScript = ''
- $machine->waitForUnit("multi-user.target");
- $machine->succeed("${blivetTest}");
- $machine->execute("rm -rf /tmp/xchg/bigtmp");
- '';
-})
diff --git a/nixos/tests/buildbot.nix b/nixos/tests/buildbot.nix
index f5c8c4863b6f16b5517cae4b2d0312c7f0305022..5655a34a8b513de80880c811e1dd5e8bd95b6fa8 100644
--- a/nixos/tests/buildbot.nix
+++ b/nixos/tests/buildbot.nix
@@ -1,12 +1,11 @@
+# Test ensures buildbot master comes up correctly and workers can connect
+
{ system ? builtins.currentSystem,
config ? {},
pkgs ? import ../.. { inherit system config; }
}:
-with import ../lib/testing.nix { inherit system pkgs; };
-
-# Test ensures buildbot master comes up correctly and workers can connect
-makeTest {
+import ./make-test-python.nix {
name = "buildbot";
nodes = {
@@ -39,75 +38,76 @@ makeTest {
services.openssh.enable = true;
networking.firewall.allowedTCPPorts = [ 22 9418 ];
environment.systemPackages = with pkgs; [ git ];
+ systemd.services.git-daemon = {
+ description = "Git daemon for the test";
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+
+ serviceConfig.Restart = "always";
+ path = with pkgs; [ coreutils git openssh ];
+ environment = { HOME = "/root"; };
+ preStart = ''
+ git config --global user.name 'Nobody Fakeuser'
+ git config --global user.email 'nobody\@fakerepo.com'
+ rm -rvf /srv/repos/fakerepo.git /tmp/fakerepo
+ mkdir -pv /srv/repos/fakerepo ~/.ssh
+ ssh-keyscan -H gitrepo > ~/.ssh/known_hosts
+ cat ~/.ssh/known_hosts
+
+ mkdir -p /src/repos/fakerepo
+ cd /srv/repos/fakerepo
+ rm -rf *
+ git init
+ echo -e '#!/bin/sh\necho fakerepo' > fakerepo.sh
+ cat fakerepo.sh
+ touch .git/git-daemon-export-ok
+ git add fakerepo.sh .git/git-daemon-export-ok
+ git commit -m fakerepo
+ '';
+ script = ''
+ git daemon --verbose --export-all --base-path=/srv/repos --reuseaddr
+ '';
+ };
};
};
testScript = ''
- #Start up and populate fake repo
- $gitrepo->waitForUnit("multi-user.target");
- print($gitrepo->execute(" \
- git config --global user.name 'Nobody Fakeuser' && \
- git config --global user.email 'nobody\@fakerepo.com' && \
- rm -rvf /srv/repos/fakerepo.git /tmp/fakerepo && \
- mkdir -pv /srv/repos/fakerepo ~/.ssh && \
- ssh-keyscan -H gitrepo > ~/.ssh/known_hosts && \
- cat ~/.ssh/known_hosts && \
- cd /srv/repos/fakerepo && \
- git init && \
- echo -e '#!/bin/sh\necho fakerepo' > fakerepo.sh && \
- cat fakerepo.sh && \
- touch .git/git-daemon-export-ok && \
- git add fakerepo.sh .git/git-daemon-export-ok && \
- git commit -m fakerepo && \
- git daemon --verbose --export-all --base-path=/srv/repos --reuseaddr & \
- "));
-
- # Test gitrepo
- $bbmaster->waitForUnit("network-online.target");
- #$bbmaster->execute("nc -z gitrepo 9418");
- print($bbmaster->execute(" \
- rm -rfv /tmp/fakerepo && \
- git clone git://gitrepo/fakerepo /tmp/fakerepo && \
- pwd && \
- ls -la && \
- ls -la /tmp/fakerepo \
- "));
-
- # Test start master and connect worker
- $bbmaster->waitForUnit("buildbot-master.service");
- $bbmaster->waitUntilSucceeds("curl -s --head http://bbmaster:8010") =~ /200 OK/;
- $bbworker->waitForUnit("network-online.target");
- $bbworker->execute("nc -z bbmaster 8010");
- $bbworker->execute("nc -z bbmaster 9989");
- $bbworker->waitForUnit("buildbot-worker.service");
- print($bbworker->execute("ls -la /home/bbworker/worker"));
-
+ gitrepo.wait_for_unit("git-daemon.service")
+ gitrepo.wait_for_unit("multi-user.target")
- # Test stop buildbot master and worker
- print($bbmaster->execute(" \
- systemctl -l --no-pager status buildbot-master && \
- systemctl stop buildbot-master \
- "));
- $bbworker->fail("nc -z bbmaster 8010");
- $bbworker->fail("nc -z bbmaster 9989");
- print($bbworker->execute(" \
- systemctl -l --no-pager status buildbot-worker && \
- systemctl stop buildbot-worker && \
- ls -la /home/bbworker/worker \
- "));
+ with subtest("Repo is accessible via git daemon"):
+ bbmaster.wait_for_unit("network-online.target")
+ bbmaster.succeed("rm -rfv /tmp/fakerepo")
+ bbmaster.succeed("git clone git://gitrepo/fakerepo /tmp/fakerepo")
+ with subtest("Master service and worker successfully connect"):
+ bbmaster.wait_for_unit("buildbot-master.service")
+ bbmaster.wait_until_succeeds("curl --fail -s --head http://bbmaster:8010")
+ bbworker.wait_for_unit("network-online.target")
+ bbworker.succeed("nc -z bbmaster 8010")
+ bbworker.succeed("nc -z bbmaster 9989")
+ bbworker.wait_for_unit("buildbot-worker.service")
- # Test buildbot daemon mode
- $bbmaster->execute("buildbot create-master /tmp");
- $bbmaster->execute("mv -fv /tmp/master.cfg.sample /tmp/master.cfg");
- $bbmaster->execute("sed -i 's/8010/8011/' /tmp/master.cfg");
- $bbmaster->execute("buildbot start /tmp");
- $bbworker->execute("nc -z bbmaster 8011");
- $bbworker->waitUntilSucceeds("curl -s --head http://bbmaster:8011") =~ /200 OK/;
- $bbmaster->execute("buildbot stop /tmp");
- $bbworker->fail("nc -z bbmaster 8011");
+ with subtest("Stop buildbot worker"):
+ bbmaster.succeed("systemctl -l --no-pager status buildbot-master")
+ bbmaster.succeed("systemctl stop buildbot-master")
+ bbworker.fail("nc -z bbmaster 8010")
+ bbworker.fail("nc -z bbmaster 9989")
+ bbworker.succeed("systemctl -l --no-pager status buildbot-worker")
+ bbworker.succeed("systemctl stop buildbot-worker")
+ with subtest("Buildbot daemon mode works"):
+ bbmaster.succeed(
+ "buildbot create-master /tmp",
+ "mv -fv /tmp/master.cfg.sample /tmp/master.cfg",
+ "sed -i 's/8010/8011/' /tmp/master.cfg",
+ "buildbot start /tmp",
+ "nc -z bbmaster 8011",
+ )
+ bbworker.wait_until_succeeds("curl --fail -s --head http://bbmaster:8011")
+ bbmaster.wait_until_succeeds("buildbot stop /tmp")
+ bbworker.fail("nc -z bbmaster 8011")
'';
meta.maintainers = with pkgs.stdenv.lib.maintainers; [ nand0p ];
-}
+} {}
diff --git a/nixos/tests/buildkite-agent.nix b/nixos/tests/buildkite-agent.nix
new file mode 100644
index 0000000000000000000000000000000000000000..3c824c9aedf5ba2bf14c57566eaa78b6d69d5fcb
--- /dev/null
+++ b/nixos/tests/buildkite-agent.nix
@@ -0,0 +1,36 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+{
+ name = "buildkite-agent";
+ meta = with pkgs.stdenv.lib.maintainers; {
+ maintainers = [ flokli ];
+ };
+
+ nodes = {
+ node1 = { pkgs, ... }: {
+ services.buildkite-agent = {
+ enable = true;
+ privateSshKeyPath = (import ./ssh-keys.nix pkgs).snakeOilPrivateKey;
+ tokenPath = (pkgs.writeText "my-token" "5678");
+ };
+ };
+ # don't configure ssh key, run as a separate user
+ node2 = { pkgs, ...}: {
+ services.buildkite-agent = {
+ enable = true;
+ tokenPath = (pkgs.writeText "my-token" "1234");
+ };
+ };
+ };
+
+ testScript = ''
+ start_all()
+ # we can't wait on the unit to start up, as we obviously can't connect to buildkite,
+ # but we can look whether files are set up correctly
+
+ node1.wait_for_file("/var/lib/buildkite-agent/buildkite-agent.cfg")
+ node1.wait_for_file("/var/lib/buildkite-agent/.ssh/id_rsa")
+
+ node2.wait_for_file("/var/lib/buildkite-agent/buildkite-agent.cfg")
+ '';
+})
diff --git a/nixos/tests/certmgr.nix b/nixos/tests/certmgr.nix
index cb69f35e862f8eae32d70878640fb278a719caec..ef32f54400e309b955384a53a1d81ff8c54b2e0e 100644
--- a/nixos/tests/certmgr.nix
+++ b/nixos/tests/certmgr.nix
@@ -9,8 +9,8 @@ let
inherit action;
authority = {
file = {
- group = "nobody";
- owner = "nobody";
+ group = "nginx";
+ owner = "nginx";
path = "/tmp/${host}-ca.pem";
};
label = "www_ca";
@@ -18,14 +18,14 @@ let
remote = "localhost:8888";
};
certificate = {
- group = "nobody";
- owner = "nobody";
+ group = "nginx";
+ owner = "nginx";
path = "/tmp/${host}-cert.pem";
};
private_key = {
- group = "nobody";
+ group = "nginx";
mode = "0600";
- owner = "nobody";
+ owner = "nginx";
path = "/tmp/${host}-key.pem";
};
request = {
diff --git a/nixos/tests/chromium.nix b/nixos/tests/chromium.nix
index a5531d112e3c690a52cfb4f8c61db5ca890698c1..fc5d3a5c52fe5e6afd0432ebd2a931ef739ff656 100644
--- a/nixos/tests/chromium.nix
+++ b/nixos/tests/chromium.nix
@@ -8,7 +8,7 @@
}
}:
-with import ../lib/testing.nix { inherit system pkgs; };
+with import ../lib/testing-python.nix { inherit system pkgs; };
with pkgs.lib;
mapAttrs (channel: chromiumPkg: makeTest rec {
@@ -21,9 +21,11 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
enableOCR = true;
+ user = "alice";
+
machine.imports = [ ./common/user-account.nix ./common/x11.nix ];
machine.virtualisation.memorySize = 2047;
- machine.services.xserver.displayManager.auto.user = "alice";
+ machine.test-support.displayManager.auto.user = user;
machine.environment.systemPackages = [ chromiumPkg ];
startupHTML = pkgs.writeText "chromium-startup.html" ''
@@ -47,155 +49,218 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
xdoScript = pkgs.writeText "${name}.xdo" text;
in "${pkgs.xdotool}/bin/xdotool '${xdoScript}'";
in ''
+ import shlex
+ from contextlib import contextmanager, _GeneratorContextManager
+
+
# Run as user alice
- sub ru ($) {
- my $esc = $_[0] =~ s/'/'\\${"'"}'/gr;
- return "su - alice -c '$esc'";
- }
-
- sub createNewWin {
- $machine->nest("creating a new Chromium window", sub {
- $machine->execute(ru "${xdo "new-window" ''
- search --onlyvisible --name "startup done"
- windowfocus --sync
- windowactivate --sync
- ''}");
- $machine->execute(ru "${xdo "new-window" ''
- key Ctrl+n
- ''}");
- });
- }
-
- sub closeWin {
- Machine::retry sub {
- $machine->execute(ru "${xdo "close-window" ''
- search --onlyvisible --name "new tab"
- windowfocus --sync
- windowactivate --sync
- ''}");
- $machine->execute(ru "${xdo "close-window" ''
- key Ctrl+w
- ''}");
- for (1..20) {
- my ($status, $out) = $machine->execute(ru "${xdo "wait-for-close" ''
- search --onlyvisible --name "new tab"
- ''}");
- return 1 if $status != 0;
- $machine->sleep(1);
- }
- }
- }
-
- sub waitForNewWin {
- my $ret = 0;
- $machine->nest("waiting for new Chromium window to appear", sub {
- for (1..20) {
- my ($status, $out) = $machine->execute(ru "${xdo "wait-for-window" ''
- search --onlyvisible --name "new tab"
- windowfocus --sync
- windowactivate --sync
- ''}");
- if ($status == 0) {
- $ret = 1;
-
- # XXX: Somehow Chromium is not accepting keystrokes for a few
- # seconds after a new window has appeared, so let's wait a while.
- $machine->sleep(10);
-
- last;
- }
- $machine->sleep(1);
- }
- });
- return $ret;
- }
-
- sub createAndWaitForNewWin {
- for (1..3) {
- createNewWin;
- return 1 if waitForNewWin;
- }
- die "new window didn't appear within 60 seconds";
- }
-
- sub testNewWin {
- my ($desc, $code) = @_;
- createAndWaitForNewWin;
- subtest($desc, $code);
- closeWin;
- }
-
- $machine->waitForX;
-
- my $url = "file://${startupHTML}";
- $machine->execute(ru "ulimit -c unlimited; chromium \"$url\" & disown");
- $machine->waitForText(qr/startup done/);
- $machine->waitUntilSucceeds(ru "${xdo "check-startup" ''
- search --sync --onlyvisible --name "startup done"
- # close first start help popup
- key -delay 1000 Escape
- windowfocus --sync
- windowactivate --sync
- ''}");
-
- createAndWaitForNewWin;
- $machine->screenshot("empty_windows");
- closeWin;
-
- $machine->screenshot("startup_done");
-
- testNewWin "check sandbox", sub {
- $machine->succeed(ru "${xdo "type-url" ''
- search --sync --onlyvisible --name "new tab"
- windowfocus --sync
- type --delay 1000 "chrome://sandbox"
- ''}");
-
- $machine->succeed(ru "${xdo "submit-url" ''
- search --sync --onlyvisible --name "new tab"
- windowfocus --sync
- key --delay 1000 Return
- ''}");
-
- $machine->screenshot("sandbox_info");
-
- $machine->succeed(ru "${xdo "find-window" ''
- search --sync --onlyvisible --name "sandbox status"
- windowfocus --sync
- ''}");
- $machine->succeed(ru "${xdo "copy-sandbox-info" ''
- key --delay 1000 Ctrl+a Ctrl+c
- ''}");
-
- my $clipboard = $machine->succeed(ru "${pkgs.xclip}/bin/xclip -o");
- die "sandbox not working properly: $clipboard"
- unless $clipboard =~ /layer 1 sandbox.*namespace/mi
- && $clipboard =~ /pid namespaces.*yes/mi
- && $clipboard =~ /network namespaces.*yes/mi
- && $clipboard =~ /seccomp.*sandbox.*yes/mi
- && $clipboard =~ /you are adequately sandboxed/mi;
-
- $machine->sleep(1);
- $machine->succeed(ru "${xdo "find-window-after-copy" ''
- search --onlyvisible --name "sandbox status"
- ''}");
-
- my $clipboard = $machine->succeed(ru "echo void | ${pkgs.xclip}/bin/xclip -i");
- $machine->succeed(ru "${xdo "copy-sandbox-info" ''
- key --delay 1000 Ctrl+a Ctrl+c
- ''}");
-
- my $clipboard = $machine->succeed(ru "${pkgs.xclip}/bin/xclip -o");
- die "copying twice in a row does not work properly: $clipboard"
- unless $clipboard =~ /layer 1 sandbox.*namespace/mi
- && $clipboard =~ /pid namespaces.*yes/mi
- && $clipboard =~ /network namespaces.*yes/mi
- && $clipboard =~ /seccomp.*sandbox.*yes/mi
- && $clipboard =~ /you are adequately sandboxed/mi;
-
- $machine->screenshot("afer_copy_from_chromium");
- };
-
- $machine->shutdown;
+ def ru(cmd):
+ return "su - ${user} -c " + shlex.quote(cmd)
+
+
+ def create_new_win():
+ with machine.nested("Creating a new Chromium window"):
+ machine.execute(
+ ru(
+ "${xdo "new-window" ''
+ search --onlyvisible --name "startup done"
+ windowfocus --sync
+ windowactivate --sync
+ ''}"
+ )
+ )
+ machine.execute(
+ ru(
+ "${xdo "new-window" ''
+ key Ctrl+n
+ ''}"
+ )
+ )
+
+
+ def close_win():
+ def try_close(_):
+ machine.execute(
+ ru(
+ "${xdo "close-window" ''
+ search --onlyvisible --name "new tab"
+ windowfocus --sync
+ windowactivate --sync
+ ''}"
+ )
+ )
+ machine.execute(
+ ru(
+ "${xdo "close-window" ''
+ key Ctrl+w
+ ''}"
+ )
+ )
+ for _ in range(1, 20):
+ status, out = machine.execute(
+ ru(
+ "${xdo "wait-for-close" ''
+ search --onlyvisible --name "new tab"
+ ''}"
+ )
+ )
+ if status != 0:
+ return True
+ machine.sleep(1)
+ return False
+
+ retry(try_close)
+
+
+ def wait_for_new_win():
+ ret = False
+ with machine.nested("Waiting for new Chromium window to appear"):
+ for _ in range(1, 20):
+ status, out = machine.execute(
+ ru(
+ "${xdo "wait-for-window" ''
+ search --onlyvisible --name "new tab"
+ windowfocus --sync
+ windowactivate --sync
+ ''}"
+ )
+ )
+ if status == 0:
+ ret = True
+ machine.sleep(10)
+ break
+ machine.sleep(1)
+ return ret
+
+
+ def create_and_wait_for_new_win():
+ for _ in range(1, 3):
+ create_new_win()
+ if wait_for_new_win():
+ return True
+ assert False, "new window did not appear within 60 seconds"
+
+
+ @contextmanager
+ def test_new_win(description):
+ create_and_wait_for_new_win()
+ with machine.nested(description):
+ yield
+ close_win()
+
+
+ machine.wait_for_x()
+
+ url = "file://${startupHTML}"
+ machine.succeed(ru(f'ulimit -c unlimited; chromium "{url}" & disown'))
+ machine.wait_for_text("startup done")
+ machine.wait_until_succeeds(
+ ru(
+ "${xdo "check-startup" ''
+ search --sync --onlyvisible --name "startup done"
+ # close first start help popup
+ key -delay 1000 Escape
+ windowfocus --sync
+ windowactivate --sync
+ ''}"
+ )
+ )
+
+ create_and_wait_for_new_win()
+ machine.screenshot("empty_windows")
+ close_win()
+
+ machine.screenshot("startup_done")
+
+ with test_new_win("check sandbox"):
+ machine.succeed(
+ ru(
+ "${xdo "type-url" ''
+ search --sync --onlyvisible --name "new tab"
+ windowfocus --sync
+ type --delay 1000 "chrome://sandbox"
+ ''}"
+ )
+ )
+
+ machine.succeed(
+ ru(
+ "${xdo "submit-url" ''
+ search --sync --onlyvisible --name "new tab"
+ windowfocus --sync
+ key --delay 1000 Return
+ ''}"
+ )
+ )
+
+ machine.screenshot("sandbox_info")
+
+ machine.succeed(
+ ru(
+ "${xdo "find-window" ''
+ search --sync --onlyvisible --name "sandbox status"
+ windowfocus --sync
+ ''}"
+ )
+ )
+ machine.succeed(
+ ru(
+ "${xdo "copy-sandbox-info" ''
+ key --delay 1000 Ctrl+a Ctrl+c
+ ''}"
+ )
+ )
+
+ clipboard = machine.succeed(
+ ru("${pkgs.xclip}/bin/xclip -o")
+ )
+
+ filters = [
+ "layer 1 sandbox.*namespace",
+ "pid namespaces.*yes",
+ "network namespaces.*yes",
+ "seccomp.*sandbox.*yes",
+ "you are adequately sandboxed",
+ ]
+ if not all(
+ re.search(filter, clipboard, flags=re.DOTALL | re.IGNORECASE)
+ for filter in filters
+ ):
+ assert False, f"sandbox not working properly: {clipboard}"
+
+ machine.sleep(1)
+ machine.succeed(
+ ru(
+ "${xdo "find-window-after-copy" ''
+ search --onlyvisible --name "sandbox status"
+ ''}"
+ )
+ )
+
+ clipboard = machine.succeed(
+ ru(
+ "echo void | ${pkgs.xclip}/bin/xclip -i"
+ )
+ )
+ machine.succeed(
+ ru(
+ "${xdo "copy-sandbox-info" ''
+ key --delay 1000 Ctrl+a Ctrl+c
+ ''}"
+ )
+ )
+
+ clipboard = machine.succeed(
+ ru("${pkgs.xclip}/bin/xclip -o")
+ )
+ if not all(
+ re.search(filter, clipboard, flags=re.DOTALL | re.IGNORECASE)
+ for filter in filters
+ ):
+ assert False, f"copying twice in a row does not work properly: {clipboard}"
+
+ machine.screenshot("after_copy_from_chromium")
+
+ machine.shutdown()
'';
}) channelMap
diff --git a/nixos/modules/services/x11/display-managers/auto.nix b/nixos/tests/common/auto.nix
similarity index 93%
rename from nixos/modules/services/x11/display-managers/auto.nix
rename to nixos/tests/common/auto.nix
index 1068a344e0cfb76eb3baee0ddb48628970f77cc4..2c21a8d51673789f0f46f034e8d9e75b7e314542 100644
--- a/nixos/modules/services/x11/display-managers/auto.nix
+++ b/nixos/tests/common/auto.nix
@@ -5,7 +5,7 @@ with lib;
let
dmcfg = config.services.xserver.displayManager;
- cfg = dmcfg.auto;
+ cfg = config.test-support.displayManager.auto;
in
@@ -15,7 +15,7 @@ in
options = {
- services.xserver.displayManager.auto = {
+ test-support.displayManager.auto = {
enable = mkOption {
default = false;
diff --git a/nixos/tests/common/ec2.nix b/nixos/tests/common/ec2.nix
index 1e69b63191a70b9ed49a904dfc4b3bf52cc64bbf..ba087bb600905f1d3e42f148de317a534ae205e7 100644
--- a/nixos/tests/common/ec2.nix
+++ b/nixos/tests/common/ec2.nix
@@ -25,7 +25,7 @@ with pkgs.lib;
my $imageDir = ($ENV{'TMPDIR'} // "/tmp") . "/vm-state-machine";
mkdir $imageDir, 0700;
my $diskImage = "$imageDir/machine.qcow2";
- system("qemu-img create -f qcow2 -o backing_file=${image}/nixos.qcow2 $diskImage") == 0 or die;
+ system("qemu-img create -f qcow2 -o backing_file=${image} $diskImage") == 0 or die;
system("qemu-img resize $diskImage 10G") == 0 or die;
# Note: we use net=169.0.0.0/8 rather than
@@ -35,7 +35,7 @@ with pkgs.lib;
# again when it deletes link-local addresses.) Ideally we'd
# turn off the DHCP server, but qemu does not have an option
# to do that.
- my $startCommand = "qemu-kvm -m 768";
+ my $startCommand = "qemu-kvm -m 1024";
$startCommand .= " -device virtio-net-pci,netdev=vlan0";
$startCommand .= " -netdev 'user,id=vlan0,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${pkgs.micro-httpd}/bin/micro_httpd ${metaData}'";
$startCommand .= " -drive file=$diskImage,if=virtio,werror=report";
diff --git a/nixos/tests/common/x11.nix b/nixos/tests/common/x11.nix
index 5ad0ac20fac85dc7a9c05c8750702e6706961159..0d76a0e972ff51315496aec8faf2b7d51deeb730 100644
--- a/nixos/tests/common/x11.nix
+++ b/nixos/tests/common/x11.nix
@@ -1,9 +1,14 @@
{ lib, ... }:
-{ services.xserver.enable = true;
+{
+ imports = [
+ ./auto.nix
+ ];
+
+ services.xserver.enable = true;
# Automatically log in.
- services.xserver.displayManager.auto.enable = true;
+ test-support.displayManager.auto.enable = true;
# Use IceWM as the window manager.
# Don't use a desktop manager.
diff --git a/nixos/tests/corerad.nix b/nixos/tests/corerad.nix
new file mode 100644
index 0000000000000000000000000000000000000000..950c9abc8994d0b3e9eff06e2bdacaf3cb4757a8
--- /dev/null
+++ b/nixos/tests/corerad.nix
@@ -0,0 +1,70 @@
+import ./make-test-python.nix (
+ {
+ nodes = {
+ router = {config, pkgs, ...}: {
+ config = {
+ # This machines simulates a router with IPv6 forwarding and a static IPv6 address.
+ boot.kernel.sysctl = {
+ "net.ipv6.conf.all.forwarding" = true;
+ };
+ networking.interfaces.eth1 = {
+ ipv6.addresses = [ { address = "fd00:dead:beef:dead::1"; prefixLength = 64; } ];
+ };
+ services.corerad = {
+ enable = true;
+ # Serve router advertisements to the client machine with prefix information matching
+ # any IPv6 /64 prefixes configured on this interface.
+ configFile = pkgs.writeText "corerad.toml" ''
+ [[interfaces]]
+ name = "eth1"
+ send_advertisements = true
+ [[interfaces.prefix]]
+ prefix = "::/64"
+ '';
+ };
+ };
+ };
+ client = {config, pkgs, ...}: {
+ # Use IPv6 SLAAC from router advertisements, and install rdisc6 so we can
+ # trigger one immediately.
+ config = {
+ boot.kernel.sysctl = {
+ "net.ipv6.conf.all.autoconf" = true;
+ };
+ environment.systemPackages = with pkgs; [
+ ndisc6
+ ];
+ };
+ };
+ };
+
+ testScript = ''
+ start_all()
+
+ with subtest("Wait for CoreRAD and network ready"):
+ # Ensure networking is online and CoreRAD is ready.
+ router.wait_for_unit("network-online.target")
+ client.wait_for_unit("network-online.target")
+ router.wait_for_unit("corerad.service")
+
+ # Ensure the client can reach the router.
+ client.wait_until_succeeds("ping -c 1 fd00:dead:beef:dead::1")
+
+ with subtest("Verify SLAAC on client"):
+ # Trigger a router solicitation and verify a SLAAC address is assigned from
+ # the prefix configured on the router.
+ client.wait_until_succeeds("rdisc6 -1 -r 10 eth1")
+ client.wait_until_succeeds(
+ "ip -6 addr show dev eth1 | grep -q 'fd00:dead:beef:dead:'"
+ )
+
+ addrs = client.succeed("ip -6 addr show dev eth1")
+
+ assert (
+ "fd00:dead:beef:dead:" in addrs
+ ), "SLAAC prefix was not found in client addresses after router advertisement"
+ assert (
+ "/64 scope global temporary" in addrs
+ ), "SLAAC temporary address was not configured on client after router advertisement"
+ '';
+ })
diff --git a/nixos/tests/dnscrypt-proxy.nix b/nixos/tests/dnscrypt-proxy2.nix
similarity index 50%
rename from nixos/tests/dnscrypt-proxy.nix
rename to nixos/tests/dnscrypt-proxy2.nix
index 98153d5c9047051d7f24fb31d38dd6fc0342d6a1..b614d912a9f4ed45d16ffbf4ae344e5225f6d4a2 100644
--- a/nixos/tests/dnscrypt-proxy.nix
+++ b/nixos/tests/dnscrypt-proxy2.nix
@@ -1,5 +1,5 @@
import ./make-test-python.nix ({ pkgs, ... }: {
- name = "dnscrypt-proxy";
+ name = "dnscrypt-proxy2";
meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ joachifm ];
};
@@ -13,9 +13,16 @@ import ./make-test-python.nix ({ pkgs, ... }: {
{
security.apparmor.enable = true;
- services.dnscrypt-proxy.enable = true;
- services.dnscrypt-proxy.localPort = localProxyPort;
- services.dnscrypt-proxy.extraArgs = [ "-X libdcplugin_example.so" ];
+ services.dnscrypt-proxy2.enable = true;
+ services.dnscrypt-proxy2.settings = {
+ listen_addresses = [ "127.0.0.1:${toString localProxyPort}" ];
+ sources.public-resolvers = {
+ urls = [ "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md" ];
+ cache_file = "public-resolvers.md";
+ minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+ refresh_delay = 72;
+ };
+ };
services.dnsmasq.enable = true;
services.dnsmasq.servers = [ "127.0.0.1#${toString localProxyPort}" ];
@@ -24,12 +31,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
testScript = ''
client.wait_for_unit("dnsmasq")
-
- # The daemon is socket activated; sending a single ping should activate it.
- client.fail("systemctl is-active dnscrypt-proxy")
- client.execute(
- "${pkgs.iputils}/bin/ping -c1 example.com"
- )
- client.wait_until_succeeds("systemctl is-active dnscrypt-proxy")
+ client.wait_for_unit("dnscrypt-proxy2")
'';
})
diff --git a/nixos/tests/docker-containers.nix b/nixos/tests/docker-containers.nix
index 972552735202044986a48159090ae69cc4094a43..9be9bfa80ce0c60204864181c7e6399e3878984f 100644
--- a/nixos/tests/docker-containers.nix
+++ b/nixos/tests/docker-containers.nix
@@ -1,9 +1,11 @@
# Test Docker containers as systemd units
-import ./make-test.nix ({ pkgs, lib, ... }: {
+import ./make-test.nix ({ pkgs, lib, ... }:
+
+{
name = "docker-containers";
meta = {
- maintainers = with lib.maintainers; [ benley ];
+ maintainers = with lib.maintainers; [ benley mkaito ];
};
nodes = {
@@ -11,10 +13,9 @@ import ./make-test.nix ({ pkgs, lib, ... }: {
{
virtualisation.docker.enable = true;
- virtualisation.dockerPreloader.images = [ pkgs.dockerTools.examples.nginx ];
-
docker-containers.nginx = {
image = "nginx-container";
+ imageFile = pkgs.dockerTools.examples.nginx;
ports = ["8181:80"];
};
};
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index 9ab1a71f3314aa6949e9281e764c736e96daeb35..07fac5336803a5d0fee22d9d0c4d18082ca5cf84 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -80,5 +80,8 @@ import ./make-test.nix ({ pkgs, ... }: {
# This is to be sure the order of layers of the parent image is preserved
$docker->succeed("docker run --rm ${pkgs.dockerTools.examples.layersOrder.imageName} cat /tmp/layer2 | grep -q layer2");
$docker->succeed("docker run --rm ${pkgs.dockerTools.examples.layersOrder.imageName} cat /tmp/layer3 | grep -q layer3");
+
+ # Ensure image with only 2 layers can be loaded
+ $docker->succeed("docker load --input='${pkgs.dockerTools.examples.two-layered-image}'");
'';
})
diff --git a/nixos/tests/dokuwiki.nix b/nixos/tests/dokuwiki.nix
new file mode 100644
index 0000000000000000000000000000000000000000..38bde10f47edc88e4479f5b8144f648bda1dc23f
--- /dev/null
+++ b/nixos/tests/dokuwiki.nix
@@ -0,0 +1,29 @@
+import ./make-test-python.nix ({ lib, ... }:
+
+with lib;
+
+{
+ name = "dokuwiki";
+ meta.maintainers = with maintainers; [ maintainers."1000101" ];
+
+ nodes.machine =
+ { pkgs, ... }:
+ { services.dokuwiki = {
+ enable = true;
+ acl = " ";
+ superUser = null;
+ nginx = {
+ forceSSL = false;
+ enableACME = false;
+ };
+ };
+ };
+
+ testScript = ''
+ machine.start()
+ machine.wait_for_unit("phpfpm-dokuwiki.service")
+ machine.wait_for_unit("nginx.service")
+ machine.wait_for_open_port(80)
+ machine.succeed("curl -sSfL http://localhost/ | grep 'DokuWiki'")
+ '';
+})
diff --git a/nixos/tests/ec2.nix b/nixos/tests/ec2.nix
index c649ce852dad5fed14a635b6b8fdd9ae94d0e8d1..6aeeb17ba31ad0bb197f247c4419f8ebc278300d 100644
--- a/nixos/tests/ec2.nix
+++ b/nixos/tests/ec2.nix
@@ -9,7 +9,7 @@ with pkgs.lib;
with import common/ec2.nix { inherit makeTest pkgs; };
let
- image =
+ imageCfg =
(import ../lib/eval-config.nix {
inherit system;
modules = [
@@ -26,20 +26,32 @@ let
'';
# Needed by nixos-rebuild due to the lack of network
- # access. Mostly copied from
- # modules/profiles/installation-device.nix.
+ # access. Determined by trial and error.
system.extraDependencies =
- with pkgs; [
- stdenv busybox perlPackages.ArchiveCpio unionfs-fuse mkinitcpio-nfs-utils
-
- # These are used in the configure-from-userdata tests for EC2. Httpd and valgrind are requested
- # directly by the configuration we set, and libxslt.bin is used indirectly as a build dependency
- # of the derivation for dbus configuration files.
- apacheHttpd valgrind.doc libxslt.bin
- ];
+ with pkgs; (
+ [
+ # Needed for a nixos-rebuild.
+ busybox
+ stdenv
+ stdenvNoCC
+ mkinitcpio-nfs-utils
+ unionfs-fuse
+ cloud-utils
+ desktop-file-utils
+ texinfo
+ libxslt.bin
+ xorg.lndir
+
+ # These are used in the configure-from-userdata tests
+ # for EC2. Httpd and valgrind are requested by the
+ # configuration.
+ apacheHttpd apacheHttpd.doc apacheHttpd.man valgrind.doc
+ ]
+ );
}
];
- }).config.system.build.amazonImage;
+ }).config;
+ image = "${imageCfg.system.build.amazonImage}/${imageCfg.amazonImage.name}.vhd";
sshKeys = import ./ssh-keys.nix pkgs;
snakeOilPrivateKey = sshKeys.snakeOilPrivateKey.text;
@@ -110,16 +122,23 @@ in {
text = "whoa";
};
+ networking.hostName = "ec2-test-vm"; # required by services.httpd
+
services.httpd = {
enable = true;
adminAddr = "test@example.org";
- virtualHosts.localhost.documentRoot = "${pkgs.valgrind.doc}/share/doc/valgrind/html";
+ virtualHosts.localhost.documentRoot = "''${pkgs.valgrind.doc}/share/doc/valgrind/html";
};
networking.firewall.allowedTCPPorts = [ 80 ];
}
'';
script = ''
$machine->start;
+
+ # amazon-init must succeed. if it fails, make the test fail
+ # immediately instead of timing out in waitForFile.
+ $machine->waitForUnit('amazon-init.service');
+
$machine->waitForFile("/etc/testFile");
$machine->succeed("cat /etc/testFile | grep -q 'whoa'");
diff --git a/nixos/tests/elk.nix b/nixos/tests/elk.nix
index 80db0967d400cf803cacad364b3d0c90ea530693..d3dc6dde13592e3ba0b60ea555016b04fa218e4e 100644
--- a/nixos/tests/elk.nix
+++ b/nixos/tests/elk.nix
@@ -10,8 +10,7 @@ let
esUrl = "http://localhost:9200";
mkElkTest = name : elk :
- let elasticsearchGe7 = builtins.compareVersions elk.elasticsearch.version "7" >= 0;
- in import ./make-test-python.nix ({
+ import ./make-test-python.nix ({
inherit name;
meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ eelco offline basvandijk ];
@@ -91,8 +90,7 @@ let
};
elasticsearch-curator = {
- # The current version of curator (5.6) doesn't support elasticsearch >= 7.0.0.
- enable = !elasticsearchGe7;
+ enable = true;
actionYAML = ''
---
actions:
@@ -173,7 +171,7 @@ let
one.wait_until_succeeds(
total_hits("Supercalifragilisticexpialidocious") + " | grep -v 0"
)
- '' + pkgs.lib.optionalString (!elasticsearchGe7) ''
+
with subtest("Elasticsearch-curator works"):
one.systemctl("stop logstash")
one.systemctl("start elasticsearch-curator")
diff --git a/nixos/tests/freeswitch.nix b/nixos/tests/freeswitch.nix
new file mode 100644
index 0000000000000000000000000000000000000000..349d0e7bc6f0dff7426bb2e6f4413b5e0e3324a8
--- /dev/null
+++ b/nixos/tests/freeswitch.nix
@@ -0,0 +1,29 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+ name = "freeswitch";
+ meta = with pkgs.stdenv.lib.maintainers; {
+ maintainers = [ misuzu ];
+ };
+ nodes = {
+ node0 = { config, lib, ... }: {
+ networking.useDHCP = false;
+ networking.interfaces.eth1 = {
+ ipv4.addresses = [
+ {
+ address = "192.168.0.1";
+ prefixLength = 24;
+ }
+ ];
+ };
+ services.freeswitch = {
+ enable = true;
+ enableReload = true;
+ configTemplate = "${config.services.freeswitch.package}/share/freeswitch/conf/minimal";
+ };
+ };
+ };
+ testScript = ''
+ node0.wait_for_unit("freeswitch.service")
+ # Wait for SIP port to be open
+ node0.wait_for_open_port("5060")
+ '';
+})
diff --git a/nixos/tests/gnome3.nix b/nixos/tests/gnome3.nix
index ab363efb6a197b37486d60d04e97f10e0ac27b12..486c146d8dc39301c46560bddd513ba7c1d538fc 100644
--- a/nixos/tests/gnome3.nix
+++ b/nixos/tests/gnome3.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
name = "gnome3";
meta = with pkgs.stdenv.lib.maintainers; {
maintainers = pkgs.gnome3.maintainers;
@@ -24,41 +24,53 @@ import ./make-test.nix ({ pkgs, ...} : {
virtualisation.memorySize = 1024;
};
- testScript = let
+ testScript = { nodes, ... }: let
# Keep line widths somewhat managable
- bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus";
+ user = nodes.machine.config.users.users.alice;
+ uid = toString user.uid;
+ bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus";
gdbus = "${bus} gdbus";
+ su = command: "su - ${user.name} -c '${command}'";
+
# Call javascript in gnome shell, returns a tuple (success, output), where
# `success` is true if the dbus call was successful and output is what the
# javascript evaluates to.
eval = "call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval";
- # False when startup is done
- startingUp = "${gdbus} ${eval} Main.layoutManager._startingUp";
- # Hopefully gnome-terminal's wm class
- wmClass = "${gdbus} ${eval} global.display.focus_window.wm_class";
- in ''
- # wait for gdm to start
- $machine->waitForUnit("display-manager.service");
- # wait for alice to be logged in
- $machine->waitForUnit("default.target","alice");
-
- # Check that logging in has given the user ownership of devices.
- $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
+ # False when startup is done
+ startingUp = su "${gdbus} ${eval} Main.layoutManager._startingUp";
- # Wait for the wayland server
- $machine->waitForFile("/run/user/1000/wayland-0");
+ # Start gnome-terminal
+ gnomeTerminalCommand = su "${bus} gnome-terminal";
- # Wait for gnome shell, correct output should be "(true, 'false')"
- $machine->waitUntilSucceeds("su - alice -c '${startingUp} | grep -q true,..false'");
+ # Hopefully gnome-terminal's wm class
+ wmClass = su "${gdbus} ${eval} global.display.focus_window.wm_class";
+ in ''
+ with subtest("Login to GNOME with GDM"):
+ # wait for gdm to start
+ machine.wait_for_unit("display-manager.service")
+ # wait for the wayland server
+ machine.wait_for_file("/run/user/${uid}/wayland-0")
+ # wait for alice to be logged in
+ machine.wait_for_unit("default.target", "${user.name}")
+ # check that logging in has given the user ownership of devices
+ assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
- # open a terminal
- $machine->succeed("su - alice -c '${bus} gnome-terminal'");
- # and check it's there
- $machine->waitUntilSucceeds("su - alice -c '${wmClass} | grep -q gnome-terminal-server'");
+ with subtest("Wait for GNOME Shell"):
+ # correct output should be (true, 'false')
+ machine.wait_until_succeeds(
+ "${startingUp} | grep -q 'true,..false'"
+ )
- # wait to get a nice screenshot
- $machine->sleep(20);
- $machine->screenshot("screen");
+ with subtest("Open Gnome Terminal"):
+ machine.succeed(
+ "${gnomeTerminalCommand}"
+ )
+ # correct output should be (true, '"gnome-terminal-server"')
+ machine.wait_until_succeeds(
+ "${wmClass} | grep -q 'gnome-terminal-server'"
+ )
+ machine.sleep(20)
+ machine.screenshot("screen")
'';
})
diff --git a/nixos/tests/graphite.nix b/nixos/tests/graphite.nix
index 27a87bdbb9f29177fb4c8a730410865a5c8f39e8..ba3c73bb878d7ad257a1856607037f8532d7c09f 100644
--- a/nixos/tests/graphite.nix
+++ b/nixos/tests/graphite.nix
@@ -1,6 +1,11 @@
-import ./make-test.nix ({ pkgs, ... } :
+import ./make-test-python.nix ({ pkgs, ... } :
{
name = "graphite";
+ meta = {
+ # Fails on dependency `python-2.7-Twisted`'s test suite
+ # complaining `ImportError: No module named zope.interface`.
+ broken = true;
+ };
nodes = {
one =
{ ... }: {
@@ -22,20 +27,20 @@ import ./make-test.nix ({ pkgs, ... } :
};
testScript = ''
- startAll;
- $one->waitForUnit("default.target");
- $one->waitForUnit("graphiteWeb.service");
- $one->waitForUnit("graphiteApi.service");
- $one->waitForUnit("graphitePager.service");
- $one->waitForUnit("graphite-beacon.service");
- $one->waitForUnit("carbonCache.service");
- $one->waitForUnit("seyren.service");
+ start_all()
+ one.wait_for_unit("default.target")
+ one.wait_for_unit("graphiteWeb.service")
+ one.wait_for_unit("graphiteApi.service")
+ one.wait_for_unit("graphitePager.service")
+ one.wait_for_unit("graphite-beacon.service")
+ one.wait_for_unit("carbonCache.service")
+ one.wait_for_unit("seyren.service")
# The services above are of type "simple". systemd considers them active immediately
# even if they're still in preStart (which takes quite long for graphiteWeb).
# Wait for ports to open so we're sure the services are up and listening.
- $one->waitForOpenPort(8080);
- $one->waitForOpenPort(2003);
- $one->succeed("echo \"foo 1 `date +%s`\" | nc -N localhost 2003");
- $one->waitUntilSucceeds("curl 'http://localhost:8080/metrics/find/?query=foo&format=treejson' --silent | grep foo >&2");
+ one.wait_for_open_port(8080)
+ one.wait_for_open_port(2003)
+ one.succeed('echo "foo 1 `date +%s`" | nc -N localhost 2003')
+ one.wait_until_succeeds("curl 'http://localhost:8080/metrics/find/?query=foo&format=treejson' --silent | grep foo >&2")
'';
})
diff --git a/nixos/tests/i3wm.nix b/nixos/tests/i3wm.nix
index 126178d118790feb038dda85564fe5ac38c32a97..b527aa706ad2190223dad28834a3263d061fbbbd 100644
--- a/nixos/tests/i3wm.nix
+++ b/nixos/tests/i3wm.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
machine = { lib, ... }: {
imports = [ ./common/x11.nix ./common/user-account.nix ];
- services.xserver.displayManager.auto.user = "alice";
+ test-support.displayManager.auto.user = "alice";
services.xserver.displayManager.defaultSession = lib.mkForce "none+i3";
services.xserver.windowManager.i3.enable = true;
};
diff --git a/nixos/tests/ihatemoney.nix b/nixos/tests/ihatemoney.nix
index 14db17fe5e6768c832763039f5805fa76ad60200..7df0ea0b691fc84df43d0310355cd1660b3b9444 100644
--- a/nixos/tests/ihatemoney.nix
+++ b/nixos/tests/ihatemoney.nix
@@ -1,13 +1,5 @@
-{ system ? builtins.currentSystem
-, config ? {}
-, pkgs ? import ../.. { inherit system config; }
-}:
-
let
- inherit (import ../lib/testing.nix { inherit system pkgs; }) makeTest;
-in
-map (
- backend: makeTest {
+ f = backend: import ./make-test-python.nix ({ pkgs, ... }: {
name = "ihatemoney-${backend}";
machine = { lib, ... }: {
services.ihatemoney = {
@@ -30,23 +22,34 @@ map (
};
};
testScript = ''
- $machine->waitForOpenPort(8000);
- $machine->waitForUnit("uwsgi.service");
- my $return = $machine->succeed("curl -X POST http://localhost:8000/api/projects -d 'name=yay&id=yay&password=yay&contact_email=yay\@example.com'");
- die "wrong project id $return" unless "\"yay\"\n" eq $return;
- my $timestamp = $machine->succeed("stat --printf %Y /var/lib/ihatemoney/secret_key");
- my $owner = $machine->succeed("stat --printf %U:%G /var/lib/ihatemoney/secret_key");
- die "wrong ownership for the secret key: $owner, is uwsgi running as the right user ?" unless $owner eq "ihatemoney:ihatemoney";
- $machine->shutdown();
- $machine->start();
- $machine->waitForOpenPort(8000);
- $machine->waitForUnit("uwsgi.service");
- # check that the database is really persistent
- print $machine->succeed("curl --basic -u yay:yay http://localhost:8000/api/projects/yay");
- # check that the secret key is really persistent
- my $timestamp2 = $machine->succeed("stat --printf %Y /var/lib/ihatemoney/secret_key");
- die unless $timestamp eq $timestamp2;
- $machine->succeed("curl http://localhost:8000 | grep ihatemoney");
+ machine.wait_for_open_port(8000)
+ machine.wait_for_unit("uwsgi.service")
+
+ assert '"yay"' in machine.succeed(
+ "curl -X POST http://localhost:8000/api/projects -d 'name=yay&id=yay&password=yay&contact_email=yay\@example.com'"
+ )
+ owner, timestamp = machine.succeed(
+ "stat --printf %U:%G___%Y /var/lib/ihatemoney/secret_key"
+ ).split("___")
+ assert "ihatemoney:ihatemoney" == owner
+
+ with subtest("Restart machine and service"):
+ machine.shutdown()
+ machine.start()
+ machine.wait_for_open_port(8000)
+ machine.wait_for_unit("uwsgi.service")
+
+ with subtest("check that the database is really persistent"):
+ machine.succeed("curl --basic -u yay:yay http://localhost:8000/api/projects/yay")
+
+ with subtest("check that the secret key is really persistent"):
+ timestamp2 = machine.succeed("stat --printf %Y /var/lib/ihatemoney/secret_key")
+ assert timestamp == timestamp2
+
+ assert "ihatemoney" in machine.succeed("curl http://localhost:8000")
'';
- }
-) [ "sqlite" "postgresql" ]
+ });
+in {
+ ihatemoney-sqlite = f "sqlite";
+ ihatemoney-postgresql = f "postgresql";
+}
diff --git a/nixos/tests/installed-tests/fwupd.nix b/nixos/tests/installed-tests/fwupd.nix
index b9f761e99582e5b9388fe362ed6b0762216408d0..6a0ceb57dda489ccfa2fe6d98f01489bd13d0536 100644
--- a/nixos/tests/installed-tests/fwupd.nix
+++ b/nixos/tests/installed-tests/fwupd.nix
@@ -1,11 +1,11 @@
-{ pkgs, makeInstalledTest, ... }:
+{ pkgs, lib, makeInstalledTest, ... }:
makeInstalledTest {
tested = pkgs.fwupd;
testConfig = {
services.fwupd.enable = true;
- services.fwupd.blacklistPlugins = []; # don't blacklist test plugin
+ services.fwupd.blacklistPlugins = lib.mkForce []; # don't blacklist test plugin
services.fwupd.enableTestRemote = true;
virtualisation.memorySize = 768;
};
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index eb1f4f192dd11db946b94a3bab634cd092c0aab3..983861911e0d3c105359f35cb3011018d05be160 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -3,7 +3,7 @@
pkgs ? import ../.. { inherit system config; }
}:
-with import ../lib/testing.nix { inherit system pkgs; };
+with import ../lib/testing-python.nix { inherit system pkgs; };
with pkgs.lib;
let
@@ -67,161 +67,193 @@ let
, grubIdentifier, preBootCommands, extraConfig
, testCloneConfig
}:
- let
- iface = if grubVersion == 1 then "ide" else "virtio";
- isEfi = bootLoader == "systemd-boot" || (bootLoader == "grub" && grubUseEfi);
-
- # FIXME don't duplicate the -enable-kvm etc. flags here yet again!
- qemuFlags =
- (if system == "x86_64-linux" then "-m 768 " else "-m 512 ") +
- (optionalString (system == "x86_64-linux") "-cpu kvm64 ") +
- (optionalString (system == "aarch64-linux") "-enable-kvm -machine virt,gic-version=host -cpu host ");
-
- hdFlags = ''hda => "vm-state-machine/machine.qcow2", hdaInterface => "${iface}", ''
- + optionalString isEfi (if pkgs.stdenv.isAarch64
- then ''bios => "${pkgs.OVMF.fd}/FV/QEMU_EFI.fd", ''
- else ''bios => "${pkgs.OVMF.fd}/FV/OVMF.fd", '');
+ let iface = if grubVersion == 1 then "ide" else "virtio";
+ isEfi = bootLoader == "systemd-boot" || (bootLoader == "grub" && grubUseEfi);
+ bios = if pkgs.stdenv.isAarch64 then "QEMU_EFI.fd" else "OVMF.fd";
in if !isEfi && !(pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) then
throw "Non-EFI boot methods are only supported on i686 / x86_64"
else ''
+ def assemble_qemu_flags():
+ flags = "-cpu host"
+ ${if system == "x86_64-linux"
+ then ''flags += " -m 768"''
+ else ''flags += " -m 512 -enable-kvm -machine virt,gic-version=host"''
+ }
+ return flags
- $machine->start;
- # Make sure that we get a login prompt etc.
- $machine->succeed("echo hello");
- #$machine->waitForUnit('getty@tty2');
- #$machine->waitForUnit("rogue");
- $machine->waitForUnit("nixos-manual");
+ qemu_flags = {"qemuFlags": assemble_qemu_flags()}
- # Wait for hard disks to appear in /dev
- $machine->succeed("udevadm settle");
+ hd_flags = {
+ "hdaInterface": "${iface}",
+ "hda": "vm-state-machine/machine.qcow2",
+ }
+ ${optionalString isEfi ''
+ hd_flags.update(
+ bios="${pkgs.OVMF.fd}/FV/${bios}"
+ )''
+ }
+ default_flags = {**hd_flags, **qemu_flags}
- # Partition the disk.
- ${createPartitions}
- # Create the NixOS configuration.
- $machine->succeed("nixos-generate-config --root /mnt");
+ def create_machine_named(name):
+ return create_machine({**default_flags, "name": "boot-after-install"})
- $machine->succeed("cat /mnt/etc/nixos/hardware-configuration.nix >&2");
- $machine->copyFileFromHost(
- "${ makeConfig { inherit bootLoader grubVersion grubDevice grubIdentifier grubUseEfi extraConfig; } }",
- "/mnt/etc/nixos/configuration.nix");
+ machine.start()
- # Perform the installation.
- $machine->succeed("nixos-install < /dev/null >&2");
+ with subtest("Assert readiness of login prompt"):
+ machine.succeed("echo hello")
+ machine.wait_for_unit("nixos-manual")
- # Do it again to make sure it's idempotent.
- $machine->succeed("nixos-install < /dev/null >&2");
+ with subtest("Wait for hard disks to appear in /dev"):
+ machine.succeed("udevadm settle")
- $machine->succeed("umount /mnt/boot || true");
- $machine->succeed("umount /mnt");
- $machine->succeed("sync");
+ ${createPartitions}
- $machine->shutdown;
+ with subtest("Create the NixOS configuration"):
+ machine.succeed("nixos-generate-config --root /mnt")
+ machine.succeed("cat /mnt/etc/nixos/hardware-configuration.nix >&2")
+ machine.copy_from_host(
+ "${ makeConfig {
+ inherit bootLoader grubVersion grubDevice grubIdentifier
+ grubUseEfi extraConfig;
+ }
+ }",
+ "/mnt/etc/nixos/configuration.nix",
+ )
+
+ with subtest("Perform the installation"):
+ machine.succeed("nixos-install < /dev/null >&2")
+
+ with subtest("Do it again to make sure it's idempotent"):
+ machine.succeed("nixos-install < /dev/null >&2")
+
+ with subtest("Shutdown system after installation"):
+ machine.succeed("umount /mnt/boot || true")
+ machine.succeed("umount /mnt")
+ machine.succeed("sync")
+ machine.shutdown()
# Now see if we can boot the installation.
- $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}", name => "boot-after-install" });
+ machine = create_machine_named("boot-after-install")
# For example to enter LUKS passphrase.
${preBootCommands}
- # Did /boot get mounted?
- $machine->waitForUnit("local-fs.target");
-
- ${if bootLoader == "grub" then
- ''$machine->succeed("test -e /boot/grub");''
- else
- ''$machine->succeed("test -e /boot/loader/loader.conf");''
- }
-
- # Check whether /root has correct permissions.
- $machine->succeed("stat -c '%a' /root") =~ /700/ or die;
-
- # Did the swap device get activated?
- # uncomment once https://bugs.freedesktop.org/show_bug.cgi?id=86930 is resolved
- $machine->waitForUnit("swap.target");
- $machine->succeed("cat /proc/swaps | grep -q /dev");
-
- # Check that the store is in good shape
- $machine->succeed("nix-store --verify --check-contents >&2");
-
- # Check whether the channel works.
- $machine->succeed("nix-env -iA nixos.procps >&2");
- $machine->succeed("type -tP ps | tee /dev/stderr") =~ /.nix-profile/
- or die "nix-env failed";
-
- # Check that the daemon works, and that non-root users can run builds (this will build a new profile generation through the daemon)
- $machine->succeed("su alice -l -c 'nix-env -iA nixos.procps' >&2");
-
- # We need a writable Nix store on next boot.
- $machine->copyFileFromHost(
- "${ makeConfig { inherit bootLoader grubVersion grubDevice grubIdentifier grubUseEfi extraConfig; forceGrubReinstallCount = 1; } }",
- "/etc/nixos/configuration.nix");
-
- # Check whether nixos-rebuild works.
- $machine->succeed("nixos-rebuild switch >&2");
-
- # Test nixos-option.
- $machine->succeed("nixos-option boot.initrd.kernelModules | grep virtio_console");
- $machine->succeed("nixos-option boot.initrd.kernelModules | grep 'List of modules'");
- $machine->succeed("nixos-option boot.initrd.kernelModules | grep qemu-guest.nix");
-
- $machine->shutdown;
+ with subtest("Assert that /boot get mounted"):
+ machine.wait_for_unit("local-fs.target")
+ ${if bootLoader == "grub"
+ then ''machine.succeed("test -e /boot/grub")''
+ else ''machine.succeed("test -e /boot/loader/loader.conf")''
+ }
+
+ with subtest("Check whether /root has correct permissions"):
+ assert "700" in machine.succeed("stat -c '%a' /root")
+
+ with subtest("Assert swap device got activated"):
+ # uncomment once https://bugs.freedesktop.org/show_bug.cgi?id=86930 is resolved
+ machine.wait_for_unit("swap.target")
+ machine.succeed("cat /proc/swaps | grep -q /dev")
+
+ with subtest("Check that the store is in good shape"):
+ machine.succeed("nix-store --verify --check-contents >&2")
+
+ with subtest("Check whether the channel works"):
+ machine.succeed("nix-env -iA nixos.procps >&2")
+ assert ".nix-profile" in machine.succeed("type -tP ps | tee /dev/stderr")
+
+ with subtest(
+ "Check that the daemon works, and that non-root users can run builds "
+ "(this will build a new profile generation through the daemon)"
+ ):
+ machine.succeed("su alice -l -c 'nix-env -iA nixos.procps' >&2")
+
+ with subtest("Configure system with writable Nix store on next boot"):
+ # we're not using copy_from_host here because the installer image
+ # doesn't know about the host-guest sharing mechanism.
+ machine.copy_from_host_via_shell(
+ "${ makeConfig {
+ inherit bootLoader grubVersion grubDevice grubIdentifier
+ grubUseEfi extraConfig;
+ forceGrubReinstallCount = 1;
+ }
+ }",
+ "/etc/nixos/configuration.nix",
+ )
+
+ with subtest("Check whether nixos-rebuild works"):
+ machine.succeed("nixos-rebuild switch >&2")
+
+ with subtest("Test nixos-option"):
+ kernel_modules = machine.succeed("nixos-option boot.initrd.kernelModules")
+ assert "virtio_console" in kernel_modules
+ assert "List of modules" in kernel_modules
+ assert "qemu-guest.nix" in kernel_modules
+
+ machine.shutdown()
# Check whether a writable store build works
- $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}", name => "rebuild-switch" });
+ machine = create_machine_named("rebuild-switch")
${preBootCommands}
- $machine->waitForUnit("multi-user.target");
- $machine->copyFileFromHost(
- "${ makeConfig { inherit bootLoader grubVersion grubDevice grubIdentifier grubUseEfi extraConfig; forceGrubReinstallCount = 2; } }",
- "/etc/nixos/configuration.nix");
- $machine->succeed("nixos-rebuild boot >&2");
- $machine->shutdown;
+ machine.wait_for_unit("multi-user.target")
+
+ # we're not using copy_from_host here because the installer image
+ # doesn't know about the host-guest sharing mechanism.
+ machine.copy_from_host_via_shell(
+ "${ makeConfig {
+ inherit bootLoader grubVersion grubDevice grubIdentifier
+ grubUseEfi extraConfig;
+ forceGrubReinstallCount = 2;
+ }
+ }",
+ "/etc/nixos/configuration.nix",
+ )
+ machine.succeed("nixos-rebuild boot >&2")
+ machine.shutdown()
# And just to be sure, check that the machine still boots after
# "nixos-rebuild switch".
- $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}", "boot-after-rebuild-switch" });
+ machine = create_machine_named("boot-after-rebuild-switch")
${preBootCommands}
- $machine->waitForUnit("network.target");
- $machine->shutdown;
+ machine.wait_for_unit("network.target")
+ machine.shutdown()
# Tests for validating clone configuration entries in grub menu
- ${optionalString testCloneConfig ''
- # Reboot Machine
- $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}", name => "clone-default-config" });
- ${preBootCommands}
- $machine->waitForUnit("multi-user.target");
-
- # Booted configuration name should be Home
- # This is not the name that shows in the grub menu.
- # The default configuration is always shown as "Default"
- $machine->succeed("cat /run/booted-system/configuration-name >&2");
- $machine->succeed("cat /run/booted-system/configuration-name | grep Home");
+ ''
+ + optionalString testCloneConfig ''
+ # Reboot Machine
+ machine = create_machine_named("clone-default-config")
+ ${preBootCommands}
+ machine.wait_for_unit("multi-user.target")
- # We should find **not** a file named /etc/gitconfig
- $machine->fail("test -e /etc/gitconfig");
+ with subtest("Booted configuration name should be 'Home'"):
+ # This is not the name that shows in the grub menu.
+ # The default configuration is always shown as "Default"
+ machine.succeed("cat /run/booted-system/configuration-name >&2")
+ assert "Home" in machine.succeed("cat /run/booted-system/configuration-name")
- # Set grub to boot the second configuration
- $machine->succeed("grub-reboot 1");
+ with subtest("We should **not** find a file named /etc/gitconfig"):
+ machine.fail("test -e /etc/gitconfig")
- $machine->shutdown;
+ with subtest("Set grub to boot the second configuration"):
+ machine.succeed("grub-reboot 1")
- # Reboot Machine
- $machine = createMachine({ ${hdFlags} qemuFlags => "${qemuFlags}", name => "clone-alternate-config" });
- ${preBootCommands}
+ machine.shutdown()
- $machine->waitForUnit("multi-user.target");
- # Booted configuration name should be Work
- $machine->succeed("cat /run/booted-system/configuration-name >&2");
- $machine->succeed("cat /run/booted-system/configuration-name | grep Work");
+ # Reboot Machine
+ machine = create_machine_named("clone-alternate-config")
+ ${preBootCommands}
- # We should find a file named /etc/gitconfig
- $machine->succeed("test -e /etc/gitconfig");
+ machine.wait_for_unit("multi-user.target")
+ with subtest("Booted configuration name should be Work"):
+ machine.succeed("cat /run/booted-system/configuration-name >&2")
+ assert "Work" in machine.succeed("cat /run/booted-system/configuration-name")
- $machine->shutdown;
- ''}
+ with subtest("We should find a file named /etc/gitconfig"):
+ machine.succeed("test -e /etc/gitconfig")
+ machine.shutdown()
'';
@@ -243,63 +275,63 @@ let
nodes = {
# The configuration of the machine used to run "nixos-install".
- machine =
- { pkgs, ... }:
-
- { imports =
- [ ../modules/profiles/installation-device.nix
- ../modules/profiles/base.nix
- extraInstallerConfig
- ];
-
- virtualisation.diskSize = 8 * 1024;
- virtualisation.memorySize = 1024;
-
- # Use a small /dev/vdb as the root disk for the
- # installer. This ensures the target disk (/dev/vda) is
- # the same during and after installation.
- virtualisation.emptyDiskImages = [ 512 ];
- virtualisation.bootDevice =
- if grubVersion == 1 then "/dev/sdb" else "/dev/vdb";
- virtualisation.qemu.diskInterface =
- if grubVersion == 1 then "scsi" else "virtio";
-
- boot.loader.systemd-boot.enable = mkIf (bootLoader == "systemd-boot") true;
-
- hardware.enableAllFirmware = mkForce false;
-
- # The test cannot access the network, so any packages we
- # need must be included in the VM.
- system.extraDependencies = with pkgs;
- [ sudo
- libxml2.bin
- libxslt.bin
- desktop-file-utils
- docbook5
- docbook_xsl_ns
- unionfs-fuse
- ntp
- nixos-artwork.wallpapers.simple-dark-gray-bottom
- perlPackages.XMLLibXML
- perlPackages.ListCompare
- shared-mime-info
- texinfo
- xorg.lndir
-
- # add curl so that rather than seeing the test attempt to download
- # curl's tarball, we see what it's trying to download
- curl
- ]
- ++ optional (bootLoader == "grub" && grubVersion == 1) pkgs.grub
- ++ optionals (bootLoader == "grub" && grubVersion == 2) [ pkgs.grub2 pkgs.grub2_efi ];
-
- nix.binaryCaches = mkForce [ ];
- nix.extraOptions =
- ''
- hashed-mirrors =
- connect-timeout = 1
- '';
- };
+ machine = { pkgs, ... }: {
+ imports = [
+ ../modules/profiles/installation-device.nix
+ ../modules/profiles/base.nix
+ extraInstallerConfig
+ ];
+
+ virtualisation.diskSize = 8 * 1024;
+ virtualisation.memorySize = 1024;
+
+ # Use a small /dev/vdb as the root disk for the
+ # installer. This ensures the target disk (/dev/vda) is
+ # the same during and after installation.
+ virtualisation.emptyDiskImages = [ 512 ];
+ virtualisation.bootDevice =
+ if grubVersion == 1 then "/dev/sdb" else "/dev/vdb";
+ virtualisation.qemu.diskInterface =
+ if grubVersion == 1 then "scsi" else "virtio";
+
+ boot.loader.systemd-boot.enable = mkIf (bootLoader == "systemd-boot") true;
+
+ hardware.enableAllFirmware = mkForce false;
+
+ # The test cannot access the network, so any packages we
+ # need must be included in the VM.
+ system.extraDependencies = with pkgs; [
+ desktop-file-utils
+ docbook5
+ docbook_xsl_ns
+ libxml2.bin
+ libxslt.bin
+ nixos-artwork.wallpapers.simple-dark-gray-bottom
+ ntp
+ perlPackages.ListCompare
+ perlPackages.XMLLibXML
+ shared-mime-info
+ sudo
+ texinfo
+ unionfs-fuse
+ xorg.lndir
+
+ # add curl so that rather than seeing the test attempt to download
+ # curl's tarball, we see what it's trying to download
+ curl
+ ]
+ ++ optional (bootLoader == "grub" && grubVersion == 1) pkgs.grub
+ ++ optionals (bootLoader == "grub" && grubVersion == 2) [
+ pkgs.grub2
+ pkgs.grub2_efi
+ ];
+
+ nix.binaryCaches = mkForce [ ];
+ nix.extraOptions = ''
+ hashed-mirrors =
+ connect-timeout = 1
+ '';
+ };
};
@@ -310,13 +342,13 @@ let
};
};
- makeLuksRootTest = name: luksFormatOpts: makeInstallerTest name
- { createPartitions = ''
- $machine->succeed(
+ makeLuksRootTest = name: luksFormatOpts: makeInstallerTest name {
+ createPartitions = ''
+ machine.succeed(
"flock /dev/vda parted --script /dev/vda -- mklabel msdos"
- . " mkpart primary ext2 1M 50MB" # /boot
- . " mkpart primary linux-swap 50M 1024M"
- . " mkpart primary 1024M -1s", # LUKS
+ + " mkpart primary ext2 1M 50MB" # /boot
+ + " mkpart primary linux-swap 50M 1024M"
+ + " mkpart primary 1024M -1s", # LUKS
"udevadm settle",
"mkswap /dev/vda2 -L swap",
"swapon -L swap",
@@ -328,77 +360,74 @@ let
"mkfs.ext3 -L boot /dev/vda1",
"mkdir -p /mnt/boot",
"mount LABEL=boot /mnt/boot",
- );
- '';
- extraConfig = ''
- boot.kernelParams = lib.mkAfter [ "console=tty0" ];
- '';
- enableOCR = true;
- preBootCommands = ''
- $machine->start;
- $machine->waitForText(qr/Passphrase for/);
- $machine->sendChars("supersecret\n");
- '';
- };
+ )
+ '';
+ extraConfig = ''
+ boot.kernelParams = lib.mkAfter [ "console=tty0" ];
+ '';
+ enableOCR = true;
+ preBootCommands = ''
+ machine.start()
+ machine.wait_for_text("Passphrase for")
+ machine.send_chars("supersecret\n")
+ '';
+ };
# The (almost) simplest partitioning scheme: a swap partition and
# one big filesystem partition.
- simple-test-config = { createPartitions =
- ''
- $machine->succeed(
- "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
- . " mkpart primary linux-swap 1M 1024M"
- . " mkpart primary ext2 1024M -1s",
- "udevadm settle",
- "mkswap /dev/vda1 -L swap",
- "swapon -L swap",
- "mkfs.ext3 -L nixos /dev/vda2",
- "mount LABEL=nixos /mnt",
- );
- '';
- };
-
- simple-uefi-grub-config =
- { createPartitions =
- ''
- $machine->succeed(
- "flock /dev/vda parted --script /dev/vda -- mklabel gpt"
- . " mkpart ESP fat32 1M 50MiB" # /boot
- . " set 1 boot on"
- . " mkpart primary linux-swap 50MiB 1024MiB"
- . " mkpart primary ext2 1024MiB -1MiB", # /
- "udevadm settle",
- "mkswap /dev/vda2 -L swap",
- "swapon -L swap",
- "mkfs.ext3 -L nixos /dev/vda3",
- "mount LABEL=nixos /mnt",
- "mkfs.vfat -n BOOT /dev/vda1",
- "mkdir -p /mnt/boot",
- "mount LABEL=BOOT /mnt/boot",
- );
- '';
- bootLoader = "grub";
- grubUseEfi = true;
- };
+ simple-test-config = {
+ createPartitions = ''
+ machine.succeed(
+ "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+ + " mkpart primary linux-swap 1M 1024M"
+ + " mkpart primary ext2 1024M -1s",
+ "udevadm settle",
+ "mkswap /dev/vda1 -L swap",
+ "swapon -L swap",
+ "mkfs.ext3 -L nixos /dev/vda2",
+ "mount LABEL=nixos /mnt",
+ )
+ '';
+ };
+
+ simple-uefi-grub-config = {
+ createPartitions = ''
+ machine.succeed(
+ "flock /dev/vda parted --script /dev/vda -- mklabel gpt"
+ + " mkpart ESP fat32 1M 50MiB" # /boot
+ + " set 1 boot on"
+ + " mkpart primary linux-swap 50MiB 1024MiB"
+ + " mkpart primary ext2 1024MiB -1MiB", # /
+ "udevadm settle",
+ "mkswap /dev/vda2 -L swap",
+ "swapon -L swap",
+ "mkfs.ext3 -L nixos /dev/vda3",
+ "mount LABEL=nixos /mnt",
+ "mkfs.vfat -n BOOT /dev/vda1",
+ "mkdir -p /mnt/boot",
+ "mount LABEL=BOOT /mnt/boot",
+ )
+ '';
+ bootLoader = "grub";
+ grubUseEfi = true;
+ };
- clone-test-extraconfig = { extraConfig =
- ''
- environment.systemPackages = [ pkgs.grub2 ];
- boot.loader.grub.configurationName = "Home";
- nesting.clone = [
- {
- boot.loader.grub.configurationName = lib.mkForce "Work";
-
- environment.etc = {
- "gitconfig".text = "
- [core]
- gitproxy = none for work.com
- ";
- };
- }
- ];
- '';
- testCloneConfig = true;
+ clone-test-extraconfig = {
+ extraConfig = ''
+ environment.systemPackages = [ pkgs.grub2 ];
+ boot.loader.grub.configurationName = "Home";
+ nesting.clone = [ {
+ boot.loader.grub.configurationName = lib.mkForce "Work";
+
+ environment.etc = {
+ "gitconfig".text = "
+ [core]
+ gitproxy = none for work.com
+ ";
+ };
+ } ];
+ '';
+ testCloneConfig = true;
};
@@ -415,27 +444,26 @@ in {
simpleClone = makeInstallerTest "simpleClone" (simple-test-config // clone-test-extraconfig);
# Simple GPT/UEFI configuration using systemd-boot with 3 partitions: ESP, swap & root filesystem
- simpleUefiSystemdBoot = makeInstallerTest "simpleUefiSystemdBoot"
- { createPartitions =
- ''
- $machine->succeed(
- "flock /dev/vda parted --script /dev/vda -- mklabel gpt"
- . " mkpart ESP fat32 1M 50MiB" # /boot
- . " set 1 boot on"
- . " mkpart primary linux-swap 50MiB 1024MiB"
- . " mkpart primary ext2 1024MiB -1MiB", # /
- "udevadm settle",
- "mkswap /dev/vda2 -L swap",
- "swapon -L swap",
- "mkfs.ext3 -L nixos /dev/vda3",
- "mount LABEL=nixos /mnt",
- "mkfs.vfat -n BOOT /dev/vda1",
- "mkdir -p /mnt/boot",
- "mount LABEL=BOOT /mnt/boot",
- );
- '';
- bootLoader = "systemd-boot";
- };
+ simpleUefiSystemdBoot = makeInstallerTest "simpleUefiSystemdBoot" {
+ createPartitions = ''
+ machine.succeed(
+ "flock /dev/vda parted --script /dev/vda -- mklabel gpt"
+ + " mkpart ESP fat32 1M 50MiB" # /boot
+ + " set 1 boot on"
+ + " mkpart primary linux-swap 50MiB 1024MiB"
+ + " mkpart primary ext2 1024MiB -1MiB", # /
+ "udevadm settle",
+ "mkswap /dev/vda2 -L swap",
+ "swapon -L swap",
+ "mkfs.ext3 -L nixos /dev/vda3",
+ "mount LABEL=nixos /mnt",
+ "mkfs.vfat -n BOOT /dev/vda1",
+ "mkdir -p /mnt/boot",
+ "mount LABEL=BOOT /mnt/boot",
+ )
+ '';
+ bootLoader = "systemd-boot";
+ };
simpleUefiGrub = makeInstallerTest "simpleUefiGrub" simple-uefi-grub-config;
@@ -443,107 +471,99 @@ in {
simpleUefiGrubClone = makeInstallerTest "simpleUefiGrubClone" (simple-uefi-grub-config // clone-test-extraconfig);
# Same as the previous, but now with a separate /boot partition.
- separateBoot = makeInstallerTest "separateBoot"
- { createPartitions =
- ''
- $machine->succeed(
- "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
- . " mkpart primary ext2 1M 50MB" # /boot
- . " mkpart primary linux-swap 50MB 1024M"
- . " mkpart primary ext2 1024M -1s", # /
- "udevadm settle",
- "mkswap /dev/vda2 -L swap",
- "swapon -L swap",
- "mkfs.ext3 -L nixos /dev/vda3",
- "mount LABEL=nixos /mnt",
- "mkfs.ext3 -L boot /dev/vda1",
- "mkdir -p /mnt/boot",
- "mount LABEL=boot /mnt/boot",
- );
- '';
- };
+ separateBoot = makeInstallerTest "separateBoot" {
+ createPartitions = ''
+ machine.succeed(
+ "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+ + " mkpart primary ext2 1M 50MB" # /boot
+ + " mkpart primary linux-swap 50MB 1024M"
+ + " mkpart primary ext2 1024M -1s", # /
+ "udevadm settle",
+ "mkswap /dev/vda2 -L swap",
+ "swapon -L swap",
+ "mkfs.ext3 -L nixos /dev/vda3",
+ "mount LABEL=nixos /mnt",
+ "mkfs.ext3 -L boot /dev/vda1",
+ "mkdir -p /mnt/boot",
+ "mount LABEL=boot /mnt/boot",
+ )
+ '';
+ };
# Same as the previous, but with fat32 /boot.
- separateBootFat = makeInstallerTest "separateBootFat"
- { createPartitions =
- ''
- $machine->succeed(
- "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
- . " mkpart primary ext2 1M 50MB" # /boot
- . " mkpart primary linux-swap 50MB 1024M"
- . " mkpart primary ext2 1024M -1s", # /
- "udevadm settle",
- "mkswap /dev/vda2 -L swap",
- "swapon -L swap",
- "mkfs.ext3 -L nixos /dev/vda3",
- "mount LABEL=nixos /mnt",
- "mkfs.vfat -n BOOT /dev/vda1",
- "mkdir -p /mnt/boot",
- "mount LABEL=BOOT /mnt/boot",
- );
- '';
- };
+ separateBootFat = makeInstallerTest "separateBootFat" {
+ createPartitions = ''
+ machine.succeed(
+ "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+ + " mkpart primary ext2 1M 50MB" # /boot
+ + " mkpart primary linux-swap 50MB 1024M"
+ + " mkpart primary ext2 1024M -1s", # /
+ "udevadm settle",
+ "mkswap /dev/vda2 -L swap",
+ "swapon -L swap",
+ "mkfs.ext3 -L nixos /dev/vda3",
+ "mount LABEL=nixos /mnt",
+ "mkfs.vfat -n BOOT /dev/vda1",
+ "mkdir -p /mnt/boot",
+ "mount LABEL=BOOT /mnt/boot",
+ )
+ '';
+ };
# zfs on / with swap
- zfsroot = makeInstallerTest "zfs-root"
- {
- extraInstallerConfig = {
- boot.supportedFilesystems = [ "zfs" ];
- };
-
- extraConfig = ''
- boot.supportedFilesystems = [ "zfs" ];
-
- # Using by-uuid overrides the default of by-id, and is unique
- # to the qemu disks, as they don't produce by-id paths for
- # some reason.
- boot.zfs.devNodes = "/dev/disk/by-uuid/";
- networking.hostId = "00000000";
- '';
-
- createPartitions =
- ''
- $machine->succeed(
- "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
- . " mkpart primary linux-swap 1M 1024M"
- . " mkpart primary 1024M -1s",
- "udevadm settle",
+ zfsroot = makeInstallerTest "zfs-root" {
+ extraInstallerConfig = {
+ boot.supportedFilesystems = [ "zfs" ];
+ };
- "mkswap /dev/vda1 -L swap",
- "swapon -L swap",
+ extraConfig = ''
+ boot.supportedFilesystems = [ "zfs" ];
- "zpool create rpool /dev/vda2",
- "zfs create -o mountpoint=legacy rpool/root",
- "mount -t zfs rpool/root /mnt",
+ # Using by-uuid overrides the default of by-id, and is unique
+ # to the qemu disks, as they don't produce by-id paths for
+ # some reason.
+ boot.zfs.devNodes = "/dev/disk/by-uuid/";
+ networking.hostId = "00000000";
+ '';
- "udevadm settle"
- );
- '';
- };
+ createPartitions = ''
+ machine.succeed(
+ "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+ + " mkpart primary linux-swap 1M 1024M"
+ + " mkpart primary 1024M -1s",
+ "udevadm settle",
+ "mkswap /dev/vda1 -L swap",
+ "swapon -L swap",
+ "zpool create rpool /dev/vda2",
+ "zfs create -o mountpoint=legacy rpool/root",
+ "mount -t zfs rpool/root /mnt",
+ "udevadm settle",
+ )
+ '';
+ };
# Create two physical LVM partitions combined into one volume group
# that contains the logical swap and root partitions.
- lvm = makeInstallerTest "lvm"
- { createPartitions =
- ''
- $machine->succeed(
- "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
- . " mkpart primary 1M 2048M" # PV1
- . " set 1 lvm on"
- . " mkpart primary 2048M -1s" # PV2
- . " set 2 lvm on",
- "udevadm settle",
- "pvcreate /dev/vda1 /dev/vda2",
- "vgcreate MyVolGroup /dev/vda1 /dev/vda2",
- "lvcreate --size 1G --name swap MyVolGroup",
- "lvcreate --size 2G --name nixos MyVolGroup",
- "mkswap -f /dev/MyVolGroup/swap -L swap",
- "swapon -L swap",
- "mkfs.xfs -L nixos /dev/MyVolGroup/nixos",
- "mount LABEL=nixos /mnt",
- );
- '';
- };
+ lvm = makeInstallerTest "lvm" {
+ createPartitions = ''
+ machine.succeed(
+ "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+ + " mkpart primary 1M 2048M" # PV1
+ + " set 1 lvm on"
+ + " mkpart primary 2048M -1s" # PV2
+ + " set 2 lvm on",
+ "udevadm settle",
+ "pvcreate /dev/vda1 /dev/vda2",
+ "vgcreate MyVolGroup /dev/vda1 /dev/vda2",
+ "lvcreate --size 1G --name swap MyVolGroup",
+ "lvcreate --size 2G --name nixos MyVolGroup",
+ "mkswap -f /dev/MyVolGroup/swap -L swap",
+ "swapon -L swap",
+ "mkfs.xfs -L nixos /dev/MyVolGroup/nixos",
+ "mount LABEL=nixos /mnt",
+ )
+ '';
+ };
# Boot off an encrypted root partition with the default LUKS header format
luksroot = makeLuksRootTest "luksroot-format1" "";
@@ -557,14 +577,14 @@ in {
# Test whether opening encrypted filesystem with keyfile
# Checks for regression of missing cryptsetup, when no luks device without
# keyfile is configured
- encryptedFSWithKeyfile = makeInstallerTest "encryptedFSWithKeyfile"
- { createPartitions = ''
- $machine->succeed(
+ encryptedFSWithKeyfile = makeInstallerTest "encryptedFSWithKeyfile" {
+ createPartitions = ''
+ machine.succeed(
"flock /dev/vda parted --script /dev/vda -- mklabel msdos"
- . " mkpart primary ext2 1M 50MB" # /boot
- . " mkpart primary linux-swap 50M 1024M"
- . " mkpart primary 1024M 1280M" # LUKS with keyfile
- . " mkpart primary 1280M -1s",
+ + " mkpart primary ext2 1M 50MB" # /boot
+ + " mkpart primary linux-swap 50M 1024M"
+ + " mkpart primary 1024M 1280M" # LUKS with keyfile
+ + " mkpart primary 1280M -1s",
"udevadm settle",
"mkswap /dev/vda2 -L swap",
"swapon -L swap",
@@ -579,89 +599,88 @@ in {
"cryptsetup luksOpen --key-file /mnt/keyfile /dev/vda3 crypt",
"mkfs.ext3 -L test /dev/mapper/crypt",
"cryptsetup luksClose crypt",
- "mkdir -p /mnt/test"
- );
- '';
- extraConfig = ''
- fileSystems."/test" =
- { device = "/dev/disk/by-label/test";
- fsType = "ext3";
- encrypted.enable = true;
- encrypted.blkDev = "/dev/vda3";
- encrypted.label = "crypt";
- encrypted.keyFile = "/mnt-root/keyfile";
- };
- '';
- };
-
+ "mkdir -p /mnt/test",
+ )
+ '';
+ extraConfig = ''
+ fileSystems."/test" = {
+ device = "/dev/disk/by-label/test";
+ fsType = "ext3";
+ encrypted.enable = true;
+ encrypted.blkDev = "/dev/vda3";
+ encrypted.label = "crypt";
+ encrypted.keyFile = "/mnt-root/keyfile";
+ };
+ '';
+ };
- swraid = makeInstallerTest "swraid"
- { createPartitions =
- ''
- $machine->succeed(
- "flock /dev/vda parted --script /dev/vda --"
- . " mklabel msdos"
- . " mkpart primary ext2 1M 100MB" # /boot
- . " mkpart extended 100M -1s"
- . " mkpart logical 102M 2102M" # md0 (root), first device
- . " mkpart logical 2103M 4103M" # md0 (root), second device
- . " mkpart logical 4104M 4360M" # md1 (swap), first device
- . " mkpart logical 4361M 4617M", # md1 (swap), second device
- "udevadm settle",
- "ls -l /dev/vda* >&2",
- "cat /proc/partitions >&2",
- "udevadm control --stop-exec-queue",
- "mdadm --create --force /dev/md0 --metadata 1.2 --level=raid1 --raid-devices=2 /dev/vda5 /dev/vda6",
- "mdadm --create --force /dev/md1 --metadata 1.2 --level=raid1 --raid-devices=2 /dev/vda7 /dev/vda8",
- "udevadm control --start-exec-queue",
- "udevadm settle",
- "mkswap -f /dev/md1 -L swap",
- "swapon -L swap",
- "mkfs.ext3 -L nixos /dev/md0",
- "mount LABEL=nixos /mnt",
- "mkfs.ext3 -L boot /dev/vda1",
- "mkdir /mnt/boot",
- "mount LABEL=boot /mnt/boot",
- "udevadm settle",
- );
- '';
- preBootCommands = ''
- $machine->start;
- $machine->fail("dmesg | grep 'immediate safe mode'");
- '';
- };
+ swraid = makeInstallerTest "swraid" {
+ createPartitions = ''
+ machine.succeed(
+ "flock /dev/vda parted --script /dev/vda --"
+ + " mklabel msdos"
+ + " mkpart primary ext2 1M 100MB" # /boot
+ + " mkpart extended 100M -1s"
+ + " mkpart logical 102M 2102M" # md0 (root), first device
+ + " mkpart logical 2103M 4103M" # md0 (root), second device
+ + " mkpart logical 4104M 4360M" # md1 (swap), first device
+ + " mkpart logical 4361M 4617M", # md1 (swap), second device
+ "udevadm settle",
+ "ls -l /dev/vda* >&2",
+ "cat /proc/partitions >&2",
+ "udevadm control --stop-exec-queue",
+ "mdadm --create --force /dev/md0 --metadata 1.2 --level=raid1 "
+ + "--raid-devices=2 /dev/vda5 /dev/vda6",
+ "mdadm --create --force /dev/md1 --metadata 1.2 --level=raid1 "
+ + "--raid-devices=2 /dev/vda7 /dev/vda8",
+ "udevadm control --start-exec-queue",
+ "udevadm settle",
+ "mkswap -f /dev/md1 -L swap",
+ "swapon -L swap",
+ "mkfs.ext3 -L nixos /dev/md0",
+ "mount LABEL=nixos /mnt",
+ "mkfs.ext3 -L boot /dev/vda1",
+ "mkdir /mnt/boot",
+ "mount LABEL=boot /mnt/boot",
+ "udevadm settle",
+ )
+ '';
+ preBootCommands = ''
+ machine.start()
+ machine.fail("dmesg | grep 'immediate safe mode'")
+ '';
+ };
# Test a basic install using GRUB 1.
- grub1 = makeInstallerTest "grub1"
- { createPartitions =
- ''
- $machine->succeed(
- "flock /dev/sda parted --script /dev/sda -- mklabel msdos"
- . " mkpart primary linux-swap 1M 1024M"
- . " mkpart primary ext2 1024M -1s",
- "udevadm settle",
- "mkswap /dev/sda1 -L swap",
- "swapon -L swap",
- "mkfs.ext3 -L nixos /dev/sda2",
- "mount LABEL=nixos /mnt",
- "mkdir -p /mnt/tmp",
- );
- '';
- grubVersion = 1;
- grubDevice = "/dev/sda";
- };
+ grub1 = makeInstallerTest "grub1" {
+ createPartitions = ''
+ machine.succeed(
+ "flock /dev/sda parted --script /dev/sda -- mklabel msdos"
+ + " mkpart primary linux-swap 1M 1024M"
+ + " mkpart primary ext2 1024M -1s",
+ "udevadm settle",
+ "mkswap /dev/sda1 -L swap",
+ "swapon -L swap",
+ "mkfs.ext3 -L nixos /dev/sda2",
+ "mount LABEL=nixos /mnt",
+ "mkdir -p /mnt/tmp",
+ )
+ '';
+ grubVersion = 1;
+ grubDevice = "/dev/sda";
+ };
# Test using labels to identify volumes in grub
simpleLabels = makeInstallerTest "simpleLabels" {
createPartitions = ''
- $machine->succeed(
- "sgdisk -Z /dev/vda",
- "sgdisk -n 1:0:+1M -n 2:0:+1G -N 3 -t 1:ef02 -t 2:8200 -t 3:8300 -c 3:root /dev/vda",
- "mkswap /dev/vda2 -L swap",
- "swapon -L swap",
- "mkfs.ext4 -L root /dev/vda3",
- "mount LABEL=root /mnt",
- );
+ machine.succeed(
+ "sgdisk -Z /dev/vda",
+ "sgdisk -n 1:0:+1M -n 2:0:+1G -N 3 -t 1:ef02 -t 2:8200 -t 3:8300 -c 3:root /dev/vda",
+ "mkswap /dev/vda2 -L swap",
+ "swapon -L swap",
+ "mkfs.ext4 -L root /dev/vda3",
+ "mount LABEL=root /mnt",
+ )
'';
grubIdentifier = "label";
};
@@ -670,22 +689,23 @@ in {
# TODO: Fix udev so the symlinks are unneeded in /dev/disks
simpleProvided = makeInstallerTest "simpleProvided" {
createPartitions = ''
- my $UUID = "\$(blkid -s UUID -o value /dev/vda2)";
- $machine->succeed(
- "sgdisk -Z /dev/vda",
- "sgdisk -n 1:0:+1M -n 2:0:+100M -n 3:0:+1G -N 4 -t 1:ef02 -t 2:8300 -t 3:8200 -t 4:8300 -c 2:boot -c 4:root /dev/vda",
- "mkswap /dev/vda3 -L swap",
- "swapon -L swap",
- "mkfs.ext4 -L boot /dev/vda2",
- "mkfs.ext4 -L root /dev/vda4",
- );
- $machine->execute("ln -s ../../vda2 /dev/disk/by-uuid/$UUID");
- $machine->execute("ln -s ../../vda4 /dev/disk/by-label/root");
- $machine->succeed(
- "mount /dev/disk/by-label/root /mnt",
- "mkdir /mnt/boot",
- "mount /dev/disk/by-uuid/$UUID /mnt/boot"
- );
+ uuid = "$(blkid -s UUID -o value /dev/vda2)"
+ machine.succeed(
+ "sgdisk -Z /dev/vda",
+ "sgdisk -n 1:0:+1M -n 2:0:+100M -n 3:0:+1G -N 4 -t 1:ef02 -t 2:8300 "
+ + "-t 3:8200 -t 4:8300 -c 2:boot -c 4:root /dev/vda",
+ "mkswap /dev/vda3 -L swap",
+ "swapon -L swap",
+ "mkfs.ext4 -L boot /dev/vda2",
+ "mkfs.ext4 -L root /dev/vda4",
+ )
+ machine.execute(f"ln -s ../../vda2 /dev/disk/by-uuid/{uuid}")
+ machine.execute("ln -s ../../vda4 /dev/disk/by-label/root")
+ machine.succeed(
+ "mount /dev/disk/by-label/root /mnt",
+ "mkdir /mnt/boot",
+ f"mount /dev/disk/by-uuid/{uuid} /mnt/boot",
+ )
'';
grubIdentifier = "provided";
};
@@ -693,61 +713,62 @@ in {
# Simple btrfs grub testing
btrfsSimple = makeInstallerTest "btrfsSimple" {
createPartitions = ''
- $machine->succeed(
- "sgdisk -Z /dev/vda",
- "sgdisk -n 1:0:+1M -n 2:0:+1G -N 3 -t 1:ef02 -t 2:8200 -t 3:8300 -c 3:root /dev/vda",
- "mkswap /dev/vda2 -L swap",
- "swapon -L swap",
- "mkfs.btrfs -L root /dev/vda3",
- "mount LABEL=root /mnt",
- );
+ machine.succeed(
+ "sgdisk -Z /dev/vda",
+ "sgdisk -n 1:0:+1M -n 2:0:+1G -N 3 -t 1:ef02 -t 2:8200 -t 3:8300 -c 3:root /dev/vda",
+ "mkswap /dev/vda2 -L swap",
+ "swapon -L swap",
+ "mkfs.btrfs -L root /dev/vda3",
+ "mount LABEL=root /mnt",
+ )
'';
};
# Test to see if we can detect /boot and /nix on subvolumes
btrfsSubvols = makeInstallerTest "btrfsSubvols" {
createPartitions = ''
- $machine->succeed(
- "sgdisk -Z /dev/vda",
- "sgdisk -n 1:0:+1M -n 2:0:+1G -N 3 -t 1:ef02 -t 2:8200 -t 3:8300 -c 3:root /dev/vda",
- "mkswap /dev/vda2 -L swap",
- "swapon -L swap",
- "mkfs.btrfs -L root /dev/vda3",
- "btrfs device scan",
- "mount LABEL=root /mnt",
- "btrfs subvol create /mnt/boot",
- "btrfs subvol create /mnt/nixos",
- "btrfs subvol create /mnt/nixos/default",
- "umount /mnt",
- "mount -o defaults,subvol=nixos/default LABEL=root /mnt",
- "mkdir /mnt/boot",
- "mount -o defaults,subvol=boot LABEL=root /mnt/boot",
- );
+ machine.succeed(
+ "sgdisk -Z /dev/vda",
+ "sgdisk -n 1:0:+1M -n 2:0:+1G -N 3 -t 1:ef02 -t 2:8200 -t 3:8300 -c 3:root /dev/vda",
+ "mkswap /dev/vda2 -L swap",
+ "swapon -L swap",
+ "mkfs.btrfs -L root /dev/vda3",
+ "btrfs device scan",
+ "mount LABEL=root /mnt",
+ "btrfs subvol create /mnt/boot",
+ "btrfs subvol create /mnt/nixos",
+ "btrfs subvol create /mnt/nixos/default",
+ "umount /mnt",
+ "mount -o defaults,subvol=nixos/default LABEL=root /mnt",
+ "mkdir /mnt/boot",
+ "mount -o defaults,subvol=boot LABEL=root /mnt/boot",
+ )
'';
};
# Test to see if we can detect default and aux subvolumes correctly
btrfsSubvolDefault = makeInstallerTest "btrfsSubvolDefault" {
createPartitions = ''
- $machine->succeed(
- "sgdisk -Z /dev/vda",
- "sgdisk -n 1:0:+1M -n 2:0:+1G -N 3 -t 1:ef02 -t 2:8200 -t 3:8300 -c 3:root /dev/vda",
- "mkswap /dev/vda2 -L swap",
- "swapon -L swap",
- "mkfs.btrfs -L root /dev/vda3",
- "btrfs device scan",
- "mount LABEL=root /mnt",
- "btrfs subvol create /mnt/badpath",
- "btrfs subvol create /mnt/badpath/boot",
- "btrfs subvol create /mnt/nixos",
- "btrfs subvol set-default \$(btrfs subvol list /mnt | grep 'nixos' | awk '{print \$2}') /mnt",
- "umount /mnt",
- "mount -o defaults LABEL=root /mnt",
- "mkdir -p /mnt/badpath/boot", # Help ensure the detection mechanism is actually looking up subvolumes
- "mkdir /mnt/boot",
- "mount -o defaults,subvol=badpath/boot LABEL=root /mnt/boot",
- );
+ machine.succeed(
+ "sgdisk -Z /dev/vda",
+ "sgdisk -n 1:0:+1M -n 2:0:+1G -N 3 -t 1:ef02 -t 2:8200 -t 3:8300 -c 3:root /dev/vda",
+ "mkswap /dev/vda2 -L swap",
+ "swapon -L swap",
+ "mkfs.btrfs -L root /dev/vda3",
+ "btrfs device scan",
+ "mount LABEL=root /mnt",
+ "btrfs subvol create /mnt/badpath",
+ "btrfs subvol create /mnt/badpath/boot",
+ "btrfs subvol create /mnt/nixos",
+ "btrfs subvol set-default "
+ + "$(btrfs subvol list /mnt | grep 'nixos' | awk '{print \$2}') /mnt",
+ "umount /mnt",
+ "mount -o defaults LABEL=root /mnt",
+ "mkdir -p /mnt/badpath/boot", # Help ensure the detection mechanism
+ # is actually looking up subvolumes
+ "mkdir /mnt/boot",
+ "mount -o defaults,subvol=badpath/boot LABEL=root /mnt/boot",
+ )
'';
};
-
}
diff --git a/nixos/tests/keymap.nix b/nixos/tests/keymap.nix
index 2b4c1ab7b052920690c866d31cb07f03c67b7982..09d5d2a6c9e140cf2c8a5267383064b8d5eb8df4 100644
--- a/nixos/tests/keymap.nix
+++ b/nixos/tests/keymap.nix
@@ -3,14 +3,13 @@
pkgs ? import ../.. { inherit system config; }
}:
-with import ../lib/testing.nix { inherit system pkgs; };
+with import ../lib/testing-python.nix { inherit system pkgs; };
let
readyFile = "/tmp/readerReady";
resultFile = "/tmp/readerResult";
testReader = pkgs.writeScript "test-input-reader" ''
- #!${pkgs.stdenv.shell}
rm -f ${resultFile} ${resultFile}.tmp
logger "testReader: START: Waiting for $1 characters, expecting '$2'."
touch ${readyFile}
@@ -27,56 +26,75 @@ let
'';
- mkKeyboardTest = layout: { extraConfig ? {}, tests }: with pkgs.lib; let
- combinedTests = foldAttrs (acc: val: acc ++ val) [] (builtins.attrValues tests);
- perlStr = val: "'${escape ["'" "\\"] val}'";
- lq = length combinedTests.qwerty;
- le = length combinedTests.expect;
- msg = "length mismatch between qwerty (${toString lq}) and expect (${toString le}) lists!";
- send = concatMapStringsSep ", " perlStr combinedTests.qwerty;
- expect = if (lq == le) then concatStrings combinedTests.expect else throw msg;
-
- in makeTest {
+ mkKeyboardTest = layout: { extraConfig ? {}, tests }: with pkgs.lib; makeTest {
name = "keymap-${layout}";
+ machine.console.keyMap = mkOverride 900 layout;
machine.services.xserver.desktopManager.xterm.enable = false;
- machine.i18n.consoleKeyMap = mkOverride 900 layout;
machine.services.xserver.layout = mkOverride 900 layout;
machine.imports = [ ./common/x11.nix extraConfig ];
testScript = ''
-
- sub mkTest ($$) {
- my ($desc, $cmd) = @_;
-
- subtest $desc, sub {
- # prepare and start testReader
- $machine->execute("rm -f ${readyFile} ${resultFile}");
- $machine->succeed("$cmd ${testReader} ${toString le} ".q(${escapeShellArg expect} & ));
-
- if ($desc eq "Xorg keymap") {
- # make sure the xterm window is open and has focus
- $machine->waitForWindow(qr/testterm/);
- $machine->waitUntilSucceeds("${pkgs.xdotool}/bin/xdotool search --sync --onlyvisible --class testterm windowfocus --sync");
- }
-
- # wait for reader to be ready
- $machine->waitForFile("${readyFile}");
- $machine->sleep(1);
-
- # send all keys
- foreach ((${send})) { $machine->sendKeys($_); };
-
- # wait for result and check
- $machine->waitForFile("${resultFile}");
- $machine->succeed("grep -q 'PASS:' ${resultFile}");
- };
- };
-
- $machine->waitForX;
-
- mkTest "VT keymap", "openvt -sw --";
- mkTest "Xorg keymap", "DISPLAY=:0 xterm -title testterm -class testterm -fullscreen -e";
+ import json
+ import shlex
+
+
+ def run_test_case(cmd, xorg_keymap, test_case_name, inputs, expected):
+ with subtest(test_case_name):
+ assert len(inputs) == len(expected)
+ machine.execute("rm -f ${readyFile} ${resultFile}")
+
+ # set up process that expects all the keys to be entered
+ machine.succeed(
+ "{} {} {} {} &".format(
+ cmd,
+ "${testReader}",
+ len(inputs),
+ shlex.quote("".join(expected)),
+ )
+ )
+
+ if xorg_keymap:
+ # make sure the xterm window is open and has focus
+ machine.wait_for_window("testterm")
+ machine.wait_until_succeeds(
+ "${pkgs.xdotool}/bin/xdotool search --sync --onlyvisible "
+ "--class testterm windowfocus --sync"
+ )
+
+ # wait for reader to be ready
+ machine.wait_for_file("${readyFile}")
+ machine.sleep(1)
+
+ # send all keys
+ for key in inputs:
+ machine.send_key(key)
+
+ # wait for result and check
+ machine.wait_for_file("${resultFile}")
+ machine.succeed("grep -q 'PASS:' ${resultFile}")
+
+
+ with open("${pkgs.writeText "tests.json" (builtins.toJSON tests)}") as json_file:
+ tests = json.load(json_file)
+
+ keymap_environments = {
+ "VT Keymap": "openvt -sw --",
+ "Xorg Keymap": "DISPLAY=:0 xterm -title testterm -class testterm -fullscreen -e",
+ }
+
+ machine.wait_for_x()
+
+ for keymap_env_name, command in keymap_environments.items():
+ with subtest(keymap_env_name):
+ for test_case_name, test_data in tests.items():
+ run_test_case(
+ command,
+ False,
+ test_case_name,
+ test_data["qwerty"],
+ test_data["expect"],
+ )
'';
};
@@ -89,7 +107,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
altgr.expect = [ "~" "#" "{" "[" "|" ];
};
- extraConfig.i18n.consoleKeyMap = "azerty/fr";
+ extraConfig.console.keyMap = "azerty/fr";
extraConfig.services.xserver.layout = "fr";
};
@@ -99,7 +117,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
homerow.expect = [ "a" "r" "s" "t" "n" "e" "i" "o" ];
};
- extraConfig.i18n.consoleKeyMap = "colemak/colemak";
+ extraConfig.console.keyMap = "colemak/colemak";
extraConfig.services.xserver.layout = "us";
extraConfig.services.xserver.xkbVariant = "colemak";
};
@@ -151,7 +169,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
altgr.expect = [ "@" "|" "{" "[" "]" "}" ];
};
- extraConfig.i18n.consoleKeyMap = "de";
+ extraConfig.console.keyMap = "de";
extraConfig.services.xserver.layout = "de";
};
}
diff --git a/nixos/tests/limesurvey.nix b/nixos/tests/limesurvey.nix
index ad66ada106b711181372b12a8996e180b1eccb42..7228fcb833155a787606b03451253ca2fdc40f03 100644
--- a/nixos/tests/limesurvey.nix
+++ b/nixos/tests/limesurvey.nix
@@ -1,21 +1,26 @@
-import ./make-test.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: {
name = "limesurvey";
meta.maintainers = [ pkgs.stdenv.lib.maintainers.aanderse ];
- machine =
- { ... }:
- { services.limesurvey.enable = true;
- services.limesurvey.virtualHost.hostName = "example.local";
- services.limesurvey.virtualHost.adminAddr = "root@example.local";
-
- # limesurvey won't work without a dot in the hostname
- networking.hosts."127.0.0.1" = [ "example.local" ];
+ machine = { ... }: {
+ services.limesurvey = {
+ enable = true;
+ virtualHost = {
+ hostName = "example.local";
+ adminAddr = "root@example.local";
+ };
};
+ # limesurvey won't work without a dot in the hostname
+ networking.hosts."127.0.0.1" = [ "example.local" ];
+ };
+
testScript = ''
- startAll;
+ start_all()
- $machine->waitForUnit('phpfpm-limesurvey.service');
- $machine->succeed('curl http://example.local/') =~ /The following surveys are available/ or die;
+ machine.wait_for_unit("phpfpm-limesurvey.service")
+ assert "The following surveys are available" in machine.succeed(
+ "curl http://example.local/"
+ )
'';
})
diff --git a/nixos/tests/lorri/default.nix b/nixos/tests/lorri/default.nix
index 53074385a652d35ecf95899eb28dba70d336e6e6..198171082d880f0c2923bbcd290cbb414f1d8547 100644
--- a/nixos/tests/lorri/default.nix
+++ b/nixos/tests/lorri/default.nix
@@ -15,12 +15,12 @@ import ../make-test-python.nix {
# Start the daemon and wait until it is ready
machine.execute("lorri daemon > lorri.stdout 2> lorri.stderr &")
- machine.wait_until_succeeds("grep --fixed-strings 'lorri: ready' lorri.stdout")
+ machine.wait_until_succeeds("grep --fixed-strings 'ready' lorri.stdout")
# Ping the daemon
- machine.execute("lorri ping_ $(readlink -f shell.nix)")
+ machine.succeed("lorri internal__ping shell.nix")
# Wait for the daemon to finish the build
- machine.wait_until_succeeds("grep --fixed-strings 'OutputPaths' lorri.stdout")
+ machine.wait_until_succeeds("grep --fixed-strings 'Completed' lorri.stdout")
'';
}
diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix
index ca28bc31cf1c2564fe1f6dfcfcbba4270c7488f2..17260ce640676def13ea8e481ec5049886fdbc5e 100644
--- a/nixos/tests/misc.nix
+++ b/nixos/tests/misc.nix
@@ -1,6 +1,6 @@
# Miscellaneous small tests that don't warrant their own VM run.
-import ./make-test.nix ({ pkgs, ...} : rec {
+import ./make-test-python.nix ({ pkgs, ...} : rec {
name = "misc";
meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ eelco ];
@@ -34,109 +34,97 @@ import ./make-test.nix ({ pkgs, ...} : rec {
testScript =
''
- subtest "nix-db", sub {
- my $json = $machine->succeed("nix path-info --json ${foo}");
- $json =~ /"narHash":"sha256:0afw0d9j1hvwiz066z93jiddc33nxg6i6qyp26vnqyglpyfivlq5"/ or die "narHash not set";
- $json =~ /"narSize":128/ or die "narSize not set";
- };
+ import json
- subtest "nixos-version", sub {
- $machine->succeed("[ `nixos-version | wc -w` = 2 ]");
- };
- subtest "nixos-rebuild", sub {
- $machine->succeed("nixos-rebuild --help | grep 'NixOS module' ");
- };
+ def get_path_info(path):
+ result = machine.succeed(f"nix path-info --json {path}")
+ parsed = json.loads(result)
+ return parsed
- # Sanity check for uid/gid assignment.
- subtest "users-groups", sub {
- $machine->succeed("[ `id -u messagebus` = 4 ]");
- $machine->succeed("[ `id -g messagebus` = 4 ]");
- $machine->succeed("[ `getent group users` = 'users:x:100:' ]");
- };
- # Regression test for GMP aborts on QEMU.
- subtest "gmp", sub {
- $machine->succeed("expr 1 + 2");
- };
+ with subtest("nix-db"):
+ info = get_path_info("${foo}")
- # Test that the swap file got created.
- subtest "swapfile", sub {
- $machine->waitForUnit("root-swapfile.swap");
- $machine->succeed("ls -l /root/swapfile | grep 134217728");
- };
+ if (
+ info[0]["narHash"]
+ != "sha256:0afw0d9j1hvwiz066z93jiddc33nxg6i6qyp26vnqyglpyfivlq5"
+ ):
+ raise Exception("narHash not set")
- # Test whether kernel.poweroff_cmd is set.
- subtest "poweroff_cmd", sub {
- $machine->succeed("[ -x \"\$(cat /proc/sys/kernel/poweroff_cmd)\" ]")
- };
+ if info[0]["narSize"] != 128:
+ raise Exception("narSize not set")
- # Test whether the blkio controller is properly enabled.
- subtest "blkio-cgroup", sub {
- $machine->succeed("[ -n \"\$(cat /sys/fs/cgroup/blkio/blkio.sectors)\" ]")
- };
+ with subtest("nixos-version"):
+ machine.succeed("[ `nixos-version | wc -w` = 2 ]")
- # Test whether we have a reboot record in wtmp.
- subtest "reboot-wtmp", sub {
- $machine->shutdown;
- $machine->waitForUnit('multi-user.target');
- $machine->succeed("last | grep reboot >&2");
- };
+ with subtest("nixos-rebuild"):
+ assert "NixOS module" in machine.succeed("nixos-rebuild --help")
- # Test whether we can override environment variables.
- subtest "override-env-var", sub {
- $machine->succeed('[ "$EDITOR" = emacs ]');
- };
+ with subtest("Sanity check for uid/gid assignment"):
+ assert "4" == machine.succeed("id -u messagebus").strip()
+ assert "4" == machine.succeed("id -g messagebus").strip()
+ assert "users:x:100:" == machine.succeed("getent group users").strip()
- # Test whether hostname (and by extension nss_myhostname) works.
- subtest "hostname", sub {
- $machine->succeed('[ "`hostname`" = machine ]');
- #$machine->succeed('[ "`hostname -s`" = machine ]');
- };
+ with subtest("Regression test for GMP aborts on QEMU."):
+ machine.succeed("expr 1 + 2")
- # Test whether systemd-udevd automatically loads modules for our hardware.
- $machine->succeed("systemctl start systemd-udev-settle.service");
- subtest "udev-auto-load", sub {
- $machine->waitForUnit('systemd-udev-settle.service');
- $machine->succeed('lsmod | grep mousedev');
- };
+ with subtest("the swap file got created"):
+ machine.wait_for_unit("root-swapfile.swap")
+ machine.succeed("ls -l /root/swapfile | grep 134217728")
- # Test whether systemd-tmpfiles-clean works.
- subtest "tmpfiles", sub {
- $machine->succeed('touch /tmp/foo');
- $machine->succeed('systemctl start systemd-tmpfiles-clean');
- $machine->succeed('[ -e /tmp/foo ]');
- $machine->succeed('date -s "@$(($(date +%s) + 1000000))"'); # move into the future
- $machine->succeed('systemctl start systemd-tmpfiles-clean');
- $machine->fail('[ -e /tmp/foo ]');
- };
+ with subtest("whether kernel.poweroff_cmd is set"):
+ machine.succeed('[ -x "$(cat /proc/sys/kernel/poweroff_cmd)" ]')
- # Test whether automounting works.
- subtest "automount", sub {
- $machine->fail("grep '/tmp2 tmpfs' /proc/mounts");
- $machine->succeed("touch /tmp2/x");
- $machine->succeed("grep '/tmp2 tmpfs' /proc/mounts");
- };
+ with subtest("whether the blkio controller is properly enabled"):
+ machine.succeed("[ -e /sys/fs/cgroup/blkio/blkio.reset_stats ]")
- subtest "shell-vars", sub {
- $machine->succeed('[ -n "$NIX_PATH" ]');
- };
+ with subtest("whether we have a reboot record in wtmp"):
+ machine.shutdown
+ machine.wait_for_unit("multi-user.target")
+ machine.succeed("last | grep reboot >&2")
- subtest "nix-db", sub {
- $machine->succeed("nix-store -qR /run/current-system | grep nixos-");
- };
+ with subtest("whether we can override environment variables"):
+ machine.succeed('[ "$EDITOR" = emacs ]')
- # Test sysctl
- subtest "sysctl", sub {
- $machine->waitForUnit("systemd-sysctl.service");
- $machine->succeed('[ `sysctl -ne vm.swappiness` = 1 ]');
- $machine->execute('sysctl vm.swappiness=60');
- $machine->succeed('[ `sysctl -ne vm.swappiness` = 60 ]');
- };
+ with subtest("whether hostname (and by extension nss_myhostname) works"):
+ assert "machine" == machine.succeed("hostname").strip()
+ assert "machine" == machine.succeed("hostname -s").strip()
- # Test boot parameters
- subtest "bootparam", sub {
- $machine->succeed('grep -Fq vsyscall=emulate /proc/cmdline');
- };
+ with subtest("whether systemd-udevd automatically loads modules for our hardware"):
+ machine.succeed("systemctl start systemd-udev-settle.service")
+ machine.wait_for_unit("systemd-udev-settle.service")
+ assert "mousedev" in machine.succeed("lsmod")
+
+ with subtest("whether systemd-tmpfiles-clean works"):
+ machine.succeed(
+ "touch /tmp/foo", "systemctl start systemd-tmpfiles-clean", "[ -e /tmp/foo ]"
+ )
+ # move into the future
+ machine.succeed(
+ 'date -s "@$(($(date +%s) + 1000000))"',
+ "systemctl start systemd-tmpfiles-clean",
+ )
+ machine.fail("[ -e /tmp/foo ]")
+
+ with subtest("whether automounting works"):
+ machine.fail("grep '/tmp2 tmpfs' /proc/mounts")
+ machine.succeed("touch /tmp2/x")
+ machine.succeed("grep '/tmp2 tmpfs' /proc/mounts")
+
+ with subtest("shell-vars"):
+ machine.succeed('[ -n "$NIX_PATH" ]')
+
+ with subtest("nix-db"):
+ machine.succeed("nix-store -qR /run/current-system | grep nixos-")
+
+ with subtest("Test sysctl"):
+ machine.wait_for_unit("systemd-sysctl.service")
+ assert "1" == machine.succeed("sysctl -ne vm.swappiness").strip()
+ machine.execute("sysctl vm.swappiness=60")
+ assert "60" == machine.succeed("sysctl -ne vm.swappiness").strip()
+
+ with subtest("Test boot parameters"):
+ assert "vsyscall=emulate" in machine.succeed("cat /proc/cmdline")
'';
})
diff --git a/nixos/tests/networking-proxy.nix b/nixos/tests/networking-proxy.nix
index ab908c96e5eea233650261cfb3fd48ecd81b19e9..bae9c66ed61a2828b17ba924545b9f677c5801cc 100644
--- a/nixos/tests/networking-proxy.nix
+++ b/nixos/tests/networking-proxy.nix
@@ -10,7 +10,7 @@ let default-config = {
virtualisation.memorySize = 128;
};
-in import ./make-test.nix ({ pkgs, ...} : {
+in import ./make-test-python.nix ({ pkgs, ...} : {
name = "networking-proxy";
meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ ];
@@ -66,46 +66,70 @@ in import ./make-test.nix ({ pkgs, ...} : {
testScript =
''
- startAll;
-
- # no proxy at all
- print $machine->execute("env | grep -i proxy");
- print $machine->execute("su - alice -c 'env | grep -i proxy'");
- $machine->mustFail("env | grep -i proxy");
- $machine->mustFail("su - alice -c 'env | grep -i proxy'");
-
- # Use a default proxy option
- print $machine2->execute("env | grep -i proxy");
- print $machine2->execute("su - alice -c 'env | grep -i proxy'");
- $machine2->mustSucceed("env | grep -i proxy");
- $machine2->mustSucceed("su - alice -c 'env | grep -i proxy'");
-
- # explicitly set each proxy option
- print $machine3->execute("env | grep -i proxy");
- print $machine3->execute("su - alice -c 'env | grep -i proxy'");
- $machine3->mustSucceed("env | grep -i http_proxy | grep 123");
- $machine3->mustSucceed("env | grep -i https_proxy | grep 456");
- $machine3->mustSucceed("env | grep -i rsync_proxy | grep 789");
- $machine3->mustSucceed("env | grep -i ftp_proxy | grep 101112");
- $machine3->mustSucceed("env | grep -i no_proxy | grep 131415");
- $machine3->mustSucceed("su - alice -c 'env | grep -i http_proxy | grep 123'");
- $machine3->mustSucceed("su - alice -c 'env | grep -i https_proxy | grep 456'");
- $machine3->mustSucceed("su - alice -c 'env | grep -i rsync_proxy | grep 789'");
- $machine3->mustSucceed("su - alice -c 'env | grep -i ftp_proxy | grep 101112'");
- $machine3->mustSucceed("su - alice -c 'env | grep -i no_proxy | grep 131415'");
-
- # set default proxy option + some other specifics
- print $machine4->execute("env | grep -i proxy");
- print $machine4->execute("su - alice -c 'env | grep -i proxy'");
- $machine4->mustSucceed("env | grep -i http_proxy | grep 000");
- $machine4->mustSucceed("env | grep -i https_proxy | grep 000");
- $machine4->mustSucceed("env | grep -i rsync_proxy | grep 123");
- $machine4->mustSucceed("env | grep -i ftp_proxy | grep 000");
- $machine4->mustSucceed("env | grep -i no_proxy | grep 131415");
- $machine4->mustSucceed("su - alice -c 'env | grep -i http_proxy | grep 000'");
- $machine4->mustSucceed("su - alice -c 'env | grep -i https_proxy | grep 000'");
- $machine4->mustSucceed("su - alice -c 'env | grep -i rsync_proxy | grep 123'");
- $machine4->mustSucceed("su - alice -c 'env | grep -i ftp_proxy | grep 000'");
- $machine4->mustSucceed("su - alice -c 'env | grep -i no_proxy | grep 131415'");
+ from typing import Dict, Optional
+
+
+ def get_machine_env(machine: Machine, user: Optional[str] = None) -> Dict[str, str]:
+ """
+ Gets the environment from a given machine, and returns it as a
+ dictionary in the form:
+ {"lowercase_var_name": "value"}
+
+ Duplicate environment variables with the same name
+ (e.g. "foo" and "FOO") are handled in an undefined manner.
+ """
+ if user is not None:
+ env = machine.succeed("su - {} -c 'env -0'".format(user))
+ else:
+ env = machine.succeed("env -0")
+ ret = {}
+ for line in env.split("\0"):
+ if "=" not in line:
+ continue
+
+ key, val = line.split("=", 1)
+ ret[key.lower()] = val
+ return ret
+
+
+ start_all()
+
+ with subtest("no proxy"):
+ assert "proxy" not in machine.succeed("env").lower()
+ assert "proxy" not in machine.succeed("su - alice -c env").lower()
+
+ with subtest("default proxy"):
+ assert "proxy" in machine2.succeed("env").lower()
+ assert "proxy" in machine2.succeed("su - alice -c env").lower()
+
+ with subtest("explicitly-set proxy"):
+ env = get_machine_env(machine3)
+ assert "123" in env["http_proxy"]
+ assert "456" in env["https_proxy"]
+ assert "789" in env["rsync_proxy"]
+ assert "101112" in env["ftp_proxy"]
+ assert "131415" in env["no_proxy"]
+
+ env = get_machine_env(machine3, "alice")
+ assert "123" in env["http_proxy"]
+ assert "456" in env["https_proxy"]
+ assert "789" in env["rsync_proxy"]
+ assert "101112" in env["ftp_proxy"]
+ assert "131415" in env["no_proxy"]
+
+ with subtest("default proxy + some other specifics"):
+ env = get_machine_env(machine4)
+ assert "000" in env["http_proxy"]
+ assert "000" in env["https_proxy"]
+ assert "123" in env["rsync_proxy"]
+ assert "000" in env["ftp_proxy"]
+ assert "131415" in env["no_proxy"]
+
+ env = get_machine_env(machine4, "alice")
+ assert "000" in env["http_proxy"]
+ assert "000" in env["https_proxy"]
+ assert "123" in env["rsync_proxy"]
+ assert "000" in env["ftp_proxy"]
+ assert "131415" in env["no_proxy"]
'';
})
diff --git a/nixos/tests/networking.nix b/nixos/tests/networking.nix
index 9448a104073f7a501e64d9875bce90b79fbc2daf..933a4451af92470ae350851651535edec9c25287 100644
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@@ -533,7 +533,7 @@ let
useNetworkd = networkd;
useDHCP = false;
interfaces.eth1 = {
- preferTempAddress = true;
+ tempAddress = "default";
ipv4.addresses = mkOverride 0 [ ];
ipv6.addresses = mkOverride 0 [ ];
useDHCP = true;
@@ -546,7 +546,7 @@ let
useNetworkd = networkd;
useDHCP = false;
interfaces.eth1 = {
- preferTempAddress = false;
+ tempAddress = "enabled";
ipv4.addresses = mkOverride 0 [ ];
ipv6.addresses = mkOverride 0 [ ];
useDHCP = true;
diff --git a/nixos/tests/openstack-image.nix b/nixos/tests/openstack-image.nix
index d0225016ab7624d8e6861df9651e9d2b18aeb69f..97c9137fe1d6780e6a37bcf10d6223bd42dc1eec 100644
--- a/nixos/tests/openstack-image.nix
+++ b/nixos/tests/openstack-image.nix
@@ -16,8 +16,14 @@ let
../maintainers/scripts/openstack/openstack-image.nix
../modules/testing/test-instrumentation.nix
../modules/profiles/qemu-guest.nix
+ {
+ # Needed by nixos-rebuild due to lack of network access.
+ system.extraDependencies = with pkgs; [
+ stdenv
+ ];
+ }
];
- }).config.system.build.openstackImage;
+ }).config.system.build.openstackImage + "/nixos.qcow2";
sshKeys = import ./ssh-keys.nix pkgs;
snakeOilPrivateKey = sshKeys.snakeOilPrivateKey.text;
diff --git a/nixos/tests/printing.nix b/nixos/tests/printing.nix
index 4d0df289cf75c021e78b009b5f3ad45fa255c6ab..355c94a0386162ff41795491d4a02c5a45754dbb 100644
--- a/nixos/tests/printing.nix
+++ b/nixos/tests/printing.nix
@@ -1,19 +1,18 @@
# Test printing via CUPS.
-import ./make-test.nix ({pkgs, ... }:
+import ./make-test-python.nix ({pkgs, ... }:
let
printingServer = startWhenNeeded: {
services.printing.enable = true;
services.printing.startWhenNeeded = startWhenNeeded;
services.printing.listenAddresses = [ "*:631" ];
services.printing.defaultShared = true;
- services.printing.extraConf =
- ''
-
- Order allow,deny
- Allow from all
-
- '';
+ services.printing.extraConf = ''
+
+ Order allow,deny
+ Allow from all
+
+ '';
networking.firewall.allowedTCPPorts = [ 631 ];
# Add a HP Deskjet printer connected via USB to the server.
hardware.printers.ensurePrinters = [{
@@ -34,9 +33,7 @@ let
hardware.printers.ensureDefaultPrinter = "DeskjetRemote";
};
-in
-
-{
+in {
name = "printing";
meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ domenkozar eelco matthewbauer ];
@@ -50,65 +47,91 @@ in
serviceClient = { ... }: (printingClient false);
};
- testScript =
- ''
- startAll;
-
- # Make sure that cups is up on both sides.
- $serviceServer->waitForUnit("cups.service");
- $serviceClient->waitForUnit("cups.service");
- # wait until cups is fully initialized and ensure-printers has executed with 10s delay
- $serviceClient->sleep(20);
- $socketActivatedClient->waitUntilSucceeds("systemctl status ensure-printers | grep -q -E 'code=exited, status=0/SUCCESS'");
- sub testPrinting {
- my ($client, $server) = (@_);
- my $clientHostname = $client->name();
- my $serverHostname = $server->name();
- $client->succeed("lpstat -r") =~ /scheduler is running/ or die;
- # Test that UNIX socket is used for connections.
- $client->succeed("lpstat -H") =~ "/var/run/cups/cups.sock" or die;
- # Test that HTTP server is available too.
- $client->succeed("curl --fail http://localhost:631/");
- $client->succeed("curl --fail http://$serverHostname:631/");
- $server->fail("curl --fail --connect-timeout 2 http://$clientHostname:631/");
- # Do some status checks.
- $client->succeed("lpstat -a") =~ /DeskjetRemote accepting requests/ or die;
- $client->succeed("lpstat -h $serverHostname:631 -a") =~ /DeskjetLocal accepting requests/ or die;
- $client->succeed("cupsdisable DeskjetRemote");
- $client->succeed("lpq") =~ /DeskjetRemote is not ready.*no entries/s or die;
- $client->succeed("cupsenable DeskjetRemote");
- $client->succeed("lpq") =~ /DeskjetRemote is ready.*no entries/s or die;
- # Test printing various file types.
- foreach my $file ("${pkgs.groff.doc}/share/doc/*/examples/mom/penguin.pdf",
- "${pkgs.groff.doc}/share/doc/*/meref.ps",
- "${pkgs.cups.out}/share/doc/cups/images/cups.png",
- "${pkgs.pcre.doc}/share/doc/pcre/pcre.txt")
- {
- $file =~ /([^\/]*)$/; my $fn = $1;
- subtest "print $fn", sub {
- # Print the file on the client.
- $client->succeed("lp $file");
- $client->waitUntilSucceeds("lpq | grep -q -E 'active.*root.*$fn'");
- # Ensure that a raw PCL file appeared in the server's queue
- # (showing that the right filters have been applied). Of
- # course, since there is no actual USB printer attached, the
- # file will stay in the queue forever.
- $server->waitForFile("/var/spool/cups/d*-001");
- $server->waitUntilSucceeds("lpq -a | grep -q -E '$fn'");
- # Delete the job on the client. It should disappear on the
- # server as well.
- $client->succeed("lprm");
- $client->waitUntilSucceeds("lpq -a | grep -q -E 'no entries'");
- Machine::retry sub {
- return 1 if $server->succeed("lpq -a") =~ /no entries/;
- };
- # The queue is empty already, so this should be safe.
- # Otherwise, pairs of "c*"-"d*-001" files might persist.
- $server->execute("rm /var/spool/cups/*");
- };
- }
- }
- testPrinting($serviceClient, $serviceServer);
- testPrinting($socketActivatedClient, $socketActivatedServer);
+ testScript = ''
+ import os
+ import re
+ import sys
+
+ start_all()
+
+ with subtest("Make sure that cups is up on both sides"):
+ serviceServer.wait_for_unit("cups.service")
+ serviceClient.wait_for_unit("cups.service")
+
+ with subtest(
+ "Wait until cups is fully initialized and ensure-printers has "
+ "executed with 10s delay"
+ ):
+ serviceClient.sleep(20)
+ socketActivatedClient.wait_until_succeeds(
+ "systemctl status ensure-printers | grep -q -E 'code=exited, status=0/SUCCESS'"
+ )
+
+
+ def test_printing(client, server):
+ assert "scheduler is running" in client.succeed("lpstat -r")
+
+ with subtest("UNIX socket is used for connections"):
+ assert "/var/run/cups/cups.sock" in client.succeed("lpstat -H")
+ with subtest("HTTP server is available too"):
+ client.succeed("curl --fail http://localhost:631/")
+ client.succeed(f"curl --fail http://{server.name}:631/")
+ server.fail(f"curl --fail --connect-timeout 2 http://{client.name}:631/")
+
+ with subtest("LP status checks"):
+ assert "DeskjetRemote accepting requests" in client.succeed("lpstat -a")
+ assert "DeskjetLocal accepting requests" in client.succeed(
+ f"lpstat -h {server.name}:631 -a"
+ )
+ client.succeed("cupsdisable DeskjetRemote")
+ out = client.succeed("lpq")
+ print(out)
+ assert re.search(
+ "DeskjetRemote is not ready.*no entries",
+ client.succeed("lpq"),
+ flags=re.DOTALL,
+ )
+ client.succeed("cupsenable DeskjetRemote")
+ assert re.match(
+ "DeskjetRemote is ready.*no entries", client.succeed("lpq"), flags=re.DOTALL
+ )
+
+ # Test printing various file types.
+ for file in [
+ "${pkgs.groff.doc}/share/doc/*/examples/mom/penguin.pdf",
+ "${pkgs.groff.doc}/share/doc/*/meref.ps",
+ "${pkgs.cups.out}/share/doc/cups/images/cups.png",
+ "${pkgs.pcre.doc}/share/doc/pcre/pcre.txt",
+ ]:
+ file_name = os.path.basename(file)
+ with subtest(f"print {file_name}"):
+ # Print the file on the client.
+ print(client.succeed("lpq"))
+ client.succeed(f"lp {file}")
+ client.wait_until_succeeds(
+ f"lpq; lpq | grep -q -E 'active.*root.*{file_name}'"
+ )
+
+ # Ensure that a raw PCL file appeared in the server's queue
+ # (showing that the right filters have been applied). Of
+ # course, since there is no actual USB printer attached, the
+ # file will stay in the queue forever.
+ server.wait_for_file("/var/spool/cups/d*-001")
+ server.wait_until_succeeds(f"lpq -a | grep -q -E '{file_name}'")
+
+ # Delete the job on the client. It should disappear on the
+ # server as well.
+ client.succeed("lprm")
+ client.wait_until_succeeds("lpq -a | grep -q -E 'no entries'")
+
+ retry(lambda _: "no entries" in server.succeed("lpq -a"))
+
+ # The queue is empty already, so this should be safe.
+ # Otherwise, pairs of "c*"-"d*-001" files might persist.
+ server.execute("rm /var/spool/cups/*")
+
+
+ test_printing(serviceClient, serviceServer)
+ test_printing(socketActivatedClient, socketActivatedServer)
'';
})
diff --git a/nixos/tests/proxy.nix b/nixos/tests/proxy.nix
index 3859d429c21b98cb3a21e13c68a0f151f46b2a38..6a14a9af59aec0da67be086afa3d63cb237500ae 100644
--- a/nixos/tests/proxy.nix
+++ b/nixos/tests/proxy.nix
@@ -1,97 +1,90 @@
-import ./make-test.nix ({ pkgs, ...} :
+import ./make-test-python.nix ({ pkgs, ...} :
let
-
- backend =
- { pkgs, ... }:
-
- { services.httpd.enable = true;
- services.httpd.adminAddr = "foo@example.org";
- services.httpd.virtualHosts.localhost.documentRoot = "${pkgs.valgrind.doc}/share/doc/valgrind/html";
- networking.firewall.allowedTCPPorts = [ 80 ];
+ backend = { pkgs, ... }: {
+ services.httpd = {
+ enable = true;
+ adminAddr = "foo@example.org";
+ virtualHosts.localhost.documentRoot = "${pkgs.valgrind.doc}/share/doc/valgrind/html";
};
-
-in
-
-{
+ networking.firewall.allowedTCPPorts = [ 80 ];
+ };
+in {
name = "proxy";
meta = with pkgs.stdenv.lib.maintainers; {
maintainers = [ eelco ];
};
- nodes =
- { proxy =
- { nodes, ... }:
-
- { services.httpd.enable = true;
- services.httpd.adminAddr = "bar@example.org";
- services.httpd.extraModules = [ "proxy_balancer" "lbmethod_byrequests" ];
- services.httpd.extraConfig = ''
- ExtendedStatus on
+ nodes = {
+ proxy = { nodes, ... }: {
+ services.httpd = {
+ enable = true;
+ adminAddr = "bar@example.org";
+ extraModules = [ "proxy_balancer" "lbmethod_byrequests" ];
+ extraConfig = ''
+ ExtendedStatus on
+ '';
+ virtualHosts.localhost = {
+ extraConfig = ''
+
+ Require all granted
+ SetHandler server-status
+
+
+
+ Require all granted
+ BalancerMember http://${nodes.backend1.config.networking.hostName} retry=0
+ BalancerMember http://${nodes.backend2.config.networking.hostName} retry=0
+
+
+ ProxyStatus full
+ ProxyPass /server-status !
+ ProxyPass / balancer://cluster/
+ ProxyPassReverse / balancer://cluster/
+
+ # For testing; don't want to wait forever for dead backend servers.
+ ProxyTimeout 5
'';
- services.httpd.virtualHosts.localhost = {
- extraConfig = ''
-
- Require all granted
- SetHandler server-status
-
-
-
- Require all granted
- BalancerMember http://${nodes.backend1.config.networking.hostName} retry=0
- BalancerMember http://${nodes.backend2.config.networking.hostName} retry=0
-
-
- ProxyStatus full
- ProxyPass /server-status !
- ProxyPass / balancer://cluster/
- ProxyPassReverse / balancer://cluster/
-
- # For testing; don't want to wait forever for dead backend servers.
- ProxyTimeout 5
- '';
- };
-
- networking.firewall.allowedTCPPorts = [ 80 ];
};
-
- backend1 = backend;
- backend2 = backend;
-
- client = { ... }: { };
+ };
+ networking.firewall.allowedTCPPorts = [ 80 ];
};
- testScript =
- ''
- startAll;
+ backend1 = backend;
+ backend2 = backend;
+
+ client = { ... }: { };
+ };
- $proxy->waitForUnit("httpd");
- $backend1->waitForUnit("httpd");
- $backend2->waitForUnit("httpd");
- $client->waitForUnit("network.target");
+ testScript = ''
+ start_all()
- # With the back-ends up, the proxy should work.
- $client->succeed("curl --fail http://proxy/");
+ proxy.wait_for_unit("httpd")
+ backend1.wait_for_unit("httpd")
+ backend2.wait_for_unit("httpd")
+ client.wait_for_unit("network.target")
- $client->succeed("curl --fail http://proxy/server-status");
+ # With the back-ends up, the proxy should work.
+ client.succeed("curl --fail http://proxy/")
- # Block the first back-end.
- $backend1->block;
+ client.succeed("curl --fail http://proxy/server-status")
- # The proxy should still work.
- $client->succeed("curl --fail http://proxy/");
+ # Block the first back-end.
+ backend1.block()
- $client->succeed("curl --fail http://proxy/");
+ # The proxy should still work.
+ client.succeed("curl --fail http://proxy/")
+ client.succeed("curl --fail http://proxy/")
- # Block the second back-end.
- $backend2->block;
+ # Block the second back-end.
+ backend2.block()
- # Now the proxy should fail as well.
- $client->fail("curl --fail http://proxy/");
+ # Now the proxy should fail as well.
+ client.fail("curl --fail http://proxy/")
- # But if the second back-end comes back, the proxy should start
- # working again.
- $backend2->unblock;
- $client->succeed("curl --fail http://proxy/");
- '';
+ # But if the second back-end comes back, the proxy should start
+ # working again.
+ backend2.unblock()
+ client.succeed("curl --fail http://proxy/")
+ '';
})
diff --git a/nixos/tests/restic.nix b/nixos/tests/restic.nix
new file mode 100644
index 0000000000000000000000000000000000000000..67bb7f1933d66a80944dc4076b4d1009e88f792c
--- /dev/null
+++ b/nixos/tests/restic.nix
@@ -0,0 +1,63 @@
+import ./make-test-python.nix (
+ { pkgs, ... }:
+
+ let
+ password = "some_password";
+ repository = "/tmp/restic-backup";
+ passwordFile = pkgs.writeText "password" "correcthorsebatterystaple";
+ in
+ {
+ name = "restic";
+
+ meta = with pkgs.stdenv.lib.maintainers; {
+ maintainers = [ bbigras ];
+ };
+
+ nodes = {
+ server =
+ { ... }:
+ {
+ services.restic.backups = {
+ remotebackup = {
+ inherit repository;
+ passwordFile = "${passwordFile}";
+ initialize = true;
+ paths = [ "/opt" ];
+ pruneOpts = [
+ "--keep-daily 2"
+ "--keep-weekly 1"
+ "--keep-monthly 1"
+ "--keep-yearly 99"
+ ];
+ };
+ };
+ };
+ };
+
+ testScript = ''
+ server.start()
+ server.wait_for_unit("dbus.socket")
+ server.fail(
+ "${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots"
+ )
+ server.succeed(
+ "mkdir -p /opt",
+ "touch /opt/some_file",
+ "timedatectl set-time '2016-12-13 13:45'",
+ "systemctl start restic-backups-remotebackup.service",
+ '${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots -c | grep -e "^1 snapshot"',
+ "timedatectl set-time '2017-12-13 13:45'",
+ "systemctl start restic-backups-remotebackup.service",
+ "timedatectl set-time '2018-12-13 13:45'",
+ "systemctl start restic-backups-remotebackup.service",
+ "timedatectl set-time '2018-12-14 13:45'",
+ "systemctl start restic-backups-remotebackup.service",
+ "timedatectl set-time '2018-12-15 13:45'",
+ "systemctl start restic-backups-remotebackup.service",
+ "timedatectl set-time '2018-12-16 13:45'",
+ "systemctl start restic-backups-remotebackup.service",
+ '${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots -c | grep -e "^4 snapshot"',
+ )
+ '';
+ }
+)
diff --git a/nixos/tests/riak.nix b/nixos/tests/riak.nix
index 68a9b7315b3501ef6b49c309fb8bf6e742f3c5ce..6915779e7e9c2e4873ffbfdb09905892b63ce120 100644
--- a/nixos/tests/riak.nix
+++ b/nixos/tests/riak.nix
@@ -1,21 +1,18 @@
-import ./make-test.nix {
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
name = "riak";
+ meta = with lib.maintainers; {
+ maintainers = [ filalex77 ];
+ };
- nodes = {
- master =
- { pkgs, ... }:
-
- {
- services.riak.enable = true;
- services.riak.package = pkgs.riak;
- };
+ machine = {
+ services.riak.enable = true;
+ services.riak.package = pkgs.riak;
};
testScript = ''
- startAll;
+ machine.start()
- $master->waitForUnit("riak");
- $master->sleep(20); # Hopefully this is long enough!!
- $master->succeed("riak ping 2>&1");
+ machine.wait_for_unit("riak")
+ machine.wait_until_succeeds("riak ping 2>&1")
'';
-}
+})
diff --git a/nixos/tests/signal-desktop.nix b/nixos/tests/signal-desktop.nix
index c746d46dc5505bedabd69de8a2abef6e20196917..ae141fe116de8c9c772760952f5ca0d9c2254272 100644
--- a/nixos/tests/signal-desktop.nix
+++ b/nixos/tests/signal-desktop.nix
@@ -15,7 +15,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
];
services.xserver.enable = true;
- services.xserver.displayManager.auto.user = "alice";
+ test-support.displayManager.auto.user = "alice";
environment.systemPackages = [ pkgs.signal-desktop ];
};
diff --git a/nixos/tests/solr.nix b/nixos/tests/solr.nix
index 2108e851bc5954a20463b8655e6f5cf1be705dbe..23e1a960fb371a14c8b45c6b328c7e57299fa13a 100644
--- a/nixos/tests/solr.nix
+++ b/nixos/tests/solr.nix
@@ -1,65 +1,48 @@
-{ system ? builtins.currentSystem,
- config ? {},
- pkgs ? import ../.. { inherit system config; }
-}:
+import ./make-test.nix ({ pkgs, ... }:
-with import ../lib/testing.nix { inherit system pkgs; };
-with pkgs.lib;
-
-let
- solrTest = package: makeTest {
- machine =
- { config, pkgs, ... }:
- {
- # Ensure the virtual machine has enough memory for Solr to avoid the following error:
- #
- # OpenJDK 64-Bit Server VM warning:
- # INFO: os::commit_memory(0x00000000e8000000, 402653184, 0)
- # failed; error='Cannot allocate memory' (errno=12)
- #
- # There is insufficient memory for the Java Runtime Environment to continue.
- # Native memory allocation (mmap) failed to map 402653184 bytes for committing reserved memory.
- virtualisation.memorySize = 2000;
+{
+ name = "solr";
+ meta.maintainers = [ pkgs.stdenv.lib.maintainers.aanderse ];
- services.solr.enable = true;
- services.solr.package = package;
- };
+ machine =
+ { config, pkgs, ... }:
+ {
+ # Ensure the virtual machine has enough memory for Solr to avoid the following error:
+ #
+ # OpenJDK 64-Bit Server VM warning:
+ # INFO: os::commit_memory(0x00000000e8000000, 402653184, 0)
+ # failed; error='Cannot allocate memory' (errno=12)
+ #
+ # There is insufficient memory for the Java Runtime Environment to continue.
+ # Native memory allocation (mmap) failed to map 402653184 bytes for committing reserved memory.
+ virtualisation.memorySize = 2000;
- testScript = ''
- startAll;
+ services.solr.enable = true;
+ };
- $machine->waitForUnit('solr.service');
- $machine->waitForOpenPort('8983');
- $machine->succeed('curl --fail http://localhost:8983/solr/');
+ testScript = ''
+ startAll;
- # adapted from pkgs.solr/examples/films/README.txt
- $machine->succeed('sudo -u solr solr create -c films');
- $machine->succeed(q(curl http://localhost:8983/solr/films/schema -X POST -H 'Content-type:application/json' --data-binary '{
- "add-field" : {
- "name":"name",
- "type":"text_general",
- "multiValued":false,
- "stored":true
- },
- "add-field" : {
- "name":"initial_release_date",
- "type":"pdate",
- "stored":true
- }
- }')) =~ /"status":0/ or die;
- $machine->succeed('sudo -u solr post -c films ${pkgs.solr}/example/films/films.json');
- $machine->succeed('curl http://localhost:8983/solr/films/query?q=name:batman') =~ /"name":"Batman Begins"/ or die;
- '';
- };
-in
-{
- solr_7 = solrTest pkgs.solr_7 // {
- name = "solr_7";
- meta.maintainers = [ lib.maintainers.aanderse ];
- };
+ $machine->waitForUnit('solr.service');
+ $machine->waitForOpenPort('8983');
+ $machine->succeed('curl --fail http://localhost:8983/solr/');
- solr_8 = solrTest pkgs.solr_8 // {
- name = "solr_8";
- meta.maintainers = [ lib.maintainers.aanderse ];
- };
-}
+ # adapted from pkgs.solr/examples/films/README.txt
+ $machine->succeed('sudo -u solr solr create -c films');
+ $machine->succeed(q(curl http://localhost:8983/solr/films/schema -X POST -H 'Content-type:application/json' --data-binary '{
+ "add-field" : {
+ "name":"name",
+ "type":"text_general",
+ "multiValued":false,
+ "stored":true
+ },
+ "add-field" : {
+ "name":"initial_release_date",
+ "type":"pdate",
+ "stored":true
+ }
+ }')) =~ /"status":0/ or die;
+ $machine->succeed('sudo -u solr post -c films ${pkgs.solr}/example/films/films.json');
+ $machine->succeed('curl http://localhost:8983/solr/films/query?q=name:batman') =~ /"name":"Batman Begins"/ or die;
+ '';
+})
diff --git a/nixos/tests/systemd-networkd-vrf.nix b/nixos/tests/systemd-networkd-vrf.nix
new file mode 100644
index 0000000000000000000000000000000000000000..5bc824531e82e484fc121af2a011496bd8e3ef20
--- /dev/null
+++ b/nixos/tests/systemd-networkd-vrf.nix
@@ -0,0 +1,221 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: let
+ inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+in {
+ name = "systemd-networkd-vrf";
+ meta.maintainers = with lib.maintainers; [ ma27 ];
+
+ nodes = {
+ client = { pkgs, ... }: {
+ virtualisation.vlans = [ 1 2 ];
+
+ networking = {
+ useDHCP = false;
+ useNetworkd = true;
+ firewall.checkReversePath = "loose";
+ };
+
+ systemd.network = {
+ enable = true;
+
+ netdevs."10-vrf1" = {
+ netdevConfig = {
+ Kind = "vrf";
+ Name = "vrf1";
+ MTUBytes = "1300";
+ };
+ vrfConfig.Table = 23;
+ };
+ netdevs."10-vrf2" = {
+ netdevConfig = {
+ Kind = "vrf";
+ Name = "vrf2";
+ MTUBytes = "1300";
+ };
+ vrfConfig.Table = 42;
+ };
+
+ networks."10-vrf1" = {
+ matchConfig.Name = "vrf1";
+ networkConfig.IPForward = "yes";
+ routes = [
+ { routeConfig = { Destination = "192.168.1.2"; Metric = "100"; }; }
+ ];
+ };
+ networks."10-vrf2" = {
+ matchConfig.Name = "vrf2";
+ networkConfig.IPForward = "yes";
+ routes = [
+ { routeConfig = { Destination = "192.168.2.3"; Metric = "100"; }; }
+ ];
+ };
+
+ networks."10-eth1" = {
+ matchConfig.Name = "eth1";
+ linkConfig.RequiredForOnline = "no";
+ networkConfig = {
+ VRF = "vrf1";
+ Address = "192.168.1.1";
+ IPForward = "yes";
+ };
+ };
+ networks."10-eth2" = {
+ matchConfig.Name = "eth2";
+ linkConfig.RequiredForOnline = "no";
+ networkConfig = {
+ VRF = "vrf2";
+ Address = "192.168.2.1";
+ IPForward = "yes";
+ };
+ };
+ };
+ };
+
+ node1 = { pkgs, ... }: {
+ virtualisation.vlans = [ 1 ];
+ networking = {
+ useDHCP = false;
+ useNetworkd = true;
+ };
+
+ services.openssh.enable = true;
+ users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+
+ systemd.network = {
+ enable = true;
+
+ networks."10-eth1" = {
+ matchConfig.Name = "eth1";
+ linkConfig.RequiredForOnline = "no";
+ networkConfig = {
+ Address = "192.168.1.2";
+ IPForward = "yes";
+ };
+ };
+ };
+ };
+
+ node2 = { pkgs, ... }: {
+ virtualisation.vlans = [ 2 ];
+ networking = {
+ useDHCP = false;
+ useNetworkd = true;
+ };
+
+ systemd.network = {
+ enable = true;
+
+ networks."10-eth2" = {
+ matchConfig.Name = "eth2";
+ linkConfig.RequiredForOnline = "no";
+ networkConfig = {
+ Address = "192.168.2.3";
+ IPForward = "yes";
+ };
+ };
+ };
+ };
+
+ node3 = { pkgs, ... }: {
+ virtualisation.vlans = [ 2 ];
+ networking = {
+ useDHCP = false;
+ useNetworkd = true;
+ };
+
+ systemd.network = {
+ enable = true;
+
+ networks."10-eth2" = {
+ matchConfig.Name = "eth2";
+ linkConfig.RequiredForOnline = "no";
+ networkConfig = {
+ Address = "192.168.2.4";
+ IPForward = "yes";
+ };
+ };
+ };
+ };
+ };
+
+ testScript = ''
+ def compare_tables(expected, actual):
+ assert (
+ expected == actual
+ ), """
+ Routing tables don't match!
+ Expected:
+ {}
+ Actual:
+ {}
+ """.format(
+ expected, actual
+ )
+
+
+ start_all()
+
+ client.wait_for_unit("network.target")
+ node1.wait_for_unit("network.target")
+ node2.wait_for_unit("network.target")
+ node3.wait_for_unit("network.target")
+
+ client_ipv4_table = """
+ 192.168.1.2 dev vrf1 proto static metric 100
+ 192.168.2.3 dev vrf2 proto static metric 100
+ """.strip()
+ vrf1_table = """
+ broadcast 192.168.1.0 dev eth1 proto kernel scope link src 192.168.1.1
+ 192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.1
+ local 192.168.1.1 dev eth1 proto kernel scope host src 192.168.1.1
+ broadcast 192.168.1.255 dev eth1 proto kernel scope link src 192.168.1.1
+ """.strip()
+ vrf2_table = """
+ broadcast 192.168.2.0 dev eth2 proto kernel scope link src 192.168.2.1
+ 192.168.2.0/24 dev eth2 proto kernel scope link src 192.168.2.1
+ local 192.168.2.1 dev eth2 proto kernel scope host src 192.168.2.1
+ broadcast 192.168.2.255 dev eth2 proto kernel scope link src 192.168.2.1
+ """.strip()
+
+ # Check that networkd properly configures the main routing table
+ # and the routing tables for the VRF.
+ with subtest("check vrf routing tables"):
+ compare_tables(
+ client_ipv4_table, client.succeed("ip -4 route list | head -n2").strip()
+ )
+ compare_tables(
+ vrf1_table, client.succeed("ip -4 route list table 23 | head -n4").strip()
+ )
+ compare_tables(
+ vrf2_table, client.succeed("ip -4 route list table 42 | head -n4").strip()
+ )
+
+ # Ensure that other nodes are reachable via ICMP through the VRF.
+ with subtest("icmp through vrf works"):
+ client.succeed("ping -c5 192.168.1.2")
+ client.succeed("ping -c5 192.168.2.3")
+
+ # Test whether SSH through a VRF IP is possible.
+ # (Note: this seems to be an issue on Linux 5.x, so I decided to add this to
+ # ensure that we catch this when updating the default kernel).
+ with subtest("tcp traffic through vrf works"):
+ node1.wait_for_open_port(22)
+ client.succeed(
+ "cat ${snakeOilPrivateKey} > privkey.snakeoil"
+ )
+ client.succeed("chmod 600 privkey.snakeoil")
+ client.succeed(
+ "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.1.2 true"
+ )
+
+ # Only configured routes through the VRF from the main routing table should
+ # work. Additional IPs are only reachable when binding to the vrf interface.
+ with subtest("only routes from main routing table work by default"):
+ client.fail("ping -c5 192.168.2.4")
+ client.succeed("ping -I vrf2 -c5 192.168.2.4")
+
+ client.shutdown()
+ node1.shutdown()
+ node2.shutdown()
+ node3.shutdown()
+ '';
+})
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index 4b71b4d67597de858b23e3792c0bd79e23688214..8028145939bb54d29f107d072811d53c2f92179e 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: {
name = "systemd";
machine = { lib, ... }: {
@@ -19,7 +19,7 @@ import ./make-test.nix ({ pkgs, ... }: {
systemd.extraConfig = "DefaultEnvironment=\"XXX_SYSTEM=foo\"";
systemd.user.extraConfig = "DefaultEnvironment=\"XXX_USER=bar\"";
services.journald.extraConfig = "Storage=volatile";
- services.xserver.displayManager.auto.user = "alice";
+ test-support.displayManager.auto.user = "alice";
systemd.shutdown.test = pkgs.writeScript "test.shutdown" ''
#!${pkgs.stdenv.shell}
@@ -53,50 +53,69 @@ import ./make-test.nix ({ pkgs, ... }: {
};
testScript = ''
- $machine->waitForX;
+ import re
+ import subprocess
+
+ machine.wait_for_x()
# wait for user services
- $machine->waitForUnit("default.target","alice");
+ machine.wait_for_unit("default.target", "alice")
# Regression test for https://github.com/NixOS/nixpkgs/issues/35415
- subtest "configuration files are recognized by systemd", sub {
- $machine->succeed('test -e /system_conf_read');
- $machine->succeed('test -e /home/alice/user_conf_read');
- $machine->succeed('test -z $(ls -1 /var/log/journal)');
- };
+ with subtest("configuration files are recognized by systemd"):
+ machine.succeed("test -e /system_conf_read")
+ machine.succeed("test -e /home/alice/user_conf_read")
+ machine.succeed("test -z $(ls -1 /var/log/journal)")
# Regression test for https://github.com/NixOS/nixpkgs/issues/50273
- subtest "DynamicUser actually allocates a user", sub {
- $machine->succeed('systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami | grep iamatest');
- };
+ with subtest("DynamicUser actually allocates a user"):
+ assert "iamatest" in machine.succeed(
+ "systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami"
+ )
# Regression test for https://github.com/NixOS/nixpkgs/issues/35268
- subtest "file system with x-initrd.mount is not unmounted", sub {
- $machine->succeed('mountpoint -q /test-x-initrd-mount');
- $machine->shutdown;
- system('qemu-img', 'convert', '-O', 'raw',
- 'vm-state-machine/empty2.qcow2', 'x-initrd-mount.raw');
- my $extinfo = `${pkgs.e2fsprogs}/bin/dumpe2fs x-initrd-mount.raw`;
- die "File system was not cleanly unmounted: $extinfo"
- unless $extinfo =~ /^Filesystem state: *clean$/m;
- };
+ with subtest("file system with x-initrd.mount is not unmounted"):
+ machine.succeed("mountpoint -q /test-x-initrd-mount")
+ machine.shutdown()
- subtest "systemd-shutdown works", sub {
- $machine->shutdown;
- $machine->waitForUnit('multi-user.target');
- $machine->succeed('test -e /tmp/shared/shutdown-test');
- };
+ subprocess.check_call(
+ [
+ "qemu-img",
+ "convert",
+ "-O",
+ "raw",
+ "vm-state-machine/empty0.qcow2",
+ "x-initrd-mount.raw",
+ ]
+ )
+ extinfo = subprocess.check_output(
+ [
+ "${pkgs.e2fsprogs}/bin/dumpe2fs",
+ "x-initrd-mount.raw",
+ ]
+ ).decode("utf-8")
+ assert (
+ re.search(r"^Filesystem state: *clean$", extinfo, re.MULTILINE) is not None
+ ), ("File system was not cleanly unmounted: " + extinfo)
+
+ with subtest("systemd-shutdown works"):
+ machine.shutdown()
+ machine.wait_for_unit("multi-user.target")
+ machine.succeed("test -e /tmp/shared/shutdown-test")
+
+ # Test settings from /etc/sysctl.d/50-default.conf are applied
+ with subtest("systemd sysctl settings are applied"):
+ machine.wait_for_unit("multi-user.target")
+ assert "fq_codel" in machine.succeed("sysctl net.core.default_qdisc")
+
+ # Test cgroup accounting is enabled
+ with subtest("systemd cgroup accounting is enabled"):
+ machine.wait_for_unit("multi-user.target")
+ assert "yes" in machine.succeed(
+ "systemctl show testservice1.service -p IOAccounting"
+ )
- # Test settings from /etc/sysctl.d/50-default.conf are applied
- subtest "systemd sysctl settings are applied", sub {
- $machine->waitForUnit('multi-user.target');
- $machine->succeed('sysctl net.core.default_qdisc | grep -q "fq_codel"');
- };
-
- # Test cgroup accounting is enabled
- subtest "systemd cgroup accounting is enabled", sub {
- $machine->waitForUnit('multi-user.target');
- $machine->succeed('systemctl show testservice1.service -p IOAccounting | grep -q "yes"');
- $machine->succeed('systemctl status testservice1.service | grep -q "CPU:"');
- };
+ retcode, output = machine.execute("systemctl status testservice1.service")
+ assert retcode in [0, 3] # https://bugs.freedesktop.org/show_bug.cgi?id=77507
+ assert "CPU:" in output
'';
})
diff --git a/nixos/tests/victoriametrics.nix b/nixos/tests/victoriametrics.nix
new file mode 100644
index 0000000000000000000000000000000000000000..73ef8b72861530971140825c71717cbd1bcfd388
--- /dev/null
+++ b/nixos/tests/victoriametrics.nix
@@ -0,0 +1,31 @@
+# This test runs influxdb and checks if influxdb is up and running
+
+import ./make-test-python.nix ({ pkgs, ...} : {
+ name = "victoriametrics";
+ meta = with pkgs.stdenv.lib.maintainers; {
+ maintainers = [ yorickvp ];
+ };
+
+ nodes = {
+ one = { ... }: {
+ services.victoriametrics.enable = true;
+ };
+ };
+
+ testScript = ''
+ start_all()
+
+ one.wait_for_unit("victoriametrics.service")
+
+ # write some points and run simple query
+ out = one.succeed(
+ "curl -d 'measurement,tag1=value1,tag2=value2 field1=123,field2=1.23' -X POST 'http://localhost:8428/write'"
+ )
+ cmd = """curl -s -G 'http://localhost:8428/api/v1/export' -d 'match={__name__!=""}'"""
+ # data takes a while to appear
+ one.wait_until_succeeds(f"[[ $({cmd} | wc -l) -ne 0 ]]")
+ out = one.succeed(cmd)
+ assert '"values":[123]' in out
+ assert '"values":[1.23]' in out
+ '';
+})
diff --git a/nixos/tests/virtualbox.nix b/nixos/tests/virtualbox.nix
index 32637d2c1efe277f25d8c7b5e86e1311c8d8a801..f03dc1cc41384030721128f965208f6dc49f2ace 100644
--- a/nixos/tests/virtualbox.nix
+++ b/nixos/tests/virtualbox.nix
@@ -356,7 +356,7 @@ let
virtualisation.qemu.options =
if useKvmNestedVirt then ["-cpu" "kvm64,vmx=on"] else [];
virtualisation.virtualbox.host.enable = true;
- services.xserver.displayManager.auto.user = "alice";
+ test-support.displayManager.auto.user = "alice";
users.users.alice.extraGroups = let
inherit (config.virtualisation.virtualbox.host) enableHardening;
in lib.mkIf enableHardening (lib.singleton "vboxusers");
diff --git a/nixos/tests/xandikos.nix b/nixos/tests/xandikos.nix
new file mode 100644
index 0000000000000000000000000000000000000000..0fded20ff1a9cdea4776ed4769b0d82882345ddc
--- /dev/null
+++ b/nixos/tests/xandikos.nix
@@ -0,0 +1,70 @@
+import ./make-test-python.nix (
+ { pkgs, lib, ... }:
+
+ {
+ name = "xandikos";
+
+ meta.maintainers = [ lib.maintainers."0x4A6F" ];
+
+ nodes = {
+ xandikos_client = {};
+ xandikos_default = {
+ networking.firewall.allowedTCPPorts = [ 8080 ];
+ services.xandikos.enable = true;
+ };
+ xandikos_proxy = {
+ networking.firewall.allowedTCPPorts = [ 80 8080 ];
+ services.xandikos.enable = true;
+ services.xandikos.address = "localhost";
+ services.xandikos.port = 8080;
+ services.xandikos.routePrefix = "/xandikos/";
+ services.xandikos.extraOptions = [
+ "--defaults"
+ ];
+ services.nginx = {
+ enable = true;
+ recommendedProxySettings = true;
+ virtualHosts."xandikos" = {
+ serverName = "xandikos.local";
+ basicAuth.xandikos = "snakeOilPassword";
+ locations."/xandikos/" = {
+ proxyPass = "http://localhost:8080/";
+ };
+ };
+ };
+ };
+ };
+
+ testScript = ''
+ start_all()
+
+ with subtest("Xandikos default"):
+ xandikos_default.wait_for_unit("multi-user.target")
+ xandikos_default.wait_for_unit("xandikos.service")
+ xandikos_default.wait_for_open_port(8080)
+ xandikos_default.succeed("curl --fail http://localhost:8080/")
+ xandikos_default.succeed(
+ "curl -s --fail --location http://localhost:8080/ | grep -qi Xandikos"
+ )
+ xandikos_client.wait_for_unit("network.target")
+ xandikos_client.fail("curl --fail http://xandikos_default:8080/")
+
+ with subtest("Xandikos proxy"):
+ xandikos_proxy.wait_for_unit("multi-user.target")
+ xandikos_proxy.wait_for_unit("xandikos.service")
+ xandikos_proxy.wait_for_open_port(8080)
+ xandikos_proxy.succeed("curl --fail http://localhost:8080/")
+ xandikos_proxy.succeed(
+ "curl -s --fail --location http://localhost:8080/ | grep -qi Xandikos"
+ )
+ xandikos_client.wait_for_unit("network.target")
+ xandikos_client.fail("curl --fail http://xandikos_proxy:8080/")
+ xandikos_client.succeed(
+ "curl -s --fail -u xandikos:snakeOilPassword -H 'Host: xandikos.local' http://xandikos_proxy/xandikos/ | grep -qi Xandikos"
+ )
+ xandikos_client.succeed(
+ "curl -s --fail -u xandikos:snakeOilPassword -H 'Host: xandikos.local' http://xandikos_proxy/xandikos/user/ | grep -qi Xandikos"
+ )
+ '';
+ }
+)
diff --git a/nixos/tests/xautolock.nix b/nixos/tests/xautolock.nix
index 10e92b40e9562f065d63cdd4a937a84afd8ca740..4a8d3f4cebf7c91f7d18b9113a90e6fa72d03ae5 100644
--- a/nixos/tests/xautolock.nix
+++ b/nixos/tests/xautolock.nix
@@ -9,7 +9,7 @@ with lib;
nodes.machine = {
imports = [ ./common/x11.nix ./common/user-account.nix ];
- services.xserver.displayManager.auto.user = "bob";
+ test-support.displayManager.auto.user = "bob";
services.xserver.xautolock.enable = true;
services.xserver.xautolock.time = 1;
};
diff --git a/nixos/tests/xfce.nix b/nixos/tests/xfce.nix
index 3ea96b383631d49eb29c5447ea470fbf64894bd5..99065669661a0c9d4856418d94730ec42cf360fb 100644
--- a/nixos/tests/xfce.nix
+++ b/nixos/tests/xfce.nix
@@ -4,12 +4,20 @@ import ./make-test-python.nix ({ pkgs, ...} : {
machine =
{ pkgs, ... }:
- { imports = [ ./common/user-account.nix ];
+ {
+ imports = [
+ ./common/user-account.nix
+ ];
services.xserver.enable = true;
- services.xserver.displayManager.auto.enable = true;
- services.xserver.displayManager.auto.user = "alice";
+ services.xserver.displayManager.lightdm = {
+ enable = true;
+ autoLogin = {
+ enable = true;
+ user = "alice";
+ };
+ };
services.xserver.desktopManager.xfce.enable = true;
diff --git a/nixos/tests/xmonad.nix b/nixos/tests/xmonad.nix
index ef711f8dcf6ae729913d25ffa7a7518f6c9e9995..56baae8b9d3cd6cb1a81b53b11d7bd146602f513 100644
--- a/nixos/tests/xmonad.nix
+++ b/nixos/tests/xmonad.nix
@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
machine = { pkgs, ... }: {
imports = [ ./common/x11.nix ./common/user-account.nix ];
- services.xserver.displayManager.auto.user = "alice";
+ test-support.displayManager.auto.user = "alice";
services.xserver.displayManager.defaultSession = "none+xmonad";
services.xserver.windowManager.xmonad = {
enable = true;
diff --git a/nixos/tests/xrdp.nix b/nixos/tests/xrdp.nix
index 1aceeffb955d47e9fbad09d9ca456c20a30dfc4d..6d7f2b9249ffa22206ef33d56ff72458eeab8c32 100644
--- a/nixos/tests/xrdp.nix
+++ b/nixos/tests/xrdp.nix
@@ -14,7 +14,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
client = { pkgs, ... }: {
imports = [ ./common/x11.nix ./common/user-account.nix ];
- services.xserver.displayManager.auto.user = "alice";
+ test-support.displayManager.auto.user = "alice";
environment.systemPackages = [ pkgs.freerdp ];
services.xrdp.enable = true;
services.xrdp.defaultWindowManager = "${pkgs.icewm}/bin/icewm";
diff --git a/nixos/tests/xss-lock.nix b/nixos/tests/xss-lock.nix
index 3a7dea07d53a5ff22f8b9809e02ac1b85e69dad3..b77bbbbb3c4e7e21385fc81c9d4e5d9127f0842a 100644
--- a/nixos/tests/xss-lock.nix
+++ b/nixos/tests/xss-lock.nix
@@ -10,12 +10,12 @@ with lib;
simple = {
imports = [ ./common/x11.nix ./common/user-account.nix ];
programs.xss-lock.enable = true;
- services.xserver.displayManager.auto.user = "alice";
+ test-support.displayManager.auto.user = "alice";
};
custom_lockcmd = { pkgs, ... }: {
imports = [ ./common/x11.nix ./common/user-account.nix ];
- services.xserver.displayManager.auto.user = "alice";
+ test-support.displayManager.auto.user = "alice";
programs.xss-lock = {
enable = true;
diff --git a/nixos/tests/yabar.nix b/nixos/tests/yabar.nix
index 9108004d4df9d42408de58b8f467e36b2236d0ed..b374ef2968074d8241c65c4f85ee7dbb40dc3dae 100644
--- a/nixos/tests/yabar.nix
+++ b/nixos/tests/yabar.nix
@@ -11,7 +11,7 @@ with lib;
machine = {
imports = [ ./common/x11.nix ./common/user-account.nix ];
- services.xserver.displayManager.auto.user = "bob";
+ test-support.displayManager.auto.user = "bob";
programs.yabar.enable = true;
programs.yabar.bars = {
diff --git a/nixos/tests/zfs.nix b/nixos/tests/zfs.nix
index 8f844aca416051fbb4b478ff7cbfca2be7a687fd..7ba60ee9806c5b217539f11d4422b083890d16d8 100644
--- a/nixos/tests/zfs.nix
+++ b/nixos/tests/zfs.nix
@@ -3,12 +3,10 @@
pkgs ? import ../.. { inherit system config; }
}:
-with import ../lib/testing.nix { inherit system pkgs; };
+with import ../lib/testing-python.nix { inherit system pkgs; };
let
- makeTest = import ./make-test-python.nix;
-
makeZfsTest = name:
{ kernelPackage ? pkgs.linuxPackages_latest
, enableUnstable ? false
@@ -20,41 +18,33 @@ let
maintainers = [ adisbladis ];
};
- machine = { pkgs, ... }:
- {
- virtualisation.emptyDiskImages = [ 4096 ];
- networking.hostId = "deadbeef";
- boot.kernelPackages = kernelPackage;
- boot.supportedFilesystems = [ "zfs" ];
- boot.zfs.enableUnstable = enableUnstable;
+ machine = { pkgs, ... }: {
+ virtualisation.emptyDiskImages = [ 4096 ];
+ networking.hostId = "deadbeef";
+ boot.kernelPackages = kernelPackage;
+ boot.supportedFilesystems = [ "zfs" ];
+ boot.zfs.enableUnstable = enableUnstable;
- environment.systemPackages = with pkgs; [
- parted
- ];
- };
+ environment.systemPackages = [ pkgs.parted ];
+ };
testScript = ''
- machine.succeed("modprobe zfs")
- machine.succeed("zpool status")
-
- machine.succeed("ls /dev")
-
machine.succeed(
- "mkdir /tmp/mnt",
-
- "udevadm settle",
- "parted --script /dev/vdb mklabel msdos",
- "parted --script /dev/vdb -- mkpart primary 1024M -1s",
- "udevadm settle",
-
- "zpool create rpool /dev/vdb1",
- "zfs create -o mountpoint=legacy rpool/root",
- "mount -t zfs rpool/root /tmp/mnt",
- "udevadm settle",
-
- "umount /tmp/mnt",
- "zpool destroy rpool",
- "udevadm settle"
+ "modprobe zfs",
+ "zpool status",
+ "ls /dev",
+ "mkdir /tmp/mnt",
+ "udevadm settle",
+ "parted --script /dev/vdb mklabel msdos",
+ "parted --script /dev/vdb -- mkpart primary 1024M -1s",
+ "udevadm settle",
+ "zpool create rpool /dev/vdb1",
+ "zfs create -o mountpoint=legacy rpool/root",
+ "mount -t zfs rpool/root /tmp/mnt",
+ "udevadm settle",
+ "umount /tmp/mnt",
+ "zpool destroy rpool",
+ "udevadm settle",
)
'' + extraTest;
@@ -69,18 +59,17 @@ in {
enableUnstable = true;
extraTest = ''
machine.succeed(
- "echo password | zpool create -o altroot=\"/tmp/mnt\" -O encryption=aes-256-gcm -O keyformat=passphrase rpool /dev/vdb1",
- "zfs create -o mountpoint=legacy rpool/root",
- "mount -t zfs rpool/root /tmp/mnt",
- "udevadm settle",
-
- "umount /tmp/mnt",
- "zpool destroy rpool",
- "udevadm settle"
+ 'echo password | zpool create -o altroot="/tmp/mnt" '
+ + "-O encryption=aes-256-gcm -O keyformat=passphrase rpool /dev/vdb1",
+ "zfs create -o mountpoint=legacy rpool/root",
+ "mount -t zfs rpool/root /tmp/mnt",
+ "udevadm settle",
+ "umount /tmp/mnt",
+ "zpool destroy rpool",
+ "udevadm settle",
)
'';
};
installer = (import ./installer.nix { }).zfsroot;
-
}
diff --git a/pkgs/applications/accessibility/dasher/default.nix b/pkgs/applications/accessibility/dasher/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..9e8084e7a87a2adc191a1ffa0ea58bcc6ce8cce3
--- /dev/null
+++ b/pkgs/applications/accessibility/dasher/default.nix
@@ -0,0 +1,55 @@
+{ stdenv, lib, fetchFromGitHub
+, autoreconfHook, pkgconfig, wrapGAppsHook
+, glib, gtk3, expat, gnome-doc-utils, which
+, at-spi2-core, dbus
+, libxslt, libxml2
+, speechSupport ? true, speechd ? null
+}:
+
+assert speechSupport -> speechd != null;
+
+stdenv.mkDerivation {
+ pname = "dasher";
+ version = "2018-04-03";
+
+ src = fetchFromGitHub {
+ owner = "dasher-project";
+ repo = "dasher";
+ rev = "9ab12462e51d17a38c0ddc7f7ffe1cb5fe83b627";
+ sha256 = "1r9xn966nx3pv2bidd6i3pxmprvlw6insnsb38zabmac609h9d9s";
+ };
+
+ prePatch = ''
+ # tries to invoke git for something, probably fetching the ref
+ echo "true" > build-aux/mkversion
+ '';
+
+ configureFlags = lib.optional (!speechSupport) "--disable-speech";
+
+ nativeBuildInputs = [
+ autoreconfHook
+ wrapGAppsHook
+ pkgconfig
+ # doc generation
+ gnome-doc-utils
+ which
+ libxslt libxml2
+ ];
+
+ buildInputs = [
+ glib
+ gtk3
+ expat
+ # at-spi2 needs dbus to be recognized by pkg-config
+ at-spi2-core dbus
+ ] ++ lib.optional speechSupport speechd;
+
+ meta = {
+ homepage = http://www.inference.org.uk/dasher/;
+ description = "Information-efficient text-entry interface, driven by natural continuous pointing gestures";
+ license = lib.licenses.gpl2;
+ maintainers = [ lib.maintainers.Profpatsch ];
+ platforms = lib.platforms.all;
+ };
+
+}
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
index 0cff19819c01bb7b77c93441631517ae72a02db4..64ee40e038ced68c9ffda27e5be17c0a99a136d6 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
@@ -2,18 +2,16 @@
bitwig-studio1.overrideAttrs (oldAttrs: rec {
name = "bitwig-studio-${version}";
- version = "3.1.1";
+ version = "3.1.2";
src = fetchurl {
url = "https://downloads.bitwig.com/stable/${version}/bitwig-studio-${version}.deb";
- sha256 = "1mgyyl1mr8hmzn3qdmg77km6sk58hyd0gsqr9jksh0a8p6hj24pk";
+ sha256 = "07djn52lz43ls6fa4k1ncz3m1nc5zv2j93hwyavnr66r0hlqy7l9";
};
buildInputs = oldAttrs.buildInputs ++ [ xorg.libXtst ];
- runtimeDependencies = [
- pulseaudio
- ];
+ runtimeDependencies = [ pulseaudio ];
installPhase = ''
${oldAttrs.installPhase}
diff --git a/pkgs/applications/audio/bshapr/default.nix b/pkgs/applications/audio/bshapr/default.nix
index 732a8cf1ce2f2e19330f9ba3ed2b2bc4378851ab..88a671495c38d65dc8c2147c397d7179c331d680 100644
--- a/pkgs/applications/audio/bshapr/default.nix
+++ b/pkgs/applications/audio/bshapr/default.nix
@@ -2,13 +2,13 @@
stdenv.mkDerivation rec {
pname = "BShapr";
- version = "0.6";
+ version = "0.7";
src = fetchFromGitHub {
owner = "sjaehn";
repo = pname;
rev = "v${version}";
- sha256 = "0mi8f0svq1h9cmmxyskcazr5x2q4dls3j9jc6ahi5rlk7i0bpa74";
+ sha256 = "1422xay28jkmqlj5y4vhb57kljy6ysvxh20cxpfxm980m8n54gq5";
};
nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/audio/bslizr/default.nix b/pkgs/applications/audio/bslizr/default.nix
index 3273d7de68c2e8a0225d84b304fd3b6b1467f45d..97a9d60ec277db0c29ea89cba674e8195690524b 100644
--- a/pkgs/applications/audio/bslizr/default.nix
+++ b/pkgs/applications/audio/bslizr/default.nix
@@ -2,13 +2,13 @@
stdenv.mkDerivation rec {
pname = "BSlizr";
- version = "1.2.2";
+ version = "1.2.4";
src = fetchFromGitHub {
owner = "sjaehn";
repo = pname;
rev = "${version}";
- sha256 = "0q92ygz17iiriwzqylmaxd5ml2bhqy3n6c3f7g71n4hn9z3bl3s1";
+ sha256 = "0gyczxhd1jch7lwz3y1nrbpc0dycw9cc5i144rpif6b9gd2y1h1j";
};
nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/audio/distrho/default.nix b/pkgs/applications/audio/distrho/default.nix
index 0d2858713eba088756d5d65797c3e394e715da46..36f7dcc5993fec4073b30b270ed65d4563bfae45 100644
--- a/pkgs/applications/audio/distrho/default.nix
+++ b/pkgs/applications/audio/distrho/default.nix
@@ -9,13 +9,13 @@ let
else "linux";
in stdenv.mkDerivation rec {
pname = "distrho-ports";
- version = "2018-04-16";
+ version = "unstable-2019-10-09";
src = fetchFromGitHub {
owner = "DISTRHO";
repo = "DISTRHO-Ports";
- rev = version;
- sha256 = "0l4zwl4mli8jzch32a1fh7c88r9q17xnkxsdw17ds5hadnxlk12v";
+ rev = "7e62235e809e59770d0d91d2c48c3f50ce7c027a";
+ sha256 = "10hpsjcmk0cgcsic9r1wxyja9x6q9wb8w8254dlrnzyswl54r1f8";
};
configurePhase = ''
@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
runHook postConfigure
'';
- patchPhase = ''
+ postPatch = ''
sed -e "s#@./scripts#sh scripts#" -i Makefile
'';
diff --git a/pkgs/applications/audio/ecasound/default.nix b/pkgs/applications/audio/ecasound/default.nix
index 6c9cd628a518c1359202f46eb906964969e0add2..c17f6b745b37d25e37008908f6a713ce20494baa 100644
--- a/pkgs/applications/audio/ecasound/default.nix
+++ b/pkgs/applications/audio/ecasound/default.nix
@@ -15,11 +15,11 @@
stdenv.mkDerivation rec {
pname = "ecasound";
- version = "2.9.2";
+ version = "2.9.3";
src = fetchurl {
url = "https://ecasound.seul.org/download/ecasound-${version}.tar.gz";
- sha256 = "15rcs28fq2wfvfs66p5na7adq88b55qszbhshpizgdbyqzgr2jf1";
+ sha256 = "1m7njfjdb7sqf0lhgc4swihgdr4snkg8v02wcly08wb5ar2fr2s6";
};
buildInputs = [ alsaLib audiofile libjack2 liblo liboil libsamplerate libsndfile lilv lv2 ];
diff --git a/pkgs/applications/audio/fomp/default.nix b/pkgs/applications/audio/fomp/default.nix
index a92d331baadbbcf4b7e7ae1d8e40e5452f186181..9f7f0b0900740921fe0d027401bcd583f7eff56a 100644
--- a/pkgs/applications/audio/fomp/default.nix
+++ b/pkgs/applications/audio/fomp/default.nix
@@ -2,11 +2,11 @@
stdenv.mkDerivation rec {
pname = "fomp";
- version = "1.0.0";
+ version = "1.2.0";
src = fetchurl {
url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
- sha256 = "1hh2xhknanqn3iwp12ihl6bf8p7bqxryms9qk7mh21lixl42b8k5";
+ sha256 = "01ld6yjrqrki6zwac8lmwmqkr5rv0sdham4pfbfkjwck4hi1gqqw";
};
nativeBuildInputs = [ pkgconfig wafHook ];
diff --git a/pkgs/applications/audio/giada/default.nix b/pkgs/applications/audio/giada/default.nix
index 8907011c16fb8e3c64189a49cc0e17444a82a982..eff1d6411a15b77eebcf1e985b9c5b5917c729e3 100644
--- a/pkgs/applications/audio/giada/default.nix
+++ b/pkgs/applications/audio/giada/default.nix
@@ -5,13 +5,13 @@
stdenv.mkDerivation rec {
pname = "giada";
- version = "0.16.0";
+ version = "0.16.1";
src = fetchFromGitHub {
owner = "monocasual";
repo = pname;
rev = "v${version}";
- sha256 = "1lbxqa4kwzjdd79whrjgh8li453z4ckkjx4s4qzmrv7aqa2xmfsf";
+ sha256 = "0b3lhjs6myml5r5saky15523sbc3qr43r9rh047vhsiafmqdvfq1";
};
configureFlags = [ "--target=linux" ];
diff --git a/pkgs/applications/audio/gnaural/default.nix b/pkgs/applications/audio/gnaural/default.nix
deleted file mode 100644
index f5887e870db6e8cb1ff6c182a7dae6c327e14c7b..0000000000000000000000000000000000000000
--- a/pkgs/applications/audio/gnaural/default.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, gtk2, libsndfile, portaudio }:
-
-stdenv.mkDerivation rec {
- name = "gnaural-1.0.20110606";
- nativeBuildInputs = [ pkgconfig ];
- buildInputs = [ gtk2 libsndfile portaudio ];
- src = fetchurl {
- url = "mirror://sourceforge/gnaural/Gnaural/${name}.tar.gz";
- sha256 = "0p9rasz1jmxf16vnpj17g3vzdjygcyz3l6nmbq6wr402l61f1vy5";
- };
- meta = with stdenv.lib;
- { description = "Auditory binaural-beat generator";
- homepage = http://gnaural.sourceforge.net/;
- license = licenses.gpl2;
- maintainers = [ maintainers.ehmry ];
- platforms = platforms.linux;
- broken = true;
- };
-}
diff --git a/pkgs/applications/audio/gpodder/default.nix b/pkgs/applications/audio/gpodder/default.nix
index b972aae7de80782f6862fc594a7bbcb9ee91137c..332a633616ccb247a5a41f2e536fd66c53c3e76e 100644
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@@ -5,14 +5,14 @@
python3Packages.buildPythonApplication rec {
pname = "gpodder";
- version = "3.10.11";
+ version = "3.10.13";
format = "other";
src = fetchFromGitHub {
owner = pname;
repo = pname;
rev = version;
- sha256 = "15f5z3cnch9lpzbz73l4wjykv9n74y8djz5db53la2ql4ihaxfz9";
+ sha256 = "1h542syaxsx1hslfzlk3fx1nbp190zjw35kigw7a1kx1jwvfwapg";
};
patches = [
diff --git a/pkgs/applications/audio/guitarix/default.nix b/pkgs/applications/audio/guitarix/default.nix
index 91f4b1dcdfe9c31352cacc22f208ee0208278506..ca552882ba436be0e3d866018311fcd19694a0c6 100644
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@@ -12,11 +12,11 @@ in
stdenv.mkDerivation rec {
pname = "guitarix";
- version = "0.38.1";
+ version = "0.39.0";
src = fetchurl {
url = "mirror://sourceforge/guitarix/guitarix2-${version}.tar.xz";
- sha256 = "0bw7xnrx062nwb1bfj9x660h7069ncmz77szcs8icpqxrvhs7z80";
+ sha256 = "1nn80m1qagfhvv69za60f0w6ck87vmk77qmqarj7fbr8avwg63s9";
};
nativeBuildInputs = [ gettext intltool wrapGAppsHook pkgconfig python2 wafHook ];
diff --git a/pkgs/applications/audio/ingen/default.nix b/pkgs/applications/audio/ingen/default.nix
index 1e249b51fb76bb24550744b5e7b60dd9973f7e5c..9d3fb6aae40b2f308e845de502c54bd950bc36a8 100644
--- a/pkgs/applications/audio/ingen/default.nix
+++ b/pkgs/applications/audio/ingen/default.nix
@@ -1,23 +1,24 @@
{ stdenv, fetchgit, boost, ganv, glibmm, gtkmm2, libjack2, lilv
-, lv2Unstable, makeWrapper, pkgconfig, python, raul, rdflib, serd, sord, sratom
+, lv2, makeWrapper, pkgconfig, python, raul, rdflib, serd, sord, sratom
, wafHook
, suil
}:
stdenv.mkDerivation rec {
- name = "ingen-unstable-${rev}";
- rev = "2017-07-22";
+ pname = "ingen";
+ version = "unstable-2019-12-09";
+ name = "${pname}-${version}";
src = fetchgit {
- url = "https://git.drobilla.net/cgit.cgi/ingen.git";
- rev = "cc4a4db33f4d126a07a4a498e053c5fb9a883be3";
- sha256 = "1gmwmml486r9zq4w65v91mfaz36af9zzyjkmi74m8qmh67ffqn3w";
+ url = "https://gitlab.com/drobilla/ingen.git";
+ rev = "e32f32a360f2bf8f017ea347b6d1e568c0beaf68";
+ sha256 = "0wjn2i3j7jb0bmxymg079xpk4iplb91q0xqqnvnpvyldrr7gawlb";
deepClone = true;
};
nativeBuildInputs = [ pkgconfig wafHook ];
buildInputs = [
- boost ganv glibmm gtkmm2 libjack2 lilv lv2Unstable makeWrapper
+ boost ganv glibmm gtkmm2 libjack2 lilv lv2 makeWrapper
python raul serd sord sratom suil
];
@@ -38,7 +39,7 @@ stdenv.mkDerivation rec {
meta = with stdenv.lib; {
description = "A modular audio processing system using JACK and LV2 or LADSPA plugins";
homepage = http://drobilla.net/software/ingen;
- license = licenses.gpl3;
+ license = licenses.agpl3Plus;
maintainers = [ maintainers.goibhniu ];
platforms = platforms.linux;
};
diff --git a/pkgs/applications/audio/jalv/default.nix b/pkgs/applications/audio/jalv/default.nix
index a40d5101b34f228af783dc0c9ee4428a25d89ec2..51ec102dbfd2119eb42da3730324d0880b99eb10 100644
--- a/pkgs/applications/audio/jalv/default.nix
+++ b/pkgs/applications/audio/jalv/default.nix
@@ -1,18 +1,18 @@
-{ stdenv, fetchurl, gtk2, libjack2, lilv, lv2, pkgconfig, python
+{ stdenv, fetchurl, gtk3, libjack2, lilv, lv2, pkgconfig, python
, serd, sord , sratom, suil, wafHook }:
stdenv.mkDerivation rec {
pname = "jalv";
- version = "1.6.2";
+ version = "1.6.4";
src = fetchurl {
url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
- sha256 = "13al2hb9s3m7jgbg051x704bmzmcg4wb56cfh8z588kiyh0mxpaa";
+ sha256 = "1wwfn7yzbs37s2rdlfjgks63svd5g14yyzd2gdl7h0z12qncwsy2";
};
nativeBuildInputs = [ pkgconfig wafHook ];
buildInputs = [
- gtk2 libjack2 lilv lv2 python serd sord sratom suil
+ gtk3 libjack2 lilv lv2 python serd sord sratom suil
];
meta = with stdenv.lib; {
diff --git a/pkgs/applications/audio/kid3/default.nix b/pkgs/applications/audio/kid3/default.nix
index 5571b12f3ef61201e4115b010324e70b6bc671ab..dcd305abdee6a7e0d501551453fb6639d7b39b25 100644
--- a/pkgs/applications/audio/kid3/default.nix
+++ b/pkgs/applications/audio/kid3/default.nix
@@ -9,11 +9,11 @@
stdenv.mkDerivation rec {
pname = "kid3";
- version = "3.8.1";
+ version = "3.8.2";
src = fetchurl {
url = "mirror://sourceforge/project/kid3/kid3/${version}/${pname}-${version}.tar.gz";
- sha256 = "1d2lr500dx7gnxw2vrvpbhadpn313ly3zyp178864z26dnfkjv8x";
+ sha256 = "051y77swpi9isx275gwzl4fn3igd2dmixbszv9m3h0h9lqhcjrvr";
};
nativeBuildInputs = [ wrapQtAppsHook ];
diff --git a/pkgs/applications/audio/mda-lv2/default.nix b/pkgs/applications/audio/mda-lv2/default.nix
index 61f2bc33f7f7f3fd52d46bcb21900d26ae5dbb1e..6c4170cf0fb6df24d175995ea0db8f084ae50328 100644
--- a/pkgs/applications/audio/mda-lv2/default.nix
+++ b/pkgs/applications/audio/mda-lv2/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fftwSinglePrec, lv2, pkgconfig, python, wafHook }:
+{ stdenv, fetchurl, fftwSinglePrec, lv2, pkgconfig, wafHook }:
stdenv.mkDerivation rec {
pname = "mda-lv2";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
};
nativeBuildInputs = [ pkgconfig wafHook ];
- buildInputs = [ fftwSinglePrec lv2 python ];
+ buildInputs = [ fftwSinglePrec lv2 ];
meta = with stdenv.lib; {
homepage = http://drobilla.net/software/mda-lv2/;
diff --git a/pkgs/applications/audio/muse/default.nix b/pkgs/applications/audio/muse/default.nix
index 372c8faf773d522de26a8362bf984965d5d93332..f1fad05beced4b41a1b5c6bf58fcf5fa5904abf7 100644
--- a/pkgs/applications/audio/muse/default.nix
+++ b/pkgs/applications/audio/muse/default.nix
@@ -1,7 +1,9 @@
{ stdenv
, fetchFromGitHub
, libjack2
-, qt5
+, wrapQtAppsHook
+, qtsvg
+, qttools
, cmake
, libsndfile
, libsamplerate
@@ -13,7 +15,6 @@
, dssi
, liblo
, pkgconfig
-, gitAndTools
}:
stdenv.mkDerivation {
@@ -45,14 +46,14 @@ stdenv.mkDerivation {
nativeBuildInputs = [
pkgconfig
- gitAndTools.gitFull
+ wrapQtAppsHook
+ qttools
+ cmake
];
buildInputs = [
libjack2
- qt5.qtsvg
- qt5.qttools
- cmake
+ qtsvg
libsndfile
libsamplerate
ladspaH
@@ -65,15 +66,4 @@ stdenv.mkDerivation {
];
sourceRoot = "source/muse3";
-
- buildPhase = ''
- cd ..
- bash compile_muse.sh
- '';
-
- installPhase = ''
- mkdir $out
- cd build
- make install
- '';
}
diff --git a/pkgs/applications/audio/ncmpc/default.nix b/pkgs/applications/audio/ncmpc/default.nix
index 58eb5462ef84b3f8603c6f4d15a9c656ae634c3f..c95177cd3821e215726e55be62056d4bc4629fae 100644
--- a/pkgs/applications/audio/ncmpc/default.nix
+++ b/pkgs/applications/audio/ncmpc/default.nix
@@ -10,13 +10,13 @@ assert pcreSupport -> pcre != null;
stdenv.mkDerivation rec {
pname = "ncmpc";
- version = "0.36";
+ version = "0.37";
src = fetchFromGitHub {
owner = "MusicPlayerDaemon";
repo = "ncmpc";
rev = "v${version}";
- sha256 = "1ssmk1p43gjhcqi86sh6b7csqpwwpf3hs32cmnylv6pmbcwbs69h";
+ sha256 = "1b0vd0h49kjg4nxjfjrcg8gzplz93ryr6xyfha2pvhlrzdd2d1lj";
};
buildInputs = [ glib ncurses mpd_clientlib boost ]
diff --git a/pkgs/applications/audio/noise-repellent/default.nix b/pkgs/applications/audio/noise-repellent/default.nix
index 146e13f34de15eff190cbd91cdd3322e885bad93..bc5b35396e239ceaa27c0e575e8d7f3e75921139 100644
--- a/pkgs/applications/audio/noise-repellent/default.nix
+++ b/pkgs/applications/audio/noise-repellent/default.nix
@@ -2,13 +2,13 @@
stdenv.mkDerivation rec {
pname = "noise-repellent";
- version = "unstable-2018-12-29";
+ version = "0.1.5";
src = fetchFromGitHub {
owner = "lucianodato";
repo = pname;
- rev = "9efdd0b41ec184a792087c87cbf5382f455e33ec";
- sha256 = "0pn9cxapfvb5l62q86bchyfll1290vi0rhrzarb1jpc4ix7kz53c";
+ rev = version;
+ sha256 = "0hb89x9i2knzan46q4nwscf5zmnb2nwf4w13xl2c0y1mx1ls1mwl";
fetchSubmodules = true;
};
diff --git a/pkgs/applications/audio/padthv1/default.nix b/pkgs/applications/audio/padthv1/default.nix
index 6d97a2da739f18538c335f6d65d20f7b04233c58..0cb0f00844e3f9ff2d6f98473498b72f81928cc9 100644
--- a/pkgs/applications/audio/padthv1/default.nix
+++ b/pkgs/applications/audio/padthv1/default.nix
@@ -2,11 +2,11 @@
mkDerivation rec {
pname = "padthv1";
- version = "0.9.11";
+ version = "0.9.12";
src = fetchurl {
url = "mirror://sourceforge/padthv1/${pname}-${version}.tar.gz";
- sha256 = "02yfwyirjqxa075yqdnci9b9k57kdmkjvn9gnpdbnjp887pds76g";
+ sha256 = "1zz3rz990k819q0rlzllqdwvag0x9k63443lb0mp8lwlczxnza6l";
};
buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools fftw ];
diff --git a/pkgs/applications/audio/pavucontrol/default.nix b/pkgs/applications/audio/pavucontrol/default.nix
index fee86cb5bcaee7408e10d076be596d019e55bb5a..d07cf8a476b5b34ef469a5689dd31eed2c6b2f6c 100644
--- a/pkgs/applications/audio/pavucontrol/default.nix
+++ b/pkgs/applications/audio/pavucontrol/default.nix
@@ -1,5 +1,5 @@
{ fetchurl, stdenv, pkgconfig, intltool, libpulseaudio, gtkmm3
-, libcanberra-gtk3, makeWrapper, gnome3 }:
+, libcanberra-gtk3, gnome3, wrapGAppsHook }:
stdenv.mkDerivation rec {
pname = "pavucontrol";
@@ -10,16 +10,10 @@ stdenv.mkDerivation rec {
sha256 = "1qhlkl3g8d7h72xjskii3g1l7la2cavwp69909pzmbi2jyn5pi4g";
};
- preFixup = ''
- wrapProgram "$out/bin/pavucontrol" \
- --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
- --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS"
- '';
-
- buildInputs = [ libpulseaudio gtkmm3 libcanberra-gtk3 makeWrapper
+ buildInputs = [ libpulseaudio gtkmm3 libcanberra-gtk3
gnome3.adwaita-icon-theme ];
- nativeBuildInputs = [ pkgconfig intltool ];
+ nativeBuildInputs = [ pkgconfig intltool wrapGAppsHook ];
configureFlags = [ "--disable-lynx" ];
diff --git a/pkgs/applications/audio/pulseeffects/default.nix b/pkgs/applications/audio/pulseeffects/default.nix
index 31e1915486286b12314443f2d86bcbc78f838448..00c5af4422df7bbea93eb1b9b0f2561ec01cde4b 100644
--- a/pkgs/applications/audio/pulseeffects/default.nix
+++ b/pkgs/applications/audio/pulseeffects/default.nix
@@ -46,13 +46,13 @@ let
];
in stdenv.mkDerivation rec {
pname = "pulseeffects";
- version = "4.7.0";
+ version = "4.7.1";
src = fetchFromGitHub {
owner = "wwmm";
repo = "pulseeffects";
rev = "v${version}";
- sha256 = "1cpiill24c54sy97xm1r0sqqpxj6ar40pnnwb72qs8b9zzci920r";
+ sha256 = "1r1hk5zp2cgrwyqkvp8kg2dkbihdyx3ydzhmirkwya8jag9pwadd";
};
nativeBuildInputs = [
diff --git a/pkgs/applications/audio/qmmp/default.nix b/pkgs/applications/audio/qmmp/default.nix
index 801d32189bfd03748e20b08b156265af31c6735a..a941ea485b79547a70ae8cee5ce914418d77df69 100644
--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@@ -29,11 +29,11 @@
# handle that.
mkDerivation rec {
- name = "qmmp-1.3.5";
+ name = "qmmp-1.3.6";
src = fetchurl {
url = "http://qmmp.ylsoftware.com/files/${name}.tar.bz2";
- sha256 = "0h7kcqzhfvk610937pwrhizcdgd4n7ncl1vayv6sj3va1x7pv6xm";
+ sha256 = "0dihy6v6j1cfx4qgwgajdn8rx6nf8x5srk8yjki9xh1mlcaanhp8";
};
nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/applications/audio/quodlibet/default.nix b/pkgs/applications/audio/quodlibet/default.nix
index 573dca518e3a972607a4fa546bb1855dd56781e6..597cf68f4d09e36707735105efa02a3dea4b39d9 100644
--- a/pkgs/applications/audio/quodlibet/default.nix
+++ b/pkgs/applications/audio/quodlibet/default.nix
@@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication rec {
nativeBuildInputs = [ wrapGAppsHook gettext ];
- checkInputs = with python3.pkgs; [ pytest pytest_xdist pyflakes pycodestyle polib xvfb_run dbus.daemon glibcLocales ];
+ checkInputs = [ gdk-pixbuf ] ++ (with python3.pkgs; [ pytest pytest_xdist polib xvfb_run dbus.daemon glibcLocales ]);
buildInputs = [ gnome3.adwaita-icon-theme libsoup glib glib-networking gtk3 webkitgtk gdk-pixbuf keybinder3 gtksourceview libmodplug libappindicator-gtk3 kakasi gobject-introspection ]
++ (if xineBackend then [ xineLib ] else with gst_all_1;
@@ -33,13 +33,23 @@ python3.pkgs.buildPythonApplication rec {
LC_ALL = "en_US.UTF-8";
+ pytestFlags = stdenv.lib.optionals (xineBackend || !withGstPlugins) [
+ "--ignore=tests/plugin/test_replaygain.py"
+ ] ++ [
+ # upstream does actually not enforce source code linting
+ "--ignore=tests/quality"
+ # build failure on Arch Linux
+ # https://github.com/NixOS/nixpkgs/pull/77796#issuecomment-575841355
+ "--ignore=tests/test_operon.py"
+ ];
+
checkPhase = ''
runHook preCheck
- env XDG_DATA_DIRS="$out/share:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS" \
+ env XDG_DATA_DIRS="$out/share:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_ICON_DIRS:$XDG_DATA_DIRS" \
HOME=$(mktemp -d) \
xvfb-run -s '-screen 0 800x600x24' dbus-run-session \
--config-file=${dbus.daemon}/share/dbus-1/session.conf \
- py.test${stdenv.lib.optionalString (xineBackend || !withGstPlugins) " --ignore=tests/plugin/test_replaygain.py"}
+ py.test $pytestFlags
runHook postCheck
'';
@@ -65,6 +75,5 @@ python3.pkgs.buildPythonApplication rec {
maintainers = with maintainers; [ coroa sauyon ];
homepage = https://quodlibet.readthedocs.io/en/latest/;
- broken = true;
};
}
diff --git a/pkgs/applications/audio/rhythmbox/default.nix b/pkgs/applications/audio/rhythmbox/default.nix
index 24b342a26a92d3465199f9316307846cc07a952b..b6bff79fa03a119f7d803b6fe4b86395860954fb 100644
--- a/pkgs/applications/audio/rhythmbox/default.nix
+++ b/pkgs/applications/audio/rhythmbox/default.nix
@@ -17,13 +17,13 @@
}:
let
pname = "rhythmbox";
- version = "3.4.3";
+ version = "3.4.4";
in stdenv.mkDerivation rec {
name = "${pname}-${version}";
src = fetchurl {
url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
- sha256 = "1yx3n7p9vmv23jsv98fxwq95n78awdxqm8idhyhxx2d6vk4w1hgx";
+ sha256 = "142xcvw4l19jyr5i72nbnrihs953pvrrzcbijjn9dxmxszbv03pf";
};
nativeBuildInputs = [
diff --git a/pkgs/applications/audio/rofi-mpd/default.nix b/pkgs/applications/audio/rofi-mpd/default.nix
index 9def4a292f618e416ac25b295d2e7fc92cc674db..97c737675ad8c878c336475ddceefc8a48b1d57e 100644
--- a/pkgs/applications/audio/rofi-mpd/default.nix
+++ b/pkgs/applications/audio/rofi-mpd/default.nix
@@ -2,16 +2,16 @@
python3Packages.buildPythonApplication rec {
pname = "rofi-mpd";
- version = "1.1.0";
+ version = "2.0.1";
src = fetchFromGitHub {
owner = "JakeStanger";
repo = "Rofi_MPD";
rev = "v${version}";
- sha256 = "0pdra1idgas3yl9z9v7b002igwg2c1mv0yw2ffb8rsbx88x4gbai";
+ sha256 = "12zzx0m2nwyzxzzqgzq30a27k015kcw4ylvs7cyalf5gf6sg27kl";
};
- propagatedBuildInputs = with python3Packages; [ mutagen mpd2 ];
+ propagatedBuildInputs = with python3Packages; [ mutagen mpd2 toml appdirs ];
# upstream doesn't contain a test suite
doCheck = false;
diff --git a/pkgs/applications/audio/rosegarden/default.nix b/pkgs/applications/audio/rosegarden/default.nix
index 7c4cefb6ba4bc3a520479b8cd161b2739c6eeda8..8d8e3e1b6c0ea2e1700f44034ff17531e2d745a5 100644
--- a/pkgs/applications/audio/rosegarden/default.nix
+++ b/pkgs/applications/audio/rosegarden/default.nix
@@ -1,14 +1,14 @@
{ stdenv, fetchurl, cmake, makedepend, perl, pkgconfig, qttools, wrapQtAppsHook
-, dssi, fftwSinglePrec, ladspaH, ladspaPlugins, libjack2
+, dssi, fftwSinglePrec, ladspaH, ladspaPlugins, libjack2, alsaLib
, liblo, liblrdf, libsamplerate, libsndfile, lirc ? null, qtbase }:
stdenv.mkDerivation (rec {
- version = "19.06";
+ version = "19.12";
pname = "rosegarden";
src = fetchurl {
url = "mirror://sourceforge/rosegarden/${pname}-${version}.tar.bz2";
- sha256 = "169qb58v2s8va59hzkih8nqb2aipsqlrbfs8q39ywqa8w5d60gcc";
+ sha256 = "1qcaxc6hdzva7kwxxhgl95437fagjbxzv4mihsgpr7y9qk08ppw1";
};
patchPhase = ''
@@ -30,6 +30,7 @@ stdenv.mkDerivation (rec {
libsndfile
lirc
qtbase
+ alsaLib
];
enableParallelBuilding = true;
diff --git a/pkgs/applications/audio/samplv1/default.nix b/pkgs/applications/audio/samplv1/default.nix
index 4874969b633245931e4747a587e368e6741f0d45..8c8e5407f7aec343eddf40f3a5da8e74a3282177 100644
--- a/pkgs/applications/audio/samplv1/default.nix
+++ b/pkgs/applications/audio/samplv1/default.nix
@@ -2,11 +2,11 @@
stdenv.mkDerivation rec {
pname = "samplv1";
- version = "0.9.11";
+ version = "0.9.12";
src = fetchurl {
url = "mirror://sourceforge/samplv1/${pname}-${version}.tar.gz";
- sha256 = "17zs8kvvwqv00bm4lxpn09a5hxjlbz7k5mkl3k7jspw7rqn3djf2";
+ sha256 = "0xzjxiqzcf1ygabrjsy0iachhnpy85rp9519fmj2f568r6ml6hzg";
};
buildInputs = [ libjack2 alsaLib liblo libsndfile lv2 qt5.qtbase qt5.qttools];
diff --git a/pkgs/applications/audio/sfizz/default.nix b/pkgs/applications/audio/sfizz/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..d785d37806580012ac177eb29845ea0b9736861a
--- /dev/null
+++ b/pkgs/applications/audio/sfizz/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub , cmake, libjack2, libsndfile }:
+
+stdenv.mkDerivation rec {
+ pname = "sfizz";
+ version = "unstable-2020-01-24";
+
+ src = fetchFromGitHub {
+ owner = "sfztools";
+ repo = pname;
+ rev = "b9c332777853cb35faeeda2ff4bf34ea7121ffb9";
+ sha256 = "0wzgwpcwal5a7ifrm1hx8y6vx832qixk9ilp8wkjnsdxj6i88p2c";
+ fetchSubmodules = true;
+ };
+
+ nativeBuildInputs = [ cmake ];
+
+ buildInputs = [ libjack2 libsndfile ];
+
+ cmakeFlags = [
+ "-DCMAKE_BUILD_TYPE=Release"
+ "-DSFIZZ_TESTS=ON"
+ ];
+
+ meta = with stdenv.lib; {
+ homepage = "https://github.com/sfztools/sfizz";
+ description = "SFZ jack client and LV2 plugin";
+ license = licenses.bsd2;
+ maintainers = [ maintainers.magnetophon ];
+ platforms = platforms.all;
+ badPlatforms = platforms.darwin;
+ };
+}
diff --git a/pkgs/applications/audio/sonic-visualiser/default.nix b/pkgs/applications/audio/sonic-visualiser/default.nix
index 501d097f29faabf42b5ec0a20cedd127e405cf4a..6164c1cfe933c03e4a25a30a675322e6f4c0c27f 100644
--- a/pkgs/applications/audio/sonic-visualiser/default.nix
+++ b/pkgs/applications/audio/sonic-visualiser/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
meta = with stdenv.lib; {
description = "View and analyse contents of music audio files";
- homepage = http://www.sonicvisualiser.org/;
+ homepage = https://www.sonicvisualiser.org/;
license = licenses.gpl2Plus;
maintainers = [ maintainers.goibhniu maintainers.marcweber ];
platforms = platforms.linux;
diff --git a/pkgs/applications/audio/spotify-tui/default.nix b/pkgs/applications/audio/spotify-tui/default.nix
index 973062ecb750aee44652773efca48a3222eb4d30..fc630e78078fcd8dee78ccf8d1c6bf9b22279de2 100644
--- a/pkgs/applications/audio/spotify-tui/default.nix
+++ b/pkgs/applications/audio/spotify-tui/default.nix
@@ -2,16 +2,16 @@
rustPlatform.buildRustPackage rec {
pname = "spotify-tui";
- version = "0.11.0";
+ version = "0.13.0";
src = fetchFromGitHub {
owner = "Rigellute";
repo = "spotify-tui";
rev = "v${version}";
- sha256 = "1pshwn486msn418dilk57rl9471aas0dif765nx1p9xgkrjpb7wa";
+ sha256 = "0gp7xb63icraqg7f0j91q474acph3ligzak2k8qqr9cqbgg509f4";
};
- cargoSha256 = "0020igycgikkbd649hv6xlpn13dij4g7yc43fic9z710p6nsxqaq";
+ cargoSha256 = "1364z9jz3mnba3pii5h7imqlwlvbp146pcd5q8w61lsmdr2iyha2";
nativeBuildInputs = [ pkgconfig ] ++ stdenv.lib.optionals stdenv.isLinux [ python3 ];
buildInputs = [ openssl ]
@@ -21,6 +21,7 @@ rustPlatform.buildRustPackage rec {
meta = with stdenv.lib; {
description = "Spotify for the terminal written in Rust";
homepage = https://github.com/Rigellute/spotify-tui;
+ changelog = "https://github.com/Rigellute/spotify-tui/releases/tag/v${version}";
license = licenses.mit;
maintainers = with maintainers; [ jwijenbergh ];
platforms = platforms.all;
diff --git a/pkgs/applications/audio/spotifyd/default.nix b/pkgs/applications/audio/spotifyd/default.nix
index 36ab017c5cbb01e9acc64a6aecdf0bc26903b779..30cedfa8bb8f11f5f983300fef6bebdcfeac6b44 100644
--- a/pkgs/applications/audio/spotifyd/default.nix
+++ b/pkgs/applications/audio/spotifyd/default.nix
@@ -6,16 +6,16 @@
rustPlatform.buildRustPackage rec {
pname = "spotifyd";
- version = "0.2.20";
+ version = "0.2.24";
src = fetchFromGitHub {
owner = "Spotifyd";
repo = "spotifyd";
rev = "v${version}";
- sha256 = "1hf4wpk7r0s4jpjhxaz67y1hd8jx9ns5imd85r3cdg4lxf3j5gph";
+ sha256 = "08i0zm7kgprixqjpgaxk7xid1njgj6lmi896jf9fsjqzdzlblqk8";
};
- cargoSha256 = "1h3fis47hmxvppiv1icjhgp48nd46gayfcmzfjs34q6jask90n0w";
+ cargoSha256 = "0kl8xl2qhzf8wb25ajw59frgym62lkg7p72d8z0xmkqjjcg2nyib";
cargoBuildFlags = [
"--no-default-features"
diff --git a/pkgs/applications/audio/squeezelite/default.nix b/pkgs/applications/audio/squeezelite/default.nix
index 3184f89ced9557a17693b796d230d094e6bb12c8..4648c9b5ab320bae023be9f8633b35fe3fb2d2b4 100644
--- a/pkgs/applications/audio/squeezelite/default.nix
+++ b/pkgs/applications/audio/squeezelite/default.nix
@@ -1,6 +1,9 @@
-{ stdenv, fetchFromGitHub, alsaLib, faad2, flac, libmad, libvorbis, mpg123 }:
+{ stdenv, fetchFromGitHub, alsaLib, faad2, flac, libmad, libvorbis, makeWrapper, mpg123 }:
-stdenv.mkDerivation {
+let
+ runtimeDeps = [ faad2 flac libmad libvorbis mpg123 ];
+ rpath = stdenv.lib.makeLibraryPath runtimeDeps;
+in stdenv.mkDerivation {
name = "squeezelite-git-2018-08-14";
src = fetchFromGitHub {
@@ -10,7 +13,8 @@ stdenv.mkDerivation {
sha256 = "0di3d5qy8fhawijq6bxy524fgffvzl08dprrws0fs2j1a70fs0fh";
};
- buildInputs = [ alsaLib faad2 flac libmad libvorbis mpg123 ];
+ buildInputs = [ alsaLib ] ++ runtimeDeps;
+ nativeBuildInputs = [ makeWrapper ];
enableParallelBuilding = true;
@@ -20,6 +24,7 @@ stdenv.mkDerivation {
install -Dm755 -t $out/bin squeezelite
install -Dm644 -t $out/share/doc/squeezelite *.txt *.md
+ wrapProgram $out/bin/squeezelite --set LD_LIBRARY_PATH $RPATH
runHook postInstall
'';
@@ -29,4 +34,5 @@ stdenv.mkDerivation {
license = licenses.gpl3;
platforms = platforms.linux;
};
+ RPATH = rpath;
}
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/applications/audio/strawberry/default.nix
index 07e7bb84c565c1c3d12da853d62e3a0c43a44b16..ad5685f71b02432202d35ce07187beab13f45ab0 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@@ -35,13 +35,13 @@
mkDerivation rec {
pname = "strawberry";
- version = "0.6.7";
+ version = "0.6.8";
src = fetchFromGitHub {
owner = "jonaski";
repo = pname;
rev = version;
- sha256 = "14bw4hmysrbl4havz03s3wl8bv76380wddf5zzrjvfjjpwn333r6";
+ sha256 = "0jc1m1855dg3f1i1p744c5s42ssmjs61znw4cf28ifamw1nbr1r5";
};
buildInputs = [
diff --git a/pkgs/applications/audio/string-machine/default.nix b/pkgs/applications/audio/string-machine/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..67053baa35fffd7b6e38a251f2a2815d014539bf
--- /dev/null
+++ b/pkgs/applications/audio/string-machine/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, boost, cairo, lv2, pkg-config }:
+
+stdenv.mkDerivation rec {
+ pname = "string-machine";
+ version = "unstable-2020-01-20";
+
+ src = fetchFromGitHub {
+ owner = "jpcima";
+ repo = pname;
+ rev = "188082dd0beb9a3c341035604841c53675fe66c4";
+ sha256 = "0l9xrzp3f0hk6h320qh250a0n1nbd6qhjmab21sjmrlb4ngy672v";
+ fetchSubmodules = true;
+ };
+
+ postPatch = ''
+ patchShebangs ./dpf/utils/generate-ttl.sh
+ '';
+
+ nativeBuildInputs = [ pkg-config ];
+
+ buildInputs = [
+ boost cairo lv2
+ ];
+
+ makeFlags = [
+ "PREFIX=$(out)"
+ ];
+
+ meta = with stdenv.lib; {
+ homepage = "https://github.com/jpcima/string-machine";
+ description = "Digital model of electronic string ensemble instrument";
+ maintainers = [ maintainers.magnetophon ];
+ platforms = intersectLists platforms.linux platforms.x86;
+ license = licenses.boost;
+ };
+}
diff --git a/pkgs/applications/audio/sunvox/default.nix b/pkgs/applications/audio/sunvox/default.nix
index 1a3d1a96c85dc2423e51be7e443f2137251bfd61..738b876026a8670f12389a6f97f74a3c55e983ee 100644
--- a/pkgs/applications/audio/sunvox/default.nix
+++ b/pkgs/applications/audio/sunvox/default.nix
@@ -13,11 +13,11 @@ let
in
stdenv.mkDerivation rec {
pname = "SunVox";
- version = "1.9.4c";
+ version = "1.9.5";
src = fetchurl {
url = "http://www.warmplace.ru/soft/sunvox/sunvox-${version}.zip";
- sha256 = "19c1a4e28459e31e1a19986f219d4caa4eb2cb5bc9f6aa994abdbb2ebf6ac4ac";
+ sha256 = "011cyagbqqkvnrxxq196zsvcyn3gksjfsaas02xl8ncjwfj084di";
};
buildInputs = [ unzip ];
diff --git a/pkgs/applications/audio/synthv1/default.nix b/pkgs/applications/audio/synthv1/default.nix
index 349c7acc3db37ced5e59ea1b1655d057e918bbc4..f58166a5984690bf490796f1331a5f0fb29e8487 100644
--- a/pkgs/applications/audio/synthv1/default.nix
+++ b/pkgs/applications/audio/synthv1/default.nix
@@ -2,11 +2,11 @@
mkDerivation rec {
pname = "synthv1";
- version = "0.9.11";
+ version = "0.9.12";
src = fetchurl {
url = "mirror://sourceforge/synthv1/${pname}-${version}.tar.gz";
- sha256 = "116k2vca9dygvsd684wvxm61p0l1xrrgdph4qrrprlsr6vj0llgm";
+ sha256 = "1amxrl1cqwgncw5437r572frgf6xhss3cfpbgh178i8phlq1q731";
};
buildInputs = [ qtbase qttools libjack2 alsaLib liblo lv2 ];
diff --git a/pkgs/applications/audio/vcv-rack/default.nix b/pkgs/applications/audio/vcv-rack/default.nix
index 11daabbf8104cb80334d5bb3615748cadfed297c..21aa27fa5bc11de7346d49a94801bd32aaafce99 100644
--- a/pkgs/applications/audio/vcv-rack/default.nix
+++ b/pkgs/applications/audio/vcv-rack/default.nix
@@ -93,7 +93,7 @@ with stdenv.lib; stdenv.mkDerivation rec {
meta = with stdenv.lib; {
description = "Open-source virtual modular synthesizer";
- homepage = http://vcvrack.com/;
+ homepage = https://vcvrack.com/;
# The source is BSD-3 licensed, some of the art is CC-BY-NC 4.0 or under a
# no-derivatives clause
license = with licenses; [ bsd3 cc-by-nc-40 unfreeRedistributable ];
diff --git a/pkgs/applications/audio/vkeybd/default.nix b/pkgs/applications/audio/vkeybd/default.nix
index 485edaa1ff27538b0b5dcba724c5d14f2bb0f0f6..3f77a6574724f8ef60122ea46c5459077c2ba78d 100644
--- a/pkgs/applications/audio/vkeybd/default.nix
+++ b/pkgs/applications/audio/vkeybd/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
meta = with stdenv.lib; {
description = "Virtual MIDI keyboard";
- homepage = http://www.alsa-project.org/~tiwai/alsa.html;
+ homepage = https://www.alsa-project.org/~tiwai/alsa.html;
license = licenses.gpl2Plus;
platforms = platforms.linux;
maintainers = [ maintainers.goibhniu ];
diff --git a/pkgs/applications/audio/x42-plugins/default.nix b/pkgs/applications/audio/x42-plugins/default.nix
index bae9cef715015d737d0808e9c3b23a5c5067ee98..f4087506daa3247a5405974c3f7eb6a975866cf7 100644
--- a/pkgs/applications/audio/x42-plugins/default.nix
+++ b/pkgs/applications/audio/x42-plugins/default.nix
@@ -3,12 +3,12 @@
, libGLU, lv2, gtk2, cairo, pango, fftwFloat, zita-convolver }:
stdenv.mkDerivation rec {
- version = "20191215";
+ version = "20200114";
pname = "x42-plugins";
src = fetchurl {
url = "https://gareus.org/misc/x42-plugins/${pname}-${version}.tar.xz";
- sha256 = "1mwfvhsvc0qgjyiwd8pmmam1mav43lmv39fljhmj9yri558v5g1c";
+ sha256 = "02f8wnsl9wg7pgf4sshr0hdjfjkwln870ffgjmb01nqk37v7hiyn";
};
nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/blockchains/bitcoin-abc.nix b/pkgs/applications/blockchains/bitcoin-abc.nix
index 85d6dcbdbe6864166f0cdd373947e14764fd2fd4..6b339091701c8e41d0e3e32bf5a750fb3253c852 100644
--- a/pkgs/applications/blockchains/bitcoin-abc.nix
+++ b/pkgs/applications/blockchains/bitcoin-abc.nix
@@ -7,13 +7,13 @@ with stdenv.lib;
mkDerivation rec {
name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
- version = "0.20.9";
+ version = "0.20.12";
src = fetchFromGitHub {
owner = "bitcoin-ABC";
repo = "bitcoin-abc";
rev = "v${version}";
- sha256 = "1dmk7vm4r9n0yia8dazlx4fmr8i1r8cz8p1pj11glpa3pwda3669";
+ sha256 = "0ar3syrz7psf83bh24hn2y0mxjgn7cjqk2h8q4cgdp7mq55v8ynj";
};
patches = [ ./fix-bitcoin-qt-build.patch ];
diff --git a/pkgs/applications/blockchains/bitcoin-gold.nix b/pkgs/applications/blockchains/bitcoin-gold.nix
new file mode 100644
index 0000000000000000000000000000000000000000..7205e882c314528629fef93853cac41e93a6bbe8
--- /dev/null
+++ b/pkgs/applications/blockchains/bitcoin-gold.nix
@@ -0,0 +1,70 @@
+{ stdenv
+, fetchFromGitHub
+, openssl
+, boost
+, libevent
+, autoreconfHook
+, db4
+, pkgconfig
+, protobuf
+, hexdump
+, zeromq
+, libsodium
+, withGui
+, qtbase ? null
+, qttools ? null
+, wrapQtAppsHook ? null
+}:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+
+ pname = "bitcoin" + toString (optional (!withGui) "d") + "-gold";
+ version = "0.15.2";
+
+ src = fetchFromGitHub {
+ owner = "BTCGPU";
+ repo = "BTCGPU";
+ rev = "v${version}";
+ sha256 = "0grd1cd8d2nsrxl27la85kcan09z73fn70ncr9km4iccaj5pg12h";
+ };
+
+ nativeBuildInputs = [
+ autoreconfHook
+ pkgconfig
+ hexdump
+ ] ++ optionals withGui [
+ wrapQtAppsHook
+ ];
+
+ buildInputs = [
+ openssl
+ boost
+ libevent
+ db4
+ zeromq
+ libsodium
+ ] ++ optionals withGui [
+ qtbase
+ qttools
+ protobuf
+ ];
+
+ enableParallelBuilding = true;
+
+ configureFlags = [
+ "--with-boost-libdir=${boost.out}/lib"
+ ] ++ optionals withGui [
+ "--with-gui=qt5"
+ "--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin"
+ ];
+
+ meta = {
+ description = "BTG is a cryptocurrency with Bitcoin fundamentals, mined on common GPUs instead of specialty ASICs";
+ homepage = "https://bitcoingold.org/";
+ license = licenses.mit;
+ maintainers = [ maintainers.mmahut ];
+ platforms = platforms.linux;
+ };
+}
diff --git a/pkgs/applications/blockchains/bitcoin.nix b/pkgs/applications/blockchains/bitcoin.nix
index 2fa8ea6467c1ad6a246a60e35fcf2404b7e337c3..c1143f898e28542dbe85316734e3ba1ac18094e1 100644
--- a/pkgs/applications/blockchains/bitcoin.nix
+++ b/pkgs/applications/blockchains/bitcoin.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, autoreconfHook, openssl, db48, boost, zeromq, rapidcheck
+{ stdenv, fetchurl, pkgconfig, autoreconfHook, openssl, db48, boost, zeromq, rapidcheck, hexdump
, zlib, miniupnpc, qtbase ? null, qttools ? null, wrapQtAppsHook ? null, utillinux, python3, qrencode, libevent
, withGui }:
@@ -31,6 +31,7 @@ in stdenv.mkDerivation rec {
nativeBuildInputs =
[ pkgconfig autoreconfHook ]
+ ++ optional stdenv.isDarwin hexdump
++ optional withGui wrapQtAppsHook;
buildInputs = [ openssl db48 boost zlib zeromq
miniupnpc libevent]
@@ -75,7 +76,6 @@ in stdenv.mkDerivation rec {
homepage = http://www.bitcoin.org/;
maintainers = with maintainers; [ roconnor AndersonTorres ];
license = licenses.mit;
- # bitcoin needs hexdump to build, which doesn't seem to build on darwin at the moment.
- platforms = platforms.linux;
+ platforms = platforms.unix;
};
}
diff --git a/pkgs/applications/blockchains/dero.nix b/pkgs/applications/blockchains/dero.nix
index 0ab63bb53951e6096a37f8555225f49299a85b4d..8aa693d2871475fcd884c673f50657123f0f87f1 100644
--- a/pkgs/applications/blockchains/dero.nix
+++ b/pkgs/applications/blockchains/dero.nix
@@ -3,13 +3,13 @@
stdenv.mkDerivation rec {
pname = "dero";
- version = "0.11.6";
+ version = "0.11.7";
src = fetchFromGitHub {
owner = "deroproject";
repo = "dero";
rev = "v${version}";
- sha256 = "0jc5rh2ra4wra04dwv9sydid5ij5930s38mhzq3qkdjyza1ahmsr";
+ sha256 = "1v8b9wbmqbpyf4jpc0v276qzk3hc5fpddcmwvv5k5yfi30nmbh5c";
};
nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/applications/blockchains/digibyte.nix b/pkgs/applications/blockchains/digibyte.nix
new file mode 100644
index 0000000000000000000000000000000000000000..0d0fc081a118d5dcb284d882dc8b542395033b97
--- /dev/null
+++ b/pkgs/applications/blockchains/digibyte.nix
@@ -0,0 +1,69 @@
+{ stdenv
+, fetchFromGitHub
+, openssl
+, boost
+, libevent
+, autoreconfHook
+, db4
+, pkgconfig
+, protobuf
+, hexdump
+, zeromq
+, withGui
+, qtbase ? null
+, qttools ? null
+, wrapQtAppsHook ? null
+}:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+ pname = "digibyte";
+ version = "7.17.2";
+
+ name = pname + toString (optional (!withGui) "d") + "-" + version;
+
+ src = fetchFromGitHub {
+ owner = pname;
+ repo = pname;
+ rev = "v${version}";
+ sha256 = "04czj7mx3wpbx4832npk686p9pg5zb6qwlcvnmvqf31hm5qylbxj";
+ };
+
+ nativeBuildInputs = [
+ autoreconfHook
+ pkgconfig
+ hexdump
+ ] ++ optionals withGui [
+ wrapQtAppsHook
+ ];
+
+ buildInputs = [
+ openssl
+ boost
+ libevent
+ db4
+ zeromq
+ ] ++ optionals withGui [
+ qtbase
+ qttools
+ protobuf
+ ];
+
+ enableParallelBuilding = true;
+
+ configureFlags = [
+ "--with-boost-libdir=${boost.out}/lib"
+ ] ++ optionals withGui [
+ "--with-gui=qt5"
+ "--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin"
+ ];
+
+ meta = {
+ description = "DigiByte (DGB) is a rapidly growing decentralized, global blockchain";
+ homepage = "https://digibyte.io/";
+ license = licenses.mit;
+ maintainers = [ maintainers.mmahut ];
+ platforms = platforms.linux;
+ };
+}
diff --git a/pkgs/applications/blockchains/go-ethereum.nix b/pkgs/applications/blockchains/go-ethereum.nix
index 34cfe868c0b3381e75076f8b6bb5e2b5a34b3fbb..f7f0aaf603ef03a0f402f6e2962e7004e13f3efb 100644
--- a/pkgs/applications/blockchains/go-ethereum.nix
+++ b/pkgs/applications/blockchains/go-ethereum.nix
@@ -2,16 +2,16 @@
buildGoModule rec {
pname = "go-ethereum";
- version = "1.9.9";
+ version = "1.9.10";
src = fetchFromGitHub {
owner = "ethereum";
repo = pname;
rev = "v${version}";
- sha256 = "00fhqn0b9grqz8iigzbijg7b1va58vccjb15fpy6yfr301z3ib1q";
+ sha256 = "0pm8gfr4g7rbax6vzxv6lklpx83mxghah7fyvpk3jqvm1mq299ln";
};
- modSha256 = "1rn1x3qc23wfcx9c61sw1sc6iqwvv2b9pv006lk1az4zbwh09dbm";
+ modSha256 = "0zar9nvx2nk6kyijp8df3y2rzxvg0mccj6b3skhzf8y9c27hvrsg";
subPackages = [
"cmd/abigen"
diff --git a/pkgs/applications/blockchains/litecoin.nix b/pkgs/applications/blockchains/litecoin.nix
index 33ac2be1832287ca2f4a5806503ae88fdf95dc9c..470772665413f548f5a3af7a761cf8b518be66d6 100644
--- a/pkgs/applications/blockchains/litecoin.nix
+++ b/pkgs/applications/blockchains/litecoin.nix
@@ -1,33 +1,37 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, mkDerivation, fetchFromGitHub
, pkgconfig, autoreconfHook
, openssl, db48, boost, zlib, miniupnpc
-, glib, protobuf, utillinux, qt4, qrencode
+, glib, protobuf, utillinux, qrencode
, AppKit
, withGui ? true, libevent
+, qtbase, qttools
+, zeromq
}:
with stdenv.lib;
-stdenv.mkDerivation rec {
+mkDerivation rec {
name = "litecoin" + (toString (optional (!withGui) "d")) + "-" + version;
- version = "0.16.3";
+ version = "0.17.1";
src = fetchFromGitHub {
owner = "litecoin-project";
repo = "litecoin";
rev = "v${version}";
- sha256 = "0vc184qfdkjky1qffa7309k6973k4197bkzwcmffc9r5sdfhrhkp";
+ sha256 = "08a0ghs4aa9m3qv3ppydyshfibykdwxk07i1vcqvg0ycqisdpb7y";
};
nativeBuildInputs = [ pkgconfig autoreconfHook ];
- buildInputs = [ openssl db48 boost zlib
+ buildInputs = [ openssl db48 boost zlib zeromq
miniupnpc glib protobuf utillinux libevent ]
++ optionals stdenv.isDarwin [ AppKit ]
- ++ optionals withGui [ qt4 qrencode ];
+ ++ optionals withGui [ qtbase qttools qrencode ];
configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
- ++ optionals withGui [ "--with-gui=qt4" ];
+ ++ optionals withGui [
+ "--with-gui=qt5"
+ "--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin" ];
enableParallelBuilding = true;
diff --git a/pkgs/applications/blockchains/pivx.nix b/pkgs/applications/blockchains/pivx.nix
index cda342290a2caee9f55005aacc7b8f16a48a4238..af8085232e9949a3856ad435f5749c09cdc7e8f4 100644
--- a/pkgs/applications/blockchains/pivx.nix
+++ b/pkgs/applications/blockchains/pivx.nix
@@ -10,13 +10,13 @@
with stdenv.lib;
stdenv.mkDerivation rec {
name = "pivx-${version}";
- version = "4.0.0";
+ version = "4.0.2";
src = fetchFromGitHub {
owner = "PIVX-Project";
repo= "PIVX";
rev = "v${version}";
- sha256 = "0m85nc7c8cppdysqz4m12rgmzacrcbwnvf7wy90wzfvfr3xkbapd";
+ sha256 = "12lnp318k8dx1sar24zfmv2imnzs30srssnlpb31y7hcxhz0wpc5";
};
nativeBuildInputs = [ pkgconfig autoreconfHook ] ++ optionals withGui [ wrapQtAppsHook ];
diff --git a/pkgs/applications/blockchains/vertcoin.nix b/pkgs/applications/blockchains/vertcoin.nix
new file mode 100644
index 0000000000000000000000000000000000000000..1b8b0376331aaeb93d1ea0f1aade8f3e889fbc84
--- /dev/null
+++ b/pkgs/applications/blockchains/vertcoin.nix
@@ -0,0 +1,69 @@
+{ stdenv
+, fetchFromGitHub
+, openssl
+, boost
+, libevent
+, autoreconfHook
+, db4
+, pkgconfig
+, protobuf
+, hexdump
+, zeromq
+, withGui
+, qtbase ? null
+, qttools ? null
+, wrapQtAppsHook ? null
+}:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+ pname = "vertcoin";
+ version = "0.14.0";
+
+ name = pname + toString (optional (!withGui) "d") + "-" + version;
+
+ src = fetchFromGitHub {
+ owner = pname + "-project";
+ repo = pname + "-core";
+ rev = version;
+ sha256 = "00vnmrhn5mad58dyiz8rxgsrn0663ii6fdbcqm20mv1l313k4882";
+ };
+
+ nativeBuildInputs = [
+ autoreconfHook
+ pkgconfig
+ hexdump
+ ] ++ optionals withGui [
+ wrapQtAppsHook
+ ];
+
+ buildInputs = [
+ openssl
+ boost
+ libevent
+ db4
+ zeromq
+ ] ++ optionals withGui [
+ qtbase
+ qttools
+ protobuf
+ ];
+
+ enableParallelBuilding = true;
+
+ configureFlags = [
+ "--with-boost-libdir=${boost.out}/lib"
+ ] ++ optionals withGui [
+ "--with-gui=qt5"
+ "--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin"
+ ];
+
+ meta = {
+ description = "A digital currency with mining decentralisation and ASIC resistance as a key focus";
+ homepage = "https://vertcoin.org/";
+ license = licenses.mit;
+ maintainers = [ maintainers.mmahut ];
+ platforms = platforms.linux;
+ };
+}
diff --git a/pkgs/applications/blockchains/wasabiwallet/default.nix b/pkgs/applications/blockchains/wasabiwallet/default.nix
index 9599dc9407c3e0bafae9c1a060cccfb9d703d7d7..6b9630fa6b70090822a8ee242ce542a7a0430231 100644
--- a/pkgs/applications/blockchains/wasabiwallet/default.nix
+++ b/pkgs/applications/blockchains/wasabiwallet/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeDesktopItem, openssl, xorg, curl, fontconfig, krb5, zlib, dotnet-sdk }:
+{ stdenv, fetchurl, makeDesktopItem, openssl, xorg, curl, fontconfig, krb5, zlib, dotnet-netcore }:
stdenv.mkDerivation rec {
pname = "wasabiwallet";
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
cd $out/opt/${pname}
for i in $(find . -type f -name '*.so') wassabee
do
- patchelf --set-rpath ${stdenv.lib.makeLibraryPath [ openssl stdenv.cc.cc.lib xorg.libX11 curl fontconfig.lib krb5 zlib dotnet-sdk ]} $i
+ patchelf --set-rpath ${stdenv.lib.makeLibraryPath [ openssl stdenv.cc.cc.lib xorg.libX11 curl fontconfig.lib krb5 zlib dotnet-netcore ]} $i
done
patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" wassabee
ln -s $out/opt/${pname}/wassabee $out/bin/${pname}
diff --git a/pkgs/applications/blockchains/wownero.nix b/pkgs/applications/blockchains/wownero.nix
index 8b25e098b2fe2b1e352de1bbca699157a26926a7..eb813a361251fe3e27bb16c1199ed25803f03e91 100644
--- a/pkgs/applications/blockchains/wownero.nix
+++ b/pkgs/applications/blockchains/wownero.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
signatures using different participants for the same tx outputs on
opposing forks.
'';
- homepage = http://wownero.org/;
+ homepage = https://wownero.org/;
license = licenses.bsd3;
platforms = platforms.linux;
maintainers = with maintainers; [ fuwa ];
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 219c13f241cb08a049441d8c5e43404079b44c5e..60d00b7fbc7afb2fb3d7fcc2d1a913bc9e73b723 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -13,14 +13,14 @@ let
sha256Hash = "1nsm4d3vdx90szqd78a8mjq65xc9m5ipd35cqrlx3c3ny900sqxg";
};
betaVersion = {
- version = "3.6.0.18"; # "Android Studio 3.6 RC 1"
- build = "192.6071332";
- sha256Hash = "0xpcihr5xxr9l1kv6aflywshs8fww3s7di0g98mz475whhxwzf3q";
+ version = "3.6.0.19"; # "Android Studio 3.6 RC 2"
+ build = "192.6165589";
+ sha256Hash = "1d47nfhzb0apfzin4bg5bck4jjid3jipm5s4n36r7fh20lpx93z5";
};
latestVersion = { # canary & dev
- version = "4.0.0.8"; # "Android Studio 4.0 Canary 8"
- build = "193.6107147";
- sha256Hash = "0bdibjp52jjlyh0966p9657xxmz1z7vi262v6ss4ywpb7gpaj9qq";
+ version = "4.0.0.9"; # "Android Studio 4.0 Canary 9"
+ build = "193.6137316";
+ sha256Hash = "1cgxyqp85z5x2jnjh1qabn2cfiziiwvfr6iggzb531dlhllyfyqw";
};
in {
# Attributes are named by their corresponding release channels
diff --git a/pkgs/applications/editors/bless/default.nix b/pkgs/applications/editors/bless/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..b3c3caae4e4516c6f19c773a8344167a6abbe2d6
--- /dev/null
+++ b/pkgs/applications/editors/bless/default.nix
@@ -0,0 +1,80 @@
+{ stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkgconfig
+, mono
+, gtk-sharp-2_0
+, gettext
+, makeWrapper
+, glib
+, gtk2-x11
+, gnome2
+}:
+
+stdenv.mkDerivation rec {
+ pname = "bless";
+ version = "0.6.2";
+
+ src = fetchFromGitHub {
+ owner = "afrantzis";
+ repo = pname;
+ rev = "v${version}";
+ sha256 = "04ra2mcx3pkhzbhcz0zwfmbpqj6cwisrypi6xbc2d6pxd4hdafn1";
+ };
+
+ buildInputs = [
+ gtk-sharp-2_0
+ mono
+ # runtime only deps
+ glib
+ gtk2-x11
+ gnome2.libglade
+ ];
+
+ nativeBuildInputs = [
+ pkgconfig
+ autoreconfHook
+ gettext
+ makeWrapper
+ ];
+
+ configureFlags = [
+ # scrollkeeper is a gnome2 package, so it must be old and we shouldn't really support it
+ # NOTE: that sadly doesn't turn off the compilation of the manual with scrollkeeper, so we have to fake the binaries below
+ "--without-scrollkeeper"
+ ];
+
+ autoreconfPhase = ''
+ mkdir _bin
+
+ # this fakes the scrollkeeper commands, to keep the build happy
+ for f in scrollkeeper-preinstall scrollkeeper-update; do
+ echo "true" > ./_bin/$f
+ chmod +x ./_bin/$f
+ done
+
+ export PATH="$PWD/_bin:$PATH"
+
+ # and it also wants to install that file
+ touch ./doc/user/bless-manual.omf
+
+ # patch mono path
+ sed "s|^mono|${mono}/bin/mono|g" -i src/bless-script.in
+
+ ./autogen.sh
+ '';
+
+ preFixup = ''
+ MPATH="${gtk-sharp-2_0}/lib/mono/gtk-sharp-2.0:${glib.out}/lib:${gtk2-x11}/lib:${gnome2.libglade}/lib:${gtk-sharp-2_0}/lib"
+ wrapProgram $out/bin/bless --prefix MONO_PATH : "$MPATH" --prefix LD_LIBRARY_PATH : "$MPATH"
+ '';
+
+ meta = with stdenv.lib; {
+ homepage = "https://github.com/afrantzis/bless";
+ description = "Gtk# Hex Editor";
+ maintainers = [ maintainers.mkg20001 ];
+ license = licenses.gpl2;
+ platforms = platforms.linux;
+ badPlatforms = [ "aarch64-linux" ];
+ };
+}
diff --git a/pkgs/applications/editors/bviplus/default.nix b/pkgs/applications/editors/bviplus/default.nix
index 7d70ad14b5db18ab02e41437b54fccae44bcbdd8..5fab7fe9da6206468fc9abbcc102b3fe3b3af92e 100644
--- a/pkgs/applications/editors/bviplus/default.nix
+++ b/pkgs/applications/editors/bviplus/default.nix
@@ -2,11 +2,11 @@
stdenv.mkDerivation rec {
pname = "bviplus";
- version = "0.9.4";
+ version = "1.0";
src = fetchurl {
url = "mirror://sourceforge/project/bviplus/bviplus/${version}/bviplus-${version}.tgz";
- sha256 = "10x6fbn8v6i0y0m40ja30pwpyqksnn8k2vqd290vxxlvlhzah4zb";
+ sha256 = "08q2fdyiirabbsp5qpn3v8jxp4gd85l776w6gqvrbjwqa29a8arg";
};
buildInputs = [
diff --git a/pkgs/applications/editors/eclipse/plugins.nix b/pkgs/applications/editors/eclipse/plugins.nix
index 364d432f1e3499696c07d229ab3d26b2ac3b4845..87c32c30e1905c6a2a5be63b109ac0b2065e80d7 100644
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@@ -259,7 +259,7 @@ rec {
src = fetchzip {
stripRoot = false;
url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/tools/cdt/releases/9.10/${name}/${name}.zip";
- sha256 = "0rjm91j0h1aq9lq4sdwgp9b2yp4w9lr13n82z32dw3gz3nby1mvi";
+ sha256 = "11nbrcvgbg9l3cmp3v3y8y0vldzcf6qlpp185a6dzabdcij6gz5m";
};
meta = with stdenv.lib; {
@@ -479,7 +479,7 @@ rec {
src = fetchzip {
stripRoot = false;
url = https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops4/R-4.14-201912100610/org.eclipse.jdt-4.14.zip;
- sha256 = "16c5v59mkb0cyfhf2475ds1ajma65bhqfxjr6v59hianqxq9h9la";
+ sha256 = "1c2a23qviv58xljpq3yb37ra8cqw7jh52hmzqlg1nij2sdxb6hm5";
};
meta = with stdenv.lib; {
diff --git a/pkgs/applications/editors/emacs-modes/elpa-generated.nix b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
index bfbddb6fc37c723abac99c66ddc213e35053f042..9d4fb66f7322ccaaff79b336220fe97a78780ac6 100644
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@@ -3236,10 +3236,10 @@
elpaBuild {
pname = "undo-tree";
ename = "undo-tree";
- version = "0.7";
+ version = "0.7.2";
src = fetchurl {
- url = "https://elpa.gnu.org/packages/undo-tree-0.7.el";
- sha256 = "0mc5spiqx20z8vh8b24dp9hqj27h5bm5wqk0ga7c6s6mp69r72h4";
+ url = "https://elpa.gnu.org/packages/undo-tree-0.7.2.el";
+ sha256 = "0gdqh5rkgwlancbjx5whgl5gqkdipdkspkl2bqmrq70sgg5ahrcc";
};
packageRequires = [];
meta = {
@@ -3734,4 +3734,4 @@
license = lib.licenses.free;
};
}) {};
- }
\ No newline at end of file
+ }
diff --git a/pkgs/applications/editors/emacs-modes/melpa-packages.nix b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
index e15da80b3b1bc78bbbce560f0ddba06424d38bb3..5c9456b76a637084c7634d4cf96d94f7beead1f1 100644
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@@ -111,6 +111,11 @@ env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate --show-trace ../../../../ -A emacsPac
flycheck-rtags = fix-rtags super.flycheck-rtags;
+ gnuplot = super.gnuplot.overrideAttrs (old: {
+ nativeBuildInputs =
+ (old.nativeBuildInputs or []) ++ [ pkgs.autoreconfHook ];
+ });
+
pdf-tools = super.pdf-tools.overrideAttrs(old: {
nativeBuildInputs = [ external.pkgconfig ];
buildInputs = with external; old.buildInputs ++ [ autoconf automake libpng zlib poppler ];
diff --git a/pkgs/applications/editors/emacs-modes/org-generated.nix b/pkgs/applications/editors/emacs-modes/org-generated.nix
index 8d70794a754006eedfb64c9e30ff022cf1d3d7c7..302f5adcfb1f7f47ffc3872b2b44001851edf7bc 100644
--- a/pkgs/applications/editors/emacs-modes/org-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/org-generated.nix
@@ -6,7 +6,7 @@
ename = "org";
version = "20191203";
src = fetchurl {
- url = "http://orgmode.org/elpa/org-20191203.tar";
+ url = "https://orgmode.org/elpa/org-20191203.tar";
sha256 = "1fcgiswjnqmfzx3xkmlqyyhc4a8ms07vdsv7nkizgxqdh9hwfm2q";
};
packageRequires = [];
@@ -21,7 +21,7 @@
ename = "org-plus-contrib";
version = "20191203";
src = fetchurl {
- url = "http://orgmode.org/elpa/org-plus-contrib-20191203.tar";
+ url = "https://orgmode.org/elpa/org-plus-contrib-20191203.tar";
sha256 = "1kvw95492acb7gqn8gxbp1vg4fyw80w43yvflxnfxdf6jnnw2wah";
};
packageRequires = [];
diff --git a/pkgs/applications/editors/emacs-modes/org-mac-link/default.nix b/pkgs/applications/editors/emacs-modes/org-mac-link/default.nix
index 241ec3b42c9e40492d9125302bee2a7eb3f170f5..4d8f40074bdd1d0bbf431b4e4ec9c213e198171d 100644
--- a/pkgs/applications/editors/emacs-modes/org-mac-link/default.nix
+++ b/pkgs/applications/editors/emacs-modes/org-mac-link/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
meta = {
description = "Insert org-mode links to items selected in various Mac apps";
- homepage = http://orgmode.org/worg/org-contrib/org-mac-link.html;
+ homepage = https://orgmode.org/worg/org-contrib/org-mac-link.html;
license = stdenv.lib.licenses.gpl3;
platforms = stdenv.lib.platforms.all;
};
diff --git a/pkgs/applications/editors/focuswriter/default.nix b/pkgs/applications/editors/focuswriter/default.nix
index b08e3b5fa23cb1a0ff7f22f0a45fd2e2585bb435..ccda1b4d4cbd61d12caf2a4d97dbec19a12db915 100644
--- a/pkgs/applications/editors/focuswriter/default.nix
+++ b/pkgs/applications/editors/focuswriter/default.nix
@@ -2,11 +2,11 @@
mkDerivation rec {
pname = "focuswriter";
- version = "1.7.3";
+ version = "1.7.4";
src = fetchurl {
url = "https://gottcode.org/focuswriter/focuswriter-${version}-src.tar.bz2";
- sha256 = "155wf7z1g2yx6fb41w29kcb0m2rhnk9ci5yw882yy86s4x20b1jq";
+ sha256 = "1fli85p9d58gsg2kwmncqdcw1nmx062kddbrhr50mnsn04dc4j3g";
};
nativeBuildInputs = [ pkgconfig qmake qttools ];
diff --git a/pkgs/applications/editors/hexdino/default.nix b/pkgs/applications/editors/hexdino/default.nix
index ef3635aa8d296d24e06d401a90d5725bf5aed395..eee5a696555832c04c6cec47545a22721862c5d5 100644
--- a/pkgs/applications/editors/hexdino/default.nix
+++ b/pkgs/applications/editors/hexdino/default.nix
@@ -1,6 +1,7 @@
{ stdenv, fetchFromGitHub, rustPlatform, ncurses }:
-rustPlatform.buildRustPackage rec {
- name = "hexdino-${version}";
+
+rustPlatform.buildRustPackage {
+ pname = "hexdino";
version = "0.1.0";
src = fetchFromGitHub {
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 3286e342744583feb3581b9dbce59eff593796fa..83dff4a4f29e880905791b867cef7ee5965fba64 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -250,12 +250,12 @@ in
clion = buildClion rec {
name = "clion-${version}";
- version = "2019.3.2"; /* updated by script */
+ version = "2019.3.3"; /* updated by script */
description = "C/C++ IDE. New. Intelligent. Cross-platform";
license = stdenv.lib.licenses.unfree;
src = fetchurl {
url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
- sha256 = "0aksix22cbbxny68650qxjbbm1fmgbsnp97qix5kl5nx4y4yvlii"; /* updated by script */
+ sha256 = "1dvnb6mb8xgrgqzqxm2zirwm77w4pci6ibwsdh6wqpnzpqksh4iw"; /* updated by script */
};
wmClass = "jetbrains-clion";
update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@@ -263,12 +263,12 @@ in
datagrip = buildDataGrip rec {
name = "datagrip-${version}";
- version = "2019.3.1"; /* updated by script */
+ version = "2019.3.2"; /* updated by script */
description = "Your Swiss Army Knife for Databases and SQL";
license = stdenv.lib.licenses.unfree;
src = fetchurl {
url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
- sha256 = "1h7va6x625kxc2i22mnya64b1kb4vl5xgjxrv3lqwz725q5hkrxa"; /* updated by script */
+ sha256 = "1aypzs5q9zgggxbpaxfd8r5ds0ck31lb00csn62npndqxa3bj7z5"; /* updated by script */
};
wmClass = "jetbrains-datagrip";
update-channel = "DataGrip RELEASE";
@@ -289,12 +289,12 @@ in
idea-community = buildIdea rec {
name = "idea-community-${version}";
- version = "2019.3.1"; /* updated by script */
+ version = "2019.3.2"; /* updated by script */
description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
license = stdenv.lib.licenses.asl20;
src = fetchurl {
url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
- sha256 = "0285jdh350dalvk76ajy57mi1yg1g905cnfhcjlb465bsxaw0z5n"; /* updated by script */
+ sha256 = "09vicd2czag07f2f7dy0mmcvz5kryv659m32zm9rlsr4nai1i3y3"; /* updated by script */
};
wmClass = "jetbrains-idea-ce";
update-channel = "IntelliJ IDEA RELEASE";
@@ -302,12 +302,12 @@ in
idea-ultimate = buildIdea rec {
name = "idea-ultimate-${version}";
- version = "2019.3.1"; /* updated by script */
+ version = "2019.3.2"; /* updated by script */
description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
license = stdenv.lib.licenses.unfree;
src = fetchurl {
url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
- sha256 = "0rb726nh2c7zxnpjcf6fyrpl29y9wgr6qhpb6hjxia2gzxab9jz0"; /* updated by script */
+ sha256 = "09lgdd7gkx94warjc7wah9w7s9lj81law8clavjjyjas8bhhf1hz"; /* updated by script */
};
wmClass = "jetbrains-idea";
update-channel = "IntelliJ IDEA RELEASE";
@@ -315,12 +315,12 @@ in
phpstorm = buildPhpStorm rec {
name = "phpstorm-${version}";
- version = "2019.3.1"; /* updated by script */
+ version = "2019.3.2"; /* updated by script */
description = "Professional IDE for Web and PHP developers";
license = stdenv.lib.licenses.unfree;
src = fetchurl {
url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
- sha256 = "170ppd0inn3s1yxd5ybspzgx2il78838z900fpg2pznq2hi0rn2h"; /* updated by script */
+ sha256 = "02qnkcri49chbbpx2f338cfs5w2kg1l7zfn6fa7qrla82zpjsqlm"; /* updated by script */
};
wmClass = "jetbrains-phpstorm";
update-channel = "PhpStorm RELEASE";
@@ -328,12 +328,12 @@ in
pycharm-community = buildPycharm rec {
name = "pycharm-community-${version}";
- version = "2019.3.1"; /* updated by script */
+ version = "2019.3.2"; /* updated by script */
description = "PyCharm Community Edition";
license = stdenv.lib.licenses.asl20;
src = fetchurl {
url = "https://download.jetbrains.com/python/${name}.tar.gz";
- sha256 = "1cph2v7gaxikrvvdaz7ihk17qgdzrn86jamik9fijb8sjli3695v"; /* updated by script */
+ sha256 = "06dzqjsq6jqgv8askzskm0bllzm9i8rzmhkjsv4na2phvdxf6qi2"; /* updated by script */
};
wmClass = "jetbrains-pycharm-ce";
update-channel = "PyCharm RELEASE";
@@ -341,12 +341,12 @@ in
pycharm-professional = buildPycharm rec {
name = "pycharm-professional-${version}";
- version = "2019.3.1"; /* updated by script */
+ version = "2019.3.2"; /* updated by script */
description = "PyCharm Professional Edition";
license = stdenv.lib.licenses.unfree;
src = fetchurl {
url = "https://download.jetbrains.com/python/${name}.tar.gz";
- sha256 = "1bjijwc5f1is2920b497d395ckswhpxilmxaljb6pjwq4a2k8yzx"; /* updated by script */
+ sha256 = "1zp64pnzz2jy232g8fgkqmn34afbhbkkhgyb9z1v1qfb533p39ig"; /* updated by script */
};
wmClass = "jetbrains-pycharm";
update-channel = "PyCharm RELEASE";
@@ -380,12 +380,12 @@ in
webstorm = buildWebStorm rec {
name = "webstorm-${version}";
- version = "2019.3.1"; /* updated by script */
+ version = "2019.3.2"; /* updated by script */
description = "Professional IDE for Web and JavaScript development";
license = stdenv.lib.licenses.unfree;
src = fetchurl {
url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
- sha256 = "0qjqd1a44mdlpvv3l4sx2n5clirwxialzh6s2dlb0dibx8zvnckp"; /* updated by script */
+ sha256 = "0mbfkwjqg2d1mkka0vajx41nv4f07y1w7chk6ii7sylaj7ypzi13"; /* updated by script */
};
wmClass = "jetbrains-webstorm";
update-channel = "WebStorm RELEASE";
diff --git a/pkgs/applications/editors/kakoune/default.nix b/pkgs/applications/editors/kakoune/default.nix
index a6580581f850185aadfe6dbc7f1ae91949ae5838..8cb70af40e06c237028ea1830882800488139189 100644
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@@ -4,12 +4,12 @@ with stdenv.lib;
stdenv.mkDerivation rec {
pname = "kakoune-unwrapped";
- version = "2019.12.10";
+ version = "2020.01.16";
src = fetchFromGitHub {
repo = "kakoune";
owner = "mawww";
rev = "v${version}";
- sha256 = "0cb3ndlczxvxnzb91s4idxx0cy30mnrc4znsbjpnch68fvpm0x2f";
+ sha256 = "16v6z1nzj54j19fraxhb18jdby4zfs1br91gxpg9s2s4nsk0km0b";
};
nativeBuildInputs = [ pkgconfig ];
buildInputs = [ ncurses asciidoc docbook_xsl libxslt ];
diff --git a/pkgs/applications/editors/kdevelop5/kdev-php.nix b/pkgs/applications/editors/kdevelop5/kdev-php.nix
index 35efe76cfb2ebc52cadab3627c0ddcedf2fd8e92..72ef081070400a639c43a5742b4edeccf05fed5b 100644
--- a/pkgs/applications/editors/kdevelop5/kdev-php.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-php.nix
@@ -2,11 +2,11 @@
stdenv.mkDerivation rec {
pname = "kdev-php";
- version = "5.4.6";
+ version = "5.5.0";
src = fetchurl {
url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
- sha256 = "0p532r0ld6j6fpwqyf9m5m0d27y37chgbvcjp1x6g5jjvm7m77xk";
+ sha256 = "1hd3ckayrwszda517zfvhihrfmzq4m3kcsrz4sqkbvib0giwsfkp";
};
nativeBuildInputs = [ cmake extra-cmake-modules ];
diff --git a/pkgs/applications/editors/kdevelop5/kdev-python.nix b/pkgs/applications/editors/kdevelop5/kdev-python.nix
index 0f15a63be7a80d369c905a8b30f39816f906ffd8..275aaba4f2eba04aca4ba9943e90a6cdb892e6e8 100644
--- a/pkgs/applications/editors/kdevelop5/kdev-python.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-python.nix
@@ -2,11 +2,11 @@
stdenv.mkDerivation rec {
pname = "kdev-python";
- version = "5.4.6";
+ version = "5.5.0";
src = fetchurl {
url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
- sha256 = "1xzk0zgbc4nnz8gjbhw5h6kwznzxsqrg19ggyb8ijpmgg0ncxk8l";
+ sha256 = "0kna6vkxc6lrfzb3gzn11qvw8jpa86gi1k996hdk83gn0lhmkvx5";
};
cmakeFlags = [
diff --git a/pkgs/applications/editors/kdevelop5/kdevelop.nix b/pkgs/applications/editors/kdevelop5/kdevelop.nix
index ed5017a0487c74846de2b0ff33a7142da320e44b..51dfbbab61e8d8e127615acc2a7aba69b8898e3b 100644
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@@ -10,11 +10,11 @@
mkDerivation rec {
pname = "kdevelop";
- version = "5.4.6";
+ version = "5.5.0";
src = fetchurl {
url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
- sha256 = "01jmrmwbc1hrvq7jdfcc7mxl03q2l6kz57yca2j26xwyvfcfv5sz";
+ sha256 = "0438721v24pim5q0q54ivsws9a679fm7ymrm1nn9g1fv06qsm4d8";
};
nativeBuildInputs = [
diff --git a/pkgs/applications/editors/neovim/qt.nix b/pkgs/applications/editors/neovim/qt.nix
index 3a46f68e77550e009951ca995d090f065d0d49cb..8fe93d37c7e877f1aa548704f842781f90de023e 100644
--- a/pkgs/applications/editors/neovim/qt.nix
+++ b/pkgs/applications/editors/neovim/qt.nix
@@ -4,13 +4,13 @@
let
unwrapped = mkDerivation rec {
pname = "neovim-qt-unwrapped";
- version = "0.2.12";
+ version = "0.2.15";
src = fetchFromGitHub {
owner = "equalsraf";
repo = "neovim-qt";
rev = "v${version}";
- sha256 = "09s3044j0y8nmyi8ykslfii6fx7k9mckmdvb0jn2xmdabpb60i20";
+ sha256 = "097nykglqp4jyvla4yp32sc1f1hph4cqqhp6rm9ww7br8c0j54xl";
};
cmakeFlags = [
diff --git a/pkgs/applications/editors/netbeans/default.nix b/pkgs/applications/editors/netbeans/default.nix
index 38b92151b29f5a8f1d7b7e4a850615258c555cad..0fddddbaacf527a734f523ec077c116b5cafa6de 100644
--- a/pkgs/applications/editors/netbeans/default.nix
+++ b/pkgs/applications/editors/netbeans/default.nix
@@ -3,7 +3,7 @@
}:
let
- version = "11.1";
+ version = "11.2";
desktopItem = makeDesktopItem {
name = "netbeans";
exec = "netbeans";
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
inherit version;
src = fetchurl {
url = "mirror://apache/netbeans/netbeans/${version}/netbeans-${version}-bin.zip";
- sha512 = "bb061b9258d524b7b53b3b5ee9aa95111f7a391a5e2c5c0bc949164166af9a03d0cebbde2b47a8853fb765307b4c93ce8389a9c87bef26c92c08cdf446314e4d";
+ sha512 = "d589481808832c4f0391ee1ecb8e18202cebeee8bd844cb4bdbf6125113b41f9138a34c4c2ef1fdf228294ef8c24b242ffec9ba5fdc4f1d288db4a3f19ba1509";
};
buildCommand = ''
diff --git a/pkgs/applications/editors/okteta/default.nix b/pkgs/applications/editors/okteta/default.nix
index 5c7ddfb34d46fbbebb8ea2f625cbda600ff7a269..fa63ee90adc91e6890ab8e8d3bf7c8cb2ee57d98 100644
--- a/pkgs/applications/editors/okteta/default.nix
+++ b/pkgs/applications/editors/okteta/default.nix
@@ -4,11 +4,11 @@
stdenv.mkDerivation rec {
pname = "okteta";
- version = "0.26.2";
+ version = "0.26.3";
src = fetchurl {
url = "mirror://kde/stable/okteta/${version}/src/${pname}-${version}.tar.xz";
- sha256 = "0k38hd9wq6jvzy0225y61rzr7lgwbac1haalhsrfpmyjy6d833dv";
+ sha256 = "1454844s76skk18gpcf56y9pkmffs7p4z09ggmy37ifzf7yk1p19";
};
nativeBuildInputs = [ qtscript extra-cmake-modules kdoctools ];
diff --git a/pkgs/applications/editors/quartus-prime/default.nix b/pkgs/applications/editors/quartus-prime/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..6a6ea80ca45896b63b68ca9434c442de936b560b
--- /dev/null
+++ b/pkgs/applications/editors/quartus-prime/default.nix
@@ -0,0 +1,119 @@
+{ buildFHSUserEnv, makeDesktopItem, stdenv, lib, requireFile, unstick, cycloneVSupport ? true }:
+
+let
+ quartus = stdenv.mkDerivation rec {
+ version = "19.1.0.670";
+ pname = "quartus-prime-lite";
+
+ src = let
+ require = {name, sha256}: requireFile {
+ inherit name sha256;
+ url = "${meta.homepage}/${lib.versions.majorMinor version}/?edition=lite&platform=linux";
+ };
+ in map require ([{
+ name = "QuartusLiteSetup-${version}-linux.run";
+ sha256 = "15vxvqxqdk29ahlw3lkm1nzxyhzy4626wb9s5f2h6sjgq64r8m7f";
+ } {
+ name = "ModelSimSetup-${version}-linux.run";
+ sha256 = "0j1vfr91jclv88nam2plx68arxmz4g50sqb840i60wqd5b0l3y6r";
+ }] ++ lib.optional cycloneVSupport {
+ name = "cyclonev-${version}.qdz";
+ sha256 = "0bqxpvjgph0y6slk0jq75mcqzglmqkm0jsx10y9xz5llm6zxzqab";
+ });
+
+ nativeBuildInputs = [ unstick ];
+
+ buildCommand = let
+ installers = lib.sublist 0 2 src;
+ components = lib.sublist 2 ((lib.length src) - 2) src;
+ copyInstaller = installer: ''
+ # `$(cat $NIX_CC/nix-support/dynamic-linker) $src[0]` often segfaults, so cp + patchelf
+ cp ${installer} $TEMP/${installer.name}
+ chmod u+w,+x $TEMP/${installer.name}
+ patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $TEMP/${installer.name}
+ '';
+ copyComponent = component: "cp ${component} $TEMP/${component.name}";
+ # leaves enabled: quartus, modelsim_ase, devinfo
+ disabledComponents = [
+ "quartus_help"
+ "quartus_update"
+ "modelsim_ae"
+ # Devices
+ "arria_lite"
+ "cyclone"
+ "cyclone10lp"
+ "max"
+ "max10"
+ ] ++ lib.optional (!cycloneVSupport) "cyclonev";
+ in ''
+ ${lib.concatMapStringsSep "\n" copyInstaller installers}
+ ${lib.concatMapStringsSep "\n" copyComponent components}
+
+ unstick $TEMP/${(builtins.head installers).name} \
+ --disable-components ${lib.concatStringsSep "," disabledComponents} \
+ --mode unattended --installdir $out --accept_eula 1
+
+ # This patch is from https://wiki.archlinux.org/index.php/Altera_Design_Software
+ patch --force --strip 0 --directory $out < ${./vsim.patch}
+
+ rm -r $out/uninstall $out/logs
+ '';
+
+ meta = {
+ homepage = "https://fpgasoftware.intel.com";
+ description = "FPGA design and simulation software";
+ license = lib.licenses.unfree;
+ platforms = lib.platforms.linux;
+ maintainers = with lib.maintainers; [ kwohlfahrt ];
+ };
+ };
+
+ desktopItem = makeDesktopItem {
+ name = quartus.name;
+ exec = "quartus";
+ icon = "quartus";
+ desktopName = "Quartus";
+ genericName = "Quartus FPGA IDE";
+ categories = "Development;";
+ };
+
+# I think modelsim_ase/linux/vlm checksums itself, so use FHSUserEnv instead of `patchelf`
+in buildFHSUserEnv {
+ name = "quartus-prime-lite";
+
+ targetPkgs = pkgs: with pkgs; [
+ # quartus requirements
+ glib
+ xorg.libICE
+ xorg.libSM
+ zlib
+ # qsys requirements
+ xorg.libXtst
+ xorg.libXi
+ ];
+ multiPkgs = pkgs: with pkgs; let
+ # This seems ugly - can we override `libpng = libpng12` for all `pkgs`?
+ freetype = pkgs.freetype.override { libpng = libpng12; };
+ fontconfig = pkgs.fontconfig.override { inherit freetype; };
+ libXft = pkgs.xorg.libXft.override { inherit freetype fontconfig; };
+ in [
+ # modelsim requirements
+ libxml2
+ ncurses5
+ unixODBC
+ libXft
+ # common requirements
+ freetype
+ fontconfig
+ xorg.libX11
+ xorg.libXext
+ xorg.libXrender
+ ];
+
+ extraInstallCommands = ''
+ mkdir -p $out/share/applications
+ cp ${desktopItem}/share/applications/* $out/share/applications
+ '';
+
+ runScript = "${quartus}/quartus/bin/quartus";
+}
diff --git a/pkgs/applications/editors/quartus-prime/vsim.patch b/pkgs/applications/editors/quartus-prime/vsim.patch
new file mode 100644
index 0000000000000000000000000000000000000000..36dc41b7ef14446d5e30df9137b3ea69691f7520
--- /dev/null
+++ b/pkgs/applications/editors/quartus-prime/vsim.patch
@@ -0,0 +1,11 @@
+--- modelsim_ase/vco 1970-01-01 01:00:01.000000000 +0100
++++ modelsim_ase/vco 1970-01-01 01:00:01.000000000 +0100
+@@ -207,7 +207,7 @@
+ 2.[5-9]*) vco="linux" ;;
+ 2.[1-9][0-9]*) vco="linux" ;;
+ 3.[0-9]*) vco="linux" ;;
+- *) vco="linux_rh60" ;;
++ *) vco="linux" ;;
+ esac
+ if [ ! -x "$dir/$vco/vsim" ]; then
+ if [ -x "$dir/linuxle/vsim" ]; then
diff --git a/pkgs/applications/editors/quilter/default.nix b/pkgs/applications/editors/quilter/default.nix
index ceb119a5f0a2588af952c9d53cc60e231de9ea94..87dc1a6cfe79f9f895e390820b3d0cc378349cc4 100644
--- a/pkgs/applications/editors/quilter/default.nix
+++ b/pkgs/applications/editors/quilter/default.nix
@@ -4,13 +4,13 @@
stdenv.mkDerivation rec {
pname = "quilter";
- version = "2.0.5";
+ version = "2.1.0";
src = fetchFromGitHub {
owner = "lainsce";
repo = pname;
rev = version;
- sha256 = "1gij5gqidzvwym7yq5fx0344n4fkydx5diwz8g8kwkcsz7z1w45a";
+ sha256 = "1756gp3f2pmxz2k4xg4cfdbdav848qb0vjglyiy1n2k9xc79dyxz";
};
nativeBuildInputs = [
diff --git a/pkgs/applications/editors/rednotebook/default.nix b/pkgs/applications/editors/rednotebook/default.nix
index 622c4a680f59adade9b08d1c0b3e8700c77c0335..a46a643e136a8a8ea87e6f8206f018d64546b1cf 100644
--- a/pkgs/applications/editors/rednotebook/default.nix
+++ b/pkgs/applications/editors/rednotebook/default.nix
@@ -5,13 +5,13 @@
buildPythonApplication rec {
pname = "rednotebook";
- version = "2.15";
+ version = "2.16";
src = fetchFromGitHub {
owner = "jendrikseipp";
repo = "rednotebook";
rev = "v${version}";
- sha256 = "1p43xncqb898rgfx4vv1nxy6dj57pvxpc0b5j3kgs58ir70rg1js";
+ sha256 = "1cziac9pmhpxvs8qg54wbckzgjpplqb55hykg5vdwdqqs7j054aj";
};
# We have not packaged tests.
diff --git a/pkgs/applications/editors/rstudio/default.nix b/pkgs/applications/editors/rstudio/default.nix
index 933644cc471763fe21346fe055c6a1e642be46fc..cab7ac119b6a607b7a74a0899d0f7fae15d31648 100644
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@@ -1,10 +1,10 @@
-{ stdenv, fetchurl, fetchFromGitHub, makeDesktopItem, cmake, boost, zlib
+{ lib, mkDerivation, fetchurl, fetchFromGitHub, makeDesktopItem, cmake, boost, zlib
, openssl, R, qtbase, qtxmlpatterns, qtsensors, qtwebengine, qtwebchannel
, libuuid, hunspellDicts, unzip, ant, jdk, gnumake, makeWrapper, pandoc
, llvmPackages
}:
-with stdenv.lib;
+with lib;
let
verMajor = "1";
verMinor = "2";
@@ -13,7 +13,7 @@ let
ginVer = "2.1.2";
gwtVer = "2.8.1";
in
-stdenv.mkDerivation rec {
+mkDerivation rec {
pname = "RStudio";
inherit version;
@@ -116,15 +116,16 @@ stdenv.mkDerivation rec {
mimeType = "text/x-r-source;text/x-r;text/x-R;text/x-r-doc;text/x-r-sweave;text/x-r-markdown;text/x-r-html;text/x-r-presentation;application/x-r-data;application/x-r-project;text/x-r-history;text/x-r-profile;text/x-tex;text/x-markdown;text/html;text/css;text/javascript;text/x-chdr;text/x-csrc;text/x-c++hdr;text/x-c++src;";
};
+ qtWrapperArgs = [ ''--suffix PATH : ${gnumake}/bin'' ];
+
postInstall = ''
- wrapProgram $out/bin/rstudio --suffix PATH : ${gnumake}/bin
mkdir $out/share
cp -r ${desktopItem}/share/applications $out/share
mkdir $out/share/icons
ln $out/rstudio.png $out/share/icons
'';
- meta = with stdenv.lib;
+ meta = with lib;
{ description = "Set of integrated tools for the R language";
homepage = https://www.rstudio.com/;
license = licenses.agpl3;
diff --git a/pkgs/applications/editors/texstudio/default.nix b/pkgs/applications/editors/texstudio/default.nix
index 13b7f4db0c5b306f389b5e952370d0e9666783b5..372d9508174aa557dbe80b17b33065eceaf07a0c 100644
--- a/pkgs/applications/editors/texstudio/default.nix
+++ b/pkgs/applications/editors/texstudio/default.nix
@@ -3,13 +3,13 @@
mkDerivation rec {
pname = "texstudio";
- version = "2.12.16";
+ version = "2.12.20";
src = fetchFromGitHub {
owner = "${pname}-org";
repo = pname;
rev = version;
- sha256 = "0ck65fvz6mzfpqdb1ndgyvgxdnslrwhdr1swgck4gaghcrgbg3gq";
+ sha256 = "0hywx2knqdrslzmm4if476ryf4ma0aw5j8kdp6lyrz2jx7az2gqa";
};
nativeBuildInputs = [ qmake wrapQtAppsHook pkgconfig ];
@@ -20,10 +20,10 @@ mkDerivation rec {
meta = with lib; {
description = "TeX and LaTeX editor";
longDescription=''
- Fork of TeXMaker, this editor is a full fledged IDE for
- LaTeX editing with completion, structure viewer, preview,
- spell checking and support of any compilation chain.
- '';
+ Fork of TeXMaker, this editor is a full fledged IDE for
+ LaTeX editing with completion, structure viewer, preview,
+ spell checking and support of any compilation chain.
+ '';
homepage = http://texstudio.sourceforge.net;
license = licenses.gpl2Plus;
platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/editors/thonny/default.nix b/pkgs/applications/editors/thonny/default.nix
index 26b7ab5a0fb3d56eff70cb62abe84082d2ca7270..16f1ba4346e9aef54bcfc5ecb1704afb5413e13c 100644
--- a/pkgs/applications/editors/thonny/default.nix
+++ b/pkgs/applications/editors/thonny/default.nix
@@ -4,13 +4,13 @@ with python3.pkgs;
buildPythonApplication rec {
pname = "thonny";
- version = "3.2.4";
+ version = "3.2.6";
src = fetchFromGitHub {
owner = pname;
repo = pname;
rev = "v${version}";
- sha256 = "1hfpjw4fac0kq3n9jqwfzbys6h35qjbh5rpc4jzhlln200h6zvwj";
+ sha256 = "19krnxpp3i1n65zafazvdm9mvnjry5rml0y9imj4365q4bkj20g2";
};
propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
index e66530aaf769c116828ba18c519c461fc30f8e07..aa6fc0a7d24085a99ab7470d005b8c3cd3824679 100644
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@@ -3,13 +3,13 @@
mkDerivation rec {
pname = "tiled";
- version = "1.3.1";
+ version = "1.3.2";
src = fetchFromGitHub {
owner = "bjorn";
repo = pname;
rev = "v${version}";
- sha256 = "1vhg8m1b7ccccrzlp0pyf3qskgvlf6sn1w956zsczmndrixbli9a";
+ sha256 = "1jfr9ngsbkn9j3yvy3mnx0llfwmk39dj8kfiy9fawkhw0v4bzjbd";
};
nativeBuildInputs = [ pkgconfig qmake ];
diff --git a/pkgs/applications/editors/uberwriter/default.nix b/pkgs/applications/editors/uberwriter/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..48ebc79e705030f54c109fbcf7f1fb76ae2115ac
--- /dev/null
+++ b/pkgs/applications/editors/uberwriter/default.nix
@@ -0,0 +1,55 @@
+{ stdenv, fetchFromGitHub, meson, ninja, cmake
+, wrapGAppsHook, pkgconfig, desktop-file-utils
+, appstream-glib, pythonPackages, glib, gobject-introspection
+, gtk3, webkitgtk, glib-networking, gnome3, gspell, texlive
+, shared-mime-info, haskellPackages}:
+
+let
+ pythonEnv = pythonPackages.python.withPackages(p: with p;
+ [ regex setuptools python-Levenshtein pyenchant pygobject3 pycairo pypandoc ]);
+ texliveDist = texlive.combined.scheme-medium;
+
+in stdenv.mkDerivation rec {
+ pname = "uberwriter";
+ version = "unstable-2020-01-24";
+
+ src = fetchFromGitHub {
+ owner = pname;
+ repo = pname;
+ rev = "0647b413407eb8789a25c353602c4ac979dc342a";
+ sha256 = "19z52fpbf0p7dzx7q0r5pk3nn0c8z69g1hv6db0cqp61cqv5z95q";
+ };
+
+ nativeBuildInputs = [ meson ninja cmake pkgconfig desktop-file-utils
+ appstream-glib wrapGAppsHook ];
+
+ buildInputs = [ glib pythonEnv gobject-introspection gtk3
+ gnome3.adwaita-icon-theme webkitgtk gspell texliveDist
+ glib-networking ];
+
+ postPatch = ''
+ patchShebangs --build build-aux/meson_post_install.py
+
+ substituteInPlace uberwriter/config.py --replace "/usr/share/uberwriter" "$out/share/uberwriter"
+
+ # get rid of unused distributed dependencies
+ rm -r uberwriter/{pylocales,pressagio}
+ '';
+
+ preFixup = ''
+ gappsWrapperArgs+=(
+ --prefix PYTHONPATH : "$out/lib/python${pythonEnv.pythonVersion}/site-packages/"
+ --prefix PATH : "${texliveDist}/bin"
+ --prefix PATH : "${haskellPackages.pandoc-citeproc}/bin"
+ --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
+ )
+ '';
+
+ meta = with stdenv.lib; {
+ homepage = http://uberwriter.github.io/uberwriter/;
+ description = "A distraction free Markdown editor for GNU/Linux";
+ license = licenses.gpl3;
+ platforms = platforms.linux;
+ maintainers = [ maintainers.sternenseemann ];
+ };
+}
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 663c64ac5de4708bb6a0e126544c007dffe8769a..b6861a9023f88b6e7c3a85e3063b44bb7224e75f 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -11,15 +11,15 @@ let
archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
sha256 = {
- x86_64-linux = "00b6q3rvf9v993i8d1vh9ckb86s655mz6kqkw0lxg8xmhpm568ra";
- x86_64-darwin = "1r4qbjbypdqx9qmycykgkrg8anckicmdmawwwsszgkdd0zd5idgg";
+ x86_64-linux = "1bb7icdjzprrsxllx2q478m1p3qf5sbs3rs3bavvb3hzyyf4bifn";
+ x86_64-darwin = "1hqpfmp5s135kb9777s96sr0zbls002h1980qbgf7r2hmc0mpnx0";
}.${system};
in
callPackage ./generic.nix rec {
# The update script doesn't correctly change the hash for darwin, so please:
# nixpkgs-update: no auto update
- version = "1.41.1";
+ version = "1.42.0";
pname = "vscode";
executableName = "code" + lib.optionalString isInsiders "-insiders";
diff --git a/pkgs/applications/graphics/apngasm/2.nix b/pkgs/applications/graphics/apngasm/2.nix
new file mode 100644
index 0000000000000000000000000000000000000000..166bc135c193601541a36bd6fb20f15bf28de94a
--- /dev/null
+++ b/pkgs/applications/graphics/apngasm/2.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchzip, libpng, zlib, zopfli }:
+
+stdenv.mkDerivation rec {
+ pname = "apngasm";
+ version = "2.91";
+
+ src = fetchzip {
+ url = "mirror://sourceforge/${pname}/${pname}-${version}-src.zip";
+ stripRoot = false;
+ sha256 = "0qhljqql159xkn1l83vz0q8wvzr7rjz4jnhiy0zn36pgvacg0zn1";
+ };
+
+ buildInputs = [ libpng zlib zopfli ];
+
+ postPatch = ''
+ rm -rf libpng zlib zopfli
+ '';
+
+ NIX_CFLAGS_LINK = "-lzopfli";
+
+ installPhase = ''
+ install -Dt $out/bin apngasm
+ '';
+
+ enableParallelBuilding = true;
+
+ meta = with stdenv.lib; {
+ description = "Create highly optimized Animated PNG files from PNG/TGA images";
+ homepage = "http://apngasm.sourceforge.net/";
+ license = licenses.zlib;
+ maintainers = with maintainers; [ orivej ];
+ platforms = platforms.linux;
+ };
+
+}
diff --git a/pkgs/applications/graphics/apngasm/default.nix b/pkgs/applications/graphics/apngasm/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..8d50696efcbd20c35b6645b531e903bbe466d5c8
--- /dev/null
+++ b/pkgs/applications/graphics/apngasm/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub, cmake, boost, libpng, zlib }:
+
+stdenv.mkDerivation rec {
+ pname = "apngasm";
+ version = "3.1.9";
+
+ src = fetchFromGitHub {
+ owner = pname;
+ repo = pname;
+ rev = "d50bfb0cf14c376f4cfb94eb91c61d795a76b715"; # not tagged, but in debian/changelog
+ sha256 = "0pk0r8x1950pm6j3d5wgryvy3ldm7a9gl59jmnwnjmg1sf9mzf97";
+ };
+
+ nativeBuildInputs = [ cmake ];
+
+ buildInputs = [ boost libpng zlib ];
+
+ meta = with stdenv.lib; {
+ description = "Create an APNG from multiple PNG files";
+ homepage = "https://github.com/apngasm/apngasm";
+ license = licenses.zlib;
+ maintainers = with maintainers; [ orivej ];
+ platforms = platforms.linux;
+ };
+
+}
diff --git a/pkgs/applications/graphics/avocode/default.nix b/pkgs/applications/graphics/avocode/default.nix
index 3595908f1437ea176fbd3955db3c0827c1a7e859..f15804038e716b36fe7b71a88198051b8612d6fd 100644
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@@ -5,11 +5,11 @@
stdenv.mkDerivation rec {
pname = "avocode";
- version = "4.2.1";
+ version = "4.2.2";
src = fetchurl {
url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
- sha256 = "06g12gqri1sgfklla6jfpi7wm2qjazakcjs2w2rhrphnl50r6ca7";
+ sha256 = "0f4cmai2d1x7wbqllxp9na6gxgqfxqav8n4g9azyvm6ymd8zjnx8";
};
libPath = stdenv.lib.makeLibraryPath (with xorg; [
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index c71e95b21af8a418c436b0758c0ddb94a022f24b..2a7efea52713f208cc90b2dac5c111e671a52d11 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -11,11 +11,11 @@
stdenv.mkDerivation rec {
pname = "drawio";
- version = "12.4.2";
+ version = "12.6.5";
src = fetchurl {
url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/draw.io-x86_64-${version}.rpm";
- sha256 = "1mngn90cn9hixa0xkhk7mb02gjp480wnipjy2jzkq8kwpai1gm1m";
+ sha256 = "14x4h680q3w9wsdmivy2k1bggb09vdm3a3wrpfwd79dbaagjk4lc";
};
nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/fluxus/default.nix b/pkgs/applications/graphics/fluxus/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..a809407110130306715b167b12ce22b99f6a3b6a
--- /dev/null
+++ b/pkgs/applications/graphics/fluxus/default.nix
@@ -0,0 +1,96 @@
+{ stdenv
+, fetchFromGitLab
+, alsaLib
+, bzip2
+, fftw
+, freeglut
+, freetype
+, glew
+, libjack2
+, libGL
+, libGLU
+, libjpeg
+, liblo
+, libpng
+, libsndfile
+, libtiff
+, ode
+, openal
+, openssl
+, racket
+, scons
+, zlib
+}:
+let
+ libs = [
+ alsaLib
+ bzip2
+ fftw
+ freeglut
+ freetype
+ glew
+ libjack2
+ libGL
+ libGLU
+ libjpeg
+ liblo
+ libpng
+ libsndfile
+ libtiff
+ ode
+ openal
+ openssl
+ zlib
+ ];
+in
+stdenv.mkDerivation rec {
+ pname = "fluxus";
+ version = "0.19";
+ src = fetchFromGitLab {
+ owner = "nebogeo";
+ repo = "fluxus";
+ rev = "ba9aee218dd4a9cfab914ad78bdb6d59e9a37400";
+ hash = "sha256:0mwghpgq4n1khwlmgscirhmcdhi6x00c08q4idi2zcqz961bbs28";
+ };
+
+ buildInputs = [
+ alsaLib
+ fftw
+ freeglut.dev
+ freetype
+ glew
+ libjack2
+ libjpeg.dev
+ liblo
+ libsndfile.dev
+ libtiff.dev
+ ode
+ openal
+ openssl.dev
+ racket
+ ];
+ nativeBuildInputs = [ scons ];
+
+ patches = [ ./fix-build.patch ];
+ sconsFlags = [
+ "RacketPrefix=${racket}"
+ "RacketInclude=${racket}/include/racket"
+ "RacketLib=${racket}/lib/racket"
+ "LIBPATH=${stdenv.lib.makeLibraryPath libs}"
+ "DESTDIR=build"
+ ];
+ configurePhase = ''
+ sconsFlags+=" Prefix=$out"
+ '';
+ installPhase = ''
+ mkdir -p $out
+ cp -r build$out/* $out/
+ '';
+
+ meta = with stdenv.lib; {
+ description = "Livecoding environment for 3D graphics, sound, and games";
+ license = licenses.gpl2;
+ homepage = http://www.pawfal.org/fluxus/;
+ maintainers = [ maintainers.brainrape ];
+ };
+}
diff --git a/pkgs/applications/graphics/fluxus/fix-build.patch b/pkgs/applications/graphics/fluxus/fix-build.patch
new file mode 100644
index 0000000000000000000000000000000000000000..7810dd59e357222542deb57e70c5238caaf37ff9
--- /dev/null
+++ b/pkgs/applications/graphics/fluxus/fix-build.patch
@@ -0,0 +1,16 @@
+diff --git a/SConstruct b/SConstruct
+index 32cb644..0b3a208 100644
+--- a/SConstruct
++++ b/SConstruct
+@@ -225,6 +225,11 @@ if env['PLATFORM'] == 'posix':
+ ["asound", "alsa/asoundlib.h"],
+ ["openal", "AL/al.h"]]
+
++env.Append(ENV={'PATH': ' ' + os.environ['PATH'], })
++env.Append(LIBPATH=ARGUMENTS.get('LIBPATH', '').split(':'))
++env.Append(CCFLAGS=' ' + os.environ.get('NIX_CFLAGS_COMPILE',''))
++env.Append(CCFLAGS=' -DNULL=0')
++
+ ################################################################################
+ # Make sure we have these libraries availible
+
diff --git a/pkgs/applications/graphics/fondo/default.nix b/pkgs/applications/graphics/fondo/default.nix
index 3df7ba493c0f2a99d4ba02599b122e811c0ea680..7b186312301d159bd9b97ba857773cc7f2dc94e8 100644
--- a/pkgs/applications/graphics/fondo/default.nix
+++ b/pkgs/applications/graphics/fondo/default.nix
@@ -1,6 +1,5 @@
{ stdenv
, fetchFromGitHub
-, fetchpatch
, pantheon
, vala
, pkgconfig
@@ -15,26 +14,28 @@
, glib-networking
, libsoup
, libunity
+, desktop-file-utils
, wrapGAppsHook
}:
stdenv.mkDerivation rec {
pname = "fondo";
- version = "1.3.2";
+ version = "1.3.8";
src = fetchFromGitHub {
owner = "calo001";
repo = pname;
rev = version;
- sha256 = "0w7qai261l9m7ckzxc2gj3ywa55wm6p5br1xdk7607ql44lfpgba";
+ sha256 = "126diirhmm2igxdpgfv1l20wnz5q8hadgq53d0j83ka72mfd3qg6";
};
nativeBuildInputs = [
+ desktop-file-utils
meson
ninja
- vala
pkgconfig
python3
+ vala
wrapGAppsHook
];
@@ -50,14 +51,6 @@ stdenv.mkDerivation rec {
pantheon.granite
];
- patches = [
- # Fix hardcoded FHS gsettings path
- (fetchpatch {
- url = "https://github.com/calo001/fondo/commit/98afdd834201321a3242f0b53bfba4b2ffa04a4c.patch";
- sha256 = "0vvgbgjja6vyrk6in3sgv8jbl4bwxkm6fhllgjzq7r65gkj4jg79";
- })
- ];
-
postPatch = ''
chmod +x meson/post_install.py
patchShebangs meson/post_install.py
diff --git a/pkgs/applications/graphics/gthumb/default.nix b/pkgs/applications/graphics/gthumb/default.nix
index f0057f3a1a8845dda9279f514333c97cf97756f9..b51db1e945febeee80fe93c3aa58e356fa30d247 100644
--- a/pkgs/applications/graphics/gthumb/default.nix
+++ b/pkgs/applications/graphics/gthumb/default.nix
@@ -33,11 +33,11 @@
stdenv.mkDerivation rec {
pname = "gthumb";
- version = "3.8.2";
+ version = "3.8.3";
src = fetchurl {
url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
- sha256 = "15wqks35ks5dm7zj046dfd45vvrilan2ayfy2sxiprv7q74cip2q";
+ sha256 = "1a0gss9cjcwayrcpkam5kc1giwbfy38jgqxvh33in9gfq9dgrygg";
};
nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/imgp/default.nix b/pkgs/applications/graphics/imgp/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..80420202c0532485f8b6bd79062dac68d5ddce01
--- /dev/null
+++ b/pkgs/applications/graphics/imgp/default.nix
@@ -0,0 +1,38 @@
+{ lib, fetchFromGitHub, buildPythonApplication, pillow, imgp }:
+
+buildPythonApplication rec {
+ pname = "imgp";
+ version = "2.7";
+
+ src = fetchFromGitHub {
+ owner = "jarun";
+ repo = pname;
+ rev = "v${version}";
+ sha256 = "13r4fn3dd0nyidfhrr7zzpls5ifbyqdwxhyvpkqr8ahchws7wfc6";
+ };
+
+ propagatedBuildInputs = [ pillow ];
+
+ installFlags = [
+ "DESTDIR=$(out)"
+ "PREFIX="
+ ];
+
+ postInstall = ''
+ install -Dm555 auto-completion/bash/imgp-completion.bash $out/share/bash-completion/completions/imgp.bash
+ install -Dm555 auto-completion/fish/imgp.fish -t $out/share/fish/vendor_completions.d
+ install -Dm555 auto-completion/zsh/_imgp -t $out/share/zsh/site-functions
+ '';
+
+ checkPhase = ''
+ $out/bin/imgp --help
+ '';
+
+ meta = with lib; {
+ description = "High-performance CLI batch image resizer & rotator";
+ homepage = "https://github.com/jarun/imgp";
+ license = licenses.gpl3;
+ platforms = platforms.unix;
+ maintainers = with maintainers; [ sikmir ];
+ };
+}
diff --git a/pkgs/applications/graphics/imlibsetroot/default.nix b/pkgs/applications/graphics/imlibsetroot/default.nix
index 49868bbd831f1c38da46988de267b481959bce8a..8ca4d71bb56cd99cdebe182263ff2824cb3c6399 100644
--- a/pkgs/applications/graphics/imlibsetroot/default.nix
+++ b/pkgs/applications/graphics/imlibsetroot/default.nix
@@ -24,6 +24,6 @@ stdenv.mkDerivation {
homepage = http://robotmonkeys.net/2010/03/30/imlibsetroot/;
license = licenses.gpl2;
platforms = platforms.linux;
- maintainers = with maintainers; [ lucas8 ];
+ maintainers = with maintainers; [ dwarfmaster ];
};
}
diff --git a/pkgs/applications/graphics/krop/default.nix b/pkgs/applications/graphics/krop/default.nix
index c4c889cdba526477b334aee726b3ac1a6721db74..401e5f6fc570b1506a586a252db5bea310a08c7a 100644
--- a/pkgs/applications/graphics/krop/default.nix
+++ b/pkgs/applications/graphics/krop/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, python3Packages, libsForQt5, ghostscript }:
+{ stdenv, fetchFromGitHub, python3Packages, libsForQt5, ghostscript, qt5}:
python3Packages.buildPythonApplication rec {
pname = "krop";
@@ -19,6 +19,11 @@ python3Packages.buildPythonApplication rec {
ghostscript
];
+ nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+ makeWrapperArgs = [
+ "\${qtWrapperArgs[@]}"
+ ];
+
# Disable checks because of interference with older Qt versions // xcb
doCheck = false;
diff --git a/pkgs/applications/graphics/openimageio/default.nix b/pkgs/applications/graphics/openimageio/default.nix
index c743f8bd65323a51361d42bf62dc0c7dedb82110..23cad7e859df1f9a58b4f6355df7df5052eba141 100644
--- a/pkgs/applications/graphics/openimageio/default.nix
+++ b/pkgs/applications/graphics/openimageio/default.nix
@@ -39,6 +39,5 @@ stdenv.mkDerivation rec {
license = licenses.bsd3;
maintainers = [ maintainers.goibhniu ];
platforms = platforms.unix;
- badPlatforms = [ "x86_64-darwin" ];
};
}
diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index 1a47a35574938cd2d2008249f441776fe7d1104a..ac01c28ebd4bf2e1970243e248ba6598a0078a1d 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -1,9 +1,5 @@
-{
-stdenv, fetchFromGitHub, cmake, makeWrapper
-,qtbase, qttools, python, libGLU, libGL
-,libXt, qtx11extras, qtxmlpatterns
-, mkDerivation
-}:
+{ stdenv, fetchFromGitHub, cmake, makeWrapper, qtbase , qttools, python
+, libGLU, libGL , libXt, qtx11extras, qtxmlpatterns , mkDerivation }:
mkDerivation rec {
pname = "paraview";
@@ -30,7 +26,7 @@ mkDerivation rec {
# libraries. These reside in build/lib, and are not found by
# default.
preBuild = ''
- export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib:$PWD/VTK/ThirdParty/vtkm/vtk-m/lib
+ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib:$PWD/VTK/ThirdParty/vtkm/vtk-m/lib
'';
enableParallelBuilding = true;
@@ -53,20 +49,20 @@ mkDerivation rec {
# Paraview links into the Python library, resolving symbolic links on the way,
# so we need to put the correct sitePackages (with numpy) back on the path
- postInstall = ''
- wrapProgram $out/bin/paraview \
- --set PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
- wrapProgram $out/bin/pvbatch \
- --set PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
- wrapProgram $out/bin/pvpython \
- --set PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
+ preFixup = ''
+ wrapQtApp $out/bin/paraview \
+ --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
+ wrapQtApp $out/bin/pvbatch \
+ --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
+ wrapQtApp $out/bin/pvpython \
+ --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
'';
- meta = {
+ meta = with stdenv.lib; {
homepage = http://www.paraview.org/;
description = "3D Data analysis and visualization application";
- license = stdenv.lib.licenses.free;
- maintainers = with stdenv.lib.maintainers; [guibert];
- platforms = with stdenv.lib.platforms; linux;
+ license = licenses.free;
+ maintainers = with maintainers; [ guibert ];
+ platforms = platforms.linux;
};
}
diff --git a/pkgs/applications/graphics/pencil/default.nix b/pkgs/applications/graphics/pencil/default.nix
index 37857fc459ea9c2c682e3c8b188671b7a7fe81ab..edd923822ea3920a9d9eab900841a094df92fb0e 100644
--- a/pkgs/applications/graphics/pencil/default.nix
+++ b/pkgs/applications/graphics/pencil/default.nix
@@ -1,32 +1,72 @@
-{ stdenv, fetchurl, lib, makeWrapper,
+{ stdenv, fetchurl, lib, makeWrapper, wrapGAppsHook,
# build dependencies
- alsaLib, atk, cairo, cups, dbus, expat, fontconfig,
- freetype, gdk-pixbuf, glib, gnome2, nspr, nss, xorg,
- glibc, systemd
+ alsaLib, atk, at-spi2-atk, at-spi2-core, cairo, cups, dbus, expat, fontconfig,
+ freetype, gdk-pixbuf, glib, glibc, gtk3, libuuid, nspr, nss, pango,
+ xorg, systemd
}:
+let
-stdenv.mkDerivation rec {
- version = "3.0.4";
+ deps = [
+ alsaLib
+ atk
+ at-spi2-atk
+ at-spi2-core
+ cairo
+ cups
+ dbus
+ expat
+ fontconfig
+ freetype
+ gdk-pixbuf
+ glib
+ glibc
+ gtk3
+ libuuid
+ nspr
+ nss
+ pango
+ xorg.libX11
+ xorg.libxcb
+ xorg.libXScrnSaver
+ xorg.libXcomposite
+ xorg.libXcursor
+ xorg.libXdamage
+ xorg.libXext
+ xorg.libXfixes
+ xorg.libXi
+ xorg.libXrandr
+ xorg.libXrender
+ xorg.libXtst
+ stdenv.cc.cc.lib
+ stdenv.cc.cc
+ ];
+
+in stdenv.mkDerivation rec {
+ version = "3.1.0";
pname = "pencil";
src = fetchurl {
- url = "http://pencil.evolus.vn/dl/V${version}/Pencil_${version}_amd64.deb";
- sha256 = "58e2b794c615ea8715d8374f177e19c87f7071e359826ec34a59836d537a62fd";
+ url = "http://pencil.evolus.vn/dl/V${version}.ga/pencil_${version}.ga_amd64.deb";
+ sha256 = "01ae54b1a1351b909eb2366c6ec00816e1deba370e58f35601cf7368f10aaba3";
};
sourceRoot = ".";
unpackCmd = ''
- ar p "$src" data.tar.xz | tar xJ
+ ar p "$src" data.tar.gz | tar xz
'';
dontBuild = true;
- nativeBuildInputs = [ makeWrapper ];
+ nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
+
+ buildInputs = deps;
installPhase = ''
- mkdir -p $out/bin
- cp -R usr/share opt $out/
+ mkdir -p $out/bin $out/opt $out/share/applications
+ cp -R usr/share $out/
+ cp -R opt/pencil*/ $out/opt/pencil
+ cp $out/opt/pencil/pencil.desktop $out/share/applications/
# fix the path in the desktop file
substituteInPlace \
@@ -34,42 +74,12 @@ stdenv.mkDerivation rec {
--replace /opt/ $out/opt/
# symlink the binary to bin/
- ln -s $out/opt/Pencil/pencil $out/bin/pencil
+ ln -s $out/opt/pencil/pencil $out/bin/pencil
'';
preFixup = let
- packages = [
- alsaLib
- atk
- cairo
- cups
- dbus
- expat
- fontconfig
- freetype
- gdk-pixbuf
- glib
- gnome2.GConf
- gnome2.gtk
- gnome2.pango
- nspr
- nss
- xorg.libX11
- xorg.libXScrnSaver
- xorg.libXcomposite
- xorg.libXcursor
- xorg.libXdamage
- xorg.libXext
- xorg.libXfixes
- xorg.libXi
- xorg.libXrandr
- xorg.libXrender
- xorg.libXtst
- stdenv.cc.cc.lib
- stdenv.cc.cc
- glibc
- ];
+ packages = deps;
libPathNative = lib.makeLibraryPath packages;
libPath64 = lib.makeSearchPathOutput "lib" "lib64" packages;
libPath = "${libPathNative}:${libPath64}";
@@ -77,21 +87,13 @@ stdenv.mkDerivation rec {
# patch executable
patchelf \
--set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
- --set-rpath "${libPath}:$out/opt/Pencil" \
- $out/opt/Pencil/pencil
-
- # patch libnode
- patchelf \
- --set-rpath "${libPath}" \
- $out/opt/Pencil/libnode.so
-
- # libffmpeg is for some reason not executable
- chmod a+x $out/opt/Pencil/libffmpeg.so
+ --set-rpath "${libPath}:$out/opt/pencil" \
+ $out/opt/pencil/pencil
# fix missing libudev
- ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/Pencil/libudev.so.1
- wrapProgram $out/opt/Pencil/pencil \
- --prefix LD_LIBRARY_PATH : $out/opt/Pencil
+ ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/pencil/libudev.so.1
+ wrapProgram $out/opt/pencil/pencil \
+ --prefix LD_LIBRARY_PATH : $out/opt/pencil
'';
meta = with stdenv.lib; {
diff --git a/pkgs/applications/graphics/qview/default.nix b/pkgs/applications/graphics/qview/default.nix
index 0595ab2963ca5214c81591c407f5d5934ceeca4c..8df6ce4f80baf7b642e11dffeb93adbeca555047 100644
--- a/pkgs/applications/graphics/qview/default.nix
+++ b/pkgs/applications/graphics/qview/default.nix
@@ -1,12 +1,12 @@
{stdenv, fetchFromGitHub, qmake}:
stdenv.mkDerivation rec {
pname = "qview";
- version = "2.0";
+ version = "3.0";
src = fetchFromGitHub {
owner = "jurplel";
repo = "qView";
rev = version;
- sha256 = "1s29hz44rb5dwzq8d4i4bfg77dr0v3ywpvidpa6xzg7hnnv3mhi5";
+ sha256 = "15a91bs3wcqhgf76wzigbn10hayg628j84pq4j2vaxar94ak0vk7";
};
nativeBuildInputs = [ qmake ];
patchPhase = ''
diff --git a/pkgs/applications/graphics/rapid-photo-downloader/default.nix b/pkgs/applications/graphics/rapid-photo-downloader/default.nix
index 2e12e18a5a535243cda7b88da1ad6a5bfc4805e2..afdd2262e504fdd0ec4b75473a1f1fe7ff1af9c2 100644
--- a/pkgs/applications/graphics/rapid-photo-downloader/default.nix
+++ b/pkgs/applications/graphics/rapid-photo-downloader/default.nix
@@ -6,11 +6,11 @@
mkDerivationWith python3Packages.buildPythonApplication rec {
pname = "rapid-photo-downloader";
- version = "0.9.17";
+ version = "0.9.18";
src = fetchurl {
url = "https://launchpad.net/rapid/pyqt/${version}/+download/${pname}-${version}.tar.gz";
- sha256 = "10vqbi9rcg8r0jxpx2kn8xmahwgdcal28wpix2fg6nkp5rfwxnr6";
+ sha256 = "15p7sssg6vmqbm5xnc4j5dr89d7gl7y5qyq44a240yl5aqkjnybw";
};
# Disable version check and fix install tests
@@ -80,7 +80,7 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
meta = with stdenv.lib; {
description = "Photo and video importer for cameras, phones, and memory cards";
- homepage = http://www.damonlynch.net/rapid/;
+ homepage = https://www.damonlynch.net/rapid/;
license = licenses.gpl3;
platforms = platforms.linux;
maintainers = with maintainers; [ jfrankenau ];
diff --git a/pkgs/applications/graphics/renderdoc/default.nix b/pkgs/applications/graphics/renderdoc/default.nix
index 426985d312c7a279f5edead58e1c5836e4d47fab..843801011f773006b810df7fc9f0736ac979c794 100644
--- a/pkgs/applications/graphics/renderdoc/default.nix
+++ b/pkgs/applications/graphics/renderdoc/default.nix
@@ -13,14 +13,14 @@ let
pythonPackages = python3Packages;
in
mkDerivation rec {
- version = "1.5";
+ version = "1.6";
pname = "renderdoc";
src = fetchFromGitHub {
owner = "baldurk";
repo = "renderdoc";
rev = "v${version}";
- sha256 = "0a05f6qfq90wrf4fixchp9knx4nhqhwjxl02n03a7k56xzxxnlci";
+ sha256 = "0b2f9m5azzvcjbmxkwcl1d7jvvp720b81zwn19rrskznfcc2r1i8";
};
buildInputs = [
diff --git a/pkgs/applications/graphics/runwayml/default.nix b/pkgs/applications/graphics/runwayml/default.nix
index 839a87214e64c8ad038043d430b2b58d17c8ae83..c3f747837e01d6b646fe1806c75c7c70de14f410 100644
--- a/pkgs/applications/graphics/runwayml/default.nix
+++ b/pkgs/applications/graphics/runwayml/default.nix
@@ -6,12 +6,12 @@
let
pname = "runwayml";
- version = "0.10.11";
+ version = "0.10.20";
name = "${pname}-${version}";
src = fetchurl {
url = "https://runway-releases.s3.amazonaws.com/Runway%20${version}.AppImage";
- sha256 = "0f3icgpwj1sk9bkycqw65c8bhrzzpw5yzacw52siv4j1gl4casnl";
+ sha256 = "1wi94xi8nrwfc4v2j1crlmwr0nxg95ffp5h4hxd84crvya8ibxgz";
name="${pname}-${version}.AppImage";
};
diff --git a/pkgs/applications/graphics/rx/default.nix b/pkgs/applications/graphics/rx/default.nix
index f2b56b578b6e19246ea4d4fa9d4015caf3dc8213..3093fa107d6b75f4ba79a73be2cf773848ccb003 100644
--- a/pkgs/applications/graphics/rx/default.nix
+++ b/pkgs/applications/graphics/rx/default.nix
@@ -7,13 +7,13 @@ with stdenv.lib;
rustPlatform.buildRustPackage rec {
pname = "rx";
- version = "0.3.1";
+ version = "0.3.2";
src = fetchFromGitHub {
owner = "cloudhead";
repo = pname;
rev = "v${version}";
- sha256 = "1byaxbhd3q49473kcdd52rvn3xq7bmy8bdx3pz0jiw96bclzhcgq";
+ sha256 = "1n5s7v2z13550gkqz7w6dw62jdy60wdi8w1lfa23609b4yhg4w94";
};
cargoSha256 = "173jfjvdag97f6jvfg366hjk9v3cz301cbzpcahy51rbf1cip1w1";
diff --git a/pkgs/applications/graphics/sane/backends/default.nix b/pkgs/applications/graphics/sane/backends/default.nix
index 4245acf716d5a29356f1ca00639ade69c735ff4c..6aba42d33e63db50c5ce17792ff0c35e40bbd790 100644
--- a/pkgs/applications/graphics/sane/backends/default.nix
+++ b/pkgs/applications/graphics/sane/backends/default.nix
@@ -1,11 +1,10 @@
{ callPackage, fetchurl, ... } @ args:
callPackage ./generic.nix (args // rec {
- version = "1.0.27";
+ version = "1.0.28";
+
src = fetchurl {
- sha256 = "1j9nbqspaj0rlgalafb5z6r606k0i22kz0rcpd744p176yzlfdr9";
- urls = [
- "https://alioth-archive.debian.org/releases/sane/sane-backends/${version}/sane-backends-${version}.tar.gz"
- ];
+ url = "https://gitlab.com/sane-project/backends/uploads/9e718daff347826f4cfe21126c8d5091/sane-backends-${version}.tar.gz";
+ sha256 = "00yy8q9hqdf0zjxxl4d8njr9zf0hhi3a9ib23ikc2anqf8zhy9ii";
};
})
diff --git a/pkgs/applications/graphics/sane/backends/generic.nix b/pkgs/applications/graphics/sane/backends/generic.nix
index 0e8a5f34f6c1ccfee40c38464d46cf5263de4f3b..d3e8b417017d184f956a397af164755a2c0d26ea 100644
--- a/pkgs/applications/graphics/sane/backends/generic.nix
+++ b/pkgs/applications/graphics/sane/backends/generic.nix
@@ -1,6 +1,6 @@
{ stdenv
-, avahi, libjpeg, libusb1, libv4l, net-snmp, libpng
, gettext, pkgconfig
+, avahi, libgphoto2, libieee1284, libjpeg, libpng, libtiff, libusb1, libv4l, net-snmp
# List of { src name backend } attibute sets - see installFirmware below:
, extraFirmware ? []
@@ -19,15 +19,30 @@ stdenv.mkDerivation {
outputs = [ "out" "doc" "man" ];
- configureFlags = []
- ++ stdenv.lib.optional (avahi != null) "--enable-avahi"
- ++ stdenv.lib.optional (libusb1 != null) "--enable-libusb_1_0"
- ;
+ nativeBuildInputs = [
+ gettext
+ pkgconfig
+ ];
+
+ buildInputs = [
+ avahi
+ libgphoto2
+ libieee1284
+ libjpeg
+ libpng
+ libtiff
+ libusb1
+ libv4l
+ net-snmp
+ ];
- buildInputs = [ avahi libusb1 libv4l net-snmp libpng ];
- nativeBuildInputs = [ gettext pkgconfig ];
enableParallelBuilding = true;
+ configureFlags = []
+ ++ stdenv.lib.optional (avahi != null) "--enable-avahi"
+ ++ stdenv.lib.optional (libusb1 != null) "--with-usb"
+ ;
+
postInstall = let
compatFirmware = extraFirmware
@@ -71,7 +86,7 @@ stdenv.mkDerivation {
video- and still-cameras, frame-grabbers, etc. For a list of supported
scanners, see http://www.sane-project.org/sane-backends.html.
'';
- homepage = http://www.sane-project.org/;
+ homepage = "http://www.sane-project.org/";
license = licenses.gpl2Plus;
maintainers = with maintainers; [ peti ];
diff --git a/pkgs/applications/graphics/shutter/default.nix b/pkgs/applications/graphics/shutter/default.nix
index 957692b4ba17a659f5f6d834334fefbf9748172a..dd41ee4c3f845260a05169b35bc71a5146843240 100644
--- a/pkgs/applications/graphics/shutter/default.nix
+++ b/pkgs/applications/graphics/shutter/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
meta = with stdenv.lib; {
description = "Screenshot and annotation tool";
- homepage = http://shutter-project.org/;
+ homepage = https://shutter-project.org/;
license = licenses.gpl3Plus;
platforms = platforms.all;
maintainers = [ maintainers.bjornfor ];
diff --git a/pkgs/applications/graphics/sxiv/default.nix b/pkgs/applications/graphics/sxiv/default.nix
index 99c151f8c80b4a4fa6c6399d6a41c22b7fbf238d..f54299583286cc929b5c2a3b070edae9f0ac51e1 100644
--- a/pkgs/applications/graphics/sxiv/default.nix
+++ b/pkgs/applications/graphics/sxiv/default.nix
@@ -4,28 +4,24 @@ with stdenv.lib;
stdenv.mkDerivation rec {
pname = "sxiv";
- version = "25";
+ version = "26";
src = fetchFromGitHub {
owner = "muennich";
repo = pname;
rev = "v${version}";
- sha256 = "13s1lfar142hq1j7xld0ri616p4bqs57b17yr4d0b9a9w7liz4hp";
+ sha256 = "0xaawlfdy7b277m38mgg4423kd7p1ffn0dq4hciqs6ivbb3q9c4f";
};
- postUnpack = ''
- substituteInPlace $sourceRoot/Makefile \
- --replace /usr/local $out
- '';
-
configFile = optionalString (conf!=null) (builtins.toFile "config.def.h" conf);
preBuild = optionalString (conf!=null) "cp ${configFile} config.def.h";
buildInputs = [ libXft imlib2 giflib libexif ];
+ makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
postInstall = ''
- mkdir -p $out/share/applications/
- cp -v sxiv.desktop $out/share/applications/
+ install -Dt $out/share/applications sxiv.desktop
'';
meta = {
diff --git a/pkgs/applications/graphics/tesseract/tesseract4.nix b/pkgs/applications/graphics/tesseract/tesseract4.nix
index 548f58a50fb1ba4d678f446f951855b2d00ea688..95896337720a876b6210640957dc49fed05c3f43 100644
--- a/pkgs/applications/graphics/tesseract/tesseract4.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract4.nix
@@ -3,13 +3,13 @@
stdenv.mkDerivation rec {
pname = "tesseract";
- version = "4.1.0";
+ version = "4.1.1";
src = fetchFromGitHub {
owner = "tesseract-ocr";
repo = "tesseract";
rev = version;
- sha256 = "06i7abxy2ifmdx1fak81cx0kns85n8hvp0339jk6242fhshibljx";
+ sha256 = "1ca27zbjpx35nxh9fha410z3jskwyj06i5hqiqdc08s2d7kdivwn";
};
enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/tev/default.nix b/pkgs/applications/graphics/tev/default.nix
index 47da0b749df36732b043374d98c8c06cf43cd0c5..b884532279e57540e92e54b87d0f9ac7a16fdf41 100644
--- a/pkgs/applications/graphics/tev/default.nix
+++ b/pkgs/applications/graphics/tev/default.nix
@@ -1,22 +1,22 @@
{ stdenv, fetchFromGitHub
, cmake, wrapGAppsHook
-, libX11, xorg, libzip, glfw, gnome3
+, libX11, libzip, glfw, libpng, xorg, gnome3
}:
stdenv.mkDerivation rec {
pname = "tev";
- version = "1.13";
+ version = "1.14";
src = fetchFromGitHub {
owner = "Tom94";
repo = pname;
rev = "v${version}";
fetchSubmodules = true;
- sha256 = "0c8md6yv1q449aszs05xfby6a2aiw8pac7x0zs169i5mpqrrbfa9";
+ sha256 = "1g86wl0sdn0wprfxff2q1yc1hiq9fndmzhyvj09cw51lzbab5faw";
};
nativeBuildInputs = [ cmake wrapGAppsHook ];
- buildInputs = [ libX11 libzip glfw ]
+ buildInputs = [ libX11 libzip glfw libpng ]
++ (with xorg; [ libXrandr libXinerama libXcursor libXi libXxf86vm ]);
dontWrapGApps = true; # We also need zenity (see below)
diff --git a/pkgs/applications/graphics/xournalpp/default.nix b/pkgs/applications/graphics/xournalpp/default.nix
index 76f8e03fa13f34f86ea088e1b5059a4d1f77e937..65aa17e3b4eed1f9432843b7e1e91802d6f290e7 100644
--- a/pkgs/applications/graphics/xournalpp/default.nix
+++ b/pkgs/applications/graphics/xournalpp/default.nix
@@ -1,5 +1,4 @@
{ stdenv
-, lib
, fetchFromGitHub
, cmake
@@ -23,13 +22,13 @@
stdenv.mkDerivation rec {
pname = "xournalpp";
- version = "1.0.16";
+ version = "1.0.17";
src = fetchFromGitHub {
owner = "xournalpp";
repo = pname;
rev = version;
- sha256 = "1bdmxxkcqpjvkckizmrz2839b4yspw4xv69bqkrrgkcyvxsr804w";
+ sha256 = "0xw2mcgnm4sa9hrhfgp669lfypw97drxjmz5w8i5whaprpvmkxzw";
};
nativeBuildInputs = [ cmake gettext pkgconfig wrapGAppsHook ];
@@ -45,7 +44,9 @@ stdenv.mkDerivation rec {
portaudio
zlib
]
- ++ lib.optional withLua lua;
+ ++ stdenv.lib.optional withLua lua;
+
+ buildFlags = "translations";
hardeningDisable = [ "format" ];
@@ -53,9 +54,9 @@ stdenv.mkDerivation rec {
meta = with stdenv.lib; {
description = "Xournal++ is a handwriting Notetaking software with PDF annotation support";
- homepage = https://github.com/xournalpp/xournalpp;
+ homepage = "https://github.com/xournalpp/xournalpp";
license = licenses.gpl2;
- maintainers = with maintainers; [ andrew-d ];
+ maintainers = with maintainers; [ andrew-d sikmir ];
platforms = platforms.linux;
};
}
diff --git a/pkgs/applications/kde/default.nix b/pkgs/applications/kde/default.nix
index 0bfa850cb26e0a7db2187cc78312d1230b608e4f..3c45b05e9e8f2f854ed5cba66dc7d7e82a7bb198 100644
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@@ -121,6 +121,7 @@ let
kio-extras = callPackage ./kio-extras.nix {};
kldap = callPackage ./kldap.nix {};
kleopatra = callPackage ./kleopatra.nix {};
+ kmahjongg = callPackage ./kmahjongg.nix {};
kmail = callPackage ./kmail.nix {};
kmail-account-wizard = callPackage ./kmail-account-wizard.nix {};
kmailtransport = callPackage ./kmailtransport.nix {};
@@ -160,6 +161,7 @@ let
libkgapi = callPackage ./libkgapi.nix {};
libkipi = callPackage ./libkipi.nix {};
libkleo = callPackage ./libkleo.nix {};
+ libkmahjongg = callPackage ./libkmahjongg.nix {};
libkomparediff2 = callPackage ./libkomparediff2.nix {};
libksane = callPackage ./libksane.nix {};
libksieve = callPackage ./libksieve.nix {};
diff --git a/pkgs/applications/kde/kmahjongg.nix b/pkgs/applications/kde/kmahjongg.nix
new file mode 100644
index 0000000000000000000000000000000000000000..b51d0d147e2ec13f4637851209f354d93853600d
--- /dev/null
+++ b/pkgs/applications/kde/kmahjongg.nix
@@ -0,0 +1,19 @@
+{ lib
+, mkDerivation
+, extra-cmake-modules
+, kdoctools
+, kdeclarative
+, knewstuff
+, libkdegames
+, libkmahjongg
+}:
+
+mkDerivation {
+ name = "kmahjongg";
+ nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+ buildInputs = [ kdeclarative libkmahjongg knewstuff libkdegames ];
+ meta = {
+ license = with lib.licenses; [ gpl2 ];
+ maintainers = with lib.maintainers; [ genesis ];
+ };
+}
diff --git a/pkgs/applications/kde/libkmahjongg.nix b/pkgs/applications/kde/libkmahjongg.nix
new file mode 100644
index 0000000000000000000000000000000000000000..4b7b8538290c5af74ffd227afb91af39000b8ae0
--- /dev/null
+++ b/pkgs/applications/kde/libkmahjongg.nix
@@ -0,0 +1,18 @@
+{
+ mkDerivation, lib, kdepimTeam,
+ extra-cmake-modules, kdoctools,
+ kcompletion, kconfig, kconfigwidgets, kcoreaddons, ki18n,
+ kwidgetsaddons
+}:
+
+mkDerivation {
+ name = "libkmahjongg";
+ meta = {
+ license = with lib.licenses; [ gpl2 ];
+ maintainers = with lib.maintainers; [ genesis ];
+ };
+ nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+ buildInputs = [ kcompletion kconfig kconfigwidgets kcoreaddons ki18n
+ kwidgetsaddons ];
+ outputs = [ "out" "dev" ];
+}
diff --git a/pkgs/applications/misc/audio/soxr/default.nix b/pkgs/applications/misc/audio/soxr/default.nix
index 7c4e6ff8c3d7bb4dc174c1d62ab234f731908ba1..20a754ba98ae6f598cd67a245c0abddfa13bcc73 100644
--- a/pkgs/applications/misc/audio/soxr/default.nix
+++ b/pkgs/applications/misc/audio/soxr/default.nix
@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
outputs = [ "out" "doc" ]; # headers are just two and very small
preConfigure = if stdenv.isDarwin then ''
- export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:"`pwd`/build/src
+ export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}"`pwd`/build/src
'' else ''
- export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:"`pwd`/build/src
+ export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}"`pwd`/build/src
'';
nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/bashSnippets/default.nix b/pkgs/applications/misc/bashSnippets/default.nix
index b0af34ec7606bb99696cf6e75699f403c68efda4..0976e7625bcf67dc6785595b214e7724610681f2 100644
--- a/pkgs/applications/misc/bashSnippets/default.nix
+++ b/pkgs/applications/misc/bashSnippets/default.nix
@@ -1,7 +1,7 @@
{ stdenv, lib, fetchFromGitHub, makeWrapper
, curl, python, bind, iproute, bc, gitMinimal }:
let
- version = "1.17.3";
+ version = "1.23.0";
deps = lib.makeBinPath [
curl
python
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
owner = "alexanderepstein";
repo = "Bash-Snippets";
rev = "v${version}";
- sha256 = "1xdjk8bjh7l6h7gdqrra1dh4wdq89wmd0jsirsvqa3bmcsb2wz1r";
+ sha256 = "044nxgd3ic2qr6hgq5nymn3dyf5i4s8mv5z4az6jvwlrjnvbg8cp";
};
buildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/misc/bleachbit/default.nix b/pkgs/applications/misc/bleachbit/default.nix
index 225a5c5fc3763484a5b1155ac20a7f8ff5e8ec6e..4b2e1c66761251a97568563ac0231b779b3f6f77 100644
--- a/pkgs/applications/misc/bleachbit/default.nix
+++ b/pkgs/applications/misc/bleachbit/default.nix
@@ -11,13 +11,13 @@
pythonPackages.buildPythonApplication rec {
pname = "bleachbit";
- version = "3.0";
+ version = "3.2.0";
format = "other";
src = fetchurl {
url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
- sha256 = "18ns9hms671b4l0189m1m2agprkydnpvyky9q2f5hxf35i9cn67d";
+ sha256 = "1sszpn7ifiry0wwmkzdppzh61zvgrfypm9g7wk6q1ya20qhb5b51";
};
nativeBuildInputs = [
diff --git a/pkgs/applications/misc/blender/darwin.patch b/pkgs/applications/misc/blender/darwin.patch
new file mode 100644
index 0000000000000000000000000000000000000000..43b96466df28ad55d048217938b3fc2bab37c2fb
--- /dev/null
+++ b/pkgs/applications/misc/blender/darwin.patch
@@ -0,0 +1,105 @@
+diff a/build_files/cmake/platform/platform_apple.cmake b/build_files/cmake/platform/platform_apple.cmake
+--- a/build_files/cmake/platform/platform_apple.cmake
++++ b/build_files/cmake/platform/platform_apple.cmake
+@@ -35,7 +35,6 @@ else()
+ message(STATUS "Using pre-compiled LIBDIR: ${LIBDIR}")
+ endif()
+ if(NOT EXISTS "${LIBDIR}/")
+- message(FATAL_ERROR "Mac OSX requires pre-compiled libs at: '${LIBDIR}'")
+ endif()
+
+ if(WITH_OPENAL)
+@@ -79,7 +78,7 @@ endif()
+ if(WITH_CODEC_SNDFILE)
+ set(LIBSNDFILE ${LIBDIR}/sndfile)
+ set(LIBSNDFILE_INCLUDE_DIRS ${LIBSNDFILE}/include)
+- set(LIBSNDFILE_LIBRARIES sndfile FLAC ogg vorbis vorbisenc)
++ set(LIBSNDFILE_LIBRARIES sndfile)
+ set(LIBSNDFILE_LIBPATH ${LIBSNDFILE}/lib ${LIBDIR}/ffmpeg/lib) # TODO, deprecate
+ endif()
+
+@@ -90,7 +89,7 @@ if(WITH_PYTHON)
+ # normally cached but not since we include them with blender
+ set(PYTHON_INCLUDE_DIR "${LIBDIR}/python/include/python${PYTHON_VERSION}m")
+ set(PYTHON_EXECUTABLE "${LIBDIR}/python/bin/python${PYTHON_VERSION}m")
+- set(PYTHON_LIBRARY ${LIBDIR}/python/lib/libpython${PYTHON_VERSION}m.a)
++ set(PYTHON_LIBRARY "${LIBDIR}/python/lib/libpython${PYTHON_VERSION}m.dylib")
+ set(PYTHON_LIBPATH "${LIBDIR}/python/lib/python${PYTHON_VERSION}")
+ # set(PYTHON_LINKFLAGS "-u _PyMac_Error") # won't build with this enabled
+ else()
+@@ -155,10 +154,7 @@ if(WITH_CODEC_FFMPEG)
+ set(FFMPEG_INCLUDE_DIRS ${FFMPEG}/include)
+ set(FFMPEG_LIBRARIES
+ avcodec avdevice avformat avutil
+- mp3lame swscale x264 xvidcore
+- theora theoradec theoraenc
+- vorbis vorbisenc vorbisfile ogg opus
+- vpx swresample)
++ swscale swresample)
+ set(FFMPEG_LIBPATH ${FFMPEG}/lib)
+ endif()
+
+@@ -199,14 +195,14 @@ if(WITH_OPENCOLLADA)
+ set(OPENCOLLADA ${LIBDIR}/opencollada)
+
+ set(OPENCOLLADA_INCLUDE_DIRS
+- ${LIBDIR}/opencollada/include/COLLADAStreamWriter
+- ${LIBDIR}/opencollada/include/COLLADABaseUtils
+- ${LIBDIR}/opencollada/include/COLLADAFramework
+- ${LIBDIR}/opencollada/include/COLLADASaxFrameworkLoader
+- ${LIBDIR}/opencollada/include/GeneratedSaxParser
++ ${LIBDIR}/opencollada/include/opencollada/COLLADAStreamWriter
++ ${LIBDIR}/opencollada/include/opencollada/COLLADABaseUtils
++ ${LIBDIR}/opencollada/include/opencollada/COLLADAFramework
++ ${LIBDIR}/opencollada/include/opencollada/COLLADASaxFrameworkLoader
++ ${LIBDIR}/opencollada/include/opencollada/GeneratedSaxParser
+ )
+
+- set(OPENCOLLADA_LIBPATH ${OPENCOLLADA}/lib)
++ set(OPENCOLLADA_LIBPATH ${OPENCOLLADA}/lib/opencollada)
+ set(OPENCOLLADA_LIBRARIES
+ OpenCOLLADASaxFrameworkLoader
+ -lOpenCOLLADAFramework
+@@ -215,7 +211,7 @@ if(WITH_OPENCOLLADA)
+ -lMathMLSolver
+ -lGeneratedSaxParser
+ -lbuffer -lftoa -lUTF
+- ${OPENCOLLADA_LIBPATH}/libxml2.a
++ xml2
+ )
+ # PCRE is bundled with openCollada
+ # set(PCRE ${LIBDIR}/pcre)
+@@ -276,14 +272,13 @@ if(WITH_BOOST)
+ endif()
+
+ if(WITH_INTERNATIONAL OR WITH_CODEC_FFMPEG)
+- set(PLATFORM_LINKFLAGS "${PLATFORM_LINKFLAGS} -liconv") # boost_locale and ffmpeg needs it !
+ endif()
+
+ if(WITH_OPENIMAGEIO)
+ set(OPENIMAGEIO ${LIBDIR}/openimageio)
+ set(OPENIMAGEIO_INCLUDE_DIRS ${OPENIMAGEIO}/include)
+ set(OPENIMAGEIO_LIBRARIES
+- ${OPENIMAGEIO}/lib/libOpenImageIO.a
++ ${OPENIMAGEIO}/lib/libOpenImageIO.dylib
+ ${PNG_LIBRARIES}
+ ${JPEG_LIBRARIES}
+ ${TIFF_LIBRARY}
+@@ -306,7 +301,7 @@ endif()
+ if(WITH_OPENCOLORIO)
+ set(OPENCOLORIO ${LIBDIR}/opencolorio)
+ set(OPENCOLORIO_INCLUDE_DIRS ${OPENCOLORIO}/include)
+- set(OPENCOLORIO_LIBRARIES OpenColorIO tinyxml yaml-cpp)
++ set(OPENCOLORIO_LIBRARIES OpenColorIO)
+ set(OPENCOLORIO_LIBPATH ${OPENCOLORIO}/lib)
+ endif()
+
+@@ -443,7 +438,7 @@ else()
+ set(CMAKE_CXX_FLAGS_RELEASE "-mdynamic-no-pic -fno-strict-aliasing")
+ endif()
+
+-if(${XCODE_VERSION} VERSION_EQUAL 5 OR ${XCODE_VERSION} VERSION_GREATER 5)
++if(FALSE)
+ # Xcode 5 is always using CLANG, which has too low template depth of 128 for libmv
+ set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -ftemplate-depth=1024")
+ endif()
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 0af78852204d6aeb336643c67b36968e907b661d..83f2bf63642d11bd6eaabc83df2a851f573dfab0 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -1,13 +1,14 @@
{ config, stdenv, lib, fetchurl, boost, cmake, ffmpeg, gettext, glew
, ilmbase, libXi, libX11, libXext, libXrender
, libjpeg, libpng, libsamplerate, libsndfile
-, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimageio, openjpeg_1, python3Packages
+, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimageio2, openjpeg, python3Packages
, openvdb, libXxf86vm, tbb
, zlib, fftw, opensubdiv, freetype, jemalloc, ocl-icd, addOpenGLRunpath
, jackaudioSupport ? false, libjack2
, cudaSupport ? config.cudaSupport or false, cudatoolkit
, colladaSupport ? true, opencollada
, enableNumpy ? false, makeWrapper
+, pugixml, SDL, Cocoa, CoreGraphics, ForceFeedback, OpenAL, OpenGL
}:
with lib;
@@ -23,22 +24,53 @@ stdenv.mkDerivation rec {
sha256 = "1zl0ar95qkxsrbqw9miz2hrjijlqjl06vg3clfk9rm7krr2l3b2j";
};
+ patches = lib.optional stdenv.isDarwin ./darwin.patch;
+
nativeBuildInputs = [ cmake ] ++ optional cudaSupport addOpenGLRunpath;
buildInputs =
[ boost ffmpeg gettext glew ilmbase
- libXi libX11 libXext libXrender
- freetype libjpeg libpng libsamplerate libsndfile libtiff libGLU libGL openal
- opencolorio openexr openimageio openjpeg_1 python zlib fftw jemalloc
+ freetype libjpeg libpng libsamplerate libsndfile libtiff
+ opencolorio openexr openimageio2 openjpeg python zlib fftw jemalloc
(opensubdiv.override { inherit cudaSupport; })
- openvdb libXxf86vm tbb
+ tbb
makeWrapper
]
+ ++ (if (!stdenv.isDarwin) then [
+ libXi libX11 libXext libXrender
+ libGLU libGL openal
+ libXxf86vm
+ # OpenVDB currently doesn't build on darwin
+ openvdb
+ ]
+ else [
+ pugixml SDL Cocoa CoreGraphics ForceFeedback OpenAL OpenGL
+ ])
++ optional jackaudioSupport libjack2
++ optional cudaSupport cudatoolkit
++ optional colladaSupport opencollada;
postPatch =
- ''
+ if stdenv.isDarwin then ''
+ : > build_files/cmake/platform/platform_apple_xcode.cmake
+ substituteInPlace source/creator/CMakeLists.txt \
+ --replace '${"$"}{LIBDIR}/python' \
+ '${python}'
+ substituteInPlace build_files/cmake/platform/platform_apple.cmake \
+ --replace '${"$"}{LIBDIR}/python' \
+ '${python}' \
+ --replace '${"$"}{LIBDIR}/opencollada' \
+ '${opencollada}' \
+ --replace '${"$"}{PYTHON_LIBPATH}/site-packages/numpy' \
+ '${python3Packages.numpy}/${python.sitePackages}/numpy' \
+ --replace 'set(OPENJPEG_INCLUDE_DIRS ' \
+ 'set(OPENJPEG_INCLUDE_DIRS "'$(echo ${openjpeg.dev}/include/openjpeg-*)'") #' \
+ --replace 'set(OPENJPEG_LIBRARIES ' \
+ 'set(OPENJPEG_LIBRARIES "${openjpeg}/lib/libopenjp2.dylib") #' \
+ --replace 'set(OPENIMAGEIO ' \
+ 'set(OPENIMAGEIO "${openimageio2.out}") #' \
+ --replace 'set(OPENEXR_INCLUDE_DIRS ' \
+ 'set(OPENEXR_INCLUDE_DIRS "${openexr.dev}/include/OpenEXR") #'
+ '' else ''
substituteInPlace extern/clew/src/clew.c --replace '"libOpenCL.so"' '"${ocl-icd}/lib/libOpenCL.so"'
'';
@@ -48,7 +80,7 @@ stdenv.mkDerivation rec {
"-DWITH_CODEC_SNDFILE=ON"
"-DWITH_INSTALL_PORTABLE=OFF"
"-DWITH_FFTW3=ON"
- #"-DWITH_SDL=ON"
+ "-DWITH_SDL=OFF"
"-DWITH_OPENCOLORIO=ON"
"-DWITH_OPENSUBDIV=ON"
"-DPYTHON_LIBRARY=${python.libPrefix}m"
@@ -61,10 +93,18 @@ stdenv.mkDerivation rec {
"-DWITH_OPENVDB=ON"
"-DWITH_TBB=ON"
"-DWITH_IMAGE_OPENJPEG=ON"
+ "-DWITH_OPENCOLLADA=${if colladaSupport then "ON" else "OFF"}"
+ ]
+ ++ optionals stdenv.isDarwin [
+ "-DWITH_CYCLES_OSL=OFF" # requires LLVM
+ "-DWITH_OPENVDB=OFF" # OpenVDB currently doesn't build on darwin
+
+ "-DLIBDIR=/does-not-exist"
]
+ # Clang doesn't support "-export-dynamic"
+ ++ optional stdenv.cc.isClang "-DPYTHON_LINKFLAGS="
++ optional jackaudioSupport "-DWITH_JACK=ON"
- ++ optional cudaSupport "-DWITH_CYCLES_CUDA_BINARIES=ON"
- ++ optional colladaSupport "-DWITH_OPENCOLLADA=ON";
+ ++ optional cudaSupport "-DWITH_CYCLES_CUDA_BINARIES=ON";
NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR -I${python}/include/${python.libPrefix}";
@@ -95,7 +135,7 @@ stdenv.mkDerivation rec {
# They comment two licenses: GPLv2 and Blender License, but they
# say: "We've decided to cancel the BL offering for an indefinite period."
license = licenses.gpl2Plus;
- platforms = [ "x86_64-linux" ];
+ platforms = [ "x86_64-linux" "x86_64-darwin" ];
maintainers = [ maintainers.goibhniu ];
};
}
diff --git a/pkgs/applications/misc/blugon/default.nix b/pkgs/applications/misc/blugon/default.nix
index e6f956cc09101c53b64e5fee2664d225b2ce8e3e..cdb317749efefbf7cc513c0b715d957f0165d175 100644
--- a/pkgs/applications/misc/blugon/default.nix
+++ b/pkgs/applications/misc/blugon/default.nix
@@ -2,13 +2,13 @@
stdenv.mkDerivation rec {
pname = "blugon";
- version = "1.11.4";
+ version = "1.12.0";
src = fetchFromGitHub {
owner = "jumper149";
repo = pname;
rev = version;
- sha256 = "0x320w2h5nlcgha4345i8ns15akb4kmrdgkh710s4r1n1by4x11r";
+ sha256 = "0vdhq8v011awhpkccbcmigj9c46widyzh0m5knafapanai3kv7ii";
};
buildInputs = [ python3 libX11 libXrandr ];
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index 9701db3c0b79100617ba8e84758b4969128fec3b..fd86f21dff0d615c46f438dbdbf5fbf9d1570a66 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -1,7 +1,27 @@
-{ lib, mkDerivation, fetchurl, poppler_utils, pkgconfig, libpng
-, imagemagick, libjpeg, fontconfig, podofo, qtbase, qmake, icu, sqlite
-, unrarSupport ? false, chmlib, python2Packages, libusb1, libmtp
-, xdg_utils, makeDesktopItem, removeReferencesTo
+{ lib
+, mkDerivation
+, fetchurl
+, poppler_utils
+, pkgconfig
+, libpng
+, imagemagick
+, libjpeg
+, fontconfig
+, podofo
+, qtbase
+, qmake
+, icu
+, sqlite
+, hunspell
+, hyphen
+, unrarSupport ? false
+, chmlib
+, python2Packages
+, libusb1
+, libmtp
+, xdg_utils
+, makeDesktopItem
+, removeReferencesTo
}:
let
@@ -10,11 +30,11 @@ let
in
mkDerivation rec {
pname = "calibre";
- version = "3.48.0";
+ version = "4.8.0";
src = fetchurl {
url = "https://download.calibre-ebook.com/${version}/${pname}-${version}.tar.xz";
- sha256 = "034m89h7j2088p324i1kya33dfldmqyynjxk3w98xiqkz7q2hi82";
+ sha256 = "1lk44qh3hzqhpz2b00iik7cgjg4xm36qjh2pxflkjnbk691gbpqk";
};
patches = [
@@ -44,17 +64,49 @@ mkDerivation rec {
CALIBRE_PY3_PORT = builtins.toString pypkgs.isPy3k;
buildInputs = [
- poppler_utils libpng imagemagick libjpeg
- fontconfig podofo qtbase chmlib icu sqlite libusb1 libmtp xdg_utils
- ] ++ (with pypkgs; [
- apsw cssselect css-parser dateutil dnspython feedparser html5-parser lxml markdown netifaces pillow
- python pyqt5_with_qtwebkit sip
- regex msgpack beautifulsoup4 html2text
- # the following are distributed with calibre, but we use upstream instead
- odfpy
- ]) ++ lib.optionals (!pypkgs.isPy3k) (with pypkgs; [
- mechanize
- ]);
+ poppler_utils
+ libpng
+ imagemagick
+ libjpeg
+ fontconfig
+ podofo
+ qtbase
+ chmlib
+ icu
+ hunspell
+ hyphen
+ sqlite
+ libusb1
+ libmtp
+ xdg_utils
+ ] ++ (
+ with pypkgs; [
+ apsw
+ cssselect
+ css-parser
+ dateutil
+ dnspython
+ feedparser
+ html5-parser
+ lxml
+ markdown
+ netifaces
+ pillow
+ python
+ pyqt5_with_qtwebkit
+ sip
+ regex
+ msgpack
+ beautifulsoup4
+ html2text
+ # the following are distributed with calibre, but we use upstream instead
+ odfpy
+ ]
+ ) ++ lib.optionals (!pypkgs.isPy3k) (
+ with pypkgs; [
+ mechanize
+ ]
+ );
installPhase = ''
runHook preInstall
diff --git a/pkgs/applications/misc/cbatticon/default.nix b/pkgs/applications/misc/cbatticon/default.nix
index d6680c61eb9b159421eea074fd704f1c4240e1ff..ac2948c2d6ef46bc3028401e90ed881b1d17b0c4 100644
--- a/pkgs/applications/misc/cbatticon/default.nix
+++ b/pkgs/applications/misc/cbatticon/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, gettext, glib, gtk3, libnotify }:
+{ stdenv, fetchFromGitHub, pkgconfig, gettext, glib, gtk3, libnotify, wrapGAppsHook }:
stdenv.mkDerivation rec {
pname = "cbatticon";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
sha256 = "0ivm2dzhsa9ir25ry418r2qg2llby9j7a6m3arbvq5c3kaj8m9jr";
};
- nativeBuildInputs = [ pkgconfig gettext ];
+ nativeBuildInputs = [ pkgconfig gettext wrapGAppsHook ];
buildInputs = [ glib gtk3 libnotify ];
diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index e06ee14a2d31d7e5cae2569f2218d7c2042c01a4..3cb5738cd42663933b9ea5c53ba65f760aecb72b 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -2,11 +2,11 @@
pythonPackages.buildPythonApplication rec {
pname = "cherrytree";
- version = "0.38.10";
+ version = "0.38.11";
src = fetchurl {
url = "https://www.giuspen.com/software/${pname}-${version}.tar.xz";
- sha256 = "1bj83b7lwqir13fp9slcdn8mgign06vywy42x8zvsp22fjn4p7f7";
+ sha256 = "1awrrfyawa7d8qaipvikxm1p0961060az2qvmv9wwpl47zcnk1dn";
};
nativeBuildInputs = [ gettext ];
diff --git a/pkgs/applications/misc/cointop/default.nix b/pkgs/applications/misc/cointop/default.nix
index 29700774219e218ba8ec042bb1b109572179cd36..ef897d2ea5988b72a8aa2a506988b88ddd6b1bc7 100644
--- a/pkgs/applications/misc/cointop/default.nix
+++ b/pkgs/applications/misc/cointop/default.nix
@@ -2,13 +2,13 @@
buildGoPackage rec {
pname = "cointop";
- version = "1.4.1";
+ version = "1.4.4";
src = fetchFromGitHub {
owner = "miguelmota";
repo = pname;
rev = version;
- sha256 = "067jsn66xs30d5yz9z8cvpxbvh8a95kllkb2wk134c43bfxy2m34";
+ sha256 = "12yi1lmyd5y4cgcjclkczf93jj7wd6k8aqnhq21dd1mx65l77swv";
};
goPackagePath = "github.com/miguelmota/cointop";
diff --git a/pkgs/applications/misc/dbeaver/default.nix b/pkgs/applications/misc/dbeaver/default.nix
index d0011eee9c14b9fc4c1ca3445559123b5fc4b2d5..98aebc32dba1ce5018f6441cef84bacda83c297d 100644
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@@ -7,7 +7,7 @@
stdenv.mkDerivation rec {
pname = "dbeaver-ce";
- version = "6.3.2";
+ version = "6.3.4";
desktopItem = makeDesktopItem {
name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
src = fetchurl {
url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
- sha256 = "0yr79p4vdg6s6c8sry6qnf2ifjcjdapn0sff2crsnz331rsh27sm";
+ sha256 = "1b4ac7vsfz3c9vk7yv33pcfflcxl5fcnbzfdva1yfq63v28g38gk";
};
installPhase = ''
diff --git a/pkgs/applications/misc/diff-pdf/default.nix b/pkgs/applications/misc/diff-pdf/default.nix
index af47afcc601d1d326b909401605bafa2b9b8b70d..83116da4df05bf33ead543ac446e18e04e6574ff 100644
--- a/pkgs/applications/misc/diff-pdf/default.nix
+++ b/pkgs/applications/misc/diff-pdf/default.nix
@@ -9,13 +9,13 @@ let
in
stdenv.mkDerivation rec {
pname = "diff-pdf";
- version = "0.3";
+ version = "0.4.1";
src = fetchFromGitHub {
owner = "vslavik";
repo = "diff-pdf";
rev = "v${version}";
- sha256 = "0vzvyjpk6m89zs6j1dq85f93n2b1i6akn2g0z9qhagjd2pds920i";
+ sha256 = "1y5ji4c4m69vzs0z051fkhfdrjnyxb6kzac5flhdkfb2hgp1jnxl";
};
nativeBuildInputs = [ autoconf automake pkgconfig ];
diff --git a/pkgs/applications/misc/elogind/default.nix b/pkgs/applications/misc/elogind/default.nix
index 3d71d9855d04b255c6b5b2fbe9c9855bb177c712..9565e7213dcd9d12ae9961029a9f523afe704543 100644
--- a/pkgs/applications/misc/elogind/default.nix
+++ b/pkgs/applications/misc/elogind/default.nix
@@ -29,13 +29,13 @@ with stdenv.lib;
stdenv.mkDerivation rec {
pname = "elogind";
- version = "241.4";
+ version = "243.4";
src = fetchFromGitHub {
owner = "elogind";
repo = pname;
rev = "v${version}";
- sha256 = "13nd0chackqclgvw43910k4pkw2q773dh6wq9s5f3d97ibnik48k";
+ sha256 = "141frvgyk4fafcxsix94qc0d9ffrwksld8lqq4hq6xsgjlvv0mrs";
};
nativeBuildInputs = [
diff --git a/pkgs/applications/misc/font-manager/default.nix b/pkgs/applications/misc/font-manager/default.nix
index edb47e11dd7f7289a309c198931cc8757a614ec1..afa0a06d33fc5f2c094e1e3c79d699ceecf941ce 100644
--- a/pkgs/applications/misc/font-manager/default.nix
+++ b/pkgs/applications/misc/font-manager/default.nix
@@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, meson, ninja, gettext, python3, fetchpatch,
+{ stdenv, fetchFromGitHub, meson, ninja, gettext, python3,
pkgconfig, libxml2, json-glib , sqlite, itstool, librsvg, yelp-tools,
vala, gtk3, gnome3, desktop-file-utils, wrapGAppsHook, gobject-introspection
}:
stdenv.mkDerivation rec {
pname = "font-manager";
- version = "0.7.5";
+ version = "0.7.7";
src = fetchFromGitHub {
owner = "FontManager";
repo = "master";
rev = version;
- sha256 = "16hma8rrkam6ngn5vbdaryn31vdixvii6920g9z928gylz9xkd3g";
+ sha256 = "1bzqvspplp1zj0n0869jqbc60wgbjhf0vdrn5bj8dfawxynh8s5f";
};
nativeBuildInputs = [
@@ -38,19 +38,6 @@ stdenv.mkDerivation rec {
gnome3.adwaita-icon-theme
];
- mesonFlags = [
- "-Ddisable_pycompile=true"
- ];
-
- patches = [
- # fix build with Vala 0.46
- (fetchpatch {
- url = "https://github.com/FontManager/font-manager/commit/c73b40de11f376f4515a0edfe97fb3721a264b35.patch";
- sha256 = "0lacwsifgvda2r3z6j2a0svdqr6mgav7zkvih35xa8155y8wfpnw";
- excludes = [ "fedora/font-manager.spec" ];
- })
- ];
-
postPatch = ''
chmod +x meson_post_install.py
patchShebangs meson_post_install.py
diff --git a/pkgs/applications/misc/foxtrotgps/default.nix b/pkgs/applications/misc/foxtrotgps/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..dc3f1922c21442785df4e397d9579bd8d5bc51ac
--- /dev/null
+++ b/pkgs/applications/misc/foxtrotgps/default.nix
@@ -0,0 +1,40 @@
+{ fetchurl, stdenv, pkg-config, wrapGAppsHook, curl, gnome2, gpsd, gtk2
+, intltool, libexif, python3Packages, sqlite }:
+
+stdenv.mkDerivation rec {
+ pname = "foxtrotgps";
+ version = "1.2.2";
+
+ src = fetchurl {
+ url = "https://www.foxtrotgps.org/releases/foxtrotgps-${version}.tar.xz";
+ sha256 = "0grn35j5kwc286dxx18fv32qa330xmalqliwy6zirxmj6dffvrkg";
+ };
+
+ nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+
+ buildInputs = [
+ curl.dev
+ gnome2.libglade.dev
+ gpsd
+ gtk2.dev
+ intltool
+ libexif
+ sqlite.dev
+ (python3Packages.python.withPackages (pythonPackages: with python3Packages;
+ [ beautifulsoup4 feedparser sqlalchemy ]))
+ ];
+
+ meta = with stdenv.lib; {
+ description = "GPS/GIS application optimized for small screens";
+ longDescription = ''
+ An easy to use, free & open-source GPS/GIS application that works well on
+ small screens, and is especially suited to touch input. It spun off of
+ tangoGPS in 2010 with a focus on cooperation and fostering community
+ innovation.
+ '';
+ homepage = "https://www.foxtrotgps.org/";
+ license = licenses.gpl2;
+ platforms = platforms.unix;
+ maintainers = with maintainers; [ wucke13 ];
+ };
+}
diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index d578479787b0f045a8cd6492cc137bee49d2e7b4..941b6050a1ac113bd9b4f9d786aacfd58cdd9024 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,11 +2,11 @@
python3Packages.buildPythonApplication rec {
pname = "gallery_dl";
- version = "1.12.2";
+ version = "1.12.3";
src = python3Packages.fetchPypi {
inherit pname version;
- sha256 = "013bavyqvnay38c844n1jvirsmj807f0wg2qlclkdghkj316p1pz";
+ sha256 = "06q6vmbliy935zlf4bbnfgiqyrx9vskz3fsks4jpxi47xs80rqkz";
};
doCheck = false;
diff --git a/pkgs/applications/misc/gcal/default.nix b/pkgs/applications/misc/gcal/default.nix
index f5eb6e188b7aba026b064df1b18c5d71ad376e3c..713000d3f69af31712f813e8ec99d189480184cd 100644
--- a/pkgs/applications/misc/gcal/default.nix
+++ b/pkgs/applications/misc/gcal/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses }:
+{ stdenv, fetchurl, ncurses, fetchpatch }:
stdenv.mkDerivation rec {
pname = "gcal";
@@ -9,6 +9,13 @@ stdenv.mkDerivation rec {
sha256 = "1av11zkfirbixn05hyq4xvilin0ncddfjqzc4zd9pviyp506rdci";
};
+ patches = [
+ (fetchpatch {
+ url = "https://src.fedoraproject.org/rpms/gcal/raw/master/f/gcal-glibc-no-libio.patch";
+ sha256 = "0l4nw9kgzsay32rsdwvs75pbp4fhx6pfm85paynfbd20cdm2n2kv";
+ })
+ ];
+
enableParallelBuilding = true;
buildInputs = [ ncurses ];
diff --git a/pkgs/applications/misc/girara/default.nix b/pkgs/applications/misc/girara/default.nix
index 6bfb4907807a0bf7fde2b33c5666e015dc557606..45bca7d3fbf54c45342549a37d784fe533bb2177 100644
--- a/pkgs/applications/misc/girara/default.nix
+++ b/pkgs/applications/misc/girara/default.nix
@@ -3,13 +3,13 @@
stdenv.mkDerivation rec {
pname = "girara";
- version = "0.3.3";
+ version = "0.3.4";
outputs = [ "out" "dev" ];
src = fetchurl {
url = "https://git.pwmt.org/pwmt/${pname}/-/archive/${version}/${pname}-${version}.tar.gz";
- sha256 = "13vr62kkkqs2xsrmsn114n6c6084ix1qyjksczqsc3s2y3bdsmj4";
+ sha256 = "08zdsr4zwi49facsl5596l0g1xqqv2jk3sqk841gkxwawcggim44";
};
nativeBuildInputs = [ meson ninja pkgconfig gettext check dbus xvfb_run ];
diff --git a/pkgs/applications/misc/gmtp/default.nix b/pkgs/applications/misc/gmtp/default.nix
index c8bbcf2aa7f3c3f345e00521980c8e50bb173ca7..db2193dbd3d7c573ff15c54f264bcbc3ee329403 100644
--- a/pkgs/applications/misc/gmtp/default.nix
+++ b/pkgs/applications/misc/gmtp/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
description = "A simple MP3 and Media player client for UNIX and UNIX like systems.";
homepage = https://gmtp.sourceforge.io;
platforms = stdenv.lib.platforms.linux;
- maintainers = [ stdenv.lib.maintainers.pbogdan ];
+ maintainers = [ ];
license = stdenv.lib.licenses.bsd3;
};
}
diff --git a/pkgs/applications/misc/gpxlab/default.nix b/pkgs/applications/misc/gpxlab/default.nix
index b4778f9f4f8be1888d0af18bd9386ac3eba2d63d..3b432ff66b128f0a5a25ab41dc983b1daa2641a2 100644
--- a/pkgs/applications/misc/gpxlab/default.nix
+++ b/pkgs/applications/misc/gpxlab/default.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchFromGitHub, qmake, qttools, qttranslations }:
+{ stdenv, mkDerivation, lib, fetchFromGitHub, qmake, qttools, qttranslations }:
mkDerivation rec {
pname = "gpxlab";
@@ -18,6 +18,12 @@ mkDerivation rec {
lrelease GPXLab/locale/*.ts
'';
+ postInstall = lib.optionalString stdenv.isDarwin ''
+ mkdir -p $out/Applications
+ mv GPXLab/GPXLab.app $out/Applications
+ wrapQtApp $out/Applications/GPXLab.app/Contents/MacOS/GPXLab
+ '';
+
enableParallelBuilding = true;
meta = with lib; {
@@ -29,6 +35,6 @@ mkDerivation rec {
'';
license = licenses.gpl3;
maintainers = with maintainers; [ sikmir ];
- platforms = platforms.linux;
+ platforms = with platforms; linux ++ darwin;
};
}
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index 9a9edba512aade156261439ce0f0d9fb5c06b52b..d3d732f410fec492cc0b76b08f9cbdb910b3bda5 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -1,14 +1,14 @@
-{ mkDerivation, lib, fetchFromGitHub, qmake, qttools }:
+{ stdenv, mkDerivation, lib, fetchFromGitHub, qmake, qttools }:
mkDerivation rec {
pname = "gpxsee";
- version = "7.18";
+ version = "7.20";
src = fetchFromGitHub {
owner = "tumic0";
repo = "GPXSee";
rev = version;
- sha256 = "1z3knfqfv0rwsq66adk0qngw1r500yvy4z259bygqkzbn2l5fcjk";
+ sha256 = "08scvhhdadzz9iydhpkn2k618bgw26z09y6nydi3hi8fc3xfnb8d";
};
nativeBuildInputs = [ qmake ];
@@ -18,6 +18,12 @@ mkDerivation rec {
lrelease lang/*.ts
'';
+ postInstall = lib.optionalString stdenv.isDarwin ''
+ mkdir -p $out/Applications
+ mv GPXSee.app $out/Applications
+ wrapQtApp $out/Applications/GPXSee.app/Contents/MacOS/GPXSee
+ '';
+
enableParallelBuilding = true;
meta = with lib; {
@@ -29,6 +35,6 @@ mkDerivation rec {
'';
license = licenses.gpl3;
maintainers = with maintainers; [ womfoo sikmir ];
- platforms = platforms.linux;
+ platforms = with platforms; linux ++ darwin;
};
}
diff --git a/pkgs/applications/misc/grip/default.nix b/pkgs/applications/misc/grip/default.nix
index 4416e1e62c2d3a1a05cb17fb9ee1804bf50cc8ec..b70901bac8105f3f1e645fadb38f3071d13ab564 100644
--- a/pkgs/applications/misc/grip/default.nix
+++ b/pkgs/applications/misc/grip/default.nix
@@ -2,11 +2,11 @@
, curl, cdparanoia, libid3tag, ncurses, libtool }:
stdenv.mkDerivation rec {
- name = "grip-4.0.1";
+ name = "grip-4.1.0";
src = fetchurl {
url = "mirror://sourceforge/grip/${name}.tar.gz";
- sha256 = "0blh5j3d4g16bhsqmhv71qhbsyyzcqywzpqsjjiiw465mjlwxka6";
+ sha256 = "0iy7bcyrxm7zyrxah06qyxdshkgq6yqkadlw211j2qzld38a79j5";
};
nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/misc/heimer/default.nix b/pkgs/applications/misc/heimer/default.nix
index 5f403c9b7b6f81adb9b941a0c26bd11b5b312e29..fe74634915570fb1602128a22df7b1db01478f63 100644
--- a/pkgs/applications/misc/heimer/default.nix
+++ b/pkgs/applications/misc/heimer/default.nix
@@ -2,13 +2,13 @@
mkDerivation rec {
pname = "heimer";
- version = "1.13.1";
+ version = "1.15.0";
src = fetchFromGitHub {
owner = "juzzlin";
repo = pname;
rev = version;
- sha256 = "1s6s5rlzr917hq7370pmikbdvd6y468cyxw614ah65d4v105qfv7";
+ sha256 = "1qh8nr6yvxiy8pxl5pkhzlfr7hanxxc8hd8h00gsdxa0vgmqz11q";
};
nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/hivemind/default.nix b/pkgs/applications/misc/hivemind/default.nix
index e452ec0511e75da7027b4470b2d7bc7105fda014..b3fb84340f21288c403522d53cfb2708cd925c9b 100644
--- a/pkgs/applications/misc/hivemind/default.nix
+++ b/pkgs/applications/misc/hivemind/default.nix
@@ -1,10 +1,14 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoPackage, fetchFromGitHub, runtimeShell }:
buildGoPackage rec {
pname = "hivemind";
version = "1.0.6";
goPackagePath = "github.com/DarthSim/hivemind";
+ postPatch = ''
+ substituteInPlace process.go --replace \"/bin/sh\" \"${runtimeShell}\"
+ '';
+
src = fetchFromGitHub {
owner = "DarthSim";
repo = "hivemind";
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index 69ca6a8376400f3fd9fd131223a2145225fa59aa..6ab297c6970012a5e2324ae90c9bc4d85e89d34c 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,7 +2,7 @@
buildGoModule rec {
pname = "hugo";
- version = "0.62.2";
+ version = "0.64.0";
goPackagePath = "github.com/gohugoio/hugo";
@@ -10,10 +10,10 @@ buildGoModule rec {
owner = "gohugoio";
repo = pname;
rev = "v${version}";
- sha256 = "1rdfx5gv0q64ivyg0ilb96p5nksip9cj75fmvw0bjky9w6i07yd9";
+ sha256 = "10zbi2414c9grqhi9vcj3sczjh7hf20dihvcsirj551fmiqxrvpy";
};
- modSha256 = "0dwv5qnglv00jj7vlps76zlfpkzsplf93401j2l03xfvmvadifrs";
+ modSha256 = "18wfsp3ypfxj5qljmb19kzyc5byf413nkabz5mfvq8srjhcq1ifl";
buildFlags = [ "-tags" "extended" ];
@@ -23,6 +23,6 @@ buildGoModule rec {
description = "A fast and modern static website engine.";
homepage = "https://gohugo.io";
license = licenses.asl20;
- maintainers = with maintainers; [ schneefux filalex77 ];
+ maintainers = with maintainers; [ schneefux filalex77 Frostman ];
};
}
diff --git a/pkgs/applications/misc/ikiwiki/default.nix b/pkgs/applications/misc/ikiwiki/default.nix
index 957f0f7f68bbb8600882c3494329b2e325e48228..8b908f1f9cf29e4dae4cbfde53c79063bbae47be 100644
--- a/pkgs/applications/misc/ikiwiki/default.nix
+++ b/pkgs/applications/misc/ikiwiki/default.nix
@@ -19,7 +19,7 @@ assert mercurialSupport -> (mercurial != null);
let
name = "ikiwiki";
- version = "3.20170111";
+ version = "3.20190228";
lib = stdenv.lib;
in
@@ -27,8 +27,8 @@ stdenv.mkDerivation {
name = "${name}-${version}";
src = fetchurl {
- url = "mirror://debian/pool/main/i/ikiwiki/${name}_${version}.tar.xz";
- sha256 = "00d7yzv426fvqbhvzyafddv7fa6b4j2647b0wi371wd5yjj9j3sz";
+ url = "mirror://debian/pool/main/i/ikiwiki/${name}_${version}.orig.tar.xz";
+ sha256 = "17pyblaqhkb61lxl63bzndiffism8k859p54k3k4sghclq6lsynh";
};
buildInputs = [ which ]
@@ -44,7 +44,11 @@ stdenv.mkDerivation {
++ lib.optionals subversionSupport [subversion]
++ lib.optionals mercurialSupport [mercurial];
- patchPhase = ''
+ # A few markdown tests fail, but this is expected when using Text::Markdown
+ # instead of Text::Markdown::Discount.
+ patches = [ ./remove-markdown-tests.patch ];
+
+ postPatch = ''
sed -i s@/usr/bin/perl@${perlPackages.perl}/bin/perl@ pm_filter mdwn2man
sed -i s@/etc/ikiwiki@$out/etc@ Makefile.PL
sed -i /ENV{PATH}/d ikiwiki.in
@@ -83,6 +87,5 @@ stdenv.mkDerivation {
license = stdenv.lib.licenses.gpl2Plus;
platforms = stdenv.lib.platforms.linux;
maintainers = [ stdenv.lib.maintainers.peti ];
- broken = true; # https://ikiwiki.info/bugs/imagemagick_6.9.8_test_suite_failure/
};
}
diff --git a/pkgs/applications/misc/ikiwiki/remove-markdown-tests.patch b/pkgs/applications/misc/ikiwiki/remove-markdown-tests.patch
new file mode 100644
index 0000000000000000000000000000000000000000..c981857a248b2f2816d81175a1c39d897b9331fd
--- /dev/null
+++ b/pkgs/applications/misc/ikiwiki/remove-markdown-tests.patch
@@ -0,0 +1,37 @@
+diff --git a/t/mdwn.t b/t/mdwn.t
+index ca3180139..d64750403 100755
+--- a/t/mdwn.t
++++ b/t/mdwn.t
+@@ -16,32 +16,17 @@ is(IkiWiki::htmlize("foo", "foo", "mdwn",
+ "C. S. Lewis wrote books\n"),
+ "
C. S. Lewis wrote books
\n", "alphalist off by default");
+
+-$config{mdwn_alpha_lists} = 1;
+-like(IkiWiki::htmlize("foo", "foo", "mdwn",
+- "A. One\n".
+- "B. Two\n"),
+- qr{A. One\sB. Two
\n}, "alphalist can be disabled");
+
+-like(IkiWiki::htmlize("foo", "foo", "mdwn",
+- "This works[^1]\n\n[^1]: Sometimes it doesn't.\n"),
+- qr{
This works\^1}, "footnotes can be disabled");
+
+-$config{mdwn_footnotes} = 1;
+-like(IkiWiki::htmlize("foo", "foo", "mdwn",
+- "This works[^1]\n\n[^1]: Sometimes it doesn't.\n"),
+- qr{